Higher Power Technology

pfSense and Squid Proxy - Managing RAM Usage

2012-01-27T15:19:00.000-06:00

My systems RAM usage typically hovers between 60% and 80% and the installed system is pfSense 2.0.1 with Squid, SquidGuard, and LightSquid.

To manage your cache effectively and reduce memory usage:

On the Cache Management page: Reduce the Memory Cache Size parameter - I use around 25% of host system's installed RAM . This controls how many ``hot'' objects are kept in memory. Reducing this parameter will not significantly affect performance, but you may recieve some warnings in cache.log if your cache is busy.

Reduce the Hard Disk Cache Size on the Cache Management page (on a system with 4GB of RAM I use 10,000 MB, on an old 1GB I use 512 MB). This will reduce the number of objects Squid keeps. Your overall hit ratio may go down a little, but your cache will perform significantly better.

Reduce the Maximum Object Size parameter (I use 512 on new 4GB systems, 64 on an old 1GB). You won't be able to cache the larger objects, and your byte volume hit ratio may go down, but Squid will perform better overall. (The preceding uses information borrowed heavily from http://www.comfsm.fm/computing/squid/FAQ-8.html - all credit to the original author!)

Squid Proxy - Cache Windows, Adobe, and Java updates

2011-04-05T11:54:00.002-05:00

Your pfSense has the ability to cache popular updates like UpdateAccelerator for your favorite OS and its ancillary applications.

You will need to install the Squid Proxy package then go to the Proxy Server under the Services menu.

Select the Cache Mgmt tab then set your hard disk cache size to 3000 MB or better (I set mine to 10000 MB because I have a 250GB hdd and there's still plenty of room left).
Up your memory cache size to around 1/4 of the installed memory - this will speed up your proxy over all.
Set your maximum object size to 512000 - this will cache files up to 512MB, a bit bigger than the biggest service packs I've come across. You can adjust this size as you see fit!

Once you have completed these steps paste the following into your pfSense Squid Proxy "Custom Options" and, save it, watch your updates fly (after the initial download):

refresh_pattern ([^.]+.|)(download|(windows|)update|).(microsoft.|)com/.*\.(cab|exe|msi|msp) 4320 100% 43200 reload-into-ims;range_offset_limit -1;refresh_pattern ([^.]+.|)windowsupdate.com/.*\.(cab|exe|msi|msp) 4320 100% 43200 reload-into-ims;range_offset_limit -1;refresh_pattern ([^.]+.|)adobe.com/.*\.(zip|exe) 43200 100% 43200 reload-into-ims;refresh_pattern ([^.]+.|)java.com/.*\.(zip|exe) 43200 100% 43200 reload-into-ims;refresh_pattern ([^.]+.|)sun.com/.*\.(zip|exe) 43200 100% 43200 reload-into-ims

Ugh, SSL Certificates

2011-03-17T20:36:00.011-05:00

Through much trial and error I think I have it figured out: there are three ways to go when it comes to SSL certificates for your business server needs, and each one can be painful.

Self-signed certificates: With Server 2003 a self-signed certificate meant that you just had to ignore that overly dire warning you were given in your browser. It turns out that it is difficult for non-techies to ignore and has been quite a source of worry for the end user, who then decides that the system is broken and finds something else to do. SBS 2008 changed that in that it becomes a pain in the neck to get your Outlook to work.
Get a certificate from your favorite Certification Authority, like my favorite registrar Register.com. It's fast, easy, and somewhat expensive - a certificate for a single domain name (remote.yourdomain.com is probably the one to invest in) is $72.00 per subdomain for three years. Then it gets ridiculous: Outlook 2007+, Windows Server 2008 SBS or Exchange 2007 and 2010 want you to have a valid certificate that applies to each required subdomain, so a "wildcard certificate" would seem to be in order - I confirmed this by calling Register.com's tech support and asking them which certificate I should use to secure my SBS 2008 - they recommended the wildcard certificate as the answer to all of my needs. $730 for 3 years. Fortunately there are ways around this, so DON'T DO IT. See the excellent Third Tier Blog's explanation of how to configure your DNS to work around this.
Get your certificates from StartSSL. While I have not tried the truly free certificates that they offer, I did undergo the personal and organization validations which were $49.90 each (total of $99.90, I'm not sure what it will cost come renewal time) with the certs being good for two years. Since I manage systems for multiple organizations it makes sense for me to validate each organization so that my personal details don't appear on their certificates! Validating yourself and your organization means getting together your personal identifying docs like your drivers license, birth certificate, and phone bill, then your business identifying docs like Articles of Incorporation, Certificate of Insurance, and maybe your business license - whatever you can show that proves you are you and your business is on board with your plans to get a certificate with their name on it (meaning a letter from the owner or CEO). When requesting certificates you have no option for a "wildcard" certificate, but you may specify as many subdomains as you desire for each of your verified domains - sweet.

An interesting note about StartSSL: there has been some debate as to the legitimacy of StartSSL as a valid Certification Authority, especially with regards to the free certificates. While it is easy to get their free certs if you can prove you own the domain, it is also easy to get certs from other CA's. The barriers to entry to receive a basic SSL cert from the Registrars and other commercial CA's are: verifying that you own the domain and paying their fees. StartSSL's Class 1 performs domain name ownership verification. StartSSL's Class 2 validates your identity using personal documents and business documents then calls your organization and verifies the info, even asking to speak with the owner or CEO!

The real debate is not whether freedom reduces crime with regards to SSL (IMHO it does not - even scammers know it takes money to make money) but whether users have the ability to truly trust an organization - a valid certificate is certainly NOT a guarantee you won't be ripped off, and I feel annoyed that SSL is presented in such a manner - like somehow the crummy lock icon means the web site is not owned and operated by a bunch of crooks

Since StartSSL isn't always considered when adding the Root CA's to OS's and devices you may also have some certificate issues, especially with ActiveSync - by the way, check your Exchange connectivity and certificate problems at https://www.testexchangeconnectivity.com/.

More about SBS 2008 Installation. . .

2011-01-07T11:03:00.001-06:00

The SBS 2008 installation process on an HP Server is buggier than a bucket of roaches. If you don't hold your mouth right while setting it up it just won't take.

Use the Manufacturer's "Easy Setup" CD to perform the setup, but DO NOT EVER put in a password for the Administrator, leave it blank or there is a good chance that the installation will fail, particularly the setup of Exchange.
SBS 2008 can take a very long time to start up, especially after applying updates. Don't panic, give it time to finish and it should be fine. In my experience I worry the most at the black screen with a working mouse pointer but nothing else - just leave it be, it may take a half hour before it comes up! (Update 14-Jan-11 - My half-hour black screen was due to a defective hard disk, it was a one week old server, and I received SMART errors on startup. Restored to a new HDD and boot times are in line with what they should be!)
Don't apply updates during the installation even though this is the course of action recommended in the dialog, you should install them after the installation completes and you have run the Connect to the Internet Wizard. Running the updates during the setup has resulted in a failure of Exchange to properly complete setup.
Run all updates after completing the initial setup (including setting up your Remote and certificates) and before adding any other applications, users, or computers.
Use the SBS 2008 Best Practices Analyzer and do what is says. I don't know why MS doesn't implement these practices during the install process, but it will make for a smoother server experience.

Automatically Print Server 2008 Backup Confirmation/Results Logs

2010-12-16T22:09:00.003-06:00

For a year I've looked for a way to confirm Server 2008 backup results without regularly logging in and examining the Server Manager, perusing the System Logs, or buying a backup software package. Windows Backup makes quite readable reports in the \%systemfolder%\logs\WindowsServerBackup\ folder that can be viewed in Notepad. These files are created upon the completion of each backup, and seem to stick around for a couple of weeks.

Scheduling the following .bat files to run after your backup has completed will yield printed backup reports that will list what is backed up in the first report, then a second report with any exceptions which will be blank except for the number "1" in the bottom center of the page if there are no exceptions.

