welcome to Sanioclement's Blog

Audit Policy in Windows 7 and 2008 R2

2011-06-05T09:39:00.000-07:00

Introduced granular auditing in Windows Vista and a few years later we released Advanced Audit Policy Configuration. Legacy Windows audit policy didn’t go away, of course. To make things interesting, all of this can be configured through domain policy, local policy, multiple-local policy, per-user, or using command-line tools. Like most security policy that has evolved through 20 years of Windows, it’s a bit of a Frankenstein’s monster. Making sense of what settings are actually in place in Win7 and 2008 R2 can be a real pain in the neck. Today we’ll see if I can make it easier.

Fire good!

A Scenario

You commonly configure audit settings using the following:

Domain based group policy (via GPMC.MSC)
Local policy (via GPEDIT.MSC)
Directly (only advanced audit policy, via auditpol.exe)

But depending on how you set the policy, your reporting tools may be misleading you around effective settings. For instance, I have specified the following policies using the following techniques.

1. I have a legacy audit policy applying from domain policy that configures Object Access auditing:

2. I have advanced audit configuration applying from domain policy that sets AD changes, account lockouts, and logons:

3. I have advanced audit configuration applying from local policy for process startup and termination:

4. I have granular audit settings configured using auditpol.exe /set for file share access:

Pro tip: this is not awesome auditing technique, on a number of levels. :) Just for demo purposes, mmmkay?

Initial Results

Now I generate a resultant set of policy report. I am not using RSOP.MSC as it’s deprecated and often wrong and generally evil. I run GPRESULT /H foo.htm instead:

Looks pretty good so far. I can’t see my policy that I set through auditpol.exe though; that kinda sucks but whatevah.

So now I start generating some audit events for the areas I am tracking from my four audit points. Immediately I see some weirdness:

All the advanced audit configuration coming from “Local Group Policy” and “Advanced Audit DC Policy” is working great.

My event log should be flooded with Object Access events but there are zero.
Accessing file shares doesn’t generate any audit events.

The lack of Object Access auditing is expected: as soon as you start applying Advanced Audit Configuration Policy, legacy policies will be completely ignored. The only way to get a Win7/R2 computer to start using legacy policy is to set the security policy “Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings” to DISABLED. That disables the use of the newer policy type.

Not seeing the File Share events makes sense too: after all, I created domain based and local policy to set all of this; they are just blowing away my local settings, right?

Yes and no.

First, I delete my link for the “Advanced audit DC policy” and run GPUPDATE /FORCE. Now I am only getting local policy settings for process creation and termination as expected. If I then re-run my auditpol /set /subcategory:”file share” /success:enable command and access a file share, I get an event. Yay team. Except after a while, this will stop working, because the local policy setting is going to reapply when the computer restarts or every 16 hours when security policy is reapplied arbitrarily.

Here’s where things get weird.

Unlike most security settings that directly edit registry keys as preferences, advanced audit policy stores all of its local security policy values in an audit.csv file located here:

%systemroot%\system32\grouppolicy\machine\microsoft\windows nt\audit\audit.csv

Which is then copied here:

%systemroot%\security\audit\audit.csv

But the domain-based policy settings are in an audit.csv in SYSVOL and that is never stored locally to the computer. So examining any of them is rather useless. Unfortunately for you, those audit.csv files are what RSOP data is returning, not the actual applied settings. And if you use legacy tools like SECEDIT.EXE /EXPORT it won’t even mention the advanced audit configuration at all – it was never updated to include those settings.

The Truth

All of this boils down to one lesson: you should not trust any of the Group Policy reporting tools when it comes to audit settings. There’s only one safe bet and it’s this command:

auditpol.exe /get /category:*

Only auditpol reads the actual super-top-secret-eyes-only-licensed-to-kill-shaken-not-stirred registry key that stores the current, effective set of auditing policy that LSASS.EXE consumes:

HKEY_Local_Machine\Security\Policy\PolAdtEv

If it’s not in that key, it’s not getting audited.

Before you get all excited and start plowing into this key, understand that this key is intended to be opaque and proprietary. We don’t really document it and you certainly cannot safely edit it with regedit. In fact, as an experiment I once renamed it in order to see if it would be automatically recreated using “default, out of box” settings. Instead, the computer refused to boot to a logon prompt anymore! I had to load that hive using regedit in WIN PE and name it back (Last Known Good Configuration boot does not apply to the Security hive). If you want to write your own version of auditpol you use the functionAuditQuerySystemPolicy (part of the gigantor Advapi32 library of Authorization functions; have fun with that goo and don’t call me about it, it’s grody).

As a side note - if you want a safe way to remove auditing settings you can easily clear that registry key by running auditpol /clear and removing policy. That puts you to “nothing”. If you want to restore to “out of the box” experience you would useauditpol /backup on a nice clean unadulterated repro computer that was installed from media and never joined to a domain. That gives you the “before”. Then if you ever want to reset a computer to OOB you auditpol /restore it.

Until next time.

Ned “Wait. Where are you going? I was going to make Espresso!” Pyle

Installing Windows on an External Hard Drive

2011-04-02T00:51:00.000-07:00

1.Check that the size of the external hard drive meets the system requirements of the Windows operating system. Windows XP requires 1.5 gigabytes of free hard drive space. Windows Vista requires 20 gigabytes (for the Home Basic edition) or 50 gigabytes (for all other editions). The system requirements for older, outdated versions of the Windows operating system, such as Windows Me and Windows 98, can be found on the official Microsoft Windows Web site (link in the Resources section).

2. Connect the external hard drive to the computer with which you plan to use the hard drive. Use the hard drive's original cables included by the drive's manufacturer. It does not matter what connectivity standard you use. Windows will automatically detect the external hard drive.

3.Click the Start menu in the lower left-hand corner of the PC screen and select My Computer.

4.Right-click the icon for the external hard drive. Click Format from the pop-up menu. Format the external hard drive in the NTSF format.

5.Insert the original Windows installation disk into your computer's CD-ROM drive. Close the Installation Wizard when it appears on the screen.

6.Return to the My Computer window from Step 3. Write down the drive letters assigned to the CD-ROM drive and the drive of your external hard drive. For the sake of this article, we will use the example of D:\\\\ being the external hard drive and E:\\\\ being the CD-ROM drive. These are typically the letters assigned to CD-ROM and external drives in the Windows operating system.

7.Click the Start menu button and select Run.

8.Type \"E:\\I386\\winnt32.exe /syspart:D: /tempdrive:D: /makelocalsource /noreboot\" (without quotation marks) and click OK. This launches the Windows installer file on the Windows installation disk in drive E:\\\\ and commands it to install on the D:\\\\ drive (your external hard drive). The Windows Installer Wizard screen will appear.

9.Select the Full Install option in the Windows Installer Wizard. You will then be guided through the Windows installation disk. Follow the on-screen prompts to complete the installation. Depending on the speed of your computer's processor, this may take several hours. Be prepared to enter important information, such as your Windows registration key to register your copy of the Windows operating system. Do not close the installation window until the installation process is complete.

10.Shut down the computer and disconnect the external hard drive. You can now use the external hard drive to boot up another computer using the installed copy of the Windows operating system.

How to Find out Applications consuming more CPU and RAM on Windows 7

2011-02-17T05:58:00.000-08:00

Geeks are always interested in knowing performance of computer , discovering applications eating up RAM catch the application causing problems. and consuming CPU usage. Here I share a real time process/thread activity tool so that we can

Windows 7 integrates number of tools to keep watch on process activities but why not use an universal standalone tool with which you can find out Applications consuming more CPU and RAM Memory on Windows.
With free program called “Process Monitor” from Microsoft (SysInternals) which doesn’t require installation. Very easy to use and monitor status of PC and find out resource sucking process and limit them manually.

Go to menu File and uncheck the item Capture events You can pause the monitoring process by Process Monitor.
Click on the button Clear toolbar (the sheet with the eraser) to erase all information previously recorded by Process Monitor;
Go to menu Options> Events Profiling, Put the check on the items Generate thread profiling events and Every 100 milliseconds, And click OK to configure the program so that it captures the execution of each process in the log;
Go to menu File and put the tick on the item Capture events to restart the monitoring process by Process Monitor;
At the end of follow-up, ie after using the programs referred to means test the appetite for resources, back in the main Process Monitor, go to the menu File and uncheck the item Capture events to stop the monitoring process;
Go to menu Tools> Process Activity Summary to view the list of registered processes by Process Monitor on CPU and RAM consumption.

Sort processes according to RAM usage now

How to Check if Your Gmail Account Has Been Hacked

2011-02-12T01:34:00.000-08:00

Step 1: Find the ‘Last Account Activity’ Section Your Inbox

At the bottom of your Gmail inbox there is a ‘Last Account Activity’ section. Click on ‘details’ to launch the full blown monitor.

Step 2: See who has accessed your Gmail account recently

Next, what you’ll see is a table of the most recent activity from your Gmail account. It shows you

How it was accessed (Browser/mobile etc)
Where exactly the IP address is (So you can do some further digging)
When it was accessed

Step 3: Understand the IP addresses – Has your Gmail really been hacked?

If you see IP addresses from different countries, don’t be too quick to panic. If you use any 3rd party services which hook-up to your Gmail account, they will almost certainly show up in your activity log. To do you own investigation, you can use DomainTools to identify the IP address. This will help you differentiate normal activity and your Gmail account being hacked.

Step 4: Understand the alerts – Google’s way of highlighting suspicious activity

Google will also do it’s fair share of monitoring, and will also alert you if it sees suspicious activity both in your inbox, as well as your recent activity log. When this happens, and the IP addresses look suspicious, it is advisable to play it safe, assume your Gmail account has been hacked, and change your passwords immediately.

Step 5: Sign Out All Other Sessions – If you forgot to sign out on a public computer

If you are worried you did not not sign out of a public computer, you can ‘sign out all other sessions’. This won’t fix any hacked Gmail accounts, but it will resolve any careless mistakes. This is also useful if you happen to lose your mobile phone and you want to ensure your email is not read by others.

Step 6: What to do if your Gmail account has really been hacked

The first thing you do is change both your password and security question right away. Then make sure your new choices are very secure. Google themselves have some really good tips . For example in the case of security questions:

Choose a question only you know the answer to – make sure the question isn’t associated with your password.
Pick a question that can’t be answered through research (for example, avoid your mother’s maiden name, your birth date, your first or last name, your social security number, your phone number, your pet’s name, etc.).
Make sure your answer is memorable, but not easy to guess. Use an answer that is a complete sentence for even more security.

So there you have it. A step-by-step guide on fully understanding Gmail’s account activity log, and how to check if your Gmail account has been hacked :)

Splashtop OS: Quick Boot Operating system for Web Surfing

2011-02-11T20:38:00.000-08:00

Splashtop OS is an operating system which boots instantly, specially developed for the OEM market and for accessing Web services in no time and lets you enter online world without entering Windows.

There are few manufacturers who provide this feature inbuilt into their products but now it is no more restricted to OEMs but even you can try it on your machine for free.

Splashtop OS is a light weight operating system which boots quickly and lets you connect to Internet quickly. Its simple and light weight because only thing it carries is web browser just like Google Chrome OS which is required to connect to Internet.

For whom is it?

It is suitable for netbooks or travellers who just want to check with emails or surf web instantly. Not limited to these but it is suitable for cyber cafes, friend or relative who understands little about Computers.

Installation is quite easy: You need Windows > Download a 2 MB Online installer which downloads complete OS (nearly 220 MB) and after complete installation, restart to boot Splashtop.

The full boot takes about 20 seconds, if you count the time from when the computer’s power button was pressed. If we consider just the operating system, the boot is done in about eight seconds.

The trick behind quick loading is to launch a custom Linux kernel that loads only the essentials so that the user can navigate through the Chromium web browser.

Use of the Splashtop OS is very simple. Despite that the base is Linux, you will have access to a full graphical environment like KDE. One of the few programs which can interact with the web browser open full screen by default, configured to use Bing search engine and Flash Player 10 installed.

For downloads, storage and new themes for the browser, USB flash memory will be needed, since the user has limited permissions to access the disk. When connected, the memory is automatically recognized. The system has a very simple file manager so that the user can view, copy, move or delete files on the USB disk.

Blogsolute Verdict about Splashtop OS

Despite being still in beta, Splashtop OS is an operating system stable and well developed, which did not show any fault during our tests. Although it is a bit limited, Splashtop OS seems to be a good choice for netbooks and other similar devices, as a quick alternative to surf the internet.

The startup time is impressive: after pressing the Power button takes 20 seconds for the system is ready for use.

Integration with Bing may be a problem for some users, but it is possible to configure Chromium Google or other search engine.

The configuration tools of Splashtop OS is easy to use and self explanatory, taking only the essentials to eliminate distractions or confusion by the user. The downside is the import feature of Mozilla Firefox bookmarks, did not work during our tests.

Automatically Backup Files & Folders to USB Drives

2011-01-13T21:27:00.000-08:00

If you are storing lot of important data on your system then loosing this data is a big set back. To prevent this we have to backup these files regularly. But there are times when we forget to perform these tasks and as a result we may have to suffer great loss.
If you constantly keep forget to backup your data, Drive back up is a small utility that can be of great help. Similar app we covered was to copy USB drive silently.

Drive Backup is a freeware windows application that can automate backup tasks once configured. Using this application is very easy. First thing that you have to do is to setup the usb drive you want to use as backup drive.

You can also use this application to backup usb drives to your hard disk. This task can be switched from the 2 modes present in the application.

Once the above things are set, you can select files and folders to backup. Files and folders added to the backup drive are processed instantly at background.

How to Unlock Protected PDF – Select, Edit, Print in Best Ways

2011-01-04T05:24:00.000-08:00

The standard PDF security allows passwords at two levels.
‘user password’ – password for opening the pdf file.
‘owner password’ – for restricting printing; copying text, decrypting graphics, adding or modifying text notes, fields
There are times, when the owner forgets or have lost the actual password. In these cases, where has valid legal reason, follow the below methods. Please respect copyright laws and stay away from legal issues by unlocking unauthorized files.
Commercial Solution : Advanced PDF Password Recovery from ElcomSoft and PDF Password Remover from Very PDF are best commercial products. But, we are here to talk about free ways.
PDFCrack is a GNU/Linux open source (GPL) PDF password cracker for recovering owner and user passwords. PDFCrack is command line driven tool. PDFCrack version 0.8 is the latest version that has been ported to Win32 platform, and has been tested to work PDF version 1.6 from Adobe Acrobat version 7.0 with 128-bit AES encryption support.
- Download Linux source version.
- Download Windows pdfcrack-0.8-win32.zip.

If you are just looking to bypass ‘owner password’ for printing. Below are the various working ways.

Method 1: With Ghostscript and GSView.

Download and install Ghostscript, an interpreter for the PostScript language and for PDF.
Download and install GSView, a graphical interface for Ghostscript.
Run ‘Start -> All Programs -> Ghostgum -> GSView’ to open and print/copy any security locked PDF files.
You can also save an unprotected version of the file. In GSView click "File -> Convert -> OK" and save it under a new name (unprotected.pdf).

Method 2.a : Using Online Service FreeMyPDF to Remove Restrictions
FreeMyPDF is a online servive that lets you strip passwords and other restrictions from the file. Go to http://freemypdf.com/ and browse to upload the file you want to fix. It should be noted however that the process only works for files you are able to view—files which you need a password to even view can’t be unprotected by FreeMyPDF.

