Decommissioning Old 2003 Domain Controllers

Recently I had to help move some services off of a few old 2003 domain controllers. I compiled the following list to help me remember all of the things I needed to check

Moving NTP

·      Old DC

o   w32tm /config /syncfromflags:domhier /reliable:no /update

o   net stop w32time && net start w32time

·      New DC

o   w32tm /config /manualpeerlist:time.windows.com /syncfromflags:manual /reliable:yes /update

o   net stop w32time && net start w32time

Moving DHCP

·      http://support.microsoft.com/kb/962355

o   Export from 2003

§  Netsh

§  DHCP

§  server <\\Name or IP Address>

§  export c:\w2k3DHCPdb all

o   Import to 2008

§  Copy the exported DHCP database file to the local hard disk of the Windows Server 2008-based computer. 

§  Install the DHCP Role on the server. 

§  net stop DHCPserver 

§  Delete the DHCP.mdb file under c:\windows\system32\DHCP folder. 

§  Start the DHCP server service. 

§  Netsh

§  DHCP

§  server <\\Name or IP Address>

§  import c:\w2k3DHCPdb

§  Restart DHCP and verify the database has moved over properly. 

View the current operations master role holders 

Transfer the schema master 

Transfer the domain naming master 

Transfer the domain-level operations master roles 

Determine whether a domain controller is a global catalog server 

·      Open Active Directory Sites and Services.

o   expand the Sites container

o   expand the site of the domain controller you want to check

o   expand the Servers container

o    expand the Server object.

§  Right-click the NTDS Settings object, and then click Properties

§  On the General tab, if the Global Catalog box is selected, the domain controller is designated as a global catalog server.

Verify DNS registration and functionality 

·      netdiag /test:dns /v   (2003)

·      move DNS – point all servers to one primary DNS

Verify communication with other domain controllers 

·      netdiag /test:dsgetdc /v   (2003)

·      nltest /dclist:

Verify the availability of the operations masters 

·      dcdiag /s: domaincontroller /test:knowsofroleholders /verbose

·      dcdiag /s: domaincontroller /test:fsmocheck

If the domain controller hosts encrypted documents,

·      perform the following procedure before you remove Active Directory to ensure that the encrypted files can be recovered after Active Directory is removed: Export a certificate with the private key http://go.microsoft.com/fwlink/?LinkId=20039

Uninstall Active Directory 

·      dcpromo

If the domain controller hosts encrypted documents

·       and you backed up the certificate and private key before you remove Active  Directory, perform the following procedure to re-import the certificate to the server: Import a certificate http://go.microsoft.com/fwlink/?LinkId=20040

Determine whether a Server object has child objects 

·      Open Active Directory Sites and Services.

·      Expand the Sites container and expand the site of the Server object.

·      Expand the Servers container, and then expand the Server object to view any Child objects

Delete a Server object from a site 

·      Open Active Directory Sites and Services.

·      Expand the Sites container, and then expand the site from which you want to delete a Server object.

·      If no Child objects appear below the Server object, right-click the Server object, and then clickDelete.

McAfee Windows Kill Fix

**updated again**

Been hit by the McAfee issue?

Yes? No guarantees but the following methods have worked for us:

First try the local cached file option:

* Click start / run / type in cmd
* Click OK

On the command line:
a. copy c:\windows\ServicePackFiles\i386\svchost.exe c:\windows\system32
b. hit /enter/
c. net start “windows installer”
d. hit /enter/

OR
Find someone with the same working version and service pack of Windows - copy the svchost.exe file from their Windows\System32 folder to a usb stick

Then to copy it to the affected system you may have to use the command prompt

Where 'u:' equals the usb drive letter

* Click start / run / type in cmd
* Click OK

On the command line:
a. copy u:\svchost.exe c:\windows\system32\
b. hit /enter/
c. net start “windows installer”
d. hit /enter/

---off the command line----

Go to control panel and add remove programs
Uninstall Mcafee
Reboot if prompted

---

Windows won't boot?