Create a text file called prtbaklog.bat containing the following:

@echo off

setlocal

if {%1}=={} @echo Syntax PrintDevice (\\Server\Printer)

set device=%1

set prt=N

for /f "Tokens=*" %%i in ('dir /o-d /b "C:\windows\logs\WindowsServerBackup\Backup-*.log"') do call :print %%i

endlocal

goto :EOF

:print

if not "%prt%" EQU "N" goto :EOF

set prt=Y

"C:\Program Files\Windows NT\Accessories\wordpad.exe" /pt "C:\windows\logs\WindowsServerBackup\%1" %device%

The prtbaklog.bat is invoked with the following command syntax:

prtbaklog.bat \\servername\printername

Next create the following .bat file entitled prtbakfail.bat"

@echo off

setlocal

if {%1}=={} @echo Syntax PrintDevice (\\Server\Printer)

set device=%1

set prt=N

for /f "Tokens=*" %%j in ('dir /o-d /b "C:\windows\logs\WindowsServerBackup\Backup_Error*.log"') do call :print %%j

endlocal

goto :EOF

:print

if not "%prt%" EQU "N" goto :EOF

set prt=Y

"C:\Program Files\Windows NT\Accessories\wordpad.exe" /pt "C:\windows\logs\WindowsServerBackup\%1" %device%

Again, schedule it to run after your backup has completed with the command syntax:

prtbakfail.bat \\servername\sharename

Site to Site IPCop to pfSense VPN

2010-11-16T21:11:00.005-06:00

NOTE: Spoofing the MAC Address of your WAN adapter breaks IPSec in PFSense 1.2.3

Since IPCop seems to have slowed development to a slow drip (last stable update was 1.4.21 and it was made available in 2008, but a new beta was recently released - you can get it here), I am beginning the migration from IPCop to pfSense. The extra features and reports will be most welcome, but this will require replacing 20+ IPCop's across four states - all are connected to one central IPCop via VPN. I must focus on minimizing disruption to the end users - simultaneous replacement of all of the units is out of the question.

I considered an IPCop and an pfSense firewall running in a side-by-side configuration with the new pfSense on our second public IP, but this means added hardware and complication with regards to routing.

Once these settings have been completed it is a ready drop-in for the IPCop and the far IPCop should require no additional configuration.

Rummaging around in the IPCop docs I found that its bundled VPN server uses IPSec. Rummaging around in the pfSense forums yielded a sparse description of the settings that allowed pfSense and IPCop to establish VPN communications - see http://www.perkiset.org/forum/all_things_general_tech/vpn_tunnel_helper_pfsense_to_ipcop-t2661.0.html - thanks to the author Perkiset for these nuggets of wisdom. While his exact configuration did not work for me, a slight variation did. I've reposted his settings but revised them with the ones that worked for me.

IPCop Box:

Use pre-shared key
Local and remote addresses thus: (a).(b).(c).0/255.255.255.0 where a b c is the LAN address of the remote network
Dead Peer detection set to restart
IKE Encryption: Blowfish 256, Blowfish 128
IKE Integrity: SHA and MD5
IKE Grouptype: MODP 1536
ESP Encryption: Blowfish 256, Blowfish 128
ESP Integrity: SHA1 & MD5
ESP Grouptype: Phase1 Group
ESP Keylife: 8 hours
IKE + ESP: Unchecked
IKE Aggressive: Not checked
PFS: Checked
Negotiate Payload: Unchecked

pfSense Box:

Local subnet: LAN subnet
Remote subnet: (a).(b).(c).0 / 24
Remote gateway is the public address or domain name of the remote network
Negotiation Mode: Main
Indentifier: My IP Address
Encryption Algo: Blowfish
Hash Algo: SHA1
DH Key Group: 5
Lifetime - leave blank
Authentication method: preshared-key
Phase 2, Protocol: ESP
Encryption Algo: Blowfish
Hash Algos: SHA1 & MD5
PFS Keygroup: 2
Lifetime: 28800 Seconds
Ping Host: This is redundant to the Dead Peer detection in IPCop, which will execute a restart

Migrating SBS 2003 to SBS 2008? Is your target server a ML150G6?

2010-10-19T17:09:00.004-05:00

You may have serious headaches during this migration. Mine lasted four days, with most of the time spent watching Microsoft Support clean up the Active Directory on the source server. A Blue Screen of Death was my ultimate reward towards the end of each install.

BSOD Error: STOP 0x0000003B System_Service_Exception

I checked that all firmware was up to date, I reseated everything I could possible reseat (RAM, CPU, HDD cables, and even the fan connectors), and I spent a lot of time on the phone with HP and Microsoft. Ultimately I gave up on the idea of a "swing migration" - using the MS migration tools to move the user and computer accounts, exchange mailboxes, etc. - and am going with the "side-by-side migration" that any sane admin would do in a small business environment.

Ultimately my Microsoft support rep says that there have been reports of similar issues when doing the migration from SBS 2k3 to SBS 2k8 where the target server is an ML150, and that I should just proceed with the side-by-side migration.

Heres a side-by-side migration in a nutshell:

Load a fresh copy of SBS 2k8 into your new server with a new domain name and server name.
Give your new server its own IP on the subnet.
Set up usernames that are identical to your old servers usernames, if you can set up identical passwords, do that also. I reset everyones passwords on the 2k3, kept a list of them, and set up the users in 2k8 with the same passwords as I assigned in 2k3 - this will make for easy migration of redirected My Documents folders.
Export all of your users Exchange info in the SBS 2k3 to some kind of external drive using Exmerge.
While the export is happening, complete the SBS 2k8 Internet configurations, then set up your SBS 2k8 to redirect the users documents.
Import the PST's into each mailbox on the SBS 2k8's Exchange 2007 using these instructions on Technet. Check the users Outlook - their old stuff will now be there after you reconfigure Outlook to point at the new SBS 2k8.
Use Profwiz from Forensit.com to migrate each desktop from the old domain into the new domain, which will preserve the users desktops, favorites, etc. Before running Profwiz delete the migrating users' Outlook profile from the Mail in Preferences (you backed up the mailboxes, right?). (WARNING: This doesn't work on Windows Vista or 7 - it mudges up the profile and you risk losing their profile data - you will need to back up their docs, favorites, etc., and manually change the domain)
If the users un/pw is the same, the users My Documents will be automatically copied and redirected from the 2k3 to the 2k8 when you log in. Expect the 1st login to take a few minutes.
Reconfigure each desktop's Outlook to point to the new server and check that it works.
Move the client's line of business applications and databases and share folders as required to support them.
Fix all the little things that broke during the process.
If an end-user needs remote desktop access via the RWW you must run the http://connect wizard - the problem is that it doesn't migrate domain accounts, only local accounts, so you will need to use Profwiz (XP and lower!) then once this is complete run the http://connect wizard to complete the process. The connect wizard also allows for automatic configuration of Outlook.
Fix file synchronization on each desktop (because your desktops will still try to synchronize with the old server!) by signing in as a user with local administrative privileges, opening My Computer, selecting Tools, Offline Files, then holding CTRL+SHIFT and clicking on the Delete Files . . . button. Be certain that you have the contents of My Documents moved to the new server before doing this!

Prevent Computers from Hibernating

2010-10-08T17:22:00.000-05:00

Add this to your logon batch fine:

powercfg.exe /change "always on" /monitor-timeout-ac 20

powercfg.exe /SETACTIVE "always on"

Automatically Print NT Backup Logs - Revised

2010-08-31T12:16:00.003-05:00

A serious shortcoming of today's printers is an inability to print output from MS-DOS (or is it a Windows shortcoming?) One way around this is the wordpad /pt [filename] [printer] command. Here's a revised PRTBAKLOG.bat file that will print the last NT Backup Log file to the specified printer.

