Cannot log into SBS 2003 and the "Log on to" Dropdown Box is Missing?

This one puzzled me for quite some time - and twice at that! I guess because it's getting late . . .

After reloading my SBS 2k3 with all of the software and updates, I booted into Directory Restore Services, restored the AD databases and such, rebooted, waited while it said "Preparing network connections" for what seemed like forever, and then found that my username and password no longer worked, despite the fact that I was using the same ones prior to and after the restore. Additionally, when I clicked the Options >> button there was no domain dropdown box!

Here's the fix that worked for me:

1. Boot from your SBS CD 1.
2. When prompted, press R for Recovery Console.
3. Once you have logged into your Recovery Console (thank goodness my username and password worked here!) enter the command listsvc, get your pen ready and take note of all non-standard services (I hope you're familiar with them!).
4. Disable each of these services with the command disable servicename. Since this is a recovery operation, you'll be reinstalling those services anyway.
5. Type exit and reboot.
6. Boot back into SBS CD 1 and proceed as if your are reinstalling the system - when prompted that a Windows system already exists select the Repair option.
7. If prompted regarding unsigned drivers, select Yes for each one.
8. Wait

After the reboot you will likely feel some joy.

Restoring SBS 2003

OMG, restoring a crashed SBS 2003 that was in service for 4 years has been like replacing not just the house that burned down, but the furniture, fixtures, photos, and family heirlooms. Better backup and preparation would have helped, as would prior experience. If it wasn't for Google, I would have been dead in the water. I've done almost as many searches in the past 5 days as I did in the entire last month.

I've been backing up the System State, Exchange storage groups, the users' Shared Documents folders (to which I've directed their Home Folders), and all 3rd party application data.

What did I learn?

• Use a script or special application to back up Sharepoint.
• NTBackup does a great job backing up just about everything else.
  
• Don't restore ANYTHING until you've finished setting up the SBS and every last one of it's components - even if the customer is badgering you to do so.
• Set up a clean, working server with no users, groups, or policies, but with all components in place.

Once these conditions have been met, and only then, can you begin restoring users, data, Exchange stores, and the Sharepoint databases, and do them in that order.

Why have I been so productive lately?

Perhaps you've noticed I've been blogging much more frequently than I have been. Did I start a new medication? Have I been going back to school? Have I just gotten a case of ADD?

None of the above - I've been meditating.

A couple with which myself and my wife are friends teach Transcendental Stress Management. They asked us for years to come and learn their techniques, but I felt that it was snake oil, or at least not worth the few grand it would cost me as meditation information is all over the web and available at the local library. In addition, these are our friends, why should we pay them to teach us something that costs them nothing but time? Well, it turns out that teaching TSM is their career, and getting paid to teach meditation is what puts food in their childrens' mouths.

When my wife paid the fee and learned to meditate from our friends I was annoyed. How could she would waste our money like that? However I soon noticed a change in her - she wasn't so quickly irritated with myself or our children, and this was a woman who went from zero to thermonuclear in no time! She had also been plagued with frequent debilitating migraines. Although she still gets them, they are certainly less frequent and less intense - with no new medications or other changes in lifestyle - what a Godsend!

I finally got up the courage to spend the money for myself to learn. I'm glad that I have - I can get more done in less time. I have laser-fine focus. I need less sleep. I don't get tired as easy when I'm working. I'm more patient. My goodness - I feel like a mental superman! And from what? Sitting quietly for 20 minutes each morning and evening and doing the meditation as I was taught. The reduction in internal stress - even with increased stress from my career and home life - has truly helped!

Thank you, Farrokh and Ruffina, you are a Godsend to us and everyone you have helped!

Gentle reader, if you have read this and would like to learn more, please visit at their web site www.bestagainststress.com and get in touch with them.

Computers for the Developementally Disabled

I had a fascinating conversation yesterday at the laundromat with a man who was fascinated with my laptop. He said that he wanted one, but he was officially considered "retarded" and never learned to read or do arithmetic, so he was afraid he wouldn't be able to use it.

As I was speaking with him I saw no signs that he was any different from the average Joe on the street. In my opinion, he is one of the unfortunate people who went through the American public school system before the discovery of "learning disabilities," and was relegated to learning how to work as a janitor or helping out in the cafeteria.

