Just an IT nublet

I've moved to my own site!

2010-04-26T15:28:00.000-07:00

O hai! I'm not here anymore because I've moved to my own Wordpress blog! You can find me at:

http://www.TheNubbyAdmin.com/

That's right, I'm just an IT nublet, trying to be less nubby. No shame in admitting that. Change your bookmarks and tell your friends. It's going to be a wild ride as I settle into a new job, create my own business and attempt to de-nubify myself.

Come on over and join in as life and experience unfolds. I'll be there waiting for you!

ProjectCartoon.com – How projects REALLY are

2010-04-22T03:09:00.000-07:00

Some of you may have already seen this original cartoon, the author of which I can’t seem to track down to give proper credit to:

The site ProjectCartoon.com expands slightly on that original with the addition of a few cells and also allows you do edit the captions and order of the cartoon.

My favorite new cell? This made me chortle:

However, all the cells are worthy of a laugh or two. Project planning, even for single-person IT departments, can be an exercise in juggling ferrets. What’s your best IT project story? Bonus points if it involved the calling of at least one public emergency-services department (negative points if that department was the SWAT team).

Technorati Tags: Humor

Speed Reading, Week 2 Finished!

2010-04-21T15:36:00.001-07:00

I did a speed reading test on the morning of Monday the 19th before starting my first lesson of the week. The supposed reading speed was 295 WPM, but I admit my comprehension was low. I’m focusing less on comprehension and more on technique. I’m attempting to consistently stop verbalizing the words I read in my head and just let my eyes see the word and my brain register the meaning.

Monday:
- Morning: Lesson 3 Completed
- Evening: Lesson 3 Completed
Tuesday:
- Morning: Lesson 4 Completed
- Evening: Missed
Wednesday:
- Morning: Missed
- Evening: Missed
Thursday:
- Morning: Lesson 4 completed
- Evening: Missed
Friday:
- Morning: Missed
- Evening: Missed
Saturday:
- Morning: Lesson 4 completed
- Evening:

Wow. I got a weeklong pass on the FAIL train. Two all-day seminars back-to-back on Tuesday and Wednesday threw a wrench into my plans. Thursday, Friday and Saturday were exercises in mediocrity and failed time management.

It’s hard to leave for a day or two and then come back. You really need to keep on it each and every day, twice a day. The ability to keep up a steady reading pace and simultaneously assimilate all of the information (which is now coming in through your eyes at a faster rate than you’re accustomed to) is a draining activity and needs to be consistently done. Much like weight training.

With good intentions, and hopefully more disciplined time management and prioritization, I enter week 3.

Listing all volume mount points on a Windows server

2010-04-21T01:32:00.000-07:00

While auditing and revising the backup policies for some servers, I came to an older file server that I hadn’t had significant contact with in a while. I knew I had made a volume mount point from one volume to another volume, but couldn’t remember where it was.

Like a good SysAdmin, I documented it in a private wiki so the information was a simple click away. However, it struck me that I should know how to list all volume mount points on a Windows Server 2003 or 2008 box. Who knows? Maybe I made a couple of extra VMPs and forgot about it.

If I had development skills, I could use this MSDN content to create a small app to enumerate mounted folders that uses the calls “FindFirstVolumeMountPoint”, “FindNextVolumeMountPoint” and “FindVolumeMountPointClose”. However, as far as any kind of programming is concerned I couldn’t hack my way out of a wet paper bag.

The Windows 2000 Resource Kit has three tools that deal with volume mount points or “Junction Points”. These tools also work on Server 2008 and are included by deafault, at least on my Server 2008 R2 machine. Those tools are: linkd.exe, mountvol.exe and delrp.exe.

Mountvol when used by itself with no switches will first show the command’s help text but then list all volumes that are available on the system as well as a what junctions connect to that volume:

Notice that all my drive letters are listed, but underneath one of them, the E: drive, is a path to a folder that resides on the C: drive. This is the location index files for my backup program. Super, so now I can see all the junction points that are associated with a drive letter! As I suspected, there was only one junction point.

It should be noted that I also found a scripted way of enumerating volume mount points. The script is from The Scripting Guys and is located at this Microsoft TechNet link. Not that it does not work for Windows Server 2008, but supposedly does for Windows Server 2008 R2 I’ll reproduce the script here for you benefit:

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery _
    ("SELECT * FROM Win32_MountPoint")

For Each objItem In colItems
  WScript.Echo "Directory: " & objItem.Directory
  WScript.Echo "Volume: " & objItem.Volume
  WScript.Echo
Next

When pasted into notepad, saved as a.vbs file and run the cscript, the output is similar, but not as well formatted as mountvol:

How do you use volume mount points in your OS of choice? What’s the most mount points you’ve ever seen on a single machine?

Technorati Tags: windows,windows server

How many days are left in my Windows Server 2008 R2 trial?

2010-04-20T00:25:00.000-07:00

The Quick Answer:

Run the following command at a command prompt:

slmgr.vbs –dli

You may have to wait for 20 or 30 seconds, but eventually a dialog box will pop up that displays the following information:

The Long Story:

I’m frobbing around with Microsoft Windows Server 2008 R2 and Exchange 2010, and in the development of my test lab a question occurred to me:

“How many days are left in my Windows Server 2008 R2 trial?”

There’s a lot of misinformation out there, and some of it contains methods that were common in older versions of Windows.

One common method that is still espoused today is to check the creation or modification dates of various system folders. This isn’t accurate. I have creation and modification dates of system folders going back almost a year before I actually installed the operating system.

Another method that I just learned about is to check the registry key at HKLM\Software\Microsoft\Windows NT\Current Version\
InstallDate which shows the date of installation in UNIX epoch time. Converting the decimal notation into UNIX epoch time is as simple as going to www.EpochTime.com and performing the conversion.

You could then take the current date’s epoch time, subtract it from the installation date’s time and see how close to the trial limit you are (180 days).

However, that is inaccurate since you can wait up to 10 days to activate Windows. The trial period starts from the date of activation not the date of installation. I’m unsure if there is a registry key that shows the date of activation.

Technorati Tags: Microsoft,Windows,Windows Server,Windows Server 2008 R2

Video on Web Application Development that Doesn’t Suck

2010-04-19T02:27:00.000-07:00

Being a stereotypical SysAdmin, I tend to shy away from development topics. Partially because I attempted to program as a kid (HyperTalk, AppleScript, Pascal, C and the nail that sealed the coffin lid: C++) and found it to be an exercise similar to self mutilation except without garnering any sympathy from people.

Furthermore, being a SMB SysAdmin I tend to be ignorant to the unique challenges that SysAdmins who focus on web technologies have to face. Ironically, my latest contract is managing the technicals behind an upstart website that a friend is making… go figure. Looks like I’ll be having a nice, vertical learning curve soon.

Moving on, I found a video on YouTube that intrigued me. No, it wasn’t Hamster on a Piano, even though that amused me far more than I’m comfortable admitting.

It’s a well done video by a fellow named Sean Kelly (who has worked at places as diverse as NOAA and NASA Jet propulsion laboratory) titled “Better Web Application Development”. The video itself is a little old, circa late 2006 I believe. It starts with Sean’s frustrations with using C++ in the 90s to attempt to get various datasources unified in a single user interface at NOAA.

Moving forward into the 2000s (and a job at NASA), web protocols became the standard for the kind of application development he worked in. As a result, one of the sticking points that he felt in the 90s, that of slow UI development, started to become obsolete. However, not before some poor tools caused him to reach a breaking point.

The video is a 36 minute tour of Sean pitting various web app frameworks against eachother in a logical and fast-paced style. What happens when you pit J2EE (using servlets and hibernate), J2EE with JBoss, Ruby on Rails, Django, Zope and Turbo Gears? It’s a framework beatdown and while the front of the pack is a little crowded, the loser(s) are easy to spot.

The video is well done, with good audio and is fast paced. It’s obviously scripted so the speaking flows nicely and the whole video moves along well. Overall it’s great to listen to and the areas where computer work has been screencasted are sped up with a summary narrative given so there’s no excruciating waiting periods watching someone fumble at the CLI.

There were several good quotes and concepts from the video that I took away and applied to systems administration. Because, when you come down to it, we’re all in the same boat. We all have to create and support systems that are interacted with by people who just want to get their jobs done. Some of my favorite quotes from the video are these:

“Planning a UI is 1/4 of the battle. 3/4 of a UI comes from users playing with it”

The concept I took away from the above quote is that whatever a person has to interact with needs to be good. Furthermore, it needs to be good by their standards. If it’s good by your standards, that’s not enough. If the QA department’s interface is good by an accountant’s standards. That’s not good enough. If the sale’s teams interface is good by the art department’s standards… actually, that probably is good enough.

“It’s got to be fun. Why? C’mon! Fun don’t need a reason!”

Quoted for truth.

“Rapid turnaround is absolutely, unquestionably, irrevocably vital.”

Whatever we do, whatever is implemented, it must be modifiable and furthermore it must be easy and quick to modify. Things change, people and industries are different. Live with it and like it.

“You might recognize this as the n-tier architecture where n is always 3. I’m not sure why they don’t just call it the 3-tier architecture.”

Yeah, what’s up with that?

If you watch the video, let me know what you think about it. know of any better ones?

Speed Reading, Week 1 Finished

2010-04-17T21:40:00.001-07:00

I started the week, prior to starting any of my lessons, with a reading speed of about 170 to 185 words per minute. Not bad for me! I think that increased speed is a result of doing these exercises and learning some techniques late last year.

Monday - Lesson 1: Morning and evening
Tuesday – Lesson 1: Morning but missed evening (Got back into the mental habits pretty good. Came up to speed quickly, was able to focus my attention well.)
Wednesday - Lesson 2: Morning but missed evening
Thursday - Lesson 3: Morning (more like late afternoon) Evening
Friday - Lesson 3: Morning, forgot evening! =(
Saturday Lesson 3: Forgot both. Fail.

It wasn’t the most energetic or consistent week and the last day was a bit of a failure. At least I got back into the habits. Next week will be better!

Integrate Google Docs and Microsoft Outlook… free!

2010-04-15T02:22:00.000-07:00

I recently stumbled upon a free Microsoft Outlook Add-in that allows you to have access to your Google Docs from within Outlook 2007. It’s from a company called Mainsoft and the tool is called Harmony for Google Docs.

I’m not a huge Google Docs fan, primarily because the web interface never impressed me and I didn’t want to juggle two interfaces to access various similar information. Those two interfaces being Outlook for much of my email and Google Docs for online files.

However, with this new plug in, I think I may give Google Docs another try. If I can easily store files “in the cloud”, I’ll be more apt to do so.

Mainsoft also creates an Outlook plug-in for SharePoint called Harmony for SharePoint. However, not yet having fully implemented SharePoint in one of my offices, I’ll save my opinions on that tool for when/if I ever use it.

If anyone else has comments or experiences with either tool, drop me a line or comment. Guest blog posts are always welcomed!

Technorati Tags: microsoft,outlook,google

Speed Reading; Legitimate personal development or just a gimmick?

2010-04-13T03:22:00.000-07:00

A few years ago, I started to realize just how poor my reading skills were. It’s not that I can’t read, it’s just that I have a constant battle with staying focused as well as a rather slow words-per-minute reading rate.

I knew I was somewhat of a slow reader because it seemed that most people could read through a page or paragraph well before I was done. On top of that, people seemed to have better comprehension than me. “Faster reading and better comprehension? Is everyone I know some kind of genius?” I would think dejectedly.

I also have difficulty knitting together the sentences that I’m reading at the moment with the sentences that I read a few seconds ago. Stringing sentences together into a full comprehensive work can be difficult (if not impossible) for me. Instead of a full tapestry of thought, I see everything that I’ve read as a mostly disjointed series of vignettes.

Think of watching a two hour movie, but chunking it into 2 minute intervals or intervals that last only as long as each specific scene and only watching two or three of those intervals a day. That’s my reading experience.

Strangely, that’s also my movie watching experience. While watching movies, I focused on the scenes as individual units and never knit them together into fluid stories. At this moment, thinking back over all the movies I’ve watched prior to just a year or two ago, I only recollect them as a series of scenes, vignettes or segments devoid of any context. I did not know from whence a scene came, what it was doing or where it was going.

Now, with better insight into my comprehension issues, I have re-watched a few movies that I grew up with and used some newfound concentration techniques and am amazed! It’s like watching a movie for the first time. I actually understand what’s going on and see it as a story and not just a bunch of cool scenes that follow one after the other. My comprehension isn’t nearly as good as I’d like it to be, but I’m healing it little bit at a time… partly through my previous involvement in speed reading. More on that later.

I also tended to get lost in thinking about how I would personally react in the movie’s circumstances rather than enjoying the story itself, but I think that’s another, separate issue.

What’s worse is that I didn’t even know anything was wrong about my experience or that people experienced things in any other way. I suppose I did have an inkling that something was wrong. When people talked of things like character and plot development being too slow/fast/predictable, I looked at them in silent puzzlement, not knowing how one would even sense something like that. I felt stupid.

Now, imagine having these issues with learning and general information gathering… with your job title being “Systems Administrator”. Anyone remotely connected with IT knows how much info we have to wade through. If any job would expose my problems with learning, this would be it.

In fact it was the job’s mental workload that truly made me realize there was a problem and I needed to do something about it. One day I discussed my problems with my boss, particularly concerning my slow reading speed, and he mentioned a speed reading program that he had tried and had success with.

I was slightly skeptical, however this person’s track record of not getting sucked into gimmicks lent some instant credibility to the concept. In my limited exposure to speed reading, it all seemed murky and on the fringes of rationality.

I performed a reading speed test and found that I read at about 160 WPM with supposedly full comprehension. If I attempted to push it to 200, comprehension dropped sharply. 160 WPM reading speed isn’t too bad. However, cut that speed at least in half when you realize that I often need multiple passes to understand something. Further drop that number when you realize that I tended to force myself to slow my reading down in an effort to forcefully understand what I was reading.

I decided to look into this certain speed reading program to see what it was all about. This program is not photo reading, subconscious absorption, skimming or “schematic processing” system. According to Wikipedia, it would probably be classified as “Meta Guiding”.

The basic concept is very simple. You must first stop mentally vocalizing the words that you read in your head. I do this all the time… and I didn’t even know I was doing it. I have a friend who is studying to be a librarian who reads around 500 WPM (I tested his speed one day out of interest). I asked him if he pronounces the words in his head and he thought about it for a moment before answering “no”. Apparently, he had never thought about it. It was just natural to see the words without pronouncing them mentally.

After breaking that habit with some help from the program, you also are encouraged to expand your vision slightly (not the “peripheral absorption” that I think some systems may delve into) as well as keeping a rythmic flow of your eyes over the text.

I have settled on one speed reading course in particular that seems mostly devoid of mysticism and pseudo-science. I will not reveal it’s name publically just yet, if ever. If anyone is interested, I’ll tell them through email or IM (email and IM me through nonapeptide@gmail / live.com depending on your network of choice). I’ve attempted to go through this course late in 2009, but had other commitments get in the way as well as my own undisciplined time management habits.

During my attempt at working through the course, I made a few fascinating breakthroughs. I found it amazing that my comprehension seemed to go up and my ability to absorb information increased. What it seemed like was that my whole life my brain wants information fast, but my reading habits (pronouncing words in my head, for one) kept me back. My brain in frustration would wander off to other thoughts further thwarting my attempt at learning. As a result, I’d get even more frustrated and force myself to concentrate on the text, only I would then read more deliberately and more slowly which only served to compounded the problem.