Go here for helpful directions and options

Not affected? Just say no to McAfee anyway - uninstall it and switch to Microsoft Security Essentials

*Written on a Mac*
*I don't own any shares in or work for any of the companies mentioned*

Removing Viruses from a PC That Won't Boot

Removing Viruses from a PC That Won't Boot

Good info on virus rescue CD's

Enable writing with Apple's built-in NTFS driver

I am linking to this so I don't forget


"Compatibility with Microsoft's NTFS filesystem is sometimes necessary for people who use either separate PCs or Boot Camp. While Apple offers a driver to read NTFS volumes, by default it will not write to them. To overcome this, there are several third-party NTFS drivers available, but in Snow Leopard you can also set Apple's built-in driver to write to NTFS as well."

XP slow? Another list of things to try

When your XP or 2000 computer gets slow a rebuild may not be needed.

First as I have mentioned before it is a good idea to eliminate hardware as the reason for the computer slowness.

Is the hard drive full? A full or nearly full drive will affect performance. If you have less than about 20% free space on the hard drive you may need a new drive or to delete files to free up space.

Does the machine feel hot to the touch? Is it faster for a short period of time after it has been shut down for a time? Can you hear or feel the fans putting out air? If you open task manager and the CPU usage is low, but the machine is hot and running slowly, either the fan is not working or perhaps there is something clogging the vent. If this is the case, unless the machine is taken apart and cleaned you won't be able to fix the problem.

Running the quick diagnostics and looking for errors is a good idea. On newer Dell systems, with the computer powered off hold the key while pressing the power button, let go of both buttons when the computer powers up. On older Dell systems, when you see that Dell BIOS splash screen hit Ctrl-Alt-D. Let it run the diagnostics, all we are looking for errors to see if any of them are related to the performance issue.

If none of the above applies, start looking at software problems.

Uninstall any unused programs, the less you have, the less problems you will have. Make sure you are only running one anti-virus/anti-spyware program, while you are at it switch to Microsoft Security Essentials.

Make sure all of your Microsoft Updates are applied, just in case there is an unresolved bug causing the problem. You could also look for driver updates for the hardware when you are running the Microsoft Updates.

Clean up the 'crud' that accumulates in your system. Use CCleaner to to clean out temporary internet files, disable startup items, and to clean up the registry. When you install it, make sure to pay attention and don't install the tool bar.

Defragment the hard drive. You can start with the built-in defragmenter, and if that doesn't help you can try Defraggler.

This should give you enough to try for now, of course you could buy a SSD drive...

Can ping but can't browse - a reminder to think the problem through before acting

The computer in question was Windows XP SP3 with IE8 and McAfee. Since the user in question (like most people) hasn't used a wired connection for so long the problem initially presented itself as a wireless issue. This remote user described the problem to me as he could not connect to wireless - 1st error - unless you can see they are describing the problem correctly never assume the user knows what they are talking about. It ended up being some sort of driver/software conflict

There are so many different variables that I can't assume (and neither should you) that blindly following a list will get you a result. You need to understand what it usually means if you cannot ping by name but you can ping by IP. With that caveat here are some suggestions to try, let me know if I left something out or if I should order them differently.

• Verify they are connected to the correct wireless network - if this fails...
•  verify type of network, SSID, encryption and key, etc
• You can often connect to a network but get nowhere if you have the right key but the wrong type of encryption
• Verify the device is enabled and has no errors in the device manager
• Verify (if possible) that others can connect to wireless and the internet
•  if this fails... you need to deal with the router
• if this succeeds try a wired connection to the router

• Verify IP address, DNS, default gateway (cmd - then ipconfig/all) - if this fails...
• ipconfig /release and then ipconfig / renew
• verify properties of the connection
• Is it set to use DHCP or manual - whichever is correct in your situation
• usually the former
• correct driver?
• Power settings on adapter?
• Scroll down to Brian's answer on this website
• TCP/IP installed and checked?
• Verify they can ping  - systematically (either outside in or inside out)
• Outside in would be something like
• ping remote address by name - if this fails...
• ping remote address by IP - if this fails...
• ping default gateway by IP - if this fails...
• ping local address by IP - if this fails...
• ping localhost by IP (127.0.0.1) if this fails..
• Are you sure the card is enable and the drivers are correctly installed?
• Did you check the properties of the adapter to verify that TCP/IP is installed and enabled
• You can try running netsh int ip reset to repair the IP stack  

