Way To Wisdom

Solve Any Rubik's cube - 24 step algorithm

2018-01-25T12:55:00.001+05:30

Here is a great algorithm for solving Rubik's cube. Some times you don't have to go through all the way to the end. If it doesn't finished, continue from the beginning; it will finish eventually.

24 step algorithm

L	R2	B	L'	R	U2
F2	L	B	D	U2	B
L'	R2	B2	L'	D2	U
L	B2	U2	R2	B	D2

Reset CentOS 7 root password through Single User Mode

2017-12-12T18:43:00.005+05:30

Reset CentOS 7 root password through Single User Mode

While i was learning centos i used to install os on virtual machines and give passwords that i feel like easy to remember and hard to forget. But trust me if i am opening these machines after a three or four days gap, it would be easy for me to create a new virtual machine and install from scratch....

But there is a method to reset the root password for CentOS. Actually this method is applicable for all linux distributions with small changes in parameters to access single user mode.

For earlier versions of centos is a slight different. For CentOS 7 follow the steps.

Turn on the machine
At the boot menu, press e to edit the existing kernel (Core) as shown below.

Scroll down

Change ro to rw and start into bash shell by adding a simple line of command init= /sysroot/bin/sh

Press Ctrl + X to boot into Single User Mode

You will get a # prompt. Enter the following command
chroot /sysroot

Then run the command to change password
passwd root

If you want to change password for other users than root use the same command changing the username.

passwd ratheesh

if you dont know the user login name just go through /etc/passwd file. For that enter the following command.

cat /etc/passwd

First field is the username or login. Here on the above image rpb is the login and Ratheesh PB is the full name of that user. if there are a lot of users you can use more or less command to sees pagewise

more /etc/passwd
less /etc/passwd

or you can use the following command to list only usernames

awk -F':' '{print $1}' /etc/passwd

If you want to get list of all users other than built in system users use the following command

awk -F':' '{if($3 >= 1000 && $3 <= 60000) print $0}' /etc/passwd

after all changes update these changes and reset the boot parameters, use the following command

touch /.autorelabel

exit and reboot the machine

Login using new password....

Hosting PHP web application on Windows Server

2016-12-23T16:10:00.000+05:30

To host a PHP application on a windows server follow these steps

Install IIS on windows server

On Windows Server 2012 machine

On the Start page, click the Server Manager tile, and then click OK.
In Server Manager, select Dashboard, and click Add roles and features.
In the Add Roles and Features Wizard, on the Before You Begin page, click Next.
On the Select Installation Type page, select Role-based or Feature-based Installation and click Next
On the Select Destination Server page, select Select a server from the server pool, select your server, and click Next.
On the Select Server Roles page, select Web Server (IIS), and then click Next.
On the Select Features page, note the preselected features that are installed by default, and then select CGI. This selection also installs FastCGI, which is recommended for PHP applications.
Click Next.
On the Web Server Role (IIS) page, click Next.
On the Select Role Services page, note the preselected role services that are installed by default, and then click Next.
On the Confirm Installation Selections page, confirm your selections, and then click Install.
On the Installation Progress page, confirm that your installation of the Web Server (IIS) role and required role services completed successfully, and then click Close.
To verify that IIS installed successfully, type the following into a web browser:
http://localhost or http://127.0.0.1
You should see the default IIS Welcome page.

On Windows 8 machine

On the Start page, type Control Panel, and then click the Control Panel icon in the search results.
In Control Panel, click Programs, and then click Turn Windows features on or off.
In the Windows Features dialog box, click Internet Information Services, note the preselected features that are installed by default, and then select CGI. This selection also installs FastCGI, which is recommended for PHP applications.
Click OK.
To verify that IIS installed successfully, type the following into a web browser:
http://localhost
You see the default IIS Welcome page.

Install PHP

using Web Platform Installer (Web PI)

Open a browser to the following website: Microsoft Web Platform Installer 3.0.
Click Download It Now, and then click Run.
At the top of the Web Platform Installer window, click Products.
Click Frameworks, and then select the current version of PHP. (At this writing, the current version is PHP 5.3.13.)
Click Install.
The Web Platform Installation page displays the version of PHP and its dependencies that will be installed.
Click I Accept.
Web PI installs the PHP packages.
Click Finish.

Manual PHP installation

Download PHP and the WinCache extension.
Install PHP and WinCache.
Add the PHP installation folder to the Path environment variable.
Set up a handler mapping for PHP.
Add default document entries for PHP.
Test your PHP installation.

To keep this procedure simple, install the WinCache extension but do not configure it. You will configure and test WinCache later

Download and install php

Open your browser to Windows for PHP Download Page and download the PHP 5.3 non-thread-safe zip package.
Caution

The PHP 5.4 version does not work with the WinCache extension version 1.1. Use PHP 5.3 until this problem is resolved.
Download the WinCache extension (Php_wincache-svn20110402-5.2-nts-vc6-x86.zip) from the List of Windows Extensions for PHP.
Extract all files in the PHP .zip package to a folder of your choice, for example C:\PHP\.
Extract the WinCache .zip package to the PHP extensions folder (\ext), for example C:\PHP\ext.
The WinCache .zip package contains one file (Php_wincache.dll).
Open Control Panel, click System and Security, click System, and then click Advanced system settings.
In the System Properties window, select the Advanced tab, and then click Environment Variables.
Under System variables, select Path, and then click Edit.
Add the path to your PHP installation folder to the end of the Variable value, for example ;C:\PHP. Click OK.
Open IIS Manager, select the hostname of your computer in the Connections panel, and then double-click Handler Mappings.
In the Action panel, click Add Module Mapping.
In Request path, type *.php.
From the Module menu, select FastCgiModule.
In the Executable box, type the full path to Php-cgi.exe, for example C:\PHP\Php-cgi.exe.
In Name, type a name for the module mapping, for example FastCGI.
Click OK.
Select the hostname of your computer in the Connections panel, and double-click Default Document.
In the Action panel, click Add. Type Index.php in the Name box, and then click OK.
Click Add again. Type Default.php in the Name box, and then click OK.

Caution
The PHP 5.4 version does not work with the WinCache extension version 1.1. Use PHP 5.3 until this problem is resolved.

test php install installation

Open a text editor, for example Notepad, as Administrator.
In a new file, type the following text:
Save the file as C:\inetpub\wwwroot\Phpinfo.php.
Open a browser and enter the following URL: http://localhost/phpinfo.php
A nicely formatted webpage is displayed showing the current PHP settings.

Add php application

Once you have IIS and PHP installed, you can add a PHP application to your web server. This section describes how to set up your PHP application on an IIS web server with PHP installed. It does not explain how to develop a PHP application.

Open IIS Manager.

For Windows Server 2012, on the Start page click the Server Manager tile, and then click OK. On the Server Manager Dashboard, click the Tools menu, and then click Internet Information Services (IIS) Manager.
For Windows 8, on the Start page type Control Panel, and then click the Control Panel icon in the search results. On the Control Panel screen, click System and Security, click Administrative Tools, and then click Internet Information Services (IIS) Manager.

In the Connections pane, right-click the Sites node in the tree, and then click Add Website.
In the Add Website dialog box, type a friendly name for your website in the Site name box.
If you want to select a different application pool than the one listed in the Application Pool box, click Select. In the Select Application Pool dialog box, select an application pool from the Application Pool list and then click OK.
In the Physical path box, type the physical path of the website's folder, or click the browse button (...) to navigate the file system to find the folder.
If the physical path that you entered in step 5 is to a remote share, click Connect as to specify credentials that have permission to access the path. If you do not use specific credentials, select the Application user (pass-through authentication) option in the Connect As dialog box.
Select the protocol for the website from the Type list.
The default value in the IP address box is All Unassigned. If you must specify a static IP address for the website, type the IP address in the IP address box.
Type a port number in the Port text box.
Optionally, type a host header name for the website in the Host Header box.
If you do not have to make any changes to the site, and you want the website to be immediately available, select the Start Web site immediately check box.
Click OK.

configure wincache

To configure the WinCache PHP extension

In Windows Explorer, open your PHP installation folder, for example C:\PHP.
Choose either the php.ini - development or php.ini - production file, and rename it php.ini.
In a text editor, open the php.ini file and added the following line at the end of the file: extension = php_wincache.dll.
Save and close the php.ini file.
Recycle the IIS Application Pools for PHP to pick up the configuration changes.

To view WinCache configuration and other PHP settings

Open a text editor.
In a new file, type the following text:
Save the file as c:\inetpub\wwwroot\phpinfo.php.
Open a browser and enter the following URL: http://localhost/phpinfo.php
A nicely formatted web page is displayed showing the current PHP settings. The WinCache settings appear in a section called wincache.

Warning
Delete the phpinfo.php file when it’s no longer needed.

