Brian Desmond's Blog

Getting Rid of Apple Software Update

Brian Desmond — Sat, 10 May 2008 03:17:59 GMT

I had to load Quicktime on my PC for one reason or another in the past few months. It's not generally a package I load, but, apparently I needed it for some reason. I of course did the extra legwork to find the Quicktime installer that didn't include iTunes, as I also don't have any use for iTunes. In the past few weeks this really annoying dialog started popping up periodically hawking not only some new QuickTime build, but also iTunes.

I have been clicking Quit for weeks now and it's been getting old. I hadn't really invested the time to figure out where this annoying application was launching itself from, but, tonight I stumbled upon the answer by accident. Check your scheduled tasks - apparently Apple took the liberty of installing a job that runs this update application of theirs. I deleted the job - hopefully it doesn't come back and hopefully I don't see this dialog anymore:

Share this post: email it! | digg it! | bookmark it! | live it!

Windows 2003 Forest Functional Level

Brian Desmond — Fri, 11 Apr 2008 05:34:00 GMT

Thought I'd post an informational post for folks who are moving an AD forest to Windows 2003 forest functional level (aka FFL2) as I realized today this piece of information might not be quite as well known as I might have thought. As an FYI, this change adds a number of attributes to the partial attribute set (aka the PAS or global catalog):

Ms-DS-Trust-Forest-Trust-Info
Trust-Direction
Trust-Attributes
Trust-Type
Trust-Partner
Security Identifier
Ms-DS-Entry-Time-To-Die
MSMQ-Secured-Source
MSMQ-Multicast-Address
Print-Memory
Print-Rate
Print-Rate-Unit
MS-DRM-Identity-Certificate

This is done when you upgrade the forest functional level because at this point there are no Windows 2000 domain controllers in the forest and thus a change to the PAS will not force a GC resync. Recall that in Windows 2000, modifying the PAS caused every global catalog in the forest to replicate the global catalog from scratch. In a large environment this could be a major undertaking. Windows 2003 removes this and only replicates the changes. By waiting until Windows 2003 FFL, you mitigate this issue of adding these attributes to the PAS.

This should be a nonevent really but if you've got any issues in the forest that might come out of the woodwork with a PAS modification then this could cause you some grief. Having made this change numerous times, I've only had an issue once and it was a replication block that worked itself out on its' own.

Share this post: email it! | digg it! | bookmark it! | live it!

Upgrading my MCSE

Brian Desmond — Wed, 02 Apr 2008 05:38:00 GMT

So I have an MCSE: Messaging 2003. Took something like 7 or 8 tests to get that way back when and it's still good. Being the good consultant that I am I decided I'd figure out what I need to do to get whatever the new equivelants are on Windows 2008 and Exchange 2007:

The new Windows 2008 exam seems to be an "MCITP: Enterprise Administrator":

Windows 2003 MCSE upgrade Test
Windows Vista Test
Windows 2008 Enterprise Administrator Test

OK so, three tests total for an upgrade. That's a lot of test questions, but, seeing as my transcript says I took the Windows 2000 client test - they have a point. Unfortunately this means I'm going to have to make peace with Vista on some piece of hardware and actually use it. Not looking forward to that - 2003 runs so well on my machines.

The new Exchagne 2007 tests I can run as a seperate thread - seems that's now called an "MCITP: Enterprise Messaging Administrator":

Configuring Exchange 2007 Test
Designing Exchange 2007 Test
Deploying Exchange 2007 Test

Well, three more tests to upgrade. 3 + 3 = 6 tests total to upgrade. I only took 7 or 8 originally so might as well not even call this an upgrade - perhaps renumbering would be a better term.

So, I need to take six tests to change the alphabet soup in my signature line at work. Speaking of alphabet soup - what is up with these new certification names? I can fit "MCSE: Messaging" in my signature without any sort of space constraint. If I plug in there that I'm an "MCITP: Enterprise Administrator and MCITP: Enterprise Messaging Administrator" I'm going to practically have a buffer overrun at only 80 characters across the screen, not to mention I'd look like one of those folks that spells out their 12 useless certifications in their signature line and pastes the jpegs in that they send you when you pass.

