The Heisenberg Compensator

Non-Technical Wonderings: Teaching and Groups

2015-02-14T15:58:00.000-05:00

I remember in my Undergraduate Programs how much I hated group work. Your group wasn't always in sync with you, and sometimes interpersonal communication became a royal issue. Of course, an instructor was trying to teach you to have the ability to work together, because sometimes (i.e., the real world) you have to work with people that you don't like, or that aren't as capable as you.

When I completed my Graduate Program, I realized how much I loved the group work. Maybe it's because everyone felt they had to be there as an Undergrad, but those in the Graduate program actually wanted to be there. They were, on the whole, willing to put forth the effort to do what was needed to be done. And as a group of working adults, you could communicate with each other, and figure out what you needed to have done in a timely manner.

Now, speaking as an Instructor for an Undergraduate Program, I still want to do Group Work as relevant for the reasons I've mentioned above. But it's difficult to see a group have some failures because of minor shortcomings that get overlooked due to those interpersonal issues. Every single person misses a question because one person didn't do the task accordingly. There's something to be said in group failures and group successes, but, I don't know that I agree with the idea that a group should have issues because one person makes a minor mistake. But to rectify that, every member of the group should be looking over each other for mistakes. Again, that's the idea of group work.

I suppose it's a mixture of having the available resources to accomplish a task, versus making group coordination and communication a part of that task. I suppose I've always appreciated the idea of group work, but in practicality with a time crunch involved, I wonder if it's feasible.

Cisco ACS Migration 4.2.x to 5.6, continued

2015-02-03T09:37:00.001-05:00

Well, hopefully you'll read this post before you start your own journey through the migration process. Because it'll save you a lot of time. This posting might be a bit more 'ranty' than it is technically helpful, but I've been working through a lot for the past few days. I'll still include valuable links where available.

In the last posting I made, I provided information, links, and possible components that you should consider when making the migration from ACS 4.x to 5.6.

Let's catch you up on where I am.

After obtaining console access to the Windows Virtual Machine, the migration utility still refused to run correctly. After doing some more digging, I found this piece of documentation regarding the migration utility for ACS 5.6, notably this piece:

The ACS 5.6 migration utility is not supported on Windows 2008 64 bit.

Well. Grand.

After doing a bit more research, I found that ACS 5.4 and ACS 5.5 have no such warnings about their migration utilities. So now, we take the ACS Appliance that we have, and attempt to downgrade it from ACS 5.6 to 5.4. Except that in this documentation and in this documentation (and trial and error), you cannot install ACS 5.4 on the 3495 Apppliance. So now, we move on to ACS 5.5, which is supported on the 3495.

So now, back to where we have been originally. Re-download the migration utility from ACS 5.5, make sure to configure the ACS unit for the web-based migration utility (see previous post), connect to the console of the Windows 2008 x64 Virtual Machine, and attempt to connect.

You can probably tell from my enthusiasm that it didn't work. Which, at that point, I've exhausted every forum post and blog post relevant to this process, so, we turn to the Cisco support forums:

CSCtn17779 Bug was noticed, Run the migration machine on Windows 2003 32-bit.

And there you have it. I don't have access to a Server 2003 x86 server, so I can't test the validity of the statement.

Cisco ACS Migration, 4.2.x to 5.6

2015-01-21T21:49:00.002-05:00

So it's been a while since I've written anything, and that's mostly because the majority of things I work on are now considered classified, internal, or confidential. It makes it difficult to write topics on concepts when you're not 100% certain the public can know anything about it.

This however, I'm relatively certain I'm good to work with.

So the company that I'm working with now is in the process of migrating some of their ACS servers from 4.2.x appliances to 5.6 appliances. Cisco has a pretty comprehensive guide on the process here. One of the major issues that comes from 4.2.x on an appliance versus a Windows server comes from the fact that you need an NT Agent on a Domain Member server so that it can connect to Active Directory accordingly. On a Windows Server, the NT Agent is local, so it's not a worry. Well, Secure ACS 5.6 no longer needs that Windows NT Agent, it can just point directly at the LDAP server--great!