@echo off
setlocal
if {%1}=={} @echo Syntax PrintDevice (\\Server\Printer)
set device=%1
set prt=N
for /f "Tokens=*" %%i in ('dir /o-d /b "%userprofile%\Local Settings\Application Data\Microsoft\Windows NT\NTBackup\data\backup*.log"') do call :print %%i
endlocal
goto :EOF
:print
if not "%prt%" EQU "N" goto :EOF
set prt=Y
"C:\Program Files\Windows NT\Accessories\wordpad.exe" /pt "%userprofile%\Local Settings\Application Data\Microsoft\Windows NT\NTBackup\data\%1" %device%

There is also a notepad /p [filename] OR wordpad /p [filename] to send output to the default printer should you need it.

IPCop 2.0 - Withered on the Vine?

2010-08-26T13:11:00.001-05:00

Our friends who have worked so hard on the IPCop system seem to have run out of steam - whether it is a lack of community support (the project is too much for one man, I'm certain), or an over-crowded roll-your-own firewall space (pfSense, UnTangle, Shorewall, and M0n0wall, to name the more popular distributions), I'm not certain. What I am certain of is that the others have continued development where IPCop has stalled.

I've had repeated issues with unstable 3rd party addons (Squid and Squidguard addons called AdvProxy and URLFilter), but have otherwise been happy with IPCop. What is spurring my move is not performance (though I think I can see some performance improvements when using other distros - I wish I had a good metric!) but the ability of the firewall to handle client VPN traffic such as a user inside of the network connecting via PPTP to a remote network - iptables apparently can't handle such a situation and won't allow the connection.

I will be reviewing pfSense, but more info on UnTangle and the others would be nice - what do you think of these?

/Update 11-Apr-11

A new IPCop 2.0 Beta has been released! Visit http://sourceforge.net/projects/ipcop/files/IPCop%20Test%20Versions/ and try it out - don't put it on a production box as many features are incomplete but it is in a quite useable condition!

One thing that I've realized: when comparing IPCop and pfSense it's important to consider the that the projects have different targets for their user base - IPCop is aimed at the small office/home office and pfSense is aimed at the big boys - the end products reflect this in their ease of configuration and available configuration options.

Installing Agris Software on Windows 7 64-bit

2010-07-07T11:31:00.001-05:00

I contacted John Deere about Agris and asked whether they supported installing the current version of their software on Windows 7 64-bit edition. They had said that it would work under Windows 7 after the next update (I think he said R15) but it would not be supported in the 64-bit Windows 7.

Don't forget that there is an XP Mode, and the system runs fine when it is in XP Mode! Visit Microsoft's XP Mode Download Page and install it per the instructions on the Microsoft site. Next find and run Windows XP Mode under the Windows Virtual PC Folder in your Start Menu. The XP Mode initially uses an IP Address that cannot reach your Agris server so you will need to then go to the Menu Bar and Select Tools -> Settings -> Networking then select Adapter 1 and change it to your wired or wireless network adapter depending on how you connect to your Agris server.

This is an XP Virtual Machine, an imaginary computer within your computer - use it just like you did XP, map the network drive and install Pervasive SQL, Agris, and the Agris updates. Run Agris from the XP Mode desktop and verify that it functions properly.

You will need to add any printers to the XP Mode using the traditional methods available to XP users.

Working? Good! Select CTRL+ALT+Delete from the XP Mode menu bar and select Shutdown. Go to Start -> All Programs -> Windows Virtual PC -> Windows XP Mode Applications and you will see an Agris shortcut - copy it to your desktop for a quick way to run Agris without the apparent hassle of running the XP Virtual Machine.

W3SVC Log Files are Filling Up Your SBS's System Drive

2010-06-09T08:47:00.001-05:00

I can't believe that I haven't encountered this sooner: The system drive on an SBS 2003 was full. I used my trusty SequoiaView and found that the W3SVC1 folder was 6.14GB - OUCH! A quick Google search yielded an excellent discussion of how to deal with the matter.

At a command prompt enter this all on one line:

at 12:00 /EVERY:Su Forfiles.exe -p C:\WINDOWS\system32\LogFiles\W3SVC1 -m *.log -d -30 -c "Cmd.exe /C del @path\"

This will schedule a job that will run every Sunday and remove W3SVC1 log files that are >30 days old.

Thanks to Tom Watson for posting this gem!

"Power Outage"-Proof Your Mac

2010-06-08T18:57:00.001-05:00

Ah, spring has sprung, the flowers are making me sneeze, and the birds are singing way too loud, way too early. Spring showers have brought not only May flowers but frequent power failures that have rendered my lovely Mac unavailable when I'm out and about. "This moron needs an UPS!" you say - I've been a little slow on the uptake, I'll admit, and after an entire life without one I've been aggravated enough to plunk down my $100 and get one. I'm definitely not proud that I've gone for so long without one - it's been on the list, but it's always been put off then remembered the next time the power went out.

I opted for a unit from CyberPower because it said that it supported Mac and was $30 cheaper than a comparable model from APC. I've always gone with APC and Tripp-Lite for my customers because, frankly, I don't know and trust CyberPower like I do the the other two. But $30 is enough to convince me to try it, and it's my own computer, so noone but me will be aggravated when it breaks. Hopefully I'm in for a pleasant surprise and the unit will be higher quality that I anticipated.

I plugged in the new unit (CyberPower 850VA model CP850AVRLCD), plugged in all my cords and wall warts (Linux box and iMac on the battery side, router, switch, and WAP on the surge only side), plugged it in, hooked up the USB cord to my iMac, and was pretty much done. Surprisingly enough, OS X comes with built-in UPS management software that is under Apple -> System Preferences -> Energy Saver -> UPS tab.

But what about my open programs? I want to run VirtualBox and save the state of the machine if my computer gets interrupted. Safe Sleep seems like a good bet - it functions in ~~MacBooks~~ iMacs like Hibernate does in PC's - the contents of the RAM are saved to the HDD and the computer goes to sleep, powering the RAM and ready to wake in a moments notice. If power is interrupted there is no loss because the RAM was saved to the hard drive and it is simply recovered the next time the computer powers up. It's helpful to set your "Start up automatically after a power failure" option under Energy Saver so that can pick up where it left off automatically. There is no Safe Sleep or hibernate function available on iMacs out of the box, but SmartSleep fixes that. Download it, install it, then set your sleep state to Sleep & Hibernate. I tested this by opening some apps, putting my iMac to sleep, pulling the plug, plugging it back in, and feeling the joy.

Next you will go to the UPS settings under Energy Saver and set your Computer Sleep to a sane amount of time. 5 minutes to 1/2 hour depending on how big your UPS is. I've opted for safety and went with 5 minutes. DO NOT go the extra step and configure any shutdown options - this will quit your programs and shut down.

Your computer will now go to sleep with the RAM contents saved after it has been on battery for the time you set. If the battery runs out of juice the computer goes off. When power is restored the computer comes back on. Hopefully the power remains on for a while and allows the battery to recharge because too soon a repeat outage and your sleep timeout won't be reached before it's cut off.

How to find out which user is using which computer on a Windows domain.

2010-04-02T10:03:00.002-05:00

Provided you have access to the domain controller this can be easy. If you don't it gets a bit more complicated.

If you are on the domain controller then you may use your Security Event Logs. I don't know about you, but the Security Logs are the last place I want to dig for information. If the user in question is using shares on the server you will be presented with the username and IP's of computers accessing those shares. On your server go to Computer Management (right-click My Computer, select Manage) and drill down System Tools -> Shared Folders -> Sessions.

If you don't need to know immediately, but you desire a log of login/logoff times. Free Windows Network User Accounting is the tool for the job. Though it is a bit of a challenge to set up, it's worth the effort. This web interfaced system is useful in finding out who is currently logged in and which computer they are using. The log is never cleared unless you clear it, so the history of who used which computer when can provide a lot of insight.

If you only have access to the local computer then checking the Security Event Log and checking the last modified times of the folders in c:\documents and settings\ can provide important clues.