Time to start the test taking and theorizing on how to summarize that whole jumble.

Share this post: email it! | digg it! | bookmark it! | live it!

Forcing a Blue Screen via iLO

Brian Desmond — Thu, 27 Mar 2008 05:03:00 GMT

Sometimes one of the most useful resources at your disposal when troubleshooting a hang or other issues is the memory dump file Windows will write out during a blue screen. If a system is hung and you are not able to get to it locally, pressing Ctrl+ScrollLock, ScrollLock isn't going to be a feasible solution. If the server is an HP server with an iLO card (Integrated Lights Out), and you've set a registry key in Windows ahead of time, you can force the system to bluescreen, write the memory dump, and restart.

The key to doing this is generating what's called a nonmaskable interrupt or NMI. The long and short of it is that NMIs are hardware interrupts which have to be serviced immediately. Windows has a concept of IRQ levels, or IRQLs. The highest IRQL is always serviced, preempting any lower level interrupts which are currently being serviced. The preemptive behavior here is called masking the interrupt. So, an NMI is an interrupt which must be serviced immediately. Generally you get an NMI when there's a major hardware fault that prevents the operating system from continuing. This is exactly what happens if we trigger one manually in the iLO.

The first step to getting this functionality working is setting a registry key outlined in KB 927069. Don't mind the part about this only applying to HP Blades or that it only applies to Windows 2000. This works on 2000 and 2003 and it works with hardware other than HP blades. Here's the registry key info:

Path: HKLM\System\CurrentControlSet\Control\CrashControl

Value: NMICrashDump

Data: 1

Type: REG_DWORD

You'll need to reboot for the change to take effect.

If you have the Automated System Recovery (ASR) functionality enabled on the server and you need to get a full memory dump, you will need to turn it off as it can interfere with this process. This is a BIOS setting which I don't have the steps to change easily available. If there's demand (leave a comment), I can track them down.

To crash the box, these are the steps. I shot these screens on a DL360 G4 which is fairly recent hardware. I suspect the screens and locations of options may vary a bit by age (and especially on older legacy Compaq stuff), but the basic process is the same.

1. Login to the ILO and then proceed to the "Server and iLO Diagnostics" link on the left hand navigation:

2. Select the Virtual NMI Button option on the toolbar:

Warning! I can't guarantee that this button generates a warning when you click it on all versions of the iLO firmware. Generating an NMI will HALT your system. Don't click this button just to see what happens!

3. Generate the NMI. This button is towards the bottom of the page so if your browser doesn't automatically scroll down to it, you'll have to drill down:

4. You will get a warning dialog to make sure you're really certain this is what you want to happen. Remember, doing this will HALT your system!

5. The iLO will write a status message to the status bar in IE:

6. At this point Windows will crash with a 0x80 bugcheck and reboot (assuming your machine is configured to automatically reboot after a bluescreen). You can hopefully use the memory dump to assist in troubleshooting the problem at hand.

Note that this capability is present in the Dell DRAC cards (at least certain versions). I'm trying to find out what happened to the option in the latest versions of the cards as it seems to have gone AWOL. I'll post the directions whenever I find out.

Share this post: email it! | digg it! | bookmark it! | live it!

Loading VMWare 6 Tools on 2008 Server Core

Brian Desmond — Sun, 23 Mar 2008 04:37:00 GMT

Normally in VMWare when you go "VM>Install VMWare Tools..." with a Windows guest, autorun kicks right in and the installer launches. On server core this isn't the case. You need to launch the MSI by hand.

To do this, swich to your CD drive (e.g. "D:"), and then launch the MSI manually:

msiexec /i "VMware Tools.msi"

The MSI will launch, but at least for me it appeared hung shortly into the install. There are a couple DLLs it tries to load which aren't in the server core image. The errors about this are hidden behind the installer so if you drag it off the screen some you should be able to OK the message boxes and continue. You'll also get prompted for installing the HTML help engine. I declined this.