Attempting to bump my reading speed up actually helped satiate my brain, helped it to stay focused and increased my learning ability (and decreased my frustration levels which in itself helps out quite a bit).

The plan is simple. I give a few minutes to my speed reading exercise twice a day for six days in a week. The lessons can be repeated for as many days as I think I need to. For example, one day does not necessarily equate to one lesson. I could spend 3 days or a whole week on a lesson. Whatever seems best.

I’ll go through all ten lessons (and not wander away from the course like I did last time), which I estimate might take a month, and see if I can put into practice the timing, vision and speed discipline into my everyday reading. From then, it’s a matter of maintenance to do an exercise or two a day at the speed level that I want to maintain.

My goal is to be at 600 to 700 WPM reading with close to 100% comprehension. Obviously, material that is complex or new will require slower times, however simply reading a ZDNet article of 500 words shouldn’t take more than 60 seconds. With all of the Google Reader blogs I’m subscribed to, I’d love to power through a few dozen of them in just 10 or 15 minutes since not many of them are deep dives into murky technical waters (Except for SysAdmin1138’s Storage Administration entries =) ).

I’ll record my progress here as well as delve a little deeper into the topic of speed reading over the coming weeks.

Any comments, debate, flames and etc. are welcomed. I don’t moderate my comments so as long as you don’t say too many bad words or try to sell R0lex watches, you’re comments will be accepted. =)

Backing up GPOs with GPMC scripting on Windows Server 2008

2010-04-09T02:58:00.002-07:00

I’ve been developing a thorough set of backup and disaster recovery processes for an office running Microsoft’s Small Business Server 2008. The built in Windows Server Backup tool is quite nice from a “set-it-and-forget-it” perspective, even if it doesn’t offer a lot of customizable features.

However, there are a few things on the server that I’m considering backing up in a different way in addition to Windows Server Backup (WSB). One of those things is the domain’s Group Policy Objects (GPOs).

It’s a simple enough procedure from within the Group Policy Management Console (GPMC). In typical Windows fashion, it’s only a single right click away.

However, as a Windows admin who is attempting to recover from GUI-itis (the unreasonable reliance on GUI input to do tasks) as well as scripting-itis (an irrational fear of text that resembles code) and is also trying to fortify his body of automation skills, I knew I had to script this task.

Fortunately, the GPMC has it’s own set of scripting interfaces so that you can automate group policy tasks. There is also a set of GPMC scripting samples that were included with Windows Server 2003 but for some reason are not installed by default on Windows Server 2008.

To install the scripting samples on Windows Server 2008, go to this Microsoft download link. Those scripting samples include many useful scripts that allow for listing all disabled GPOs, Listing GPO’s without security filtering, deleting, restoring and importing GPOs as well as, most importantly to me at the moment, backing up and restoring GPOs. Here’s a list of the GPMC scripting samples.

From there, it’s as simple as calling BackupGPO.wsf or BackupAllGPOs.wsf from within Task Scheduler to get the job done. If you really want to get fancy, you could use PowerShell to do something like backing up all GPO’s that have been modified this month.

Heads up on a good SysAdmin related blog

2010-04-08T02:47:00.000-07:00

Just a heads up to my SysAdmin peeps… uhm… I mean, “peers” about a blog that started earlier this year. It’s called “SysAdmin Talk” (not to be confused with the oddly defunct SysAdminTalk.com forums – what happened to that place anyway?)

Started by Red Gate Software, it actually avoids the self-promotion and gets to some meaty posts. It mostly centers around Microsoft technologies such as Exchange, Windows Server and Active Directory. Some of the most memorable posts include:

Manage Exchange Retention Policies Before they Manage You
High Availability: you *are* Joking, Right? (Funny anecdote about what one software company considered a viable backup strategy for their product)
Using Microsoft System Center Configuration Manager to Deploy PST Importer Agents

There’s only a handful of writers at the moment, and posts are sporadic, but they are looking for writers so if you don’t see the topics you’d like to… you can always make them yourself. =)

There’s always room for one more good SysAdmin related blog on the intertubes

Creating an IT consultancy in the USA, Episode 0

2010-04-07T02:55:00.000-07:00

As I spend my evenings researching how to create my own IT consultancy in the USA, I’ve come across one main website that has most, if not all of the information that I need: www.Business.gov

I haven’t even scratched the surface yet and already I’m swimming in the midst of “fictitious names”, EINs and Schedule Cs. Fun.

One article in particular on Business.gov has been helpful to me in my larval stage: “10 Steps to Starting a Business” I’ll reproduce those 10 steps here so I can fill in the blanks with the specifics of my own situation.

1. Research and Plan Your Business

Located here are helpful guides such as How to Write a Business Plan, a video on Business Planning and Research and a Start Up Assessment tool.

In my case, this is all overkill since I’m simply creating a consultancy so a friend can contract me to do a large job for him. Maybe someday I’ll actually make a business out of it, but not today.

2. Get Business Assistance and Training

More information on business plans are offered here, but there is an additional emphasis on Small Business Counseling as well as financing your venture.

This too is unnecessary for me. Unless I can get someone to finance my protein shakes and Clif bars. Anyone?

3. Choose a Business Location

Tips on choosing the right location to set up a business are given here as well as listing various zoning laws and precautions.

Once again, this is irrelevant to me since I’m not actually setting up a storefront nor am I currently seeking customers. I’m just sitting in my home office in front of a computer, hacking away for entirely too many hours in a day with no reason to venture outside of the house.

Maybe I should try eHarmony…

4. Finance Your Business

Some of these bullet points make me think that the original author really only had 7 points, but stretched a few just to make a nice round number. This is repeating much of point 2.

I’m not looking for financing so I can cross this step off. Hey! This isn’t going too bad. Four points down and I haven’t had to do a thing!

5. Determine the Legal Structure of Your Business

Finally, a point that I need to pay attention to. Fortunately, there are very few options, and only two make any sense. The options are a Sole Proprietorship, Partnership, Corporation, S Corporation, LLC, Non Profit and Cooperative.

Of those, a Sole Proprietorship (SP) and an LLC are the only reasonable options for me. If I choose to become a Sole Proprietorship, I am personably liable for any debts or lawsuits. That means my car, clothes, baseball card collection and family heirlooms are all fair game.

If I choose a Limited Liability Company (LLC), I have a limited amount of liability that I can be responsible for. In otherwords, I won’t literally lose my shirt.

However, there seems to be a significant amount of extra paperwork that is needed and taxes seem to be a bit more convoluted than they normally are anyway.

Furthermore, I’m only becoming a consultancy for one job and I seriously doubt that any liability lawsuits are in my future (famous last words!). If I want, I can always change to an LLC at a future date, but for now I’ll choose to go with a sole proprietorship.

I’ll tackle the last 5 points soon. Until then… yes, I’m growing a beard. 23 days and still going strong.

I’m back and I’m… warm!

2010-04-06T03:23:00.000-07:00

After moving 1,800 miles from the Cincinnati, Ohio area to Scottsdale, Arizona I’m finally settled down enough to attempt to get some blogging and work done. That is, when I can tear my eyes away from the palm trees and stop picking oranges, grapefruit and lemons from the trees in my backyard.

“What work are you doing these days?” you might ask. (I know, I know –- no one asked, but I’m falling back on my imaginary friends to voice these questions)

Aside from digesting citrus and giggling at everyone who lives roughly above the 35th parallel line (even YOU Amarillo – unnaturally cold and windy place that you are), I’m now doing work for a friend that requires me to be an independent contractor. Thus I am beginning to delve into the mysteries and myths surrounding sole proprietorship and the United States tax laws which are rapidly beginning to look like a Vorticistic painting created by inebriated wombats falling down stairs.

If anyone has any tips, I’d appreciate some guidance. In the interim, I’m going back to reading some of the many helpful articles over at business.gov.

I’ll post what I find along the path to self-employment.

Blog activity temporarily suspended

2010-03-17T01:30:00.000-07:00

Due to beginning a move from the Cincinnati area to Scottsdale Arizona, my writings are temporarily suspended. Most, if not all of March will be taken up by activities related to the move.

You may still see some activity on my Twitter account, but I don’t have time for much more than 140 characters at a time.

On the bright side, I’ll soon be a resident of an area of the world that is home to palm trees and cacti. Everyone should experience that at least once.

“Remember when every business had their own SysAdmin(s)?”

2010-03-15T05:30:00.000-07:00

Do you think that sentence will ever be uttered? If so, do you think you’ll hear it in your lifetime? In your career?

According to a recent CIO article titled “Cloud and the Death of the Sysadmin”, the answer to each of those questions may very well be “yes” (unless you plan on retiring in the next few months). The cloud is the reason.

In the article, sysadmins are analogized with car mechanics of old. Back before cars didn’t need software updates and laughed in the face of a potential EMP “event”.

There was a personal touch and much lore and insight that mechanics had. A bit like Systems Administrators today. Journeyman programs prepared young grease monkeys to become arch mechanics much like Jr. Admins (or PFYs if you prefer) are ideally mentored by an experience admin in the nuances of administration.

Fast forward to today. According to the CIO article, the average high-end car has more lines of code than the Windows 7 and that codebase is distributed over more computers than a small office has.

Mechanics can no longer turn a wrench or replace a hose to fix many problems. They resort to rip-and-replace tactics for various microcomputer components (called Electronic Control Units or ECUs) because they don’t know what else to do. Half of all replaced ECUs show no signs of errors.

Apparently automobiles are now so complex, that remote support technicians will soon be who mechanics turn to for diagnostics. It is intelligently hypothesized that cars will be connected to a network and remotely diagnosed by highly skilled and specialized technicians. Those techs will then tell the mechanic what parts to replace.

A ever increasing disparity in skill will exist between the highly specialized remote worker and the local “mechanic” which will become little more than the hands for the remote tech. Maybe a few local mechanics will be kept on to do physical tasks like changing oil or rotating tires. At least, until that’s automated with arms that are similar to those seen on factory floors.

The generalist mechanic will become a relic. Any current-day specialist skills will become obsolete. We may no longer need a transmission specialist any more than we need switchboard operators today. Those displaced mechanics may find satisfaction in restoring those old cars that served their career so well, but they will no longer have a job working on a modern fleet of vehicles.

Change the story to focus on SysAdmins. The older automobiles change to private server room. The new autos to the cloud. The applications and services to the increasingly complex individual components or ECUs.

According to the CIO article, application complexity is increasing and troubleshooting is becoming harder. Specialized skills are needed for each service that an IT department is required to render and maintain.

The article continues the conjecture and considers a future where finely honed specialists for each service will be centralized and will service the applications that are being delivered. Onsite personnel are now only there to handle physical tasks for the service’s required onsite hardware.

Visions of a Googler walking through a non-descript server isle with a shopping pulling out bits of failed hardware from servers comes to mind. Even that scenario is old fashioned when you take into consideration the new datacenter pods that are never opened by humans, but simply get replaced wholesale when a certain percentage of hardware failure is reached.

The jack-of-all-trades (and if he’s especially amazing, master-of-some) SysAdmin has gone the way of Car Hops and Lamplighters. Maybe they’re needed in third world countries or in a themed Old Tyme amusement park, but not in the Real World.

To further drive home the point, the author reminds us that skilled workmen once filled factories. Now those same factory floors have had the lighbulbs removed and are filled with robotic appendages working at threatening speeds, eerily aping human motions that our grandfathers once did. The few workers that are still employed are the ones with the highest specialization… in robotic repair, efficiency analysis and various factory systems.

Essentially, information workers.

Is this true? Will SysAdmins be a fabled creature, spoken of in the same sentence as American Wild West cowboys? Vestiges of a time before more efficient, predictable and civilized ways of handling things was implemented?

In my opinion, probably to a large extent that scenario is true. I believe that the role of the Systems Administrator will change drastically in the next 10 years due to SaaS and cloud-ifying applications. How and why that happens is a question I’m still trying to answer.

The article only mentions application complexity as a reason for the move highly specialized positions. I disagree. I think it’s a simple matter of sheer scale.

SaaS is in many ways cheaper. It is also much more reliable. Cheap and reliable… who could resist? More services will be moved offsite from a private datacenter to a cloud service. Cloud services develop and grow at an exponential rate. More and more people will be needed to run those datacenters and the individual application ecosystems on them which will be massive in scale.

The drive for specialized skills will primarily be born from positions that must manage services on a massive scale. The complexity comes as a result of scale. Not, as I believe the article is implying, that the applications themselves are becoming more complex.

Maybe I’m drawing a blurry line. However, the important part to take away is that needed skills will change both their nature and their location. Skills will become specialized and will be moved from the onsite datacenter to massive, centralized datacenters. To what degree is in question.

The article’s emphasis on the increasing gulf between those that are specialists in one thing and those with lower, generalist skills seems accurate to a point.

However, I doubt that most business will offsite a majority of their services in the near future. Maybe non-trivial amounts of it… say, 30%. I do believe that there will be a tipping point. For example, once say 50% offsiting is achieved, it seems that the remaining percentage will be easier to achieve than the first 50%.

Nonetheless, the SysAdmin’s role is changing. That change is happening now. That change is unavoidable. Instead of fighting it, we ought to intelligently prepare ourselves for it today.

When the day comes that we have to decide to become datacenter infrastructure specialists or cloud applications specialists versus being relegated to SMBs that are too suspicious or remote to support their workflows being sent to the cloud… we ought to make that decision based on rationality rather than stubbornly sticking to old ways.

"I observe that old men seldom have any advantage of new discoveries, because they are beside a way of thinking, they have been so long used to.”

--Jonathan Edwards

iPhone FAIL

2010-03-12T11:17:00.001-07:00

Click the image to go to the Flickr original.

…but then again, if it supported flash it would be even slower and Safari would crash even more. So maybe it’s for the better.

A Flickr group for server rooms from the wrong side of the tracks

2010-03-09T05:00:00.003-07:00

UPDATE: I fixed my borked Bit.ly link. This one should work now.

Ever been in one of those server rooms? Ever seen solutions designed by someone who could only use one hand because the other was on a chrome .45? Awww yee-uh. Ghetto IT.

Got any photo evidence of those slipshod solutions? Maybe you would never close circuits with a pair of plyers, but did your predecessor leave you with core switches powered by an exercise bike and servers propped up with broom sticks? If so, I've created the Flickr group for you: "Ghetto IT"

The inspiration behind this is a thread at the SysAdmin-Network from a user named Isaac.The thread was named "Isaac? The ghetto is calling, they want their servers back." I figured that we all had our own run-ins with ghetto IT whether we were the originators of it or merely the unfortunate stewards of it.

Got anything to contribute? Want to join the group? Want to be a Thug Operator? Lemme know over at Flick-to-the-r.

Free eBook: The Complete Guide to Twitter

2010-03-03T08:06:00.001-07:00

We all know that Twitter is a popular social network that has more than its fair share of criticism and parodies. However, I believe that Twitter can be harnessed by progressive IT departments for their own good. I'll explore that possibility in a future post, but until then read and digest this free 40 page PDF eBook from MakeUseOf.com titled "The Complete Guide to Twitter".

If you have an experience with using Twitter in your IT department, drop me a line to give me some ideas for my forthcoming post on the topic.

Let's create a groundswell at Dell!

2010-03-02T05:56:00.004-07:00

A few weeks back, Shawn Anderson of Admin Arsenal fame posted a blog entry concerning how Dell gets one-upped by Dominos pizza when it comes to a customer's visibility into the build process. In fact, it's more than just one-upped, it's more like completely pwnz0red.

