Brian Hehir's Random Doodlings & Techno Babble

kernel32.dll DeviceIoControl example in C#

2011-12-08T09:45:00.005-05:00

Had to write some code to retrieve the partition alignment of some VM disks hosted on a NAS from within the client OS. Simple method using WMI is below, but that was a bit dull as WMI is too easy so I thought I'd create a native method using API calls to kernel32.dll and use DeviceIOControl... what a pain but below is a native method that shows how to get the native code working under C#...

WMI method - simples...

        void WMIMethod()

              string sComputer = ".";

             ManagementScope scope = new ManagementScope("\\\\" + sComputer + "\\root\\cimv2");

             //"\\\\" + args[0] + "\\root\\cimv2");

  scope.Connect();

             ObjectQuery query = new ObjectQuery("SELECT * FROM Win32_DiskPartition");

             ManagementObjectSearcher searcher =  new ManagementObjectSearcher(scope, query);

               ManagementObjectCollection queryCollection = searcher.Get();

               // Console.WriteLine("MachineName={0}", args[0]);

             foreach (ManagementObject m in queryCollection)

 // Display the remote computer information

  Console.Write("Disk={0}", m["DiskIndex"]);

  Console.Write(",Partition={0}", m["Index"]);

  foreach (ManagementBaseObject c in m.GetRelated("Win32_LogicalDisk"))

   Console.Write(",Drive={0}", c["name"]);

  Console.Write(",StartingOffset={0}", m["StartingOffset"]);

                 Int64 i = Convert.ToInt64(m["StartingOffset"]) + Convert.ToInt64(m["Size"]);

                 Console.Write(",NextAlignedOffset={0}", i);

                 Console.WriteLine(",Size={0}", m["Size"]);

Now the tricky one using the native calls... Converted this to C# from a post on XtremeVB, works like a charm...

//using Microsoft.VisualBasic;

using System;

using System.Collections;

using System.Collections.Generic;

using System.Data;

using System.Diagnostics;

using Microsoft.Win32.SafeHandles;

using System.ComponentModel;

using System.Runtime.InteropServices;

using System.Security;

static class IOCtl

{

private const int GENERIC_READ = unchecked((int)0x80000000);

private const int FILE_SHARE_READ = 1;

private const int FILE_SHARE_WRITE = 2;

private const int OPEN_EXISTING = 3;

private const int IOCTL_DISK_GET_DRIVE_LAYOUT_EX = unchecked((int)0x00070050);

private const int ERROR_INSUFFICIENT_BUFFER = 122;

private enum PARTITION_STYLE : int

{

MBR = 0,

GPT = 1,

RAW = 2

}

private enum Partition : byte

{

ENTRY_UNUSED = 0,

FAT_12 = 1,

XENIX_1 = 2,

XENIX_2 = 3,

FAT_16 = 4,

EXTENDED = 5,

HUGE = 6,

IFS = 7,

OS2BOOTMGR = 0xa,

FAT32 = 0xb,

FAT32_XINT13 = 0xc,

XINT13 = 0xe,

XINT13_EXTENDED = 0xf,

PREP = 0x41,

LDM = 0x42,

UNIX = 0x63

}

[SuppressUnmanagedCodeSecurity()]

private class NativeMethods

{

[DllImport("kernel32", CharSet = CharSet.Unicode, SetLastError = true)]

public static extern SafeFileHandle CreateFile(

string fileName,

int desiredAccess,

int shareMode,

IntPtr securityAttributes,

int creationDisposition,

int flagsAndAttributes,

IntPtr hTemplateFile);

[DllImport("kernel32", SetLastError = true)]

[return: MarshalAs(UnmanagedType.Bool)]

public static extern bool DeviceIoControl(

SafeFileHandle hVol,

int controlCode,

IntPtr inBuffer,

int inBufferSize,

IntPtr outBuffer,

int outBufferSize,

ref int bytesReturned,

IntPtr overlapped);

}

// Needs to be explicit to do the union.

[StructLayout(LayoutKind.Explicit)]

private struct DRIVE_LAYOUT_INFORMATION_EX

{

[FieldOffset(0)]

public PARTITION_STYLE PartitionStyle;

[FieldOffset(4)]

public int PartitionCount;

[FieldOffset(8)]

public DRIVE_LAYOUT_INFORMATION_MBR Mbr;

[FieldOffset(8)]

public DRIVE_LAYOUT_INFORMATION_GPT Gpt;

// Forget partition entry, we can't marshal it directly

// as we don't know how big it is.

}

private struct DRIVE_LAYOUT_INFORMATION_MBR

{

public uint Signature;

}

// Sequential ensures the fields are laid out in memory

// in the same order as we write them here. Without it,

// the runtime can arrange them however it likes, and the

// type may no longer be blittable to the C type.

[StructLayout(LayoutKind.Sequential)]

private struct DRIVE_LAYOUT_INFORMATION_GPT

{

public Guid DiskId;

// C LARGE_INTEGER is 64 bit

public long StartingUsableOffset;

public long UsableLength;

// C ULONG is 32 bit

public int MaxPartitionCount;

}

[StructLayout(LayoutKind.Sequential)]

private struct PARTITION_INFORMATION_MBR

{

public byte PartitionType;

[MarshalAs(UnmanagedType.U1)]

public bool BootIndicator;

[MarshalAs(UnmanagedType.U1)]

public bool RecognizedPartition;

public UInt32 HiddenSectors;

// helper method - is the hi bit valid - if so IsNTFT has meaning.

public bool IsValidNTFT()

{

return (PartitionType & 0xc0) == 0xc0;

}

// is this NTFT - i.e. an NTFT raid or mirror.

public bool IsNTFT()

{

return (PartitionType & 0x80) == 0x80;

}

// the actual partition type.

public Partition GetPartition()

{

const byte mask = 0x3f;

return (Partition)(PartitionType & mask);

}

[StructLayout(LayoutKind.Explicit, CharSet = CharSet.Unicode)]

private struct PARTITION_INFORMATION_GPT

{

// Strangely, this works as sequential if you build x86,

// But for x64 you must use explicit.

[FieldOffset(0)]

public Guid PartitionType;

[FieldOffset(16)]

public Guid PartitionId;

[FieldOffset(32)]

//DWord64

public ulong Attributes;

[FieldOffset(40)]

[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 36)]

public string Name;

}

[StructLayout(LayoutKind.Explicit)]

private struct PARTITION_INFORMATION_EX

{

[FieldOffset(0)]

public PARTITION_STYLE PartitionStyle;

[FieldOffset(8)]

public long StartingOffset;

[FieldOffset(16)]

public long PartitionLength;

[FieldOffset(24)]

public int PartitionNumber;

[FieldOffset(28)]

[MarshalAs(UnmanagedType.U1)]

public bool RewritePartition;

[FieldOffset(32)]

public PARTITION_INFORMATION_MBR Mbr;

[FieldOffset(32)]

public PARTITION_INFORMATION_GPT Gpt;

}

public static void Main()

{

SendIoCtlDiskGetDriveLayoutEx(0);

Console.ReadKey();

}

private static void SendIoCtlDiskGetDriveLayoutEx(int PhysicalDrive)

{

DRIVE_LAYOUT_INFORMATION_EX lie = default(DRIVE_LAYOUT_INFORMATION_EX);

PARTITION_INFORMATION_EX[] pies = null;

using (SafeFileHandle hDevice =

NativeMethods.CreateFile("\\\\.\\PHYSICALDRIVE" + PhysicalDrive, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, IntPtr.Zero, OPEN_EXISTING, 0, IntPtr.Zero))

{

if (hDevice.IsInvalid)

throw new Win32Exception();

// Must run as administrator, otherwise we get "ACCESS DENIED"

// We don't know how many partitions there are, so we have to use a blob of memory...

int numPartitions = 1;

bool done = false;

{

// 48 = the number of bytes in DRIVE_LAYOUT_INFORMATION_EX up to

// the first PARTITION_INFORMATION_EX in the array.

// And each PARTITION_INFORMATION_EX is 144 bytes.

int outBufferSize = 48 + (numPartitions * 144);

IntPtr blob = default(IntPtr);

int bytesReturned = 0;

bool result = false;

try

{

blob = Marshal.AllocHGlobal(outBufferSize);

result = NativeMethods.DeviceIoControl(hDevice, IOCTL_DISK_GET_DRIVE_LAYOUT_EX, IntPtr.Zero, 0, blob, outBufferSize, refbytesReturned, IntPtr.Zero);

// We expect that we might not have enough room in the output buffer.

if (result == false)

{

// If the buffer wasn't too small, then something else went wrong.

if (Marshal.GetLastWin32Error() != ERROR_INSUFFICIENT_BUFFER)

throw new Win32Exception();

// We need more space on the next loop.

numPartitions += 1;

}

else

{

// We got the size right, so stop looping.

done = true;

// Do something with the data here - we'll free the memory before we leave the loop.

// First we grab the DRIVE_LAYOUT_INFORMATION_EX, it's at the start of the blob of memory:

lie = (DRIVE_LAYOUT_INFORMATION_EX)Marshal.PtrToStructure(blob, typeof(DRIVE_LAYOUT_INFORMATION_EX));

// Then loop and add the PARTITION_INFORMATION_EX structures to an array.

pies = new PARTITION_INFORMATION_EX[lie.PartitionCount];

for (int i = 0; i <= lie.PartitionCount - 1; i++)

{

// Where is this structure in the blob of memory?

