Winzero Support FAQs

Active Directory groupType Attribute

2012-01-17T15:15:00.000-08:00

Active Directory groupType Attribute

-2147483640 universal security group
-2147483646 global security group
-2147483644 domain local security group
-2147483643 builtin security group

2 global distribution group
4 local distribution group
8 universal distribution group

This is used by all ManageRED ADUM softawre, OEM and ManageRED ADSearch software as group type coding.

ManageRED PasswordCopy Requirements

2011-07-06T12:50:00.000-07:00

In order to copy passwords the minimum requirements must be met:

Windows 64bit (Windows 2008R2) ***

When Windows 2008R2 or any Windows 64bit server is involved in the password copy process the LSA must be manually edited before starting the process.

On the 64bit computer(s), DC or member server, navigate to:

HKEY_LOCAL_MACHINE
SYSTEM\CurrentControlSet\Control\Lsa\
List: SecurityPackages

The SecutityPackages key must contain only: kerberose, msv1_0, schannel, wdigest, tspkg

Edit this key to be exact as above by removing any extra entries and reboot the server for the change to take effect.

Virus scan software must be disabled during a password migration. False Trojan readings and required files may be quarantined.

PDC - PDC Emulator (Windows 200x FSMO Server) requirements:

Drive letters must be shared example C$, D$ etc
The Windows directory must have the Administrative Share ADMIN$
Remote registry services must be running
The DCs must be reachable by Name (NETBIOS name Resolution must be working across subnets)
The DCs must be remotely manageable (Windows Firewall issues)
Service Account and the operator must have domain Administrative rights
Service Account must have logon Locally and Run as a Service Right.
The Target Domain Password Policy must be less restrictive then the Source Domain Password Policy
2 way trusts must be in place and functional

Password Copy in Workgroups

Drive letters must be shared example C$, D$ etc
The Windows directory must have the Administrative Share ADMIN$
Remote registry services must be running
The servers must be reachable by Name (NETBIOS name Resolution must be working across subnets)
The servers must be remotely manageable (Windows Firewall issues)
Service Account and the operator must be ADMINISTRATOR
Service Account must have logon Locally and Run as a Service Right.
The Target Password Policy must be less restrictive then the Source Password Policy

Password Copy Console Computer

Service Account and the operator must have domain Administrative rights
Service Account must have logon Locally and Run as a Service Right.
Windows Firewall must be turned off or set in the remote manage state
All DC must be reachable by name

Administrative Rights Domain Recommendations

Install the PasswordCopy Software on a computer in the Target Domain
Create or select an account from the Target Domain
Add or verify the account is a member of the Target Domain Admins group
Add or verify the Target Domain Admins group is a member of the Source domain Administrators local group
Add or verify the account can logon locally and run as a service on the source, target DCs and the local computer.
Use the account as the service account
Logon to the console computer with the account.

Windows Vista, Windows 2008 and Windows 7

PasswordCopy supports Windows Vista, Windows 2008 and Windows 7. However in order to run administrative tools on these platforms, Windows firewall and Windows User Account Control must be turned OFF
RemoteRegistry services must be running and netBIOS over IP resolution must be enabled

ManageRED Software to Release Password Copy with 64bit Support

2011-04-12T06:52:00.000-07:00

With the development of a 64 bit password copy solution, ManageRED Software will be the first software provider to release a complete password copy software solution set to migrate customers to Microsoft Windows 64 bit server platforms on April 15, 2011.

Many businesses are considering moving to Microsoft 64 bit platforms such as Microsoft Server 2008 and Microsoft Server 2008R2 from their current 32 bit platform. ManageRED will integrate the new 64bit solution set into PasswordCopy designed to migrate or synchronize Windows servers and domains.

ManageRED's PasswordCopy will make it possible to migrate local server account and domain account passwords for organizations wishing to transition off Microsoft 32 bit platforms in one operation. With support for selective account password copy and synchronization, allows for co-existence of multiple platforms. Businesses will be able migrate local server account or domain account with passwords incrementally into Windows 64 bit servers as they transition away Windows 32 bit.

As customers begin to adopt Windows 64 bit Servers, we want them to know that ManageRED Software offers the best of breed password copy solution with technical expertise to help them move successfully, cost-effectively, with reduced downtime to their new 64 bit platforms' said Akos Sandor, chief technology officer, ManageRED Software.

Availability
ManageRED Software will release the new 64 bit password copy solution as a significant upgrade to their existing software line. PasswordCopy will be available directly from the ManageRED website starting April 15, 2011 for an introductory price of $249.00 USD for an unlimited enterprise license.