These issues aside the VMWare Tools install seems to have suceeded on a 2008 Enterprise Server Core x86 install. I'm running VMWare Workstation 6.0.3 so perhaps the MSI issues will get fixed in a subsequent update to VMWare Workstation.

Share this post: email it! | digg it! | bookmark it! | live it!

How to Sysprep in Windows 2008

Brian Desmond — Sun, 23 Mar 2008 03:43:00 GMT

I thought I'd document how to setup the new sysprep process equivalent on Windows 2008 since the old setupmgr file for making sysprep.inf's doesn't exist anymore (and neither does sysprep.inf).

The first step is acquiring the Windows Automated Installation Kit (WAIK) from somewhere. You can get it from Microsoft's website, MSDN subscriber downloads, and probably the volume licensing downloads site too I'd guess (though I haven't checked). The ISO is available at http://www.microsoft.com/downloads/details.aspx?FamilyID=94bb6e34-d890-4932-81a5-5b50c657de08&DisplayLang=en, and is about an 800MB install on my 2003 SP2 x86 box.

You'll also need to copy the install.wim from your 2008 DVD sources folder to the hard drive as the tool won't work with it if it doesn't have write access.

The tool of choice is the Windows System Image Manager (WSIM). When you start it you'll get a blank screen like this:

The first step is to catalog the image file. You can do this from Tools>Create Catalog, selecting your install.wim and then what image(s) to catalog. I'm setting up 2008 enterprise so I selected the appropriate option. The final three choices are the server core variants:

All of the settings you will want to setup in your unattend.xml file are in the tree under Windows Image. The documentation for all the settings can be found at http://technet2.microsoft.com/WindowsVista/en/library/69eee519-55a6-440d-ab94-56330ef57e291033.mspx. This link http://technet2.microsoft.com/WindowsVista/en/library/71b576bd-cca6-466f-a1db-16500be3098f1033.mspx shows a mapping table between the sysprep.inf file and the new unattend.xml format.

All of the various settings can be applied during different passes of the setup process which sysprep will trigger. You can read about these passes here: http://technet2.microsoft.com/WindowsVista/en/library/7cc1b17c-8cc6-4cb4-a652-fe7c5e40a29c1033.mspx. I built a simple unattend file just for sysprep'ing my base image which includes settings in the generalize, specialize, and oobeSystem passes. All of the settings I chose are outlined below.

My answer file tree:

Disabling the initial configuration dialog:

Disabling auto-starting the server manager application:

Setting my product key, timezone settings, and my name:

Configuring the screen resolution and color depth - 1280x960 is what works in VMWare full screen mode with the tabs across the top:

Configuring setup not to show me the EULA again:

Configuring setup to install a default local administrator account password:

One of the things I discovered doing this is that unlike sysprep from Windows 2000 - 2003, the unattend.xml file isn't deleted at the conclusion of the sysprep process. Recall that downlevel sysprep deletes the c:\sysprep folder when it finishes. In order to replicate this functionality, you can put a command in to delete the unattend.xml file in the SetupComplete.cmd batch file (which must be located in c:\windows\setup\scripts\) which gets called at the end of sysprep. See this link for more info - http://technet2.microsoft.com/WindowsVista/en/library/9cc0e504-9924-4543-89ae-7430906d85e71033.mspx?mfr=true.

I put a simple one line command in my SetupComplete.cmd file:

del /Q /F c:\windows\system32\sysprep\unattend.xml

In order to run sysprep you'll need a new command. The old sysprep UI that was there in Windows 2000 - 2003 doesn't really exist anymore. All of the sysprep command line switches are documented at http://technet2.microsoft.com/WindowsVista/en/library/72cc64e2-a0f3-4516-84fc-097577127fc91033.mspx.

sysprep /generalize /oobe /shutdown /unattend:sysprep.xml

So far this process is working fine for me with Windows 2008 Enterprise x86 full installs. I haven't tried it with server core yet, but if it's different I'll post something about that. I'm inclined to believe given how new and different this process is to me compared to the previous process that there may be some updates to this post over the next several months as I learn the in's and out's of the sysprep process in Windows 2008.