• Verify that you can connect wired or wireless by booting into safe mode with networking
• If so, you probably have a conflict with hardware or software
• Can you can for spyware?
• Check your list of software for security and or antivirus programs that may be causing conflicts
• Try a system restore (if enabled) 
• if this fails you may have to rebuild the system
• If not, and with the assumption that you double check all of the above, the system is probably beyond repair

 Let me know what you think, and if you have anything to add...

Close Unexpected Pop-ups with ALT-F4

Many malicious programs are using various techniques to try infect your computer. While we are actively pursuing new ways to defend your computer, an inadvertent mouse click may be all that stands between you and a major problem.

Consider the graphic. If you were to click the red ‘X’ to close the window, you would have ended up installing the virus instead of closing it, clicking anywhere on that window will actually cause the payload to hit – the whole thing including the title bar is a linked graphic. The mouse cursor may even change to the active link pointer, which would be a clue that there is something sneaky going on.

How can you safely close these unexpected windows without messing up your computer? By simply holding the ALT key and then pressing the F4 function key, you would safely close the window.


The key point is to train yourself to use ALT+F4 to close open windows.

Troubleshooting Outlook Performance Issues

If you ever deal with complaints about Outlook speed, the first thing you need to do (apart from verifying all the latest patches are applied) is to make sure the user is following best practices when it comes to mailbox size (i.e. less than 2GB) . Of course as soon as you enforce or even suggest this you will receive complaints, once the user is shown the performance difference they may come around. This kb from Microsoft offers some additional suggestions. Hopefully this limitation will be fixed in Outlook 2010.

BSOD with Hyper-V & HP DL360 G5

It appears to be a bug.
The workaround is to disable the processor C3 state (deep sleep) in the BIOS.

On DL360 G5's (P58 BIOS) that is in the BIOS under
Advanced Options -> Processor Options -> Intel Core C3 State,
change it to 'Disabled'.

After doing that, Hyper-V installs and no BSOD.

Get your Blue Screen of Death T-shirt, Large here...

Why installing a bunch of stuff on a Windows computer is a bad idea

So I get an email from someone with XP and Office 2007 that both Excel and Outlook are unable to work properly (links are messed up, unable to move email around, etc) with the error "this operation has been canceled due to restrictions in effect on this computer".

After verifying that they indeed had local admin privileges, I went to my best friend 'Google'... Google didn't help me much, so I asked the person if they had installed anything - and of course they had. When in doubt, blame the last thing you messed with.

What had they installed? Google Chrome - and not only had they installed it, they reinstalled it. When will people learn? Anyway with this new information, they changed the default browser and it works - for now anyway. Of course after that happened I found an article talking about how a corrupt registry entry at HKEY_Local_Machine\Software\Classes \htmlfile\shell\open\command can cause this problem and that Chrome can break Outlook.

Moral of the story? Quit installing junk on your computer!

Regular Windows Computer maintenance

The second Tuesday of each month is Microsoft Patch Tuesday - this is a good time to plan for other maintenance since you probably will already need to reboot. The updates usually don't show up until the afternoon, so you may want this maintenance to occur on the Wednesday after the second Tuesday of every month - as odd as that sounds.

Preliminaries - Has the machine had any issues with extreme slowness or other erratic behavior? Other than running a backup, I wouldn't do the other maintenance issues below until I was sure that I knew the backup was good, and had an idea of what was going on.

Backup - this of course assumes that you have a backup plan and sufficient disk space. I would run the backup manually just to make sure it is working even if it is scheduled to happen automagically.

Disk cleanup / registry scan/cleanup - I run a free tool called ccleaner. When you install it pick the minimal options to prevent it from putting a bunch of other stuff on your computer. Keep an eye on free disk space, it is easy for that to creep up on you, this tool, carefully used can manage some of that.