Method 2.b : Using Online Service Ensode.net/pdf.jsf

Goto http://www.ensode.net/pdf-crack.jsf
Accept the terms and upload the protected file and Submit.
A new window will open up and prompt to save pdf-crack.jsf
Rename the file from jsf to pdf (pdf-crack.pdf)
Now you can open the file to print or anything

Method 3 : Use of Screen grabber software.
This method involves capturing the document as a picture, which can later be printed. Free Screen capturing software tool like Snipping Tool ( Vista free Screen Capture Utility) or SnagIt , which support auto-scroll to capture multiple pages of the document automatically. Also try Free Bug Shooting, Gadwin PrintScreen 4.3

Method 4: Freeware PDF Unlocker
Freeware PDF Unlocker allowing users to remove password and restrictions on any PDF file that you can read. The utility is very simple to use, simply drag and drop the file to remove restrictions. You do not need to know the "owner" password for this to work. Download Freeware PDF Unlocker

Method 5: pdfFactory and Zan image printer
Download pdfFactory. Print to pdffactory. When the print preview comes up, save as pdf.
Otherway, Go to http://www.zan1011.com/ and download the Zan image printer. This is an opensource driver. In the config, choose printer redirect and then hook off your prefered pdf writer. It even works with adobe writer. Your result is a “graphical” pdf file with no restrictions and you can run OCR if necessary. In some cases though Adobe Acrobat Reader might refuse to print to MDI or PS printer, saying “The printer is not allowed for secure printing. Do you want to change your choice ?”.
Printer port redirection tool such as RedMon can help.

Method 6: PDFTools 1.3 Freeware

Download PDFTools install and use fully free...

Enjoy...

Useful tools and add-ons for IIS troubleshooting and IIS7

2011-01-04T03:09:00.001-08:00

Source:→ Microsoft

Understanding HTTP Error Messages

2011-01-04T03:06:00.000-08:00

HTTP error messages are related to the HTTP status codes which are included in the response headers when pages are requested from the Web server. HTTP status codes are three digit numbers.
HTTP status codes are categorized into the following categories:

Informational (1xx): This category is used for testing, and is not used for production Web servers.
Successful (2xx): Indicates that requests were successfully received.
Redirection (3xx): Indicates that the client needs to perform additional steps for his/her request to be serviced.
Client Error (4xx): Indicates an error at the client.
Server Error (5xx): Indicates an error at the server.

Understanding HTTP error messages and their associated status codes is important when you need to troubleshoot IIS. A few common errors on the client side (4xx error) and server side (5xx error) are listed below:

400 Bad Request; the server cannot service the request, usually because of an incorrect URL.
401 Unauthorized; the users credentials were not accepted by the authorization process.
403 Forbidden; the request could not be serviced for a number of reasons, even though the user was authenticated.
404 Not Found; the server cannot locate the requested file.
405 Method Not Allowed; the client incorrectly issues a HTTP GET request when a HTTP POST request should have been issued.
406 Not Acceptable; the requested file is not supported by the client.
407 Proxy Authentication Required; the client has to authenticate with the proxy server before its request can be serviced.
410 Gone; the server no longer has the requested file.
500 Internal Server Error; indicates a typical server side error.
501 Not Implemented; the server does not support the HTTP method requested by the client.
502 Bad Gateway; an invalid response was received by the upstream server for which this server is a gateway.
503 Service Unavailable; the server does not support the service requested by the client.

From the above, you can see that a few of the error codes are quite vague in describing the actual issue. For this reason, a few HTTP error messages have substatus codes to provide more information on the current errors. The substatus codes associated with the various HTTP error messages in IIS 6 are:

The substatus codes for the 401 Unauthorized status code are:
- 1; logon failed
- 2; logon failed because of the server configuration
- 3; logon failed because of the ACL on resource
- 4; logon failed due to filter
- 5; logon failed due to ISAPI/CGI application
- 7; logon failed due to URL Authorization policy
The substatus codes for the 403 Forbidden status code are:
- 1; Execute access denied
- 2; Read access denied
- 3; Write access denied
- 4; requires SSL
- 5; requires SSL 128-bit
- 6; IP address denied
- 7; requires client certificate
- 8; site access rejected
- 9; users too much
- 10; invalid configuration
- 11; password modified
- 12; mapper access rejected
- 13; client certificate revoked
- 14; directory listing rejected
- 15; client Access License exceeded
- 16; client certificate not trusted
- 17; client certificate either not valid yet, or expired
- 18; request cannot be serviced by particular application pool
- 19; CGI access rejected
- 20; Passport failed
The substatus codes for the 404 Not Found status code are:
- 2; denied by Lockdown Policy
- 3; denied by MIME Map Policy
The substatus codes for the 500 Internal Serve Error status code are:
- 12; application restarting
- 13; server occupied
- 15; direct requests forbidden for GLOBAL.ASA
- 16; UNC access error
- 17; URL Authorization store not located
- 18; URL Authorization store cannot be accessed/opened
- 19; bad file in metabase
- 100; ASP application error

By default, IIS returns the following default HTTP errors:

403; 14 Forbidden – directory listing rejected
500 Internal Server Error
500; 100 Internal Server Error – ASP error
501 Not Implemented
502 Bad Gateway

Custom HTTP Error Messages

Besides for the default HTTP error messages, IIS returns custom error messages. IIS returns custom error messages for all the other HTTP error messages, other than the default HTTP error messages listed previously. Custom error messages provide more information on the error condition than what the default messages provide, and can be customized. The custom error messages also include additional troubleshooting tips, which the default HTTP error messages do not provide. When custom error messages are enabled, IIS logs the error in the web logs for the site at the same time that it sends the HTTP error message to the client.
You can however configure IIS to return a default message over a custom error message for a particular error, or you can configure IIS to return only default error messages for all errors.
The details and troubleshooting tips associated with custom HTTP error messages are discussed and condensed in the following section:

The Page Cannot Be Displayed: The page which you are looking for is currently unavailable.
Please try the following:
- Click the Refresh button.
- Click the Back button to attempt a different link.
- Ensure that the website page address is spelt correctly.
- Verify the network connection settings which are being used. To do this, click the Tools menu, click Internet Options, and then click the Connections tab. Click Settings. The settings detailed for the connections must correspond to the settings which were provided by the ISP or LAN administrator.
- To enable Windows to automatically detect your network connection settings, click Detect Network Settings.
- Sites may require 128-bit SSL connection security. Use Help | About Internet Explorer to verify that the correct connection security is supported, and can be utilized.
- Verify that your existing Security settings can support the required connection security by clicking the Tools menu, clicking Internet Options, and clicking the Advanced tab. Verify the settings for SSL 2.0, SSL 3.0, TLS 1.0, and PCT 1.0.
Additional troubleshooting tips:
- The client has incorrectly spelt the domain name of the website in the requested URL.
- The port number of the website has since changed from its standard setting of port 80 to a different port number.
- The website may have been stopped or paused by the administrator.
400 Bad Request: The page could be temporarily unavailable, could have been removed, could have undergone a name change, or could have its content expired.
Please try the following:
- Ensure that the website address is spelt correctly.
- Click the Back button to attempt a different link to access the same content.
- Contact an administrator to inform him/her that the link is incorrectly formatted.
Additional troubleshooting tips:
- The client is normally the cause of this error condition. Typical causes are the utilization of spaces in the URL, or a syntax error in the URL.
- The Default Web Site could have had its IP address changed from All Unassigned to an IP address which is not specified on IP Settings tab of the Advanced TCP/IP properties window.
401 You Are Not Authorized to View This Page: The credentials which were provided do not include permission to access the page or directory.
Please try the following:
- Click the Refresh button and attempt to access the page/directory by providing different credentials.
- Contact an administrator to inform him/her that you should be allowed to access the page/directory.
Additional troubleshooting tips:
- The provided credentials do not exist for the user.
- A mapping failure occurred between the .NET Passports and the user accounts stored in Active Directory.
401.2 You Are Not Authorized to View This Page: The credentials which were provided do not include permission to access the page or directory because the Web browser is sending a WWW-Authenticate header field which is not supported by the Web server.
Please try the following:
- Click the Refresh button and attempt to access the page/directory by providing different credentials.
- Contact an administrator to inform him/her that you should be allowed to access the page/directory.
Additional troubleshooting tips:
- The site contains no configured authentication methods.
- The incorrect credentials are being used to access a remote virtual directory.
401.3 You Are Not Authorized to View This Page: The credentials which were provided cannot be used to access the page or directory because of the ACL set on the resource on the Web server.
Please try the following:
- Click the Refresh button and attempt to access the page/directory by providing different credentials.
- Contact an administrator to inform him/her that you should be allowed to access the page/directory.
Additional troubleshooting tips:
- NTFS permissions are incorrectly configured for the requested file.
401.4 You Are Not Authorized to View This Page: The credentials which were provided cannot be used to access the requested page or directory because user authentication failed. This is due to a filter implemented on the Web server which authenticates user access, and authentication has failed.
Please try the following:
- Click the Refresh button and attempt to access the page/directory by providing different credentials.
- Contact an administrator to inform him/her that you should be allowed to access the page/directory.
401.5 You Are Not Authorized to View This Page: The credentials which were provided cannot be used to access the requested page or directory because authentication failed due to an ISAPI application or a CGI application.
Please try the following:
- Click the Refresh button and attempt to access the page/directory by providing different credentials.
- Contact an administrator to inform him/her that you should be allowed to access the page/directory.
401.6 You Are Not Authorized to View This Page: The credentials which were provided cannot be used to access the requested page or directory because the authorization scope associated with the URL could not be located on the Web server.
Please try the following:
- Click the Refresh button and attempt to access the page/directory by providing different credentials.
- Contact an administrator to inform him/her that you should be allowed to access the page/directory.
401.7 You Are Not Authorized to View This Page: The credentials which were provided cannot be used to access the requested page or directory because of the URL Authorization policy configured for the Web server.
Please try the following:
- Click the Refresh button and attempt to access the page/directory by providing different credential.
- Contact an administrator to inform him/her that you should be allowed to access the page/directory.
403 You Are Not Authorized to View This Page: The credentials which were provided cannot be used to access the requested page or directory.
Please try the following:
- Click the Refresh button and attempt to access the page/directory by providing different credentials.
- Contact an administrator to inform him/her that you should be allowed to access the page/directory.
403.1 The Page Cannot Be Displayed: An executable program (CGI, ISAPI or some other program) was executed from a directory from which it could not be executed.
Please try the following:
- Contact an administrator to determine whether or not you should be allowed to execute programs from the directory.
Additional troubleshooting tips:
- Open the Home Directory tab of the website to check what execute permissions has been configured. For CGI and ISAPI applications, check that Script and Executable permissions have been configured.
403.2 The Page Cannot Be Displayed: The page attempting to be accessed cannot be displayed. This is normally due to the directory being configured to allow Script and Execute permissions only.
Please try the following:
- Contact an administrator to determine whether Read permission should be allowed.
Additional troubleshooting tips:
- Open the Home Directory tab of the website to check whether the Read permission has been configured.
403.3 The Page Cannot Be Saved: The page cannot be saved to the website because Write access is not allowed.
Please try the following:
- Contact an administrator to determine whether Write permission should be allowed for the directory.
Additional troubleshooting tips:
- For publishing content to IIS using either WebDAV or FrontPage, verify that the correct permission has been configured for the website.
- For FTP sites, verify that the Write permission is enabled.
403.4 The Page Must Be Viewed Over A Secure Channel: The page requires a Secure Sockets Layer (SSL) connection.
Please try the following:
- Enter https:// at the start of the address you want to navigate to.
403.5 The Page Must Be Viewed With a High-Security Web Browser: To access the resource, your web browser needs to support 128-bit Secure Sockets Layer (SSL) encryption.
Please try the following:
- Upgrade the web browser to support 128-bit SSL encryption.
- Contact an administrator to inform him/her that you should be allowed to access the page/directory.
403.6 You Are Not Authorized to View This Page: The website has a predefined list of denied IP addresses, and the IP address being utilized appears on that list.
Please try the following:
- Contact an administrator to inform him/her that you should be allowed to access the page/directory.
Additional troubleshooting tips:
- Open the Directory Security tab of the website, and check whether the IP address appears on the IP Address and Domain Name Restrictions list.
403.7 The Page Requires a Client Certificate: To access the page, you need a web browser to have a Secure Sockets Layer (SSL) client certificate which the particular Web server accepts.
Please try the following:
- Contact an administrator to inform him/her that you should be allowed to access the page/directory.
- Contact an administrator to obtain a client certificate.
- If you have a client certificate (valid) verify that is installed correctly.
403.8 You Are Not Authorized to View This Page The Web server has a predefined list of denied DNS names, and the DNS name being utilized appears on that list.
Please try the following:
- Contact an administrator to inform him/her that you should be allowed to access the page/directory.
Additional troubleshooting tips:
- Open the Directory Security tab of the website, and check whether the DNS domain name of the client is disallowed.
403.9 The Page Cannot Be Displayed: The Web server is currently too occupied to service the request.
Please try the following:
- Click the Refresh button
Additional troubleshooting tips:
- Verify whether the Connection Limit for the Web server has been surpassed.
403.10 You Are Not Authorized to View This Page: This directory does not allow executable programs to be executed.
Please try the following:
- Contact an administrator to determine whether or not the directory should be configured to allow execute access.
403.11 You Are Not Authorized To View This Page: The credentials provided to access the page/directory does not have the necessary permissions.
Please try the following:
- Click the Refresh button and attempt to access the page/directory by providing different credentials.
- Contact an administrator to inform him/her that you should be allowed to view the page/directory.
403.12 The Requested Page Requires A Valid SSL Client Certificate: The account associated with the client certificate on the Web server has not been allowed access to the site.
Please try the following:
- Contact an administrator to determine what the client certificate permissions are.
- If you have a client certificate (valid) verify that is installed correctly.
- Change the client certificate, click the Refresh button.
403.13 The Page Requires A Valid SSL Client Certificate: The client certificate which was used has been revoked.
Please try the following:
- Contact an administrator to determine what the client certificate permissions are.
- Contact an administrator to obtain a client certificate.
403.14 Directory Listing Is Denied: A directory listing of this directory's content is not configured on the Web server.
Please try the following:
- Contact an administrator to determine whether a directory listing should be allowed.
Additional troubleshooting tips:
- Verify whether the Directory Browsing setting, and the Read permission has been enabled on the Home Directory tab for the site.
403.15 The Page Cannot Be Displayed: The Web server has surpassed the configured Client Access License limit.
Please try the following:
- Click the Refresh button.
403.16 The Page Requires A Valid SSL Client Certificate: The current client certificate is invalid/untrusted.
Please try the following:
- Contact an administrator to determine what the client certificate permissions are.
- Verify that your existing valid client certificate is installed correctly.
- Contact an administrator to obtain a client certificate.
403.17 The Page Requires A Valid SSL Client Certificate: The current client certificate is invalid or has expired. A SSL client certificate is used to verify access to this particular resource.
Please try the following:
- Contact an administrator to determine what the client certificate permissions are.
- Verify that your existing valid client certificate is installed correctly.
- Change the client certificate, click Refresh.
403.18 Cannot Execute Request from the Current Application Pool: The request could not be executed from the Current Application Pool specified for the particular resource.
Please try the following:
- Contact an administrator to inform him/her that you should be allowed to view the page/directory.
403.19 Cannot Execute CGI Applications in the Current Application Pool on the Web Server: CGI Applications could not be executed from the Current Application Pool because the user has insufficient permissions.
Please try the following:
- Contact an administrator to inform him/her that you should be allowed to execute CGI applications.
403.20 Passport Login Failed: An error was received from the Passport logon server.
Please try the following:
- Contact an administrator to inform him/her that you should be allowed to view the page/directory.
- Click the Refresh button.
404 The Page Cannot Be Found: The page was either renamed, removed, or is currently unavailable.
Please try the following:
- Ensure that the website address is correctly spelt and formatted.
- Click the Back button to attempt a different link to access the same page.
- Contact an administrator to inform him/her that the link is incorrectly formatted.
404.1 The Website Cannot Be Found: For this site, an IP address is specified to disallow requests which detail a port number.
Please try the following:
- Ensure that the website address is correctly spelt and formatted.
- Click the Back button to attempt a different link to access the same page.
- Contact an administrator to inform him/her that the link is incorrectly formatted.
Additional troubleshooting tips:
- The client is probably requesting a URL for an IP address that is not used by IIS.
404.2 The Page Cannot Be Found: The web service extensions specified for the Web server is preventing the request from being serviced.
Please try the following:
- Contact an administrator to inform him/her that the required web service extension is not configured for the site.
Additional troubleshooting tips:
- The required web service extension for the ASP.NET, ASP, ISAPI, or CGI application has not been configured.
- An application extension is not mapped in IIS.
- The user account under which the application (CGI) executes has the incorrect permissions.
404.3 The Page Cannot Be Found: The Multipurpose Internet Mail Extensions (MIME) map policy specified for the Web server is preventing the request from being serviced.
Please try the following:
- Contact an administrator to inform him/her that the required file extensions have not been enabled via the MIME map policy.
Additional troubleshooting tips:
- The request is for a static file that's filename extension is not specified in the MIME map for the Web server or website.
405 The Page Cannot Be Displayed: An invalid method, such as a HTTP verb, was used in the request for the page.
Please try the following:
- Ensure that the website address is correctly spelt and formatted.
- Contact an administrator to inform him/her that the request should be allowed.
406 The Resource Cannot Be Displayed: The requested page has a filename extension that is not supported by the browser being used.
Please try the following:
- Modify the MIME/security settings of the browser to support the requested page's filename extension.
407 Proxy Authentication Required: To view the requested page, authentication has to occur through a proxy server.
Please try the following:
- Contact the administrator if you should be allowed to view the page/directory.
- Retry logging on to the proxy server.
410 The Page Does Not Exist: The requested page has since been removed/deleted.
Please try the following:
- Find additional links to the information which you want to view.
412 The Page Cannot Be Displayed: The request could not be serviced because of preconditions existing in the request header which are preventing the particular request method.
Please try the following:
- Find additional links to the information which you want to view.
- Delete any cached items and click Refresh.
414 The Page Cannot Be Displayed: The requested URL address length is too long.
Please try the following:
- Ensure that the website address is correctly spelt and formatted.
- Contact the administrator to inform him/her of the URL address error.
415 The Page Cannot Be Returned: The requested file has a format which the Web server cannot download.
Please try the following:
- Contact the administrator to inform him/her of the error for the requested file.
500 The Page Cannot Be Displayed: The requested page has a problematic condition which is preventing the request from being serviced.
Please try the following:
- Contact the administrator to inform him/her of the URL address error condition.
500.11 The Page Cannot Be Displayed: The particular website is in the process of shutting down.
Please try the following:
- Click the Refresh button.
- Contact the administrator to inform him/her of the URL address error condition if you continuously cannot access the website.
500.12 The Page Cannot Be Displayed: The particular website is in the process of restarting.
Please try the following:
- Click the Refresh button.
- Contact the administrator to inform him/her of the URL address error condition if you continuously cannot access the website.
500.13 The Page Cannot Be Displayed: The particular website is too busy to service the request