Share this post: email it! | digg it! | bookmark it! | live it!

Windows 2008 - Windows System Image Manager Error

Brian Desmond — Sat, 22 Mar 2008 23:04:00 GMT

I'm working on adding Windows 2008 to my lab and the first step of this for me anyway is making templates. The whole sysprep process in Vista and Windows 2008 has been completely re-engineered so I'm learning on the go here. Turns out you need to load the Windows Automated Installation Kit (WAIK) on a machine and then run the Windows System Image Manager to build the new XML based unattend files. Given this is an 800MB install (versus like 800K for the old setupmgr.exe) I decided to load it on my VMWare host machine which is Windows 2003 x64 R2. My first 2008 VM template is an x86 build.

I was getting the error dialog and stack trace below every time I tried to catalog the install.wim for my x86 Windows 2008 DVD:

System.Reflection.TargetParameterCountException: Parameter count mismatch.
at System.Windows.Forms.Control.MarshaledInvoke(Control caller, Delegate method, Object[] args, Boolean synchronous)
at System.Windows.Forms.Control.Invoke(Delegate method, Object[] args)
at Microsoft.ComponentStudio.Common.ErrorReporting.ShowErrorConfirmation(Form owner, String message, Exception ex, String caption, MessageBoxButtons buttons, MessageBoxDefaultButton defaultButton, String servicingPath)
at Microsoft.ComponentStudio.CatalogGenerator.CreateCat(ProgressDialog pd, Object o)
at Microsoft.ComponentStudio.Controls.ProgressDialog.ThreadProc()
at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
at System.Threading.ThreadHelper.ThreadStart()

I did some Googling and discovered that if you load the WAIK on an x64 machine, you can only catalog x64 Windows images. So, I loaded the WAIK on my x86 machine and it worked. I also learnt that this problem is documented in the readme which I of course elected not to read from the get-go. The readme file is available at http://www.microsoft.com/downloads/details.aspx?FamilyID=051091e8-51ea-4d2c-96b3-dc9863edebd9. Per the readme the follow permutations are supported:

x86 Image Manager
Can create catalogs for x86, x64, and Itanium-based Windows images.
x64 Image Manager
Can create catalogs only for x64 Windows images.
Itanium-based Image Manager
Can create catalogs only for Itanium-based Windows images.

I also encountered this exception on my x86 machine when I renamed the wim from something other than install.wim in an effort to mark what it was actually for. Renaming it back solved it.

Share this post: email it! | digg it! | bookmark it! | live it!

At DEC This Week

Brian Desmond — Sun, 02 Mar 2008 19:50:00 GMT

I'm heading downtown in a bit for DEC 2008 and will be around all week. Please do say stop by and say hello and join in the conversations if you're there! If you're looking for suggestions on local things I can try and help since I'm from Chicago too.

Share this post: email it! | digg it! | bookmark it! | live it!

Exchange 2007 SCC Install Error

Brian Desmond — Sat, 12 Jan 2008 21:47:00 GMT

Apparently when installing a new Exchange 2007 SCC cluster, you can't give the resource group containing the physical disks the same name as what the cluster virtual name will be.

For example if your mailbox virtual server will accessible via shortname "vmbx01", calling the cluster group "vmbx01" will result in setup failing with this error:

Cluster Common Failure Exception: Cluster Common Failure Exception: The group or resource is not in the correct state to perform the requested operation. (Exception from HRESULT: 0x8007139F)

Once I renamed my cluster group to "vmbx01-disk", setup proceeded business-as-usual. After setup completes you need to migrate all the disks to the new "vmbx01" cluster group that setup will create. This is documented in this article starting at step 19: http://technet.microsoft.com/en-us/library/bb123969.aspx.

