Tips

Saved Windows Credentials on Windows 7 Home Premium

Miguel Garrido — Sat, 30 Jan 2010 17:04:02 GMT

The problem

I have a few Windows 7 Home Premium machines at home which I network together. I don’t use HomeGroups yet, and may not in the near future but I do keep some resources on the network that each machine has to access. Windows 7 Home Premium (and lower) does not remember credentials for other Windows machines (if you click the “Remember this password” checkbox in many authentication dialogs, Windows will not remember them and re-use them on next logon) so this becomes a problem when you are using service accounts to access shared media across machines (I don’t have an Active Directory domain at home).

The workaround/solution

My old solution was to create a service account on the machines needing to access the shared resources and hide the service account from view on each machine.

My new solution is to use the Windows Credentials Manager (in the Start Menu, search for “Manage Windows Credentials”). This will bring you to the Operating System’s Credential Manager, where you can Add a Windows credential. From this window, type in the server name and local username and password that authenticates on that server (like your service account) and click on OK.

Windows will now use those credentials whenever it tries to authenticate against that machine.

All you need to do now is to remember to change the password here whenever you change it on your servers for your service accounts.

Remember to check the MAC address

Miguel Garrido — Thu, 21 Jan 2010 03:33:14 GMT

Today I encountered a weird issue with a new machine I was setting up. The NIC on the machine worked to PXE boot and install Windows XP off the WDS server at work, however once I installed the drivers for the NIC on Windows XP and obtained an IP address from DHCP I couldn’t reach anything.

I couldn’t ping my default gateway, any DNS servers, couldn’t ARP an IP address, nothing. I tried to release and renew the IP address, ran diagnostics (which all passed except the connection diagnostic) and I was getting an IP address on the correct subnet and with correct values for the gateway and DNS servers. I was stumped!

I knew the NIC was working because I’d installed the OS through the network, but even though the NIC was sending packets out, none were being received (as reported by the OS). I called my boss and started throwing ideas back and forth, I’d already done most of what he was mentioning except one thing: Look at the MAC address that the NIC is reporting. It was 00-00-00-00-00-00.

I completely skipped over that the first time I ran an ipconfig /all on the machine, but as soon as I saw the MAC address contained all zeroes I quickly went to the properties page that installed with the NIC driver, went to the MAC masquerading tab and clicked on “Use default” – nothing changed. The MAC address field was empty and while I could have maybe retrieved the MAC address off the NIC itself or motherboard, in the interest of time my boss found the vendor ID for a company I’d never heard of (maybe he’d used them before, who knows, but we didn’t have any of those adapters in the office) and gave me the first 3 pairs belonging to that vendor for the MAC address. I set the last three pairs to random numbers and seconds later after an ipconfig/release && ipconfig/renew I was finally able to send and receive traffic on the network. Ideally you'd try to retrieve the MAC address that belongs to the NIC, however, we manage the environment and know what devices come into the network so it is very unlikely that we will encounter any conflicts. No excuse, I know, but that's just the way things are right now.

Neither of us had seen something like this before, but the advice to take with you from this post is: remember to check the MAC address if you ever encounter a similar issue.

Remember to check the physical wireless switch

On a related note, this brought back memories of a colleague of mine who while working on one of my old employer’s help desks took a call once, minutes before the end of his shift. The user was reporting that his wireless connection was not working and my colleague spent the next 45 minutes troubleshooting with the user only to find that the problem was resolved by toggling the physical wireless switch on the laptop to the On position. Yes, that simple.

Details matter, remember this.

Know about WinRM (Remote Management) and WinRS (Remote Shell)

Miguel Garrido — Wed, 20 Jan 2010 01:05:14 GMT

I just recently migrated my data to another machine (to use as a file server) since it has a Sans Digital NAS attached to it. Normally working with files across the network (I now map a shared drive to the share on the server) is perfectly acceptable – however, there are some operations better left on the remote machine, for instance: extracting or compressing [rar/zip] archives.

Ideally, I’d prefer to have a solution where I can (in this case) right click on an item on my machine and run a command on the remote machine, and with WinRS and some programming I may get it done eventually, but in the meantime as a quick and dirty solution I set up WinRM on both machines and I currently start a command prompt instance using WinRS and I can use the command line rar.exe or 7za.exe for dealing with archives on the remote machine.