Except that we also have another major issue by having appliances. In order to migrate the database from 4.2.x to 5.6, you must first export the database from the appliance to a Windows Server, so that you can run the migration tool against it.

Which means that to migrate, you'll need:

Your source ACS Appliance
Your Windows Server to host the ACS Application
A Windows version of ACS
Your 5.x Appliance or Virtual Machine
A series of helpful web links

Which is one of the reasons we have this blog post, is to provide a series of helpful web links, and share some of my infuriating issues.

Most of everything comes from this link, the Migration guide from ACS 4.x to 5.6. You'll also want to know how to re-image the appliance in the event that you blow it up.

Now, Cisco offers a full version of ACS 4.2 that's a trial to download, so as long as you have a support contract you'll be fine there.

This leaves you needing a Windows Host to run the software on. And...according to our documentation, ACS 4.2 runs on Windows Server 2008 x64. Note: Not R2. This was a huge problem in our environment, because their bare minimum standard for Windows Servers was Server 2k8R2. And because it's larger corporate politics, that meant lots of paperwork, lots of documentation, lots of justification, and someone's time to spin off a new Virtual Machine for me.

While waiting on the Virtual Machine spin-up, it's a good time to bring online the ACS Appliance for 5.6. Important note that I discovered during installation: the NTP server (or it was the gateway) must be reachable while loading the IP settings, or else you'll have to re-image it from scratch. Not sure why, but that's what I had to end up doing.

Once you have your ACS 5.6 appliance or virtual machine running, complete with remote accessibility, you can begin your migration. After waiting for your Windows Server to be built, loaded with Java, and imported from a backup, you're ready to begin.

First, download the migration utility from the ACS Appliance and load it on your Windows Server.

Next, when connecting, specify a username and password and connect accordingly.

Then, after troubleshooting the connections and available configuration settings, spend several hours tearing your hair out trying to further troubleshoot why the connection continues to fail for no reason. Then you find an obscure post on a German Cisco forum that leads you to this link. The point of reference that made me nearly scream was this:

Remote Desktop Support
The Migration Utility does not support Remote Desktop Connection. You must run the Migration Utility on the migration machine; or, use VNC to connect to the migration machine.

So make sure when trying to run the migration utility, you don't RDP into your Virtual Machine. You have to VNC into it, or get some local hardware to run it off of.

Edit: On to the next issue....(You'll want to read that post if you haven't already)

Cisco ASA-SM: ASDM won't load

2014-06-11T14:06:00.001-04:00

So I'm in the process of trying to migrate from the Cisco PIX Series Firewalls to the ASA Series, configured in roughly the same format and style until we can re-migrate to the Zone-Based firewalls. Well, today, I ran into an interesting issue that I couldn't find much support on.

So, these were Cisco ASA-SM (Adaptive Security Appliance Service Modules) loaded into a 6500-E Series. After the device is configured for allowing the appropriate connections, I wanted to load up the ASDM to see the differences in how NAT translations were done (Bi-directional as opposed to Unidirectional).

Except that I couldn't get the ASDM to load. In fact, it wasn't even listening on tcp/443.

As it turns out, for the ASDM to load, you need some additional components. But first, for the uninitiated, how do we set up the ASDM?

You'll find a million posts from Cisco or Blogposts from other users showing you how this is done, so, this should be review. For a brief post on how to configure the ASDM, read here.

Since this is an ASA-SM, out of the box we can session into the blade and configure it from there. You could use telnet or SSH, but since I'm in the process of still building it, I haven't gotten that far yet.

YourRouter#session slot 6 processor 1

Since my routers are in a VSS pair, I use this command:

MyRouter#session switch 2 slot 6 processor 1

This command tells the router that we want to session into the blade, as if we were at the console (session), which switch in the VSS pair I want (switch #, optional due to your configuration), which slot the blade is loaded into (slot #), and which processor I want to use (processor #).