IntPtr offset = new IntPtr(blob.ToInt64() + 48 + (i * 144));

pies[i] = (PARTITION_INFORMATION_EX)Marshal.PtrToStructure(offset, typeof(PARTITION_INFORMATION_EX));

}

finally

{

Marshal.FreeHGlobal(blob);

}

} while (!(done));

}

DumpInfo(lie, pies);

}

private static bool IsPart0Aligned(PARTITION_INFORMATION_EX[] pies)

{

try

{

if (pies[0].StartingOffset % 4096 == 0)

{

return true;

}

else

{

return false;

}

catch

{

return false;

}

private static void DumpInfo(DRIVE_LAYOUT_INFORMATION_EX lie, PARTITION_INFORMATION_EX[] pies)

{

if (IsPart0Aligned(pies) == true) {

Console.Write( "True");

}

else

{

Console.Write("false");

}

Console.WriteLine("Partition Style: {0}", lie.PartitionStyle);

Console.WriteLine("Partition Count: {0}", lie.PartitionCount);

switch (lie.PartitionStyle)

{

case PARTITION_STYLE.MBR:

Console.WriteLine("Mbr Signature: {0}", lie.Mbr.Signature);

break;

case PARTITION_STYLE.GPT:

Console.WriteLine("Gpt DiskId: {0}", lie.Gpt.DiskId);

Console.WriteLine("Gpt StartingUsableOffset: {0}", lie.Gpt.StartingUsableOffset);

Console.WriteLine("Gpt UsableLength: {0}", lie.Gpt.UsableLength);

Console.WriteLine("Gpt MaxPartitionCount: {0}", lie.Gpt.MaxPartitionCount);

break;

default:

Console.WriteLine("RAW!");

break;

}

for (int i = 0; i <= lie.PartitionCount - 1; i++)

{

Console.WriteLine();

Console.WriteLine("Partition {0} info...", i + 1);

Console.WriteLine("-------------------");

Console.WriteLine();

var _with1 = pies[i];

Console.WriteLine("Partition style: {0}", _with1.PartitionStyle);

Console.WriteLine("Starting offset: {0}", _with1.StartingOffset);

Console.WriteLine("Partition length: {0}", _with1.PartitionLength);

Console.WriteLine("Partition number: {0}", _with1.PartitionNumber);

Console.WriteLine("Rewrite partition: {0}", _with1.RewritePartition);

switch (_with1.PartitionStyle)

{

case PARTITION_STYLE.MBR:

var _with2 = _with1.Mbr;

Console.WriteLine("Mbr PartitionType - raw value: {0}", _with2.PartitionType);

// Console.WriteLine("Mbr PartitionType - validNTFT: {0}", _with2.IsValidNTFT);

// if (_with2.IsValidNTFT)

// Console.WriteLine("Mbr PartitionType - ntft: {0}", _with2.IsNTFT);

// Console.WriteLine("Mbr PartitionType - decoded: {0}", _with2.GetPartition);

Console.WriteLine("Mbr BootIndicator : {0}", _with2.BootIndicator);

Console.WriteLine("Mbr RecognizedPartition : {0}", _with2.RecognizedPartition);

Console.WriteLine("Mbr HiddenSectors : {0}", _with2.HiddenSectors);

break;

case PARTITION_STYLE.GPT:

var _with3 = _with1.Gpt;

Console.WriteLine("Gpt PartitionType: {0}", _with3.PartitionType);

Console.WriteLine("Gpt PartitionId: {0}", _with3.PartitionId);

Console.WriteLine("Gpt Attributes: {0}", _with3.Attributes);

Console.WriteLine("Gpt Name: {0}", _with3.Name);

break;

case PARTITION_STYLE.RAW:

Console.WriteLine("RAW!");

break;

}

Simples! lol!

Delete old profiles

2011-10-10T11:18:00.005-04:00

Had an issue with a client where SCCM was mounting each user profile (NTUSER.DAT) everyday and the profile age was always the same for all users on the machine even if some had not logged in for months. so knocked this out that looks at the DateModified on the profile directory which only gets updated when the user logs out.

using System;

using System.Collections.Generic;

using System.Text;

using Microsoft.Win32;

using System.IO;

using System.Security.Principal;

using System.Runtime.InteropServices;

using System.Diagnostics;

namespace DelProfs

{

class Program

{

private static string m_skeyName = "";

public static string skeyName

{

get { return m_skeyName; }

set { m_skeyName = value; }

}

private static string m_sHKLMkeyName = "";

public static string sHKLMkeyName

{

get { return m_sHKLMkeyName; }

set { m_sHKLMkeyName = value; }

}

private static string m_sFile2Check = "";

public static string sFile2Check

{

get { return m_sFile2Check; }

set { m_sFile2Check = value; }

}

[DllImport("userenv.dll", SetLastError = true)]

static extern bool DeleteProfile(string lpSidString, string lpProfilePath, string lpcomputername);

[DllImport("kernel32", SetLastError = true, CallingConvention = CallingConvention.Winapi)]

public extern static IntPtr LoadLibrary(string libraryName);

[DllImport("kernel32", SetLastError = true, CallingConvention = CallingConvention.Winapi)]

public extern static IntPtr GetProcAddress(IntPtr hwnd, string procedureName);

static void Main(string[] args)

{

//if (Is32BitProcessOn64BitProcessor())

//{

// skeyName = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList";

// sHKLMkeyName = "SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList";

//}

//else

//{

skeyName = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList";

sHKLMkeyName = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList";

//}

sFile2Check = "NTUSER.DAT";

//const string lpcomputername = null;

if (args.Length == 0)

{

System.Console.WriteLine("Please Enter the Age of Profiles to Delete in Days.");

System.Console.WriteLine("Usage: DelProfs ");

System.Console.WriteLine();

return;

//return 1;

}

string sdefUserDomain = "";

string sdefUserName = "";

int num;

bool test = int.TryParse(args[0], out num);

if (test == false)

{

System.Console.WriteLine("Please Enter the Age of Profiles to Delete in Days.");

System.Console.WriteLine("Usage: DelProfs ");

System.Console.WriteLine();

return;

//return 1;

}

if (args.Length == 3)

{

//get the default domain and username passed from smartbutton

sdefUserDomain = args[1].ToUpper();

sdefUserName = args[2].ToUpper();

//System.Console.WriteLine(sdefUser);

//return;

}

string sComputerName = "";

sComputerName = (string)Registry.GetValue("HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\ComputerName\\ActiveComputerName","Computername","");

//return;

//int iMaxAge = 10;

int iMaxAge = num;

string sProfilePath = (string)Registry.GetValue(skeyName, "ProfilesDirectory", "");

sProfilePath = Environment.ExpandEnvironmentVariables(sProfilePath);

if (sProfilePath != "")

{

try

{

foreach (string sdir in Directory.GetDirectories(sProfilePath))

{

//System.Console.WriteLine(sdir);

//string sTemp = Path.Combine(sdir, "HELPASSISTANT");

if ((sdir.ToUpper().Contains(sComputerName)) && (sComputerName != ""))

{

DeleteUserProfileKey(Path.Combine(sdir, "HELPASSISTANT"));

}

DateTime dFolderAge = getFolderDateModified(sdir);

int iAge = HowOld(dFolderAge);

if (iAge > iMaxAge)

{

string scheck = Path.Combine(sdir, sFile2Check);

if ((File.Exists(scheck))

((File.GetAttributes(scheck) & FileAttributes.Hidden) == FileAttributes.Hidden))

{

//check owner

//string sowner = "";

string sowner = getFileOwner(Path.Combine(sdir, sFile2Check));

if (sowner.IndexOf("\\") > 0)

{

string[] split = null;

char[] splitchar = { '\\' };

split = sowner.Split(splitchar);

string sDomainNaime = split[0];

string sUserName = split[1];

if ((sDomainNaime.ToUpper() == "BUILTIN")

(sDomainNaime.ToUpper() == "NT AUTHORITY")

(sDomainNaime.ToUpper() == "ERROR")

(sDomainNaime.ToUpper() == "WINDOWSLIVEID")

(sDomainNaime.ToUpper() == "IIS APPPOOL")

((sDomainNaime.ToUpper() == sdefUserDomain.ToUpper()) && (sUserName.ToUpper() == sdefUserName.ToUpper())

(sUserName.ToUpper().Contains("CLEARCASE")))

)

{

//Excluded account profiles

}

else

{

//ForceDeleteDirectory(sdir);

//DeleteUserProfileKey(sdir);

DeleteUserProfileKey(sdir);

}

}

else

{

// not a domain account

}

}

else

{

//no ntuser.dat found so delete it anyway

//ForceDeleteDirectory(sdir);

//DeleteUserProfileKey(sdir);

DeleteUserProfileKey(sdir);

}

}

}

}

catch (Exception)

{

//Console.WriteLine(excpt.Message);

}

}

else { }

}

public static int HowOld(DateTime d1)

{

TimeSpan ts = DateTime.Now - d1;

return Math.Abs(ts.Days);

}

public static void DeleteUserProfileKey(string sProfilePath)

{

//string keyName = "LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList";

Boolean bfound = false;

try

{

using (RegistryKey profileList = Registry.LocalMachine.OpenSubKey(sHKLMkeyName))

{

//Get a list of SIDs corresponding to each profile on the computer

string[] sidList = profileList.GetSubKeyNames();

foreach (string ssid in sidList)

{

try

{

string sRegPath = Path.Combine(skeyName, ssid);

string sProfileTestPath = (string)Registry.GetValue(sRegPath, "ProfileImagePath", "");

if (sProfileTestPath.ToUpper() == sProfilePath.ToUpper())

{

DeleteProfile(ssid, sProfilePath, null);

bfound = true;

ForceDeleteDirectory(sProfilePath);

DeleteProfile(ssid, sProfilePath, null);

}

// }

}

catch (Exception)

{

//Console.WriteLine(e.Message);

}

}

if (bfound == false)

{

ForceDeleteDirectory(sProfilePath);

}

}

}

catch (Exception)

{

// Console.WriteLine(e.Message);

}

}

public static void deleteRegKeySub(string skey)

{

try

{

Registry.LocalMachine.DeleteSubKeyTree(skey);

}

catch (Exception)

{

}

}

public static string getFileOwner(string sFile)

{

try

{

if (File.Exists(sFile))

{

var fs = File.GetAccessControl(sFile);

var sid = fs.GetOwner(typeof(SecurityIdentifier));

//Console.WriteLine(sid); // SID

var ntAccount = sid.Translate(typeof(NTAccount));

//Console.WriteLine(ntAccount); // DOMAIN\username

return ntAccount.ToString().ToUpper();

}

else

{

return "";

}

}

catch (Exception)

{

return "";

}

}

public static DateTime getFolderDateModified(string sFolderPath)

{

try

{

string spath = @sFolderPath;

if (!Directory.Exists(spath))

{

return DateTime.Now;

}

else

{

return Directory.GetLastWriteTime(spath);

}

}

catch (Exception)

{

return DateTime.Now;

}

}

//private static void DeleteFileSystemInfo(FileSystemInfo fsi)