Configure other PHP settings

To configure a PHP setting

In Windows Explorer, open your PHP installation folder, for example C:\PHP.
In a text editor, open the php.ini file.
Search the file for the setting you want to change.
If the setting is commented out (line begins with a semicolon [;]), delete the semicolon and set the value. If you can’t find the setting, add the line to the end of the file.
Save and close the php.ini file.
Recycle the IIS Application Pools for PHP to pick up the configuration changes.

configure PHP extensions

To configure a PHP extension

Download the PHP extension you want from the list of Windows extensions for PHP.
Extract the extension zip package to the PHP extensions folder (\ext), for example C:\PHP\ext.
In Windows Explorer, open your PHP installation folder, for example C:\PHP.
In a text editor, open the php.ini file.
Search the file for the extension you want to configure.
If the extension is commented out (line begins with a semicolon [;]), delete the semicolon. If you can’t find the extension, add it to the end of the file. A line that adds an extension is in the form: extension = extension_name.dll. For example: extension = php_soap.dll.
Save and close the php.ini file.
Recycle the IIS Application Pools for PHP to pick up the configuration changes.

configure PHP security settings

To configure a PHP setting for security

In Windows Explorer, open your PHP installation folder, for example C:\PHP.
In a text editor, open the php.ini file.
Search the file for the setting you want to change.
If the setting is commented out (line begins with a semicolon [;]), delete the semicolon and set the value. If you can’t find the setting, add the line to the end of the file.
Save and close the php.ini file.
Recycle the IIS Application Pools for PHP to pick up the configuration changes.

Isolate Web Applications

Implement the following recommendations to isolate websites and web applications on your server.

Use one application pool per website or web application.
Limit access to site folders and files to the application pool identity.
Set up a separate PHP temp folder per site and only give access to the application pool identity.
Make sure to set an ACL (access control list) on each site root to allow only access to the application pool identity.

If you have more than one application per application pool, consider creating enough application pools and moving some of the applications to the new pools.

To create an application pool

Open IIS Manager.
In the Connections pane, click Application Pools.
In the Actions pane, click Add Application Pool.
In the Name box, type a unique name for the application pool.
Under .NET Framework version, select No Managed Code.
Select the Managed pipeline mode. The Integrated mode is recommended.
Click OK.

To move an application to another application pool

Open IIS Manager.
In the Connections page, select the website or web application you want to move.
In the Actions pane, click Basic Settings.
On the Edit Site dialog, click Select to open the Select Application Pool dialog, and then select the application pool from the Application pool menu.
Click OK to close the Select Application Pool dialog, and click OK to close the Edit Site menu.

To add an application pool identity to a folder or file ACL

Open Windows Explorer and navigate to the folder or file.
Right click the folder or file, and then click Properties.
Select the Security tab, and then click Edit.
Click Add, click Locations, and select your server as the location to search.
In the Enter the object names to select box, type IIS APPPOOL\applicationPoolName, where applicationPoolName is the application pool identity.
Click OK, click OK, and click OK again to close the dialogs.

Enable Per-site PHP Configuration

When you have multiple PHP applications on an IIS web server, you can improve security by configuring a PHP process pool and a php.ini file for each application. This section explains how to configure process pools and multiple pnp.ini files by using an applicationHost.config file.

Per-site PHP Process Pools

When each website has its own application pool, which is a recommended practice on IIS, it is possible to associate a dedicated FastCGI process pool with each website. This association is done in the fastCgi section of the applicationHost.config file. A FastCGI process pool is uniquely identified by the combination of fullPath and arguments attributes of the application element. To create several FastCGI process pools for the same process executable, such as php-cgi.exe, use the arguments attribute to distinguish the process pool definitions. With php-cgi.exe processes, use the command line switch "-d" to define an INI entry for a PHP process. And use this switch to set a PHP setting that makes the arguments string unique.
For example, if there are two Web sites "website1" and "website2" that must have their own set of PHP settings, define the FastCGI process pools as follows:

Copy

In this example the PHP setting open_basedir is used to distinguish between the process pool definitions. The setting also enforces that the PHP executable for each process pool can perform file operations only within the root folder of the corresponding website.
Therefore, the PHP handler mapping for website1 is as follows:

Copy

And the handler mapping for website2 is as follows:

Copy

Specifying Php.ini Location

When the PHP process starts, it determines the location of the configuration php.ini file by using various settings. The PHP documentation provides a detailed description of the PHP startup process. One of the places where the PHP process searches for the php.ini location is the PHPRC environment variable. If the PHP process finds a php.ini file in the path that is specified in this environment variable, it will use it. Otherwise, the PHP process will revert to using the default location of the php.ini file. This environment variable can be used to allow hosting customers to use their own versions of php.ini files.
For example, if there are two websites, "website1" and "website2," that are located at the following file paths: C:\WebSites\website1 and C:\WebSites\website2, you can configure the php-cgi.exe process pools in the fastCgi section of the applicationHost.config file as follows:

Copy

This way website1 can have its own version of the php.ini file that is located in the C:\WebSites\website1, while website2 can have its own version of the php.ini file that is located in C:\WebSites\website2. This configuration also ensures that if a php.ini file cannot be found in the location that is specified by the PHPRC environment variable, then PHP will use the default php.ini file that is located in the same folder where the php-cgi.exe is located.

Unable to Click on Android application(apk) Install button

2016-11-02T13:36:00.000+05:30

When we try to install an application on android it will ask for permission. Normally there will be two buttons Cancel and Next or Install. The problem is we can click on Cancel button or Next button without any problem and they will work as usual. But if we click on the install button; nothing will happen.. no error messages no warnings, simply no click effect at all.

I realized that i was using a screen filter app. I paused that app and tried to install. voila install button works...!
Usually these screen filter apps like flux, lumen, twilight etc are used to change the color and brightness of the display. Actually what it does is it shows a transparent layer over the display. Because of some security issues android will not allow click action on Install Button. If we pause or stop these apps the transparent layer will go and we are clicking directly on the Install Button.

Command prompt some useful tricks

2016-10-20T14:11:00.001+05:30

Send Command output to a new file

ipconfig > C:\Ipaddress.txt
this will create a text file named Ipaddress and the result will be saved in the file.

Send output to an existing file

net use >> C:\Ipaddress.txt
this will append the result to the file Ipaddress

send output to clip board

ipconfig | clip
this will send the result of the command to clip board and you can use it later.

if you want to navigate to a folder which is deep in a folder tree from command prompt you have to use the cd command a number of times and is very annoying process. You can simply navigate to the folder through file explorer by and right click on the folder by holding the Shift key

it will open command prompt with that folder as current directory

You can use Tab button to auto fill file/folder name after a command. This will be helpful for longer filenames which might have so many numbers and all.
for example if you want to copy the following file MsftWdf_User_01_11_00_Inbox_Critical.Wdf; it will be quite difficult to type in that name correctly. you can just type copy after a blank space you can press tab continuously until this file shows up. or to filter out files you can enter few first characters of the file name and press Tab that will display only files which starts with that characters. In this example you can type(without quotes) "copy msf" then press Tab.

You can use up arrow key to use previous commands in command prompt. But if you are trying to find a particular command which you entered before 20 commands then it is a problem. You can view previous commands by using this command
doskey /history

you can drag a file/folder to command prompt, and the file/folder path will append with the current command. if you want to change directory to a long path just type cd and a blank space and drag the folder to command prompt.

You can run multiple commands in one line. use double ampersand to link commands
net use && ipconfig

Mapping a network drive

2016-10-20T12:42:00.003+05:30

Mapping of network shares is essential for system administrators. It will help user to easily access network shared resources.

You can access the network share using running UNC path or by going through network.

After accessing the network resource you can just right click the desired share and click on "Map Network Drive"

You will get a Z: drive on you computer when you log in. You can change available drive letter. or change the login credentials with more privileged user.

You can also use command prompt to map and view network drives.
To see network drives already connected just type the following command in command prompt

net use

To map a network share use the following command
net use z: \\192.168.1.200\softwares
You can also use hostname instead of ip address.
net use z: \\server-01\softwares

can use different user credentials
net use s: \\192.168.1.200\softwares /user administrator 123

above mapped drives will not persist on reboot. If you want to retain the drive even after rebooting use /P:Yes switch with the command.
net use z: \\server-01\softwares /P:Yes

To delete a particular share drive use following command
net use z: /delete

To delete all network share drives use * instead of drive letter
net use * /delete

Troubleshoot Slow Computer

2016-10-20T11:19:00.002+05:30

Slow computers are always a problem for home users and professionals. This document does not cover slow boot-up, slow Internet or slow network. And also intended for Microsoft users.

Reboot

The first universal pc troubleshooting step is to restart your computer. If any unwanted applications running or any file corrupted or any one time problem situations or issues may will get solved - if you are lucky.

Background Programs

One of the most common reason is background processes. You can check running processes by opening Task Manager or RESMON. Uninstall any unwanted programs installed on your computer with or without your awareness. Disable unwanted startup programs. You can check start up programs by opening MSCONFIG.
Note: If you installed anti-virus on your pc then verify that anti-virus is not running scans on background. It might considerably slowdown your system.

Temp Files

Temporary files are accumulated as program runs but they never deletes as those programs exits. We can use third party cleaner softwares like CCleaner or Disk Cleanup. But a manual deletion of temp files is recommended. You can delete all files in %temp% directory (type %temp% in run prompt and press OK to open temp folder). If any files are not able to delete, you can skip it.

Hard Disk Free Space

You must save some space on system drive to allocate page file or virtual memory and to create temp files. If you have insufficient space that will make your pc slow. It is not necessary to allocate page files on system drive. Please verify those settings on
System Properties/Advanced/Performance/Settings/Advanced/Virtual Memory

Bad Hard Disk

Run tools like ScanDisk, chkdsk or any third party tools to verify that the hard disk is physically ok - dont have any bad sector problems.
Run Defrag to to order files in the hard disk

Malware

Spyware and Malware are the primary reason for slow computer other than physical issues. All anti-virus softwares are not good in detecting malware softwares. It is recommended to scan with a specialist anti-malware tool. Free version of Malwarebytes is a good option.

