Nagios process check simple fix

I'm setting up Nagios for the second time and I'm having to refresh my memory while setting up the service checks. I found a quick fix for one of the template services that always seems to fail - the process check for Explorer.exe. On all of the servers I setup Nagios reported that Explorer.exe wasn't running and was in a critical state. I couldn't see what was wrong with the check initially and that's because at first glance there isn't anything wrong with it. Until you look closer at the process information in task manager and notice that the process for Windows Explorer is called explorer.exe (lower case). It turns out that Nagios process checks are now case sensitive. I tested this with a couple of other processes, testing with upper case, lower case and normal case spellings and this confirmed it for me.

Slow down a network file copy

I've recently been virtualising our servers at work and I completed a P2V of our main server. This has been the most difficult to do because it previously hosted all of the network services, so it's been difficult to take offline and separate out the roles onto virtual machines without causing too much disruption. Anyway I was down to the last step, which was to virtualise the remaining database server but it generated a massive 400GB VM to copy onto the Hyper-V host.

I kicked off the copy from the physical server to it's new home and thought nothing of it, until one of my colleagues sitting next to me started to complain that database access had really slowed down. I checked task manager and discovered that the copy process had consumed 100% of the network bandwidth on the server. I quickly cancelled the copy and everyone in the building thanked me for working my magic and getting things working again!

I decided that if I wanted to complete this transfer and get started setting up the new VM I needed to find a way to copy the VHD file without using up all of the bandwidth on the server. Fortunately it only took a short amount of Google searching to find what I was looking for. The really handy Robocopy program built into Windows has an option called inter-packet gap that allows you to specify a copy speed when copying across the network. In my case I reduced the copy speed to only 25% of the network card bandwidth and although it took longer it copied successfully without interfering with the network based services on the server.

You can find out all about the options for Robocopy (including the wonderful inter-packet gap) here.

Word 2007 Macro Error

After a recent install of Word 2007 one particular computer kept giving the following error message when Word started:

The function you are attempting to run contains macros or content that requires macro language support. When this software was installed, you (or your administrator) chose not to install support for macros or controls.

After much searching of the internet I discovered that this error could be caused by incompatible plugins. Checking the running plugins in Word, I discovered that a particular PDF converter was responsible. Seeing as Word 2007 now supports saving as PDFs natively I decided to remove the incompatible plugin. Success! Temporarily at least. 

Some time later the error message started reappearing on the same computer. So back to the drawing board I went to seek out a permanent solution. That's when I discovered that this error message is also caused when the Visual Basic for Applications component is not installed. This can be installed by going to the Control Panel and selecting the Change option for Microsoft Office 2007, then expanding Office Shared Features and setting the Run from my computer option for Visual Basic for Applications.

Voila! Problem solved!

CSS automatically resize fonts for different resolutions and browser sizes

I've recently been rebuilding a website and getting my web design skills up to scratch. One of the problems that I've had to deal with is automatic resizing of elements on an page when faced with mobile devices and different browser/screen sizes. With a little help from the forums on the Stack Overflow website I've managed to coble together this handy piece of CSS that seems to do the job. It might not be perfect as I'm still learning advanced CSS, but for a quick easy solution it does the job:

@media screen and (max-width:767px) {
    .content1, .content2, .content3 {
        font-size: 70%;
    };
}

@media screen and (min-width:768px) {
    .content1, .content2, .content3 {
        font-size: 80%;
    };
}

@media screen and (min-width:992px) {
    .content1, .content2, .content3 {
        font-size: 90%;
    };
}

@media screen and (min-width:1200px) {
    .content1, .content2, .content3 {
        font-size: 100%;
    };
}

Antivirus exclusion list for servers

Based on all of the resources linked on Microsoft Technet article, this is a complete list of AV exceptions that should be in place on servers running AD, DHCP, Hyper-V, SQL and Exchange. There are more exceptions listed in the article but these were the ones that applied to my server configurations at the time.