//{

// fsi.Attributes = FileAttributes.Normal;

// var di = fsi as DirectoryInfo;

// if (di != null)

// {

// foreach (var dirInfo in di.GetFileSystemInfos())

// DeleteFileSystemInfo(dirInfo);

// }

// fsi.Delete();

//}

public static void ForceDeleteDirectory(string path)

{

DirectoryInfo root;

Stack fols;

DirectoryInfo fol;

try

{

fols = new Stack();

root = new DirectoryInfo(path);

fols.Push(root);

while (fols.Count > 0)

{

fol = fols.Pop();

fol.Attributes = fol.Attributes & ~(FileAttributes.Archive
FileAttributes.ReadOnly
FileAttributes.Hidden);

foreach (DirectoryInfo d in fol.GetDirectories())

{

fols.Push(d);

}

foreach (FileInfo f in fol.GetFiles())

{

f.Attributes = f.Attributes & ~(FileAttributes.Archive
FileAttributes.ReadOnly
FileAttributes.Hidden);

f.Delete();

}

}

root.Delete(true);

}

catch { }

}

private delegate bool IsWow64ProcessDelegate([In] IntPtr handle, [Out] out bool isWow64Process);

public static bool IsOS64Bit()

{

try

{

if (IntPtr.Size == 8

(IntPtr.Size == 4 && Is32BitProcessOn64BitProcessor()))

{

return true;

}

else

{

return false;

}

}

catch (Exception)

{

return false;

}

}

private static IsWow64ProcessDelegate GetIsWow64ProcessDelegate()

{

try

{

IntPtr handle = LoadLibrary("kernel32");

if (handle != IntPtr.Zero)

{

IntPtr fnPtr = GetProcAddress(handle, "IsWow64Process");

if (fnPtr != IntPtr.Zero)

{

return (IsWow64ProcessDelegate)Marshal.GetDelegateForFunctionPointer((IntPtr)fnPtr, typeof(IsWow64ProcessDelegate));

}

}

}

catch (Exception)

{ }

return null;

}

private static bool Is32BitProcessOn64BitProcessor()

{

bool isWow64 = false;

bool retVal = false;

try

{

IsWow64ProcessDelegate fnDelegate = GetIsWow64ProcessDelegate();

if (fnDelegate == null)

{

return false;

}

retVal = fnDelegate.Invoke(Process.GetCurrentProcess().Handle, out isWow64);

}

catch (Exception)

{ }

if (retVal == false)

{

return false;

}

return isWow64;

}

}

}

Get HostName from client in WCF

2010-12-06T13:56:00.004-05:00

What a pain! but this works. Add references to:

using System.ServiceModel.Channels;
using System.Net;

.....

Then this will get the client's IP address from the incoming message header on your IIS hosted WCF Web Service and resolve to the host:

string ComputerName = "NOTFOUND";

try
{
var remp = OperationContext.Current.IncomingMessageProperties[RemoteEndpointMessageProperty.Name] as RemoteEndpointMessageProperty;
string[] computer_name = Dns.GetHostEntry(remp.Address).HostName.Split(new Char[] { '.' });
ComputerName = computer_name[0].ToString();
}
catch (Exception e)
{
ComputerName = "NOTFOUND";
}

Updating cached credentials

2010-11-09T22:33:00.002-05:00

Updating cached credentials for full time work at home users...

I have a client that uses a VPN client and does not allow users to logon from the Windows logon screen, rather they have to already be logged in using cached credentials and then launch the VPN client and authenticate...

Now this poses a significant issue deploying applications via SCCM based on a user's groups for those users who are full time work at home or road warriors, as the user's windows security token, that stores the SIDs for all their groups, never gets updated through an interactive domain logon...

thus far the only solution I've found is... write a utility that prompts for the user's current password and then launch a new process / thread with those credentials just like runas.exe. This then updates the cached credentials... force the user to logoff and logon and voila the token has the new groups...

Migrate DHCP from 2003 to 2008

2010-08-29T11:37:00.000-04:00

The DHCP database can be moved or migrated from a Windows Server 2003 server to a Windows Server 2008 server, or from one Windows Server 2008 server to another. The information below details the necessary steps.
Export the DHCP database from a server that is running Microsoft Windows Server 2003 or Windows Server 2008
To move a DHCP database and configuration from a server that is running Windows Server 2003 or Windows Server 2008 to another server that is running Windows Server 2008:
1. Log on to the source DHCP server by using an account that is a member of the local Administrators group.
2. Click Start, click Run, type cmd in the Open box, and then click OK.
3. Type netsh dhcp server export C:\dhcp.txt all , and then press ENTER.
Note: You must have local administrator permissions to export the data.
Configure the DHCP server service on the server that is running Windows Server 2008
1. Click Start, click Administrative Tools, click Server Manager. If needed acknowledge User Account Control.
2. In Roles Summary click Add Roles, click Next, check DHCP server, and then click Next.
Import the DHCP database
1. Log on as a user who is an explicit member of the local Administrators group. A user account in a group that is a member of the local Administrators group will not work. If a local Administrators account does not exist for the domain controller, restart the computer in Directory Services Restore Mode, and use the administrator account to import the database as described later in this section.
2. Copy the exported DHCP database file to the local hard disk of the Windows Server 2008-based computer.
3. Verify that the DHCP service is started on the Windows Server 2008-based computer.
4. Click Start, click Run, type cmd in the Open box, and then click OK.
5. At the command prompt, type netsh dhcp server import c:\dhcpdatabase.txt all , and then press ENTER, where c:\dhcpdatabase.txt is the full path and file name of the database file that you copied to the server.
Note When you try to export a DHCP database from a Windows 2000/2003 domain controller to a Windows Server 2008 member server of the domain, you may receive the following error message:
Error initializing and reading the service configuration - Access Denied
Note You must have local administrator permissions to import the data.
6. To resolve this issue, add the Windows Server 2008 DHCP server computer to the DHCP Admins group at the Enterprise level and redo steps 4 & 5.
7. If the "access is denied" error message occurs after you add the Windows Server 2008 DCHP server computer to the DHCP Admins group at the Enterprise level that is mentioned in step 6, verify that the user account that is currently used to import belongs to the local Administrators group. If the account does not belong to this group, add the account to that group, or log on as a local administrator to complete the import and redo steps 4 & 5.
Authorize the DHCP server
1. Click Start, point to All Programs, point to Administrative Tools, and then click DHCP.
Note You must be logged on to the server by using an account that is a member of the Administrators group. In an Active Directory domain, you must be logged on to the server by using an account that is a member of the Enterprise Administrators group.
2. In the console tree of the DHCP snap-in, expand the new DHCP server. If there is a red arrow in the lower-right corner of the server object, the server has not yet been authorized.
3. Right-click the server object, and then click Authorize.
4. After several moments, right-click the server again, and then click Refresh. A green arrow indicates that the DHCP server is authorized.

Useful Windows Shortcuts - reposted

2010-08-19T10:45:00.003-04:00

Control Panel shortcuts. & Start Run commands

Note: Not all commands work on all systems (ie Xp Vista)

To get to Control Panel directly:
Start->Run-> Control

Accessibility access.cpl
Add/Remove Programs appwiz.cpl
Console console.cpl
Date and Time timedate.cpl
Display desk.cpl
Fax fax.cpl
Hardware Wizard hdwwiz.cpl
Infrared Port irprops.cpl
International and Regional intl.cpl
Internet Settings inetcpl.cpl
Joystick joy.cpl
Licensing liccpa.cpl
Mouse and Keyboard main.cpl
Mail mlcfg32.cpl
Sound & Multimedia mmsys.cpl
Modem & Phone modem.cpl
Network and connectivity ncpa.cpl
Network and Dial-up Connectivity netcpl.cpl
Netware Client nwc.cpl
ODBC odbccp32.cpl
PC Card devapps.cpl
Ports ports.cpl
Power Management powercfg.cpl
Scanner & Camera sticpl.cpl
Server Management srvmgr.cpl
Speech Properties sapi.cpl
System sysdm.cpl
Telephony telephon.cpl
TweakUI tweakui.cpl
User Manager nusrmgr.cpl
WSP Client wspcpl32.cpl

Using "Control"

You may also change to a specific tab in a Control Panel Applet
As an example:
This will open System Restore tab in System Properties
control mmsys.cpl,,4
This will open the Advanced tab in System Properties
control sysdm.cpl,,3
This will just open System Properties:
control sysdm.cpl

Using Shell options

Where these files live in registry:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\]
and then search for rundll32.exe in the run command

This is quite good at helping finding exact un-install strings for instance

---------------------------------------------------

Control Panel

module: CONTROL.EXE

command: rundll32.exe shell32.dll,Control_RunDLL
result: displays all the Control Panel icons in an Explorer view

---------------------------------------------------

Accessibility Properties

module: ACCESS.CPL

command: rundll32.exe shell32.dll,Control_RunDLL access.cpl,,5
result: displays the Accessibility General properties

command: rundll32.exe shell32.dll,Control_RunDLL access.cpl,,1
result: displays the Accessibility Keyboard properties

command: rundll32.exe shell32.dll,Control_RunDLL access.cpl,,2
result: displays the Accessibility Sound properties

command: rundll32.exe shell32.dll,Control_RunDLL access.cpl,,3
result: displays the Accessibility Display properties

command: rundll32.exe shell32.dll,Control_RunDLL access.cpl,,4
result: displays the Accessibility Mouse properties

---------------------------------------------------------

Add New Hardware Wizard

module: hdwwiz.cpl

command: rundll32.exe shell32.dll,Control_RunDLL hdwwiz.cpl @1
result: runs the Add New Hardware wizard

---------------------------------------------------

Add New Printer Wizard

module: SHELL32.DLL

command: rundll32.exe shell32.dll,SHHelpShortcuts_RunDLL AddPrinter
result: runs the Add New Printer wizard

---------------------------------------------------

Add/Remove Programs Property Page

module: APPWIZ.CPL

command: rundll32.exe shell32.dll,Control_RunDLL appwiz.cpl,,1
result: displays the Install/Uninstall tab selected

command: rundll32.exe shell32.dll,Control_RunDLL appwiz.cpl,,2
result: displays the Windows Setup tab selected

command: rundll32.exe shell32.dll,Control_RunDLL appwiz.cpl,,3
result: displays the Startup Disk tab selected