After you connect to the device, go to the enable mode, and then configure mode.

This, of course, assumes that you have built an interface on the ASA-SM. If you haven't, you'll need to do that first. To configure the device to allow you to connect on http:

yourasa(config)# http server enable

yourasa(config)# http your_subnet_number your_subnet_mask interface

And that's all there is to it! Right?

Except what happens when it doesn't work? Here's where I was, tearing my hair out.

Cisco has some available documentation on troubleshooting the ASDM:

https://supportforums.cisco.com/document/57701/asdm-access-troubleshooting

http://www.cisco.com/c/en/us/support/docs/security/adaptive-security-device-manager/110282-asdm-tshoot.html

http://www.cisco.com/c/en/us/support/docs/security/adaptive-security-device-manager/116403-configure-asdm-00.html

And others. The first one gave me some good insight and commands, except for one that I couldn't run on the ASA:

show asp table socket

show asp table was present, but the socket option couldn't be found. When I ran an nmap scan against the device, it wasn't even listening on 443. So what gives?

As it turns out, for you to be able to access the ASDM, you have to download and install the free 3DES-AES key from Cisco, which just requires a Cisco user account. You can download it here:

https://tools.cisco.com/SWIFT/LicensingUI/ipsCryptoPage

Under Security Products, you'll find the options for Cisco ASA 3DES/AES License. Once you agree to the terms and conditions, they should send you an e-mail containing the license activation key.

How can you confirm that you don't already have the 3DES-AES license? Run show version, and look for this:

yourasa# show version

[...]

Licensed features for this platform:

Maximum Interfaces : 1024 perpetual

Inside Hosts : Unlimited perpetual

Failover : Active/Active perpetual

DES : Enabled perpetual

3DES-AES : Disabled perpetual

Security Contexts : 2 perpetual

yourasa#

Once you input the activation key, you should see this:

yourasa# show version

[...]

Licensed features for this platform:

Maximum Interfaces : 1024 perpetual

Inside Hosts : Unlimited perpetual

Failover : Active/Active perpetual

DES : Enabled perpetual

3DES-AES : Enabled perpetual

Security Contexts : 2 perpetual

GTP/GPRS : Disabled perpetual

Botnet Traffic Filter : Disabled perpetual

We had to do an additional command to confirm that it would use the 3DES-AES in the SSL configurations:

yourasa(config)# ssl encryption rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1

Once that command was placed in, the web page loaded right away, and allowed us to connect to the ASDM.

So there you go, hopefully that helps you in your own configurations and troubleshooting for the ASDM and your ASA-SM.

Writing More!

2014-06-01T10:03:00.002-04:00

So I've finally been given the opportunity to write more.

Well, not quite.

I've finally given myself enough reason and motivation to write more.

That's better.

So, this is my continued attempt at a technical blog. Here, I write down things that I know, learn, and experience for the general-knowledge and well-being that I share with others. As I experience problems, I want to write them down.

So, what am I talking about today?

A colleague of mine and I were talking the other day, and he mentioned to me Windows Azure. So, let's back up a moment before we dive in.

The company that I own (Shameless link) has an Ubuntu 12.04 Linux box hosted by Rackspace so that we can do development. It hosted Web Services (Apache), E-mail Services (Postfix, Courier, SASL Authentication/Encryption, SpamAssassin), Database Services (MySQL, PostgreSQL), and a Mumble server. And all-in-all, it worked fine. We had a Team Foundation Server rented by another company, and added bandwidth, the two services was about $32 a month. We weren't using the TFS service as much as I wanted, so I had looked at killing it, but it wasn't until recently that Visual Studios had integration with Git that I felt that we could change hosting.

Back to the present day.

A colleague of mine and I were talking the other day, and he mentioned to me Windows Azure. In our conversations, he explained what he used it for, how much database and web page space he uses, and basically mentioned that it was for pennies on the dollar. So, in conversation, I learn that he obtained Microsoft Windows services for pennies on the dollar every month. So, I try to be a reasonable business man, let's take a look into it.