IIS Interview Questions

2010-12-28T02:38:00.000-08:00

How to recycle application pool from the command prompt in IIS7?

1. Use appcmd.exe to recycle the application pool from the command prompt.

2. appcmd.exe is the command line tool for IIS7, you will find this tool at following location :

%systemroot%\system32\inetsrv\appcmd

3. To recycle your application pool use the following command:
appcmd recycle apppool /apppool.name:

List of Error & Status codes in IIS 6.0?

Status Code Type of Code
100 Series - Informational
200 Series - Success
300 Series - Redirection
400 Series - Client Error
500 Series - Server Error

What is IIS metabase? And In which format IIS stors configurations?

IIS metabase is a special databse which is used to maintain the settings and configurations data for IIS. In simple term, it is a configuration base for IIS (Metabase.xml).

IIS 5.0 --> Metabse is in Binary.
IIS 6.0 & 7.5 --> Metabase is in XML.

What is the default user name of an anonymous login in IIS?

In IIS, an anonymous user will be given with a user name of "IUSR_MachineName "

How can we take back-ups in IIS Server?

Step 1 : In the IIS (inetmgr), right click on the "Computer" icon under "Internet Information Services" . Click "All Tasks" and select "Backup/Restore Configuration".

Step 2 : Click on button "Create backup". Give Name for your backup file. If you want encryption enable encryption option and give UserName and Password and then click OK.

What is the latest version of IIS released with Windows 7

IIS 7.5

From where you can change the ASP.NET Version in IIS ?

This can be change from Virtual Directory properties. First open Properties of Virtual Directory > GoTo ASP.NET Version Tab.

There we can have change the ASP.NET Version.

What are the different "Execution Permission" available for IIS for an virtual directory ?

There are three Execution Permission available.
1. None
2. Scripts Only
3. Scripts and Executable

From where we can set the Session Time Out in IIS ?

We can set the Session time out settings from the Virtual Directory for that site.

Right Click on Virtual Directory > Properties > Click on "Configuration" Button
Goto the "Option" Tab. There in Enable Session State Section you can configure the Session Timeout .

How does IIS process an ASP.net request ?

When client request for an aspx pages, request comes to kernel level off IIS means to HTTP.SYS . HTTP.SYS receives the request and based on the application pool name [ Which is already registred with the HTTP.SYS ] it send the request to worker process. Windows Activation process works as mediator of them. w3wp.exe loads "aspnet_isapi.dll" files to start the HTTPRuntime . HTTPRuntime creates HTTPApplication objects and all request are passed through HTTPModule and finally reached to HttpHandler . This is the request pipeline. After end of Request pipeline ASP.NET Page lifecycle starts.

For more Information :
http://www.codeproject.com/KB/aspnet/aspnetrequestarchitecture.aspx

What are the different way that we can hosted site on IIS ?

We can hosted site on IIS either creating Virtual Directory through IIS manager or Using Folder Web Sharing .
Apart from that Visual studio provide some inbuilt features to host the site on IIS like using Publishing the web site , Using Copy web Tool or Creating Virtual directory during the creating the project by choosing Location as HTTP

What are the main components of SVCHost.exe ?

Main components for SVCHost.exe are WWW Publishing Service (W3SVC) and Windows Activation Porcess (WAP) .

W3SVC is the mediator of HTTP.SYS and Windows Activation Process. Windows Activation Process maintain the worker processes.

Can we create one Application Pool From Another Application Pool ?

Yes. We can.
While creating Application Application Pool From IIS, there should have two option available first one is for Default Setting and Another is for Existing Setting as template.
We can select the second one and from the drop down listed below we can select any on the Application Pool as Template,.

Is there any alternative way to host site on IIS rather than opening IIS Manager ?

Yes, We can directly host any site from the physical location of directory itself.

Right Click on Physical Folder > Properties > Web Sharing

There you need to select > "Share This Folder" Option Button. Then it will ask for alias name and other setting. Then Click on OK.

To Validate : Run > Inetmgr > Check there should an virtual directory with the same "Alias" name that you have given.

If there are already one Virtual directory exist it will showing you the error message while you providing the "Alias" name.

Why do we need to IIS Remote Debugging ?

There are following reasons where we can use remote debugging
1. Your development server does not have IIS installed.
2. Development server and Build/Released/Hosting Server is different
3. Multiple user want to debug simultaneously.

What is Application Pool in IIS ?

Before Giving the Definition : you can say like this, Concept of Application pool has from IIS 6.0 .
Application pools are used to separate sets of IIS worker processes that share the same configuration and application boundaries. Application pools used to isolate our web application for better security, reliability, and availability and performance and keep running with out impacting each other . The worker process serves as the process boundary that separates each application pool so that when one worker process or application is having an issue or recycles, other applications or worker processes are not affected.
One Application Pool can have multiple worker process Also.

Main Point to Remember:
1. Isolation of Different Web Application
2. Individual worker process for different web application
3. More reliably web application
4. Better Performance

What is web garden ?

By default Each Application Pool runs with a Single Worker Process (W3Wp.exe). We can assign multiple Worker Process With a Single Application Pool. An Application Poll with multiple Worker process called Web Gardens. Each Worker Process Should have there own Thread and Own Memory space.

Generally its not recommended to use InProc Session mode while we are using Web Garden.

What is the use of Enable Pinging Properties for Application Pool ?

IIS should periodically monitor the health of a worker process [ Idle or not , Time for recycle or not, All Worker process are running properly or not ] .
Pining means, Activation Process monitor Worker process performance, health, idle time etc.
By default it sets to 30s .

What is the Role of IIS ?

Visual studio having It own ASP.NET Engine which is capable enough to run Asp.net web application from visual studio. So we just click on Run button to start the application.
Now this is the scenarios of local environment. But If we want to host it on server from where all user can access the sites then IIS comes into the picture.

IIS provides a redesigned WWW architecture that can help you achieve better performance, reliability, scalability, and security for our Web sites. IIS can support following Protocol HTTP/HTTPS, FTP, FTPS, SMTP Etc. We need to host the site on IIS, when request comes from client it first hits the IIS Server, then the server passed it to ASP.NET worker process to execute. Then the response also passes to client via IIS itself.
Note only Hosting of Site we can create our FTP Server, SMTP Server using IIS itself.
There are different version of IIS available like 5.1, 6.0, 7.0 etc

What is the Role of Windows Activation Process in IIS ?

WAP is the Controller of Worker process under a Application Pool. Windows Activation Process which is managed by the worker process by starting, stopping and recycling the application pool. When to start, stop and Recycle should be defined on Application Pool Settings. Activation Process is also responsible for Health Monitor of Application Pool during runtime.

FYI : Health monitoring setting can be easily found in Properties of Application Pool.

What is Web Farm ?

This is one of the most question in IIS. And along with that interviewer can as what is the different between Web farm and Web Garden ?

When we hosted our web Application on multiple web server under a load balancer call the Web Farm. This is generally used for heavy load web application where there are many user request at a time. So When Web Application is hosted on Different IIS Server over a load balancer, Load balancer is responsible for distribute the load on different server.

Please have a look into this :
http://www.dotnetfunda.com/articles/article713-difference-between-web-farm-and-web-garden.aspx

What are the major innovation in IIS 7.0 ?

Below are the Major Innovation in IIS 7.0
Components are designed as module and there are major change in administration settings.
FYI : You can find out many of them, just go thorugh Microsoft IIS web site.

How we can set the Idle Time out of an worker process ?

We can set the Idle time out for an worker process from Application Pool Properties.

In Performance Tab of Application pool, we can set the Idle Time out of the worker process. This means worker process will shut down after that given time period if it stay idle. And will again wake up again if a new request comes.

How can we set the default page for any web application ?

We can set the default page for a web site from the Virtual Directory Setting.
How To :
IIS Manager > Virtual Directory > Right Click > Properties > GoTo Document Tab.

What is the default Identity of an Application Pool ?

NetworkServices

What are the worker process for IIS 5.1 and IIS 6.0 ?

For IIS 5.1 > aspnet_wp.exe
For IIS 6.0 > w3wp.exe

Name of the tool which is used for remote debugging of IIS

NOTE: This is objective type question, Please click question title for correct answer.

What is name of default application pool in IIS ?

NOTE: This is objective type question, Please click question title for correct answer.

Which application pool having maximum privilege on the server ?

NOTE: This is objective type question, Please click question title for correct answer.

Which is not an Identity of Application Pool ?

NOTE: This is objective type question, Please click question title for correct answer.

What are the different type of application pool available in IIS 7.0 ?

IIS 7.0 having two types of application pool.

1. DefaultAppPool (Integrated)
2. ClassicAppPool

How we can open IIS Configuration manager ?

Just simply Run >inetmgr
Or we can open it from control panel > Administrative tools.

What is ISAPI Filter ?

This is one of the more important question for experienced guys.

Please read this in details.
http://msdn.microsoft.com/en-us/library/ms524610.aspx

Where is the default location for IIS Log files ?

Its
C:\WINDOWS\system32\LogFiles\W3SVC1

Can we have multiple web sites on IIS ?

Yes. IIS Can have multiple web sites and Each and every web sites can have multiple virtual Directory.

Note : Here web sites means the Root Node.

What is the use of aspnet_regiis -i command ?

This is used automatically register the .NET Framework with your IIS.

For more information :
http://msdn.microsoft.com/en-us/library/k6h9cz8h%28VS.80%29.aspx

Does IIS allows multiple user to Remote debug simultaneously ?

Yes. This is one of the great features of msvsmon.exe . Each instance of the remote debugger has a unique server name.we can give an instance of the remote debugger any server name. Now multiple user can able to access the server instance.

If there are multiple worker process running on IIS, then how can you attach a particular worker process for application ?

Well, If there are multiple worker process running in IIS, it means I have to know the name of my application pool. Then I can run cscript iisapi.vbs script to find out the process ID and Application Pool name . Based on the process Id for particular application I have to attache the process from Visual studio IDE.

How can we get the list of worker process running in IIS along with the Application pool name ?

By running iisapp.vbs script from command Prompt.

Below are the steps :
1. Start > Run > Cmd
2. Go To Windows > System32
3. Run cscript iisapp.vbs

What are the different authentication mode available for IIS Remote Debugging ?

For IIS Remote Debugging msvsmon supported two authentication mode

1. Windows Authentication
2. No-Authentication

Which Tool is used for Remote IIS Debugging ?

Tools is : msvsmon.exe

This is located at : Install path\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86

How we can save an Application Pool Settings?

Application Pool Settings can be save as "XML" Format.

Right Click on Application Pool > All Task > Save Configuration to a File .

This will save all the settings of Application Pool as an XML file.We can make it password protected also.

Which version of IIS is available in Windows Server 2008 ?

IIS 7.0 .

Even Vista Home Premium and Ultimate edition is also having IIS 7.0

Does One Web Application can have multiple Application Pool ?

No. Every Web Application should have one Application Pool. Bydefault it is "DefaultAppPool ".

What is the folder location for Virtual Directory ?

:\inetpub\wwwroot

What are the permission settings are available for Virtual Directory ?

Below are the list of permission that can be set during virtaul directory creation
1. Read
2. Run Scripts
3. Execute:
4. Write:
5. Browse

How we can create a Virtual Directory on IIS ?

Open IIS Configuration Manager
First of all Right Click on Default web sites > New > Virtual Directory .
Browse the Physical Path. Set the properites. Click on OK

How we can debug a web application which is hosted on IIS ?

We can easily debug any web application that are hosted on IIS by using Attaching of Worker Process.
From Visual Studio IDE > Tools > Attach To Process
Select the particular Process, then start debugging.

For more information Read this article :
http://www.codeproject.com/KB/aspnet/ProcessAttache.aspx

How we can create an web garden ?

For creating web graden we need to go to Application Pool, then Right Click on Application Pool > Properties > Goto Performance Tab

In Web Garden Section, increase the number of worker process. By default it is 1.

Where session data stores in case of "In-Proc" Session mode ?

Session data store inside process memory of worker process [ w3wp.exe ] .

What is the default authentication settings for IIS ?

Posted by: Abhijit Jana

Anonymous authentication is the default authentication mode for any site that is hosted on IIS, and it runs under the "IUSR_[ServerName]" account.

What are the different security settings available in IIS ?

Below are the commonly used IIS Security settings

1 Anonymous
2 Integrated Windows Authentication
3. Basic Authentication
4. Digest Authentication
5. Passport Authentication

For Set security permission you need to go to Virtul Directory > Right Click > Properties > Directory Security
Click on Edit Button .

What is the Role of Http.Sys in IIS ?

HTTP.SYS is the kernel level components of IIS. All client request comes from client hit the HTTP.Sys of Kernel level. HTTP.SYS then makes a queue for each and every request for each and individual application pool based on the request.
Whenever we create any application pool IIS automatically registers the pool with HTTP.SYS to identify the particular during request processing.

What are the main layers of IIS Architecture ?

IIS having mainly two layer Kernel Mode and User Mode

Below are the subsection of both of them.
1. Kernel Mode
o HTTP.SYS
2. User Mode
o Web Admin Service
o Virtual Directory
o Application Pool

What is Recycling of Application Pool ?

ecycling Application pool means recycle the Worker process (w3wp.exe ) and the memory used for the web application.
There are two types of recycling related with Application pool

1. Recycling Worker Process - Predefined Settings
2. Recycling Worker Process - Based on Memory

Name of default Identity of IIS6.0

Default Identity of IIS 6.0 is NetworkServices .
Which is having very minimum rights on your system. The user can only have the read access of the site.

What are the different types of Identity available in IIS 6.0 ?