If you are using NetBIOS (which is becoming less and less common) and you know the user's computername or IP address then you can use your trusty command prompt.

nbtstat -A [target ip address]

nbtstat -a [netbios name]

32 Bit ADPrep for Migration to Server 2008

2010-03-24T12:57:00.000-05:00

There's a lot of misleading/frustrating information out there regarding where to find a 32 bit version of ADPrep. Allow me to define the problem: http://www.petri.co.il/windows-server-2008-adprep.htm (excellent info!) states that the Server 2008 DVD is strictly 64 bit and and will not run on a 32 bit server. One must download the 32 bit evaluation version of Server 2008 then extract the \support\adprep folder to some medium that is then mounted on your Win2k (or Win2k3) server and executed.

I didn't want to download a massive ISO and extract files, etc. as I'm on a T1 and time is of the essence. I checked the Server 2k8 DVD's \support\adprep folder and found a adprep32.exe - woohoo! Copy the adprep folder to something that is mountable on your old server, execute adprep32 instead, and feel the joy!

AT&T Global Dialer and Verizon Access Manager Don't Get Along

2010-02-23T17:31:00.000-06:00

If you use Verizon as your cellular Internet provider and you are going to install and use the AT&T Global Dialer on your computer you may run into some issues. Typically users who have Verizon Access Manager (VZAccess) installed cannot install AT&T Global and get it working - it will stop installing then roll back the install. In some cases it also prevents VZAccess from functioning properly even though it was removed.

This has to do with the way AT&T Global Dialer inserts itself in the network stack - their process is messy and dangerous to put it nicely.

So you've installed AT&T and now VZAccess doesn't work? Uninstall AT&T Global if it managed to install, uninstall VZAccess, then restore your system to a point prior to the installation of AT&T' Global. Once the system restore is finished you may reinstall VZAccess and it whould work.

So you can't live without AT&T Global? You will need to download the installation app, but don't install it yet. Uninstall VZAccess, reboot, THEN install AT&T. Once AT&T is safely installed and your system has been rebooted you may then install VZAccess.

Do not taunt AT&T Global Dialer.

Server 2003 Enterprise Edition R2 x64 Terminal Server Software Installation/Uninstallation Slow

2010-02-17T16:42:00.000-06:00

Link goes to post that helped the most (I don't make this stuff up myself)!

I found that my Server 2003 x64 Enterprise Terminal Server was taking a stupid long time to install and remove applications. It was making me crazy! This server has 1TB of hdd space (500+GB free), hardware RAID (with a battery, so write-back wasn't an issue), dual Quad-Core Xeon's, and 8GB of RAM. Everything I installed took an eternity (7-Zip took 45 minutes!)

After much reading I found a forum post saying that someone had used Process Explorer while removing software and was seeing huge amounts of data being copied out of the registry that contained Hewlett-Packard in its key. Further searches have found that when users connect to a Terminal Server and fallback drivers are configured it will try to install the users print drivers in the server, fail, go for the fallback driver, then never remove the installed (nonworking) driver info from the registry.

All the extra info in the registry was being read and written to a backup of the registry during software installs, taking a really long time. Deleting these keys and their subkeys fixed the trouble.

REMEMBER TO BACK YOUR REGISTRY UP BEFORE MAKING CHANGES TO IT!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\RefHive\Hewlett-Packard]

[HKEY_USERS\.DEFAULT\Software\Hewlett-Packard]

Reboot and feel the joy!

Intalling IPCop + USB Keyboard = Headache

2010-02-10T10:17:00.000-06:00

Link goes to a bug report in the ipcop-devel board.

IPCop 1.4.20 has trouble installing on computers with USB keyboards - on mine it was sticking at the blue screen just prior to the language selection dialog. Unfortunately many new computer don't come with PS/2 ports, so USB is a must.

If you unplug your USB keyboard after hitting ENTER to start installation it will start properly (minor errors regarding the keyboard will be seen in the boot messages). When you see the language dialog you may plug in the keyboard, wait a few seconds (I press the NumLock to see if the light toggles) then proceed normally.

How to make your IVANS Medicare Submissions Less Painful

2009-09-15T17:40:00.003-05:00

FISS, IVANS, whatever you call it, Medicare submissions don't seem to go as well as we would hope. Slow often doesn't begin to describe the process. It seems like the PasyDES (also known as Passport IP) just won't work. It won't connect. It hangs. It . . . doesn't work.

First up, if you haven't already, get a VPN account and use the VPN connection - see my previous post on this subject. Alright, everyone's using the VPN? Great - next, check that you have the latest AT&T Global Network Client. OK, now that you're ducks are in a row, let's figure out which servers actually work.

Connect to AT&T and wait for Passport IP to open.
Hit Escape and abort the connection attempt.
Go to Start -> Run -> and type cmd and click OK. A command prompt will open.
Now ping the 1st Chicago server by typing ping 204.146.91.80 and then pressing enter.
Do you get a reply, or does it time out? If it times out, you can try the next IP. If it replies, congrats, you have a working server - make a note of it and keep on trying until you get a second one.

Here are the server IP ranges:

 Chicago: 204.146.91.80 - .88

 Los Angeles: 204.146.91.148 - .154

 New York: 204.146.91.50 - .58

Don't give up until you have two of them! Enter your two addresses into the Connection Setup window, and enjoy a connection that works! If it begins to behave badly, you can repeat the process and find another working server. Happy submitting!
Update 26-Aug-10
Ivans is doing away with the Passport IP system and is instead opting for a system called Lime. They've used Blue Zone for a while, and the users have really liked it, so Ivans has repackaged Blue Zone in a Web interface and is calling it Lime - you may already be able to use it.
Connect with your AT&T Global Client (Ivans Connect), open you web browser then visit https://limecportal.ivans.com. When prompted input your user ID and password - if it proceeds you know you have it. If it doesn't work, call Ivans (or even better go to their Support Chat) and get a new contract.

Internet Usage by Residents in Long Term Care

2009-09-11T14:35:00.005-05:00

As our ever more technically inclined population are aging they are bringing their technical skill set and favorite leisure activities with them into the long-term care facilities. Among these is a desire to use a computer and access the Internet.

The Internet has proven to be a valuable link for nursing home residents and their families. Phone calls and visits in the day room are increasingly replaced by emails and online chats. Boredom is combatted and lives enriched by allowing residents to while away the hours pursuing information about their favorite hobbies, reading the news, or just playing games.

What could possibly go wrong? A Q&A with myself on this subject:

Could a staff members or visitor use a resident's computer to steal their identity or otherwise negatively influence them?

This is a big issue. Many of us save our usernames and passwords to our favorite online haunts in our browser, allowing us to enter them conveniently without the hassle of authenticating each time. However, if it isn't the computers' owner accessing the site we have a situation where someone has successfully masqueraded as the computers' owner. The potential exists for an unauthorized individual to acquire personal and financial information about the resident, or to even manipulate the resident's banking and finances.

Residents who own their own computer should be encouraged to password protect their computer. Furthermore they should be encouraged to lock their computer with a password if they will be leaving it unattended.

What level of service must we offer? Can we ethically prioritize our own Internet traffic over the residents'?

I believe that a minimal commitment of hardware and resources to resident Internet access is all that is necessary. What is more necessary is keeping the business and healthcare functions going at full-speed - not only is this good business, but it is necessary for the staff to be as efficient as possible.

This situation is avoidable if a second Internet connection is established solely for use by residents - an expensive option. What is more affordable, and certainly keeps the business and medical data more secure, is setting up a second network that is logically separate from the facility's business/medical network. If you are using an IPCop you would set up your wired business network in the Green Zone and your wireless resident network in the Blue Zone.

Is it ethical, maybe required, to filter or monitor resident Internet usage?

It depends. One good argument against filtering and monitoring is that we're dealing with free-willed adults. So long as the equipment and time is theirs they should be allowed to do as they please so long as it doesn't do any harm.

But there is a lot of harm that we may prevent by filtering and monitoring access. Many facility administrators have felt that the Internet access restrictions that apply to the staff should, in large part, be applied to the residents with a couple of notable exceptions: online chat and social networking.