Boy, was I impressed. And it's even better than that.

The general notion behind 'cloud' services is that you can host web sites, databases, virtual machines, and more, in a virtual environment. But Microsoft, being the large proprietor of software that they are, made available their resources.

If you sign up for Windows Azure, what can you get?

Free:

10 Web Sites per region.
10 Mobile Services with a 20MB SQL Database with up to 500k API calls.
An implementation of Active Directory* for up to 500k objects.
100k Notification pushes to active devices

*It's not a full Active Directory environment as you would see in a normal infrastructure, it's more of a user database, but you can't bind hosts to it.

So wow, for free, that's pretty impressive, especially for developers. I'm trying to cut costs, and they can run virtual machines, let's see what I can get for $32 a month with respect to my environment:

I could get two 'Extra Small' Windows VMs, with 1Ghz CPU and 768MB of RAM for $26.79
Two 'Extra Small' Linux VMs, with the same specifications for the same price.

Pricing calculator here

So, for the cost I'm already incurring, I could build two boxes at the same cost, regardless of Operating System, and have it hosted. At this point, I was feeling pretty confident in this move, because we get the free resources on top of the purchased resources.

So I talked to my business partner, because when you're co-owned you don't make decisions like this by yourself, and he agreed once I laid out the details for him.

So, we signed up, and started spawning new virtual machines; they were ready in minutes. They had a public IP address, a public DNS name, a public firewall with port translations available, and the resources I had above.

Boy, was I impressed. Don't get me wrong, there's nothing wrong with Rackspace. In face, their management of DNS made it quite easy to get services going, and in general I had no problems with them. This was just better.

So where does it get even better than that?

Last year, the company applied to become a Microsoft BizSpark partner for software development. We have a few major applications that we want to write and sell, and it was difficult to do so because to create them, we needed licenses of things. And after explaining what we wanted to do, we were approved and joined the BizSpark community.

At first, BizSpark was great for us for licenses--Visual Studios, versions of Microsoft Windows for us to test our software on, and copies of different applications offered by Microsoft, which included but not limited to, Microsoft Exchange, SQL Server, Team Foundation Server, BizTalk Servers, and so much more. I estimated it was well over $500,000 in software licensing.

But we had no hosts to run these things on.

Now we do.

Because being a BizSpark partner, and joining Microsoft Azure, they give us $150 in credits a month.

A virtual machine was ~$13.

I can now cut my hosting costs down, spin up new virtual machines, and get all of my hosted needs met so that we can actually code...without having to worry about counting pennies on things. When you have a finite budget...that matters.

This is where it was even better than that.

Because now I can spin up several extra-small virtual servers, host an internal Active Directory, IIS deployment, Exchange, and TFS...without being charged.

We can finally code the way we want to, without having to worry about the costs of doing so. This is exactly what BizSpark was designed to do, and because of Windows Azure we can do it.

This is where it was even better than that.

So my next few blog posts will be covering the state of things as I install and configure Windows Server 2012, and the related content from there.

Damn, I'm more excited by this than I should be.

New Life

2011-08-26T14:25:00.001-04:00

So I've decided to give this blog a new breath of life. Since then, I've changed positions and gained numerous experiences along the way, of which I plan to write about. Any content, documentation, images, or advice is freely posted, I'd just appreciate some credit if you used my solution, or if something you found was different in your configurations.

Disabling IPv6, Part Deux

2008-04-22T14:16:00.002-04:00

It should also be noted that apparently disabling IPv6 disconnects all of my SMB connections. Doing that change probably isn't the best of ideas, even though Microsoft didn't mention that part. I'm sure it's not their fault though.

IPv6

2008-04-21T17:14:00.004-04:00

I'd like to take this opportunity to thank Microsoft.

Thank you.