IIS having three different Identity.
1. Local System
2. Local Services
3. NetworkServices

What is the Name of Default Application Pool in IIS ?

Though we can create new application pool IIS with different settings, but IIS having its own default application pool named : DefaultAppPool

Before answering this question you need to know what are the different IIS version is available in different OS. Below is the list of IIS version with different Operating system.
Windows Server 2008 - Windows Vista - Home Premium/ Ultimate - IIS 7.0
Windows Server 2003 - IIS 6.0
Windows XP Professional - IIS 5.1
Now based on your working experience you can say that you have worked on IIS 5.1 and 6.0 or only IIS 7. Etc.
Now, the next question that can asked after answering this question is “what is the difference between them ? ” – Well I will come with this later.

IIS 5.0 Vs IIS 6.0 Differents

2010-12-22T03:53:00.000-08:00

IIS issues and Network Problem Diagnosis by using COMMAND LINE tools

2010-12-21T04:40:00.000-08:00

PING.EXE

I'll show you (and perhaps refresh your memory) some of the more important and powerful command-line utilities you can use to diagnose network problems on your IIS Web servers and IIS Web farms. Some of these tools' roots go back 20 or more years; some have roots in UNIX, and others are strictly Windows utilities.

You can use numerous command-line tools not only to diagnose problems when they occur but to identify potential bottlenecks before they become significant problems. These tools live in \WINNT\system32 and are consequently "pathed" so you can grab a command prompt and run them from anywhere.

Let's start with the basics. You can use the Ping.exe command-line tool to verify whether a local or remote TCP/IP system is available; you use it when your network resources stop talking.

Consider a scenario in which you receive reports that a Web application is suddenly receiving SQL Server errors. First, you can verify that both the IIS box and SQL Server are up and running. If they are, a simple ping test from the IIS box to the SQL Server box is a quick way to test connectivity. You can ping using DNS name, NetBIOS name, or IP address. And you'd probably do it in this order:

Ping sanio.sys.com
Ping sanio
Ping 192.168.1.30

A positive response from a ping resolved by DNS, such as in method 1, means the problem isn't a DNS one, and the basic connectivity between the boxes is functioning. A negative response (i.e., a "request timed out" message) means you can try both the NetBIOS and IP address methods to hunt down the problem. Let's say the DNS method failed in this manner:

C:\WINNT\system32>ping sanio.sys.com
Pinging sanio.sys.com [192.168.1.30] with 32 bytes of data:

 Request timed out.
 Request timed out.
 Request timed out.
 Reply from 192.168.1.30: Destination host unreachable.
 
Ping statistics for 192.168.1.30:
 Packets: Sent = 4, Received = 1, Lost = 3 (75% loss),
 Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum =  0ms, Average =  0ms

C:\WINNT\system32>

And let's assume a NetBIOS or IP ping method succeeds in this manner:

C:\WINNT\system32>ping 192.168.1.30
Pinging 192.168.1.30 with 32 bytes of data:
 Reply from 192.168.1.30: bytes=32 time<10ms TTL=128
 Reply from 192.168.1.30: bytes=32 time<10ms TTL=128
 Reply from 192.168.1.30: bytes=32 time<10ms TTL=128
 Reply from 192.168.1.30: bytes=32 time<10ms TTL=128
 
Ping statistics for 192.168.1.30:
     Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:
 Minimum = 0ms, Maximum =  0ms, Average =  0ms
 
C:\WINNT\system32>

The problem obviously lies with DNS, and you can fix it accordingly. I turned off my internal Windows 2000 DNS server to illustrate the problem above, and when I turned the DNS service back on, everything worked correctly again.

You can use the ping tool when you test your Internet connectivity to the world outside the firewall or to test Internet connectivity to servers you host from remote locations. We are currently having a devil of a time with our ISP. We host our static site from a computer room in our San Diego office. Ironically, as I write this (in the middle of the night from home), I know that Internet connectivity is down because I just grabbed a browser to take a peek at our site's new look and feel. It failed. I grabbed a command prompt and pinged http://www.interknowlogy.com and it failed miserably. So it's time to call our network guys—they dread hearing from me, and I guarantee they aren't happy with our ISP.
TRACERT.EXE

In the last issue of IIS Administrator UPDATE (see the URL at the end of this column), I talked about how powerful command-line utilities can help you diagnose network problems on your IIS Web servers and IIS Web farms. I started with the absolute basic—PING. Ping.exe is a command-line tool you use to verify whether a local or remote TCP/IP system is available. This time, we look at another basic command-line utility you'll want in your arsenal—TraceRT.
Tracert.exe (short for Trace Route) is a route-tracing utility that can effectively measure the number of router hops (or routes) between remote systems, but it's even more effective for measuring hops between your internal systems when you have latency problems. In other words, TraceRT can help identify routing problems between application servers. You can use TraceRT with domain names, IP addresses, or even NetBIOS names.
First try a little test by using TraceRT to trace a route to your favorite Internet site. TraceRT lives in \WINNT\system32 and is consequently "pathed" so you can grab a Command Prompt and run it from anywhere on your system. (I could be overstating the obvious, but you need Internet connectivity to run this test.) When I type tracert interknowlogy.com from my home in Carlsbad, California, I get the following:

1    20 ms    20 ms    20 ms  10.84.10.1
 2   <10 ms    10 ms    10 ms  bb1-fe2-0.carlsbad1.ca.home.net [24.11.232.193]
 3    10 ms    20 ms    20 ms  c1-se6-0.sndgca1.home.net [24.7.73.113]
 4    10 ms    20 ms    20 ms  c1-pos1-0.anhmca1.home.net [24.7.64.69]
 5    10 ms    30 ms    10 ms  c1-pos1-0.lsanca1.home.net [24.7.65.169]
 6    10 ms    30 ms    10 ms  c1-pos2-0.snbbca1.home.net [24.7.65.174]
 7    20 ms    20 ms    20 ms  c2-pos3-0.snjsca1.home.net [24.7.64.49]
 8    20 ms    30 ms    30 ms  24.7.70.134
 9    20 ms    20 ms    30 ms  svl-core-03.inet.qwest.net [205.171.14.109]
10    20 ms    40 ms    30 ms  bur-core-02.inet.qwest.net [205.171.5.217]
11    30 ms    30 ms    30 ms  bur-core-01.inet.qwest.net [205.171.13.1]
12    30 ms    20 ms    30 ms  lax-core-01.inet.qwest.net [205.171.8.41]
13    30 ms    30 ms    60 ms  lax-edge-09.inet.qwest.net [205.171.19.150]

My company's Web site is hosted in our San Diego office—just 2.5 miles from my home. Look carefully at the route. The first seven router hops are on the @home network starting in Carlsbad, moving 30 miles south to San Diego, then turning 100 miles north to Anaheim, another 100 miles north to Los Angeles, 30 miles to Santa Barbara, and 350 miles to San Jose, where I get out to the Qwest network and start "hopping" my way south again all the way back to southern California. And remember, I live 2.5 miles away from my company's Web site location! And we wonder why our connections seem slow!
Let's move to a more practical example that you'll probably use when your users (or developers) complain that a site is slow: using TraceRT to measure router hops between your application servers. Just the other day, a content manager at one of my clients complained that the deployment application was really slow. I knew the LAN wasn't experiencing latency of any significance because I'd been using it. One of the network guys told me that they had updated the router software in the production DMZs over the weekend. From the staging server that hosts the content deployment application, I ran a TraceRT to the production Web server farm that deployed the content and found seven router hops! I printed the TraceRT results, took the printout to the networking folks who did the work, and said, "I think we have a problem." This case was particularly interesting because two router hops were to the same router. It hopped in and out and then back in to the DMZ. The networking folks fixed the problem, and the content manager was back in business.
TraceRT can also help you trace routes between Web servers and database, directory, and Lightweight Directory Access Protocol (LDAP) servers. Do yourself a favor and run some TraceRTs between those servers on your Web farm. Eliminating even one router hop between a Web server and a SQL Server machine could mean a spectacular increase in your site's performance.
http://www.win2000mag.com/Articles/Index.cfm?ArticleID=20618

PATHPING.EXE

In the past two columns (see the URLs at the end of this article), I talked about how command-line utilities can help you diagnose network problems on your IIS Web servers and IIS Web farms. Often, complaints about latency in Web applications are due to network, not software, problems. The more complex your environment, the easier it is to accidentally or inherently introduce network problems.
I started with the absolute basics—PING. Ping.exe is a command-line tool you use to verify whether a local or remote TCP/IP system is available. Then I covered another basic topic—TRACERT. TraceRT (short for "Trace Route") is a route-tracing utility that can effectively measure the number of router hops (or routes) between systems.
In this article, I cover PATHPING. PathPing.exe is a Windows 2000 route-tracing tool that combines Ping and TraceRT features with additional information those tools don't provide. You can use PathPing to identify routers that cause delays and other latency problems on a connection between two IP hosts. By default, PathPing pings each router 100 times, with a single ping every 0.25 seconds. Consequently, a default query requires 25 seconds per router hop.
First, try a little test using PathPing to trace a route to your favorite Internet site. PathPing lives in \WINNT\system32 and is "pathed" so you can grab a Command Prompt and run it from anywhere on your system. (I might be overstating the obvious, but you'll need Internet connectivity to run this test.) When I type: PathPing –n InterKnowlogy.com (the "n" parameter prevents resolving IP addresses to host names), I get the following:

Tracing route to interknowlogy.com [63.237.180.197] over a maximum of 30 hops:
 0  192.168.1.2
 1  10.84.10.1
 2  24.11.232.193
 3  . . .
  
Computing statistics for 375 seconds . . .

When I run PathPing, it first lists the route. This is the same route that the TraceRT command-line tool shows. Next, PathPing displays a busy message for approximately 25 seconds multiplied by the number of router hops. During this time, PathPing gathers information from all the previously listed routers and from the links between them. At the end of this period, it displays the test results like this:

Source to Here   This Node/Link
Hop  RTT    Lost/Sent = Pct  Lost/Sent = Pct  Address
0                                             192.168.1.2
                              0/ 100 =  0%     |
1    5ms     0/ 100 =  0%     0/ 100 =  0%    10.84.10.1
                              0/ 100 =  0%     |
2    9ms     0/ 100 =  0%     0/ 100 =  0%    24.11.232.193
                              0/ 100 =  0%     |

And so forth . . .

Trace complete.

In the PathPing output above, in the "This Node/Link Lost/Sent = Pct" and "Address" columns, the link drops 20 percent of the packets.
PathPing has several optional parameters:

n—Host names. Doesn't resolve addresses to host names.
h —Maximum hops. Maximum number of hops to search for target.
g —Router-list. Uses a loose source route along the host-list.
p —Period. Number of milliseconds to wait between pings.
q —Number of queries per hop.
R—RSVP test. Checks to see whether each router in the path supports the Resource Reservation Protocol (RSVP), which lets the host computer reserve a certain amount of bandwidth for a data stream. Use the -R switch to test for Quality of Service (QoS) connectivity.
T—Layer 2 tag. Attaches a layer-2 priority tag (for example, for IEEE 802.1p) to the packets and sends it to each network device in the path. This helps identify the network devices that don't have layer-2 priority properly configured. Use the -T switch to test for QoS connectivity.
w —Timeout. Waits this many milliseconds for each reply.

As you can see, PathPing is a valuable and powerful tool for your network-problem diagnosis arsenal. It combines the power of Ping and TraceRT and provides even more detail about the routing of IP-based transmissions.
http://www.win2000mag.com/Articles/Index.cfm?ArticleID=20618
http://www.win2000mag.com/Articles/Index.cfm?ArticleID=20819

Set Up Remote Desktop Web Connection with Windows XP

2010-12-21T03:19:00.000-08:00

Get Your Host Computer Ready

The Remote Desktop feature is only available in Windows XP Professional. It's not included with Windows XP Home Edition. For more information about how Remote Desktop Web Connection works, see About Remote Desktop Web Connection.
The first step in enabling Remote Desktop Web Connection is to install the necessary software on the host computer. Remote Desktop Web Connection is an optional World Wide Web Service component of Internet Information Services (IIS), which is included by default in Windows XP Professional. IIS responds to requests from a Web browser. Have your Windows XP Professional CD handy, and follow these steps:

1.	Open Control Panel click Add or Remove Programs, and then click Add/Remove Windows Components.
2.	Click Internet Information Services, and then click Details.
3.	In the Subcomponents of Internet Information Services list, click World Wide Web Service, and then click Details.
4.	In the Subcomponents of World Wide Web Service list, select the Remote Desktop Web Connection check box, and then click OK.
5.	In the Windows Components Wizard, click Next. Click Finish when the wizard has completed.
6.	Click the Start button and click Run. Type Net Stop w3svc, and click OK. This temporarily stops the World Wide Web service to keep your system safe while you update it with security patches.

Enabling IIS without installing the appropriate security patches can make your system vulnerable to intruders. For more information, read Microsoft Security Bulletin MS01-018 and Security and Privacy for Home Users.
To check for updates:

1.	Click Start, point to All Programs, click Microsoft Update, and then click Scan for updates. Follow the prompts to install all critical updates. If prompted, restart your computer.
2.	Click Start, and then click Run. Type Net Start w3svc, and click OK. This starts the World Wide Web service.

I highly recommend using Automatic Updates, especially after installing Internet Information Services.

Top of page

Configure Internet Information Services

By default, IIS is identified on your computer by the TCP port number 80. The steps in this section change the TCP port number and make it much more difficult for a potential attacker to communicate with your computer. The steps in this section are optional, but if you do follow them, you'll dramatically improve the security of your system. If you are already using your computer as a Web server, you should leave the TCP port number at the default setting of 80.

1.	Open Control Panel, click Performance and Maintenance, and then click Administrative Tools. Double-click Internet Information Services.
2.	In the ISS snap-in, expand your computer name, expand Web Sites, right-click Default Web Site, and then click Properties.
3.	On the Web Site tab, change the value for TCP Port. Enter a number between 1000 and 65535 that you can remember easily, such as the month and day of a birthday or anniversary. You'll need to know the TCP Port when you connect to the computer in the future.
4.	Click OK, and close the Internet Information Services snap-in.

Top of page

Configure Remote Desktop

To connect using Remote Desktop, you must have a user account with a password. If you don't yet have a password on your account, create a password by opening Control Panel, and clicking User Accounts. Click your account, click Create a password, and follow the prompts. After you have a password, follow these steps to enable Remote Desktop:

1.	Right-click My Computer, and click Properties.
2.	On the Remote tab, click the Allow users to connect remotely to this computer check box, as shown in Figure 1. Figure 1: Enabling remote desktop
3.	Click Select Remote Users, and then click Add.
4.	In the Select Users dialog box, type the name of the user and then click OK. Click OK again to return to the System Properties dialog box, and then click OK to close it.

Top of page

Configure Your Router

If you use a router to connect to the Internet, you probably need to configure it to allow the Remote Desktop connection to your computer. For more information on routers and firewalls, see my Internet Firewalls column. You need to forward two ports to your Windows XP Professional-based computer: TCP port 3389, which Remote Desktop requires, and the port you specified in the TCP Port field in Internet Information Services (or TCP port 80 if you did not change the default). If you use Internet Connection Firewall (and you should!), see How to Manually Open Ports in Internet Connection Firewall in Windows XP for instructions on allowing traffic by TCP port.