*.mdf
*.ldf
*.ndf
*.bak
*.trn
*.trc
*.sqlaudit
*.sql
%ProgramFiles%\Microsoft SQL Server\MSSQL.X\OLAP\Backup\*.*
%ProgramFiles%\Microsoft SQL Server\MSSQL.X\OLAP\Log\*.*
%ProgramFiles%\Microsoft SQL Server\MSSQL10_50.BACKUPEXEC\MSSQL\Binn\SQLServr.exe
%ProgramFiles%\Microsoft SQL Server\MSSQL10_50.BACKUPEXEC\Reporting Services\ReportServer\Bin\ReportingServicesService.exe
%ProgramFiles%\Microsoft SQL Server\MSSQL10_50.BACKUPEXEC\OLAP\Bin\MSMDSrv.exe
%windir%\SoftwareDistribution\Datastore\*.*
%windir%\SoftwareDistribution\Datastore\Logs\*.*
Edb*.jrs
Edb.chk
Tmp.edb
*.edb
*.sdb
*.log
*.chk
*.jrs
%allusersprofile%\NTUser.pol
%SystemRoot%\GroupPolicy\Machine\Registry.pol
%SystemRoot%\GroupPolicy\User\Registry.pol
%windir%\Ntds\*.*
%windir%\Ntfrs\*.*
%systemroot%\Sysvol\Staging areas\*.*
%systemroot%\Sysvol\Domain\*.*
%systemdrive%\System Volume Information\DFSR\*.*
%systemroot%\System32\DHCP\*.*
%systemroot%\System32\Dns\*.*
%allusersprofile%\Microsoft\Windows\Hyper-V\*.*
C:\Users\Public\Documents\Hyper-V\Virtual Hard Disks\*.*
%systemroot%\System32\vmms.exe
%systemroot%\System32\vmwp.exe
%ExchangeInstallPath%\*.*
%SystemRoot%\System32\Inetsrv\*.*
%Winnt%\Cluster\*.*
%Windir%\Cluster\*.*
%SystemDrive%\inetpub\temp\IIS Temporary Compressed Files\*.*
%SystemRoot%\System32\Inetsrv\*.*
C:\Inetpub\logs\logfiles\w3svc\*.*
Cdb.exe
Microsoft.Exchange.Search.Exsearch.exe
Cidaemon.exe
Microsoft.Exchange.Servicehost.exe
Clussvc.exe
MSExchangeADTopologyService.exe
Dsamain.exe
MSExchangeFDS.exe
Microsoft.Exchange.EdgeCredentialSvc.exe

SSL security and Microsoft Exchange

This year the SSL Certificate Authorities announced that they would no longer be allowing SSL certificates to be issued for private IP and internal domain names. In my company this meant that when our SSL certificate recently expired we could no longer renew it for the internal exchange server name (exchange.domain.local). This was all well and good for OWA and our external staff who used our external domain address in their email clients, but it caused Outlook to have a major hissy fit and complain that the SSL certificate wasn’t valid and kept popping up an annoying warning message.

So off I went to hunt down a solution to the problem. There were two main suggestions that permeated throughout the internet:

1. Map the internal server name to the matching external name by setting up new DNS zones on the domain controller.
2. Changing the Exchange server to user external DNS names.

Option number 1 didn’t work properly for me. It was probably a configuration fault on my part as others have reported success with that approach. However, it is kind of cumbersome as you have to create a new DNS zone for each external address (you’ll need at least two – server.domain.com and autodiscover.domain.com).

Option 2 however was far more successful. Using a guide provided online by Digicert I discovered that using the Exchange Management Shell on the server, there are three Exchange entries that you need to change with the following commands:

• Set-ClientAccessServer -Identity HostName -AutodiscoverServiceInternalUri https://mail.yourdomain.com/autodiscover/autodiscover.xml
• Set-WebServicesVirtualDirectory -Identity "HostName\EWS (Default Web Site)" -InternalUrl https://mail.yourdomain.com/ews/exchange.asmx
• Set-OABVirtualDirectory -Identity "HostName\oab (Default Web Site)" -InternalUrl https://mail.yourdomain.com/oab

Once you have run these commands in Exchange Management Shell on the server, you need to then open IIS Manager, expand Application Pools, right click on MSExchangeAutodiscoverAppPool and then choose the Recycle option.

Once you’ve done this Outlook will no longer complain about invalid SSL certificates.

Remote Desktop goes black after login

When trying to login remotely to a server today I discovered that on every attempt, when I was redirected from a successful login to the desktop, the screen would go black and be unresponsive. The server was running fine and the login worked fine from the console. After a bit of searching I discovered a thread on the Microsoft Technet forums discussing this very issue.