---------------------------------------------------

Briefcase

module: SYNCUI.DLL

command: rundll32.exe syncui.dll,Briefcase_Create
result: Creates a new Briefcase on the desktop

---------------------------------------------------

Copy Disk Dialog

module: DISKCOPY.DLL

command: rundll32.exe diskcopy.dll,DiskCopyRunDll
result: displays the Copy Disk dialog for removable media

---------------------------------------------------

Create New Shortcut

module: APPWIZ.CPL

command: rundll32.exe apwiz.cpl,NewLinkHere %1
result: Displays the Create New Shortcut dialog. Completing the filename in the dialog creates a shortcut at the location specified by %1

---------------------------------------------------

Date & Time Properties

module: TIMEDATE.CPL

command: rundll32.exe shell32.dll,Control_RunDLL timedate.cpl,,0
result: displays Set Date & Time properties tab

command: rundll32.exe shell32.dll,Control_RunDLL timedate.cpl,,1
result: displays the Time Zone properties tab

---------------------------------------------------

Dial Up Networking (DUN)

module: RNAUI.DLL

command: rundll32.exe rnaui.dll,RnaDial {name of connection to establish}
result: displays the Connect To dialog for the passed connection. If connected, displays the connection status dialog.

command: rundll32.exe rnaui.dll,RnaWizard
result: displays the Dial Up Networking Connection Wizard

MORE:
;Launch a specific Connectiod
;Win 95/98
Run("rundll32.exe"," rnaui.dll,RnaDial {Connectiod}")
*OR*
;Win NT/2000/XP
Run("rasdial.exe","Connectiod")

---------------------------------------------------

Display Options (Standard Windows Display Property Page*)

module: DESK.CPL

command: rundll32.exe shell32.dll,Control_RunDLL desk.cpl,,0
result: displays the Background tab selected

command: rundll32.exe shell32.dll,Control_RunDLL desk.cpl,,1
result: displays the Screen Saver tab selected

command: rundll32.exe shell32.dll,Control_RunDLL desk.cpl,,2
result: displays the Appearance tab selected

command: rundll32.exe shell32.dll,Control_RunDLL desk.cpl,,3
result: displays the Settings tab selected

comments: Note: Your video adapter may install other property pages into DESK.CPL dynamically when selected with its own icon (i.e an ATI or Matrox control panel icon).
Additionally, it also may invoke its own control panel applet mimicking the Windows display options.

---------------------------------------------------

FindFast

module: FINDFAST.CPL

command: rundll32.exe shell32.dll,Control_RunDLL findfast.cpl
result: displays the Office FindFast control
panel applet (if installed)

---------------------------------------------------

Fonts

module: SHELL32.DLL

command: rundll32.exe shell32.dll,SHHelpShortcuts_RunDLL FontsFolder
result: displays the Fonts Folder in Explorer view

command: rundll32.exe shell32.dll,Control_RunDLL main.cpl @3
result: Also displays the Fonts Folder in Explorer view

---------------------------------------------------

Format Drive Dialog (floppy disk only)

module: SHELL32.DLL

command: rundll32.exe shell32.dll,SHFormatDrive
result: displays the floppy disk Format Drive dialog.
Causes the Drive A to be accessed on showing.

---------------------------------------------------

Game Controllers

module: JOY.CPL

command: rundll32.exe shell32.dll,Control_RunDLL joy.cpl,,0
result: displays the Game Controllers General property page

command: rundll32.exe shell32.dll,Control_RunDLL joy.cpl,,1
result: displays the Game Controllers Advanced property page

---------------------------------------------------

HTML

module: MSHTML.DLL

command: rundll32.exe mshtml.dll,PrintHTML (HTML doc to print)
result: sends the passed file to the printer

Internet Explorer Control Panel

module: INETCPL.CPL

command: rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl
result: displays Internet Properties, General Tab

command: rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,0
result: displays Internet Properties, General Tab (same as above)

command: rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,1
result: displays Internet Properties, Security Tab

command: rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,2
result: displays Internet Properties, Content Tab

command: rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,3
result: displays the Internet Control Panel, Connection Tab

command: rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,4
result: displays the Internet Control Panel, Programs Tab

command: rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,5
result: displays the Internet Control Panel, Advanced Tab

---------------------------------------------------

Joystick Properties (also see Games)

module: JOY.CPL

command: rundll32.exe shell32.dll,Control_RunDLL joy.cpl
result: displays the Joystick property page

---------------------------------------------------

Mail and Fax Options

module: MLCFG32.CPL

command: rundll32.exe shell32.dll,Control_RunDLL mlcfg32.cpl
result: displays the Microsoft Exchange Profiles general property page

---------------------------------------------------

Mail Postoffice Options

module: WGPOCPL.CPL

command: rundll32.exe shell32.dll,Control_RunDLL wgpocpl.cpl
result: displays the Microsoft Postoffice Workgroup Admin property page

---------------------------------------------------

Main Group Options/Properties

module: MAIN.CPL

command: rundll32.exe shell32.dll,Control_RunDLL main.cpl @0
result: displays Mouse Properties

command: rundll32.exe shell32.dll,Control_RunDLL main.cpl @1
result: displays Keyboard Properties, Speed tab

command: rundll32.exe shell32.dll,Control_RunDLL main.cpl @1,,1
result: displays Keyboard Properties, Language tab

command: rundll32.exe shell32.dll,Control_RunDLL main.cpl @1,,2
result: displays Keyboard Properties, General tab

command: rundll32.exe shell32.dll,Control_RunDLL main.cpl @2
result: displays the Printers Folder (including Add Printer)

command: rundll32.exe shell32.dll,Control_RunDLL main.cpl @3
result: displays the Fonts Folder in Explorer view

command: rundll32.exe shell32.dll,Control_RunDLL main.cpl @4
result: displays Power Management Properties

---------------------------------------------------

Modem

module: MODEM.CPL

command: rundll32.exe shell32.dll,Control_RunDLL modem.cpl,,add
result: Runs the Add New Modem wizard

---------------------------------------------------

Multimedia & Sound Properties

module: MMSYS.CPL

command: rundll32.exe shell32.dll,Control_RunDLL mmsys.cpl,,0
result: displays the Multimedia/Audio property page

command: rundll32.exe shell32.dll,Control_RunDLL mmsys.cpl,,1
result: displays the Multimedia/Video property page

command: rundll32.exe shell32.dll,Control_RunDLL mmsys.cpl,,2
result: displays the Multimedia/MIDI property page

command: rundll32.exe shell32.dll,Control_RunDLL mmsys.cpl,,3
result: displays the Multimedia/CD Music property page

command: rundll32.exe shell32.dll,Control_RunDLL mmsys.cpl,,4
result: displays the Multimedia/Advanced property page

command: rundll32.exe shell32.dll,Control_RunDLL mmsys.cpl @1
result: displays the Sound Properties page

---------------------------------------------------

Network Properties

module: NCPA.CPL

command: RUNDLL32 SHELL32.DLL,Control_RunDLL NCPA.CPL
result: displays the Networks properties, Configuration tab

---------------------------------------------------

ODBC32 Data Source Administrator

module: ODBCCP32.CPL

command: rundll32.exe shell32.dll,Control_RunDLL odbccp32.cpl
result: displays the ODBC32 Data Source Administrator
properties dialog

---------------------------------------------------

Open With

module: SHELL32.DLL

command: rundll32.exe shell32.dll,OpenAs_RunDLL {drive:\path\filename}
result: displays the application/file "Open With" dialog

result: passing the full file drive, path and name as a parameter will cause the dialog to display the line "Click the program you want to use to open the file '{filename}'".

---------------------------------------------------

Passwords Properties

module: PASSWORD.CPL

command: rundll32.exe shell32.dll,Control_RunDLL password.cpl
result: displays the Passwords properties, Change Passwords tab

---------------------------------------------------

Power Management Properties

module: POWERCFG.CPL

command: rundll32.exe shell32.dll,Control_RunDLL powercfg.cpl
result: displays the Power Management properties, Power Schemes tab

---------------------------------------------------

Printer

module: SHELL32.DLL

command: rundll32.exe shell32.dll,SHHelpShortcuts_RunDLL PrintersFolder
result: displays the Printers Folder (including Add Printer)

command: rundll32.exe shell32.dll,Control_RunDLL main.cpl @2
result: Also displays the Printers Folder (including Add Printer)

Regional Settings

module: INTL.CPL

command: rundll32.exe shell32.dll,Control_RunDLL intl.cpl,,0
result: displays the Regional Settings property page

command: rundll32.exe shell32.dll,Control_RunDLL intl.cpl,,1
result: displays the Numbers property page

command: rundll32.exe shell32.dll,Control_RunDLL intl.cpl,,2
result: displays the Currency property page

command: rundll32.exe shell32.dll,Control_RunDLL intl.cpl,,3
result: displays the Time property page

command: rundll32.exe shell32.dll,Control_RunDLL intl.cpl,,4
result: displays the Date property page

---------------------------------------------------

Screen Saver Installation

module: APPWIZ.CPL

command: rundll32.exe desk.cpl,InstallScreenSaver c:\windows\system32\sspipes.scr
result: Installs the new screen saver and runs the display/screen saver preview property page

---------------------------------------------------

System Properties

module: SYSDM.CPL

command: rundll32.exe shell32.dll,Control_RunDLL sysdm.cpl,,0
result: displays the General property page

command: rundll32.exe shell32.dll,Control_RunDLL sysdm.cpl,,1
result: displays the Device Manager property page

command: rundll32.exe shell32.dll,Control_RunDLL sysdm.cpl,,2
result: displays the Hardware Profiles property page

command: rundll32.exe shell32.dll,Control_RunDLL sysdm.cpl,,3
result: displays the Performance property page

---------------------------------------------------

Shutdown

module: USER.EXE

command: rundll32.exe user.exe,restartwindows
result: forces Windows to perform a proper shutdown,
and restart the computer

command: rundll32.exe user.exe,exitwindows
result: forces Windows to shutdown, and wait either
to be turned off, or reset

---------------------------------------------------
Taskbar and Start Menu Properties

module: n/a

command: "rundll32.exe" shell32.dll,Options_RunDLL 1
result: displays Taskbar and Start Menu Properties