Virus

Yes dont forget to scan for viruses too, even if you enabled live protection.

Hardware Conflicts

Cross check any hardware conflicts using Device Manager. Check for any new unrecognized or uninstalled or malfunctioning device. Install or update with proper device drivers. Remove or disable any faulty devices. Try to remove physically or disable in BIOS.

Windows Updates

Try to update windows with latest updates. Sometimes these updates may slowdown your system. so disable automatic updates. and uninstall last updates.

Driver Software

Update driver software or Rollback last driver update according to the problem occurrence- if problem started after driver update then rollback otherwise update.

Memory Upgrade

If you are using your computer for more than two years then it is recommended to upgrade your RAM. Day by day large applications are introduced in the market. Your old computer may not have the required amount of RAM to handle the application.

Hard Disk

Hard Disk is one of the slower things on a computer. If you can afford a little cost then you can upgrade to Solid State Drive(SSD).

Registry

If you are such a person who likes to try new applications (mostly students) then there is a chance to have a bad registry(orphan links). You can use third party tools to clean the registry.

Processor Heat

Dust, dirt and hair can also constrict proper airflow inside your computer which can cause a computer to over heat. Make your computer cabinet is clean and fans are not obstructed.

Reinstall OS

Reinstalling the operating system can increase performance by getting rid of old software or drivers that may be on the computer and causing the computer to be slow.

Hardware Issues

Finally if your computer is still slow after trying all of the above recommendations there may have a more serious hardware related issue, such as failing component in the computer like Hard Disk, CPU, RAM, Motherboard, Add on Cards. You can run hardware diagnostic tools like Ultimate Boot CD(UBCD). This utility provides many diagnostic tests to find the BAD piece of Hardware.

Installing Dotnet Framework 3.5 offline on Windows 8/8.1

2016-06-30T11:39:00.001+05:30

The .NET Framework is an integral part of many applications running on Windows and provides common functionality for those applications to run. The required .NET Framework version might be different for different software and the most required .NET Framework version is 3.5 which comes preinstalled in Windows 7. The .NET Framework 4.5 is included with Windows 8, the .NET Framework 4.5.1 is included with Windows 8.1 and the .NET Framework 4.6 is included with Windows 10.

BUT

Whenever you try to open a program requiring .NET Framework 3.5, you get following message:
An app on your PC needs the following Windows feature: .NET Framework 3.5 (includes .NET 2.0 and 3.0)

You can see .NET Framework 3.5 in "Add or remove Windows Features" in "Programs and Features" in Control Panel. But we end up with nothing.
Now, you dont have internet connectivity or you already have .NET Framework 3.5 with you or you dont want to waste your bandwidth to download.
The funniest thing is that if you try to install offline installer package you already have; we will get the same message.!

So what we have to do

1. First you'll need to copy Windows 8 setup files to your hard disk. If you have Windows 8 setup ISO copied in your system, you can mount it by right-click on it and select "Mount" option or you can extract its content using 7zip/WinRAR
If you have Windows 8 setup disc and don't want to copy its content, its ok. Just insert the disc in your CD/DVD drive so that Windows can access its content.

2. Now open Command Prompt as Administrator and then provide following command:
Dism /online /enable-feature /featurename:NetFx3 /All /Source:X:\sources\sxs /LimitAccess
Here "X:" represents the CD/DVD drive letter in your system which contains Windows 8 setup disc. Replace it with the correct drive letter according to your system.
If you extracted Windows 8 setup files in a directory, replace D:\sources\sxs with the correct path.

3. As soon as you execute the above mentioned command, Windows will start installing .NET Framework 3.5 in your system and it'll not require Internet connection.

It'll take a few minutes and you'll get a message that the operation completed successfully.
4. That's it. Now you have installed .NET Framework 3.5 in Windows 8 without using Internet connection.

Group Policy to disable USB Drives

2016-06-28T12:10:00.000+05:30

simple effective and free way to block these as well as other forms of removable media on a windows computer.

1.	Create a GPO The first step is to open Group Policy Management and create a new GPO. I typically like to create 2 GPO's One for blocking read access and one for blocking write access. By Creating 2 separate policies I can apply each individually so I can allow read access for certain groups of users while blocking write access and I can apply both policies to other groups so I can block all access. The policy we are about to create is user based This means that it will apply to the users and not the computer. This means we can block access as need for normal users on a computer while still allowing access for other users like say IT (ourselves) so we can still do our thing without any issues. These policies apply to all forms of removable media not just USB based media. therefor you can use them to block other media access such as CD and DVD access as well.
2.	Set the Desired Policy Items In your GPO browse to the following location. User Configuration > Policies > Administrative Templates > System > Removable Storage Access If you look through the list of options you will see 2 choices for each media type. One choice when enabled blocks write access and the other choice blocks read access. In my attached image i show an example of blocking all read access. Therefor to block read access to each of these media types simply enable the deny read access item for each. If you want to block write access enable the block write access options. If you want to block both the enable both options. Its really that simple. ---------------------------------------------------------------- Note: For some reason Digital cameras require both read and write access. So if you have users that need access to a digital camera directly through the camera's USB connection they will need read and write access. Even if all they want to do is read files from the camera. However if you remove the memory card from the camera and read it with a memory card reader it only needs read access as expected. Within the Group Policy Editor, navigate to \Computer Configuration\Policies\Administrative Templates\System\Removable Storage Access. NOTE: If you prefer to set these restrictions on a per-user basis instead of computer-wide, then use the Group Policy path \User Configuration\Policies\Administrative Templates\System\Removable Storage Access. Group Policy – Removable Storage Access Note from the above screenshot that we can use Group Policy to limit access to the following device classes: Naturally, we want to apply GPO security filtering to ensure that only our desired users and computers are affected by our new policy. From the Group Policy Management Console we can make use of theSecurity Filtering and/or the WMI Filtering areas to properly scope our GPO. This is depicted in the following screen image: In order to put your new GPO into effect immediately, open an administrative command prompt and issue the following command: gpupdate/ force This command refreshes Group Policy throughout your Active Directory domain.
3.	Apply the GPO Now that you have created your GPO Policy (or policies if you want more granular control like I did) all that you need to do is apply the GPO to the Users you wish to restrict removable media for by assigning it the correct OU's. Once applied simply wait for the policy to update on the users computer or run "gpupdate /force" to speed things up and test it out. How the restriction works Once your GPO has been ingested by your domain, a user will see the following message box whenever they attempt to mount a restricted media device: In Local non domain computers Go to the client machine and go to start button and type in to search box `gpedit.msc` then your group policy window will open left side of window - search `application templates` and double click on it then click on `system` next you will see `removable storage access` just click on it then you will see lots of group policy name see the `all removable storage access: deny all access` double click on it and select the option `enable` and click on OK button you will success to block USB of client

Create a GPO

The first step is to open Group Policy Management and create a new GPO.

I typically like to create 2 GPO's One for blocking read access and one for blocking write access.

By Creating 2 separate policies I can apply each individually so I can allow read access for certain groups of users while blocking write access and I can apply both policies to other groups so I can block all access.

The policy we are about to create is user based This means that it will apply to the users and not the computer. This means we can block access as need for normal users on a computer while still allowing access for other users like say IT (ourselves) so we can still do our thing without any issues.

These policies apply to all forms of removable media not just USB based media. therefor you can use them to block other media access such as CD and DVD access as well.

Set the Desired Policy Items

In your GPO browse to the following location.

User Configuration > Policies > Administrative Templates > System > Removable Storage Access

If you look through the list of options you will see 2 choices for each media type. One choice when enabled blocks write access and the other choice blocks read access.

In my attached image i show an example of blocking all read access.

Therefor to block read access to each of these media types simply enable the deny read access item for each.
If you want to block write access enable the block write access options.
If you want to block both the enable both options.

Its really that simple.

----------------------------------------------------------------
Note:

For some reason Digital cameras require both read and write access. So if you have users that need access to a digital camera directly through the camera's USB connection they will need read and write access. Even if all they want to do is read files from the camera. However if you remove the memory card from the camera and read it with a memory card reader it only needs read access as expected.

Within the Group Policy Editor, navigate to

\Computer Configuration\Policies\Administrative Templates\System\Removable Storage Access.

NOTE: If you prefer to set these restrictions on a per-user basis instead of computer-wide, then use the Group Policy path

\User Configuration\Policies\Administrative Templates\System\Removable Storage Access.

Group Policy – Removable Storage Access

Note from the above screenshot that we can use Group Policy to limit access to the following device classes:

Naturally, we want to apply GPO security filtering to ensure that only our desired users and computers are affected by our new policy. From the Group Policy Management Console we can make use of theSecurity Filtering and/or the WMI Filtering areas to properly scope our GPO. This is depicted in the following screen image:

In order to put your new GPO into effect immediately, open an administrative command prompt and issue the following command:

gpupdate/ force

This command refreshes Group Policy throughout your Active Directory domain.

Apply the GPO

Now that you have created your GPO Policy (or policies if you want more granular control like I did) all that you need to do is apply the GPO to the Users you wish to restrict removable media for by assigning it the correct OU's.

Once applied simply wait for the policy to update on the users computer or run "gpupdate /force" to speed things up and test it out.