Someone took that idea and posted it to Dell's IdeaStorm website. I'm proposing that all interested admins rally behind this effort to increase the visibility into the hardware build process at Dell. It matters not whether you're an "IBM person", an "HP person" or a [insert-favored-hardware-vendor-here] person. Technical innovation and competition in any industry will (ideally) never hurt anyone.

Consider giving this idea an upvote or a downvote and share your ideas to help better the hardware industry as a whole.

Controls create complexity

2010-02-22T05:53:00.000-07:00

When something bad happens do you tend to react by quickly implementing some control to quell the immediate symptom? Users taking up all your file server space with videos of their kids' soccer practice and pictures of lolcats? No problem! Run a script each night that deletes all files that end with common video and picture extensions. That's a great idea... except the script deleted the HR director's collection of employee photos as well as all of the product teams' video documentation of their latest prototypes. One late night and three backup tapes later you decide to tweak your script.

Now, all suspicious file extensions that are found in user directories that are not HR or product team members are deleted. Wait, the web team is complaining now so you'd best exempt them as well. Except that one guy Sven who you never liked so we'll pick a random date 3 times a year and indiscriminately wipe out a few files.

You then discover that users are sending their media files to HR and Product Team members to share out. You immediately create a rule in the email servers to drop all image and video files as well as impose a 250k message limit. Except now you're company logo is being dropped form email footers and the CFO's 750k policy change documents can't get sent to the contracting agency that he uses.

Tweak time! Only image files that have an approved file path are accepted and email from VP level people can go above the 250k limit. Oops, the product team can't send PDFs to the engineering team because of size limits. Okay, 5Mb limit for them.

Users have now figured out that files are only being deleted based on extensions and have started naming their media files .mymovie, .watchme and .ouradminsucks.

This is getting out of hand. You spec out and pitch a fancy NAS box to the uppity-ups. They miraculously give their support. Now you can inspect each file and tell what it is regardless of file extension. You deny certain file types from even being moved onto it based on user groups in your directory service. Problem solved. Until you look up and see the angry mob with pitchforks and torches approaching.

This fictional, but oft repeated scenario plays itself out in one form or another every day. According to this Harvard Business Review article, an organization should step back and review their policies for three potential problems

1. Static controls for dynamic issues. (Banning .media file types from the file server)

2. Cost of controls higher than the cost of no controls. (Purchasing a high-end NAS appliance to restrict file types.)

3. Controls applied across the board, whether needed or not. (Now the boss's secretary can't download and load B-Net podcasts onto the VPs iPod. You will shortly be able to examine the finer points of said VP's dental work with the amount of time his mouth will spend open oh-so-politely requesting that you rescind your policy.)

We as admins have to deal with complex systems each and every day. As a result we are desensitized to complexity and lose sight of when a solution gets out of hand. We also take our systems too personally (which is a whole 'nother post) and become offended when someone does something that we think "dirties it up".

I propose that we as admins step back, detach our emotions and look at our policies with a critical eye. Let's look for the ones which are only addressing very tightly scoped problems and rescind them, looking for more flexible policies or none at all. In fact, I think I'll go grab some spare hard drives and make an OpenFiler NAS machine for people to share their silliness on.

And for the record, the VP of marketing has very nice caps and minty fresh breath.

To those who frequent my blog

2010-02-19T05:47:00.001-07:00

...yes, both of you. I've been toying with an IT related blog in some form or another for about a year and a half. I'm focusing more on content than I am presentation. As a result, I'm still refining, renaming, moving and generally tweaking things. Bare with me as I change the name, titles, font, spacing and layout at will. I hope to settle into a nice groove soon.

Leadership Lessons from "Dancing Guy"

2010-02-17T05:59:00.001-07:00

Leadership is overglorified. Be a lone nut.

It's only 3 minutes and you'll not regret watching it. Betcha can't keep from smiling.

“Because” and “Best Practice” are not complete answers

2010-02-16T05:50:00.002-07:00

My mind is lazy. It's a problem that I'm aware of and am working against as hard as I know how. There are two main symptoms of my mental laziness. The first is that I want to remain as comfortable as possible by staying with what I know. The second is that I just don't want to spend the time it would take to learn something new.

As a result, when I want to do something a certain way I skew my views, bias the facts, ignore fallacies and generally rage against the scientific method in my pursuit of all things Me. I'm heinously selfish.

While reading through the blog of Virtualization maven Jason Boche, I came across a convicting jewel of a statement within this post that detailed his in-person defense of a Virtualization design while pursuing his VCDX certification. I was happily reading through the longish post when out of nowhere, in the eleventh paragraph, Rational Thought punched me in the face thusly:

Anything you list in your design you need to be able to speak to. If you cannot speak to everything in your design, then how do you know it is appropriate for your design? “Because”, and “Best Practice” are not complete answers.

Most of you, as seasoned IT professionals, will probably be staring at the screen and mumbling something like "Well duh!" Go back and read the first sentence in this blog post. Do you see why Jason Bosche's sentence was so devastating to me? I stopped and re-read his two sentence dose of reality several times.

When I'm looking to create a solution, I heavily favor what I'm most comfortable with by using words like "Industry Standard", "Best Practice" and "Standards Based" to soothe the pangs of protest from my conscience. In reality, I can sense that I'm probably only pursing The Path of Familiarity or avoiding The Path of Lots of Reading.

Don't get me wrong. I really enjoy learning new things. That's one of my favorite things about this industry. But sometimes in spite of enjoying this field of work, and this is the confusing part that I haven't been able to sort out yet, I just don't want to go through the effort of learning a new thing.

Other times, I make a design decision and know that I don't really know why I've chosen a certain element. I'll glance at it and think "Eh, it's a standard." But shouldn't I be able to defend that decision on a more granular level?

I admit athat you can't know everyhing about any industry, especially info tech. I can't break every link in in each chain that makes up a solution down to an atomic level because if I did, I'd be reading books on particle theory and leaving out saucers of cream for Schrodinger's cat.

And furthermore, I firmly believe that there is often no single definitive "best solution". The decision on what is the best solution is legitimately influenced by what you're most familiar with. More on that in a later post.

Can you defend your design decisions? Can you speak to each element with something more thoughtful than sales department buzzwords like "Best Practice" and "Industry Standard"? Are your decisions based on more than familiarity and comfort? Here's to admins that embrace the scientific method.

The Ultimate Productivity Blog

2010-02-15T05:12:00.000-07:00

I'm fascinated by productivity theories, tips and tricks. Probably because I have issues with staying focused and being productive. I like Merlin Mann, David Allen and BaseCamp. However, I've recently found the most amazing productivity blog I've ever come across. I think I may be on the verge of a major life change.

http://productiveblog.tumblr.com/

I think I need to meditate on that.

Cisco Puts an Internet Router in Space

2010-02-12T06:57:00.048-07:00

Cisco has gone astronomical... and not just in their licensing and hardware prices.

Yes, they really do want to rule the world. And probably the universe too. It's all part of their Cisco Internet Routing in Space (IRIS) program. You have to hand it to them for thinking big. At last the size of their corporate plans are matching their out-of-this-world-pricing (the pricing jabs will be over shortly).

Let's not forget that ProCurve had the first ethernet switch in space. Okay, so maybe it was only a simple 2524 and not a router the size of an apartment complex. But still. Yay ProCurve. Now start making routers!

What are Cisco's ultimate plans?

The long-term goal, they say, is to route voice, data and video traffic between satellites over a single IP network in ways that are more efficient, flexible and cost effective than is possible over today's fragmented satellite communications networks.

Yep, they want to rule the universe. Joking aside, there are some fascinating possibilites that will drastically change satellite communication and functions.

Historically, the brains of satellite communications networks have resided largely in ground-based hardware, with the satellite itself passively reflecting the data beamed up to it. But IRIS shifts much more of the intelligence to the orbiting router – with potentially dramatic benefits, says Cisco's IRIS general manager Greg Pelton

Cisco's plans will also remove the "double-hop" common in satellite transmissions which makes communication difficult for voice and video (think "reporter on the scene")

For all of the fascination I have with the possibilities, I'm still barely able to contain an "All Your Base" reference. I think I'll go play with Photoshop and a picture of John Chambers.

code_swarm: Visualizing software development via commit bits

2010-02-11T05:35:00.001-07:00

code_swarm is a project developed by Michael Ogawa that takes the history of commits on a software project, ties those to the developer's name that caused the commit and renders it into a movie. Watching a code_swarm rendering reminds me somewhat of the old simulation "life".

You can see some videos that have been rendered here. Some examples include the Eclipse project and Python. Here's how the development of Apache looks:

code_swarm - Apache from Michael Ogawa on Vimeo.

I've always been fascinated by visualizing data. For me, I have a hard time pulling back and seeing the larger picture of a thing. That "thing" can be anything from a work project to a life goal or even something as relatively simple as books and magazine articles. Visualizing can help me see correlations that I may never have perceived otherwise. My goal when using visualization is to see information and then learn from it to be able to perceive similar information in other datasets without visualization.

A good example of textual visualization of a complex work is Chris Harrison's visualization of the Bible.

I've long been interested in visualization as a tool for network security. I enjoy Raffael Marty's work in security visualization. Visualizing things like firewall traffic, log files and software development projects can reveal patterns that may have only been vaguely sensed, and even that was only perceived by those that had 1) Have been around networks for a long, long time, and 2) Had the perceptive nature to discern those patterns.

Even pursuits like golf benefit from visualizing data from using different methods. For example, in golf some trainers will take video of a player's putting stroke and play it back in a loop at high speeds to reveal deviations in the stroke's path.

Is there anything that visualization can't help us with? I suppose that careful interpretation is necessary so as not to get caught into the "correlation equals causation" fallacy. However, I believe that visualization needs to be used more in our study methods and in the workplace. Especially in IT. How has visualization helped you in your line of work?

Free eBook! Managing Active Directory with Windows PowerShell

2010-02-10T14:17:00.001-07:00

Quest software has a limited time offer for a free eBook at this link. Scraped from their web page:

Get this in-depth and authoritative Windows PowerShell book AT NO COST!

Discover new ways to manage Active Directory as well as local directory services
Get tips to help make Active Directory and PowerShell work more effectively together
Learn from real-world examples, including complete scripts!

More evidence that multitasking == FAIL

2010-02-10T06:47:00.001-07:00

From GreenM3.com, this is just one of many articles that have been brought to my attention concerning the downfall of multitasking. I didn't have to be sold on the poor effects of multitasking, at least not for my personality and mentality. When I start floating two or three tasks virtually simultaneously, all of the tasks suffer and in many cases are botched and end up having to be redone.

While some people may have more of a capacity for multitasking than others, it seems to be a practice that -- no matter how you look at it -- has detrimental effects. As I've said before, stop multitasking! Start unitasking!

P.S. Yes, the original incarnation of this blog post had a misspelling in the title. Could it be that I was multitasking while blogging? Perhaps.

Solving the error "Cannot add to the server Junk E-mail Lists" within Outlook 2007

2010-02-09T13:33:00.006-07:00

This blog post has been permanently moved to my new blog here:

Solving the Error "Cannot Add to the Server Junk E-mail Lists" Within Outlook 2007

Postini Resellers; Why so cheesy?

2010-02-08T14:51:00.000-07:00

Losing the fight against spam with only Exchange 2007's built in tools to aid me, I've turned to hosted filtering solutions. Google's Postini has my attention at the moment because of it's seeming simplicity, user control and the ubiquity of the Google brand. Postini resellers, on the other hand, have captured my attention because of their lack of polish and seeming indifference to rudimentary marketing policies (such as Rule #1 of Marketing: Don't scare people). While the prices that resellers offer are better than Google, I'm not entirely filled with confidence about the support that is offered when a reseller's website looks like the fruit of a seizure-prone cat dancing across a keyboard with Microsoft Front Page open.

And furthermore, if the complaints about Google's Postini support being virtually nonexistant, what benefit to I get from a reseller who is downstream of that nonexistance? Will the reseller provide me with extra empathetic tech support to listen to me sniffle should Google's fireproof services get burninated? Sarcasm aside, I believe that the resellers may get a special bat-phone to Google's tech support if they have a certain amount of customers.

Dear Postini resellers:

If you want to instill confidence in your customers, please update your websites, include some option for live chat and answer my emails. Wouldn't the ultimate irony be that my emails were caught in their Postini spam filters? Hoist by my own MTA.

P.S. And why do I not look at services like MessageLabs and MXLogic? Because I don't trust anything with the Symantec name (MessageLabs) and I don't like MXLogic because remote mailboxes that use MXLogic for protection tend to block my Exchange server in spite of it having a flawless Spam record and not being on a blacklist. I suspect it's merely because I'm on a block of DSL IPs, even though it's a static, "business class" connection.

SpamHero and AppRiver's SecureTide, however, seem interesting. Any suggestions are, of course, appreciated.

How to manage and how not to manage

2010-02-05T15:08:00.001-07:00

I recently read a blog post by Joel Spolsky that juxtaposed his working experience at Microsoft with his time at Juno. Say what you want about Microsoft, but they know how to treat their employees. This story is a quick and powerful read that everyone facing or occupying a management position should read. Twice.

http://www.joelonsoftware.com/articles/TwoStories.html

My Google number goes to someone else's phone!

2010-01-19T10:27:00.000-07:00

Today I was setting up a website monitoring service, and chose to send SMS alerts to my Google Voice phone number. The SMS alert never came, so I double checked that I typed the correct number. I then picked up my office IP phone and called my Google number... and after 4 rings was connected with some woman's voicemail that I had never heard of before.

Slightly confused and worried, I checked my Google Voice account to make sure it was still active, that my cell phone number was typed correctly and that it was all set up to forward like it should. Everything seemed in order. After some searches on the web (using Google... they're beginning to look more and more like a cradle-to-grave organization; I say this as I use a Google-based blogging service) it seems like there are some similar problems. One involves someone properly receiving the Google call on their cell phone, but voicemail is being forwarded to a wrong number. That's not quite my problem.

I added a second phone to my account and verified it. I then deselected my cell phone as a forwarding number and chose to only forward to the new phone. When I called my Google Voice number, I still did not receive the call after 4 rings and was then connected to some stranger's voicemail box. If there's some woman out there with a name that sounds like "Quitey", I'm sorry for annoying you.

I await contact from people on Google's help forum to see what might be the problem.

Microsoft's Internet Connectivity Evaluation Tool

2010-01-18T04:34:00.000-07:00

If you have Windows Vista or 7, you may want to run the Internet Connectivity Evaluation Tool. It's an ActiveX control that requires IE6 or later to run. It will tell you, among other things, if your router can support some of the advanced features in Vista and above such as "Explicit Congestion Notification" as well as if your NAT router supports cone-type NAT or a symmetric-type NAT.

Can only browse Google based web sites

2010-01-16T16:32:00.001-07:00

My Problem:
On only one computer on the network, I can only browse Google based web sites (GMail, Google news, Google shopping) while connected wirelessly to a Comcast branded Netgear CG814WG modem. All other application layer protocol communication to cross the router to that one PC seem to work fine such as email and VNC connections. All LAN based communication such as SMB and ICMP seems to be working. All other computers on the network can browse the web. If I plug the troubled computer via a network cable into the router, I can browse the internet perfectly.

My Solution:
Reduce the Wireless security to WEP 64-bit. For some reason, the router will cause one PC on the LAN that is connected wirelessly to be unable to connect to web sites other than Google (and possibly other sites) as long as the wireless security is stronger than WEP 64-bit. Thanks Comcast, and your bizarre custom firmware.

Thanks to the user curthesher in this thread for the tip.