Blocking access to shopping, gambling, and potentially dangerous sites serving up viruses and spyware are certainly desirable. Many are in long-term care because they don't have all of their mental faculties - they could drain their life savings if they could shop or gamble online and never realize what they've done.

How prevalent will pornography be?

Probably not very.

I'm certain that we will need to address the social and biological interests of our more amorous residents, as well as the well-being of our staff - the orientation of a resident's computer monitor will be very important. So long as the equipment and time are theirs they should be allowed to do as they please so long as it doesn't do any harm.

I've heard of many residents possessing and viewing a personal store of pornography, and in one case a female resident has regularly provided pornographic DVD's for group viewing by her male peers. The staff did not feel that this resulted in a sexually charged atmosphere or any undesirable public behavior. These are adults with the vices and desires common to most of us.

That said, it is still up to the facility administrator. I've had almost every one that I work with say that they did not feel comfortable allowing access to pornography using the facilities computer network. If they want pornography they'll have to get it elsewhere.

Will our staff be expected to provide technical support the residents' computers?

Absolutely not! In fact it should be actively discouraged. All interaction between staff and the residents' computer equipment should be discouraged. There are so many problems that can arise from good-intentioned assistance with a minor technical issue that the mind boggles. The door to potential ill feelings and financial headaches opens wide if there is a problem and it is blamed on the facility staff. So: Aide Frances helps Mrs. Cardigan install a new game; congratulations Aide Frances, you are now the proud owner of every problem that computer will ever have going forward. Mrs. Cardigan knows that she didn't do anything to it, it must be what you've done.

Residents must seek help from family or paid technical staff from outside of the organization. We can't get involved - there's too much risk.

Are there potential income opportunities for the facility, such as a setup fee or monthly fees?

I've wondered at this long and hard and think that it's not a bad idea. The facility is investing in the well-being of its residents. That investment should pay off.

While additional fees may not be appropriate, it is a feature that will appeal to many residents and will help to fill beds.

What liabilities can this incur? What happens if a resident has equipment that is damaged or stolen?

I'm certain it will matter if the damage is from a staff member, another resident, visitor, or act of God. I'm afraid that every issue could be blamed on the facility staff. It's just the nature of computer users to look for an issue beyond themselves as the cause of their problems.

A comprehensive set of policies will be needed to avoid these pitfalls. Residents that bring computers should be informed that the facility is in no way liable for their computer or the information that it contains. Period. Stick to this line, it will be all that you have.

The facility staff need to make sure to keep themselves from becoming liable - a housekeeper who drops a laptop while cleaning a room is in a bad position indeed.

And what about when another resident breaks the computer? Facility administrators will need to be prepared for this eventuality. If you figure out a good answer to this one, drop me a line!

What if the residents computer is used for criminal activity?

The facility and the residents both would be best served by devoting every reasonable resource to exposing the criminal, the extent of the crime, and prosecuting the offender to the fullest extent of the law. Whether a resident is guilty of using their computer for criminal hacking or possessing child pornography, or another person had used a resident computer to perpetrate a crime or fraud, society's best interests are served by involving law enforcement and seeing that justice is served. Just try to keep it away from the press - no nursing home needs bad publicity, the press is already out to get them.

What about wireless networks – won't the homes and businesses adjoining the facility may be able to join open networks?

The operative word here is Open. Basic WEP or WPA encryption is enough to keep all but the most skilled and determined attackers away. Sure it's inconvenient, but security is never convenient. Your wireless password should be an open secret - shared with anyone who asks. This makes it convenient for residents and visitors to use the valuable and convenient service that you are offering. Since you're keeping the resident's network separate from the business network there will be little gained from attacking the wireless residents network.

What about resident computers provided by the facility in the common areas?

Computers in common areas of the nursing homes will need special treatment so as to avoid issues of ownership, suitability for a particular use, appropriate usage, resident tolerance of frustration, time sharing, software installation, spyware, adware, viruses, etc. Be sure to use a technology such as Microsoft Steady State to prevent as much headache as possible. Even better, ditch Windows and use a Linux LiveCD like Hospitality Machine.

Trouble with URLFilter Addon for IPCop (Like, it quit working!)

2009-09-11T11:16:00.001-05:00

So a customer called me with a complaint about being blocked from legitimate sites, saying simply that a critical banking web site had been blocked. However, there are several ways that one is "blocked" from a web site: a simple issue of old web links or bookmarks, adware in your local computer, network congestion, an active block by your IPCop's URLFilter Addon, or OpenDNS blocking due to restricted content. Each of these gives an error message that is unique to its condition (with the exception of adware, it's meant to be misleading) - unfortuantely this person couldn't remember the content or color of the block message. I suggested they take a photo of the block message with their cell phone and text it to me the next time this happens. Windows does NOT make sending screenshots as easy as it should be.

So another person at the customers' site calls and says that there is no filtering on the system. Wow, two people from the same site with opposite problems? What a puzzle!

While I can't exactly figure out person 1's issue, person 2's issue was that the URLFilter just did not work. It had failed open - allowing access to everything that OpenDNS didn't block. The Advanced Proxy was still working as it was still dutifully logging web site visits - you'll know the AdvProxy has quit and it's just NAT if you have logging turned on but nothing is being logged.

I tried stopping and restarting the URLFilter, the AdvProxy, then the whole IPCop, but it still didn't work. I tried reinstalling the URLFilter over itself so as not to lose my settings and blacklists - no luck. I had to uninstall the URLFilter, reboot the IPCop, the reinstall the URLFilter to make it start working. I had copied all of the settings into textedit, so I was able to put everything right back into place with the exception of the blacklist.

An interesting note: removing and reinstalling the URLFilter component periodically may do some desireable housekeeping: it arranged my blocked sites categories alphabetically (they were a mess prior to that), it seemed to drop some categories that I didn't use anyway, and it seemed to improve the browsing speed.

Dell Inspiron 1545 with Vista x64 Spontaneously Reboots

2009-08-31T19:49:00.006-05:00

I'm not sure which I dislike more, Microsoft, or Dell. The two together are an unholy union that literally keep me up at night. Todays headache comes courtesy of them both. The Inspiron laptop would reboot every 20-30 mintes for no good reason, and it didn't matter if it was idle, in a screensaver, or busy with an update. After rounding up all the usual suspects (all drivers updated, 3rd party software removed, updated the BIOS, removed the antivirus, installed all OS updates, ran Dell's hardware diagnostics) I decided to call Dell.

After a half-hour of Hell because I didn't know that the customer had acquired the laptops at Best Buy (one of Dell's support reps suggested I could only get help from the reseller) a support rep took pity on me and suggested I do a system restore to two weeks prior. I tried that, with no dice. She then suggested that the issue is due to some incompatible updates from Microsoft. That's right, the updates that are supposed to make our computers safer and more stable were crashing this one out. The support rep further suggested that I turn off automatic updates. Fat chance, I told her, then I politely asked if she knew which updates in particular were causing the mischief. After a relatively brief hold, she gladly informed me that the issue was caused by the following updates and suggested that if I remove them my computer would operate trouble-free.

KB973839
KB970653
KB972036
KB973874

I've removed the required updates, rebooted, ran MS Update, hid the offending updates, and have operated the computer for the past hour without incident. I think she may have given me the correct answer - she did great, but Dell is still not on my list of recommended vendors.

IPCop Firewall 2.0 - Coming Soon to a Network Perimeter Near You!

2009-08-28T21:26:00.023-05:00

IPCop 2.0 will be here soon - I just downloaded and installeda beta version of IPCop 2.0 - IPCop 1.9.7 on a Virtual Box on my Macbook Pro. I don't know why, but they're playing it pretty close to the vest. There is virtually no mention of 2.0 on the IPCop.org web site unless you click on the Road Map link - which lays out 2.0's intended features. From the looks of 1.9, it's coming along rather nicely. I'll review the highlights and show you some screenshots.