The solution to this problem was very simple but completely unexpected. By pressing CTRL + ALT + END I could trigger the Windows security screen (much like CTRL + ATL + DEL does on a local computer). Pressing cancel on this box then restored my desktop on the server.

Others have reported online having to take an extra step of disconnecting their RDP session and then reconnecting again in order to fully restore the desktop. Many thanks to Rob Kraft on the Technet forums for this deliciously simple solution.

CUPS configuration - Be careful what you do!

So having moved from a piecemeal Ubuntu server solution to Zentyal for my home server, the one last thing I'm having trouble setting up is printer sharing. There seems to be three ways to do it; via the printers app, on the Zentyal console or via the CUPS webpage. It turns out the correct way to setup a printer for Zentyal to share is via the CUPS route.

This was all well and good, and I eventually worked out how to setup my printer and share it. But I made one schoolboy error and ticked the Kerberos authentication box. When I tried to reconnect to the CUPS webpage all I got was an unauthorised access page and no login box. There was no way for me to get back into the web config to fix the problem. This seems to be a bit of bug that needs addressing but I suppose common sense prevails and not ticking boxes without knowing the outcome is probably the best way forward. We can't wrap everyone in bubblewrap and even us IT guys need to exercise caution at times!

Fortunately it turns out that if you find yourself in this situation, all you need to do is log onto the server and replace the /etc/cups/cupsd.conf file with the default file. If you can't find the default file (like me) then just copy the text from another file or the internet and paste it into your cupsd.conf file.

To save you lots of further hunting, the original cupsd.conf file content can be found on answers.launchpad.net courtesy of the user actionparsnip. Thanks fella!

XRDP and Zentyal Server

Due to a... ahem... user error recently, I've found myself in a position to rebuild by home server. So I decided to go back and give Zentyal a try as it looks like its improved a lot since I last tried it out. Configuration of the server so far has been a breeze and the amount of documentation provided by the team and community at Zentyal is fantastic.

However I wanted to do one thing that was documented and setup remote access to the server. I know that pretty much everything can be done through a browser, but my home server isn't attached to a keyboard or monitor, so I like to have a way of getting into the server to troubleshoot. My software of choice is XRDP as I've used it all before and it works like a charm.

Unfortunately, this time it didn't quite go as smoothly as previous experiences. I'd managed to setup the port access on the Zentyal firewall and my RDP client could remote to the correct ports, but internal routing from the RDP service to the internal VNC server wasn't working. I kept getting this error:

connecting to sesman ip 127.0.0.1 port 3350
sesman connect ok
sending login info to session manager, please wait...
xrdp_mm_process_login_response: login successful for display
started connecting
connecting to 127.0.0.1 5910
error - problem connecting

After much trial and error, and many Google searches I discovered a post on the Ubuntu Forums from spider-byte describing exactly the same problem. His solution was to reinstall both XRDP and tightvncserver separately through synaptic. As a test I reinstalled tightvncserver with apt-get and voila, problem solved. I'm not sure if this is a common occurrence or just my config gone wrong, but I thought I'd share my solution and my thanks to spider-byte.

Mac user can't login to Windows domain

Had a quick question this afternoon from someone who had setup a Mac in a Windows domain environment. After setting up and joining the domain they had no problem logging onto the Mac with their Windows username and password. However, seemingly at random they were suddenly unable to login anymore.

It turned out to be quite a simple solution to the problem; the clock on the Mac was out of sync with the Windows domain controller. The Mac was running six minutes faster than it's Windows colleagues. Once the time was corrected the user was able to login to the Mac again with their Windows login.

Outlook 2010 cannot verify licence

I was reimaging a faulty computer today with a working Ghost image I had made some time back when I encountered an error opening Word. Every time I tried to open any of the Microsoft Office 2010 applications I got this error message:

"Microsoft Office cannot verify the license for this product. You should repair the Office program by using Control Panel."

After a bit of searching I discovered the answer was quite a simple one. The problem was that I had created the image some time back and the activation grace period had expired. In order to get Office to activate properly I needed to rearm the activation period.

To do this you need to open a command prompt with elevated administrator rights and type in the following command:

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\ospprearm.exe

This resets the 30 day grace period and you are once again able to open and activate Microsoft Office.