Top of page

Connect to Your Desktop

Computers are identified on the Internet using a unique IP address. To connect to your home computer from the Internet, you'll need to know your home IP address. Visit one of these sites from your home computer to learn your IP address: What Is My IP, What Is My IP.com, or Atlantic PC Solutions. Your IP address may change occasionally, so always check your IP address before you plan to connect. When you're ready to connect to your host computer, follow these steps:

1.	Open Internet Explorer, and enter the URL http://ipaddress:port/tsweb/. For example, if your IP address is 192.168.1.120, and you chose the TCP Port 1374, you would enter the URL http://192.168.1.120:1374/tsweb/.
2.	If you're prompted to install the Remote Desktop ActiveX control, click Yes.
3.	On the Remote Desktop Web Connection page, shown in Figure 2, click Connect. You don't need to fill in the Server field. If you leave the Size field set to Full-screen, the remote desktop will take over your local desktop. Figure 2: Remote Desktop Web Connection page
4.	Enter your user name and password at the Windows logon prompt, as shown in Figure 3, and then click OK. You'll see your desktop, complete with any windows that were left open the last time you used the computer. Figure 3: The Remote Desktop Web Connection logon screen

When you're done, disconnect by closing the browser, or clicking the X at the top of the screen in full-screen mode. Be sure to close all browser windows. Your user name and password aren't stored, so you don't have to worry about someone else accessing your system.
If you're Internet-savvy and plan to connect to your home computer regularly, you can get a domain name to save yourself the trouble of writing down your IP address every time you plan to connect to your computer. You're already familiar with domain names; they're the ".com" names Web sites use to identify themselves. For example, the domain name for this Web site is Microsoft.com. If you have your own domain name, you can enter that into a browser to connect to your home computer, instead of the unfriendly IP address. For information on getting your own domain name and associating it with your home computer, visit the Dynamic DNS Providers List.
If you have Windows XP Professional and an always-on Internet connection, you can securely access your applications and data from work, an Internet café, or any place that has a compatible Web browser. Getting Remote Desktop Web Connection set up takes more than one click, but it's definitely easier than lugging your computer everywhere.

10 Ways to Troubleshoot DNS Resolution Issues

2010-12-21T02:11:00.000-08:00

1. Check for network connectivity

Many times, if you open your web browser, go to a URL, and that URL fails to bring up a website, you might erroneously blame DNS. In reality, the issue is much more likely to be caused by your network connectivity. This is especially true if you are using wireless networking on a laptop. With wireless security protocols, the key will be periodically renegotiated or the signal strength will fade, causing a loss of network connectivity. Of course, you can lose network connectivity on any type of network.
In other words, before blaming DNS for your problems, start troubleshooting by checking “OSI Layer 1 – Physical” first and then check your network connectivity. Here you should find a wireless connection with a valid Internet connection.

Figure 1: Good Wireless Network Connection
Notice how the Access is Local and Internet. If it just said “Local” then you do not have a valid network address (you only have a private APIPA that starts with 169.x.x.x).
This brings me to my next point. Make sure that you have a valid IP address on your network. You can check this out by going to View Status on the screen above and then to Details, you can check your IP address and verify your DNS Server IP addresses. Again, if you have a 169.x.x.x IP address you will never get to the Internet. Here is what it looks like:

Figure 2: Verifying your IP address and DNS Server IP addresses

2. Verify your DNS server IP addresses are correct and in order

Once you know that you have network connectivity and a valid IP address, let us move on to digging deeper into DNS by verifying that your DNS Server IP addresses are correct and are in the right order.
If you look at Figure 2 above, you can see the IPv4 DNS Server IP addresses. Notice that these are both on my local LAN / subnet so that I can access them even if my default gateway is down. This is how it works on most enterprise networks. However, your DNS servers do not always have to be on your subnet. In fact, with most ISPs, the DNS Server IPs would not even be on the same subnet as the default gateway.
In most home/SMB router configurations, they do not have their own DNS servers and the SMB router is proxying DNS to the real DNS Servers. In that case, your DNS Server IP address may be the same as your router.
Finally, make sure that your DNS Servers are in the right order. In my case, with the graphic in Figure 2, my local DNS Server is 10.0.1.20. It is configured to forward any names that it cannot resolve to 10.0.1.1, my local router. That router is proxying DNS to my ISP’s DNS Servers. I can look up those DNS Servers on my router, shown below in Figure 3.

Figure 3: My local DNS Servers, received from my ISP via DHCP
That brings me to two more points. First, make sure that your DNS Servers are in the right order. If you have a local DNS Server, like I do, and you are looking up a local DNS name, you want your PC client to lookup that local DNS name in the local DNS Server FIRST, before the Internet DNS Server. Thus, your local DNS server needs to be first in your DNS settings as these DNS Server IPs are in the order that they will be used.
Secondly, you should be able to ping the IP address of your ISP’s DNS Servers. So, just as my DNS servers are listed above on my router, I can verify that I can ping them even from my local PC:

Figure 4: Pinging my ISP’s DNS Server
Notice how the response time from the ping to my ISP’s DNS Server is horrible. This could cause slow DNS lookups or even failure if it takes too long for the DNS server to respond.

3. Ping the IP address of the host you are trying to get to (if it is known)

A quick way to prove that it is a DNS issue and not a network issue is to ping the IP address of the host that you are trying to get to. If the connection to the DNS name fails but the connection to the IP address succeeds, then you know that your issue has to do with DNS.
I know that if your DNS Server is not functioning then it could be hard to figure out what the IP address is that you want to connect to. Thus, to carry out this test, you would have to have a network diagram or, like many network admins do, just have the IP address of a common host memorized.
If this works, until the DNS server is available again, you could manually put an entry in your hosts file to map the IP to the hostname.

4. Find out what DNS server is being used with nslookup

You can use the nslookup command to find out a ton of information about your DNS resolution. One of the simple things to do is to use it to see what DNS server is providing you an answer and which DNS server is NOT. Here is my nslookup of www.WindowsNetworking.com

Figure 5: nslookup output
Notice, in Figure 5, how my local DNS server failed to respond but my ISP’s DNS server did provide me a “non-authoritative answer”, meaning that it does not host the domain but can provide a response.
You can also use nslookup to compare the responses from different DNS servers by manually telling it which DNS server to use.

5. Check your DNS suffix

If you are looking up a local host on a DNS server that your PC is a member of, you might be connecting to a host and not using the FQDN (fully qualified DNS name) and counting on the DNS suffix to help out. For example, if I were to connect to “server1”, the DNS server could have multiple entries for that DNS name. You should have your network adaptor configured with the connection specific DNS suffix, as shown on the first line on the graphic above, labeled Figure 1. Notice how in that graphic my DNS suffix is wiredbraincoffee.com. Whenever I enter just a DNS name like server1, the DNS suffix will be added on the end of it to make it server1.wiredbraincoffee.com.
You should verify that your DNS suffix is correct.

6. Make sure that your DNS settings are configured to pull the DNS IP from the DHCP server

It is likely that you would want your network adaptor to obtain DNS Server IP addresses from the DHCP Server. If you look at the graphic below, this adaptor has manually specified DNS Server IP addresses.

Figure 6: Verify DNS Server Settings
You may need to change to “Obtain DNS server address automatically” in order to get a new DNS server IP. To do this, open the Properties tab of your network adaptor and then click on Internet Protocol Version 4 (TCP/IPv4).

7. Release and renew your DHCP Server IP address (and DNS information)

Even if your adaptor is set to pull DNS information from DHCP, It is possible that you have an IP address conflict or old DNS server information. After choosing to obtain the IP and DNS info automatically, I like to release my IP address and renew it.
While you can do this with a Windows Diagnosis in your network configuration, I like to do it in the command prompt. If you have UAC enabled, make sure you run the Windows cmd prompt as administrator then do:
IPCONFIG /RELEASE
IPCONFIG /RENEW
Then, do an IPCONFIG /ALL to see what your new IP and DNS Server info looks like.

8. Check the DNS Server and restart services or reboot if necessary

Of course, if the DNS server is really hung, or down, or incorrectly configured, you are not going to be able to fix that at the client side. You may be able to bypass the down server somehow, but not fix it.
Thus, it is very likely that you, or the admin responsible for the DNS server, need to check the DNS Server status and configuration to resolve your DNS issue.

9. Reboot your small office / home DNS router

As I mentioned above in #2 and showed in Figure 3, on home and small office routers, the DNS server settings are typically handed out via DHCP with the DNS server set to the IP of the router and the router will proxy the DNS to the ISP’s DNS server.
Just as it is possible that your local PC has network info (including DNS server IP Addresses), it is also possible that your router has bad info. To ensure that your router has the latest DNS server information, you may want to do a DHCP release and renew on the router’s WAN interface with the ISP. Or, the easier option may be just to reboot the router to get the latest info.

10. Contact your ISP

We all know how painful it can be to contact an ISP and try to resolve a network issue. Still, if your PC is ultimately getting DNS resolution from your ISP’s DNS servers, you may need to contact the ISP, as a last resort.

6 Tips for Troubleshooting Active Directory

2010-12-21T01:48:00.000-08:00

Tip 1: Determining DNS Health

The first thing we want to determine when assessing AD's overall health is DNS. Failing DNS can cause problems such as client authentication, application failure, Exchange failures with e-mail or GAL lookups, LDAP query failures, replication failures ... you get the picture. DNS is critical. There's a very powerful option for DCDiag.exe: C:\DCdiag /Test:DNS /e /v can be redirected to a file. The /e option indicates the test will be run on all DNS servers and /v is for verbose output. In a large environment, this may take a while to run, but it's worth the wait. I always read this starting at the bottom of the report, which is a table like that shown in Table 1. DCdiag runs six different tests: Authentication (Auth), Basic Connectivity (Basc), Forwarders (Forw), Delegation (Del), Dynamic registration enabled (Dyn) and Resource Record registration (RReg). The table also lists the External (Ext) test (connection to the Internet), but this command doesn't perform that test.

Auth	Basc	Forw	Del	Dyn	RReg	Ext
Domain: Corp.net Corp-DC02 Corp-DC03 Corp-DC01	PASS PASS PASS	WARN WARN WARN	n/a n/a n/a	n/a n/a n/a	PASS PASS PASS	FAIL FAIL FAIL	n/a n/a n/a
Domain: EMEA.Corp.net EMEA-DC03 EMEA-DC02 EMEA-DC01	FAIL FAIL FAIL	FAIL FAIL FAIL	n/a n/a n/a	n/a n/a n/a	n/a n/a n/a	n/a n/a n/a	n/a n/a n/a
Domain: Americas.Corp.net AM-DC10 AM-DC11 AM-DC12 AM-DC13	PASS PASS PASS PASS	PASS PASS PASS PASS	PASS PASS PASS PASS	PASS PASS PASS PASS	PASS PASS PASS PASS	FAIL FAIL FAIL FAIL	n/a n/a n/a n/a
Table 1. Enterprise DNS Infrastructure test results.

In the sample output in Table 1, every DNS server -- which is usually also every domain controller (DC) -- in the forest is listed by domain. The cool thing about that is that it shows the domain configuration of the forest, which is very handy if you're a consultant or support engineer and not familiar with the environment. In reading the data in the table, the results are:

PASS: The DNS server passed this particular test
FAIL: The DNS server failed the test
N/A: The test was not run. This is usually due to a previous test failing, so it makes no sense to test a dependant function, which will fail anyway.

In Table 1, we see the value of this test. In a glance, I can see where my trouble spots are. In a multiple-domain forest, you must run this command with Enterprise Admin credentials, or you will get FAIL results on all tests for all DNS servers in domains for which you don't have privileges. This is what happened for the EMEA domain in Table 1.

For further help, a complete, detailed list of the test results is available earlier in the report. For instance, I can go to the top of the report and search for Corp-DC02, and get details as shown in Figure 1.

There's a lot of good information I've cut for brevity, but you can construct the DNS resolver configuration for each DNS server just from the data here. There's a lot of other data here as well. But the point is that this section shows why the forwarders test had an N/A in the summary in Table 1. Using this method, we can pick our way through all the warnings, failures and N/A results in the summary table. And, of course, the beauty is that you have all DNS servers in the forest in one nice text file generated from one command. This can be run even from a client that has DCDiag on it.

Figure 1. Test results for domain controllers:

DC: Test-DC1.Wtec.adapps.com
   Domain: Wtec.adapps.com       
    TEST: Authentication (Auth)
     Authentication test: Successfully completed
    TEST: Basic (Basc)
     Microsoft(R) Windows(R) Server 2003,
     Enterprise Edition (Service Pack level: 2.0) is supported
    NETLOGON service is running
    
     IP address is static
     IP address: 10.13.62.95
    
     DNS servers:
     10.13.62.105 () [Valid]
     10.13.62.95 () [Valid]

Tip 2: Determining AD Replication Health

The Support tools for Windows 2003 Service Pack 1 (SP1) include a new Repadmin option called /replsum. Similar to the DCdiag /Test:DNS command in Tip No. 1, /replsum collects replication information for every DC in every domain in the forest. It will report the last time replication occurred between the DC the command was run on and each other DC in the forest. While there are a number of different options, I've only used these:

Repadmin /replsum /bysrc /bydest /sort:delta

/bysrc indicates to collect data for DCs that have replicated from the DC this command is run on
/bydest indicates to collect data for DCs that have replicated to the DC this command is run on
/sort:Delta means to show the results in descending order

A sample output is shown in Table 2. This shows six DCs in the domain and the delta since their last replication. Here we can easily see that the domain is healthy except for WTEC-DC2, which has not replicated for five days with an error 1722. I know this DC is down due to a planned move in the data center. In addition, if a DC has not replicated for its tombstone lifetime days, it will be flagged in this report so an administrator can immediately see the danger and take steps to remove it from the network.

Source	Largest Delta	Fails/Total	%%	Error
WTEC-DC2	05d.13h:39m:15s	5 / 5	100	(1722)The RPC server is...
WTEC-DC1	41m:26s	0 /20	0
DDMCWIN2K8	39m:00s	0 /4	0
GSE-EXCH3	08m:59s	0/6	0
MRNVMWTEC	08m:56s	0 / 4	0
WTEC-DC6	08m:34s	0 / 6	0
Destination DC	Largest Delta	Fails/Total	%%	Error
WTEC-DC1	05d.13h:39m:39s	5 /25	20	(1722) The RPC server is...
DDMCWIN2K8	41m:50s	0 / 4	0
GSE-EXCH3	13m:35s	0 / 6	0
MRNVMWTEC	07m:24s	0 / 4	0
WTEC-DC6	06m:25s	0 / 6	0
Table 2.

Tip 3: Replication Details for All DCs in the Forest

This technique -- very similar to the method used in Tip No. 2 -- will provide more detail. The command is Repadmin /showrepl * /csv >showrepl.csv. This puts the output in .CSV format, as shown in Table 3.

I like this command because it frequently turns up errors in more detail than the Repadmin/replsum command. Additionally, it will often report different errors -- or additional errors, error codes and so on -- and provide the naming context and specific data that /replsum doesn't provide.

Naming Context	Source DC	Number of Failures	Last Failure Time	Last Success Time	Last Failure Status
DC=Wtec,DC=adapps,DC=hp,DC=com	WTEC-DC2	535	2/18/2009 21:36	2/13/2009 7:50	1722
DC=Wtec,DC=adapps,DC=hp,DC=com	GSE-EXCH3	0	0	2/18/2009 21:37	0
DC=Wtec,DC=adapps,DC=hp,DC=com	WTEC-DC6	0	0	2/18/2009 21:37	0
DC=Wtec,DC=adapps,DC=hp,DC=com	MRNVMWTEC	0	0	2/18/2009 21:37	0
Table 3.

Tip 4: NTDS Diagnostics

This tip is an absolute essential for getting additional data on Directory Service (DS) events. It's enabled per DC in the registry at HKEY_LOCAL_MACHINE\SYSTEM\

CurrentControlSet\Services\NTDS\Diagnostics. It's fairly straightforward. There are a variety of values that, when enabled, will dump additional events into the event log to assist with troubleshooting. The valid data for these values is an integer from zero to five, inclusive. The default value is zero, meaning minimal verbosity, and a setting of five will dump more than you want. Normally I set it at three and see if I need more. For instance, if I need more verbose details on replication, I'd set the "5 Replication Events" value to three and then reproduce the problem. Make sure to reset the value to zero when troubleshooting is concluded. These settings will fill up the event log quickly.

The most common values I use include:

1 Knowledge Consistency Checker
10 Performance Counters
13 Name Resolution (this is DNS related)
15 Field Engineering
18 Global Catalog
2 Security Events
5 Replication Events
8 Directory Access
9 Internal Processing

The 9 Internal Processing value is handy for getting additional details for DS events that indicate an internal error has occurred. This will often cause additional events that will aid in diagnosing the problem. It's common to set more than one of these values. For instance, in replication troubleshooting, it would be reasonable to enable 1 Knowledge Consistency Checker and 5 Replication Events.