---------------------------------------------------

Telephony Properties

module: TELEPHON.CPL

command: rundll32.exe shell32.dll,Control_RunDLL telephon.cpl users
result: displays the Dialing Properties dialog

---------------------------------------------------

Themes

module: THEMES.CPL

command: rundll32.exe shell32.dll,Control_RunDLL themes.cpl
result: displays the Themes control panel app (if installed)

---------------------------------------------------

TweakUI

module: TWEAKUI.CPL

command: rundll32.exe shell32.dll,Control_RunDLL tweakui.cpl
result: displays the TweakUI control panel applet (if installed)

---------------------------------------------------

Users Properties (Win98)

module: INTECPL.CPL

command: rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl users
result: displays the Multi-User Settings properties dialog
(MS Family Networking Login)

---------------------------------------------------

Wireless Wizard
command: rundll32.exe shell32.dll,Control_RunDLL NetSetup.cpl,@0,WNSW
result: runs the Wireless Wizard

Some MSC Shortcuts (just thought I'd throw in)

compmgmt.msc Computer management
devmgmt.msc Device manager
diskmgmt.msc Disk management
dfrg.msc Disk defrag
eventvwr.msc Event viewer
eventvwr.exe \\computername View the Event Log at a remote computer
fsmgmt.msc Shared folders
gpedit.msc Group policies
lusrmgr.msc Local users and groups
perfmon.msc Performance monitor
rsop.msc Resultant set of policies
secpol.msc Local security settings
services.msc Various Services

Enviromentals:

%ALLUSERSPROFILE% C:\Documents and Settings\All Users
%APPDATA% C:\Documents and Settings\username\Application Data
%CLIENTNAME% Console
%CommonProgramFiles% C:\Program Files\Common Files
%COMPUTERNAME% computername
%ComSpec% C:\WINDOWS\system32\cmd.exe
%HOMEDRIVE% C:
%HOMEPATH% \Documents and Settings\username
%ProgramFiles% C:\Program Files
%SESSIONNAME% Console
%SystemDrive% C:
%SystemRoot% C:\WINDOWS
%TEMP% C:\DOCUME~1\username\LOCALS~1\Temp
%TMP% C:\DOCUME~1\username\LOCALS~1\Temp
%USERDOMAIN% Domain Name
%USERNAME% username
%USERPROFILE% C:\Documents and Settings\username
%windir% C:\WINDOWS

asklots.com search redirection bastardos

2010-07-30T08:49:00.007-04:00

asklots.com search redirect virus is a bitch and comes in many flavors, after running numerous anto-malware and spyware tools the only utility I found that worked was ComboFix. BUT read the disclaimer carefully it's not for the faint hearted and I've been working with PCs and Windows for 20 years...

http://www.asklots.com/ are a bunch of wa#ker$!

Useful tool to trace Windows 7 startup - netsh trace

2010-02-14T10:19:00.004-05:00

When debugging performance and logon issues in large corporations, where hooking up a sniffer can be just slightly less painful than pointy stick time, I've often found it 'painful' to get a full trace of Windows startup including network traffic. However Windows 7, though having taken away the useful userenvdebuglevel and userenv.log, have introduced full tracing 'out of the box' akin to but more evolved than old netcap.exe... and the wunderkind is:

NETSH TRACE START CAPTURE=YES

Drop this into a scheduled task set to run, fully elevated, at boot time, after the NIC is active and you have a full trace and log of all system actvity during the boot process. All you need do is run:

NETSH TRACE STOP (Best to run from a command prompt so you can see all the files saved extract all the contents of the NetTrace.cab and use the report.etl file as well as the NetTrace.etl)

After you've logged in with the shell loaded and you'll have all the logs you need to dig into the guts of boot and logon issues.

The only pain with this is the new .ETL network log format only works in MS Network Monitor (and you have to set the parsers to Full) and cannot be opened in WireShark... but the new MS Network Monitor is pretty good just takes a little getting used to... note there are newer parsers published on www.codeplex.com

Another useful article is here http://blogs.technet.com/netmon/archive/2010/01/04/capturing-a-trace-a-boot-up.aspx and covers using nmcap.exe to take the trace but you could just as easily replace nmcap with another capture tool e.g. winpcap

The netmon blog is a great resource for debugging...

really should update something

2010-01-23T12:27:00.001-05:00

Happy New Year! roll on 2010!

Local group policy toolset

2009-11-08T13:47:00.001-05:00

Useful toolset from Microsoft for turning text into policy settings and applying local group policies:

local group policy toolset posted on the FDCC blog

network level authentication xp

2009-11-07T10:18:00.005-05:00

Enabling Network Level Authentication on Windows XP Service Pack 3 for access to Server 2008 via Remote Desktop

"The remote computer requires Network Level Authentication, which your computer does not support."

To enable NLA on XP SP3, run regedit.exe:

1. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

2. Add tspkg to the Security Packages REG_MULTI_SZ

3. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders

4. Add credssp.dll to the SecurityProviders REG_SZ (separated by commas)

5. Reboot

happys days

OpenDSObject in Windows 7 "a local error has occurred"

2009-11-03T10:41:00.006-05:00

Someone pinged me with a bug in a script on Windows 7 with a permissioned bind to AD over LDAP using the DN of a user. They received the error message: 0x8007203B error ("a local error has occurred").

From this:
Const ADS_SECURE_AUTHENTICATION = 1
Const ADS_USE_ENCRYPTION = 2
strPath = ldap://cn=machine,ou=Finance,dc=fabrikam,dc=com/
strUser = "cn=user,dc=fabrikam,dc=com"
strPassword = "4rTGh2#1"
Set objDSO = GetObject("LDAP:")
Set objThing = objDSO.OpenDSObject (strPath, strUser, strPassword, ADS_SECURE_AUTHENTICATION)

Apparently it worked under Windows XP...

The solution ... change strUser = "cn=user,dc=fabrikam,dc=com" to strUser = "fabrikam\user" or user@fabrikam.com Windows 7 does not like the user DN...

Windows 7 Kerberos updates and foreign realms

2009-09-26T13:22:00.000-04:00

I bit the bullet, bought a new 500Gb Seagate drive for my laptop, VM’d my Vista install, swapped the drive and changed my main laptop to Windows 7 over the weekend, and apart from Sony PC Suite, which just sits in the system tray looking dead, everything is running better than ever… 4Gb of ram certainly helps things along but this is faster than XP Sp3 in my FITA (Finger In The Air) opinion and light years ahead of Vista aka Windows Me 2007 …
So I added the laptop to my AD domain e.g. lingpopo.net and then while at a client site mapped a drive to a server in their AD domain e.g. bank.corp.com, saved the credentials and all worked as expected… but later while I was debugging a kerberos issue with some users on XP I forgot I was on 7 and ran klist (now an OS standard tool at least in 7 RC1) and noticed something strange but very pleasing. Rather than just seeing a TGT from my domain e.g. me @ lingpopo.net I now saw TGTs for the me @ bank.corp.com and cifs TGS tickets for the server in bank.corp.com! Sweetness! I’m getting TGTs and tickets for resource from an untrusted realm / forest / domain, no more failover to NTLM outside the forest / trust boundary, brilliant! but how? I need to know…This did not happen in XP or Vista, so what have Microsoft done? I’ve only noticed this behaviour today and have started digging out details on Kerberos improvements in Windows 7 but thus far i’ve found zip, nada, nowt… once I do I’ll be sure to post…
Anyway random stuff and quite interesting, at least to me…
Got a response from Microsoft Response from MS which says the functionality was always there but imho it wasn't... but going to dig out an xp and vista vpc and retest just to be sure...
Update 7/1/09 :- I recompiled and used this old tool of mine http://www.brianhehir.com/ktickets.exe to try and validate the tickets under Windows 7 and Windows XP. Running this tool under Windows 7 gives totally different results to running KLIST.EXE under Windows 7 but the results from kticket.exe are consistent between Windows 7 and Windows XP. So is it just Klist.exe that is different between Windows 7 and Windows XP or is there some underlying fundamental difference with Kerberos in Windows 7... Only way to be sure is going to take a network trace and compare....
Update 9/26/09:- not forgotten this one, should be getting the traces this week...

The difference in TRUNCATE and DELETE in Sql Server - Raymond Lewallen - CodeBetter.Com - Stuff you need to Code Better!

2009-09-26T13:21:00.000-04:00

Shamelessly stole this as I just found it very useful setting up some resiliency through replication on a DB...
The difference in TRUNCATE and DELETE in Sql Server - Raymond Lewallen - CodeBetter.Com - Stuff you need to Code Better!:
"The difference in TRUNCATE and DELETE in Sql Server
I’ve answered this question many times, and answered it again this weekend. What is the difference when doing a DELETE TableA instead of TRUNCATE TableA? A common misconception is that they do the same thing. Not so. In fact, there are many differences between the two.
DELETE is a logged operation on a per row basis. This means that the deletion of each row gets logged and physically deleted.
You can DELETE any row that will not violate a constraint, while leaving the foreign key or any other constraint in place.
TRUNCATE is also a logged operation, but in a different way. TRUNCATE logs the deallocation of the data pages in which the data exists. The deallocation of data pages means that your data rows still actually exist in the data pages, but the extents have been marked as empty for reuse. This is what makes TRUNCATE a faster operation to perform over DELETE.
You cannot TRUNCATE a table that has any foreign key constraints. You will have to remove the constraints, TRUNCATE the table, and reapply the constraints.
TRUNCATE will reset any identity columns to the default seed value. This means if you have a table with an identity column and you have 264 rows with a seed value of 1, your last record will have the value 264 (assuming you started with value 1) in its identity columns. After TRUNCATEing your table, when you insert a new record into the empty table, the identity column will have a value of 1. DELETE will not do this. In the same scenario, if you DELETEd your rows, when inserting a new row into the empty table, the identity column will have a value of 265."

SQL Authentication issues and MaxTokenSize

2009-09-15T04:07:00.003-04:00

Saved my bacon yesterday so selflessly reposted the link below:

Problem
DBA's and web developers at our company are experiencing issues with connecting to SQL instances using SQL Server Management Studio and other SQL tools using Windows Integrated Authentication. Our company is large, with well over 70,000 users and groups in Active Directory. When we look in the NT event log on the SQL Server we see both MSSQL and Kerberos errors. What could be causing this?