Now, for my reason: In Windows Server 2008, you cannot uninstall IPv6.

You can only disable it.

In the registry.

Good ole Windows. Here's the thing:

So I've been getting a massive amounts of failed security audits, event IDs 5157 and 5152. They happen in bursts. They're triggered by svchost, and they're destined for the bit bucket. The source IP address comes from 224.0.0.252 (multiclass) to 169.254.203.141 (private, used by Microsoft for null addresses). The cause of this is what is known as "Link-local Multicast Name Resolution," an IPv6 protocol that performs similar functions to DNS. Wikipedia places it best: "[a] packet format that allows both IPv4 and IPv6 hosts to perform name resolution for hosts on the same local link" (Source: http://en.wikipedia.org/wiki/Link-local_Multicast_Name_Resolution)

And performing a little research, I've learned that you cannot, in fact, uninstall IPv6 much as you can in XP & 2003, but instead, disable. And the only way to disable IPv6 traffic on Server 2008 is through Registry hacking. Here's the blurb from Technet: (bold emphasis my own)

Unlike Windows XP and Windows Server 2003, IPv6 in Windows Vista and Windows Server 2008 cannot be uninstalled. However, you can disable IPv6 in Windows Vista and Windows Server 2008 by doing one of the following:

•

In the Network Connections folder, obtain properties on all of your connections and adapters and clear the check box next to the Internet Protocol version 6 (TCP/IPv6) component in the list under This connection uses the following items.

This method disables IPv6 on your LAN interfaces and connections, but does not disable IPv6 on tunnel interfaces or the IPv6 loopback interface.

•

Add the following registry value (DWORD type) set to 0xFF:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents

This method disables IPv6 on all your LAN interfaces, connections, and tunnel interfaces but does not disable the IPv6 loopback interface. You must restart the computer for this registry value to take effect.

For additional information about the DisabledComponents registry value, see Configuring IPv6 with Windows Vista.

If you disable IPv6, you will not be able to use Windows Meeting Space or any application that relies on the Windows Peer-to-Peer Networking platform or the Teredo transition technology.

Thanks Microsoft. I appreciate it.

Debian Experience

2008-01-20T19:37:00.000-05:00

I'm now involved in a very interesting situation here in my home. My brother and I are going to redesign our network, and have a joint operation domain. So, for the time being, my domain controller plans are on hold until those commence. However, the reason for this came about when a friend of mine asked me to host a game server for his game. He asked me to do this for a variety of reasons:

1) I have the(sic:his) hardware.
2) I have the time.
3) I'd like the experience.

So, using his hardware, we're going to build a Debian Linux box. I've never used Debian before. This is going to be fun.

My configuration:
Abit IC7 motherboard, 2 gigs of PC2700 DDR, and 2x80gb SATA drives to be configured in RAID1 format.

I've spent a good portion of the day installing Debian, trying out some things, screwing up the file system or the partitions, when I finally came across this:

http://nepotismia.com/debian/raidinstall/

This is a very handy guide for creating a software RAID1 on the drives. It varied a bit from my configuration, but, it's not hard to modify. If anyone's ever looking to do what I've done, this is very handy.

I e-mailed Paul and thanked him.

Server 2008 Firewall

2008-01-16T11:08:00.000-05:00

Interesting problem discovered today.

Windows Server 2003 used the Firewall Service as a layer of software all network traffic used to pass through it. When you disabled the service, you disabled the firewall.

However, Server 2008 does this differently. The Firewall service is no longer an abstraction layer, but more similar to IPTables in Linux. The firewall service actually controls the settings of the firewall, it does not control the firewall itself. So, if you want the firewall turned off, you actually have to tell the firewall to turn off. Nice feature.

Windows Server 2008: Backups

2008-01-10T21:08:00.001-05:00

There's an old adage in IT: It's not the backups that are the problem, it's restoring them.. Whoever said that is entirely correct. Today was spent wrestling with the built-in functionality of Windows Server 2008 and backing itself up. Prior to 2008 was the NTBackup system. Now, as much of a pain in the ass NTBackup was, it still worked. My test network had the domain controllers built from the NTBackup commands, and it worked rather well when you knew what you were doing.