ASUS P5 series motherboard won't shutdown with Windows 7

I had to share this little gem of a trick with everyone. I've just built a new quad core system for my wife to play The Sims on. Works perfectly except for one tiny little hitch - When you shutdown the computer Windows shuts down fully but the PC doesn't turn off; the fans carry on spinning and the lights stay on.

Many thanks have to be given to user kirk620 on the Microsoft Answers site for finding the answer to this problem. Simply go into Device Manager and find the entry for your IEEE-1394 device and under Power Management tick the box to allow Windows to turn off the device. Hey presto! The computer shuts down properly again.

Apt-get from the command line behind a proxy

I'm putting this on here more as just a reminder for myself as much as anything else. I've recently started putting more effort into developing my Linux knowledge and I've been setting up an Ubuntu server without a GUI. One of the first problems I found was that I couldn't update apt-get. It turns out that apt-get doesn't automatically see the system proxy settings but can be fixed simply with one command:

export http_proxy="http://username:Password@foo.bar:8080"

Many thanks to Cybernerd on EduGeek for this spark of genius!

Unable to Telnet localhost

I was setting up a mailserver for a client and couldn't work out why I was continually unable to send messages to our SMTP relay. I had also set up a webmail client which was having similar problems sending email to the mailserver. I'd tried everything I could think of and everything that I found online. I'd even escalated the problem up to our ISP, with no joy.

So would you believe my surprise when I came across a TechNet thread that presented the solution to my problem; something so obscure I never would have thought of it.

It turns out that McAfee's 'Client Protection' component was blocking telnet from accessing the server by IP address and hostname. Once I'd disabled the client protection component I was able to telnet to the local server, the SMTP relay server and my webmail client was able to send emails to the mailserver.

I have to give many thanks to Rich Matheisen for his informed post on TechNet.

Accessing Windows file shares from Ubuntu

I've been using Ubuntu on my home laptop for about a month now with the intention of giving it a good run as my main OS before deciding whether or not I should continue on with my previous Windows XP installation.

One of the problems I've been having is with accessing Windows file shares. It's been kind of on and off for a while whether I would be able to access files on my home server or not. I've setup my fstab configuration file to connect on startup, my Samba configuration for the correct Windows workgroup and tried various other tips and tricks. But all to no avail.

However I think I've finally fixed the problem! Many thanks to the author of the blog Boinst for this tip. The solution that worked for me was a registry edit on my Windows box. I needed to change two registry keys to setup this fix:

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\LargeSystemCache

Change this key to '1'.

HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\Size

Change this key to '3'.

The first key tells Windows to enable enough cache memory for large file sharing and the second key tells Windows to prioritise file sharing over memory saving.

So far this has sorted my file sharing problem with Ubuntu. Hope this helps others.

Take ownership and change permissions from the Windows 7 command line

I discovered a unique 'feature' of Windows 7 offline files today; It turns out that when offline files are created they are stripped of ownership and all permissions.

This little gem of knowledge I discovered when I had a client who made edits to an offline file, during which time the offline file service was stopped in the domain the computer was part of. When the laptop was returned to the domain the offline files and syncronisation were disabled, rendering all changes lost. Or were they?

I tracked down the offline files, hidden away in %systemroot%\CSC, and copied them all to a safe location on the desktop so that they could be opened and saved to the network again. However, this is when I made my discovery! I was unable to open any of the folders or files as the user account or the administrator account. I was also unable to request permission or change permissions.

After some scrutiny I discovered that I was able to retake ownership of files and begin my trek through the maze of folders and files in a very large offline files collection. Unfortunately by using explorer I had to take control and give myself permission to open every folder in the directory tree individually. This was going to be a long process and a major headache. So I went hunting in Googleland.

During my searches I found a wonderful command line tool built into Windows 7 for taking ownership and granting permissions on a whole directory. The first command allows the logged on user to take ownership of all the files and folders:

takeown /f directory_name /r /d y

The second command allows you to grant full permissions to any user account to all of the files and folders in the directory:

icacls directory_name /grant administrators:F /t

These commands were life savers for me and I give credit to eset_boy on The Windows Club Forum for his wonderful advice.

Recover iPad from failed OS update (error 1604)

Recently I've been setting up a set of iPads for a client and Apple released the latest update to their iOS. So as part of the setup I installed the update to each iPad. Unfortunately three of them failed and refused to start afterwards. When I connected them to the laptop with iTunes on it, a message popped up informing me that there were several iPads in a recovery state that needed to be restored from a backup (error 1604). I attempted this several times and each time it failed.