Share this post: email it! | digg it! | bookmark it! | live it!

Cool Tool - Anagram

Brian Desmond — Fri, 21 Dec 2007 20:49:25 GMT

Anagram is this really slick tool that will convert generic selected text into Outlook contact records or appointments. I use the contacts feature every day multiple times a day. Here is the scenario - you know the insanely long signatures people put on the bottom of their email message. It's got their phone numbers, email, website, title, company, and inevitably half a dozen other pieces of information. The process of getting all this information into your Outlook address book is time consuming - make a new contact, get each bit of information into the right field, etc. Of course inevitably sometimes you do all this work and Outlook goes "Oh, you already have a contact for this person, do you want to merge?" Anagram converts all this info to a contact object automatically whether it's in an email, webpage, or elsewhere on your machine. You highlight a bunch of text and press F12 and a new prefilled contact form shows up on your desktop. If it's complete (which generally speaking it is) you just hit save and close. It takes all of about 5 seconds from hitting F12 to clicking Save & Close.

My experience with the software has been that it is extremely accurate - sometimes it will mistake the company name for a department or something like that but given the myriad of ways folks lay out their email signatures, it does a top notch job in general. I use this every day a few times a day to catalog folks into my contacts and it makes it SO much easier. You can select text anywhere on the computer, hit F12, and "poof".

As an example I took my usual email signature on my personal account and added a few typical fields to it - title, company, and work phone. I selected the text and hit F12 and you can see the resulting Outlook contact object that got created. Anagram places anything it couldn't parse in the "Notes" field which in this case was my salutation - "Thanks," since I included that in the selection. This is a cool (configurable) feature so you can easily see what it wasn't able to parse if anything.

Anagram also does appointments where if you select something with info about a date/time it will pre-fill a new appointment form for your Outlook calendar. I personally have only used this feature once or twice as I generally get actual meeting request messages. I'm not really comfortable saying much about this part since I never use it but I can only assume that it works just as well as the contact parsing functionality. Their website also talks about compatibility with Palm devices and some other services but I have no experience with this stuff.

I stumbled across Anagram by Textual one way or another probably at least six months ago. I bought it after a few days of using the trial and it's been some of the best thirty bucks I've spent on software in quite a while. I'd highly recommend taking a look at Anagram if the scenario in this post sounds anything like what you're doing all the time. I get one or two uses a day out of the product at least.

Share this post: email it! | digg it! | bookmark it! | live it!

Reviews - Cool Stuff

Brian Desmond — Fri, 21 Dec 2007 20:28:32 GMT

I've had on my list of things to blog about for a while a handful of products that I've come across one way or another that are just really cool. Some of them are things I've tried and subsequently bought and others are things that various companies have given me complimentary copies of with the hope that I will like their product and subsequently spread the good word. I will qualify this by saying that I have also gotten comp copies of things that I used and subsequently decided I'm not about to recommend anyone uses - not every product that hits the market is going to be an award winner. So in other words if I post something up here about something I got a comp copy of and I say I like it, I mean it. I am not about to give anyone who gives me a free copy of something a good review just because they gave me a copy. There won't be anything scientific about these little reviews but there will be a handful of them over the next month or so and periodically thereafter if I come across something new. I will also be sure to differentiate anything that I got a comp copy of versus something I bought under my own initiative. I'm going to put everything up in a new Reviews category as well.

Share this post: email it! | digg it! | bookmark it! | live it!

Visual Basic 9 (VB9) .Net Framework Version Targetting

Brian Desmond — Sun, 16 Dec 2007 02:43:00 GMT

Visual Studio 2008 supports targetting different versions of the .Net framework. In previous versions you had to use the version of Visual Studio which corresponded to the version of the .Net framework you are targetting (e.g. VS2002 = .net 1.0, VS2003 = .net 1.1, and VS2005 = .Net 2.0). VS2008 will let you target any of .net 2.0, .net 3.0, or .net 3.5.