The 15 Field Engineering value will dump several additional events to the DS log. Unlike the other diagnostics, this one needs to be set to five to provide relevant data. Specifically, it will produce events 1644 and 1643, which report inefficient LDAP queries including the client who was the source of the query, the query string and the root of the query. This is important because one of the headaches related to AD is the Local System Authority Subsystem Service (LSASS) process using up enough resources to hang or crash a DC and cause client log-on delays. Inefficient LDAP queries by a user or by an application -- or even a Linux client log-on -- will put a heavier load on LSASS. Enabling this diagnostic will quickly identify the guilty party by name or IP address. Some admins leave this diagnostic permanently enabled to monitor a busy environment, but again, it will fill up the event logs and possibly hide or overwrite other important events in the DS log.

Tip 5: Group Policy Management Console and HTML Reports

I'm sure nearly every AD admin alive uses this tool, but I thought it would be worth mentioning the value of HTML reports. There are two types of reports I use very frequently because I'm dealing with environments I'm not familiar with, and I usually want proof of the settings of a Group Policy Object (GPO) as well as the results from a particular client or clients.

Getting a report of a GPO is valuable even if you're the admin because it shows exactly what settings are defined -- in fact, it shows only the settings that are defined -- so you don't have to wade through the GP editor to find which ones are set. This is a quick way to see if the GPO is defined as you think it is. It also shows links, filters applied and other details. HTML reports for the Default Domain Policy are easy to read and can be expanded and closed by sections as needed, because they're in HTML format. To get this report, just right-click on any GPO in the domain tree and select "Save Report."

One of the problems with solving a GPO-related issue at a client is pestering the user, who may be hundreds of miles away, to log in and get a GPResult. If the user has logged in at least once on a workstation, Group Policy Management Console (GPMC) can provide you with an HTML-formatted GPResult that is produced when the user logs on. This is obtained in the GPMC console by right-clicking the "Group Policy Results" node and selecting the Group Policy Results Wizard. Of course, GPResult is a necessity in diagnosing client-side issues.

Tip 6: Active Directory Performance Diagnosis

While there are many other troubleshooting tips I could have elaborated on here, this is one that probably isn't well known. In troubleshooting server performance, there's a standard set of objects, including processor, LogicalDisk, Server, Memory, System and so on. However, there's an NTDS object that provides us with relevant AD counters such as DRA, Kerberos, LDAP and even NTLM-related counters. In addition, we can collect valuable AD data by monitoring the LSASS process. I recommend enabling the following:

Object: Process

Counters: %ProcessorTime, Working Set, Working Set Peak

Object: NTDS

Counters: (all counters)

Unfortunately, there's little information available on what acceptable thresholds are. The only one I've found that even addresses this is Microsoft's Branch Office Deployment guide. While there are many counters may or may not be familiar, I've only found a few that are significant:

DRA Pending Replication Synchronizations: These are the directory synchronizations that are queued and are essentially replication backlog. Microsoft only says these values should be "as low as possible" and that "hardware is slowing replication." These could be indications that DC resources are at high utilization.
LDAP Client Sessions: This is the number of sessions opened by LDAP clients at the time the data is taken. This is helpful in determining LDAP client activity and if the DC is able to handle the load. Of course, spikes during normal periods of authentication -- such as first thing in the morning -- are not necessarily a problem, but long sustained periods of high values indicate an overworked DC.
LDAP Bind Time: This is the time in milliseconds needed to complete the last successful LDAP binding. Documentation says that this should be "as low as possible," but if you run the perfmon output through the Performance Analyzer of Logs (PAL) tool, it will flag 15 milliseconds as a warning threshold and 30 milliseconds as an error threshold. The fix is more resources: processor, memory and so on. (Note: PAL is an excellent performance-analysis tool, and is available online.)

In diagnosing the LSASS process, as in any performance analysis, a baseline must be established. A note on Microsoft's DS blog indicates that if a baseline is not available, use 80 percent. That is, the LSASS counters shouldn't indicate more than 80 percent consumption. Above 80 percent consumption indicates an overload condition, which could be a high LDAP query demand (see Tip No. 4) or general lack of server resources. The resolution is to increase resources or reduce demand, but be advised this has the potential to cause a performance hit in the domain.

If you really want to solve your LSASS resource issues, put your DCs on x64 platforms with several processors and 32GB of RAM. You might be surprised at how much memory LSASS really can use.

How Firewalls Work

2010-12-21T00:37:00.000-08:00

If you have been using Internet on a regular basis or working in a large company and surf the Internet while you are at work, you must have surely come across the term firewall. You might have also heard of people saying “firewalls protect their computer from web attacks and hackers” or “a certain website has been blocked by firewall in their work place”. If you have ever wondered to know what exactly is this firewall and how it works, here we go. In this post I will try to explain “How firewalls work” in a layman’s terms.

How Firewalls Work

Firewalls are basically a barrier between your computer (or a network) and the Internet (outside world). A firewall can be simply compared to a security guard who stands at the entrance of your house and filters the visitors coming to your place. He may allow some visitors to enter while denying others whom he suspects of being intruders. Similarly a firewall is a software program or a hardware device that filters the information (packets) coming through the Internet to your personal computer or a computer network.

Firewalls may decide to allow or block network traffic between devices based on the rules that are pre-configured or set by the firewall administrator. Most personal firewalls such as Windows firewall operate on a set of pre-configured rules that are most suitable under normal circumstances so that the user need not worry much about configuring the firewall.
Personal firewalls are easy to install and use and hence preferred by end-users for use on their personal computers. However large networks and companies prefer those firewalls that have plenty of options to configure so as to meet their customized needs. For example, a company may set up different firewall rules for FTP servers, Telnet servers and Web servers. In addition the company can even control how the employees connect to the Internet by blocking access to certain websites or restricting the transfer of files to other networks. Thus in addition to security, a firewall can give the company a tremendous control over how people use the network.
Firewalls use one or more of the following methods to control the incoming and outgoing traffic in a network:
1. Packet Filtering: In this method packets (small chunks of data) are analyzed against a set of filters. Packet filters has a set of rules that come with accept and deny actions which are pre-configured or can be configured manually by the firewall administrator. If the packet manages to make it through these filters then it is allowed to reach the destination; otherwise it is discarded.
2. Stateful Inspection: This is a newer method that doesn’t analyze the contents of the packets. Instead it compares certain key aspects of each packet to a database of trusted source. Both incoming and outgoing packets are compared against this database and if the comparison yields a reasonable match, then the packets are allowed to travel further. Otherwise they are discarded.

Firewall Configuration

Firewalls can be configured by adding one or more filters based on several conditions as mentioned below:
1. IP addresses: In any case if an IP address outside the network is said to be unfavorable, then it is possible to set filter to block all the traffic to and from that IP address. For example, if a cetain IP address is found to be making too many connections to a server, the administrator may decide to block traffic from this IP using the firewall.
2. Domain names: Since it is difficult to remember the IP addresses, it is an easier and smarter way to configure the firewalls by adding filters based on domain names. By setting up a domain filter, a company may decide to block all access to certain domain names, or may provide access only to a list of selected domain names.
3. Ports/Protocols: Every service running on a server is made available to the Internet using numbered ports, one for each service. In simple words, ports can be compared to virtual doors of the server through which services are made available. For example, if a server is running a Web (HTTP) service then it will be typically available on port 80. In order to avail this service, the client needs to connect to the server via port 80. Similarly different services such as Telnet (Port 23), FTP (port 21) and SMTP (port 25) services may be running on the server. If the services are intended for the public, they are usually kept open. Otherwise they are blocked using the firewall so as to prevent intruders from using the open ports for making unauthorized connections.
4. Specific words or phrases: A firewall can be configured to filter one or more specific words or phrases so that, both the incoming and outgoing packets are scanned for the words in the filter. For example, you may set up a firewall rule to filter any packet that contains an offensive term or a phrase that you may decide to block from entering or leaving your network.

Hardware vs Software Firewall

Hardware firewalls provide higher level of security and hence preferred for servers where security has the top most priority whereas, the software firewalls are less expensive and are most preferred in home computers and laptops. Hardware firewalls usually come as an in-built unit of a router and provide maximum security as it filters each packet in the hardware level itself even before it manages to enter your computer. A good example is the Linksys Cable/DSL router.

Why Firewall?

Firewalls provide security over a number of online threats such as Remote login, Trojan backdoors, Session hijacking, DOS & DDOS attacks, viruses, cookie stealing and many more. The effectiveness of the security depends on the way you configure the firewall and how you set up the filter rules. However major threats such as DOS and DDOS attacks may sometimes manage to bypass the firewalls and do the damage to the server. Even though firewall is not a complete answer to online threats, it can most effectively handle the attacks and provide security to the computer up to the maximum possible extent.

Exchange 2003 Setup Guide

2010-12-14T01:33:00.000-08:00

First install two servers running Windows 2003 (R2 if you have it)
Next patch fully using Windows update
Create a domain controller (any therefore a domain)
Join the second machine to the domain
On the second machine which will become your Exchange server install the prereqs for Exchange
Open Add/Remove Programs control panel

Click Add/Remove Windows Components

Select Application Server and click Details

Click ASP.NET

Double Click Internet Information Services (IIS)
Scroll down and check the box next to NNTP and SMTP

Click OK twice and then click Next
When prompted insert the CDs as requested
Once the install is complete click Finish and close the Add/Remove programs control panel

Exchange install - Forest and Domain Prep

Next insert the Exchange 2003 CD
Click Exit on the first page

Now download the latest Exchange deployment tools which can be found at the link below (as of 30/12/2006)
http://www.microsoft.com/downloads/details.aspx?familyid=271e51fd-fe7d-42ad-b621-45f974ed34c0&displaylang=en
Once you have the latest Exdelpoy.exe double click it.
Enter the location to save the files and click "OK"

Click OK

Next locate and double click the exdeploy.hta file

You are now at the first page of the Exchange deployment tools
Click "Deploy the first Exchange server"

Click "New Exchange 2003 Installation"

The first three steps are all about ensuring the prerequisites are met. Select the checkboxes by steps 1 and 2 as these have already been covered.

Select the checkboxes by steps 1 and 2 as these have already been covered.

For step three ensure the support tools are installed. If they are not, download them from the link below and install them:
http://www.microsoft.com/downloads/details.aspx?familyid=6EC50B78-8BE1-4E81-B3BE-4E7AC4F0912D&displaylang=en
Click the box by step three

To perform step four open a CMD prompt (Start, Run, type "CMD", Press "Enter")
In the CMD prompt window type the command below and press enter:
dcdiag /f:c:\dcdiaglog.txt /s:domaincontrollername.domain.com

This will output the results to a text file in the C: called dcdiaglog.txt. Open the file and ensure there are no errors. You should see output like the following:
Domain Controller Diagnosis
Performing initial setup:
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\E2K7DC1
      Starting test: Connectivity
         ......................... E2K7DC1 passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\E2K7DC1
      Starting test: Replications
         ......................... E2K7DC1 passed test Replications
      Starting test: NCSecDesc
         ......................... E2K7DC1 passed test NCSecDesc
      Starting test: NetLogons
         ......................... E2K7DC1 passed test NetLogons
      Starting test: Advertising
         ......................... E2K7DC1 passed test Advertising
      Starting test: KnowsOfRoleHolders
         ......................... E2K7DC1 passed test KnowsOfRoleHolders
      Starting test: RidManager
         ......................... E2K7DC1 passed test RidManager
      Starting test: MachineAccount
         ......................... E2K7DC1 passed test MachineAccount
      Starting test: Services
         ......................... E2K7DC1 passed test Services
      Starting test: ObjectsReplicated
         ......................... E2K7DC1 passed test ObjectsReplicated
      Starting test: frssysvol
         ......................... E2K7DC1 passed test frssysvol
      Starting test: frsevent
         ......................... E2K7DC1 passed test frsevent
      Starting test: kccevent
         ......................... E2K7DC1 passed test kccevent
      Starting test: systemlog
         ......................... E2K7DC1 passed test systemlog
      Starting test: VerifyReferences
         ......................... E2K7DC1 passed test VerifyReferences

   Running partition tests on : ForestDnsZones
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom

   Running partition tests on : DomainDnsZones
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom

   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom

   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom

   Running partition tests on : exchange
      Starting test: CrossRefValidation
         ......................... exchange passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... exchange passed test CheckSDRefDom

   Running enterprise tests on : exchange.local
      Starting test: Intersite
         ......................... exchange.local passed test Intersite
      Starting test: FsmoCheck
         ......................... exchange.local passed test FsmoCheck

If you get any errors then investigate them. You could post a question to the forums at http://www.mmmug.co.uk/forum
So long as you have no errors move back to the deployment tools and check the 4th box.

Next move back to the command prompt and enter the command below and press enter:
Netdiag >c:\netdiaglog.txt

The command will take a short while to execute. Once complete view the log file in the C:
...................................
     Computer Name: E2K7MB1
    DNS Host Name: E2K7MB1.exchange.local
    System info : Microsoft Windows Server 2003 R2 (Build 3790)
    Processor : x86 Family 6 Model 13 Stepping 8, GenuineIntel
    List of installed hotfixes :
        KB890046
        KB893756
        KB896358
        KB896422
        KB896424
        KB896428
        KB898715
        KB899587
        KB899588
        KB899589
        KB899591
        KB900725
        KB901017
        KB901214
        KB902400
        KB904706
        KB904942
        KB905414
        KB908519
        KB908531
        KB909520
        KB910437
        KB911164
        KB911280
        KB911562
        KB911567
        KB911927
        KB912919
        KB914389
        KB916281
        KB917344
        KB917734
        KB917953
        KB918439
        Q147222
Netcard queries test . . . . . . . : Passed
Per interface results:
     Adapter : Local Area Connection
         Netcard queries test . . . : Passed
         Host Name. . . . . . . . . : E2K7MB1
        IP Address . . . . . . . . : 192.168.23.20
        Subnet Mask. . . . . . . . : 255.255.255.0
        Default Gateway. . . . . . : 192.168.23.1
        Dns Servers. . . . . . . . : 192.168.23.10
         AutoConfiguration results. . . . . . : Passed
        Default gateway test . . . : Failed
            No gateway reachable for this adapter.
        NetBT name test. . . . . . : Passed
        [WARNING] At least one of the <00> 'WorkStation Service', <03> 'Messenger Service', <20> 'WINS' names is missing.
        WINS service test. . . . . : Skipped
            There are no WINS servers configured for this interface.
Global results:
Domain membership test . . . . . . : Passed
NetBT transports test. . . . . . . : Passed
    List of NetBt transports currently configured:
        NetBT_Tcpip_{BA408A51-ABAA-4413-8D49-BA81B877126B}
    1 NetBt transport currently configured.
Autonet address test . . . . . . . : Passed
IP loopback ping test. . . . . . . : Passed
Default gateway test . . . . . . . : Failed
    [FATAL] NO GATEWAYS ARE REACHABLE.
    You have no connectivity to other network segments.
    If you configured the IP protocol manually then
    you need to add at least one valid gateway.
NetBT name test. . . . . . . . . . : Passed
    [WARNING] You don't have a single interface with the <00> 'WorkStation Service', <03> 'Messenger Service', <20> 'WINS' names defined.
Winsock test . . . . . . . . . . . : Passed
DNS test . . . . . . . . . . . . . : Passed
Redir and Browser test . . . . . . : Passed
    List of NetBt transports currently bound to the Redir
        NetBT_Tcpip_{BA408A51-ABAA-4413-8D49-BA81B877126B}
    The redir is bound to 1 NetBt transport.
    List of NetBt transports currently bound to the browser
        NetBT_Tcpip_{BA408A51-ABAA-4413-8D49-BA81B877126B}
    The browser is bound to 1 NetBt transport.
DC discovery test. . . . . . . . . : Passed
DC list test . . . . . . . . . . . : Passed
Trust relationship test. . . . . . : Passed
    Secure channel for domain 'EXCHANGE' is to '\\E2K7DC1.exchange.local'.
Kerberos test. . . . . . . . . . . : Passed
LDAP test. . . . . . . . . . . . . : Passed
Bindings test. . . . . . . . . . . : Passed
WAN configuration test . . . . . . : Skipped
    No active remote access connections.
Modem diagnostics test . . . . . . : Passed
IP Security test . . . . . . . . . : Skipped
    Note: run "netsh ipsec dynamic show /?" for more detailed information
The command completed successfully

The text file should like the above output. You should get no errors. (I have errors for Default gateway because this is an isolated test system)
If you get any errors then investigate them. You could post a question to the forums at http://www.mmmug.co.uk/forum
So long as you have no errors move back to the deployment tools and check the 5th box.