45 BaseCamp Alternatives Listed Over at PM-Sherpa.com

2010-01-06T05:30:00.001-07:00

I recently had the need to search out some kind of online project management tool similar to BaseCamp. I've used basecamp before, but figured that I'd check out the competition. I found this lovely article over at PM-Sherpa.com that lists 45 Basecamp alternatives. I think I'll be going with Zoho's PM offering, simply because I really like Zoho's online office suite and use their wiki every single workday. However, there are plenty of other possibilities out there. Check the list out for yourself.

EDIT: I ended up using CoMindWork.com. What swayed me? Well, first you need to know that a Wiki was a requirement for my project management needs. Second, I remembered that in my nearly two years of using Zoho's wiki, I've had consistent trouble with the wiki editor which seems a bit quirky. I even had an entire page's formatting completely thrashed when I simply tried to spell check it. Yes, all of my documentation for a firewall, complete with bullet points, indentation, headings, etc. was rediced to one big long string of text. All the same font, size, style, everything. Only spaces were preserved. So. Much. Fun. I haven't noticed things with the wiki editor improving much over these last two years so I decided to try something new. So far, CoMindWork.com seems to be great.

Leave your next job interview in a blaze of glory! Become the interviewer!

2009-12-31T05:30:00.010-07:00

It's nearly the new year! It's nearly a new decade! Are you going to be looking for a new job? You might need some tips for how to interview the interviewer.

I just read this great article over at TheLadders.com concerning how to "Walk Out of Your Job Interview in a Blaze of Glory". In it are some great questions that you could ask the interviewer when you get the nearly inevitable question "Is there anything you'd like to as me?"

Here are some samples from the article that stood out to me:

Why is this position vacant?
How will I know that I have met your goals?
How will my performance be evaluated, and how often?
Will I be hearing from you or should I contact you?

And for the really daring among you:

Do you see any gaps in my qualifications that I need to fill?
Now that you’ve had a chance to meet and interview me, what reservations would you have in putting me in this position? (Ask it! I dare you!!)

Have a look at the article and decide for yourself if you dare be made memorable as the one who made the hiring manager stutter. If nothing else, they'll remember you. But will it be for the right reasons? I personally think it would be. What do you think? What was the craziest thing you've asked an interviewer? Did it work like you wanted it to?

What Exchange 2007 Service Pack am I running?

2009-12-22T11:52:00.001-07:00

This blog post has been permanently moved to my new blog at www.TheNubbyAdmin.com. You can find this specific post here: What Exchange 2007 Service Pack am I running?

List of Portable Cooling Units

2009-12-16T04:49:00.000-07:00

While perusing through the IT magazine "Processor", I discovered a listing of portable air conditioning units. I don't seem to find myself working in the midst of the most refined IT infrastructures, so I figured this list would come in handy the next time I find myself tasked with managing a broom closet-turned-server-room. For those situations in which you find your self a little "cold-air-challenged", have a look at the following list (as usual, any suggestions will be appreciated and I will continue to update this list when I find more options):

www.Spot-Coolers.com
Exactly what the domain sounds like. They even have a subsection entirely dedicated to "Server Coolers".

www.GoTopaz.com
Exactly what the domain does not sound like. Topaz builds portable air conditioners. Period. Air cooled, or water cooled, they've probably got what you need. They are a part of TempAir Inc. which is ironically located in Minnesota, USA. Not exactly a place that you would think needs much cooling.

www.AtlasSales.com
Yet another domain that doesn't exactly scream "We sell portable cooling units!!" Quite possibly the most thorough product offering of the portable A/C (and heating and dehumidifying!) manufacturers, they have units that are air-cooled, water-cooled, mobile (like, hauled-behind-a-pickup-truck kind of mobile), evaporative coolers, split systems, minis and ceiling mount units.

Make sure to check out the ones that evaporate their condensation so that you 1) don't have to change out the condensation tray as often if ever, and 2) don't dry out your server room too much.

www.APC.com
No discussion of environmental management is complete without mentioning APC. Specifically, APC's NetworkAIR Portable units.

www.BlackBox.com
They provide much, much more than simply air conditioning units, however units of note include:

ClimateCab NEMA 12 Standing and Wallmount Cabinets

Small wall mount cabinets with 800 BTU A/C units attached to them up to 42U cabinets with a 6,000 or 8,500 BTU A/C unit attached to the side.

www.MovinCool.com
Yet another portable cooling systems manufacturer. You can easily search for products based on criterion like cooling capacity or voltage requirements. They also make ceiling mounted units. The company includes a section on their server room offerings, so you know that they understand that their products might be used to cool down servers (which is reassuring to me, for some reason). Note that the domain is "MovinCool.com" without a "g". Someone should tell their marketing department to buy the alternate "MovingCool" domains to prevent mistyped domain confusion.

Geek Desks!

2009-12-11T08:26:00.000-07:00

http://www.geekdesk.com/

Simplistic design... adjustable height... it has wheels! I want one! Apparently the selling point is that you can stay at your computer but periodically switch form sitting to standing to keep your body limber and prevent the strain associated with sitting in front of your computer for hours on end.

I type this after having been at my computers for hours on end.

El Grande list of Open Source Help Desk Software

2009-12-02T05:17:00.001-07:00

Here I was, mulling over the idea of starting a large list of open source help desk software, when I stumble on this thread at ServerFault that included a link to a site dedicated to listing open source help desk software!

The site is aptly named http://www.opensourcehelpdesklist.com/

Three cheers for people who make things so I don't have to! =)

Open-Source Hardware?

2009-11-30T12:34:00.001-07:00

As per this Wall Street Journal article, a company named Arduino has create a small microcontroller board, the schematics of which are freely available online. The two-man Italian company has gone from selling 34,000 of the $30 microcontrollers last year to a forecasted 60,000 microcontrollers this year. Other open source hardware projects of note include Chumby and Bug.

Personally, I wonder what the open-source hardware scene will really accomplish over time. Will it flourish as much as open-source software? Will it create as much innovation and competition as open-source software? Not being a hardware engineer, I can't speak with any authority. However, I doubt very highly that it will come close to the effects that open-source software has had on the world. Anyone can install software, however not just anyone can take advantage of circuit board schematics. The pool of potential project creators and contributors is drastically smaller. However the pool of potential consumers of products based on open-source hardware could conceivably be larger than that of open-source software. Interesting points to ponder.

Does anyone have experience with the open-source hardware "movement"? Any thoughts on the subject would be appreciated.

A Macintosh is a Mac, not a MAC!!

2009-11-28T21:34:00.000-07:00

If you are referrring to Macintosh computers in written word and truncate the brand name to "Mac", please refrain from capitalizing the three letters. "Mac" is simply a nickname, not an acronym. If you type MAC my brain jits it as Media Access Control, and that makes no sense when you say "I just bought a new MAC."

If anyone out there uses the capitalized "MAC" when referring to Macintosh computers, please explain it to me. I believe this is a fairly recent phenomena as I never recall seeing this behavior in the mid and late nineties when I was much more heavily involved in that brand.

Rant over. These aren't the droids you're looking for. You can go about your business.

List of Network Inventorying Software (Update Revision 2)

2009-11-27T16:15:00.000-07:00

This thread over at Security-Forums.com sparked me to create a post where I can list the various IT asset inventorying software that I'm aware of.

Total Network Inventory
Manage Engine (Has multiple tools that could be in this category)
SpiceWorks
Network Inventory Advisor
LANrev
OCS Inventory (Would have been funnier if it was named "OCD Inventory". Commentor Matt recommends using GLPI as an interface for the poorly designed (as of this writing in November 2009) OCS interface. )
Open-AudIT
i-doit (Open and pro versions available. Is it disconcerting to anyone else what the product name turns into when you simply swap the "i" and "o"?)
Lansweeper (Recommended by commenter Chris. Windows only freeware.)

Please contribute if you know of other similar software! Close-source or open-source, it makes no difference.

How to send mail via Telnet

2009-11-24T13:12:00.000-07:00

I've seen a number of tutorials on how to send email using a Telnet session, but the one over at wikiHow.com is the bee's knees. I post the link here as a memory aid, but hope it can help you as well:

http://www.wikihow.com/Send-Email-Using-Telnet

OpenDNS interferes with Outlook Anywhere

2009-11-20T05:00:00.001-07:00

My Problem:
In an office using OpenDNS for name resolution, Outlook Anywhere retrieves an SSL certificate from OpenDNS rather than searching for and using the SSL certificate installed on your Exchange serve.

My Solution:
Use conditional forwarding for your SMTP domain in your internal DNS server to divert DNS queries for your SMTP domain away from OpenDNS.

The Long Story:
One of my users reported seeing a certificate error after I switched my SBS 2008 machine from using root hints to OpenDNS servers. Strangely, I did not have those errors when I used my offsite laptop which was also using OpenDNS servers. To attempt to reproduce the error, I connected to the network with a VPN and changed my DNS server to point to the SBS 2008 server. Sure enough, I got a certificate error.

When I clicked "View Certificate", I saw that I was somehow picking up an OpenDNS cert.

I reasoned that the problem was due to Outlook 2007's hard-coded behavior of attempting to connect to it's list of autodiscover subdomains such as autodiscover.SMTP-domain.com before finally settling on the domain's SRV record. Since we're using OpenDNS, the service tries to be helpful and returns a response when it sees we've requested a domain that does not exist (the IP returned for autodicsover.my-SMTP-domain.com is 208.69.36.132 which is an opendns IP)

Once again, I found it strange that if I use OpenDNS servers directly on my laptop I did not get that IP returned and Outlook Anywhere worked perfectly. I assumed it hadto do with the office having an OpenDNS account tied to that office IP whereas my laptop was not behind an IP address that had a OpenDNS accout. I did not create an OpenDNS account for my IP to see if the problems would suddenly start for me at home.

I logged into the office's free OpenDNS account but did not see any option to prevent a domain or subdomain from being resolved. I found it rather funny... I actually wanted OpenDNS to stop resolving DNS.

Several options presented themselves to me.

Create a split DNS zone on the SBS server that made it authoritative for our public SMTP domain. This split DNS setup is fairly common, but requires you to manually maintain DNS entries that you create in your public zone in your private zone as well. Split DNS would casuse all clients in the building to receive a definitive resolution failure when requesting the autodiscover.my-SMTP-domain.com.
Use conditional forwarders to forward queries for our domain to DNS servers other than OpenDNS's.
Figure out a way to prevent Outlook from querying for the nonexistant domains.

Option 1 seemed viable, and I actually tried it half-heartedly. The added complexity scared me away from it and I ended up deleting the zone. Conditional forwarders won out after the thought of tweaking clients manually for anyone who ever used out email server from within the building made me break out in a rash.

I simply created a conditional forwarder that used our ISP's DNS servers for any query for our public domain name. That did the trick. Incidentally, I had attempted to put in the actually authoritative name servers as targets for the forwarder, but for some reason the targets would not resolve queries. Not willing to burn any more daylight on this problem, I settled for the ISP's DNS servers and all was well in the land.

P.S. I've also heard that the practice of returning helpful hints for non-resolving domain names that some ISPs do will also cause problems. I haven't had to deal with that yet and hope I never do.

List of Outlook Anywhere autodiscover DNS query attempts

2009-11-18T08:26:00.000-07:00

This is a list of the various DNS queries that Outlook Anywhere clients will attempt to make before finally searching out a SRV record in the domain. This is taken directly from Microsoft KB940881. I reprint it here because I've already spent an embarrassing amount of time searching for this article after I forgot where I documented it. Hopefully I'll never forget again.

The succession of autodiscover attempts done by an Outlook 2007 SP1 client is now thus:

Autodiscover posts to https://contoso.com/Autodiscover/Autodiscover.xml. This fails.
Autodiscover posts to https://autodiscover.contoso.com/Autodiscover/Autodiscover.xml. This fails.
Autodiscover performs the following redirect check:
GET http://autodiscover.contoso.com/Autodiscover/Autodiscover.xml
This fails.
Autodiscover uses DNS SRV lookup for _autodiscover._tcp.contoso.com, and then "mail.contoso.com" is returned.
Outlook asks permission from the user to continue with Autodiscover to post to https://mail.contoso.com/autodiscover/autodiscover.xml.
Autodiscover's POST request is successfully posted to https://mail.contoso.com/autodiscover/autodiscover.xml.

Autodiscover clients are bringing back a strange certificate

2009-11-16T06:06:00.001-07:00

The Problem:

Outlook Anywhere clients are returning a strange certificate (possibly from Plesk or cPanel) when attempting to connect to your SBS 2008 machine running Exchange 2007 using your public domain name.

The Solution:

Check your domain's DNS settings to see if you have a * record that handles all queries for subdomains that don't explicitly exist. For example *.mydomain.com. Remove it if it exists.

The Long Story:

Outlook Anywhere Queries several subdomains of your main SMTP domain looking for the autoconfiguration information. After the queries for domains like autoconfigure.my-SMTP-domain.com fail, then Outlook will query for a SRV record. SBS 2008 relies on a SRV record to point the Outlook Anywhere clients to the proper URL using the proper hostname that was registered in your SSL cert.

My clients were returning a certificate error with a host of problems.

After some heart palpitations in which I fretted that I had munged the certificate creation process somehow, I clicked "View Certificate" and found something puzzling:

The certificate was issued to Plesk! Plesk is the control panel that our domain is managed with. Somehow or another, Outlook was getting sent to something on our domain that was returning our control panel's certificate.

I tried some things, and then realized that I could type any nonsense gibberish as a subdomain of my main domain and be sent to our website. That caused a few minutes of childish fun as I typed silly subdomains in just to see them successfully bring up the organization's web site. That still didn't clue me in to the real problem though... because I'm a nublet and was not aware of DNS * records. After some sleuthing I happened to come across a forum that mentioned a "*" record which jogged my memory. I had actually seen a * record in our DNS control panel and hadn't thought much about it.

I quickly deleted the * record from our DNS control panel and after DNS propagated, Outlook Anywhere worked for my clients.

Personally, I think Outlook's requirement that DNS resolution fails for certain subdomains before it seeks out the SRV record is a bit flakey and error prone. In fact, you will see exactly why that might cause grief for some people that use OpenDNS or even certain ISPs in a post later this week...

The succession of autodiscover attempts done by an Outlook 2007 SP1 client is now thus:

Autodiscover posts to https://contoso.com/Autodiscover/Autodiscover.xml. This fails.
Autodiscover posts to https://autodiscover.contoso.com/Autodiscover/Autodiscover.xml. This fails.
Autodiscover performs the following redirect check:

GET http://autodiscover.contoso.com/Autodiscover/Autodiscover.xml
This fails.
Autodiscover uses DNS SRV lookup for _autodiscover._tcp.contoso.com, and then "mail.contoso.com" is returned.
Outlook asks permission from the user to continue with Autodiscover to post to https://mail.contoso.com/autodiscover/autodiscover.xml.
Autodiscover's POST request is successfully posted to https://mail.contoso.com/autodiscover/autodiscover.xml.

Google Dashboard; more convenience than transparency

2009-11-12T10:54:00.002-07:00

Some news headlines are touting Google Dashboard as a step towards transparency concerning the data that Google is collecting on you. After some research on the product (including using it for myself), it seems to be nothing more than a simple web page that lists all of the Google products that your account has activated with links to configuration pages for those products as well as some summary information.

Open Boston Media has a good review of the product that seems to put things in perfect context. This is certainly a convenience, but hardly worth labeling "transparency". As some have pointed out, this seems more like conditioning people for a single-sign-on experience which will either encourage people to use more of Google's existing services or be more likely to opt in for future services (or probably both).