After some time spent on Google hunting around for a solution, I finally found an answer to my problem. It turns out that iPads have two recovery modes; standard recovery mode and DFU (Device Firmware Upgrade) mode. In DFU mode the iPad doesn't load any operating system or boot loader when it connects to iTunes. This enables you to restore a working version of iOS to the iPad and then complete a restore through iTunes.

In order to get your iPad into DFU mode you need to follow the steps below:

1. Load iTunes on your laptop/PC/Mac
2. Connect your iPad via the USB connector
3. Press and hold the power button and home button on your iPad for 10 seconds. It must be 10 seconds precisely or this will not work.
4. After 10 seconds release the power button but continue to hold down the home button for a further 5 seconds.

If done correctly your iPad screen should remain blank and iTunes will report a device in recovery mode. Under Windows you will also get a notification that the DFU recovery driver has been installed for your device. You can then complete a restore of the device and settings through iTunes. If your iPad screen does not remain blank then you haven't done it properly and need to try again. It's fiddly but it does work once you get the knack of it.

Windows Vista/7 unable to connect to wireless network after the connection goes down

My other half's laptop has for some time had a problem with our home wireless network. When booted up it connects happily to the network and everything works fine. But if the wireless network goes down (which it has frequently because of some issues with our wireless router) or if her laptop is left to go to sleep or standby mode, the wireless will not reconnect. The only thing that will fix it is a reboot.


I figured that there must be a solution to this problem. My Windows XP laptop quite happily drops and reconnects the wireless connection without any issues. So I turned to my friend Google for help... And the first link I see holds the answer to my question:


Apparently the problem is caused by a missing registry entry in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters. It should contain a DWORD (32-bit) value called ArpRetryCount and the value should be set to '0'. Apparently this has been proven to fix this problem under Vista and Windows 7.

Many thanks go to kileyferguson on www.techsupportforum.com for this answer.

Worst Phishing Email... Ever!!

I received this email from a concerned client today and I just can't believe how blatantly obvious this is as a fake. They didn't bother to disguise their email address, they sent an warning about deleting an inactive account to an active account (I know this particular client uses their hotmail address daily) and worst of all they ask you to reply to the email with your username, password and year of birth!!! Are phishers really getting this lazy!? :)

Here's the content of the email:

From: phanptv49@hotmail.com
To: phanptv49@hotmail.com
Subject: Service Alert
Date: Sun, 19 Feb 2012 10:21:11 +0700

Dear Account User,

This email is from Windows Live Customer Care®. We are sending it to all account owners for account upgrade. We are experiencing network congestion due to anonymous registration of email accounts. To prevent this, we are shutting down inactive accounts and your account is scheduled to be deactivated. 

We sent this email to you so that you can verify and let us know if your account is still valid. Click on the reply button and fill in your information:

User Name:.......................................................

Password:..........................................................

Year of Birth:......................................................

Country Or Territory:.........................................

After following the instructions in the sheet, your account will not be interrupted and will continue as normal. Thanks for your attention to this request. We apologize for any inconveniences.

Warning! Account owners who refuse to update their accounts after 24 Hours of receiving this warning will lose their accounts permanently.

Sincerely,
The Windows Live TeamMicrosoft Corporation. Microsoft respects your privacy. Please read our online privacy statement. Microsoft Corporation, One Microsoft way, Redmond, WA 98052, USA ©

Unable to edit netlogon in Windows Server 2008

I needed to make a change to a login script that was stored in the netlogon folder on a Windows Server 2008. However I discovered that I couldn't save any changes when logged on as an administrator accessing the share or even when I followed the correct path to the netlogon folder.

After many failed attempts to resolve this problem, I decided to have a search on Google. I eventually came across this thread on the petri.co.il forums.The solution was amazingly simple yet crazy that it was needed. In order to be able to edit files in netlogon you need to navigate to the correct path for netlogon, go up one level to the 'scripts' folder and modify the permissions for this folder. Make sure that the administrator account has the correct permissions for editing the contents of the folder.

Simple. Yet why Microsoft should feel that by default no one (including the administrator) can modify the contents of this folder is beyond me.