TechNet has more information on WinRM and WinRS, for brevity I am just going to outline what I had to do to get my current solution working:

First, from an administrative [read: elevated, if applicable] command prompt execute: winrm quickconfig on both machines, answering each prompt with yes.

If the machines are domain joined then they already trust each other thanks to Kerberos, however if the machines are part of a workgroup you need to tell each machine to trust the other by executing: winrm set winrm/config/client @{TrustedHosts=”%remotecomputername%”}. (Note: replace %remotecomputername% with the hostname of the remote computer.)

Now you should have all that is needed to either remotely manage each machine from the other using winrm (e.g. starting or stopping a service, or querying information using WMI) or run commands on the remote machine using winrs. My particular usage is: winrs –r:%remotecomputername% cmd.exe. This command will start a remote command prompt instance that I can then use to navigate directories on the server and run command line utilities like 7za.exe or netsh, ipconfig, etc.

If you prefer PowerShell, there is one more step that needs to be taken from within an elevated PowerShell command prompt, on the machine that you want to remotely connect to execute: Enable-PSRemoting. This will enable the PowerShell listener and PowerShell should then accept connections from remote PowerShell instances. To connect to the remote PowerShell session execute: Enter-PSSession %remotecomputername%.

Again, I did not go into any detail on this because 1) I am not an authority and I didn’t look further than this, and 2) there is plenty of information on the web and TechNet regarding this topic.

I will probably post an update to this post if/when I ever decide and have enough time to write some code that will allow me to execute canned commands on a remote machine (mainly targeted at extracting archives on the remote machine right now).

Enjoy reading up on WinRM/WinRS.

Indexing additional mailboxes in Outlook 2007

Miguel Garrido — Sat, 16 Jan 2010 05:24:54 GMT

I recently came across an issue where an administrative assistant needed to search her boss’s huge mailbox while it was attached in Online mode to her Outlook profile. Normally, Outlook search will work for certain folders (like Calendar and Contacts) because it caches those folders from attached mailboxes so that they can be indexed; however in this case the amount of items in each of those folders was either too large or something else was going on and search just wasn’t working.

After searching online, I was able to find out about the CacheOthersMail registry value which can be set in HKLM\Software\Microsoft\Office\12.0\Outlook\Cached Mode and is looked for by Outlook after a post Office 2007 SP1 hot fix (which is included in Office 2007 SP2). This value will instruct Outlook to cache any attached mailboxes in the user’s OST file – this being useful because it increases the access speed of the mailbox significantly and I thought should allow the indexer to index the mailbox. Much to my chagrin, I found that the mailbox was still not indexed after creating this value in the proper registry key (but I could confirm that the mailbox was indeed cached); I had to continue looking.

It was then that I was pointed to the following (excellent) blog post by Mike Lagase: Windows Desktop Search Indexing in Outlook. This blog post detailed an interesting setting (which could be potentially dangerous when used improperly): Enable Indexing of Delegate Mailboxes. This setting, along with other useful Group Policy settings for Windows Desktop Search 4 when a user needs to index mailbox contents are discussed in Mike's blog post.

Make sure to read the blog post for more details, however my fix was to set the CacheOthersMail registry value along with enabling the Enable Indexing of Delegate Mailboxes policy. The end result of this was Windows Desktop Search 4 indexing the contents of the already cached attached mailbox.

The administrative assistant is now happy again that she can search her boss’s mail like she was able to in the past.

Public Service Announcement: Make sure your backups are up to date

Miguel Garrido — Sat, 02 Jan 2010 06:32:41 GMT

I am sure this has happened to more people than would care to admit it: Your clients’ (or your employer’s) backups are running smooth and you correct any hiccup right away but you are lazy about your own backups. So I start my (somewhat shameful) and hopefully eye opening post.

A few days ago I saw a Windows Delay Write Failed notification in my taskbar. I think most of us know it, this notification usually means a write operation failed, and if your [external] hard drive is plugged in, on, and should be working fine, you start to suspect that maybe the drive is failing or was somehow unplugged before data in the write queue was flushed. But I digress, the notification came up, I then proceeded to access the logical volume in question (which consists of a LaCie Big Disk spanning two 500GB disks on a RAID 0) and was able to access some of the files just fine. I then attempted to run a chkdsk on the drive but I was met with an error stating that the type of the file system was “RAW” and thus chkdsk was unable to scan it. This my friends, is when I started to panic.