Nonetheless, it can be useful for people who use a Google account to see what is publicly visible. Check it out for yourself and you just might discover that more about you was available than you first thought.

VMWare View 4 touted as "Disruptive, Game-Changing"; Uhhh... ever heard of Terminal Services?

2009-11-11T17:49:00.004-07:00

Accorind to this ChannelInsider.com article, VMWare View 4 "could revolutionize how IT infrastructure is deployed today." Yet reading on, it seems to simply be another way of deploying a desktop computing experience to thin clients or home users' PCs ala Terminal Services or Citrix XenApp (née MetaFrame Server, née Presentation Server). The only difference being that View 4 would be based on virtual machines rather than different interactive sessions on the same server. Is that difference enough to call this "revolutionary"? I'm not hugely familiar with TS or Citrix products, but this seems to be pure, unadulterated hype. Cool hype... but hype nonetheless.

As always, I'm eager to be proven wrong. Anyone want to step up and school me?

P.S. Not that I'm complaining about good hype for VMWare. Anything that raises the price of my VMW stock makes me smile. =)

Updated! Appending Whitelisted Domains to Exchange 2007's BypassedSenderDomain variable

2009-11-09T11:22:00.001-07:00

My Problem:
I added a few domains to Exchange 2007's domain white list via the Exchange Management Shell using the cmdlet, Set-ContentFilterConfig -bypassedSenderDomains domain1.tld,domain2.tld. However, running the same command with domain3 as a variable will overwrite domain1.tld and domain2.tld. I needed to add domain3.tld to the existing whitelisted domains.

The Solution:
Nov 11, 2009 Update: Thanks to a tip in the comments section from one of my readers ( ::waves at Sharon:: ), I now use Glen Scales's PowerShell script that creates a simple GUI interface which allows you to update both the bypassedSenders and the bypassedSenderDomains list.

Before that GUI script, I would dump the existing contents of the bypassedSenderDomains variable to a new variable, add information to the new variable and then run Set-ContentFilterConfig using the newly modified variable:

$varWhitelist = (get-contentFilterConfig).bypassedSenderDomains
$varWhitelist.add("domain3.tld")
Set-ContentFilterConfig -bypassedSenderDomains $varWhitelist

There! It's so simple... or, not?

Etcetera:
As an addendum to this post, I have a complaint to lodge. Firstly, I don't mind a CLI/shell. I like PowerShell. I feel ashamed that I'm such a GUIfied Windows admin and sincerely want to get proficient with the command line, preferably PowerShell. However, the fact that certain functions in Exchange can only be done via the Management Shell and not the Console confutes me. Especially since the Console was touted as being built 100% on PowerShell.

Would someone in Microsoft's development department have their head melt like that guy at the end of Raiders of the Lost Ark if they added a simple GUI interface for the whitelisted domains feature? This seems like such a oft-used feature that it makes no sense to me to hide it in the shell. That's like taking something as commonplace to use as configuring your desktop picture and hiding it in a command line interface while leaving other similar options such as resolution and desktop icons in the GUI interface.

Furthermore, adding new domains shouldn't take three lines of script to do. I'm sure I could cram it on one line, but it's still three separate expressions. What's up with that? Maybe I'm just a whiny Windows admin.

Adding an RDNS record for a SBS 2008 environment

2009-11-03T14:14:00.002-07:00

My Situation:
I was reading about the various kinds of DNS records needed for email to flow properly in an SBS 2008 environment and decided to create a simple RDNS record for mail server. My confusion came when I wasn't sure if the RDNS record should contain the name of the server as seen on the local network or as seen from public DNS.

The Solution:
When creating an RDNS record, the hostname should match both the external A record for the IP where email exits your network as well as the FQDN that your MTA presents to SMTP servers. Most SBS 2008 admins will use remote for the external hostname A record and thus the RDNS record that they create should resolve to that same IP address. The FQDN in the internet send connector should be "remote.yourdomain.TLD"

The Long Story:
When creating a RDNS record, you need to supply the name of the server that is seen in Exchange 2007's send connector. However, when you use the Exchange Management Shell cmdlet "get-sendconnector | select name" you get a different name than if you look at the "specify the FQDN this connector will provide in response to HELO or EHLO" (that can be found by going to the Exchange Management Console >> Organization Configuration >> Hub Transport >> Send Connectors Tab >> right click the Windows SBS Internet Send [server name] connector and select properties >> General Tab)

The cmdlet returns the local DNS name of the Exchange server but the Send Connector properties box shows the external DNS name of the server; remote.compayname.com.

Questions started to arise in my head when I arealied that I've seen email headers stamped with the local DNS names of the email server and not the public DNS names. I wondered if I needed to create an RDNS record using the internal name of the server which would require me to create an A record in the public DNS zone named with the same name or if I shuold just create the RDNS record to point to the already existing "remote" A record.

After some research (the specific documents that I found were not recorded so I can't give links here; I'm a bad, bad researcher =( ), I discovered that the proper configuration does not include the name of the server on your local network in any way.

APC creates unobtrusive equipment racks that look like furniture.

2009-11-02T12:46:00.000-07:00

Plenty of admins/consultants have to deal with small offices and branch offices that need a server or three, a firewall and maybe some switches. But where to put them? Usually those devices end up being bunkmates with mops and 5-gallon containers of Janitor in a Drum. However, APC has created their NetShelter CX series that looks like an unobtrusive pieces of office cabinetry.

I have two concerns however:

What about airflow? I see that the back is a screen but is there sufficient room on the front for intake? Being that it's produced by APC, I would give them the benefit of the doubt that they would take that into consideration.
What about cooling? Does this thing trap heat more than a normal server rack would? That faux wood paneling must surely be more of a heat trap than the simple aluminum sides real server racks have. A subpoint of this issue is: Would it make people take the need for proper A/C flow on the unit even less seriously than people already do? Does making it look like a piece of furniture encourage equipment to be placed out in the open office where dust and heat roam unchecked??

Nonetheless, I'll look into one of these devices if the need for one at a small office rises.

Adding a Small Business Server 2008 Autodiscover SRV record using the Plesk Control Panel

2009-10-31T17:06:00.003-07:00

My Problem:
When I went to create a SRV record for my SBS 2008 machine in the domain's Plesk control panel, I was confused by the wording that Plesk uses concerning the record's options. I had to map the four required pieces of information to the seven available options.

My Solution:
The four required pieces of information as per KB 940881 are Service, Protocol, Port Number and Host. Those map to the following inputs in the Plesk control panel.

"Service: _autodiscover" maps to "Service Name" in the Plesk control panel. Do not manually type the leading underscore; only type "autodiscover" (minus the quotes, of course)

"Protocol: _tcp" maps to the "TCP"  radio button in the Plesk control panel.

"Port Number: 443" maps to "Target Port" in the Plesk control panel.

"Host: mail.contoso.com" maps to "Target Host" in the Plesk control panel. Use whatever hostname you have on your SSL cert. For the majority of SBS 2008 scenarios it will be remote.yourdomain.com.

The Long Story:
I had come to the point in my SBS 2008 implementation where I needed to create the autodiscover SRV record. However, when I logged into the Plesk control panel for the domain I was a bit puzzled. The wording for the various options was a bit ambiguous.

This helpful simplification of the facts surrounding the SRV record helped me get an initial grasp of the topic. According to the official KB article on the SRV record, I need the following information in the record:

Service: _autodiscover
Protocol: _tcp
Port Number: 443
Host: mail.contoso.com

So, I see a total of 7 possible options in the Plesk control panel and only 4 pieces of information that I'm supposed to feed it. Time to try and map the two categories to eachother.

I assumed that the "Services Name" area was simply a place to put a friendly name for me to reference the record by. I first tried "Outlook/Exchange Autodiscover" as the name, but that was reject. I assumed it was the '/' that caused issues, but taking it out didn't resolve it. I took out all spaces and that allowed the record to be created but not in the way that I thought it should be.

After some thought, I realized that the "Domain Name" section did not have an asterisk and was not necessary. Therefore, the Service Name section was probably where _autodiscover went and the domain name section should be left blank! I just that and received this confirmation:

That almost looked perfect... but that underscore in front of autodiscover seemed a tad too long. I then noticed that the underscore in the tcp portion of the record was not something that I supplied. Apparently, the underscore is not supplied for any of the information but is autocreated by the DNS service. I simply used "autodiscover" as the service name and that looked better:

The "Protocol" input seemed to be self explanatory. "Enter Domain Name" puzzled me a bit. Looking down, I saw the options "target host" which I figured would be the name of the subdomain that points to the mail server; remote.domain.com. Therefore I figured that the "Enter domain name" section was only if you had a very subdivided domain namespace.

The "Priority" and "Relative weight for records with the same priority" sections completely baffled me. I left them at their defaults. I placed "remote.domain.com" in the "Target Host" section (the domain that was registered in the SSL certificate) and "443" in the target port section.

After all this, I had a properly formed SRV record for my Outlook 2007 clients to use.

SBS 2008 by default bounces messages to postmaster and abuse accounts

2009-10-30T11:18:00.000-07:00

I wonder how many SBS 2008 boxes do not have properly funcitoning postmaster@ and abuse@ email addresses. Why? Because by default, emails to those accounts from external addresses are bounced. The short story is that the postmaster@ and abuse@ email addresses are assigned to the "Postmaster and Abuse Reporting" distribution group. By default, the only member of that distribution group is the "Windows SBS Administrators" group which by default requires that all senders must be authenticated! Doh!

Much thanks to Mariette Knapp over at SmallBizServer.net for her bite-sized article concerning the issue and how to fix it:http://www.smallbizserver.net/Forums/tabid/53/forumid/104/postid/110738/view/topic/Default.aspx

Configuring RDNS records for a Qwest.net business accout

2009-10-24T17:02:00.000-07:00

To set up RDNS records for a Qwest.net business class network connection (mine is a DSL line), you must first log into Qwest.net using your account information. Next, select "Manage your account", then select "Configure your DNS Records" and finally "Configure Reverse DNS Records"

You would use this process regardless of if your donain's DNS records are hosted at a different provider such as your web host or domain registrar. In my case, our domain's DNS records were hosted on our web host's name servers. However, reverse lookups are a function of the ISP and not typically the name servers that are authoritative for your domain unless you've explicitly told your ISP to delegate RDNS authority to different DNS servers.

Exchange 2007: Sending as a certain user fails because you do not have the proper permissions

2009-10-22T18:07:00.000-07:00

My Problem:
Even after being granted the Full Access, Send As and Send on Behalf Of rights, my emails from that user account were being rejected with the following error message:

Delivery has failed to these recipients or distribution lists:
You are not allowed to send this message because you are trying to send on behalf of another sender without permission to do so. Please verify that you are sending on behalf of the correct sender, or ask your system administrator to help you get the required permission.

My Solution:
This was a rather silly error. When creating a new mail, I was typing in the email address into the "From:" field of the new message. That is, I was typing in the full email address in the form of "emailAddress@mydomain.com". To send as the user, you need to either click the "From:" button and select the user from the address list or type the users Alias and let Exchange resolve it (E.g. emailAddress without the "@mydomain.com" part --> click Check Names).

Managed vs. Unmanaged Code

2009-09-29T17:25:00.002-07:00

While reading through the Internet Information Services 7.0 Resource Kit, I repeatedly came across the concept of unmanaged and managed code. A quick Google search later and it all makes sense (almost)! Thanks Kate Gregory!!

Installing a SSL Certificate on SBS 2008

2009-09-28T10:49:00.007-07:00

The Short Story:
Want a cheap but trusted SSL certificate for SBS 2008? GeoTrust's RapidSSL certs are $19.95 per year through eNomCentral and seem to be trusted by enough devices to make me a happy camper. eNomCentral has a few minor downsides (see below for the whole story), but all in all it was a fine experience. The remote site works, Connect to a Computer works, the only thing left to test is Outlook Anywhere, but that is for another day (EDIT: Outlook Anywhere works flawless!). You can test out the RapidSSL cert for free for 30 days using the FreeSSL option just to make sure it fits your needs.

The Long Story:
The time has come to install a SSL certificate on my SBS 2008 server. I recommend reading this amazing post by Sean Daniel which held my hand through most of my ordeal. I decided to go to enomcentral.com to get my cert since it's one of the three major registrars that SBS 2008 supports for automatically handling your public DNS settings. While I don't plan on using that service, at least I know there's a relationship between SBS 2008 and enomcentral.com. I hoped that that would bode well for me.

On enomcentral's site, I perused through the available SSL certificates and honed in on GeoTrust's RapidSSL certificate. Verisign certs were absurdly expensive and SBS Certificates (The SBS stands for Secure Business Services and not Small Business Server -- that was a bit confusing at first) seemed just a tiny but seedy based on my limited research. I know the name GeoTrust and figured that there was no doubt it would be trusted by most devices. Also, GeoTrust RapidSSL certs were $19.99 as opposed to SBS Instant certs being $29.95. I picked a 5 year certificate.

I quickly searched for any coupon codes that might be applicable at the enomcentral checkout but came up empty. In the process I discovered that enomcentral might not the place to go to get your domain names registered or web site hosted due to some customer service issues. Nice to know Microsoft joined forces with them to promote SBS 2008.

I clicked purchase and waited for a moment. Suddenly I saw a screen that said "Thank you for your purchase!" with an order number. No web page invoice or even instructions on what to do or expect next. Nice. I'm already feeling slightly alienated. I checked my mail and there was an "Order Status" email that had instructions. Okay, we're doing a little better now.

I went to my enomcentral account, went to the "SSL Certificates" drop down menu and selected "manage". After waiting for an inordinate amount of time for the page to load (this is not an uncommon thing for the enomcentral web site) I saw my lone RapidSSL cert in the listing of certificates that I owned. Its status was "Awaiting Configuration". The name of the cert was a hyperlink and I clicked it. From there I was able to edit the information for the cert.

I filled out the contact information with my info and one other person's info as a secondary contact. In the process, I nearly forgot to change the CSR source information. It by default is set to "eNom Hosting" rather than "Outside Hosting" which is what I needed. From there I looked to select my web server type and was horrified to see only IIS versions 4, 5 and 6. No IIS 7. I tried to search for a tech support email address but my search was not aided by the fact that their website is apparently using bandwidth on a shared 28.8k modem dialing through AOL over 12 pound test fishing line.

I searched through their support center and only one article came back for "IIS7" and it was simply a two sentence "article" explaining that IIS7 was not available as a hosted service and only IIS6 was offered. However, I was able to submit a support ticket through that system and hoped I wouldn't receive the same bad customer service that others had written about online.

I checked the RapidSSL site itself and it seems that the certs support IIS7. I suspected that if there was an issue with IIS7 it was enomcentral's fault for being behind. Happily, within about an hour I received a response from tech support!

Hello,

Thank you for contacting Technical Support. I'll be happy to answer your questions.

When you are configuring the cert on our site, please choose IIS6. This option will not affect the cert in any way and only has to do with server identification for the cert manufacturer.

I hope this has provided answers to your satisfaction. If you have any additional questions regarding this matter, please let us know.

Thank you for choosing us as your domain name registrar, we appreciate your business.