Microsoft Update - not just Windows update - make sure the updates are installing, even if they are scheduled to happen automatically.

Antivirus update - I've used a number of difference AV products throughout the years, and all have their pluses and minuses. The key is to pick *one* to use per machine and to only have one installed. Uninstall other products and convert to "Microsoft security essentials" for most situations a free tool is good enough.

Other software updates - it is easy to forget about other updates, but now that Microsoft patches regularly this is where the malware can sneak in and mess up your computer. Review the applications in your add/remove programs control panel (if you don't need some and you know what you are doing - remove what you aren't using) and check to see if any updates are available.

Antivirus / Malware scan - presumably your built-in tool is updating and doing this automatically. If you aren't noticing any issues, doing a manual scan after updating is probably sufficient.
I've probably forgotten a few things but this is a good start.

Let me know if you have any questions.

Or you can just buy a Mac...

Have you backed up your computer today?

I know, I know - this is as much fun as being told you need to exercise, floss or eat right. That doesn't make any of them less important. Well have you backed up? If not why not? Ideally you should have several different kinds of backups - a regular local backup to a disk or NAS, and a "offsite" backup.

Funds tight? Looking for a freebie? You could just back up your most vital files with a free backup service. Usually you are limited in how much you can backup, but hey it is free. Mozy, iDrive, aDrive, boxstr, skydrive and others provide free online backup. I'm not necessarily endorsing any of them, and you have to watch out for scams, but this is a reasonable and free way to backup your Windows (and Mac) computer.

Speed up your computer - getting to the source of the problem

This is a windows based tip.
One of the frustrating things about computer speed issues is trying to figure why the computer is so slow. A lot of time can be spent playing with all sorts of things and not really getting to the heart of the speed issue. Is it hardware, software or all the stuff that I've installed?
So what is my tip? Time your computer startup (to get objective data) and then set your computer to boot into safe mode (using f8 at startup, or by selecting the option in msconfig) and time it again. If it is not significantly faster then it is likely a hardware problem. If it is significantly faster then it a software problem. How you deal with these sorts of problems differ so for now I will leave it at that.

Posted via email from bpwojcik's posterous

Mac vs PC, and Why Mac Wins

That is how Apple stays so successful and grabs market share – it has unique products like no one else, along with services to offer that no other computer manufacturer can match. This is why I paid twice as much for the MacBook, as opposed to another PC that would bring with it the same troublesome hurdles for a demanding user like me.
Do you think Apple won over this customer with its commitment to first-class customer service? The MacBook Pro is humming along nicely, and I am getting my work done, so yes, Apple will benefit from my continued commitment, my referrals, and from the wide audience that will read this article.

via lewrockwell.com

As long as Apple continues to understand this - they will continue to grow...

Posted via web from bpwojcik's posterous

Patch Tuesday Fun - Blue Screen your Vista, 2008 and maybe even Windows 7 boxes

Hole in Windows Vista and 7 allows remote reboot

A vulnerability in Microsoft's implementation of the SMB2 protocol can be exploited via the net to crash or reboot Windows Vista and Windows 7 systems. The root of the problem is an error in how the srv2.sys driver handles client requests when the header of the "Process Id High" field contains an ampersand. The attack does not require authentication; port 445 of the target system merely has to be accessible, which in the default Windows local network configuration, it usually is. SMB2 is an extension of the conventional server message block protocol.
An exploit written in Python is already available. A test at heise Security, The H's German associates, confirmed that the exploit enabled a remote reboot of a Vista system. However, in the test, the exploit had no apparent effect on a computer running Windows 7. According to the report written by Laurent Gaffie, who discovered the vulnerability, Windows Server 2008 might also be affected, since all of the systems named used the same SMB2.0 driver. Windows 2000 and XP were not affected, however, since they do not support SMB2.
Microsoft has yet to release an official update for the issue. Presently, the only remedy is to close the SMB ports by un-ticking the boxes for file and printer access in the firewall settings.

via h-online.com

It was so easy even I was able to do it...