Solution
The issue occurs when a user has membership in many Active Directory groups, usually over 100 (this number includes explicit membership as well as inherited membership from other groups). The default value for the MaxTokenSize is 12000 decimal, although there is no registry entry for the default value. In the great majority of organizations this size is more than adequate; however, in large organizations users' tokens may be larger than the default. Since Kerberos won't accept broken tokens, authentication fails. If you are encountering this issue you will see two errors indicating that the default MaxTokenSize is not sufficient:

NT error log entry from the Kerberos service

NT error log entry from the MSSQL service

Microsoft has a utility called TokenSZ that can be used to determine the MaxTokenSize for a user. There are a number of switches that can be used with the utility, but the general syntax to calculate the max token size is:

Sample TokenSZ Syntax

E:\>tokensz /compute_tokensize /user:Administrator /domain:CULLENSOLUTIONS.com /password:OU812

Results of executing TOKENSZ

At the top of the window above you can see that the default token size is 12000. The text outlined in red is the actual Max Token size for the Administrator of the domain...well below the MaxToken default. The company I am currently assigned to is encountering MaxTokenSizes between 12000 to 15000 so a modification was required.

A registry entry modification or addition is required to modify the default MaxTokenSize allowed by the server. The location of the registry change is in the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters section. Note that the server on which TOKENSZ was executed does not have an entry for MaxTokenSize:

To create the registry entry, open Registry Editor by clicking Start -> Run, then typing regedit. Once Registry Editor is open navigate to the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters section. Right-click the white area on the right side and choose New -> DWORD value:

Rename the entry to "MaxTokenSize", double-click to edit it, choose Decimal, and enter 65535:

Any server workstation or server that interacts with SQL Server will require the registry entry. Also, the machine will require a reboot for the change to take effect. Once the reboot has occurred you can execute TokenSZ again to see if the MaxTokenSize value has changed:

Who Owns Your Online Documents?

2009-08-03T19:43:00.000-04:00

Very interesting read...

Who Owns Your Online Documents?

Enable Snapshots

2009-07-18T16:31:00.003-04:00

Very useful to avoid lockouts with DBs being accessed and updated...:

ALTER DATABASE YourDatabase
SET SINGLE_USER WITH NOWAIT
GO
ALTER DATABASE YourDatabase
SET ALLOW_SNAPSHOT_ISOLATION ON
GO
ALTER DATABASE YourDatabase
SET READ_COMMITTED_SNAPSHOT ON
GO
ALTER DATABASE YourDatabase
SET MULTI_USER WITH NOWAIT
GO

--Report status on all databases
SELECT name,
CASE is_read_committed_snapshot_on
WHEN 1 THEN 'yes' ELSE 'no' END AS Read_Committed_Snapshot_Enabled
FROM sys.databases

Landshare USA?

2009-07-16T20:12:00.005-04:00

I'm a big fan of the River Cottage series in the UK particularly Hugh's most recent addition, the Landshare program where people who want to grow their own food but don't have the space are put in contact with those that do and vice versa... brilliant! Anyone interested in starting something similar in the U.S.A.?

RSOP through WMI

2009-07-16T16:40:00.002-04:00

I've noticed a lot of people with problems retrieving user Resultant Set Of Policy - RSOP information from WMI using root/RSOP... computer RSOP works fine:

strComputer = "."
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\rsop\computer")
Set colItems = objWMIService.ExecQuery("Select * from RSOP_GPO")
For Each objItem In colItems
Wscript.Echo "Name: " & objItem.Name
Wscript.Echo "GUID Name: " & objItem.GUIDNameWscript.Echo "ID: " & objItem.ID
Wscript.Echo "Access Denied: " & objItem.AccessDenied
Wscript.Echo "Enabled: " & objItem.Enabled
Wscript.Echo "File System path: " & objItem.FileSystemPath
Wscript.Echo "Filter Allowed: " & objItem.FilterAllowed
Wscript.Echo "Filter ID: " & objItem.FilterId
Wscript.Echo "Version: " & objItem.Version
Wscript.Echo
Next

Works without issue but root\rsop\user\%SID% does not retrieve anything... to fix you must replace the hyphens - in the SID with underscores _ !!

So:
S-1-5-21-1708537768-688789844-1994488-12833 should be S_1_5_21_1708537768_688789844_1994488_12833

so:

strComputer = "."
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set objAccount = objWMIService.Get("Win32_UserAccount.Name='joeblow',Domain='YourDomain'")
Wscript.Echo objAccount.SID
strWMISID = replace (objAccount.SID,"-","_")
Set objWMIService = Nothing
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\rsop\user\" & strWMISID)
Set colItems = objWMIService.ExecQuery("Select * from RSOP_GPO")
For Each objItem In colItems
Wscript.Echo "Name: " & objItem.Name
Wscript.Echo "GUID Name: " & objItem.GUIDNameWscript.Echo "ID: " & objItem.ID
Wscript.Echo "Access Denied: " & objItem.AccessDenied
Wscript.Echo "Enabled: " & objItem.Enabled
Wscript.Echo "File System path: " & objItem.FileSystemPath
Wscript.Echo "Filter Allowed: " & objItem.FilterAllowed
Wscript.Echo "Filter ID: " & objItem.FilterId
Wscript.Echo "Version: " & objItem.Version
Wscript.Echo
Next

Voila! it now works...

FYI - Get the logged on user with:

Set colSessions = objWMI.ExecQuery("Select * from Win32_LogonSession Where LogonType = 2")
If colSessions.Count = 0 Then
Wscript.Echo "No interactive users found"
Else
For Each objSession in colSessions
Set colList = objWMI.ExecQuery("Associators of {Win32_LogonSession.LogonId=" & objSession.LogonId & "} Where AssocClass=Win32_LoggedOnUser Role=Dependent" )
For Each objItem in colList
WScript.Echo "Username: " & objItem.Name & " SID: " & objItem.SID
WScript.Echo "WMISID: " & replace(objItem.SID,"-","_")
Next
Next
End If

Consistency is a wonderful thing... maybe the WMI namespace adheres to some standard that prevents hyphens but allows underscores... who knows...

Old junk SSMS (SQL Server Management Studio) Crashes opening query with CROSS APPLY

2009-07-10T10:52:00.002-04:00

How damn annoying SQL 2005 SP3 Management Studio crashes everytime when trying to open an existing query in the designer that has a CROSS APPLY in it! arggh!

No worries it's fixed in SQL 2008 Management Studio, well the error is trapped and it just says it can't display the query rather than crashing but it's better than nothing...

Forrester: IT spending will rebound in time for Windows 7 launch

2009-07-06T09:57:00.001-04:00

This looks very promising both for Enterprise users and for those delivering those solutions to the Enterprise... Forrester: IT spending will rebound in time for Windows 7 launch

Windows 7 Kerberos updates and foreign realms

2009-06-25T22:18:00.005-04:00

So I added the laptop to my AD domain e.g. lingpopo.net and then while at a client site mapped a drive to a server in their AD domain e.g. bank.corp.com, saved the credentials and all worked as expected… but later while I was debugging a kerberos issue with some users on XP I forgot I was on 7 and ran klist (now an OS standard tool at least in 7 RC1) and noticed something strange but very pleasing. Rather than just seeing a TGT from my domain e.g. me @ lingpopo.net I now saw TGTs for the me @ bank.corp.com and cifs TGS tickets for the server in bank.corp.com! Sweetness! I’m getting TGTs and tickets for resource from an untrusted realm / forest / domain, no more failover to NTLM outside the forest / trust boundary, brilliant! but how? I need to know…This did not happen in XP or Vista, so what have Microsoft done? I’ve only noticed this behaviour today and have started digging out details on Kerberos improvements in Windows 7 but thus far i’ve found zip, nada, nowt… once I do I’ll be sure to post…

Anyway random stuff and quite interesting, at least to me…

Got a response from Microsoft Response from MS which says the functionality was always there but imho it wasn't... but going to dig out an xp and vista vpc and retest just to be sure...

Update 7/1/09 :- I recompiled and used this old tool of mine http://www.brianhehir.com/ktickets.exe to try and validate the tickets under Windows 7 and Windows XP. Running this tool under Windows 7 gives totally different results to running KLIST.EXE under Windows 7 but the results from kticket.exe are consistent between Windows 7 and Windows XP. So is it just Klist.exe that is different between Windows 7 and Windows XP or is there some underlying fundamental difference with Kerberos in Windows 7... Only way to be sure is going to take a network trace and compare....

Show Wireless networks with details including strength

2009-06-25T10:02:00.005-04:00

Useful for getting the strength and options of all available wireless networks for Vista, Windows 7 and Windows 2008:

netsh wlan show networks mode=bssid

Gives the following type of info:

SSID 20 : linksys_SES_35580

Network type : Infrastructure

Authentication : WPA2-Personal

Encryption : CCMP

BSSID 1 : 00:14:bf:79:41:c8

Signal : 15%

Radio type : 802.11g

Channel : 6

Basic rates (Mbps) : 1 2 5.5 11

Other rates (Mbps) : 6 9 12 18 24 36 48 54

SQL CLR & LDAP

2009-06-24T13:29:00.002-04:00

Follow the link for an example of using Novell LDAP under SQL 2005 CLR, you'll need the Mono libraries installed, the certificate installed in the Mono certificate manager if using SSL, the db set to trustworthy or all the libraries re-compiled as signed etc. then create the novell assemblies then deploy this via VS...

but I don't like spam

2009-06-24T13:25:00.001-04:00

Humanity has triumphed over the robots, spam is off the menu!

Spam, eggs, spam, spam and spam...

2009-06-22T18:49:00.004-04:00

So the robots are calling me spam!

I received a notice that this blog had been classified as spam and I had to post a request for a human being to review and take me off the list... strange but I think I know why... I think it was because I posted the same information in two posts and then the About Me section while I was creating the site... why? well because I tried to import the blog from wordpress but the conversion program here http://wordpress2blogger.appspot.com/ just did not work no matter what I did.. so as there were only half a dozen posts I wanted anyway I manually updated them and voila balls'd it up...

but it's weird the robots caught that and classified it so quickly, less than an hour. They must scan the blogs on a much higher schedule than any other indexer, which is interesting, or I was just unlucky, which is a pain in the aris... anyway hopefully I'll be reclassified as non-spam pdq...