The next step is to run Forest prep. This must be run by a user with Schema administrator permissions. Forest Prep will extend the AD Schema with the new classes and attributes that Exchange 2003 requires to operate.
To proceed enter the path to the install CD in the box provided and click "Run ForestPrep now"

WARNING: This operation is not undoable. Only do this if you are certain you want to proceed. I suggest testing in a lab environment before going into production. If you are unsure post a question in the Forums. http://www.mmmug.co.uk/forum

If prompted about an incompatibility then select the checkbox to ignore the warning in the future and click “Continue”

The Warning occurs because Exchange 2003 RTM needs upgrading to SP2 which we will install later.
Once the install opens click “Next”

Agree to the license and click “Next”

Note that only ForestPrep will be performed and that files will go in the default location C:\Program Files\Exchsrvr (this can be changed if required to place files on an Application drive)
Click “Next”

Select the account to be the first Exchange Full Administrator. The default is the account you are logged in as. If you are only logging in as a special schema admin account then you should select an account that will be used to admin Exchange. I will leave the default in place of Administrator.
Click “Next”
SCREENSHOT of ACCOUNT DETAILS MISSING
ForestPrep is a fairly slow process that could take around 30mins on a slow network. You will see several screens like the one below

Once the process is complete click Finish

Next move back to the deployment tools and check the box on the 6th step

Now move onto the Domain Prep. This will need to be performed in the root domain and any others which will hold Exchange mailboxes. Personally it is simplest to run it in all domains in the forest.
In a simple single domain forest proceed as follows:
Enter the path to the Install files where requested and click “Run DomainPrep now”.

On the welcome page click “Next”

Accept the licence and click “Next”

Again note that only DomainPrep will be carried out and that you can change the file location if you want (Only change it if you changed the location for ForestPrep too)
Click “Next”

Early in the process you will likely be warned that your domain is insecure for mail-enabled groups with hidden DL membership. Anyone in the Pre-Windows 2000 Compatible Access group can view this membership. So long as you are not using the group for a valid reason remove the default membership of Authenticated users to remove the problem.
Click "OK"

The DomainPrep is quick and shows the screen below whilst running

Once complete click Finish

Move back to the deployment tools and check the box of the 7th step.

You are now ready to install Exchange.
Move onto step 8. Again enter the path to the install files and click “Run Setup Now”
On the welcome page click “Next”

Accept the licence and click “Next”

This time check the install options carefully. You can choose which components to install. Generally the defaults are fine and that is what we shall stick with. Note also, that you can change the file location. Again you should do this if you changed the location for forest and domain prep.
Once you are happy with your selections, click “Next”

As there is no Exchange org setup currently select to create one and click “Next”

Name the org and click “Next”

Agree to the licence and click “Next”

Verify your choices and click “Next”

The installation will progress

When complete click Finish

Now return to the deployment tools and check the box next to step 8.
Click “Next” on the deployment tools bottom right hand corner
The next page runs through the steps again for other Exchange servers.
For now we will not install another server so again click “Next” on the deployment tools bottom right hand corner.
Read through the post installation steps. We will cover the important items from here, like SMTP Filtering, Memory optimisation and Connecting to the Internet later on.
Congratulations you have just installed Exchange!
Now let's move on to setting it up the way we want it!

How to move everything over to the new server

2010-12-07T05:36:00.000-08:00

1.	Build your new server First thing, build your new server with the most common used Windows 2003 Server. The old server is called as OLDDC and the new one is NEWDC. Assign a large C: partition, at least 25gb. The rest of can be partitioned into the D: drive. I don't like to create a lot of partitions because they just cause more overhead for little purpose. ALWAYS keep your OS and data separate though! As for the server, most places up through 100 users can easily get by with a single RAID controller running RAID5. You'll see plenty of debate over this (RAID6, RAID10, etc) but I've had good luck with this configuration. 4gb of RAM for Windows Standard.
2.	Promote the server to be the DC a. Insert your new server into the domain. Make sure to install DNS, DHCP and WINS before continuing. b. Run "DCPROMO" and make this a new DC in your domain. c. Record your AD Recovery password! d. Wait at least an hour or 2 to make sure everything gets replicated and you AD settles down.
3.	Move your FSMO roles a. RID, PDC and Infrastructure roles can be found in Active Directory Users and Computers by right clicking on your domain and click on the Operations Masters. Wait at least 30 seconds between changing each role to make sure the task gets kicked off before moving on to the next role. b. Operations Master role can be found in Active Directory Domains and Trusts by right clicking on Active Directory Domains and Trusts (above the domain) and click on Operations Master. c. Global Catalog can be found in Active Directory Sites and Services and drilling down to the NTDS settings of your server and right clicking on it. Check GC to create a new GC on that server. d. Wait at least and hour, then drill down to the NTDS settings on OLDDC and uncheck the GC from it. e. While not strictly FSMO roles, I like to click on each site in AD Sites and Services and make sure that the Licensing Site Settings and TS-Enterprise-License-Server are pointing to the new server.
4.	Move the Schema Master This role is often missed in AD migrations. a. From command line, register the schema master DLL. "regsvr32 schmmgmt.dll" b. Run "MMC" to give you a blank management console. c. Click on "File", "Add/Remove Snap-in". Click on "Add". Locate "Active Directory Schema" and click on "Add". Click on "Close", then click on "OK". d. Right click on "Active Directory Schema". You'll notice it attaches to your old DC. Click on "Change Domain Controller" and then specify your new domain controller. e. Right click again, and click on "Operations Master". Move the Schema master to your new server.
5.	Migrate DNS Since DNS was already installed on your new DC it should now have the full DNS structure downloaded. Verify this by opening the DNS MMC and seeing your data. Point all of your static IP address devices to use your new server as their DNS server. Sorry, this is a manual process.
6.	Migrate WINS WINS is barely used in Windows domains, but I like to keep it as a last resort name resolution solution. Because of that, even in large environments, I tend to only have 1 WINS server. If you have very large remote offices and feel the need to replicate WINS make sure to setup a classic hub and spoke topology with only 1 hub server and each spoke replicates ONLY with the hub. Do not setup any circular replication. Manually update your static IP address devices to use your new server as their WINS server.
7.	Migrate DHCP This is pulled from Microsoft document KB325475. a. On OLDDC, go to a command prompt and type: netsh dhcp server export C:\dhcp.txt all b. Copy C:\DHCP.TXT to the C:\ on NEWDC c. On NEWDC type: netsh dhcp server import c:\dhcp.txt all d. Open the DHCP MMC and right click on NEWDC. Click on Properties. e. Click on Advanced. Change "Conflict detection attempts" to at least 2. This way the new DHCP server will PING an address before handing it out. This avoids IP conflicts. f. Click on the "Credentials" button and put in your DHCP service account information in here. I would recommend creating a special SVC account for this instead of using the "Administrator" account. Click on "OK" twice to exit out of the window. g. Right click on the NEWDC again and click on "Authorize". The new scope is now active. h. Make sure to update the scope options to use your new DNS and WINS IP addresses. i. Now go to OLDDC and open up the DHCP MMC. Open up the server and right click on the old scope. Click on "Deactive" to turn off the old scope.
8.	Migrate Printers a. Download and install the Print Migrator (see references below) on NEWDC. b. Run Print Migrator. Click View, then click on Target. Type in "\\OLDDC" and click on OK. c. Click on Actions, then Backup. Save the .CAB to the desktop on NEWDC. This will take a few minutes. d. Click on View again, and click on Target. Type in "\\NEWDC" and click on OK. e. Click on Actions then Restore. Point to the .CAB you saved above and click on "OK". f. You may get an error message about Kernel level drivers. Click on "NO" (if you click YES it will cancel the restore). g. Double check that all of your printers came over. You may have a couple that didn't (any printer that uses a *.CAB file in it's driver set will fail to restore using print migrator). Manually recreate those printers.
9.	Move users to new printer shares a. Download the MigratePrinters script from the "Migration Scripts" reference below. b. Edit the first 2 lines to reflect the old server name (OLDDC) and the new server name (NEWDC). c. Launch the VB script from your login script when users log in. If the user has a printer from the old server it will try to map that EXACT same printer on the new server. If this fails the script moves on to the next printer. If it succeeds in mapping the printer it will then determine if this was default printer as well and set that. d. Do NOT rename the printers!
10.	Migrate File Shares - Phase 1 a. Download and install the File Migration Utility from the reference link below onto NEWDC. b. Create a new migration project. c. Follow the New Project Wizard. I have not done the DFS portion, so typically uncheck this part. Set your default location to D:\ and Finish. d. From the main server, click on "Add Server..." under the "Source file servers" pull down. Type in OLDDC. e. Select the shares you wish to migrate. Be careful here. The File Migrator does not move shares within shares very well (if you have d:\share and d:\share\share shared, it'll have all kinds of problems). Note the Target Share and Target location over to the right. f. On the "View by" pull down, select "Target Volumes". Click through every folder in this section. g. Change the "Target Share" to what you want it to be (default adds the old server name, which is probably not what you want). h. Change the "Target Location" on the right. Same problem, edit each folder as necessary. i. Click on "Continue" and validate everything before starting (this may take a couple of minutes to come up). j. Click on "Continue" to begin the phase 1 file copy. This will create new shares on the new server and begin copying files from the old server. It does NOT turn off access to the old server and can be run during business hours. Any files that are in use will be skipped. I sometimes call this step "pre-seeding".
11.	Migrate File Shares - Phase 2 a. Phase 1 will probably take several hours to complete. Once done schedule a downtime for the file server. Usually on the weekends. b. It is possible to exit out of the File Migration utility and restart it later, just note the configuration file name so you can load that later. c. When ready for Phase 2, click on "Continue" and confirm you wish to turn off the shares. This will turn off all access to the old server and copy all files that have changed since the phase 1 file copy. d. When completed the File Migration utility will turn on the new shares and they will now be accessible. e. Update your login script to reflect the shared folder change. If you don't have a login script, now would be a good time to implement one. A simple script could look like: NET USE S: /D NET USE S: \\NEWDC\SHARED
12.	Change User Folders a. One of the shares you selected in steps 10 and 11 should have been the user's private home directory. b. You can manually go through Active Directory Users and Computers and update the profile tab on all users to point to the new home directory. Or: c. You can run the ChgHomeDir script from the Migration Scripts reference below. d. Edit the script and change the first line to be your search string. If you have multiple USER folders you can specify exactly which one you want to change. The first line is a search string, if the data is matched from this string then the home directory will be changed. The script searches the current home directory field. e. Second line of the script is the path to the new users folder. f. Copy the script to NEWDC and run it. A log will be created of every folder that was changed and what it was changed to. Alternate method: ------------------------ a. Simply multi-select (ctrl-click) the users you want to change. b. Right click and click on properties c. Click on the "Profile" tab d. Click on "Home Folder", click on "Connect" then select the drive letter and type the path: \\NEWDC\USERS\%USERNAME% e. You'll probably get an error message that the folders already exist, that's OK. Click on "Cancel" to exit this window.
13.	Retire WINS a. Open up WINS on NEWDC. b. Drill down and right click on "Active Registrations". Click on Delete Owner. c. Locate OLDDC and select it. Click on "Replicate deletion to other servers (tombstone)" and click on "OK".
14.	Cleanup on OLDDC a. Run DCPROMO on OLDDC, make sure you DO NOT select "This is the last domain controller in the domain". That would be bad. Reboot as needed. b. Uninstall DHCP and DNS from OLDDC c. Remove OLDDC from the domain and power off.
15.	Final Steps a. At this point you have completed the migration. b. Install Backup and Anti-Virus agents and any other software you typically use in your environment. c. Rebuild OLDDC as a SpiceWorks server.

Conclusion

Obviously, you accomplished.

NOTE:

1. File Migration utility utilizes WMI and doesn't work on NT4.0.
2. As recently noted, the Print Migrator is 32-bit application only and will not migrate to a 64-bit system. It will also not migrate 64-bit drivers. Additionally, it has problems with print drivers that use *.CAB files in their driver set (some HP printers do this) and those will not migrate.

How to Transfer FSMO roles that cannot be transferred using the Operations Master

2010-12-07T05:04:00.000-08:00

1.	Primary Domain Controller (DC1) online? a. Yes Proceed to step 2 b. No Skip to step 5
2.	Uninstall Active Directory From DC1 dcpromo or dcpromo /forceremove
3.	Remove DNS From DC1 Using "Manage Your Server Utility" from the start menu, click Add/Remove Roles then Remove DNS
4.	Move DC1 to a work group 1. WIN + Pause/Break or start menu, right click my computer and select properties 2. Click computer name tab 3. Click change 4. Select workgroup 5. Enter Workgroup name YOU MUST RENAME THE COMPUTER AS WELL 6. Shutdown machine
5.	Remove Orphaned Domain Controller (DC1) 1. Log on to the Secondary Domain Controller (DC2) 2.Click Start, point to Run then type “CMD”, then press ENTER. 3. Type “ntdsutil” then press ENTER. 4. Type metadata cleanup, and then press ENTER. Based on the options given, the administrator can perform the removal, but additional configuration parameters must be specified before the removal can occur. 5. Type connections and press ENTER. This menu is used to connect to the specific server where the changes occur. 6. Type, “connect to server DC2”, and then press ENTER. 7. Type “quit” then press ENTER. 8. Type “select operation target” then press ENTER. 9. Type “list domains” then press ENTER. 10. Type “select domain number” and press ENTER. Where “number” is, the number associated with the domain the server you are removing is a member of. 11. Type “list sites” then press ENTER. 12 Type “select site number” then press ENTER. Where “number” is, the number associated with the site the server you are removing is a member of. It will not prompt you stating that it is connected. 13. Type “list servers in site” then press ENTER. 14. Type “select server number” then press ENTER. Where “number” is, the number associated with the server you want to remove. It will not prompt you stating that it is connected. 15. Type “quit” then press ENTER. 16. Type “remove selected server” then press ENTER. 17. Type “quit” then press ENTER. Quit the Ntdsutil utility. 18. Remove the cname record in the _msdcs.root domain of forest zone in DNS. 19. In the DNS console, use the DNS MMC to delete the A record in DNS. Also, delete the cname record in the _msdcs container. To do this, expand the _msdcs container, right-click cname, and then click Delete. In the DNS console, click the domain name under Forward Lookup Zones, and then remove this server from the Name Servers tab.
6.	Remove Old Domain Controller From Active Directory 1. Remove old computer account by using "Active Directory Sites and Services" tool. 2. Remove old DNS and WINS records of the orphaned Domain Controller. 3. Use "ADSIEdit" to remove old computer records from the Active Directory. OU=Domain Controllers,DC=domain,DC=local CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=local CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=domain,DC=local 4. Search through all directories in DNS management console and delete any and all reference to DC1. Check properties of all records
7.	See if domain controller is a global catalog server 1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Sites and Services. 2. Double-click Sites in the left pane. 3. Open the Servers folder, and then click the domain controller. 4. In the domain controller's folder, double-click NTDS Settings. 5. On the Action menu, click Properties. 6. On the General tab, view the Global Catalog check box to see if it is selected.
8.	Reinstall OS on DC1 This is per Microsoft and pretty much all articles I have read. <--- This can be avoided. If you rename the server, change the IP and disable networking while you do everything else. You can give the old IP to the new backup DC (with a different name) and bring the old DC back into the domain as a computer (with a different name). Edit: You can bring it back into the Domain with the same computer name as long as you remove all trace of it being a domain controller within DNS. In fact if you remove AD without using the /forceremove it will even ask if you want to add it to the domain.