/edit 11-Apr-2011
It seems a heroic few have soldiered on and are slowly moving toward what will be IPCop Version 2.0. Despite the fact that there hasn't been a new stable version in quite some time, the IPCop version 2.0 is still under development - a new test version 1.9.19 has been released - you can find the test versions at http://sourceforge.net/projects/ipcop/files/IPCop%20Test%20Versions/. Looking at their timeline it would seem that documentation is half finished, and many features are at 80% and 90%. It seems that traffic shaping has not begun implementation, don't even think about using a dial-up modem (my Granddad still uses one - no kidding!)

If you've never heard of IPCop I'll give you a quick rundown: it's a Linux distro that you load into a crappy old PC - they've tested it on a 486 with 64MB of RAM, and it worked at a reasonable speed! You replace your network firewall with this baby and you gain all the power and flexibility of a Microsoft ISA Server (without the hassles and expense) or a Cisco PIX Firewall (again, without the hassles and expense!). Believe me, this thing is easy and fun. For install instructions and tutorial (version 1.4.x at this time, but easily applied to 1.9.x, or even 2.0 once it arrives) check out this Instructables Article.

I spent some time looking for documentation prior to installing the Beta, and found nothing but complaints about install problems or enigmatic questions wondering when 2.0 will be available. Wonder no more: the Beta is available now, you can test it out to your hearts content. In fact, I encourage it - the more people that download the software and try it out, the more feedback will be given to the developers, and the odds are that a few people who install it will know a thing or two about development and make some serious contributions.

Why haven't I contributed? I have! I'm spreading the word! The developers get a golf-clap: by downloading the software you show interest, and no one wants to develop software that no one is interested i. I'd contribute more if I knew how to code and script - I know code and script, but I'm a total script-kiddy: I understand the fundamentals and can manipulate the system once it's made. It's like knowing how to drive, fine-tune, and even fix an automobile, but ask me to fabricate a new piece or improve on the existing engineering and I'll have to pass. I'm confined to standing on the shoulders of giants.

IPCop 2.0 - New Features (From http://www.ipcop.org/2.0.0/en/admin/html/whatsnew.html)

IPCop v2.0 is a development of v1.4, but incorporates some significant improvements.

Linux kernel 2.6.27

New hardware support, including Cobalt, sparc and PPC platforms.

New installer, which allows you to install to flash or hard drives, and to select interface cards and assign them to particular networks.

Access to all web interface pages is now password protected.

The port for https secure connections has been changed to 8443.

Redirection from ports 81 and 445 will not work.

A New Look User Interface, which includes:

A new Scheduler Page, on the System Menu, where you can program various events.

More pages on the Status Menu including new pages for System Info, Traffic Accounting, and IPTables, as well as an overhauled page for Connections. The entire Firewall Menu has been overhauled, and the Pinholes and Port Forwarding are now controlled by Firewall Rules. (This feature set rocks - the port forwarding worked great in 1.4.x, but the "pinholes" made no sense to me.)

An updated Proxy Page, now with advanced control features. (The "Advanced Control Features" are Marco Sonderman's AdvProxy addon for IPCop 1.4.x rolled into the new distro so you no longer have to install it separately. Thanks, Marco!)

There's a simplified DHCP Server Page. And underneath, dnsmasq has replaced dhcpd as the DHCP server.

The Time Server Page has also been simplified, as IPCop now uses ntpd fully.

OpenVPN has been added to IPCop, as an alternative to IPsec. (Whither Zerina? I'm guessing Zerina was rolled into this distro, too. Bravo! At the time of writing the Zerina site was down, here is the Google Cached Page Link)
On the flipside, snort Intrusion Detection System has been dropped from IPCop v2.0, to become an Addon. (I didn't use this - the Sourcefire rules update was an onerous burden, there were too many false positives, and it's strictly reactive - great forensic evidence after the crime is committed but hardly a way to prevent the crime in the first place!)

All in all, I'd say that these are milestone improvements - the install time is drastically reduced by rolling two of my favorite addons into the distro, multiple interfaces with separate IP's may be set up in each zone (2 Red's, one on the Fiber Line, one on the DSL backup?) making this a much more flexible system. I'm glad I stocked up on extra Ethernet adapters!

Oh, and a word to the wise: This is a BETA, don't use it for a production system, use it for testing and development. The manual is certainly less than complete, and I'm certain that many features are half-baked, so you'll experience some headaches if you stake you business on 1.9.x.

Small Business Server 2003 Service Pack 2 Stupidity

2009-08-16T21:22:00.002-05:00

I kept getting the error "Setup could not verify the integrity of the file Update.inf. Make sure the Cryptographic service is running on this computer," when I tried to apply SBS 2003 SP2. I stopped and started the cryptographic service. I read every Microsoft KB and followed every step. I ran DJ-Lizard's Dial-a-Fix - an excellent tool for repairing a variety of windows problems by automating the deletion of some pesky files as well as unregistering and reregistering some pesky DLL's - and still had no luck.

Reading Experts Exchange (well worth the subscription price) another individual had the same problem, ran through the same troubleshooting steps, and had no success until he realized that he hadn't applied SBS 2003 SP1. I checked my server, and sure enough, I hadn't applied SP1. The Stupid Server service packs aren't cumulative? Windows deskop OS SP's are, so I naturally assumed that server service packs would be, too.

Let's Waste Some More Time!

2009-08-15T08:10:00.020-05:00

A lot has changed since my last post about wasting time (not this one, that one!) - users decided that downloading and installing a dedicated application to run Internet television is NOT on their to-do list. Web-based video sites have instead opted to follow a format most similar to YouTube. I like the application-based model because it didn't feel like YouTube, which lets you browse videos much as you would browse Ebay.

Admittedly the new online television sites don't look exactly like YouTube, but I dislike browsing video content inside of a browser window. The full-screen Babelgum and Joost clients had their own personalities which were expressed through various eye candy like slick menu effects, and Joost's fade-to-a-dot like an old-school TV was just awesome - it reinforced the fact that it was TV.

Now that I've got my pitiful whining out of the way, lets look at our FREE online television viewing options:

YouTube

For the sake of completeness I've included the 800 pound gorilla. You know it, you love it. There's nothing that can't be found here - from the inane to the insane. It works in every browser on every platform (OK, that's a bit of a stretch, there's some geek reading this in

Lynx running under Linux on his Atari 2600 who can't). It features low-quality and high-quality modes, fullscreen viewing, and if you have a slow connection you can pause it and let it queue up some more data for a better viewing experience. It's owned by Google. What more can I say? Go watch something stupid.

Hulu

The not-quite 800 pound Gorilla but having 800 pound gorilla backing (Fox, WB, and Comedy Central to name just a few) has many, perhaps too many, TV episodes online for your viewing pleasure. And it's legal - unlike Youtube, which is regularly asked to pull copyrighted content by the content's owners. The content owners have given their precious shows over to Hulu (when they haven't Hulu gladly links to a content-providers site on which you may watch your show), which places a single 20 or 30 second ad at the points where television viewers would endure a few minutes. Even with less ads, they're making a fortune because the advertisers are willing to pay for ads that they know will be seen - it's pinpoint accuracy advertising, unlike the shotgun of over-the-air TV.

Hulu has classics like AirWolf and V, and fresh content like The Daily Show (a day late). An added bonus: Movies. They're not terribly recent, and the content is changed up regularly, so if you missed The Fifth Element when it was on Hulu a few months ago you're out of luck.

OK, on to the geeky stuff: you will need a fat Internet connection to enjoy Hulu thoroughly - the video is usually very high quality. Many hotel networks don't fit the bill. Neither does dial-up. Users with a slow connection can pause the show and let it queue up - it has a handy queue meter when you pause it - for smoother viewing.