About ManageRED
ManageRed Software is a leading provider of Microsoft Windows management software worldwide enabling customers to centralize and reduce repetitive administration, migration and ongoing day to day Windows management while benefiting from reduced risk and improved operational efficiencies.

WADMigrator-ServerMigrator Permission Issues

2011-04-03T13:59:00.000-07:00

Windows 7 Operating Systems - Desktop/Laptops:

Issue:
Unable to install the scheduling service client on any Windows 7 workstation within the environment. Console indicates that “the installation path cannot be determined”

Diagnosis:
Remote Registry is set to Manual and is not started
UAC is enabled on the workstations

Resolution:
Set the Remote Registry service to Automatic
Disable UAC on the Windows 7 Desktops/laptops/Tablets/Workstations.

Both Items can be modified via Active Directory Group Policy. The latter policy requires a reboot.

Windows 2008 Server’s

Issue:
Unable to install the scheduling service client on any Windows 2008 Servers within the environment. Console indicates that “the installation path cannot be determined”

Diagnosis:
UAC is not completely disabled. The following registry key has the following value set:

HKLM\Software\Microsoft\Windows\Currentversion\Policies\System\ConsentPromptBehaviorUser. This key has a value set to 1. This is not the default setting.

An explanation of this setting is as follows:

User Account Control: Behavior of the elevation prompt for standard users
The User Account Control: Behavior of the elevation prompt for standard users policy setting controls the behavior of the elevation prompt for standard users.

The options are:
Automatically deny elevation requests. When an operation requires elevation of privilege, a configurable access denied error message is displayed. An enterprise that is running desktops as standard user may choose this setting to reduce help desk calls. *****Has a value of 0 in the registry*****

Prompt for credentials on the secure desktop. (Default) When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a different user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. *****Has a value of 3 in the registry*****

Prompt for credentials. When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. *****Current Setting****** and has the value of 1

These are the available settings:

0 = Automatically deny elevation requests
1 = Prompt for credentials on the secure desktop
3 (Default) = Prompt for credentials on the secure desktop

Please refer to the following link: http://technet.microsoft.com/en-us/library/dd835564(WS.10).aspx#BKMK_StandardUserPromptBehavior

Resolution:
On all Windows 2008 Servers, the ConsentPromptBehaviorUser key must have a value of 3 (which is the default Windows 2008 setting). A reboot is not necessary for this change to take effect.

The above changes are mandatory and were part of the Checklist provided to the customer as part of the pre-migration checklist.

Special Thanks

A special Thanks goes to Bruno Zaffino from Compucom for his diligence and relentless effort to trouble shoot the challenges faced by the domain migration at the Government of Ontario Migration Project.

How to Find Sam Watson with N-able Free Security Software

2011-03-28T10:46:00.000-07:00

Find any account, user or group, on one or more Windows servers. Find folder access, find share access, find group membership with N-able ACLReporter your free security report software.

Now you have no excuse to prove that your server security settings are accurate when demanding auditors or CIOs demand documentation. No excuses, because now you can download N-able ACLReporter for FREE!

Learn how to get your FREE COPY OF ACLREPORTER today

N-able Technologies to Release ACLReporter as a Free Download

2011-03-14T21:37:00.000-07:00

N-able Technologies Inc (kanata ON) to release ACLReporter as a free download later this month...

ACLReporter's reporting process simplifies and shortens server security reporting projects, providing the fastest security settings collection and reporting performance available on the market. In addition, ACLReporter provides IT administrators with a granular level of control by reporting only what they need to know from multiple servers in multiple domains.

New SecuRED Update...

2011-02-18T12:49:00.000-08:00

ManageRED SecuRED Update 021811

ManageRed has released the latest version of it's security reporting application SecuRED.

SecuRED version 5.00 Build 021811 features a new look, a new faster NTFS collection engine and a new licensing model.

ManageRED SecuRED Key Features

Simplify Security Reporting by configuring only what should be collected and reported on.

Assist with Compliance. Proactively maintain and report on access controls to address many of the requirements of regulatory and best practices standards.

Enhance Windows Security. Find weaknesses, over-exposed files, over-privileged users with complete security audits in minimal time.

ManageRED SecuRED is available as an update to ManageRED Clients or as a download at ManageRED Software.

New Winzero ScheduleManager

2011-02-15T10:51:00.000-08:00

A new version for the Winzero ScheduleManager has been released as an update or as a standalone application.

To download the new ScheduleManager

Navigate to http://www.winzero.ca/downloads/ScheduleManager021611.zip and save it to your computer.

To add the update to any Winzero applicaton including: ServerMigrator, WADMigrator or AccessReporter, unzip the download to drive:\Winzero\ApplicationName\ and allow it to over write any files.