Normally, I wouldn’t be worried because I knew that I had a backup from the night before, however, recently the hard drive (also 1TB) that I use to backup my data started malfunctioning culminating in an RMA. Once I received the new drive I procrastinated mainly because I was going to purchase a Sans Digital RAID enclosure which I planned on using as a new volume for all my data (consisting of a pair of 2TB disks on a RAID 1) soon. However, I was worried because I now had no viable backup of my data and for all I knew one of the two drives on the RAID 0 array had just gone bad.

I quickly prepared the replacement 1TB drive on one of my external SATA enclosures and prepared it to copy all my data using Robocopy over my Gigabit network (this would normally take ~12 hours for a full backup) but knowing that the file system was not being read properly I decided to try my luck in power cycling the LaCie Big Disk, boy was that a mistake! The drives wouldn’t spin up again.

I proceeded to “freak out” for about five minutes, actually having to take a few minutes away from my desk in order to get past the fact that I might have just lost 600GB worth of data. Once I was able to sit back down I proceeded to go through the basic troubleshooting steps:

Take the enclosure apart (voiding the warranty, but at this point, I didn’t care about the warranty as much as my data)
Re-seat the SATA power and data cables
Disconnect each drive individually and see if the other would spin up

Everything I tried failed, things were looking grim.

Having another SATA enclosure on hand, I removed one of the SATA drives from the LaCie enclosure and installed it in my other enclosure, this time the drive spun up! I quickly confirmed the second drive spun up as well using the same method. By now at least I was sure that the drives were spinning so I started to feel some of the weight off my shoulders. My next step was to find out how to recover data from a broken LaCie RAID. Searching Google found a few noteworthy results and at least I was on my way to a real solution. While searching I heard about a few tools, R-Studio and iRecover being two of them, I would try them as soon as I had corrected my backup situation.

I also found the likely culprit for the problem: one of the blog posts I found online while searching stated that their problem was sourcing from the power adapter that the LaCie drive uses. The writer wrote that there was a ‘hissing’ noise emanating from the power adapter noticeable when your ear was placed on the adapter – I was able to reproduce this noise and confirmed that none of my other power bricks (albeit, different power bricks) were producing this sound when my ear was placed on them. The fix could have easily been to purchase a replacement power adapter, but this is the second Big Disk failure I’ve experienced so I will not be giving any more of my business to LaCie.

I spent the next 20 hours or so using WinImage 8.1 to create VHD images of each drive, the process would have been faster but I didn’t have enough space on the computer where I was making the image so I had to create the image and save to a network location (which I can only assume slowed the process down a little, though when I think about it maybe not so much as the USB bus since my Gigabit network should outperform the USB bus being used to read from the drive). Anyhow, after both VHD images were created I now felt that I had a viable backup of my drives and data. I put the two 500GB drives in a safe place and got to work on finding some tools that could “de-stripe” my array. Thanks to Windows 7’s built-in ability to Attach VHD files as local disks, I was able to perform all my tests on “Read Only” copies of the disks as if they were directly attached to the system (which was awesome).

The first tool I tried was Runtime Software’s RAID Reconstructor. This tool was unable to detect the RAID parameters that LaCie used so in the end I couldn’t use it (and it wasn’t until later that I figured out why). The default detection settings that RAID Reconstructor used were out of the range of the RAID array start sector and the array block size was not one of the default settings the software provided you with (this LaCie drive used a 256KB block size, where the largest block size that RAID Reconstructor specified by default was 128KB). The parameters to search for the RAID array are fully customizable but I was unfamiliar with RAID parameters in general and the software’s RAID detection feature was unable to find the array parameters with the settings that I provided in addition to its own recommended settings so I uninstalled the trial and moved on to the next piece of software.