Best Regards,
Ben H.
Technical Support

I was slightly skeptical, but nonetheless I selected IIS6 as the web server type and pasted in the CSR text that SBS 2008 generated. With trepidation I clicked "Submit Certificate Details". Fortunately, the pack mules they use to tranfer data between me and their web site must have had some Red Bull because the response was quick. I then had to select which approval email I wanted to use. With that done, I was sent back to the "Manage SSL Certificates" page and the status was now "Processing". I checked my mail and within one minute I recevied the certificate request email. I simply had to click through a special URL and selected either "I Approve" or "I Disapprove". After approving it I was informed with the following:

Your order is pending a final quality review prior to issuance. This review is normally completed within one business day. For more information on why your order was selected for final quality review visit our FAQs at https://knowledge.geotrust.com/support/knowledge-base/index?page=content&id=SO9246

It was already almost 5PM Eastern time when I submitted it so I expected it to not be released until the next day. 21 hours later it was released and emailed to me in text format. I followed these instructions from the official SBS blog to install the certificate by pasting the text into the cert wizard. Mere seconds later I was greeted with a successful notification. The Remote Web Workplace was secured and all worked well.

And peace reigned in the land.

"Connect to a Computer" link not visible across the WAN, but can see it on the LAN

2009-09-26T06:43:00.000-07:00

My Problem
When a user connects to the "remote.companydomain.com" site remotely, they can see the "Check Email" and "Internal Web Site" links, but not the "Connect to a Computer" link. When connecting to the site from within the company's LAN the link appears.

My Solution
Use Internet Explorer as your web browser. My problem was that I was using every browser under the sun except IE. How do I loathe IE? let me count the ways.

Dear receptionist Ashley at Bethesda Medical Center at Arrow Springs

2009-09-24T11:52:00.002-07:00

Dear receptionist Ashley at Bethesda Medical Center at Arrow Springs,

I spoke to you over the phone today to make an appointment. You are the most pleasant doctor's receptionist I have ever spoken to. This is either due to you being fresh out of school and not being dragged down by the dragons that double as receptionists or you found where the doctor keeps the Vicodin samples. Or maybe your parents were Care Bears. Speaking to you was like running through the end of the rainbow with a bubble machine.

Thank you Ashley. It's two hours after we spoke and I still feel all warm and fuzzy.

Solving local users not appearing in the Connect Computer application when adding a computer to the SBS 2008 domain; Part 2

2009-09-24T07:53:00.000-07:00

My Problem
(In reference to this issue I had) A user will not show up in the Connect Computer application. After creating a brand new user and ensuring that the new local user can be seen by the Connect Computer application I then moved the old user profile data to the new user profile folder. However, the formerly visible new user profile then becomes invisible to the connect computer app. Removing those files causes the profile to reappear in the Connect Computer app.

In other words, the solution that I used for a previous user account on another computer (documented in the link above) did not work on this machine.

My Solution
This was a bit sneaky and probably not the best way to do it, but I was desperate and so far it seems to work. Created a new local user account and then run the Connect Computer application. The new account should be visible to map a domain account to. Then, without exiting the app, delete all files in the new user profile folder, move all files over from the old user profile folder, switch back to the still running Connect Computer application and clicked "next" without rescanning the profile folders.

This may have some undesirable effects. For instance, The Outlook 2002 preferences of the user were reset, but the pst file was fine. I had to re-create the POP3 mail accounts and reset some of the visual preferences.

The Long Story

When I noticed that the existing user account was not visible in Connect Computer, I created a new local user account (after banging my head on the keyboard) and then checked to make sure the new account was visible in the Connect Computer application. I then deleted all files in the new user profile folder, moved all files over from the old user profile folder, switched back to the still running Connect Computer application and clicked "next" without rescanning the profile folders.

It hung for a while at the "assigning users" step which worried me. I did a ctrl-alt-del from the minimal user interface that the SBS application presents and noticed that it said a user nameed __sbs_netsetup__ was logged on. I launched Task Manager and noticed that MoveUser.exe was indeed taking up CPU cycles. Hmmm... maybe it was just taking a little while because the user's profile was over 60GB. After almost 10 minutes it finished and automatically rebooted.

After rebooting it was logged in automatically as the domain administrator and not the user account that I had ported over. That worried me since all my previous experience had involved the user account that was ported over being logged in after the first reboot.

I logged off and tried to log on as the user and was mercifully greeted with their desktop icons. All looked well, except Outlook (version 2002!) behaved strangely. The POP3 accounts were gone and I had to recreate them. The visual elements like which folder Outlook went to on startup was changed back to default. All in all I accepted it as a success. It's certainly not the most elegant solution and I hope to get to the bottom of things, but it could have been worse...

Solving PPTP VPN Error: 720 on Windows 7

2009-09-22T08:58:00.003-07:00

This post has been permanently moved to my new blog, here:

The Nubby Admin: Solving PPTP VPN Error: 720 on Windows 7

Security logs on client PCs fill up after joining a SBS 2008 domain

2009-09-21T11:34:00.002-07:00

The Problem:
After joining a PC to a SBS 2008 domain, you may soon notice that users cannot log into the machine and the following error is displayed on the logon box: "The security log on this system is full. Only administrators can log on to fix the problem." Or if you log in via RDP you will see the logon message "The security log on this system is full."

The Solution:
Change the log size and/or retention settings for the security log. You can either do this locally or via a GPO.

Locally: Open event viewer (run >> eventvwr), right click the security log, select properties and edit the appropriate settings under the "Log Size" section. Increase the log size for a temporary fix or select "Overwrite events as needed" or "Overwrite events older than" and select a value in days that you're sure won't cause the log to fill up before that number of days has passed.

From a GPO: Look at the options for Security Logs in the following GPO node: Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Event Log. Specifically, I chose to edit the "Maximum Security Log Size" and "Retention Method for Security Log" options.

The Long Story:
After I joined the very first client to my new SBS 2008 domain, I noticed an error upon logging in via RDP: "The security log on this system is full." It was an XP SP2 machine and when I checked the security log I noticed a ton of event numbers 538, 540 and 576 (Logon/Logoff and Privilege Use events). They were logged for users MyServerName$ and SBSMonAcct.

A quick search of the SBSMonAcct user reveals that it is a special account that is created, used and deleted on the fly by SBS 2008. So apparently there's a lot more interaction on the SBS machine's behalf with the client PCs than I first knew about. The security log settings on the XP client were set to cap the security log at an underwhelming 64K and to retain the log for 7 days. With all of those logon/logoff events the log was filling up well before the 7 day limit. I wanted to make sure this didn't happen on any other machines on the domain.

On the SBS box, I edited the "Windows SBS Client Policy" GPO that is created by default and linked to the default SBSComputers OU. I moved to the following GPO node: Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Event Log. I edited the following options:

Maximum Security Log Size: 16,384 kilobytes (the default when you enable this policy)
Retention Method for Security Log: Overwrite events as needed (This place isn't a high security environment and I think 16 megs of security events should be enough. If I need to retain more than that I can change the settings as needed.)

And all was well in the land.

Joing a Server 2003 computer to a SBS 2008 domain

2009-09-19T16:14:00.002-07:00

My Problem:
Trying to join a Server 2003 machine to the domain via the SBS Connect Computer application resulted in the following error:

This computer does not meet the requirements necessary to connect to the network. Supported Operating System Not Found. To joing your computer to the Windows SBS network using the Connect Computer program, you must be running...

My Solution:
Simply add the Server 2003 computer to the domain manually using the "Computer Name" tab in "System Properties". Once the member server has been added, go into Active Directory Users and Computers and move the server from the SBSClient OU to the SBSServers OU. This TechNet document is my source: http://technet.microsoft.com/en-us/library/dd469602%28WS.10%29.aspx

The Long Story:
While attempting to join a Server 2003 machine to my new SBS 2008 domain, I received the above error. For a split second I panicked thinking that for some strange reason Server 2003 could not be joined to the domain. I knew this to be absurd... and yet I didn't want to assume that Microsoft was more sane in some of its practices than what prior experience had proven. Some quick Googling proved that indeed Server 2003 can be a member server. However, the only trick to the process is to make sure you move the newly joined server to the SBSServer OU to keep the client PC GPOs from applying to the Server.

Solving local users not appearing in the Connect Computer application when adding a computer to the SBS 2008 domain

2009-09-17T12:37:00.001-07:00

The Problem:
When joining a computer to a SBS 2008 domain using the Connect Computer application, you may not see some or any local user profiles in the "Move existing user data and settings" dialog box. This can happen even if the "Make this folder private" option is deselected for the user's profile folder within Documents and Settings.

The Solution:
Copy the user profile folder to a new place (I used System Properties >> Advanced Tab >> User Profiles >> Settings >> Copy To) and then delete the original user profile folder. Log in with the user account so that a new profile folder is created. Delete all contents of the new user profile and copy over all contents of the old user profile. You will now be able to see the profile in the SBS Connect Computer application.

NOTE: You may want to first try renaming the NTUSER.DAT file as well as the NTUSER.DAT.LOG and NTUSER.INI files. However, that did not work in my situation and I had to completely recreate the user profile folder.

The Long Story:
I was attempting to join a user's computer to my SBS 2008 domain with the Connect Computer program. On the "Move existing user data and settings" dialog box I was dismayed to find that the drop down lists underneath the "Old logon name" heading were not populated with any user accounts. It was as if it didn't see any local user profiles.

The standard thing to check at this point is if the user profile folders that you are interested in have the "Make this folder private" option enabled which enacts "Level 1 Security" on the folder. Simple file sharing needs to be turned on to see that exact option. In my case, that option was deselected like it should have been.

I went to a different computer and ran the Connect Computer app and on the "Move existing user data and settings" dialog box I was able to see two of the eight profiles! I tried to figure out why those 6 profiles were not visible to the SBS app. Of the 8 total profile folders, only three of the corresponding accounts still existed on the local computer. Of those three accounts on the computer, only two were shown in the Connect Computer app. At this point I suspected that for the profile to be seen, the corresponding user account had to exist on the local computer. This might seem obvious at first, but initially I thought it would search for profile folders regardless of the user account existence.

First in my troubleshooting efforts was to create a brand new local user. After I logged in as that user to create the profile folder, I was able to then choose that profile in the Connect Computer app. I then deleted the newly created user and could not see that profile as an option in the Connect Computer app. That proved that in order for the profile to show up in Connect Computer, there had to be a corresponding user in the local SAM. However, this concept seemed to be thwarted by the fact that there was one profile that was not displayed in Connect Computer even though the user account still existed on the machine.

I decided to investigate that one user account that still existed on the machine but wasn't showing up in Connect Computer. When I logged in I saw the "Personalized settings... setting up personalized settings for Themes Setup" dialog box as if I was logging into a profile for the first time. Hmmm... maybe somehow the connection between the user account and the profile had been broken? But just what is that connection between the account and the profile folder? I didn't know enough about Windows accounts to know. I had a vague idea that it might have something to do with the NTUSER.DAT file.

After that user had logged in, I checked the Docs and Settings folder and noticed a new user profile folder in the format of [username].[computername]. Ouch. It had indeed created a new user profile. Somehow the connection between the original profile folder and the user account had been broken. I deleted the entire [username].[computername] folder and then went into the original [username] folder and deleted the NTUSER.DAT and NTUSER.DAT.LOG files hoping that it would create a new set of files. It didn't work. Logging in caused the creation of a new profile folder.

After much frustration and hacking, it seems that the only way to get an existing user account to use the information in an older profile is to move the profile folder to a different place, log in with the user to have a brand new profile folder created, delete all of the newly created files and folders in the profile and move over all of the old files from the old profile folder. You should now be able to see the user account in the Connect Computer app.

For more information about moving profile information, read MS KB 811151.

Solved: Can't remote desktop to a newly joined SBS 2008 domain computer over a VPN

2009-09-15T08:36:00.003-07:00

This post has been permanently moved to my new blog here: The Nubby Admin: Solved - Can't remote desktop to a newly joined SBS 2008 domain computer over a VPN

Solution to error 0xc0000135 with SBS 2008 Connect Computer application

2009-09-13T10:00:00.001-07:00

The Short Story:
At least version 2.0 of the .NET Framework is required to run the Connect Computer application. Install the latest .NET framework (Microsoft .NET Framework 3.5 Service Pack 1 in my case).

The Long Story:
I have a Windows XP SP2 machine that I browsed to the SBS 2008 connect computer web site with. I downloaded launcher.exe and opened it. After a few brief moments I was met with the error "The Application failed to initialize properly (0xc0000135). Click on OK to terminate the application." Super!

A quick Google search of that error number revealed a simple solution. It appears that that error message is indicative of the .NET framework not being installed. $60 billlion in yearly revenue and Microsoft can't at least mention ".NET Framework" somewhere in that error message?

I went to the Windows Update site and installed the Microsoft .NET Framework 3.5 Service Pack 1 and all was well. Huzzah!

Antivirus exceptions after moving Exchange 2007 files on SBS 2008

2009-09-11T09:00:00.002-07:00

When using the SBS Management Console to move Exchange files, it moves the mailbox and public folders stores. Much of the files, folders and file types that need to be excluded remain on the original drive (the system drive by default) so many of the exceptions shouldn't change. However, to make it easier after moving the Exchange files, I simply masked out the entire "Exchange Server" on the drive that I moved the Exchange data to. E.g.: "E:\Program Files\Microsoft\Exchange Server\"

Not that I'm suggesting that this is the best way to handle things, but it seems to simplify the exclusion process without any unwanted side effects.

Antivirus Process Exclusions for Exchange 2007 on SBS 2008 Standard Edition

2009-09-09T10:53:00.010-07:00

I blogged about a mammoth list of file, folder, process and extension exceptions that are needful for Microsoft's Small Business Server 2008 Standard Edition over here. However, the process exclusions list for Exchange 2007 requires a more thorough treatment.

I use Kaspersky Antivirus for Windows Servers Enterprise Edition on the SBS 2008 machine and it requires me to feed it the actual executable file in order to exempt it from the real-time scanner. This posed something of a problem as I was then required to track down the path to each individual executable file. Here's the list of executables the need to be exempted and where you can find them. The list is broken into two categories: Those that I could find and those that I could not.