How the restriction works

Once your GPO has been ingested by your domain, a user will see the following message box whenever they attempt to mount a restricted media device:

In Local non domain computers

Go to the client machine and

go to start button and type in to search box gpedit.msc

then your group policy window will open

left side of window - search application templates and double click on it

then click on system

next you will see removable storage access just click on it

then you will see lots of group policy name

see the all removable storage access: deny all access

double click on it and select the option enable and click on OK button

you will success to block USB of client

Cant open exe files on windows

2016-06-28T11:51:00.000+05:30

Cant open exe files on windows

When you try to open EXE files, you may get errors messages like: "Access Deny", "Runtime error" etc.

This might be because of corrupt registry settings or some third party product (or virus) can change the default configuration for running EXE files. This may lead to failed operation when you try to run EXE files.

If you are using Windows XP and you enable "System Restore" , you need to disable "System Restore" in "Safe Mode" before using the instructions

1. Click Start, and then click Run.
2. Type "command.com" or "cmd" , and then press Enter. (A DOS window opens.)
3. Type the following: Press Enter after typing each one.
    "cd \"
    "cd windows"
4. Type copy "regedit.exe regedit.com" and then press Enter.
5. Type "start regedit.com" and then press Enter.
6. Navigate to and select the key:
HKEY_CLASSES_ROOT\exefile\shell\open\command
7. In the right pane, double-click the (Default) value.
8. Delete the current value data, and then type:
"%1" %*
   *Tip: Type the characters: quote-percent-one-quote-space-percent-asterisk.
9. Close Regedit utility.

Cheers

Change IP Configuration through commands

2016-06-28T10:15:00.003+05:30

View Your Network Information

Before you change your IP address and related information, you’ll need to find the full name of the network for the interface you want to change. To do this, type the following command:

netsh interface ipv4 show config

Scroll down until you see the interface. In our example, we’re going to modify the Wi-Fi interface, which on our machine is just named “Wi-Fi.” You’ll also see other default names that Windows assigns to interfaces, such as “Local Area Connection,” “Local Area Connection 2,” and “Ethernet.” Just find the one you’re looking for and make note of the exact name. You can also copy and paste the name to Notepad.

Change Your IP Address, Subnet Mask, and Default Gateway

Set static IP

netsh interface ip set address name=”Local Area Connection” static 192.168.0.1 255.255.255.0 192.168.0.254

netsh interface ipv4 set address name="Wi-Fi" static 192.168.1.10 255.255.255.0 192.168.1.1

Set dynamic IP (DHCP)

netsh interface ip set address name=”Local Area Connection” source=dhcp

Set static Prefered DNS server

netsh interface ip set dns name=”Local Area Connection” static 192.168.0.250

Set alternate DNS server

netsh interface ip add dns name=”Local Area Connection” 8.8.8.8 index=2

Set dynamic Prefered DNS server

netsh interface ip set dnsservers name=”Local Area Connection” source=dhcp

Note: Those given in blue italics must be changed with your network adapter name in network settings and ip addresses of your network/service providers.

Cant run third party exe files on Windows 8

2016-06-28T10:05:00.003+05:30

Cant run third party exe files on Windows 8

Windows 8 is a bit more secure than other earlier versions of windows. But it is too much annoying for the end user. Downloaded exe files are not allowed to run on windows 8 by default.

To install EXE files downloaded from the internet on Windows 8 you’ll need to modify the registry settings.
(You have to turn off UAC)

1) Start by going to the Run command and type in “regedit” without the quotes. The Windows Registry Editor will appear.

2) Next, navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.

3) Click on the EnableLUA key and set the value to 0. This really disables UAC.

4) An Action Center message will appear prompting you to restart the computer to disable UAC.

5) Restart the computer and run EXE files downloaded from the internet at your own risk.

NOTE: You will not be able to run any apps from the Windows store. So disabling UAC for real does have its drawbacks, but remember you can always set EnableLUA back to 1 to run them.

Configure ASUS DSLN10S modem in PPPoE mode

2016-04-04T09:38:00.000+05:30

Follow steps to configure ASUS DSLN10S modem in PPPoE mode:-

Open any web browser [ Google chrome , Internet explorer, Firefox ] and enter 192.168.1.1

Enter username =admin & Password = admin and press ok
click Quick Internet setup
In web account setup enter password/confirm password =admin/admin to keep login password same.
click Next and select Time Zone press next.
select country e.g. india service provider BSNL PPPOE , vpi/vci=0/35.
Enter username/password provided by your ISP press next.
Edit ssid =This is your wifi network name , select encryption WPA-PSK[AES] and fill wifi password in pre shared key =min 8 chars.
press Next then FINISH.
click reboot button.
after Reboot modem will be ready.

Find out motherboard manufacturer, model and serial number

2015-12-10T10:21:00.001+05:30

Some times we may need to find out our motherboard model for various reasons like proper driver installation or hardware compatibility. unfortunately It is very difficult to find out motherboard model without opening the cabinet which might be under some table and somany cables around it.
You can get these using either of the following methods

Method 1

You can use Microsoft's wmic tool to get that information.
1. Open command prompt
    Start/run
    Type cmd and press ok
2. Type the following command end   press enter

wmic baseboard get product, manufacturer, version, serialnumber

Method 2

You can use directx diagnostic tool

1. Start/run
Type dxdiag and press enter key or OK button

Change UserName on ubuntu

2015-02-18T11:45:00.000+05:30

To rename a user

At the start screen press Ctrl+ALT+F1.
Log in using your username and password.
Set a password for the "root" account.
sudo passwd root
Log out.
exit
Log in using the "root" account and the password you have previously set.
Change the username and the home folder to the new name that you want.
usermod -l -d /home/ -m
Change the group name to the new name that you want.
groupmod -n
Lock the "root" account.
passwd -l root
If you were using ecryptfs (encrypted home directory). Mount your encrypted directory using ecryptfs-recover-private and edit /.ecryptfs/Private.mnt to reflect your new home directory.
Log out.
exit
press Ctrl+ALT+F7.

If you get the following error

usermod: can't change /etc/password

run the following commands in the root recovery console

mount -o remount,rw /

Then Rerun the usermod command

Setting Wallpaper Using GPO

2015-02-03T14:27:00.000+05:30

Using Group Policy we can set wallpapers of all nodes same. we can restrict users from setting unacceptable pictures and we can keep our company preferred wallpapers like company logo, motive, today's quotes, wishes, etc.

Method 1

The “Desktop Wallpaper” method in "Administrative Templates" is the most commonly used way for configuring the Wallpaper on a computer however as it seems with all things Group Policy using this setting comes with its own pro’s and con’s.

Pro’s

Change is Restricted for the users
Works on all versions of Windows

Con’s

Limited targeting only based on standard Group Policy Object’s (OU,Security Filter,Site,WMI & Domain)

User Configuration > Administrative Templates > Desktop > Desktop

specify the explicit local path or a UNC to the image you want displayed as the desktop wallpaper

Actually what it does is configuring the REG_SZ “Wallpaper” and the REG_SZ “WallpaperStyle” registry keys under the HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System path.

TIP #1: If you are running Windows 7/Server 2008 R2 pre-Service Pack 1 you will need to install hotfix http://support.microsoft.com/kb/977944 for this setting to work.

TIP #2: If you are configuring this setting I recommend that you use the “Fill” Wallpaper Style as this will work best with most screen resolutions (especially on Windows 7).

TIP #3: If you configure this setting you will need to wait for the user to logoff the computer before the background is updated.

Method 2

Method 1 configures the HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System REG_SZ “Wallpaper” key. Therefore you can also use the Group Policy Preference Registry Extension option to also set the same key to give you some added benefits.

Pro’s

Support advanced targeting option due to Group Policy Preferences Item-Level Targeting
Change is Restricted or Unrestricted for the user

Con’s

Must run Windows XP (or greater)
Must have the Group Policy Client Side Extensions installed.

simply create two registry keys

User Configuration > Preferences > Windows Settings > Registry

Now depending on the registry key that you configure for this setting you can either have this as a restricted (a.k.a. locked) setting or an unrestricted setting that allows the users to make their own changes.

Restricted: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\Wallpaper

Unrestricted: HKCU\Control Panel\Desktop\Wallpaper

Restricted: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\WallpaperStyle

Unrestricted: HKCU\Control Panel\Desktop\WallpaperStyle

Tip #4: If you don’t configured the “WallpaperStyle” registry key then users will still be able to choose their own Wallpaper Style.

If you chose the restricted registry keys to configured the wallpaper then ensure you also select the “Replace” action and “Remove this item when it is no longer applied” common option is selected (see below). If you don’t do this you will find that your users will not be able to change their wallpaper even after the policy is removed as the policy registry key will not be removed.

If you chose to use the unrestricted registry key values then also make sure you chose the “Apply once and do not reapply” option. If you don’t do this the users wallpaper will be reset ever time they log off their computer as the key will be set back to the original value during each policy refresh.

Configuring the Desktop Wallpaper Storage Location

Now that you know the many options for configuring the Desktop Wallpaper via Group Policy the next thing you should consider is where is the wallpaper being stored. As you can seen in the screen shots of the administrative template Desktop Wallpaper that they use the example of a UNC path. But…

TIP #5: DONT EVER USE A UNC PATH FOR A DESKTOP WALLPAPER… EVER!!

Simple put using a UNC path puts a lot of stress on network as it has to download file every time the wallpaper is loaded. It also means that if the network path cannot be contacted when the user logs on all they will get is a black background wallpaper. This is particularly obvious when someone logs on with a laptop not connected LAN.