To use ScheduleManager as a standalone application, create a folder and unzip the download into the new folder. Navigate to the folder and double click ScheduleManager to launch.

What's new In ScheduleMnager

- ScheduleManager now supports Windows 2008R2 and Windows 7 64bit
- Import computers from WADMigrator Projects
- Quick deployment Status Reports to reduce overhead

Compare the Top 3 Server Migration Software Solutions

2010-11-28T22:51:00.000-08:00

If you are faced with a server migration project, select the best software solution that meets your technical needs and your budget.

We compare the top three (3) server migration software packages on the market today to see how they stack up.

WinzeroTECH ServerMigrator information
ManageRED Resemble information
ScriptLogic SecureCopy information

ServerMigrator v7.0 - Windows 2008 R2

2010-07-18T20:56:00.001-07:00

To successfully migrate local account passwords to or from Windows Server 2008R2, after insatalation of ServerMigrator v7.0x, verify the following registry entries for the Lsa key:

Click image to enlarge
The keys must be exactly as illustrated... if you need to make changes the server must be rebooted before the change will take effect.

Winzero Download and Product Update Web Changes

2010-05-12T00:23:00.000-07:00

How to use the update download for Winzero Products.

Because of recent changes to the Winzero website the Winzero product updates must be downloaded and installed manually. You must request software downloads and updates links. Once a request is received, a direct software download and it's update links will be emailed to you.

How to Install Winzero Products

Any Winzero product that has had a minor update since its last release version will have a link supplied with the download link to include a link to the products update.
Once you download the Winzero product, unzip the download to a temporary folder. Run the Setup.exe to install the product.

Most Winzero Product will automatically start once the product is installed. After installation, Exit the Winzero product.

How to Update Winzero Products

Once the installation process is complete and the product is completely closed, download the update from the direct download link supplied.

The Update file will be a compressed zip file. To update the Winzero Product to the latest build unzip the update file into the working directory of the Winzero product usually Drive\Winzero\ProductName\.

This process will overwrite any files that have been updated since the last complete release.

Top Five Server Migration Mistakes.

2010-02-01T12:12:00.000-08:00

1. Server Downtime
Server downtime is probably the most-heard concern when performing a migration. This is because most migration processes require the source server be offline, either during the conversion process or during the recovery. However the Winzero solution doesn't require the server to be offline and not accessible to the users.

Winzero's ServerMigrator has addressed this issue through real-time replication that transfers the data to the new platform while the server and application remain online and available to users and then failover with minimal interruption. This process minimizes downtime for business-critical systems for disaster recovery, so why not use it for a server migration?

2. Late Night and Weekends
Get your weekends back. One of the greatest myths about server migrations is that they need to be performed during off-hours when no one is using the servers or server data that is being migrated. This is usually because the server migration can't capture changes to the data after the migration starts.

This isn't the case with asynchronous replication migration products, where data can change on the older server and replicate to the migration target server in real time. With ServerMigrator, real-time replication, migrations can be performed during normal business hours and then failed over to the target server once all the data changes have been captured and transferred to the new system.

3. P2V Conversion Process Failed
We have heard of many people complaining about the pain of the P2V (physical to virtual) process or virtual server migration they are going through, but they can't be bothered to spend a couple hundred dollars for a product that works and can make the nightmare go away.

We can't say we have much sympathy for those who try to perform mission critical functions with free tools that promise the world, but we do respect their tenacity.

4. Compatability Issuses
I hate when that happens.

There is nothing worse than getting within spitting distance of the finish line and breaking your leg. Some of the most common mistake that we have seen occur because of not preparing for the migration by reading the pre-migration checklist prior to starting the migration.

Download the Winzero Premigration Checklist with the migration product before you begin the migration.

A little planning can go along way, but having a tested process that can perform consistently and also minimize downtime will keep you from pulling out your hair.

5. Migration Succeeded but Users are Locked Out.
So, the migration's been completed, only none of the users can logon, and there begins a whole new nightmare.

There are many reasons why this happens, and it could be any combination of the factors mentioned above. Is it the free tool that was downloaded to perform the migration, the hardware being migrated, or the virtual platform? Who knows, but ServerMigrator allows you to "set and forget" and avoid this monster of user account and password conflict issues.

In summary, perform your server migration and ask what works best and what to avoid. Learn more about server provisioning or performing successful server migrations with Winzero serverMigrator or Winzero ServerMigrator Lite.

Winzero Product Demo???

2009-12-12T20:00:00.000-08:00

Winzero staff member Brian Kershaw hard at work onsite at the Microsoft Windows 7 Lounge.