Posted via web from bpwojcik's posterous

"0x80040E14" or "HTTP 500" error message when you connect to your Windows SharePoint Services Web site after you install a Windows SharePoint Services service pack or a security update

You connect to a Microsoft Windows SharePoint Services Web site after you install a Microsoft Windows SharePoint Services service pack or a security update on the server. When you do this, you may receive an error message that resembles one of the following error messages

via support.microsoft.com

Re-running the install wizard fixed this during an install on a W2k8S

Posted via web from bpwojcik's posterous

Windows, Clamwin and trojans - oh my!

ClamWin serious F/P again

ClamWin has developed 2 new F/P's in the latest sig update, one not so serious, and one very serious. If you've still not got ClamWin set to report only, I strongly urge you to do so;

C:\Program Files\NetMeeting\cb32.exe: Trojan.Waledac-389 FOUND
C:\WINDOWS\system32\dllcache\cb32.exe: Trojan.Waledac-389 FOUND
C:\WINDOWS\system32\dllcache\userinit.exe: Trojan.Agent-119464 FOUND
C:\WINDOWS\system32\userinit.exe: Trojan.Agent-119464 FOUN

As before, if you do have ClamWin quarantine these instead of reporting, you can restore them from the quarantine folder (just rename the file to remove ".infected" and put them back where they're supposed to be). If you have ClamWin automatically delete them (NO! NO! NO!), you'll need to restore them from the Service Pack files (you did download the ISO's for the SP's, right?).

These F/P's are occuring in this case, on Windows XP (all versions) and Windows Server 2003 (all versions), ClamWin hasn't shown the same F/P's on my Vista machine yet.

via hphosts.blogspot.com

I am running into the same sort of issue, on one machine (so far) malwarebytes shows an actual infection - not much to add

Posted via web from bpwojcik's posterous

BlackBerry update bursting with spyware

An update pushed out to BlackBerry users on the Etisalat network in the United Arab Emirates appears to contain remotely-triggered spyware that allows the interception of messages and emails, as well as crippling battery life.

Sent out as a WAP Push message, the update installs a Java file that one curious customer decided to take a closer look at, only to discover an application intended to intercept both email and text messages, sending a copy to an Etisalat server without the user being aware of anything beyond a slightly excessive battery drain.

via theregister.co.uk

The only thing saving us from these sorts of mindless click to install exploits is that many users are too dumb to figure out how to do an install in the first place...

Posted via web from bpwojcik's posterous

"Updates were not configured correctly - reverting changes." - Have I said I how much I hate Windows lately?

I cannot tell you what the cause of the problem is but I can tell you how I overcome the problem! Like all of you I suffered with  "Updates were not configured correctly.Reverting changes." Then I thought that if I download the "updates" in small batches, i.e. 2 to 4 at a time, then if there is 1 update that is causing the problem then I have narrowed it down! In fact by doing this "ALL" updates downloaded and installed without any problems! Has I said earlier: if there were any problems then at least by process of elimination you could identify the Rogue download and probably recieve an error code which you could have worked from! I sincerly hope this helps!

via social.technet.microsoft.com

Trying to set up a few new Windows 2008 server VMs - all built at the same time and one decides to go into this black hole 'randomly'. Thankfully someone else already met this brick wall and found a way to pound it out - o n e b r i c k a t a t i m e.

Posted via web from bpwojcik's posterous

Patch Tuesday fun...

Microsoft Security Bulletin Summary for July 2009

via microsoft.com

In addition to these there is also an unpatched exploit that should only affect Office 2003 unless a machine has Office Web components installed (see http://www.microsoft.com/downloads/details.aspx?FamilyId=7287252C-402E-4F72-97A5-E0FD290D4B76&displaylang=en )

Check to see if Office 2003 or the above web components are installed on any of your machines, and use the temp fix at http://support.microsoft.com/kb/972890 to disable the vulnerability.

Posted via web from bpwojcik's posterous