So the obviously question is how do you make sure that file that the desktop wallpaper uses is always available and easily accessible? Use a script and copy the file to the local hard drive. Sure… but http://ihatelogonscripts.com and the issue with using a script is that it will only run when the computer starts up or when the user logs on. Generally this would not be a problem and if you are smart enough to use a copy program like robocopy or other such program it wont stress your LAN as it will only copy the file once. But on the day that you change the desktop wallpaper ever computer and/or user will try to download the new wallpaper all at once.

The Answer? Use Group Policy Preferences File Extension and copy the file down to the local computer.

Using the Group Policy Preferences File Extension

Using the File Extension to copy the file to the local hard drive means the file will be copied to the local hard drive making obviously available at all times. However the File Extensions options also has the advantage of being able to updated the file during each group policy refresh. This way the computer gets the updated wallpaper without having to logoff or reboot the computer and you avoid slamming the network in the morning when all the computers turn on.

TIP #6: Setup the file copy as a computer setting so that it will update the files even when there is no user logged on.

TIP #7: If you follow Tip #6 then you need to make sure that the desktop wallpaper file has got “Domain Computers” Read permissions so the local system account has access to copy the file from the network.

USB drive disappears or file transfers stop unexpectedly

2015-01-30T10:54:00.000+05:30

After installing Windows 8.1, my USB drive disappears or file transfers stop unexpectedly…

Note: The registry workaround described in this blog is no longer required. A major Windows update published on 4/8/2014 reverts the USBSTOR.SYS driver behavior to 8.0. As a result, a storage device that uses BOT protocol will not be suspended when it's idle. So if you are having issues accessing your device after the device has been idle for sometime, please install this latest Windows update first. Here is the direct link to the update: http://support.microsoft.com/kb/2919355. Once the update is installed, you should see the timestamp on the %SystemRoot%\system32\drivers\usbstor.sys file to be 2/22/2014 or later.
In Windows 8.1, to conserve system power, some USB storage devices (external USB hard drives and USB flash drives) enter a low power state (suspended) when they are idle. To view the idle period:

1. Use the Search charm and type “power options”.
2. Click the first result.
3. Click Change Plan Settings of the currently selected power plan.
4. In the Edit Plan Settings dialog click Change advanced power settings.
5. Expand Hard disk and then Turn off hard disk after.
The Setting value indicates the system disk idle period. In this image the idle period is set to 20 minutes (default).

For this system, if no file transfers occur within 20 minutes, the drive enters a suspend state and draws less power from the system.
For most USB storage devices and USB host controllers, the power-saving mechanism works without issues. However, a pre-existing problem in the USB drive or USB host controller might cause these problems after the specified idle period expires:

The device periodically disconnects and might reconnect leading to poor user experience.
If you try to access files stored on the drive, Windows Explorer becomes unresponsive for 1-2 minutes.

If you notice any of those problems, first check whether the firmware on the USB host controller or the USB storage device is out of date. If so, get the latest firmware from the system or device manufacturer. A firmware update might resolve the issue.
Otherwise, determine whether the problem occurs during the system disk idle time period (shown in Power Options). If it does, disable suspend on idle for this device as per the instructions given in the next two sections. The first section shows how to find the VID/PID of the device and apply the registry setting manually. Second section shows how to do that using a PowerShell script. Note, you can set the value to “Never” in the Power Options just an experiment to see if that fixes the issue, but the right long term solution is to set the registry setting as described below. This registry setting does not affect the other USB storage devices and results in conserving power.

To disable suspend on idle for this device:

1. Obtain the hardware ID of the USB storage device.

1. Make sure the device is plugged in.
2. Search for “device manager” in the Search charm, and open Device Manager.
3. In Device Manager, expand the Disk Drives and locate the device:

4. Select the View > Devices by connection from the menu:

5. Right-click the USB Mass Storage Device node under which the device appears, and select Properties.
6. On the Details tab, select Hardware Ids from the drop-down list.

7. Make a note of the 4 digits occurring after “VID_” and “PID_” and close Device Manager. In this example, VID is 0004 and PID is 0001.

2. Change the device setting in the registry.

1. Run Registry Editor (regedit.exe) as administrator by searching for “regedit” in the Search charm. Right-click the regedit icon, and select Run as administrator.
2. In Registry Editor, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\usbstor.

3. Right-click usbstor and create a key. The name must be VID and PID strings obtained previously. Leading 0’s are significant. For the device in this example the new key name is “00040001”.
4. Right-click the new key and create a DWORD entry named DeviceHackFlags. Set the value to 400 hexadecimal.

5. Disconnect and reconnect the device.
If the workaround resolves the issue please respond with a comment containing the VID and PID for the device and the USB host controller to which it is connected (from top-level parent icon in step 4 of “Obtain Device Hardware ID” section).

PowerShell script to disable suspend

To make it easier to find devices and apply the registry setting, we have recently added a PowerShell script to this blog. The script when run lists all the storage devices and gives you an option to pick a device to either enable or disable the suspend setting.

Download the ToggleSuspend.ps1 to a local directory.
Right click on Start button and select "Command Prompt (Admin) option to start a command prompt with Administrator privilege.
Cd to the directory where you have the script saved.
Run "Powershell -ExecutionPolicy Bypass -NoProfile -File ToggleSuspend.ps1”. Remove the quotes when you copy paste. The script will display the VID/PID of the storage devices, friendly name of the device as seen in the device manager, and whether the "SuspendOnIdle" option is enable or disabled.
By selecting the drive number from the list, you can toggle the state.

Please note for some devices, the script may not show the friendly name. This is a known limitation of the script.
Instructions for recording a verification trace only readable by Microsoft have been removed from this blog post. This trace is no longer needed because the script eliminates difficult, error-prone steps in applying the registry workaround,

Device List

FYI: A list of Windows 8.1 certified devices which have passed selective suspend testing is available here.

Update: Thanks to all for reporting the VID/PID of the devices that are impacted by selective suspend. Here is the compiled list as of Jan. 27, 2014:
* = Device is fixed by installing KB 2914219--no need to edit registry or use our script. We hope to release another KB to fix more devices, such as the ones not marked with (*).

USB\VID_0411&PID_01E7* USB\VID_0411&PID_01EA* USB\VID_0411&PID_01E5 USB\VID_0411&PID_0105	BUFFALO HD-PNTU3 (1TB) Buffalo DriveStation HD-LB2.0TU2-UK (2GB) Buffalo HD-LBV3.0TU3 (3GB) Buffalo External HDD 500GB
USB\VID_2009&PID_5004*	datAshur
USB\VID_174C&PID_55AA* USB\VID_174C&PID_5136 USB\VID_174D&PID_5106 USB\VID_0BDA&PID_0184 USB\VID_18E3&PID_9106	Fantom Drive, USB 3.0, model: GF3BM1000U Sabrent 2.5" SATA Hard Drive To USB 3.0 Enclosure StarTech SAT2510B12U3 Fantom Compact 4 TB USB Hard Drive, model: GF3B4000U Media Card Reader (Built into Dell XPS 8100)
USB\VID_04C5&PID_120E* USB\VID_0480&PID_A006 USB\VID_04BB&PID_013E USB\VID_0939&PID_0B16 USB\VID_0DC4&PID_020A USB\VID_0930&PID_0B1A	Fujitu HDD (1TB) Toshiba Canvio Basic USB 3.0 IOData HDPV-UT Toshiba Stor.E 2TB ICY BOX Toshiba STORE.E ALU 1 TB (USB 3.0)
USB\VID_4971&PID_1012 USB\VID_4971&PID_1013 USB\VID_4971&PID_1014* USB\VID_4971&PID_1015* USB\VID_4971&PID_CE17* USB\VID_1BCF&PID_0C31	Hitachi Touro USB 3.0 HDD Hitachi HDS721010CLA332 USB Device
USB\VID_125F&PID_A03A* USB\VID_125F&PID_A15A	ADATA Nobility NH03 ADATA HD710 1TB
USB\VID_0951&PID_162B	Kingston DataTraveler HyperX 3.0 USB Device 256GB (DTHX30/256GB)
USB\VID_059F&PID_1018* USB\VID_058F&PID_6362	LaCie 2TB USB Drive Media Card Reader (Built into Dell XPS 8500)
USB\VID_1520&PID_0551*	multi-drive enclosure connected
USB\VID_152D&PID_2336* USB\VID_152D&PID_2339* USB\VID_152D&PID_2352* USB\VID_152D&PID_2509* USB\VID_152D&PID_0539 USB\VID_152D&PID_0551 USB\VID_152D&PID_2329	RaidSonic ICYBOX IB3221StU-B External Case (JMicron Technology Corp 20336 Controller) Sans Digital TR4U+B Vantect NexStar HXR4 Fantec QB-35US3R with 4x2 TB Digitus USB 3 External HDD Enclosure 2.5 Mediasonic H82-SU3S2 ProBox EAGLE ET-CS2MSU2-BK 2.5" Black USB 2.0 Mesh External Enclosure
USB\VID_04E8&PID_6012* USB\VID_04E8&PID_6013 USB\VID_04E8&PID_6860	Samsung 1T Samsung G3 Station 1TB Samsung i9500
USB\VID_0BC1&VID_A0A4 USB\VID_0BC2&PID_A0A1 USB\VID_0BC2&PID_A0A4 USB\VID_0BC2&PID_A0A5 USB\VID_0BC2&PID_5071* USB\VID_0BC2&PID_2312* USB\VID_0BC2&PID_2332 USB\VID_0BC2&PID_2340 USB\VID_0BC2&PID_3300* USB\VID_0BC2&PID_3000 USB\VID_0BC2&PID_3001 USB\VID_0BC2&PID_3008* USB\VID_0BC2&PID_3010* USB\VID_0BC2&PID_3312* USB\VID_0BC2&PID_3320* USB\VID_0BC2&PID_3332* USB\VID_0BC2&PID_3372 USB\VID_0BC2&PID_50B5 USB\VID_0BC2&PID_3330 USB\VID_0BC2&PID_5031	Seagate Drives
USB\VID_0984&PID_0310* USB\VID_0984&PID_0315* USB\VID_0984&PID_0340* USB\VID_0984&PID_1400* USB\VID_0984&PID_1405* USB\VID_0984&PID_1406* USB\VID_0984&PID_0095* USB\VID_0984&PID_0092* USB\VID_0984&PID_0317* USB\VID_0984&PID_0316* USB\VID_0984&PID_1403*	Apricorn Padlock 3.0 Apricorn Padlock DT 3.0 Apricorn Aegis BIO Apricorn Fortress Apricorn Padlock SSD Apricorn FIPS Padlock DT Apricorn Padlock Pro iStorage diskAshur iStorage diskAshur DT iStorage diskAshur FIPS DiskGenie USB Device
USB\VID_18A5&PID_0400* USB\VID_18A5&PID_021B* USB\VID_18A5&PID_0216*	Verbatim Store 'n' Save SuperSpeed 3TB Verbatim Quad-interface External HDD Verbatim 1TB-USB 2.0-Drive
USB\VID_1058&PID_1021* USB\VID_1058&PID_1140* USB\VID_1058&PID_0730* USB\VID_1058&PID_0741* USB\VID_1058&PID_0748* USB\VID_1058&PID_1123	Western Digital WD My Book 3.0 1 TB
USB\VID_0928&PID_0010	Zalman VE-200SE enclosure
USB\VID_0781&PID_5406	SanDisk Micro Cruzer (USB flash drive)
USB\VID_0D49&PID_7310	Maxtor OneTouch
USB\VID_12D1&PID_1003	Huawei MMC Storage USB Device
USB\VID_054C&PID_05C0 USB\VID_054C&PID_07BA	Sony HDD-1TB Sony HDD-2TB
USB\VID_19B9&PID_3455	Drobo 5D