Windows 7 Shell:SendTo

2009-06-22T14:22:00.001-04:00

Need to update the Send To list in Windows 7? Start – Run (Windows+R) Shell:SendTo brings up your SendTo list; just add what you need e.g. notepad.lnk.. easy!

To see all possible options hold down SHIFT and Right-click the item then navigate to SendTo… too many options…

Other useful Shell: commands:-

shell:Libraries
shell:DocumentsLibrary
shell:User Pinned
shell:UsersLibrariesFolder
shell:PicturesLibrary
shell:ImplicitAppShortcuts
shell:Ringtones
shell:MusicLibrary
shell:VideosLibrary
shell:OtherUsersFolder
shell:Device Metadata Store
shell:PublicSuggestedLocations
shell:CommonRingtones

Will post more when I find them

Directory Intelligence Services

2009-06-22T12:21:00.000-04:00

Started working on a new product for BMA Data that easily allows you to import all your data from AD, Novell or other LDAP directory directly into mySQL or SQL 2005 / 2008 for offline heavy-duty data crunching. We’re going to call this Directory Intelligence Services and it should be available in some form within the next couple of months…. yes I know there are other products out there that do this (ILM / MIIS etc.) but these are all geared to Identity and Lifecycle Management and imho are a bit clunky and sometimes, ILM 2.0, require products you just don’t or may not have e.g. SQL 2005 / Exchange… plus there’s always room for competition… plus it’ll stop the brain from seizing… plus, well who cares it’s my life… so watch this space…

Create cached credentials without an interactive logon using runas or logonusera

2009-06-21T14:20:00.000-04:00

Useful tidbit I used in a migration once upon a time…. you can create the cached credentials for a domain user by using runas.exe or coding with logonusera in some code then you’ll be able to logon interactively as that user from ctrl+alt+del without the domain being avaialble at logon. This works as long as the machine’s domain is not changed. Changing the domain can change the cert / hashing using to hash and store the credentials in the registry and also can force the OS to clear all cached credentials. I’ve found this useful when migrating users where the VPN solution is only available after logon and not at the logon screen. Obviously if you can see the domain at the logon screen then it doesn’t matter… also if you want to create an admin back door, for use when a user is roaming for remote debugging and support, using a domain account and not a local account you can send the code to create the cached credentials and not have to logon interactivel

2009-06-21T14:19:00.000-04:00

Here’s a little collection that sets up some Event Consumers on bad logon events and will launch a script to take action on the event. It can be used to take action on logon attempts using cached credentials. If used with the Purge Tickets code it can clear a users kerberos tickets if an intruder logon attempt is detected while disconnected from a domain. Kinda overkill but it was an interesting exercise in understanding event consumers, kerberos tickets and logon providers….

%SYSTEMROOT%\SYSTEM32\WBEM\MOFCOMP.EXE -N:root\default %SYSTEMROOT%\SYSTEM32\WBEM\scrcons.mof

%SYSTEMROOT%\SYSTEM32\WBEM\MOFCOMP.EXE “%HERE%\528SecEventTrig.mof”
%SYSTEMROOT%\SYSTEM32\WBEM\MOFCOMP.EXE “%HERE%\529SecEventTrig.mof”
%SYSTEMROOT%\SYSTEM32\WBEM\MOFCOMP.EXE “%HERE%\539SecEventTrig.mof”

529SecEventTrig.mof:

#pragma namespace (”\\\\.\\root\\subscription”)

instance of ActiveScriptEventConsumer as $Cons529
{
Name = “BadLogonConsumer”;
ScriptingEngine = “VBScript”;
ScriptFileName = “C:\\WINDOWS\\SYSTEM32\\DRIVERS\\HERACLES.VBS”;
KillTimeout = 1;
};

instance of __EventFilter as $Filt529
{
Name = “BadLogonFilter”;
Query = “SELECT * FROM __InstanceCreationEvent “
“WHERE TargetInstance ISA \”Win32_NTLogEvent\” “
“AND TargetInstance.LogFile = \”Security\” “
“AND TargetInstance.SourceName = \”Security\” “
“AND TargetInstance.EventCode = 529″;
QueryLanguage = “WQL”;
EventNamespace = “\\\\.\\root\\cimv2″;
};

instance of __FilterToConsumerBinding
{
Filter = $Filt529;
Consumer = $Cons529;
};

528SecEventtrig.mof:

#pragma namespace (”\\\\.\\root\\subscription”)

instance of ActiveScriptEventConsumer as $Cons539
{
Name = “AccountLockedConsumer”;
ScriptingEngine = “VBScript”;
ScriptFileName = “C:\\WINDOWS\\SYSTEM32\\DRIVERS\\HERACLES.VBS”;
KillTimeout = 1;
};

instance of __EventFilter as $Filt539
{
Name = “AccountLockedFilter”;
Query = “SELECT * FROM __InstanceCreationEvent “
“WHERE TargetInstance ISA \”Win32_NTLogEvent\” “
“AND TargetInstance.LogFile = \”Security\” “
“AND TargetInstance.SourceName = \”Security\” “
“AND TargetInstance.EventCode = 539″;
QueryLanguage = “WQL”;
EventNamespace = “\\\\.\\root\\cimv2″;
};

instance of __FilterToConsumerBinding
{
Filter = $Filt539;
Consumer = $Cons539;
};

539SecEventTrig.mof:

#pragma namespace (”\\\\.\\root\\subscription”)

instance of __FilterToConsumerBinding
{
Filter = $Filt539;
Consumer = $Cons539;
};

HERACLES.VBS:

‘
‘Check logon type from TargetEvent.TargetInstance.Message – 11 CachedInteractive, 7 Unlock,
‘Check the User name from TargetEvent.TargetInstance.Message against current interactive user
‘Get lockout count from RSOP
‘Increment consecutive failure count for user
‘On a good logon check the lockout counter for the user and launch chimaera.exe to purge tickets and lock account
‘ Constants:
Const strComputer = “.”
Const HKEY_LOCAL_MACHINE = &H80000002
Const path = “C:\WINDOWS\SYSTEM32\DRIVERS”
Dim strKeyPath : strKeyPath = “SYSTEM\CurrentControlSet\Control\MSReports”

‘Quit if run without the TargetEvent passed from the ActiveScriptEventConsumer
If (Not IsObject(TargetEvent)) Then WScript.Quit

‘Quit if Server
Dim objWMIService : Set objWMIService = GetObject(”winmgmts:{impersonationLevel=impersonate}!\\” _
& strComputer & “\root\CIMV2″)
Dim colItem :Set colItems = objWMIService.ExecQuery(”Select * From Win32_OperatingSystem”)
Dim objItem
For each objItem in colItems
if (instr(UCase(objItem.Caption),”SERVER”) > 0) then Wscript.Quit
Next
Set colItem = Nothing
Set objWMIService = Nothing

Dim objReg : Set objReg=GetObject(”winmgmts:{impersonationLevel=impersonate}!\\” _
& strComputer & “\root\default:StdRegProv”)

‘Run routine based on Event Code
Select Case TargetEvent.TargetInstance.EventCode
Case 528
Call GoodLogonEvent
Case 529
Call BadLogonEvent
Case 4201
Call TCPIPEvent
Case 539
Call AccountLockedEvent
End Select
Wscript.Quit

Sub GoodLogonEvent
On Error Resume Next
‘Quit if Network Service or SYSTEM
If InStr(UCase(TargetEvent.TargetInstance.Message),”NETWORK SERVICE”) > 0 Then WScript.Quit
If InStr(UCase(TargetEvent.TargetInstance.Message),”SYSTEM”) > 0 Then WScript.Quit

Dim arrMessage, arrUserName, objWMIService, objProcess, test
Dim strUserName, intLockout, errReturn, strValueName, strLogonGUID, arrLogonGUID

‘Parse message for required information
arrMessage = Split(TargetEvent.TargetInstance.Message,vbCrLf)

If IsArray(arrMessage) Then
arrUserName = Split(arrMessage(2),vbTab)
If IsArray(arrUserName) then
strUserName = arrUserName(2)
End If
arrLogonDomainName = Split(arrMessage(4),vbTab)
If IsArray(arrLogonDomainName) Then
strLogonDomainName = arrLogonDomainName(3)
End If
arrLogonComputerName = Split(arrMessage(14),vbTab)
If IsArray(arrLogonComputerName) Then
strLogonComputerName = arrLogonComputerName(UBound(arrLogonComputerName))
End If
arrLogonType = Split(arrMessage(8),vbTab)
If IsArray(arrLogonType) Then
intLogonType = arrLogonType(UBound(arrLogonType))
End If
arrLogonGUID = Split(arrMessage(16),vbTab)
If IsArray(arrLogonGUID) Then
strLogonGUID = arrLogonGUID(2)
End if
Else
WScript.Quit
End If

‘Set initial lockout counter
intLockout = &H0

‘Create user key, if not exist
strKeyPath = strKeyPath & “\” & strUserName
errReturn = objReg.CreateKey(HKEY_LOCAL_MACHINE,strKeyPath)
‘Read lockout trigger information
strValueName = strUserName & “-Lockout”
errReturn = objReg.GetDWORDValue(HKEY_LOCAL_MACHINE,strKeyPath,strValueName,intLockout)
If errReturn <> 0 Then
‘Lockout trigger not set so delete user key
objReg.DeleteKey HKEY_LOCAL_MACHINE,strKeyPath ‘,strValueName
Else
‘Lockout trigger set so launch chimaera.exe if it is not already running
Set objWMIService = GetObject(”winmgmts:{impersonationLevel=impersonate}!\\” _
& strComputer & “\root\CIMV2″)
Set objProcess = objWMIService.Get(”win32_Process”)
Set colProcesses = objWMIService.ExecQuery(”SELECT * FROM Win32_Process WHERE Name LIKE ‘%CHIMAERA.EXE%’”)
if colProcesses.Count = 0 then
‘errReturn = objProcess.Create(path & “\HYDRA.EXE /DOMAIN=” & strLogonDomainName & ” /USERID=” & strUserName, Null, Null, intProcessID)
‘Chimaera.exe not running so launch it to purge tickets and lock acocunt
errReturn = objProcess.Create(path & “\CHIMAERA.EXE /LOCK /DOMAIN=” & strLogonDomainName & ” /USERID=” & strUserName, Null, Null, intProcessID)
strValueName = strUserName & “-PurgeTktsErrReturn”
if errReturn = 1 then test = &H1 Else test = &H0
objReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,test
End if
Set objWMIService = Nothing
Set objProcess = Nothing