Executables that I could find:
•    edgetransport.exe ( C:\Program Files\Microsoft\Exchange Server\Bin\ )
•    mad.exe ( C:\Program Files\Microsoft\Exchange Server\Bin\ )
•    Microsoft.Exchange.Antispamupdatesvc.exe ( C:\Program Files\Microsoft\Exchange Server\Bin\ )
•    Microsoft.Exchange.Cluster.Replayservice.exe ( C:\Program Files\Microsoft\Exchange Server\Bin\ )
•    Microsoft.Exchange.Edgesyncsvc.exe ( C:\Program Files\Microsoft\Exchange Server\Bin\ )
•    Microsoft.Exchange.imap4.exe (as per this article it can be found in C:\Program files\Microsoft\exchange server\clientaccess\popimap\ )
•    Microsoft.Exchange.imap4service.exe (see above)
•    Microsoft.exchange.pop3.exe ( C:\Program Files\Microsoft\Exchange Server\ClientAccess\PopImap\ )
•    Microsoft.exchange.pop3service.exe (see above)
•    Microsoft.Exchange.Search.Exsearch.exe ( C:\Program Files\Microsoft\Exchange Server\Bin\ )
•    Microsoft.Exchange.Servicehost.exe ( C:\Program Files\Microsoft\Exchange Server\Bin\ )
•    Msexchangeadtopologyservice.exe ( C:\Program Files\Microsoft\Exchange Server\Bin\ )
•    Msexchangefds.exe ( C:\Program Files\Microsoft\Exchange Server\Bin\ )
•    Msexchangemailboxassistants.exe ( C:\Program Files\Microsoft\Exchange Server\Bin\ )
•    Msexchangemailsubmission.exe ( C:\Program Files\Microsoft\Exchange Server\Bin\ )
•    Msexchangetransport.exe ( C:\Program Files\Microsoft\Exchange Server\Bin\ )
•    Msexchangetransportlogsearch.exe ( C:\Program Files\Microsoft\Exchange Server\Bin\ )
•    Msftefd.exe ( C:\Program Files\Microsoft\Exchange Server\Bin\ )
•    msftesql.exe ( C:\Program Files\Microsoft\Exchange Server\Bin\ )
•    oleconverter.exe ( C:\Program Files\Microsoft\Exchange Server\Bin\ )
•    PowerShell.exe ( C:\WINDOWS\System32\WindowsPowerShell\v1.0 )
•    transcodingservice.exe ( C:\Program Files\Microsoft\Exchange Server\ClientAccess\owa\bin\DocumentViewing\TranscodingService.exe )
•    store.exe ( C:\Program Files\Microsoft\Exchange Server\Bin\ )
•    w3wp.exe ( C:\Windows\System32\inetsrv\ )

Executables that I could not find:
•    cdb.exe (Symbolic debugger for Windows. This doesn't seem to be a big deal that I couldn't find it. In fact, it might be something that's not included with Windows but something that you have to download and add on.)
•    cidaemon.exe (cidaemon.exe is an indexing service which catalogues files on your computer to enable for faster file searches. According to what-is-exe.com it should be at c:\windows\system32\cidaemon.exe but it is not there on my installation of SBS)
•    cluster.exe (Seems to be only applicable if Exchange is in a cluster which, in my case, it is not so I didn't worry about it)
•    dsamain.exe (dsamain.exe is a AD/AM Active Directory Application Mode from Microsoft Corporation belonging to ADAM Active Directory Application Mode. This worries me a little bit that I can't it.)
•    edgecredentialsvc.exe (It keeps the track of any credential changes on ADAM. It will update the credential changes on Edge Transport. It's supposedly in C:\Program Files\Microsoft\Exchange Server\Bin\EdgeCredentialSvc.exe but it's not in my installation of SBS 2008 for some reason )
•    galgrammargenerator.exe (As per this KB article, it appears that it should be in the :\Program Files\Microsoft\Exchange Server\Bin folder but it's not for my installation)
•    microsoft.exchange.contentfilter.wrapper.exe (I have no idea what this is or where this is supposed to be)
•    microsoft.exchange.infoworker.assistants.exe (as per this thread it should be found at C:\Program Files\Microsoft\Exchange Server\Bin\ but I didn't see it on my installation. Closest thing I have is Microsoft.Exchange.InfoWorker.AssistantsClientResources.dll )
•    Microsoft.Exchange.Monitoring.Exe (C:\Program Files\Microsoft\Exchange Server\Bin)
•    sesworker.exe (As per this article it is involved in the speech server portion of exchange. I'm not sure if SBS can do that or not so I'm not sure if it would even exist on my installatoin. sesworker.exe.config files are in C:\Program Files\Microsoft\Exchange Server\UnifiedMessaging but no sign of the executable )
•    speechservice.exe (According to this KB article the speechservice.exe file is located in %Programfiles%\Microsoft\Exchange Server\UnifiedMessaging . It's not in that folder on my installation. )
•    umservice.exe (According to this thread it should be located at E:\Program Files\Exchange server\bin\umservice.exe but I couldn't find it there even though the UMService.exe.config was there. )
•    umworkerprocess.exe (According to this page The default location is at C:\Program Files\Microsoft\Exchange Server\bin but I can only find the UMWorkerProcess.exe.config file and not the actual exe )

Executables that are really, really weird: (Okay, I lied. There are three categories)
•    inetinfo.exe (inetinfo.exe ~~is used primarily for debugging Microsoft Windows Server Internet Information Services~~ is the IIS web server service. I was confused as to it's debugging properties as a result of some threads on the web. Thanks to commenter "Joe Webster" for pointing that out. As per this thread it appears that it should be in the following location: C:\WINDOWS\system32\inetsrv\inetinfo.exe In fact I did find the executable there [as per this page, it could also be in the following locations: C:\Windows\inetinfo.exe, C:\Windows\system32\inetinfo.exe, C:\Program files\%subfolder%\inetinfo.exe, C:\inetinfo.exe]. However, for some strange reason I cannot see the .exe file when I browse to it in the kaspersky MMC console's dialog box to add it to the process exclusion list. It can be seen in Windows Explorer, but not from within Kaspersky's application to browse to the file. It does not help to run the Kaspersky MMC snap-in as an administrator. )

Default gateway disappears on Broadcom NC Series 1Gb integrated NIC in HP ML115 G5 Server

2009-09-01T15:05:00.000-07:00

I have an HP ML 115 G5 server using the integrated Broadcom NC Series NIC. The operating system is Windows Small Business Server 2008 Standard Edition. I noticed that the static default gateway set in the TCP/IPv4 settings would disappear after a reboot. All other statically assigned TCP/IP information remained such as the IP, subnet mask and DNS servers. I was using the 12.0.0.x Broadcom drivers supplied by HP and also tried the 11.7.0.x version drivers. I then used the Windows built-in Microsoft Broadcom NetXtreme Gigabit Ethernet driver (date 8/1/2006) version 10.10.0.1 and the symptom did not exist.

The solution for me was to use the HPSUM utility to check for drivers and install version 12.2.0.3 of the HP Broadcom driver. The server now retains the static default gateway information after a reboot.

Public DNS resolution problems on a Small Business Server 2008 machine; "Standard Query Response, Server Failure"

2009-08-29T13:02:00.000-07:00

The problem: When using a Small Business Server 2008 machine as your DNS server, DNS resolution is extremely unreliable oftentimes not working at all. Using root hints may offer more reliability than using forwarders which will rarely work at all. When inspecting the TCP/IP dataflow with a protocol analyzer, the SBS machine will query DNS forwarders or root hints servers and either receive no response from them, receive a very delayed response (2 to 6 seconds) or return "Standard Query Response, Server Failure" to the client.

The solution: DNS packets are being interfered with by some gateway device. In my case it was a LinkSys RV082 firewall/router at the edge of the network. The problem was solved by replacing the device with a SonicWall TZ 180.

Dude, where'd my Program Files directory go?

2009-08-28T12:44:00.003-07:00

Vista and Server 2008 no longer have the "Program Files" directory. Where'd it do? Here it is! Sort of.

SBS 2008 Standard Edition Antivirus Exception List

2009-08-28T12:30:00.010-07:00

I have a Windows Small Business Server 2008 Standard Edition installation that I installed Kaspersky Antivirus Enterprise Edition on. I've spent an uncomfortable amount of time researching the various antivirus exceptions that are recommended for SBS 2008 and the various individual components that make up SBS 2008.

Documented here are my findings and what I did for my specific case. Note well that I am not suggesting that this is the best way to do things. This is just my research presented here for you to do with as you please. All comments and criticism are welcomed.

I did not choose to use any of the Live OneCare of ForeFront products and thus did not include exclusions appropriate to those products. Furthermore, you may want to use the EICAR file ( ) to make sure that the following directories are truly being excluded by your antivirus product

Here is the list of exclusions that I used:

(The environmental variables %windir% and %systemroot% are used interchangeably because they mean the same thing. It just depended on where I was copying the string from or how lazy I was when typing. Look at some of the Google returns for windir vs systemroot to see what they’re all about.)

WUAU Related (Reference):

%systemroot%\SoftwareDistribution\Datastore\Datastore.edb (WUAU database file)
%windir%\SoftwareDistribution\Datastore\Logs\Edb*.log (WUAU transaction log files)
%windir%\SoftwareDistribution\Datastore\Logs\Edbres00001.jrs, Edbres00002.jrs (WUAU stuff exclusive to Vista / Server 08 and above)
%windir%\SoftwareDistribution\Datastore\Logs\Edb.chk (WUAU stuff)
%windir%\SoftwareDistribution\Datastore\Logs\Tmp.edb (WUAU stuff)
%windir%\security\*.edb, *.sdb, *.log, *.chk (WUAU stuff)
%windir%\security\database\Security.sdb (WUAU Stuff)

WSUS Exceptions (Reference 1 and Reference 2):

Drive:\WSUS (where "drive" is the drive that WSUS is installed on. C: is default)

Group Policy Related (Reference):

%allusersprofile%\NTUser.pol (Group Policy user registry information)
%Systemroot%\system32\GroupPolicy\registry.pol (Group Policy client settings file)

Domain Controller Related (Reference):

%windir%\ntds\ntds.dit, ntds.pat (Main NTDS files; this is the default location. Check this registry key to find the absolute location: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Database File)
%SystemRoot%\ntds\EDB*.log, Edbres00001.jrs (Default location for the Active Directory transaction log files. Check this registry key to find the absolute location: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\Database Log Files Path)
%SystemRoot%\ntds\Temp.edb, Edb.chk ('ntds' is the default NTDS working folder. Check this registry key to find the absolute location: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Working Directory )
Files in the File Replication Service (FRS) Working Folder need to be excluded. The default FRS Working folder is "%SystemRoot%\ntfrs" Check this registry key to find the absolute location of the folder: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Working Directory. By default, this is the path to the files that should be excluded:

%SystemRoot%\ntfrs\jet\sys\edb.chk
%SystemRoot%\ntfrs\jet\ntfrs.jdb
%SystemRoot%\ntfrs\jet\log\*.log

The FRS Database log files need to be excluded. The default location is in %SystemRoot%\ntfrs. Check this registry key to find the absolute location: HKEY_LOCAL_MACHINE\system\currentcontrolset\services\NtFrs\Parameters\DB Log File Directory. By default, this is the path to the files that should be excluded:

%SystemRoot%\ntfrs\jet\log\edbres00001.jrs, edbres00002.jrs
%SystemRoot%\ntfrs\log\*.log

Various staging folders need to be excluded. The staging folder located at this registry key needs to be excluded and all of its subfolders: HKEY_LOCAL_MACHINE\system\currentcontrolset\services\NtFrs\Parameters\Replica Sets\GUID\Replica Set Stage. The default location on an SBS 2008 machine is at:

%SystemRoot%\sysvol\staging

Other staging folders in their default locations to be excluded:

%SystemRoot%\sysvol\staging areas\
%SystemRoot%\SYSVOL\SYSVOL\

FRS preinstall folder which defaults to "Replica_root\DO_NOT_REMOVE_NtFrs_PreInstall_Directory". By default, this is the path to the folder that should be excluded::

%SystemRoot%\sysvol\domain\DO_NOT_REMOVE_NtFrs_PreInstall_Directory

%systemroot%\sysvol\

But my antivirus did a file exclusion for %SystemRoot%\sysvol\* so that all files but not all subdirectories are excluded. If the sysvol folder itself was excluded, then some of the preceding exclusions would be redundant. So confusing.

SQL Server Exceptions (Note: SQL Server Standard is not part of this installation since it's only SBS 2008 Standard Edition. Only the version of SQL Server that is included with standard is taken into account) (Reference):

All SQL Server data files:

*.mdf
*.ldf
*.ndf

All SQL Server backup files:

*.bak
*.trn
*.[whatever else you append to your backup files]

Full-Text catalog files which are at the following paths

%ProgramFiles%\Microsoft SQL Server\MSSQL\FTData (for a default instance)
%ProgramFiles%\Microsoft SQL Server\MSSQL$instancename\FTData (for a named instance)
C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\FTData (Default location of FTData on a SBS 2008 Standard machine running SQL 2005 Express)

Normally directories related to Analysis Services would be excluded but the express edition of SQL server does not included analysis services.
This blog post mentions to simply exclude the SQL folder (which I assume is the entire SQL Server program files folder) as well as the file extension exclusion for database related files. I chose not to exclude the whole SQL folder.

SharePoint Exceptions (Reference):

(The word "drive" Is used to designate whichever drive letter sharepoint was installed on. By default in Small Business Server 2008 Sharepoint Services is installed on drive C:)

"Drive:\Program Files\Common Files\Microsoft Shared\Web Server Extensions" However, If you really don't want to exclude that entire folder, you can exclude the following two folders specifically:

Drive:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\Logs
Drive:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\Data\Applications (If you're not using SharePoint Services Search service you don't have to exclude this)
I chose to exclude the two specific folders and not the whole Web Server Extensions folder.

%windir%\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files
%windir%\Windows\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET Files (specifically for x64 editions of Windows and, of course, SBS is 64 bit)
C:\ProgramData\Microsoft\SharePoint\Config

The former location in Pre Server 2008 OSs is: "C:\Documents and Settings\All Users\Application Data\Microsoft\SharePoint\Config"However Documents and Settings is no longer around and has been in some ways replaced by the ProgramData folder.
I used this article to find the new directory since there is no “Documents and Settings” folder anymore.

%windir%\Temp\WebTempDir
C:\Documents and Settings\the account that the search service is running as\Local Settings\Temp\
C:\Documents and Settings\ the account that the search service is running as \Local Settings\Application Data (Only if you use a specific account for SharePoint services or application pool identities)
C:\Documents and Settings\ the account that the search service is running as \Local Settings\Temp (Only if you use a specific account for SharePoint services or application pool identities)

I Couldn’t find what my search service was running as so didn’t exclude these.

%windir%\system32\LogFiles
C:\Documents and Settings\Default User\Local Settings\Temp (I chose not to exempt the Temp folder and didn’t bother looking for where the new default user temp folder was in Vista/Server 08. Does anyone know?)

IIS Exceptions (Reference):

%SystemDrive%\inetpub\temp\IIS Temporary Compressed Files

Exchange 2007 Exceptions (Reference 1, Refernece 2, Reference 3):

There are various exclusions for each of the different Exchange 2007 roles. There need to be directory, process and file name exclusions so make sure your antivirus program can handle those types of exclusions.

Exchange Directory Exclusions (NOTE: After looking at all the exclusions that are recommended, the thought occurred to me to just exclude the "drive:\Program Files\Microsoft\Exchange Server" directory. So many subfolders and files get excluded that I wonder if it would really be any less secure to simply mask out the whole Exchange Server folder. Thoughts are appreciated.)

All of your storage groups' Exchange databases, checkpoint files and log files. Default location is: %Program Files%\Microsoft\Exchange Server\Mailbox

However, you can determine the exact location by running these powershell commands in the Exchange Management Shell:
Get-StorageGroup -server [servername]| fl *path* (transaction logs and checkpoint file)
Get-MailboxDatabase -server [servername]| fl *path* (Mailbox database)
Get-PublicFolderDatabase -server [servername]| fl *path* (Public folder database)

Personal to my server

E:\Program Files\Microsoft\Exchange Server\Mailbox\
I just exclude %Program Files%\Microsoft\Exchange Server\Mailbox (or whatever your path is) and not worry about subfolders and files.

General log files found in subfolders underneath the following directories by default:

%Program Files%\Microsoft\Exchange Server\TransportRoles\Logs\
%Program Files%\Microsoft\Exchange Server\Logging\
You can run "Get-MailboxServer | fl *path*" to find the specific directories.
Personal to my server that was returned by the above cmdlet

C:\Program Files\Microsoft\Exchange Server\Logging\Managed Folder Assistant
C:\Program Files\Microsoft\Exchange Server\TransportRoles\Logs\MessageTracking
Strangely, I had previously documented that the following was what was specific to my server, but now that does not appear to be the case:

%ProgramFiles%\Microsoft\Exchange Server\TransportRoles\Logs\
%ProgramFiles%\Microsoft\Exchange Server\Logging\
I excluded all four of those paths to be safe.