* = (explained at top of table)

Exact Copy of a File or Folder using XCOPY

2015-01-28T15:15:00.001+05:30

If we copied a file or folder and paste in another or same folder, the permissions set on the folder will reset to the default inherited permission from its parent.
In some cases we will need to set same permissions to a set of subfolders. It will be easy if we can copy the permissions to each one of the sub folders. There is an easy way to do this.
Create one subfolder and set all necessary permissions on that folder. then copy that subfolder with xcopy command and it will restore all the file structure and file permissions.

Syntax:
XCOPY [Source] [Destination] [/O] [/X] [/E] [/H] [/K]

These switches have the following effects:

/E - Copies folders and subfolders, including empty ones.
/H - Copies hidden and system files also.
/K - Copies attributes. Typically, Xcopy resets read-only attributes.
/O - Copies file ownership and ACL information.

/X - Copies file audit settings (implies /O).

NOTE: This procedure does not override inherited permissions. When you use the Xcopy command with the /O /X /E /H /K switches to copy the files, the following inherited permissions apply:

The security settings that are directly assigned to the files and folders are retained.
The security settings that are inherited from the source parent folder are lost.
The security settings of the destination folders are inherited.
When you move files or folders to FAT volumes, the folders and files lose their NTFS permissions because FAT volumes do not support NTFS permissions.

Eg:

xcopy c:\olddocs c:\newdocs /O /X /E /H /K,

xcopy Computer Electronics /O /X /E /H /K

Create a log file like diary

2015-01-27T16:53:00.001+05:30

Do you ever wanted to create a file in which you can enter notes. Or a log file which appends data with timestamp. Or you are working as an executive who receives lots of calls everyday and you are noting down those call details in a notepad. Just think about a file in which you enter your notes and time automatically filled? And for this you don't need any additional application. Follow these steps

1, open notepad.exe
2, type .LOG in the first line
3, save this file as normal

From next time onwards when you open this file you will get a timestamp entry automatically.

If you append this file from any program you will get a timestamped log file....

Eg:
C:\> ver >> mylog.txt

Windows Server 2008 FSRM (File Server Resource Manager)

2015-01-21T13:49:00.000+05:30

FSRM (File Server Resource Manager) is a service of the File Services role in Windows Server 2008. You can use FSRM to enhance your ability to manage and monitor storage activities on your file server.

The main capabilities of FSRM include:

Folder Quotas

File Screening

Storage Reports

Event Log Integration

E-mail Notifications

Automated Scripts

For example, you can use FSRM to perform the following tasks:

Limit the size of a folder to 2GB and log an event when the Quota limit is reached.

E-mail an administrator whenever a specific folder reaches 85% of its specified Quota.

Create a File Screen to prevent users from saving of video/audio files to a share and send notifications when users attempt to do that.

Schedule and publish a periodic storage reports that shows how much space is being used by each user.

Generate an instant storage reports to list the largest files on a share.

Automatically execute a script when a folder size exceeds 500 MB to clean up stale data in the folder.

FSRM was introduced with Windows Server 2003 R2, but it remains as one of those hidden gems in Windows Server that delight people that discover it. It’s also important to note that FSRM fully supports Windows Server 2008 Failover Clustering.

Read along to get all the details and be sure to spread the good news to all your fellow file server administrators.

How to install FSRM

“File Server Resource Manager” is one of the role services of the “File Services” role.

To install it, open the “Server Manager” tool on your file server, right-click the File Server node on the tree and select “Add Role Services”. The “Add Role Services” wizard will start, as shown below:

Check the “File Server Resource Manager” box and click “Next”. You will then select the NTFS volumes you want to monitor:

Click on “Options” to see additional options for reports:

The screen above shows the standard configuration for a volume, along with the reports that are generated when that threshold is reached.

Select the reports you want, click “OK” to close that window, then click “Next’ to continue. This last window before the confirmation lets you specify the folder where the reports are saved and also the e-mail reporting details:

Click "Next", review the confirmation and click “Install” to finish the wizard.

Keep in mind that you can decide not to add any volumes during this install phase and add them later, after FSRM is already installed.

File Server Resource Manager MMC

Once the FSRM Role Service is properly configured, you will have an additional item under the “Administrative Tools” menu.

Click on “Administrative Tools” and select “File Server Resource Manager to launch the FSRM MMC (Microsoft Management Console). See the screenshot below, with all the nodes of the tree expanded:

We’ll now examine the individual features exposed by this MMC.

Quota Management

Quotas help you restrict and/or monitor how much space a folder can use.

FSRM can implement both hard Quotas (that actually prevent the users from adding more files, as if the disk were full) and soft Quotas (which only generate events and warnings).

You can see the Quotas in the screen below (“Quotas” node under “Quota Management”):

Note that this is soft Quota we created during the FSRM installation.

To add more Quota restrictions, click on the “Create Quota…” action (on the Actions pane on the right):

Quotas are always placed on a folder. You have the choice of basing your Quota on a template or defining a custom one. FSRM ships with a series of sample Quota templates that you can adapt to your needs.

If you click on “Custom Properties”, you can provide many details, as shown below:

In addition to specifying the space limit (hard or soft), you can also create different thresholds, with different actions. The sample above sends e-mail alerts at 85%/95%/100% and logs events at 95%/100%. If you click on the “Add…” button, you can see the configuration options for each threshold.

You can even choose to execute a command when a threshold is reached, which is shown on the screen below. If you are skilled with scripting, you can use this ability to perform a number of sophisticated tasks.

Instead of specifying custom Quotas folder by folder, you can use standard FSRM Quota templates or define your own templates.

The screen below shows the default templates and also shows the “Create Quota Template…” action on the right:

The power of Quota Templates becomes much more obvious when you use the option to “Auto apply template” while creating a Quota:

This option requires that you select a template (not a custom Quota). A Quota is created based on that template for all folders under the specified path.

Every time you add another subfolder to that folder, the template is automatically used to create another Quota for it. This allows you much simpler configuration for certain folder structures like web sites, project folders, etc.

File Screening Management

File Screening helps you restrict and/or monitor which file extensions can be used on your file server. FSRM can provide both active screening (block file with certain extensions) or passive screening (monitor file extensions without blocking).

File extensions can also be combined in “File Groups” like “Image Files” and “Audio and Video Files”:

You can see the existing File Screens in the “File Screens” node under “File Screening Management”. None are defined by default.

To add a File Screen, click on the “Create File Screen…” action (on the Actions pane on the right):

As with Quotas, FSRM supplies some predefined File Screen Templates. You can also opt to define your own File Screening properties, as shown below:

Once you click on “Custom Properties”, you will see the window below:

The basic properties include the path to monitor, the type of monitoring (active or passive), the file groups to block/monitor and the specific actions to take (e-mail, event log, command or report).

You will probably want to use a template to define your File Screening. Below is the list of pre-defined templates included with FSRM:

You can also create your own File Screening Templates, just like with Quota Templates.

FSRM includes a list of pre-defined File Groups, as shown below:

You can use those, modify them or create your own File Groups.

Storage Reports Management

One important feature of FSRM is the ability to provide many reports associated with File Server Management to make your life simpler when managing your file server. Those reports include Files by Group, Files by Owner, Large Files, Most Recently Accessed Files and Duplicate Files, just to mention a few (see screen below).