With this in mind I decided to upgrade one of my big VB.Net projects from a VS2005 solution to VS2008 so I could start leveraging some of the new functionality. Unfortunately trying to figure out where the framework targetting selection for VB9 is was not particuarly obvious.

This functionality is right on the Application tab of the project settings in a C# project. Visual Basic on the other hand has done a pretty good job burying it. The setting is inside the properties of your project under Compile>Advanced Compile Options. It's the last dropdown - "Target framework (all configurations)".

Share this post: email it! | digg it! | bookmark it! | live it!

Active Directory Site Links – Naming & Costing

Brian Desmond — Fri, 30 Nov 2007 03:04:00 GMT

There are a few things that you really have to consider when you're setting up your site links – the naming convention, cost relative to the underlying WAN transport, frequency of replication, and schedule (that is when replication can even occur).

Naming your site links is something you've got to think about what they're all going to look like in order to do properly. If you deal strictly with point to point links your options should be quite limited in how to name them. I generally go Hub - Spoke for the name, where Hub is either the hub site or the site which is logically closest to the hub (e.g. if you have three sites linked linearly Chicago à San Francisco à Tokyo, I would call the link from San Francisco to Tokyo San Francisco – Tokyo). The second part of this convention is to reverse the name in the description, so if the name is Hub – Spoke, then make the description Spoke – Hub. The reasoning here is simple – assuming you're using a GUI tool to view all your site links in a list, you can sort by the name column to see everything by origin, and the description column by destination. If you've got site links with multiple sites in them, you'll have to think of something smart which makes it descriptive yet manageable – everyone's situation is different here.

Cost is perhaps the most scientific of the three things I mentioned, and it can also be totally irrelevant. The cost of the link is used when computing the spanning tree where you have multiple paths to a site. If you have a series of spokes off a hub that have a single link back to the hub, the cost is actually totally irrelevant in the end. On the other hand if you have multiple paths from one site to another, the cost is how the KCC will create the server connections and replicate data. There are a couple schools of thought when it comes to assigning costs to site links. The first is simply a matter of a formula which relates the speed of the underlying transport to a numerical value which can be plugged into AD. The second is to assign constant proportional cost values to different types or classes of links. I generally go with the first option of linking the cost to the underlying transport, and that's what I'm going to discuss here going forward. Assigning costs to your site links based on the underlying transport between the connected sites requires that you work closely with your WAN group to get all of the circuit information and make sure you're in the loop when they change a circuit so that you can update your information as well. There are a couple of formulas that work well as far as how to cost the links. The key is making sure that you can handle differentiating even high speed links e.g. gigabit vs ten gigabit Ethernet. The formulas I use top out at 38.4 gigabits per second (OC768 speed) at a cost of 1. If you're running links faster than this then you'll need to adjust the math accordingly. The difference in the formulas is that the second which takes the square root of everything makes the numbers a lot more manageable in terms of size, and also the Active Directory Sites and Services GUI has a limitation in that it only supports graphical input of integers up to 16 bits (65535) in size. The actual attribute is a 32 bit integer, so if you're using a script or third party tool to manage site links this may not be a concern.

These are the three formulas that I use, option C being my preferred method as it's much more manageable from a numbers standpoint and the fastest link in your table is always a cost of 1. Option A is the same as option C, just that the numbers are relatively huge and can't be managed through the GUI. Finally, option B is the method Microsoft recommends in the Branch Office Deployment Guide. I divide the link bandwidth by 1024 in order to convert the link bandwidth units to kilobits. The reference bandwidth is your maximum bandwidth which will have a cost of 1, and the link bandwidth is the speed of the underlying transport. You need to use the same units for both in order for this to work – in order to support very slow links and to save any unit conversion confusion, I usually just go with bits:

A
B
C

I've attached a spreadsheet (linked at the end of this post) I created which has most of the common WAN link speeds as well as their costs given all three of the above methods. I added a common name column which is a description that goes with the link speed that is what I normally hear associated with them. From a super technical perspective a couple of the names are not entirely accurate, but this is geared towards systems people not telecom. Feel free to use and customize this spreadsheet to your liking. If you add something cool to it, I'd love to hear about it. All I ask is that you give me credit if you redistribute it.