Joost

I thoroughly enjoyed their stand-alone client's visual effects. Kudos to Joost for managing to bring some of that visual style to their site. It seems that the corporate television overlords have seen fit to keep their eggs in different baskets (I won't name names, but one rhymes with Schmomedy Schmentral). Ads are placed at the beginning of the show and at appropriate places throughout the show, much like Hulu. There is a lot of classic cartoon content - like GI Joe, He-Man, and Transformers - great stuff, I rushed home after school for these! Newer content from Nickelodeon can also be found here. Also, I'm delighted with the PBS channel, educating and entertaining at the same time!

I'm not thrilled with the layout and navigation of their site - it's clunky, wasting lots of space and hiding the impressive depth and breadth of available content. The video quality is excellent, it queues when you pause it, and you'll enjoy it more with a good fast Internet connection.

Babelgum

The European answer to Hulu and Joost, Bebelgum has an excellent easily customized interface that invites you to search deeper. And deep is what you get here - independent films and Britain's BBC as well as a plethora of documentary films. My favorite documentary? Red Files.

The site is supported by video ads that play at the beginning of the video. Then, during the video, to my irritation, static ad content slides out in a translucent bar, which is closed by clicking the X in the top-right corner. Video quality is excellent. I like this site due to the sheer uniqueness of the content, all of which is professionally generated.

LiveStation

This one is pretty iffy. It's a web site that pairs with an application (spyware risk, anyone?) that streams live TV and radio stations from mostly non-American sources - like the BBC and Al-Jazeera. Remember how I was delighted with the video services that required a player to view the content? Well these guys got it wrong. The clunky player only plays the video or audio half the time due to the fact that users may add content that then becomes unavailable even though LiveStation shows it as available. I think that what they're doing with their client is aggregating the streaming content from a "partner" entity's web site. I'd save the effort and just go to the web site of the entity you want to watch - you'll likely not suffer as much disappointment. Quality is wildly variable. The player app is available for almost every OS and platform, from Windows and Linux to Mac (Intel and PPC!).

Miro

Miro is a horse of a different color. First up you have to download and install it. It is RSS for video. You tell it which "channels" you like, and whenever you run the app it checks those feeds for fresh content, which it will then download for your offline viewing pleasure (the bar doesn't have Wifi? Pshaw, I'm still entertained!). That's right, it saves the movie files right to your hard drive, from which you can copy them into your favorite mobile device and watch them on the go, or you can just watch them in Miro. Miro is NOT for those seeking instant gratification as it must download the entire video before it plays it. Miro seems to be the only video app that plays HD content, so if you hook your computer to your TV and play the videos your in for a real treat. My favorite channels include NASAcast and Monty Python.

TVUnetworks

This one has potential, but in its current form it's too hit and miss, too low quality, and too difficult to navigate to be used by most people. Unless you're an expatriate from Asia, Europe, or the Middle East who's missing the TV from home, you will likely be disappointed by this service. It's similar to LiveStation (see above) in that it attempts to aggregate several sites' streaming content into one searchable, useable place. It won't work unless you download their proprietary plugin (I wonder if its' loaded with spyware?), and the video quality is poor. However, I'm going to periodically check back on this one because I can see the potential - the web site has a visual appeal a la Joost.

Firefox: No Longer King of the Browser Hill?

2009-08-12T11:54:00.008-05:00

After nearly seven years of telling Windows users to "Get Firefox!" I've finally stopped - Internet Explorer 8 is faster, just as secure, and has an excellent feature set. I'm not just whistling Dixie here - I deal with hundreds of Windows computers across 5 states. I see users of Firefox with spyware and extra browser bars just as often as I see IE users with those sorts of junkware. IE 8 adheres more closely to web standards and displays web pages the way the author intended. Firefox does - usually. Have you ever connected to Outlook Web Access with Firefox? It sucks. I won't explain why, I'll just wait while you try it.

OK, next up, IE 8 is just plain faster than Firefox 3.5. Take a Pentium 3 with 256MB of RAM and Windows XP, install IE 8 and Firefox 3.5 (go on, I'll wait, this will take a while . . .) then surf the web. IE 8 is faster, and it is most noticeable on older computers.

Also, Google Chrome is cool too. It's fast, displays web pages well, but it works the same as Firefox if you hit Outlook Web Access. On the up side it's new enough that it's a tiny target for malware.

OK, now for my Mac followers: Quit with the Firefox and try Safari. The latest updates have made it super fast, and its interface reminds me of a cross between Firefox and Google Chrome. The Top Sites feature is great eye candy, check the picture at the right.

Best of all, Flash (Shockwave) games work better in Safari. A good example is the Star Wars Clone Wars game my son plays on Cartoon Network. It loads much, much faster on Safari, then actually works. Lets see Firefox do that!

E-Mailed Virus Warnings

2009-08-08T02:08:00.004-05:00

I never thought I would have to make this blog post, but events over the past couple of weeks have forced my hand.

Please: NEVER, EVER FORWARD E-MAILED WARNINGS OF VIRUSES

True virus warnings will not come from the guy that sends you silly emails. They won't even come from your accountant. They will come from the news - yes, that's right, watching the TV news or listening to the news on the radio you will hear stories of impending computer virus doom. Nimda, Melissa, and Conficker all made the 10 O'Clock news. They were worth worrying about.

E-mailed missives of impending doom often come from someone we trust, contain bogusness similar to "I checked with the executives at Symantec and they confirmed that this is for real," and "it will 'burn' your hard drive, making it unreadable and destroying all of your data," and are complete and utter wastes of time.

There are some idiots out there who create things like this then laugh at the chaos it creates. Please don't be their patsy! Don't kid yourself, forwarding these things is almost as bad as spreading a real virus in that they waste time and resources. Resources that have been spent assuring people that this warning is a hoax and that we do not need to prepare for this disastrous worm or virus or whatever. My phone rang for two days. My inbox filled up. My patience wore thin.

Your computer guy has better things to do than assure you that this is a hoax.

Windows XP/Server NTBackup Script

2009-08-04T12:10:00.008-05:00

WARNING

If technical content gives you a headache SKIP THIS POST. I make a lot of assumptions about the technical savvy and familiarity of the user with the command line and DOS batch files.

I've played this one pretty close to the vest, but it's time for the world to behold the glory that is . . . My Windows NTBackup Script. This baby will back up your registry, your Exchange data, Sharepoint, user documents, and, provided you use the proper net stop commands, your databases can all be backed up. Familiarity with your database server also helps - often there is a command to dump the data from the database into a separate set of files that can be backed up while the database is still running.

This script is for backup to an external hard drive - in this case the i:\ drive. It's specific to many of my health care servers, but is easily modified to work almost anywhere - just delete the references to SharePoint, MySql, ProgressiveSQL, etc.

You will need to create the following directories on your external hard drive:

\backups
\backups-shortterm
\backups-longterm
\backups-delete

You will also need to create %windir%\backups\data\sysstate.bks and%windir%\backups\data\userdata.bks by opening up NTBackup, making the selections for your system state and user data, and saving them into the necessary files name and placed appropriately.

Lastly you will need to install Blat in your c:\windows\system32.