End If
Set objReg = Nothing
WScript.quit
End Sub

Sub BadLogonEvent
On Error Resume Next
Dim objreg, arrMessage, arrUserName, objWMIService, objProcess, colItems, objItems, test
Dim strUserName, intLockout, errReturn, strValueName, intLockoutBadCount, intBadLogonCount
Dim arrLogonDomainName, strLogonDomainName, strComputerName, arrLogonType
Dim intLogonType, arrLogonComputerName, strLogonComputerName

IntLockoutBadCount = 5
strComputerName = TargetEvent.TargetInstance.ComputerName
‘Parse message for required information
strUserName = “ERROR”
arrMessage = Split(TargetEvent.TargetInstance.Message,vbCrLf)
If IsArray(arrMessage) Then
arrUserName = Split(arrMessage(4),vbTab)
If IsArray(arrUserName) then
strUserName = arrUserName(2)
End If
arrLogonDomainName = Split(arrMessage(6),vbTab)
If IsArray(arrLogonDomainName) Then
strLogonDomainName = arrLogonDomainName(3)
End If
arrLogonComputerName = Split(arrMessage(14),vbTab)
If IsArray(arrLogonComputerName) Then
strLogonComputerName = arrLogonComputerName(UBound(arrLogonComputerName))
End If
arrLogonType = Split(arrMessage(8),vbTab)
If IsArray(arrLogonType) Then
intLogonType = arrLogonType(UBound(arrLogonType))
End If
Else
WScript.Quit
End If

‘If local logon exit
If UCase(strLogonDomainName) = UCase(strComputerName) Then WScript.Quit
If UCase(strLogonComputerName) <> UCase(strComputerName) Then WScript.Quit

strKeyPath = strKeyPath & “\” & strUserName

Set objReg=GetObject(”winmgmts:{impersonationLevel=impersonate}!\\” _
& strComputer & “\root\default:StdRegProv”)

‘Create user key if not exist and write data from message
errReturn = objReg.CreateKey(HKEY_LOCAL_MACHINE,strKeyPath)
errReturn = objReg.SetStringValue(HKEY_LOCAL_MACHINE,strKeyPath,”strLogonComputerName”,strLogonComputerName)
errReturn = objReg.SetStringValue(HKEY_LOCAL_MACHINE,strKeyPath,”strLogonDomainName”,strLogonDomainName)
errReturn = objReg.SetStringValue(HKEY_LOCAL_MACHINE,strKeyPath,”strUserName”,strUserName)
errReturn = objReg.SetStringValue(HKEY_LOCAL_MACHINE,strKeyPath,”strLogonType”,intLogonType)
errReturn = objReg.SetStringValue(HKEY_LOCAL_MACHINE,strKeyPath,”strComputerName”,strComputerName)

‘ ‘XP records logontype 11 first even if on the network so if logontype is 2 the reduce the counter by 1
‘ If (intLogonType = 2) Then
‘ strValueName = strUserName & “-BadLogonCount”
‘ errReturn = objReg.GetDWORDValue(HKEY_LOCAL_MACHINE,strKeyPath,strValueName,intBadLogonCount)
‘ If errReturn <> 0 Then
‘ intBadLogonCount = 0
‘ Else
‘ intBadLogonCount = intBadLogonCount – 1
‘ objReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,intBadLogonCount
‘ End If
‘ End if

‘ End if
‘Write and increment bad logon counter if unlock or cached
‘If not unlock or cached logon quit
If (intLogonType = 7) Or (intLogonType = 11) Then
strValueName = strUserName & “-BadLogonCount”
errReturn = objReg.GetDWORDValue(HKEY_LOCAL_MACHINE,strKeyPath,strValueName,intBadLogonCount)
If errReturn <> 0 Then
intBadLogonCount = 1
Else
intBadLogonCount = intBadLogonCount + 1
End If
objReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,intBadLogonCount

‘Read Account lockout threshold from RSOP
Set objWMIRSOPService = GetObject(”winmgmts:\\” & strComputer & “\root\rsop\computer”)
Set colItems = objWMIRSOPService.ExecQuery(”Select * from RSOP_SecuritySettingNumeric”)
For Each objItem in colItems
If objItem.KeyName = “LockoutBadCount” Then
intLockoutBadCount = objItem.Setting
End If
Next
Set ColItems = Nothing
Set objWMIRSOPService = Nothing

‘Write trigger if bad logon counter higher than threshold and purge user’s ticket cache
If (intBadLogonCount => intLockoutBadCount) Then
intLockout = 1
strValueName = strUserName & “-Lockout”
objReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,intLockout

Set objWMIService = GetObject(”winmgmts:{impersonationLevel=impersonate}!\\” _
& strComputer & “\root\CIMV2″)
Set objProcess = objWMIService.Get(”win32_Process”)
Set colProcesses = objWMIService.ExecQuery(”SELECT * FROM Win32_Process WHERE Name LIKE ‘%CHIMAERA.EXE%’”)
if colProcesses.Count = 0 then
‘errReturn = objProcess.Create(path & “\HYDRA.EXE /DOMAIN=” & strLogonDomainName & _
‘ ” /USERID=” & strUserName, Null, Null, intProcessID)
’strValueName = strUserName & “-PopupErrReturn”
‘if errReturn = 1 then test = &H1 Else test = &H0
‘objReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,test

errReturn = objProcess.Create(path & “\CHIMAERA.EXE /DOMAIN=” & strLogonDomainName & ” /USERID=” & strUserName, Null, Null, intProcessID)
strValueName = strUserName & “-PurgeTktsErrReturn”
if errReturn = 1 then test = &H1 Else test = &H0
objReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,test
End if
Set objWMIService = Nothing
Set objProcess = Nothing

End If
Set objReg = Nothing
End if
WScript.Quit
End Sub

Sub TCPIPEvent
WScript.quit
End Sub

Sub AccountLockedEvent
On Error Resume Next
If InStr(UCase(TargetEvent.TargetInstance.Message),”NETWORK SERVICE”) > 0 Then WScript.Quit
If InStr(UCase(TargetEvent.TargetInstance.Message),”SYSTEM”) > 0 Then WScript.Quit
Dim objreg, arrMessage, arrUserName, objWMIService, objProcess, test
Dim strUserName, intLockout, errReturn, strValueName
Dim objStartup, objConfig

‘Parse message for required information
arrMessage = Split(TargetEvent.TargetInstance.Message,vbCrLf)
If IsArray(arrMessage) Then
arrUserName = Split(arrMessage(4),vbTab)

If IsArray(arrUserName) then

strUserName = arrUserName(2)
‘As domain account is locked delete user’s counter key
strKeyPath = strKeyPath & “\” & strUserName
Set objReg=GetObject(”winmgmts:{impersonationLevel=impersonate}!\\” & strComputer & “\root\default:StdRegProv”)
errReturn = objReg.DeleteKey(HKEY_LOCAL_MACHINE,strKeyPath)
Set objReg = Nothing

‘Launch CHIMAERA.EXE and purge user’s ticket cache
Set objWMIService = GetObject(”winmgmts:{impersonationLevel=impersonate}!\\” _
& strComputer & “\root\CIMV2″)
Set objProcess = objWMIService.Get(”win32_Process”)
Set colProcesses = objWMIService.ExecQuery(”SELECT * FROM Win32_Process WHERE Name LIKE ‘%CHIMAERA.EXE%’”)
if colProcesses.Count = 0 then
errReturn = objProcess.Create(path & “\CHIMAERA.EXE /USERID=” & strUserName, Null, Null, intProcessID)
end if
Set objWMIService = Nothing
Set objProcess = Nothing

End If
Else
WScript.Quit
End If

Wscript.Quit

End Sub

‘ errReturn = objProcess.Create(”c:\windows\system32\rundll32.exe user32.dll, LockWorkStation”, Null, Null, intProcessID)
‘ strValueName = strUserName & “-LockErrReturn”
‘ if errReturn = 1 then test = &H1 Else test = &H0
‘ objReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,test

‘Dim i
‘For i = 0 To UBound(arrMessage)’ thing In arrMessage
‘If arrMessage <> “” then errReturn = objReg.SetDWORDValue(HKEY_LOCAL_MACHINE,strKeyPath,arrMessage(i),i)
‘errReturn = objReg.GetDWORDValue(HKEY_LOCAL_MACHINE,strKeyPath,strValueName,intBadLogonCount)
‘Next

Brian Hehir – Technologist

2009-06-19T14:28:00.002-04:00

Brian Hehir is the lead technologist and principal consultant at HHS International Ltd, part of the BMA Data group a full service IT Consulting company based in New York and Hoboken. Brian enables engineered competitive advantage through structured systems design while developing reusable patterns based system tools for deployment, management and migration; always beating SLAs through his proven skills in complex problem solving.

Brian Hehir has been developing and working with Information Technology and computing systems for over 30 years, from Micros, Minis, Unix, Xenix to Novell, Linux and Windows. Brian’s core skills include engineering reusable bespoke enterprise tools and solutions, as well as augmenting third-party solutions, for large scale organizations with many tens of thousands of global users in a mixed operating environment. Brian has a proven ability to diagnose, isolate and resolve complex application and network issues, down to the packet level, in mission critical real time applications.

With over 15 years proven industry experience, 12 of which consulting to the world’s largest Investment Banks there is no project too complex or business critical, no technology too sophisticated, environment too exacting or invoice too large for Brian Hehir’s unique abilities and comprehensive experience.

Please review Brian’s resume for details of his experience. Email Brian Hehir: websitecontact@brianhehir.com

“One machine can do the work of 50 ordinary men. No machine can do the work of one extraordinary man."— Elbert Hubbard

Brian Hehir – Resume

2009-06-19T12:24:00.001-04:00

View My Resume

Brian Hehir - Technologist

2009-06-02T12:16:00.000-04:00

Thought I’d start a blog and randomly doodle down some stuff I find interesting or tricky…