I suppose the same can be said for 2008, however, I've yet to figure out what the problem is. My goal: Full restore. I want to be able to load a system from scratch onto a blank machine from that backup. Windows Server 2008 allows for a full system backup, as well as system state.

Fantastic!, I think to myself. If I get this working in the short timespan I've got, I now have zero problems with loading it as the primary file servers! And we'll also know that the backup systems work!

Microsoft, you tease.

I'm tempted to call out 2008 and say that it sucks, yet, I'm sure that there's something I'm screwing up with the procedure. Only time will tell. So far:

+ I ran a full backup with system state and saved it to a remote share located on a Windows Server 2003 machine. Just for the hell of it, I shared every folder that was created. Every Folder. Booting a machine to a DVD and requesting to repair via the network location yields that the shared location contains no backups.
+ Using the same backup, I installed Server 2008 on the previously attempted server, and attempted the same thing, yielding the same results.

At first, I might've blamed drives. RAID controllers can be a pain in the ass, sometimes the Ethernet driver says it's connected when it's actually having difficulty, things like that. But even after that is all bypassed, it still couldn't do it.

If I can't get something working in the name of backups and recovery, I'm going to seriously doubt putting 2k8 into production. My next test for a situation like this is with the Veritas software and recovery of system state.

Windows Server 2008

2008-01-08T19:10:00.001-05:00

Over the past few days I've had the opportunity to test Windows Server 2008 in my environment. I'm looking at placing it on my primary file servers, as they're due up for replacement/migration/cleanup. So, I opted to write out some of the more interesting features I've noticed, those especially emphasizing benefit to our network.

Distributed File Shares
Think symbolic links. Instead of mounting a \\server\share\folder\folder\folder, instead, you mount a \\namespace\folder. This, however, does not work with MacOS clients right out of the box. Doing some research, you can download some apps that will allow you to mount a virtual DFS share, but to load an application to every single Mac on our campus is too much of a pain in th ass. So, essentially, DFS goes off of the priority list.

File Quotas
Windows Server 2003 maintained file quotas per user per partition. So, if Guy A was a member of five AD groups that have access to 15 folders, he could save up to the quota limit--regardless of where he saved them. The owner of the file was also important: If Guy B creates a file and gives it to Guy A, to which he places it on the file server--the file counts against Guy B. In essence, the file quota system sucked.

However, in Server 2008, this has been rectified, which was one of the primary reasons I wanted to wait for 2k8. File Quotas can now be managed multiple ways: Per folder, user/AD Group, or share. (I'm not entirely sure if the AD Group portion is true, to which I'll double check tomorrow. ) So, if I have Department A, Department B, and Department C, with the three departments sharing members, I no longer have to worry about who is saving what to which folder. Fantastic.

TCP/IP Printing
Today was also an experiment on network printing. Our Lead Tech spent several months putting into place an easy-to-use networkable printer system. Well, let me clarify that: It's easy to use if you understand how networks work. You know, DNS translation and DHCP. In short, I give a website a MAC Address and a hostname, the website feeds both to a DHCP scope, and viola'. When you plug the printer in, it has the IP Address. Configure the queue to the network information, and you're in. Now it's simpler. Sort of.

Server 2008 will automatically detect any printer on the network based on hostname or IP address. Put it online, done. The website he designed won't change much, but now detection is drastically simpler: It knows what model printer it is and loads the necessary driver.

IIS 7.0
Another change was IIS. Since I'm not a web programmer, nor did I have any websites to port over to the test environment, I don't have a proper evaluation for it. However, from the new features (comparing 6.0 to 7.0), I did like some of the newer authentication procedures.