REM @echo off

REM ***Set Variables***
Set DateCode=%date:~-4%%date:~4,2%%date:~7,2%.%time:~0,2%%time:~3,2%%time:~6,2%
set sharepointbackuplocation=d:\sharepoint\backup
set blat=c:\windows\system32\blat.exe
set relayserver=mail.charter.net
set yoursite=http://server
set emailsub=SharePointBackupReport
set templog=d:\backupscripts\spbackup.txt
set sharepointfile=Backup.bak
set to=desireduser@yourdomain.com
set who=sbackup@yourdomain.com
set reply=noreply@yourdomain.com

echo System Backup Script v1.1 by J Hoeft >> %templog%

REM ***Lock Sharepoint as readonly, create backup, unlock***
echo Backing up Sharepoin" >> %templog%
"C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\BIN\Stsadm.exe" -o setsitelock -url %yoursite% -lock readonly
"C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\BIN\Stsadm.exe" -o backup -overwrite -url %yoursite% -backupmethod full -filename %sharepointbackuplocation%\%sharepointfile% >>%templog%
"C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\BIN\Stsadm.exe" -o setsitelock -url %yoursite% -lock none
dir %sharepointbackuplocation% >> %templog%

REM ***shutdown Progressive SQL for ECS backup***
echo Stopping Progress SQL >> %templog%
\\server\keane\dlc\bin\pccmd.exe proservice stop >>%templog%

REM ***delete previous ECS backup***
del /q d:\AmericanData\EcsBackUp\dbar
del /q d:\AmericanData\EcsBackUp\dbarforms
del /q d:\AmericanData\EcsBackUp\dbdoc
del /q d:\AmericanData\EcsBackUp\dbhistory
del /q d:\AmericanData\EcsBackUp\dbmds
del /q d:\AmericanData\EcsBackUp\dbparadox
del /q d:\AmericanData\EcsBackUp\dbpicklist
del /q d:\AmericanData\EcsBackUp\dbreport
del /q d:\AmericanData\EcsBackUp\mysql

REM ***create new backup files***
d:
cd \
cd AmericanData
cd mysql
cd bin
mysqladmin flush-tables
mysqladmin flush-tables

copy d:\AmericanData\mysql\data\dbar d:\AmericanData\EcsBackUp\dbar
copy d:\AmericanData\mysql\data\dbarforms d:\AmericanData\EcsBackUp\dbarforms
copy d:\AmericanData\mysql\data\dbdoc d:\AmericanData\EcsBackUp\dbdoc
copy d:\AmericanData\mysql\data\dbhistory d:\AmericanData\EcsBackUp\dbhistory
copy d:\AmericanData\mysql\data\dbmds d:\AmericanData\EcsBackUp\dbmds
copy d:\AmericanData\mysql\data\dbparadox d:\AmericanData\EcsBackUp\dbparadox
copy d:\AmericanData\mysql\data\dbpicklist d:\AmericanData\EcsBackUp\dbpicklist
copy d:\AmericanData\mysql\data\dbreport d:\AmericanData\EcsBackUp\dbreport
copy d:\AmericanData\mysql\data\mysql d:\AmericanData\EcsBackUp\mysql

REM ***Start Progressive SQL***
echo Starting Progress SQL >> %templog%
\\server\keane\dlc\bin\pccmd.exe proservice start >>%templog%

REM ***Do System State Backup***
ntbackup backup "@%windir%\backups\data\sysstate.bks" /j "System State Backup" /f "i:\backups\SysState-%datecode%.bkf" /d "System State" /v:yes /r:no /l:s /m normal /rs:no /hc:off

REM ***Do User Data Backup***
ntbackup backup "@%windir%\backups\data\userdata.bks" /j "User Data" /f "i:\backups\UserData-%datecode%.bkf" /d "Full - User Data" /v:yes /r:no /l:s /m normal /rs:no /hc:off

REM ***Cleanup backup files weekly***
If /i "%date:~0,3%" == "Sun" (
Echo Weekly backup file considation performed.>>%templog%
move i:\backups-longterm\*.* i:\backups-delete
move i:\backups-shortterm\*.* i:\backups-longterm
move i:\backups\*.* i:\backups-shortterm
del /q i:\backups-delete\*.*
)

REM *Email backup results*
dir i:\backups >>%templog%
%blat% "%templog%" -t %to% -s "%emailsub%" -i %who% -f "%reply%" -q -server "%relayserver%"

REM ***Delete Temp Log***
del /q %templog%

I found out how to print the NTBackup Log! (From WindowsITPro.com, thanks, guys!)

Create a .bat file called PrtBakLog.bat that contains the following:

@echo off
setlocal
if {%1}=={} @echo Syntax PrintDevice (\\Server\Printer)
set device=%1
set prt=N
for /f "Tokens=*" %%i in ('dir /o-d /b "%userprofile%\Local Settings\Application Data\Microsoft\Windows NT\NTBackup\data\backup*.log"') do call :print %%i
endlocal
goto :EOF
:print
if not "%prt%" EQU "N" goto :EOF
set prt=Y
print /D:%device% "%userprofile%\Local Settings\Application Data\Microsoft\Windows NT\NTBackup\data\%1"

Insert Call PrtBkLog \\Server\Printer In the backup batch file, and you're going - you can even leave out the lame e-mailed reports!

Windows 7 Available on New Computers!

2009-07-17T21:44:00.005-05:00

Or more accurately, free upgrade to Windows 7 once it becomes available. I've even seen this made available to users who purchase computers with an XP Downgrade.

What's so cool about Windows 7?

It's faster than Vista. If your computer runs Vista, this will make it run faster. If you use a computer that is more than three years old it will be sluggish if you upgrade it from XP.
It will run your old programs. That popular time and attendance application that hasn't been updated since 1994? Worked fine from Windows 3.1 to to Windows 95, NT4 to 2000 to XP, then POW, it won't work on Vista. The camera view zooms out. Snow falls silently. Crouched at the edge of the bamboo is . . . XPM. XPM is XP Mode, and it is here to help you. I haven't tried it out yet, but as a fan of Microsoft VirtualPC, I'm willing to believe the hype.
The cool effects are actually useful and make sense in their various contexts. You're just gonna have to trust me on this one.
It's easier to support - my job will be much easier with the new Problem Steps Recorder, which allows the user to record a video of what is going on in their computer, add comments to it, then save it to a file that can be emailed to the support tech. Rock on for thinking about me, Micro$oft!

What sucks about it?

It's an incremental upgrade, not a radical rethink (despite what Microsoft says about it) - it's like Windows ME was an upgrade of Windows 98, but this time it won't suck. As bad. We hope.
It looks like Vista. You know how caterpillars have distinctive colors to let birds know that they taste bad and might be poisonous? The bird eats a pretty caterpillar, gets sick, and remembers what they look like so they don't do that again. Humans can be like that bird - I cringe at the Vista interface not because it's a bad interface but because Vista sucked.

Sysco TraySys Network Configuration

2009-07-13T14:14:00.003-05:00

Dietary Managers across the Midwest, and likely across the country, use a handy program called TraySys to manage their residents' dietary needs and to print tray cards to insure that these needs are accurately met.

Most facilities have one computer in the Dietary department, and it will likely stay that way. However, some facilities have multiple dietary users - say a Dietary Manager and a Dietitian. Both need access to TraySys, and it's mighty convenient to have it in a server for both users to use.

However, the documentation and support for a network environment are virtually non-existant. Sorry, Sysco, but someone dropped the support ball on this one. I was told by telephone support to RTFM (Read The Fine Manual). The manual said nothing about network support.

Through trial and error I figured it out:

You must install the software locally on each computer
Create a share on the server that is accessible to both users and map it as a network drive (I chose T: because it stands for TraySys)
Run TraySys on each computer, one at a time and do the following:
Click Tools -> Network Configuration
Fill in or browse for the new mapped drive you created
Check "Use Data Server"
ONLY if you have already been using TraySys locally should you click the Copy Data to Server button, and ONLY on the 1st computer - if you do it from subsequent computers the data will be overwritten with blank data.
Click Connect to Server and wait for a success message.

Free Antivirus Roundup - Summer 2009

2009-07-11T15:13:00.006-05:00

A lot has changed since my last post about Antivirus products - editions have been thoroughly updated and spyware has become a bigger threat than viruses.

Avast, a one-time favorite of mine (for its excellent protection) had stopped being free for home use for a short time, so I stopped using it. It is back, and freely available at http://www.avast.com/eng/download-avast-home.html for home and non-commercial use. Registration is compulsory if you plan on using it for more than 60 days, but accurate registration information I'm sure is optional. Avast is known for being light-weight with regard to system resource consumption. I hate the Avast user interface.

What you get:

Anti-Virus
Anti-Spyware
Anti-Rootkit
Resident Shield
P2P and IM Shield
Network Shield
Web Shield
E-Mail Scanning
Virus Vault
Scheduled Scans
Supports 64-bit Windows
Integrated Virus Cleaner