WinzeroTECH demonstartes latest.... What? This is supposed to be a product demonstration

Winzero Software Error Reports

2009-10-29T12:09:00.000-07:00

Bulletin: 102909

Software Effected:
All Winzero applications and Remote Exe's

Issue:
Where can I check Winzero application errors?

Solution:
Winzero application errors are tracked in the working directory of the Winzero product installed as ProductName.log file. To maintain performance, only errors are trapped.

In the log file, unfortunately not all errors are errors… the software will report an error but the software's internal error trap will use a different process to resolve the error and the fact that the error has been resolved would not be recorded in the logfile.
However, any access denied errors are truly errors.

The log file is always written to the working directory.
The log file is rewritten everytime the Winzero application is launched.
The log file is not updated until the application is closed.

How to Uninstall Software With Winzero Schedule Service

2009-09-24T08:42:00.000-07:00

To uninstall any Winzero software application that distributes the Winzero Schedule Service, requires a three step process

1) Remove folders and files from the remote computers.
2) Remove the Scheduling Service from the remote computers
3) Uninstall the software.

Remove any Remote Files

Select the computers to remove the Winzero remote files
From the Menu select Configuration
Select Remove Remote Files...

Repeat until all remote files have been removed from all computers

Uninstall the Winzero Scheduling Service

From the Menu Configuration
Select Manage Computer Schedule Service......
From the Popup Window Select one or more computers
From the Menu Select ACTION
Select Remove Scheduling Service

Once the service removal is complete double-Click the computer name to verify the service is not installed.
Close the ScheduleManager Window

Uninstall the Winzero Application

Exit the Winzero Application
From the Start Button Select Winzero
From the flyout select Uninstall
Select one or more Winzero Applications, from the list of Winzero Applications
Click Uninstall.

Sneak Peak at Winzero's Local Account Migrator

2009-09-13T20:09:00.000-07:00

The official release date has been confirmed for Winzero's Local Account Migrator (WLAM3264) as September 30th. WLAM3264 is the worlds first migration software to support Windows 2003 and 2008 64 bit password copy.

A first look at the new WLAM3264 user interface

Click image to enlarge this image

With the release of the Winzero Local Account Migrator(WLAM3264), a Windows 32/64 bit account and password migration solution, Winzero Technologies will be the first software provider to offer a complete software solution set to migrate customers to Microsoft Windows 64 bit server platforms.

Many businesses are considering moving to Microsoft 64 bit platforms such as Microsoft Server 2008 and Microsoft Server 2003 from their current 32 bit platform.

Winzero will integrate the new 64bit password migration technology into tools designed to migrate Windows servers and migrate active directory domains.

Windows Server Migration Checklist - ServerMigrator

2009-08-24T19:02:00.000-07:00

Before beginning a server migration project, a number of mandatory prerequisites are needed to be met in order to complete a server migration successfully. These requirements are standards to meet both the requirements for Microsoft Windows server security and the Winzero ServerMigrator software.

Download the Server Migration Checklist

Active Directory Domain Migration Checklist

2009-08-18T19:47:00.000-07:00

Before beginning an Active Directory migration, a number of mandatory requirements are needed to be in place in order to complete the migration successfully. These requirements are standards to meet both the requirements for Microsoft Windows migration and the Winzero Active Directory Migrator.

Download the Domain Migration Checklist

sIDHistory Error Code 1376

2009-07-06T17:51:00.000-07:00

Bulletin: 070609

Software Effected:
WADMigrator

Issue:
When migrating sIDHistory from one domain to another, a Windows error code 1376 is generated and sIDHistory fails to complete.

Solution:
If during the sIDHistory migration process, a Windows error code of 1376 is generated, the prerequisites for sIDHistory migration have not been followed.

Error 1376 occurs when a domain local group is missing. In order to perform a successful SidHistory migration, an empty domain local group must exist in the source domain with the NetBIOS name of the domain followed by 3 "$" signs: DomainName$$$.

We would like to thank Scott Chandler and Eric Lissoy, from Far West Technology in California for bringing this issue to our attention.

New Microsoft Update Prevents RemotePWDReset From Launching

2009-06-08T12:17:00.000-07:00

Bulletin: 060809

Software Effected:
RemotePWDReset

Issue:
RemotePWDReset will not launch and reports that file Rpwd.dll is missing.

Solution:
With the latest Microsoft security update, Winzero RemotePWDReset is unable to launch. The RemotePWDReset log file reports that Rpwd.dll is missing.
The issue has been identified and a fix will be ready June, 8 2009. An update is avilable that will uddate RemotePWDReset version 2.06 Build 060809.
All RemotePWDReset version 2.06 or higher will contain this fix.
We would like to thank James Corlew, Systems Administrator with ATLAS Development Corporation in California for bringing this issue to our attention.