Read Only Domain Controllers
This is something I'd love to implement strictly because it's new. Unfortunately, we don't have a need for it. Basically, you have a domain controller that has only has the capability to read active directory--it cannot change a thing. This is perfect for offsite locations outside of the primary IT center, somewhere that doesn't have the constant security an Operations room would(might/should) have.

Access Enumeration Lists
This one was slick. One of Microsoft's "mottos" for security is Security through Obscurity; in short: If you don't know its there, you can't hurt it--much like the Ostrich. Well, this took a new turn. File Enumeration basically controls what you can and cannot see based on permissions. If you have the capability of opening the file/folder, you can see it. If you can't, then you got nothing. The one thing that I was impressed was that it works with Mac as well. I loaded up my Mac with 10.4 and mounted the fileshare, lo and behold I could only see the share the account had access to. Unfortunately, I haven't perfected it yet, but, this is roughly what I've come up with:

The Share$ gets Authenticated Users. Example: Filestore$
The Initial Folder gets Authenticated Users. Example: A (Usernames that start with A)
The Sub Folders get Domain\Administrators, and Domain\%Username%.

By doing it this way, the user can see the path up to the share, but only that. This is inclusive to Mac users. And by combining this with Directory File Share, I can set their login scripts to load \\domain\username$, which points to \\server\share$\folder\folder\. And since the initial share is hidden ($), just browsing the hard drive won't reveal it's location on the file server. I have to play with this more, of course.

However, it doesn't eradicate the problem entirely. Browsing the server still shows all root folders up until the share. This could be corrected by creating AD Groups that only have specific access to those shares, however, this would clutter AD to the point where I'd need a separate OU just to keep it straight. Well, maybe. Let's think about this.

ALL_USERS has access to the entire share. It's membership is "Authenticated Users." In all reality, this isn't necessary, since you can just go for "Authenticated Users."
FILE_STORE_A has access to only the folders under folder named A. It's membership is all users whose username begins with A.
Under folder A is a separate folder for each user. The membership is based on %Username%.

If it needed to go deeper, reverse the order of the AD Groups, adding A to FILE_STORE_A, which is a member of FILE_GROUP, which is a member of ALL_USERS. Might get confusing, but, if you had a treespan of it, it doesn't look that bad. I might just pass it by my coworkers for the sake of security.

Overall, Windows Vista may be a huge flop, but, Windows Server 2008 looks to be very promising. I look forward to promoting it to Domain Controller level and have it start controlling DHCP/DNS on the test network, just for the sake of testing purposes.

File Shares

2008-01-06T23:52:00.000-05:00

Now that I've created a series of accounts, and added another account to the Domain Admins AD Group (default group set by Windows that allows almost as much domain control as Administrator does), it's time to set up another basic premise in a domain:

File shares.

Since I don't have a dedicated server for file shares, I'll have to impose another huge security risk by placing the fileshares on the Domain Controller itself. When available, I'll move them to another server, but for the current time--here they be.

I created a folder in the Root of C:\ called "Fileshares", and shared it out, adding the $ to the share, hiding it. I also modified security permissions on it, saying that the Authenticated Users AD Group has full control, but removing Everyone. This gives control to anyone who authenticates as a user within my domain to access this folder, and only them.

Going back to Active Directory Users and Computers, modify the properties on each object (in this case, the user accounts). Under the Profile tab, opt to use the Connect: option, mapping a drive letter to a folder located somewhere on the domain. Using the absolute folder structure, \\servername\sharename$\foldername is the naming convention. Since they're only mapping one drive, a logon script won't be necessary, however, with the addendum of a webserver coming later, I'll explore that option in the future.

I've opted to name the shares based on the username, keeping it simple; This is the user's personal share. After all the shares were created, I wanted to modify permissions on each folder, so that they couldn't access the contents of one another's drives. Whats the point of having separate folders when you can view them all? So, modify the folder, and under the Security tab, click Advanced. Still under Permissions, I've removed the check box for "Allow inheritable permissions from the parent to propage tot his object and all child objects. Include these with entries explicitly defined here." When prompted to copy or remove the permissions, I chose remove. I'll define the permissions thank you very much. Now we're left with only two permissions: Domain\Administrators, and the user account. Perfect. Only the admins and the user can access the folder. Everyone can see it, which is a danger, but for right now it'll do.