How to: Safely uninstall Ubuntu directly from Windows (7, Vista or XP)

2010-11-26T00:05:00.000-08:00

Lets know about Hyper-V features...

2010-11-19T01:18:00.000-08:00

What is Hyper-V ?
With Hyper-V, it's easier than ever to take advantage of the cost savings of virtualization through Windows Server 2008 R2. Optimize your server hardware investments by consolidating multiple server roles as separate virtual machines running on a single physical machine, efficiently run multiple different operating systems in parallel, on a single server, and fully leverage the power of x64 computing.

Benifits of Hyper-V :

Hyper-V provides customers an ideal platform for key virtualization scenarios, such as production server consolidation, business continuity management, software test and development, and development of a dynamic datacenter.

Hyper-V provides key functionality, which an ideal virtualization platform should provide scalability, high performance, reliability, security, flexibility, and manageability. It provides scalability and high performance by supporting features like guest multi-processing support and 64-bit guest and host support; reliability and security through its hypervisor architecture; flexibility and manageability by supporting features like quick migration of virtual machines from one physical host to another, and integration with System Center Virtual Machine Manager.
Microsoft provides integration components and technical support for customers running select Linux distributions as guest operating systems within Hyper-V.


wanna more about Hyper-V

CyberGhost VPN Premium Account Serial Number, 1 year License Code

2010-11-01T22:12:00.000-07:00

Security on Internet is of major concern today. Virtual Private networks aka VPN allows you to surf and download anonymously without revealing your IP address, location and other privacy stuffs. For that VPN services are used which allows to access web via some other server. CyberGhost VPN is one such Popular service.

When VPN connection is activated, all Internet data traffic is routed via the anonymization server, no matter whether a browser, messenger, filesharing client or incoming email traffic is involved. CyberGhost VPN Free account limits 1GB bandwidth which may get over in a day or two. CyberGhost VPN Premium account will cost you 69.95 Euros for one year subscription with 40GB bandwidth.

They have a big list of servers with which you can connect to surf anonymously. VPN have one more advantage that – In some countries / regions, specific websites are blocked so, using CyberGhost VPN you can unblock and surf these website inspite of restriction of yor country as VPN connects you through some other Country’s IP address.

Grab one year subscription of CyberGhost Premium using Serial Key Promotion code. For that, register an account on CyberGhost VPN and you will receive a confirmation code in email, confirm it manually or by clicking on the link. After Logging in, Click on Activate Serial Number and enter cobiextra

Now download CyberGhost VPN Client and install it. After installation, login with the account login username and username and you will get 10GB / month Bandwidth in Premium + 1GB in Premium. This is quite enough if you use it for everything like Surfing, Chatting, etc. except Downloads.

In the screenshot, you can notice 11 months left including this one which sums up to 12 months or 1 year – 365 days Premium CyberGhost VPN subscription.
CyberGhost VPN review: After using it for a while, I found that it doesn’t slows down connection speed and offers a big list of secured anonymous Servers mainly in German and US listed according to anonymity and Speed. Connecting is instant and I am impressed with its simple interface.

Enjoy!!!!

Free Depositfile Gold Account

2010-10-30T06:01:00.000-07:00

Depositfiles Gold until 2012-01-11

TO USE THE ACCOUNT FOLLOW THESE TWO STEPS:

1- GO TO LINK : depositfiles.com

2- PUT IN THE FOLLOWING CODE : n5kit65v

3- CLICK ON SEND

Enjoy!!!!!!!!

A REAL HERO FROM Madurai

2010-10-30T02:26:00.000-07:00

2010 – உலகின் தலை சிறந்த ஹீரோ ஒரு தமிழன்

திரைப்படங்களை ரசியுங்கள் ரசிகர்களே. அதில் உங்கள் ஹீரோ செய்வதெல்லாம் நிஜம் என்று மட்டும் நம்பி விடவேண்டாம். உண்மையான ஹீரோ உங்கள் பகுதியில் நேர்மையாகவும், தியாக உணர்வோடும் , சேவை மனப்பான்யுடனும் , துணிவுடனும் உழைத்துகொண்டிருப்பார்கள் ஒரு ராணுவ வீரராக , தீயணைப்பு வீரராக, காவல் துறை அதிகாரியாக, ஆசிரியாராக, சமுக சேவகராக, துப்புரவு தொழிலாளியாக மற்றும் நேர்மையாக உழைத்து சம்பாதிக்கும் எவருமாக இருக்கலாம். அவர்களை சந்திக்கும் சமயத்தில் ஒரு நன்றி சொல்வோம் , பாராட்டுவோம். அவர்களில் யாரேனும் கவுன்சிலர் தேர்தலில் நிற்கக்கூடும். நின்றால் காசுக்கு ஆசைபடாமல் ஒட்டு போடுவோம்.

இப்போது அப்படி ஒரு நிஜமான ஹீரோவை உங்களுக்கு இந்த பதிவின் வாயிலாக அறிமுகபடுத்துகிறேன். இவர் உலகப்புகழ் பெற்ற CNN இணையதளத்தில் உலகின் தலை சிறந்த ரியல் ஹீரோக்களில் முதல் பத்தில் ஒருவராக தேர்ந்தெடுக்கப்பட்டு உள்ளார். ஒரு தமிழனாக, மதுரைகாரனாக ரெம்பவும் பெருமை படுகிறேன். இன்னும் வாக்கு பதிவு நடந்து கொண்டிருகிறது. இதில் தேர்ந்தெடுக்கப்படும் ஹீரோக்கள் அமெரிக்காவில் நவம்பர் மாதம் 25 ஆம் தேதியில் Shrine ஆடிடோரியம், Los Angeles இல் நடக்கும் ஒரு பெரும் விழாவில் கௌரவிக்க பட இருக்கிறார்கள். இது CNN தொலைகாட்சியில் இந்திய நேரம் காலை எட்டு மணி ( நமக்கு நவம்பர் 26 ஆம் தேதி ) உலகம் முழுக்க நேரலை ஒளிபரப்பில் காட்டப்பட இருக்கிறது. இதற்காக நாம் ஒவ்வொரு இந்தியனும், தமிழனும் பெருமை பட வேண்டும். ஆஸ்கார் சாதனையை விட இது தான் மகத்தான சாதனை.

பெயர் : நாராயணன் கிருஷ்ணன்
வயது : 29
இருப்பு : மதுரை

அப்படி என்ன செய்து விட்டார்?
அது நினைத்துபார்கவும் முடியாத கருணை செயல்.

தான் யார் என்றே அறியாத சித்த சுவாதீனம் கொண்ட மனிதர்களை நாம் சிறு கருணையுடனும் அல்லது கொஞ்சம் அருவருப்புடனும் கடந்து செல்வோம். சில சமயம் காசு போடுவோம். அதற்கும் மேல் என்ன செய்வோம்? அதை மறக்க முயற்சிப்போம். ஆனால் இவர் அவர்களை தேடி சென்று தினமும் மூன்று வேளை உணவு தருகிறார். அருவருப்பில்லாமல் ஊட்டி விடுகிறார்.கடந்த எட்டு வருடங்களாக ஒரு நாள் தவறாமல் இந்த சேவையை இவர் தொடர்ந்து செய்து வருகிறார். மழை, புயல்,தேர்தல்,கலவரம், பந்த் என்று எதுவும் பாராமல் வருடம் முழுக்க இந்த சேவையை செய்து வருகிறார். தினமும் 400 பேருக்கு மூன்று வேளை உணவு என்பது சாதாரணம் இல்லை. இது வரை ஒரு கோடியே இருபது லட்சம் உணவு பொட்டலங்கள் விநியோகிக்கபட்டுள்ளது.

ஒரு ஐந்து நட்சத்திர ஹோட்டலில் வேலை பார்த்த, விருதுகள் வென்ற செப் சமையல் கலை வல்லுநர் இவர். சுவிட்சர்லாந்தில் ஒரு பெரிய ஹோட்டல் நிறுவனத்தில் வேலை கிடைத்தவுடன் அதை பெற்றோர்களிடம் சொல்லிவிட்டு போவதற்காக மதுரைக்கு வந்தவர் அங்கே ஒரு வயது முதிர்ந்த ஒரு கிழவர் மலத்தை உணவாக உண்ணும் அவலத்தை கண்டு பெரும் அதிர்ச்சிக்குள்ளாகி தனது வெளிநாட்டு வேலையை துறந்து மதுரையிலேயே தங்கி வீட்டில் சமைத்து அதை இது போன்ற மனிதர்களை தேடி சென்று உணவு கொடுக்க ஆரம்பிக்கிறார். இது நடந்தது 2002 . இன்றும் இவரது சேவை தொடர்கிறது மதுரையை சுற்றி நூறு கிலோமீட்டர் பரப்பளவில் கண்ணில் படும் இதுபோன்ற மனிதர்களை தேடிபிடித்து உணவு தருகிறார். இதற்காக இவர் தன்னுடைய வாழ்கையை முழுமையாக அர்பணித்துள்ளார். இவரது அன்னை இவர் குறித்து கவலை பட்டு அழுதபோது, “அம்மா ஒரு நாள் என்னோடு வாங்க. நான் என்ன செய்கிறேன் என்று பாருங்கள் அப்புறம் நீங்கள் சொல்வதை கேட்கிறேன்” என்று சொல்லி அழைத்து போயிருக்கிறார். இவரது சேவையை கண்டு மனம் உருகிய அந்த தாய் ” நீ இவர்களை பார்த்துக்கொள், நான் உள்ளவரை உன்னை பார்த்துகொள்கிறேன்” என்று சொல்லிருக்கிறார். இதை படித்த போது என் கண்களில் நீர் முட்டிக்கொண்டு வந்ததை அடக்க முடியாமல் தவித்தேன். எழுதும் இந்த கணமும் கூட.

நாம் இங்கே நம்மை ஏமாற்றும் திரை நட்சத்திரங்களை ஹீரோ என்று சொல்லி தலையில் வைத்து கொண்டாடுகிறோம். பாலபிசேகம் முதல் முளைப்பாரி வரை எண்ணற்ற பைத்தியகாரத்தனத்தை அந்த ஹீரோக்களுக்காக செய்கிறோம். முதல் நாள் அவர்கள் படங்களை பார்க்க ஆயிரம், இரண்டாயிரம் செலவழிக்க தயங்குவதில்லை. சரி கொடுகிரீர்கள் அந்த அளவுக்கு உரித்தான கலைபடைப்பையாவது அவர்கள் தருகிறார்களா? அவர்கள் என்ன செய்தார்கள். நானும் கொடை செய்கிறேன் என்று சொல்லி சிலவற்றை செய்து பத்திரிகைகளில் மறக்காமல் செய்தி கொடுக்கிறார்கள். அவர்கள் இவரின் கால் தூசுக்கு கூட பொருந்த மாட்டார்கள். இவர் தான் உண்மையான ஹீரோ. சாகசம் செய்வது சாதனை அல்ல. இல்லாதவர்க்கு தேடிசென்று ஈவதே சாதனை. எனக்கு இவர் தான் என்றென்றும் ஹீரோ. இவரை பார்க்கவும், இவருடன் புகைப்படம் எடுத்துகொள்ளவும், இவருடன் ஒரு நாள் இருந்து சிறு உதவியேனும் செய்யவும், பொருள் உதவி செய்யவும், இவரை பற்றி எழுதவும் பேசவும் பெரும் ஆவல் கொள்கிறேன், பெரும் பெருமை கொள்கிறேன் எனது ஹீரோ ஒரு மகத்தானவன் என்பதில்.

அற்றார் அழிபசி தீர்த்தல் அஃதொருவன்
பெற்றான் பொருள்வைப் புழி.

ஏதும் இல்லாதவரின் கடும்பசியைத் தீர்த்து வையுங்கள். பொருளைப் பெற்றவன் சேமித்து வைக்கும் இடம் அதுவே.

ஆதலால் நீங்கள் சேர்த்துவைக்க இடம்

http://www.akshayatrust.org/contact.php

Akshaya’s Helping in H.E.L.P. Trust
9, West 1st Main Street,
Doak Nagar Extension,
Madurai – 625 010. India

Ph: +91(0)452 4353439/2587104
Cell:+91 98433 19933
E mail : ramdost@sancharnet.in

மொக்கையாக எத்தனையோ வோட்டு போட்டுருக்கோம். ஒரு நல்ல விசயத்திற்கும் வோட்டு போடலாம் வாருங்கள். நீங்கள் வோட்டு போடவேண்டிய இடம்

http://heroes.cnn.com/vote.aspx

இதுவரை இந்த பெருமைக்குரிய விஷயம் பத்திரிக்கைகளில் பரவலாக வரவில்லை என்பது பெருத்த வேதனை மட்டுமல்ல ஒரு தமிழனாக நம் எல்லோருக்கும் அவமானம். இதை பதிவர்கள் எல்லோரும் கொண்டு சேர்க்க வேண்டுமாய் தாழ்மையுடன் கேட்டுகொள்கிறேன்

Creating the “God Mode” in windows 7 for tune up

2010-10-28T00:17:00.000-07:00

This is nothing more than a special folder or an alternative to the classic Windows Control Panel. Here’s a step-by-step guide on setting it up:

Right-click on your desktop, and select “New/Folder”.
Enter the folder name “God Mode.{ED7BA470-8E54-465E-825C-99712043E01C}”. Tip: You can give it any name you want, but the important part is the latter string of letters and numbers. For example, you could call it “Special Control Panel.{ED7BA470-8E54-465E-825C-99712043E01C}”.

Once you hit enter, the icon changes, and you will have the direct shortcut to your “God Mode” (or whatever you previously called it).
Double-click on the icon to see all of the Windows features and settings in one single place.
One suggestion: go through the list to find out how many features and settings you can actually change, activate, or deactivate with this special mode. You will be amazed at the number of hidden secrets that are suddenly revealed.
If you try to find a specific setting, use the quick search bar in the upper right corner.
Here’s a neat trick—drag your “God Mode” to the taskbar. This will let you access the function right from it. To do so, right-click on the icon, and select “God Mode”.

You can also drag it to your “Favorites” in Windows Explorer and complete the same action as with the taskbar.

The top ten hidden secrets

It is very easy to access hidden settings with “God Mode”. Below is a list of our favorite features discovered using this function under Windows 7.

Diagnose your computer’s memory problems (“Administrative Tools”). This launches the built-in memory check tool, and is very useful if you encounter random blue screens or other memory-related error messages.
View reliability history (“Action Center”). Use this feature to see a track record of how stable your computer has been and how many problems have occurred.
Make a file type always open in a specific program (“Default programs”). If you have many programs, such as several photo-editing or video-editing tools, this can be helpful.
Calibrate display color (“Display”). As the name implies, you can find a pretty useful monitor calibration utility here.
Show hidden files or folders (“Folder options”). This is something that consumers need on a daily basis.
Manage Wireless Networks (“Network and Sharing Center”). If you’re having trouble connecting to a Wi-Fi network that you have connected to before, use this setting to delete the Wi-Fi network and reconnect to it.
Use tools to improve performance (“Performance Information and Tools”). In this window, you will find information about your PC’s performance. On the left hand side, you’ll find a couple of recommended tools for boosting your machine’s speed a bit.
Lock the computer when I leave it alone for a period of time (“Personalization”). Set up a screensaver, and check “On resume, display logon screen”.
Change what closing the lid does (“Power Options”). If you don’t want your laptop to go to sleep once you close the lid, use this setting to change this behavior.
View installed updates (“Programs and features”). Have you installed a Windows or software update and experienced problems with your machine? Use this entry to uninstall the update and restore your system.

Hopefully, over time, this post will have helped you save hundreds of unnecessary clicks through the Windows Control Panel. Any additional hidden secrets you’d like to share? leave your comments here...

Program Overview	Partners
Application Support	Supported Guest OS