AccessReporter v4.00 with ACLSearch

2009-06-03T13:12:00.000-07:00

Bulletin: 060309

Software Effected:
AccessReporter v4.xx and up

Issue:
Installation and Licensing

Solution:
With the addition of a new search functionality, Winzero AccessReporter verison 4.00 will require new licensing for winzero customers with license for previous versions.

To experience the full benefits of AccessReporter with ACLSearch, we recommend installing AccessReporter rather than checking for updates.

ACLSearch - Not only can you report server security permissions, but with the ACLSearch functionality you can select one or more users or groups and discover where those accounts have direct access to multiple servers in one report.

Future versions of AccessReporter wil also allow searches based on on indirect access. By selecting a user or group account, find how and where the account has indirect server access through all group membership both local and domain group access.

Download AccessReporter or learn more...

Computers Fail to Join New Active Directory Domain

2009-05-15T10:38:00.000-07:00

Bulletin: 051509

Software Effected:
WADMigrator, WSBSMigrator

Issue:
When migrating workstations or servers from one domain to another domain in a Microsoft Active Directory enviroment, the migrate computer process does not take affect and the remote computers do not reboot and join the new domain.

Solution:
This issue only occurs when the administrative account password of the source domain or the target domain contains a character:(!@#$%^&*+<>~??-). Active Directory uses LDAP to perform computer migration functions, a special character becomes an escape character and the character is removed in translation.

To perform a successful computer migration (move a computer from one domain to another domain) both the source administrative account password and the target administrative account password perfoming the migration must only contain alpha-numeric characters. Winzero would like to thank Jay Weiner from Feature-Walters for his research and solution to this now known issue.

Unknown SID S-1-5-80- xxxxx

2009-04-24T06:49:00.000-07:00

Starting with Windows Vista and Windows Server 2008, each service is assigned a service-specific SID based on its name. (In other words, services with the same name will have identical SIDs on different systems.) A service-specific SID allows services to be directly assigned permissions on any securable object. It can also be used to control the service in other ways, such as opening ports in the Windows Firewall and IPsec.

You can view the SID of any service, including ones you do not even have yet, by using the Sc.exe command with the showsid command-line parameter. The syntax is:

sc.exe showsid [servicename]

A service’s SID is computed by taking the service’s Unicode name (in all uppercase letters) and running it through a SHA-1 hash function and adding the hash result to S-1-5-80-. For example, the SID of the W32Time service is: S-1-5-80-4267341169-2882910712-659946508- 2704364837-2204554466. This SID will be identical across all Windows Vista and Windows Server 2008 systems.

If you add a service-specific SID to a service, you must add it before the service is started, and you cannot change it while the service is running. When a service-specific SID is used, it is added to the service’s process token along with the service’s log-on account SID. If a shared service process (such as Svchost.exe) has several services with service-specific SIDs, all SIDs are added to the service’s process token and can be used by all services in the shared service process. If a service-specific SID is not enabled, the service log-on account’s SID will still be added to the service’s process token.

Windows Vista, Windows 2008 and Windows 7

2009-04-12T14:48:00.001-07:00

Bulletin: 041209

Software Effected:
All Winzero Software running on Windows 7, Windows 2008, Windows Vista

Notice:
Because all Winzero Software is designed to be used by administrators the following issues need to be check before use:

Windows Fire Wall: Windows Firewall should be disabled.
Windows User Account Control: should be disabled
IPFiltering: should be disabled if performing actions across multiple domains

New Release: Winzero TakeControl

2009-04-08T09:34:00.000-07:00

Winzero new product release: TakeControl allows administrators to gain administrative access to files, folders and shares without destroying the original permissions by appending the Administrators group SID to ACLs.

The Challenge
To gain access to files and folders, Administrators can take ownership and grant full access control permissions and rights to themselves if they want to modify, rename or delete these files or folders. During this process the original permissions are removed.

The Solution
Grant Administrators full control to files, folders or shares without taking ownership or destroying the original permission using Winzero TakeControl.

Avoid Take Ownership

Using standard Windows functions, if you must access a file or a folder that you do not have rights to, you must take ownership of that file or folder. When you do this, you replace the security permissions that were originally created for the file or folder.

Winzero TakeControl uses an append process to add the Administrators group with full control to each folder ACL and file ACL. without changing the original NTFS permission.

Download a fully functional trial version or learn more how TakeControl can help with profile migration and server migration projects.