Initial Setup

2008-01-06T22:21:00.001-05:00

Alright. So now that I have some free time, it's the first technical post: Initial Setup.

My Setup:
Currently under my control are three working computers:
Rescate - A computer given to me by a friend of mine.
SweikataServ1 - My Domain Controller
Leviathan - My computer.

Outside of my current workspace is a laptop, Glitch, and two as of yet unnamed unassembled computers. These two currently have no plans, and aren't powerful enough to really handle anything I have in mind for the future.

When I obtained Rescate, I knew I finally had the opportunity (and reason) to build my domain. So, let's begin with what I've accomplished so far:

SweikataServ1 is the primary domain controller. Windows Server 2003 requires at least 512mb of RAM to run, so make sure your hardware meets this requirement.

Installation of Server 2003 was marked as complete when the computer was updated to all available Microsoft Updates. To actually create a domain, under 'Run' type the command "dcpromo". This begins the Domain Controller Promotion, crafty eh?

Since this is my first domain creation, after reading some documents on how it should be done, I know I've done a lot of things incorrectly. So, to properly do it, I'm linking you to this.

Since I didn't follow these steps, my system is currently flawed. However, my situation is flawed: I'm not in control of my network, nor do I own the domain name sweikata.com. So, in essence, I've created just an internal domain. There isn't anything particularly wrong with this mind you, I'll just have to reconfigure some things when I do have control of the network (network referring to the physical topology, DHCP, etc.).

With my domain's inception, the first step I went for was creating a user account--not everything can be run as Administrator. Under Administrative Tools, you'll find Active Directory Users and Computers. From here, as long as you have Domain Privileges, you can control any objects in the domain.

Since my domain isn't that expansive, I'll keep everything under the root of sweikata.com, however if I learn of more security procedures that dictate otherwise, I'll move it. I created an Organizational Unit (or OU for short) called User Accounts. From here, I've created all the accounts I feel necessary. Depending on your mindset on creating accounts, I opted for standard naming conventions for user names: lastname+first_initial+number. This guarantees standardization as well as keeping objects straight. I absolutely cannot stand user accounts like "smithj", proceeded by "smithjo", then by "smithjoe". It looks abhorrent.

So, the first account: Michael Sweikata (account name sweikatam1). And here I run into my first error: "Windows cannot set the password for (username) because: The password does not meet the password policy requirements. Check the minimum password length, password complexity, and password history requirements."

Well shit. I haven't set those yet. So, before creating the account, we must first define the parameters of the account. This is done under the Group Policy Editor. Back under Administrative Tools, I've altered the Default Domain Controller Security Settings. As we define and edit them further, we'll revist them. Each option explains what it's purpose is, and gives you a default value. Set them accordingly as you like, I left the maximum password age to be 42 days, with the minimum to be 1 day. The password length is to be 7 characters, and 0 passwords are remembered under the Enforce password history. The final step is to enable the option for complexity requirements. After this is complete, I can now create accounts.

Aside from standard naming accounts, I also created a test account that will not be a member of any AD Groups. It's meant for testing security.

Initial Creation

2008-01-06T22:05:00.000-05:00

I decided to create a blog on blogspot to document my developments as I encounter them. This way, in case someone else decides to do what I have done on their own, this might answer some questions for them.

What am I doing?

In short: Creating a domain.

In long: Creating a domain inside my home with the basis of exploring Active Directory, File & Print Sharing, User Account creation and control, eventually an e-mail and web server, as well as looking at the possibilities for binding not only Windows computers, but Linux and Mac operating systems, and the trials that will ensue.

This may also document some of the more interesting finds I've come across at my own place of work. I'm a System Administrator for a University.

This ends the original post.