%Program Files%\Microsoft\Exchange Server\ExchangeOAB (Offline Address book files are located in subfolders in this directory be default)
%SystemRoot%\System32\Inetsrv (exclude the IIS system files located in this folder… I just excluded the whole folder)
Make sure to exclude the temp folder that is used by any offline maintenance utilites like eseutil.exe. By default it is wherever the .exe is run from.
Microsoft says to exclude the server's entire TMP folder. Others debate this.
%Program Files%\Microsoft\Exchange Server\Working\OleConvertor (Where OLE conversions are performed)
%Program Files%\Microsoft\Exchange Server\Mailbox\MDBTEMP (Mailbox database temp folder)
Exclude any Exchange aware antivirus program folders (GFI MailDefense Suite in my case)
Various log files underneath subfolders within %ProgramFiles%\Microsoft\Exchange Server\TransportRoles\Logs\ . Use Get-TransportServer [servername]| fl *logpath*,*tracingpath* to find the exact folders. I just exclude the entire Logs folder.
Various subfolders underneath %Program Files%\Microsoft\Exchange Server\TransportRoles\Data\Queue folder

Use this to find out specifics: Get-TransportServer | fl *dir*path*
Strangely, when I did that I got this which is not in the \Data\Queue path like the KB article said it would be:

PickupDirectoryPath : C:\Program Files\Microsoft\Exchange Server\TransportRoles\Pickup
ReplayDirectoryPath : C:\Program Files\Microsoft\Exchange Server\TransportRoles\Replay
RootDropDirectoryPath : C:\inetpub\mailroot
I excluded all directories to be safe.

“%Program Files%\Microsoft\Exchange Server\TransportRoles\Data\Queue” The transport server role queue database, checkpoint, and log files
“%Program Files%\Microsoft\Exchange Server\TransportRoles\Data\SenderReputation” The transport server role Sender Reputation database, checkpoint, and log files
“%Program Files%\Microsoft\Exchange Server\TransportRoles\Data\IpFilter” The transport server role IP filter database, checkpoint, and log files
The temporary folders that are used to perform conversions:

Server’s TMP folder (I didn't exclude this. Others say that's asking too much and it's fine to not exclude it.)
%Program Files%\Microsoft\Exchange Server\Working\OleConvertor

Client Access server role:

“%systemroot%\IIS Temporary Compressed Files” IIS compression folder use with OWA. The problem is that the KB article says it's for IIS 6.0. The same folder cannot be found on a server using IIS 7. I included that path anyway.
“%SystemRoot%\System32\Inetsrv” IIS system files
“%Program Files%\Microsoft\Exchange Server\ClientAccess” internet related files stored in sub folders of
Server TMP folder (Once again, I didn't exclude this)

Unified Messaging server role

“%Program Files%\Microsoft\Exchange Server\UnifiedMessaging\grammars” grammar files stored in subfolders of
“%Program Files%\Microsoft\Exchange Server\UnifiedMessaging\Prompts” voice prompts stored in subfolders of
“%Program Files%\Microsoft\Exchange Server\UnifiedMessaging\voicemail” voicemail files stored in
“%Program Files%\Microsoft\Exchange Server\UnifiedMessaging\badvoicemail” bad voicemail files stored in

Microsoft ForeFront Security for Exchange Server (Okay, I included some ForeFront exclusions in this post after all but didn't put them on my server) (Reference):

“%Program Files%\Microsoft ForeFront Security\Exchange Server\Data\Archive” archived message
“%Program Files%\Microsoft ForeFront Security\Exchange Server\Data\Quarantine” quarantined files
“%Program Files%\Microsoft ForeFront Security\Exchange Server\Data\Engines\x86” antivirus engine files stored in subfolders of this folder
“%Program Files%\Microsoft ForeFront Security\Exchange Server\Data” configuration files

Exchange 2007 Process Exclusions:
I included the path to the executables where I could find them. Some antivirus programs need to know the path to the executable before it can exclude it. I did not include a path for all of the executables since I was unable to locate each of them. Comments on where to find them would be appreciated.

Cdb.exe
Cidaemon.exe
Cluster.exe
Dsamain.exe
Edgecredentialsvc.exe
Edgetransport.exe (C:\Program Files\Microsoft\Exchange Server\Bin)
Galgrammargenerator.exe
Inetinfo.exe (the running process in Task Manager says the executable is in C:\Windows\System32\inetsrv but I went there and can’t find it!)
Mad.exe (C:\Program Files\Microsoft\Exchange Server\Bin)
Microsoft.Exchange.Antispamupdatesvc.exe (C:\Program Files\Microsoft\Exchange Server\Bin)
Microsoft.Exchange.Contentfilter.Wrapper.exe
Microsoft.Exchange.Cluster.Replayservice.exe (C:\Program Files\Microsoft\Exchange Server\Bin)
Microsoft.Exchange.Edgesyncsvc.exe (C:\Program Files\Microsoft\Exchange Server\Bin)
Microsoft.Exchange.Imap4.exe
Microsoft.Exchange.Imap4service.exe
Microsoft.Exchange.Infoworker.Assistants.exe
Microsoft.Exchange.Monitoring.exe (C:\Program Files\Microsoft\Exchange Server\Bin)
Microsoft.Exchange.Pop3.exe
Microsoft.Exchange.Pop3service.exe
Microsoft.Exchange.Search.Exsearch.exe (C:\Program Files\Microsoft\Exchange Server\Bin)
Microsoft.Exchange.Servicehost.exe (C:\Program Files\Microsoft\Exchange Server\Bin)
Msexchangeadtopologyservice.exe (C:\Program Files\Microsoft\Exchange Server\Bin)
Msexchangefds.exe (C:\Program Files\Microsoft\Exchange Server\Bin)
Msexchangemailboxassistants.exe (C:\Program Files\Microsoft\Exchange Server\Bin)
Msexchangemailsubmission.exe (C:\Program Files\Microsoft\Exchange Server\Bin)
Msexchangetransport.exe (C:\Program Files\Microsoft\Exchange Server\Bin)
Msexchangetransportlogsearch.exe (C:\Program Files\Microsoft\Exchange Server\Bin)
Msftefd.exe (C:\Program Files\Microsoft\Exchange Server\Bin)
Msftesql.exe (C:\Program Files\Microsoft\Exchange Server\Bin)
Oleconverter.exe (C:\Program Files\Microsoft\Exchange Server\Bin)
Powershell.exe (C:\WINDOWS\system32\WindowsPowerShell\v1.0)
Sesworker.exe
Speechservice.exe
Store.exe (C:\Program Files\Microsoft\Exchange Server\Bin)
Transcodingservice.exe
Umservice.exe (C:\Program Files\Microsoft\Exchange Server\Bin)
Umworkerprocess.exe (C:\Program Files\Microsoft\Exchange Server\Bin)
W3wp.exe (C:\Windows\System32\inetsrv)

File name extension exclusions for Exchange 2007:

Application-related extensions

.config
.dia
.Wsb

Database-related extensions

.chk
.log
.edb
.jrs
.que

Offline Address Book-related extensions:

.lzx

Content Index-related extensions

.ci
.wid
.000
.001
.002
.dir

Unified Messaging-related extensions

.cfg
.grxml

DHCP Exceptions (Reference):

%systemroot%\system32\dhcp folder (include all the sub-folders and files)

DNS Exceptions (Reference):

%systemroot%\system32\dns folder (include all the sub-folders and files)

That seems to be it. More additions as research and comments warrant.

32 bit Vista really can see more than 4GB of RAM

2009-08-26T14:48:00.003-07:00

Yes, 32 bit Windows Vista really can see more than 4GB of RAM. What's holding it back? In true Microsoft form, it's a licensing thing. Read the whole story here: http://www.geoffchappell.com/viewer.htm?doc=notes/windows/license/memory.htm

Small Business Server 2008 DNS problems; "Standard Query Response, Server Failure"

2009-05-19T17:03:00.005-07:00

UPDATE: This is not the solution after all. Almost one week after implementing this fix the symptoms came back. The ultimate solution is documented in this later post of mine.

The problem: When using a Small Business Server 2008 machine as your DNS server, DNS resolution is extremely unreliable oftentimes not working at all. Using root hints may offer more reliability than using forwarders. Using forwarders will almost always cause resolution to fail. When inspecting the TCP/IP dataflow with a protocol analyzer the SBS machine will query DNS forwarders or root hints servers and either receive no response from them, receive a very delayed response (2 to 6 seconds) or return "Standard Query Response, Server Failure" to the client.

The solution: Open Server Manager and expand the DNS node. Right click the DNS server (the name of the SBS machine) and select "Properties. On the "Interfaces" tab the default setting is "Only on the following IP addresses:" and both the IPv6 and IPv4 address for the Small Business Server's interface are selected. Deselect the IPv6 address and restart the DNS service.

Fixing SoftPerfect's Network Scanner Being Unseen and Offscreen

2009-04-04T12:15:00.003-07:00

I like to use SoftPerfect's Network Scanner utility for many reasons. However, I noticed that whenever I launched the program, it would appear on the taskbar but not be found anywhere on my screen. If I hovered my mouse over the taskbar tab for Network Scanner, I could see the pop up that showed the window's content. I Googled around for a few minutes and came across this blog post from Chris Rasco. To summarize, he theorized that the window was simply off screen and that possibly his dual monitor setup caused some errant registry entry for the programs window location. He edited the registry to solve the problem. I have a dual monitor setup. I hadn't considered that the window might be off screen and that suggestion caused me to think of another solution that did not involve a registry tweak.

I clicked the Network Scanner tab on the taskbar to bring the unseen window to the front. I then hit alt + space to bring up the window's drop down menu. Instantly, on the far right of my second monitor I saw the window's drop down menu appear (but still couldn't see Network Scanner's window). I selected "move" from the menu and then, using the arrow keys, was able to bring the Network Scanner window back to a place where I could see it.

So if you ever find yourself asking, "Oh teh noes! How do I get my SoftPerfect Network Scanner to be visible again!" you now have two ways of solving the problem. =)

How to get a free Experts Exchange account

2009-03-06T18:20:00.010-07:00

This post has been permanently moved over here: http://thenubbyadmin.com/2010/07/14/how-to-get-a-truly-free-experts-exchange-account

Solved: Cannot connect via RDP through RWW

2009-01-08T05:35:00.001-07:00

The Problem:
When trying to connect to a remote Windows XP PC through Remote Web Workplace, you receive the error:

"The Microsoft Terminal Services Client ActiveX control (also known as Microsoft RDP Client Control) is either not available, or is not enabled. For more information about installing and enabling the ActiveX control, see the Microsoft TechNet Web site (http://gomicrosoft.com/fwlink/?LinkId=103719)"

The Solution:
Upgrade the XP PC to SP3 and then confirm that the Microsoft Terminal Services Client Control ActiveX control is enabled within IE's "Manage add-ons" window.

The Long Story:
After a user received this error, I dutifully read through the KB article that was referenced in the error. While reading the KB article a few things about this situation stood out to me:

The user's computer was XP SP2 and not SP3 (the fact that it was Media Center Edition did not seem to be relevant to me).
The drop-down panel in Internet Explorer which usually prompts the user to download the ActiveX client did not appear
The version of Remote Desktop that was on the user's PC was 5.1

In reality, I had several XP SP2 machines that had this same issue. It was only one user that reported it, however I used those multiple XP SP2 machines to test on throughout this whole ordeal.

For Terminal Services Web Access to work, the Terminal Services ActiveX client must be installed (mdrdp.ocx). It is installed, but disabled by default in XP SP3. I was under the impression that this very thing was what was offered to clients when they attempted to connect to the RWW so I shouldn't have to download it manually from the Microsoft website.

I wondered if maybe they safety of Internet Explorer was causing it to block the download. A Google search of the error revealed that there is a TechNet page that describes the various errors that can happen when attempting to use Remote Web Workplace. My very error is listed and the solution is as I suspected. Remote Desktop Protocol Client 6.0 or later is required.

I thought it strange that SP3 was not installed since I assumed that the computer would have the standard Windows Update settings that download and install updates automatically. I was a little worried that this users Windows installation might not be fully patched. The automatic updates settings were set to download and install recommended updates every day... at 3AM. I don't think this user's computer has ever been on at 3AM. But aren't automatic updates set to attempt to check and install after every missed opportunity? Hmmm... I checked the local policy on the computer and the "Reschedule Automatic Updates scheduled installations" policy was set to the default of "not configured" which means that missed update schedules are re-run one minute after the computer is next started. All other Windows Updates policies were default.

I went to Microsoft Updates website, and had to install the "New and updated client!" so that means no one had ever been to that site before. Of course, users should never, ever have to do that manually. It should update on its own

SP3 was offered to me, but I decided to forgo that major installation and simply install the latest RDP client to see if that solved things. Of course, after installation it still didn't work. Huh? Ah, that's probably because the new RDP client is 6.0 and I need 6.1. Back to the Windows update site. Unfortunately, it didn't seem to think I needed RDP 6.1 and this didn't offer it to me. I then used the manual download page (which I should have done all along). After installing 6.1, things still wouldn't work so I did what all Windows admins do: I rebooted. RWW's "Connect to a Computer" feature still wouldn't work or offer me the IE Information Bar drop down to install the ActiveX control.

Strangely I noticed that the mstsc.exe app still showed version 6.0.6001 and not 6.1. However, at the bottom of the about box it states "Remote Desktop Protocol 6.1 supported". I found this article which showed that I could bypass RWW and go straight to the terminal server using the RDP client. I decided to try that. If that didn't work, then it was definitely a RDP client problem. It worked like a charm. RDP itself didn't seem to be the issue. Maybe.

Finally, I simply installed SP3 on one of the affected PCs. It still didn't work! I tried it on my 7 laptop and even though the ActiveX control was not installed and I received the same error message, I saw the warning message "This website wants to run the following add-on". The information bar is what I was hoping to see this whole time. I began to be suspicious of the IE settings on the problem XP PCs.

I added remote.[mydomain].com to the trusted sites zone. No luck. I tried without add-ons, and still the "Information Bar" would not show up. I looked around for some information concerning a recalcitrant information bar. I open the advanced security settings (Tools >> options >> security tab>> advanced) and compared the ActiveX section of one of the problem PCs with the ActiveX section of a Windows 7 machine. They were both identical on the default medium-high settings. I decided to turn off the the Information bar for ActiveX controls (ActiveX controls and plug-ins >> Automatic prompting for ActiveX controls >> Enable). The exact same symptoms persisted.

I found someone on the net that had a similar problem. As a result, I reset all security zones to default and then finally reset IE 8 altogether. Still no change. I disabled the Kaspersky antivirus with no change. There was some registry hacking suggested in this Experts-Exchange thread, but I didn't pursue it: http://www.experts-exchange.com/Web_Development/Miscellaneous/Q_21592102.html

I realized that these two XP SP2/3 machines were internal to the network. Maybe that had something to do with it. I tried an XP SP3 machine external to the network. It was not a member of the domain nor had it ever connected to the RWW before. It went right through without even asking me to install the activeX control. It was IE6 so I upgraded to IE8 and I got the error "The Microsoft Terminal Services Client ActiveXC control" etc., however I heard the familiar "ba-blip" noise and saw the Information Bar drop down and ask for the ActiveX control to be installed.

I tried it on a Server 2003 SP2 machine that was a member of the domain. I received the same TS ActiveX control error, but saw the Information bar drop down in the newly opened remote access window.

I installed SP3 on a completely different XP SP2 machine and was able to flawlessly connect to the RWW terminal services feature. The first XP SP2 machine that I was working on had been upgraded to SP3 still had problems. After some more testing, I decided to deem that Windows installation as "troubled" and that the symptoms I had experience were not normal. SP3 should have fixed the issue for that one machine, but it didn't. It's always fun when you're test machine is unstable and returns unpredictable and nonstandard results. Note to self: always use multiple test machines.