Now, the other piece of the pie when it comes to the costing is that sometimes you need to fudge things a bit (or a lot) in order to make your topology ideal. Let's take a couple examples of this. The first is that you might have a lower cost path which is actually significantly saturated most of the day. The alternative while slower is not highly utilized and thus is preferable from a reliability and load distribution standpoint. In order to make this work you'll have to fudge the cost of the saturated link to be high enough that the other path is elected. The second is that sometimes WAN links have a monetary cost on a bytes transferred basis (or even anytime they're used such as dialup, but this is something I'll talk about in a bit). This is a scenario where you'll be best served talking to your WAN group to understand how you can best accommodate the cost of the link from a financial standpoint be it not using it or limiting the frequency of your use.

Finally, my last point about site link costing is some confusion that sometimes comes up when you have frame relay clouds. I drew the diagram below as an example of something you might get from a WAN group given a request for some drawings of your network.

Here we have a frame relay cloud with a hub and spoke setup with Chicago being the hub site. Looking at the link speeds, Chicago as a full T3 going to Sprint, and then each of the spoke sites has a much smaller bandwidth allocated going back to Chicago. Additionally, there is a 56K link between Atlanta and New York City as part of this. The technical term for these links is generally PVCs or Permanent Virtual Circuits. My point here is that when costing your links, you wouldn't use the 45Mbps T3 as your cost for each link, but rather the actual allocated bandwidth to each site which is shown at each router – Miami has a 384Kbps link, San Francisco has a 128Kbps link, etc. Your WAN guys might also use the term "CIR" or committed information rate to refer to this.

Share this post: email it! | digg it! | bookmark it! | live it!

Script to Reset Local Administrator Passwords

Brian Desmond — Sat, 05 May 2007 16:11:00 GMT

I realized I hadn't posted this one answering a newsgroup post this morning. The attached script will iterate through a list of workstation names in a text file, ping them, and if the ping returns then reset the local administrator account password to whatever is defined at the top of the script. This is pretty basic and would potentially need some customization. You might want to adapt it to iterate through an OU or set of OUs instead and get the computer names from there, or perhaps set different administrator passwords on the machines.

Feel free to leave any questions/comments/etc in the comments box below and I'll take a look.

Share this post: email it! | digg it! | bookmark it! | live it!

WSUS 3.0

Brian Desmond — Wed, 02 May 2007 02:06:59 GMT

Microsoft recently released WSUS 3.0. WSUS is their free product for managing Windows Update content on Wintel machines in an organization. You can grab a copy of it here. Searching the Microsoft download site for "WSUS 3" or something similar yields a bunch of whitepapers which might be interesting as well.

I upgraded a simple WSUS 2.0 deployment to 3.0 and the installer seems to have taken care of everything nice and tidy. It did require that I install .Net 2.0 but that was inevitable and not a big deal. I was annoyed to learn at the end that a reboot was required but that was the only major problem. The biggest change from the previous version is probably the change to an MMC console from the web based UI. The MMC is somewhat faster although with all fo the other MMC 3 stuff I've used so far it seems a bit slower. The installer didn't check for the presence of MMC 3 prior to install and consequentially I got this error when I fired up the MMC after the reboot:

---------------------------
Microsoft Management Console
---------------------------

MMC cannot open the file C:\Program Files\Update Services\administrationsnapin\wsus.msc.

This may be because the file does not exist, is not an MMC console, or was created by a later version of MMC. This may also be because you do not have sufficient access rights to the file.

---------------------------
OK
---------------------------

This was easily resolved by downloading the MMC 3.0 update from Microsoft which did not require a reboot fortunately.

Share this post: email it! | digg it! | bookmark it! | live it!