The next software I installed was iRecover by DYI Data Recovery. This software was easily able to find my array and reconstruct it, however the scan time was about 30-40 minutes. I was also unable to save the scan results so I would have to reconstruct the array every time (to be fair, it seems the registered version allows scan results to be saved). Once the array was reconstructed I was able to save a large file and confirm that it was not corrupted, great news! I was now ready to purchase iRecover, which costs $90, but first I wanted to try the last option that my search yielded: R-Studio.

R-Studio offers a powerful tool set for the technician with the R-Studio Local and R-Studio Network products. You can find out more about their products on their website. I downloaded R-Studio Local and got to work, I followed the RAID Recovery Presentation which provided me with enough information about the RAID parameters that I felt like I could do more than I could previously with RAID Reconstructor and within a few minutes was looking at my data, no scanning required! I will admit it took me a few tries to get the block size correct. I had a hint about the drive order (one drive would show as unallocated space while another came up as two partitions on the R-Studio GUI) so I used the drive order that I thought was correct at first (the drive with the partitions first, then the drive with unallocated space) and varied block sizes until I found the sweet spot: 256KB.

Armed with my tool of choice: R-Studio, I proceeded to recover the data from the two 500GB drives attached to my system via a pair of USB SATA enclosures (to avoid recovering from the VHD image across the network, though honestly I think my USB bus is taking a harder beating than my network would have taken) to a third 1TB disk attached via a third USB SATA enclosure. A few hours later my data is still being recovered but this goes to show that being lazy and procrastinating can bring you a lot more work in the long run.

I still haven’t purchased the Sans Digital enclosure I want, and while I will probably do that sometime next month, as soon as the data is recovered I will be re-scheduling my old Robocopy job to run every night and mirror one drive to the other over the network.

Never a dull moment.

Creating custom MMC consoles

Miguel Garrido — Sun, 13 Dec 2009 19:03:56 GMT

I was going to write an article about authoring your own MMC consoles and I may still do that, however the main reason why I would want to create my own MMC console and lock it down is if I were delegating certain tasks to a junior administrator (like user management in Active Directory).

It turns out that Daniel Petri has already written an excellent article which shows how an administrator can create a “Taskpad” which is essentially a custom MMC console which is locked down to a set of specific administrative tasks. This taskpad can then be used by a junior administrator on a day to day basis as an alternative to granting him direct access to Active Directory for a certain domain.

This is also useful when you want an office manager or a department head to keep the AD attributes of an OU he is responsible for up to date with contact/company information, such as title, manager, phone numbers, etc.

Daniel’s article can be found here: Create Taskpads for Active Directory Operations

Make sure to look around on Daniel’s site, as it contains a plethora of other useful information.

When the PCL driver doesn’t work try the Postscript driver

Miguel Garrido — Wed, 21 Oct 2009 16:15:40 GMT

Postscript vs. PCL¹ is not something I’d like to discuss on this blog, however I will admit that there are instances when the PCL drivers won’t get the job done, specially with PDF files (granted, a PDF file is essentially a postscript file, but that’s a discussion for another day).

On more than one occasion I have come up across a few files some Excel, some PDF that for whatever reason won’t print flawlessly when spooled to a printer that is using a PCL driver on the print server but when I create another printer on the print server using the Postscript driver the file prints out without a problem. The issue may occur to a local printer but I have only seen it with higher yield printers like the HP Color LaserJet 4700n connected to a print server through the network.

The bottom line is that it is worth a try to use the Postscript driver for those problematic files that just don’t print correctly when using the PCL driver (read the article linked on note 1 below for some of the Postscript pros which may provide some understanding into why the Postscript driver prints a document with more fidelity than PCL).

Also, I think it should be noted that due to the nature of Windows printing, it is perfectly acceptable to have two printers each using a different set of drivers on the system, all you need to do is have them use the same port but a different driver and naturally have a different name so that you can tell them apart and there is no naming conflicts when creating the second printer.

Notes
1. http://www.laserquipt.com/support/idx/0/063/article/PCL-vs-Postscript.html

Infrastructure Master FSMO role and Global Catalogs in your Active Directory domain

Miguel Garrido — Mon, 21 Sep 2009 02:42:52 GMT

Remember: If only some of your Domain Controllers are Global Catalogs make sure that the domain controller that holds your Infrastructure FSMO role¹ is not a Global Catalog. The reason for this is that a global catalog that holds the infrastructure master role will stop looking for and removing phantom objects in your directory since it will have no phantom objects (we all know global catalogs hold partial information on every object in the directory) because it knows about every object in the directory if even a little.