Reports can be generated manually, on a scheduled or triggered by a Quota or File Screen. They can also be generated in different formats (see options on the screen below) and are delivered to a folder defined when you installed the role service.

That folder can also be updated in the FSRM configuration:

Below you see a number of those manually generated reports using the HTML format:

Please check the sample below, in HTML format, showing the Files by Owner report:

Additional Information

For additional information on FSRM, check the following links:

Step-by-Step Guide for File Server Resource Manager in Windows Server 2008
http://technet2.microsoft.com/windowsserver2008/en/library/33fcd74b-640c-458b-b81b-1014bd0be2321033.mspx?mfr=true

File Server Resource Manager troubleshooting information
http://technet2.microsoft.com/windowsserver2008/en/library/c23c92a7-c4f9-4a59-a80d-d0a2c9bb67551033.mspx?mfr=true

Using FSRM Folder Quotas with FTP
http://learn.iis.net/page.aspx/307/using-fsrm-folder-quotas-with-ftp/

Map Drives Based on Group Membership Using Group Policy Preferences

2015-01-21T13:42:00.003+05:30

Mapping network drives based on group membership requires some programming knowledge-- either VBScript or command shell (batch files). VBScript based logon scripts can require hundreds of lines of code to provided a complete solution. And batch files require the assistance of helper applications such as IFMEMBER.EXE and NET.EXE, and introduce many challenges with controlling how Windows processes the script. But Group Policy Preferences removes the programming requirement and awkwardness of scripting mapped drives based on group membership. There are many scenarios in which you may want to map a local drive letter to a specific network share to include public drive mappings, inclusive group drive mappings, and exclusive group drive mappings.

Public drive mappings typically do not require membership to a particular group. However, sometimes public drive mappings do not provide enough granularity. Most organizations have data specific to business units such as accounting, marketing, or human resources.. Inclusive Group Drive mappings solve this problem by allowing a configuration that maps a specific drive letter to a specific network share based on the user being a member of a particular group. This ensures members of the accounting unit receive drive letters mapped for accounting and members of human resources map their respective drives. Exclusive drive mappings are not very common; however, they do provide the flexibility to prevent a user from mapping a particular drive letter to a network share if they are not a member of a specific group. A good example of exclusive drive mappings is to prevent the CIO or other executives members from mapping a drive letter in which they are likely to never use. Let us take a closer look at these scenarios

Public drive mappings

Producing a Group Policy Preference item to create public drive mappings is simple. The GPO containing the preference item is typically linked to higher containers in Active Directory, such as a the domain or a parent organizational unit.

Configuring the drive map preference item.

Figure 1 Configuring mapped drive preference item

Newly created Group Policy objects apply to all authenticated users. The drive map preference items contained in the GPO inherits the scope of the GPO; leaving us to simply configure the preference item and link the GPO. We start by configuring the drive map preference item by choosing the Action of the item. Drive map actions include Create, Replace, Update, andDelete. These are the actions commonly found in most preference items. Create and Delete actions are self-explanatory. The compelling difference between Replace and Update is that Replace deletes the mapped drive and then creates a new mapped drive with the configured settings. Update does NOT delete the mapped drive-- it only modifies the mapped drive with the new settings. Group Policy Drive Maps use the drive letter to determine if a specific drive exists. The preceding image shows a Drive Map preference item configure with the Replace action. The configured location is a network share named data; hosted by a computer named hq-con-srv-01. The configured drive letter is the G drive. All other options are left at their defaults. This GPO is linked at the contoso.com domain.

The results of this configuration are seen when using Windows Explorer on the client computer. The following picture shows a user's view of Windows Explorer. We see there is one network location listed here, which is the G drive that is mapped to \\hq-con-srv-01\data.

Figure 2 Public drive map client view

Later, we'll see how to use exclusive drive mappings with public drive mappings as a way to exclude public drive mappings from a subset of users.

Inclusive drive mapping

Inclusive drive mappings are drives mapped to a user who is a member of (or included) in a specific security group. The most common use for inclusive drive maps is to map remote data shares in common with a specific sub set of users, such as accounting, marketing , or human resources. Configuring an inclusively mapped drive is the same as a public drive mappings, but includes one additional step. The following image shows us configuring the first part of an inclusive drive mapping preference item.

Figure 3 Inclusive drive mapping

Configuring the first part of an inclusive drive mapping preference item does not make it inclusive; it does the work of mapping the drive. We must take advantage of item-level targeting to ensure the drive mapping items works only for users who are members of the group. We can configure item level targeting by clicking the Targeting button, which is located on the Common tab of the drive mapping item. The targeting editor provides over 20 different types of targeting items. We're specifically using the Security Group targeting item.

Figure 4 Security group targeting item

Using the Browse button allows us to pick a specific group in which to target the drive mapping preference item. Security Group targeting items accomplishes its targeting by comparing security identifiers of the specified group against the list of security identifiers with the security principal's (user or computer) token. Therefore, always use the Browse button when selecting a group; typing the group name does not resolve the name to a security identifier.

Figure 5 Configured inclusive security group targeting item

The preceding screen shows a properly configured, inclusive targeting item. A properly configured security group targeting item shows both Group and SID fields. The Group field is strictly for administrative use (we humans recognize names better than numbers). The SID field is used by the client side extension to determine group membership. We can determine this is an inclusive targeting item because of the text that represents the item within the list. The word is in the text "the user is a member of the security group CONTOSO\Management." Our new drive map item and the associated inclusive targeting item are now configured. We can now link the hosting Group Policy object to the domain with confidence that only members of the Management security group receive the drive mapping. We can see the result on a client. The following image shows manager Mike Nash's desktop from a Windows Vista computer. We can see that Mike receives two drive mappings: the public drive mapping (G: drive) and the management drive mapping (M: drive).

Figure 6 Client view of inclusive drive mapping

Exclusive drive mapping

The last scenario discussed is exclusive drive mapping. Exclusive drive mappings produce the opposite results of an inclusive drive mapping; that is, the drive map does NOT occur if the user is a member of the specified group. This becomes usefully when you need to make exceptions to prevent specific drives from mapping. Let's add an exclusive drive mapping to our public drive mapping to prevent specific members of management from receiving the public drive mapping.

Figure 7 Configured exclusive drive mapping

The preceding image shows the changes we made to the public drive mapping (from the first scenario). We've added a Security Group targeting item to the existing public drive mapping preference item. However, the targeting item applies only if the user IS NOT a member of the ExcludePublicDrives group. We change this option using the Items Options list. The client view of manager Monica Brink shows the results of applying Group Policy.

Figure 8 Client view of exclusive drive mapping

This client applies two Group Policy objects; each containing a drive mapping preference item. One item contains our public drive mapping with an exclusive security group targeting item. The other GPO contains the management drive mapping with an inclusive security group targeting item. The client processes the public drive mapping GPO; however, the exclusive targeting item verifies that Monica is a member of the ExcludePublicDrives group. Monica is also a member of the Management group. Therefore, Monica's group memberships prevent her from receiving the public drive mapping and include her in receiving the management drive mapping.

Summary

Drive mapping preference items do not require any scripting knowledge and are easy to use. Leveraging targeting items with drive mapping items increases the power in which to manage drive mapping to users and computers. Public drive mappings are typically linked at higher levels in the domain and generally apply to a large subset (if not all) users. Inclusive drive mappings associate as specific subset of data with a specific group of people, often times mapping to logical divisions within an organization such as accounting, marketing, or human resources. Exclusive drive mappings invert the principals of inclusive drive mappings. The user must not be a member of the specified group for the drive mapping to occur.

Best practices

Be sure to link GPOs high enough in Active Directory so the scope of the drive mapping effects the largest group of user accounts. Obviously, not every GPO should be linked at the domain; however, if there is an accounting organizational unit with three child OUs-- then linking at the Accounting OU effects that largest amount of users. Allow your inclusive and exclusive targeting item to do the bulk of your work. GPOs hosting inclusive drive mappings are best used when the number of user needing the drive mapping are fewer than the number who do not. Exclusive drive mappings are best used when the number of user not requiring the drive mapping are fewer than the number that do. These rules help prevent users from becoming members of too many groups and increasing the cost of managing drive mappings within the organization.

Delete an Organizational Unit with protect accidental deletion

2015-01-09T14:53:00.003+05:30

Membership in the Domain Admins group, or equivalent, is required to complete this procedure.

To remove protection that prevents an OU from accidental deletion

Log on to the computer as a member of the Domain Admins group.
Open Active Directory Users and Computers.
Click View, and then click Advanced Features.
First, clear permissions on the OU for which you want to remove protection. To do this, right-click the OU, and then click Properties.
In OU Properties, click the Security tab, and then click Advanced.
In Permission Entries, select the Deny entry for the Everyone group, and then click Remove.
Click OK to close the Advanced Security Settings, and then click OK to close OU Properties.
Second, clear permissions on the parent container of the OU for which you want to remove protection. To do this, right-click the parent container, and then click Properties.
In ContainerProperties, click the Security tab.
In Group or user names, select the Everyone group, and then clear the Deny check box for Delete All Child Objects, and then click OK to close Container Properties.

How to Make a Domain User a Local Administrator for all PCs

2015-01-09T14:06:00.003+05:30

Step 1 : Creating a Security Group

First you need to create a security group called Local Admin

Log onto a Domain Controller, open Active Directory Users and Computers (dsa.msc)
Create a security Group name it Local Admin. From Menu Select Action | New | Group

Name the group as Local Admin.