However, if all your domain controllers are global catalogs, then it doesn’t matter where the infrastructure master lies since all domain controllers will know about everything in the directory and will (unless there are bigger problems) have accurate information about your directory objects.

Notes
1. http://support.microsoft.com/kb/197132

About mailbox searching in Outlook 2003/2007 [with Exchange]

Miguel Garrido — Fri, 11 Sep 2009 04:27:23 GMT

A quick tip for anyone who is experiencing issues searching their mailbox on Outlook 2003 (with or without Windows Search) and Outlook 2007 (preferably with Windows Search enabled on non-Vista/7 machines). If the mailbox mode is in Online mode, that is, it is not in Cached Exchange Mode, you might want/have to enable Cached Exchange Mode for Outlook 2003 in order for your searches to work properly.

Now I have found that for Outlook 2007 search to work (though I have to admit, I have only verified these findings when Windows Search was installed), you need to also enable Cached Exchange Mode. I can only guess that the reasoning behind this is that the indexer can index your mailbox locally and thus provide you with the search results you need (in a fast responsive manner) when your mailbox is stored on your hard drive as an OST file. Now (and this is only speculation since I haven’t bothered to look this up) it is very possible that if the Exchange Server is being indexed and you are running Exchange 2007 and Windows Server 2008 or Windows Search on Windows Server 2003 and Windows Search on your workstation that Outlook 2007 will provide you with search results without having to enable Cached Exchange Mode by passing the search request to the indexer on the server running Microsoft Exchange, similar to how Windows Search retrieves file search results across the network.

However, the whole point of this post is that it is worth a try enabling Cached Exchange Mode if you have a search related issue on an Outlook client that connects to an Exchange Server and everything else you’ve tried isn’t working, like rebuilding the index, or reinstalling Windows Search, etc.

A tip for working with accounts on Windows 7 Home Premium

Miguel Garrido — Sun, 06 Sep 2009 13:00:00 GMT

I have two HTPCs at home, one in my bedroom and one in my living room (*cough*, the living room HTPC is coming soon), as well as another notebook that my lady uses. These machines are a perfect candidate for the Windows 7 family pack that Microsoft is offering for $150, which is good news for me as far as licensing goes.

Since these machines will are simply for entertainment purposes, and web browsing, they don’t need any features other than the ones offered by Home Premium, unfortunately, the RDP host is not available for Home Premium, so I will likely end up using VNC (though I have seen that Windows 7 and VNC aren’t the best of buddies yet), LogMeIn or another remote control technology for management, but we will see, in the meantime I have my rubber keyboard and small USB mouse handy for plugging into the front USB ports on my HTPCs and using my TV as a monitor. But I digress, while the HTPCs will be auto logging into their accounts and starting up XBMC on boot, that leaves me with the third PC in the house that has a local admin account, as well as a service account granting it access to media files on my workstation. Since my workstation is domain joined, it can join a HomeGroup, it cannot serve files to a HomeGroup (for security purposes I assume), so I am stuck using a service account. This leaves me with an extra account showing up in my Welcome screen (and the welcome screen of the other machine) that I do not care to see, so I set out looking for a way to hide the service account.

The following registry hack (place usual registry editing warning here), will get the job done, and as an added bonus, I have also included the name of the user account applet for those of us that dislike the new user account control panel fluff.

Without further ado, the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList

Inside this registry key, create a new DWORD value with the account name to hide, leave the DWORD with a value of 0.

Log off or reboot and voila, the account should no longer appear in the Welcome screen, but you should still be able to authenticate to the machine using this account. This is useful in scenarios where you cannot have a HomeGroup, or choose not to use a HomeGroup and would like to share resources between machines using good old fashioned service accounts without having the account name lingering in the Welcome screen.

Also, as promised, from the Run dialog, typing netplwiz will bring up the old school user accounts applet, this is very useful in the case of Windows 7 Home Premium, since there is no Local Users & Groups applet in “Computer Management” as in Windows 7 Professional and above.

Give it a try!