Add the Help Desk members to Local Admin group. I will add two users say Tom and Bob.

Step 2: Create Group Policy.

Next you need to create a group policy called “Local Admin GPO”

Open Group Policy Management Console ( gpmc.msc )
Right click on Group Policy Objects and select New.

Type the name of the policy "Local Admin GPO"

Step 3: Configure the policy to add the “Local Admin” group as Administrators

Here you will add the Local Admin group to the Local Admin GPO policy and put them in the groups you wish them to use.

Right click “Local Admin GPO” Policy then select Edit.

Expand Computer configuration\Policies\Windows Settings\Security Settings\Restricted Groups
In the Left pane on Restricted Groups, Right Click and select “Add Group“

In the Add Group dialog box, select browse and type Local Admin and then click“Check Names“

Click OK twice to close the dialog box.

Click Add under “This group is a member of:”
Add the “Administrators” Group.
Add “Remote Desktop Users”
Click OK twice

NOTE# When adding groups, you can add whatever you want, the GPO will match the group on the system, if you type “Admins” it will match a local group called Admins if it exists and put “Local Admin” in that group.

Step 4: Linking GPO

In Group policy management console, right click on the domain or the OU and select Link an Existing GPO

Select the Local Admin GPO

Step 5: Testing GPOs

Log on to a PC which is join to the domain and then run gpupdate /force and check the local administrators group. You should see Local Admin in that group now. Make sure all PCs you want to access should be move to an OU and properly link above GPO. Tom and Bob domain users can now access all PCs remotely as a local administrator.

Backup and restore on windows server 2008

2015-01-09T11:50:00.001+05:30

Windows server backup is a feature and is not installed by default. Before we can perform backup we have to install the feature.
Either go to
Start/administrative tools/server manager
Features/add features/windows server backup

C:\>servermanagercmd -install backup-features

System state backup and restore

We can only perform a system state backup using the WBADMIN.EXE command-line tool.

C:\>wbadmin start systemstatebackup -backuptarget:e:

Backing up a server from command line

C:\>wbadmin start backup -include:c:,d: -backuptarget:e:

To backup all critical system volumes

C:\>wbadmin start backup -allcritical -backuptarget:e:

After starting backup wbadmin show the progress of the backup. If we close the window the backup will continue in the background. Can reconnect wbadmin to a running backup

C:\>wbadmin get status

To terminate

C:\>wbadmin stop job

Scheduling backup from command line

C:\>wbadmin enable backup -addtarget:e: -include:c:,d: -schedule:06:00,12:00,18:00

This command would backup c: and d: drives to e: drive three times a day, at 06:00 AM,12:00 PM,06:00 PM

Disable all scheduled backups

C:\>wbadmin disable backup

To restore

C:\>wbadmin start systemstaterecovery -version:12/03/2015-18:36

Reset Directory Service Restore Mode (DSRM) Password

2015-01-08T14:45:00.001+05:30

Option 1: Reset DSRM Password with Ntdsutil

On your machine, select Run from the Start menu, type ntdsutil and click OK.
At the Ntdsutil command prompt, type set dsrm password.
At the DSRM command prompt, run the Reset Password command, passing the name of the server on which to change the password, or use the null argument to specify the local machine. For example, to reset the password on server thanos, enter the following command:
```
reset password on server thanos
```
To reset the password on the local machine, specify null as the server name:
```
reset password on server null
```
You'll be prompted twice to enter the new password.
Type q to exit the DSRM command prompt.
At the Ntdsutil command prompt, type q to exit.

You can now use the local administrator account to log on to the recovery console or Directory Services Restore Mode using the new password. However, you can only use the Ntdsutil utility to reset DSRM password while logging into domain controller. If you also forgot domain administrator password, then you need to use the method below to change your forgotten DSRM password.

Option 2: Reset DSRM Password with PCUnlocker Utility

You need an alternative computer with internet access to download the PCUnlocker utility.
Unzip the download file, you'll get the pcunlocker.iso file.
Burn the ISO image file to a CD or USB thumb drive using the ISO2Disc tool.
Insert your newly burned CD/USB drive into the domain controller and power it up. Set the computer to boot from CD/USB by going into BIOS.
Once you've gotten it to boot from the CD/USB, the computer will load the system inside the CD/USB drive and launch the PCUnlocker utility.
Click on the Reset Local Admin/User Password option, you'll see the Windows SAM database and local user accounts.
Choose the local administrator account and click on the Reset Password button.
It will remove your forgotten DSRM password immediately.

Additionally, you can also use PCUnlocker utility to reset forgotten domain administrator password for Windows 2000 / 2003 / 2008 / 2012 Active Directory domain controllers.

The Administrator password that you use when you start Recovery Console or when you press F8 to start Directory Service Restore Mode is stored in the registry-based Security Accounts Manager (SAM) on the local computer. The SAM is located in the %SystemRoot%\System32\Config folder. The SAM-based account and password are computer specific and they are not replicated to other domain controllers in the domain.

For ease of administration of domain controllers or for additional security measures, you can change the Administrator password for the local SAM. To change the local Administrator password that you use when you start Recovery Console or when you start Directory Service Restore Mode, use one of the following methods.

Method 1

If Windows 2000 Service Pack 2 or later is installed on your computer, you can use the Setpwd.exe utility to change the SAM-based Administrator password. To do this:

Log on to the computer as the administrator or a user who is a member of the Administrators group.
At a command prompt, change to the %SystemRoot%\System32 folder.
To change the local SAM-based Administrator password, type setpwd, and then press ENTER.

To change the SAM-based Administrator password on a remote domain controller, type the following command at a command prompt, and then press ENTER
setpwd /s:servername
where servername is the name of the remote domain controller.
When you are prompted to type the password for the Directory Service Restore Mode Administrator account, type the new password that you want to use.

NOTE: If you make a mistake, repeat these steps to run setpwd again.

For additional information about the Setpwd.exe utility, click the article number below to view the article in the Microsoft Knowledge Base:

271641 The Configure Your Server Wizard Sets Blank Recovery Password

Method 2

Log on to the computer as the administrator or a user who is a member of the Administrators group.
Shut down the domain controller on which you want to change the password.
Restart the computer. When the selection menu screen is displayed during restar, press F8 to view advanced startup options.
Click the Directory Service Restore Mode option.
After you log on, use one of the following methods to change the local Administrator password:
- At a command prompt, type the following command:
  net user administrator *
- Use the Local User and Groups snap-in (Lusrmgr.msc) to change the Administrator password.
Shut down and restart the computer.

You can now use the Administrator account to log on to Recovery Console or Directory Services Restore Mode using the new password.

For additional information about how to secure the local SAM, click the article number below to view the article in the Microsoft Knowledge Base:

223301 Protection of the Administrator Account in the Offline SAM

NTDSUTIL Password Pull

Beginning with hotfix KB961320 on Windows Server 2008, you now have the option to synchronize the DSRM password on a DC with a specific domain account. You must do every time the password is changed; it does not create an automatic sync partnership.

1. Create a standard domain user account and set it with a complex password. It does not need to be a member of any special groups or the Domain Admins group.

2. Install the hotfix on your DC and restart.

3. Logon to the DC normally.

4. In an elevated CMD prompt where you have logged on as a Domain Admin, run:

NTDSUTIL SET DSRM PASSWORD SYNC FROM DOMAIN ACCOUNT Q Q

So for example (using NTDSUTIL’s ability to pass in all parameters on a single command-line):

Note how there is no need to provide the actual password being used, or provide the old password. This feature will also be included in Service Pack 2 for Win2008.

Group Policy Preference Automation of NTDSUTIL

So what if we want to automate this NTDSUTIL command so that is run via a scheduled task? This is easily done using Group Policy Preferences.

Note: Before you get too excited that I’ve missed something – no, GPP Local User password does not work with the DSRM passwords on domain controllers. You cannot use it to push a new password to the local administrator on DC’s; it only works only on member computers. Trust me, I’ve tried.

The beauty of this solution is that there is no password stored anywhere except in Active Directory itself and the system effectively self maintains – the only administrator intervention needed is to periodically change the special user’s password, and to make sure the scheduled task is working on the DC’s. The same way you should be checking to make sure those backups will actually function for a restore if you ever need to use this password.

So let’s set this up:

1. Start GPMC on a Windows Server 2008 or Windows Vista computer running RSAT.

2. Create and link a new policy on the Domain Controllers OU (you are doing all this in a test domain first, right?).

3. Create the GPP Scheduled task settings.

Note here that I have set:

A) Action of ‘Update’ (this will create the task if it does not exist).

B) Run command of the built-in GPP variable for %SystemDir% to specify the System32 directory, along with the ntdsutil.exe to be called.

C) The command line exactly as it would be done by hand with ntdsutil, including the quotation marks:

“SET DSRM PASSWORD” “SYNC FROM DOMAIN ACCOUNT DsrmUser” Q Q

D) The task is Enabled with a checkbox so that it will run, not just be created.

E) Then I have set this to run as a daily task at 9AM (it’s fairly likely that the DC will be running at that point). I could also run this hourly, weekly, etc – whatever I want.

4. After having created the policy and letting it apply to DC’s, I now see it is working by examining the scheduled tasks on one of my domain controllers. There it is (as well as another one I added to run every night too – can’t be too careful):

5. Once the right time has come and gone, I boot a DC into DS Repair mode and check – sure enough, my new password has taken affect automagically.