I began Googling relevant search terms hoping to find a Windows application or Window Manager, or perhaps a custom-tailored distribution of Linux that was meant for the functionally illiterate, the developementally disabled, or the mentally handicapped. What did I find? Nothing! OK, there were a few studies looking at how computing environments could be tailored for those with special needs, but nothing had come of them.

It was similar to a situation I ran into a few years ago when I was looking into available technologies for assisting a quadriplegic gentleman use his computer - but in his case there were a few available resources, but they were difficult to find, and once found were prohibitively expensive.

Why make expensive computer software and hardware for the handicapped? The fact is that most of America's handicapped live on public aid and have little to no disposable income. In the case of quadriplegics several universities and corporations have devoted resources to creating assistive technologies to enable them to use a computer - provided they can at least see and read or be read to by the assistive technologies for the blind.

But a more-or-less fully functioning adult with few financial resources and a reading disability? Are computing technologies for the blind appropriate? What free resources are available to the blind that might help an illiterate person use a computer? Hold on there, Mr. I'm So Smart - the illiterate need to learn to read first then they can use the computer? Perhaps they're dyslexic or have a severe learning disability and reading is out of the question.

I think that this has not been thoroughly explored because there is simply no money in it. It's enough to make me wish I was a man of means - I would establish a foundation for assistive technologies for those who are simply unable to read.

UPDATE 7-Jan-11  An administrator at a nursing home brought IN2L (It's Never 2 Late) to my attention - they specialize in computers for the elderly, particularly in a clinical setting - this is going the right direction!  I understand that it is a relatively expensive offering when considered for individuals, but this would certainly be beneficial in a community setting.

Windows Vista Stuck on Please Wait Screen? + Rant

Well, it's finally happening - Vista is creeping into my Nursing Homes despite my dire warnings of impending irritation. Please people, if you're going to buy Vista, at least buy the Business or Ultimate editions - Home edition is WORTHLESS in a Windows Domain except for being in your own little computing world - don't expect roaming profiles or easy access t network resources.

That said, Vista has apparent troubles in a Windows 2003 domain. After applying Service Pack 1 the Vista machine may seem permanently stuck at Please Wait . . . Apparently the TCP receive window auto tunes itself and mudges things up - I'm not sure what the ingredients in this sausage are, I just know it sucks.

To boot up, turn of your computer, unplug the network cable, then log in. Once you have a working desktop plug the cable back in.

I found these instructions for fixing the Autotuning here. However, it manages to set itself back to automatic after a reboot!

Before you begin, reboot your computer into safe mode with networking enabled.

1. Open a elevated command prompt.
NOTE: For how, see: How to Open a Elevated Command Prompt in Vista

2. Click on Continue in the UAC prompt.
3. In the command prompt, type netsh interface tcp set global autotuninglevel=disabled and press Enter. (See screenshot below)
4. You will get a OK response. If not, repeat step 3.



5. Close the command prompt and restart computer to apply the changes.

Thanks for the awesome post, Brink!

Secure a subset of Windows computers in a larger Workgroup.

In a Workgroup environment it can be a daunting task to prevent unauthorized access to network shares while still allowing the convenience of using any old user name on each desktop, especially with XP Home Edition. For example:

In a network of 10 computers 1 of them is desired to act as a server, serving up critical financial and clinical data. Three computers are trusted to access that data as they are in locked offices and the employees using them need to access that data to get their job done. The other 6 computers are in common areas and can pretty much be used by anyone that can walk up to them. Consider your organization too cheap to use switches with VLAN's.

In such a situation where there is no Active Directory server with fancy schmancy Security Groups it is a huge pain to set up users and permissions. I looked at Group Policy settings for an hour trying to restrict our untrusted 6. Then it hit me:

The Windows Firewall can be configured to allow or deny access to computers based on their IP address. Set up your network so that the untrusted computers are in one range of IP's, and your trusted PC's are in a different range but the same net block, so don't make the untrusted PC's 192.168.222.x and the trusted PC's 192.168.000.x, that would screw things up.

So lets say you're using 192.168.0.x; set up your DHCP server to dole out addresses from 192.168.0.10 through 192.168.0.50 to anyone that asks. Then set up reserved IP's for your more secure desktops as 192.168.0.200-192.168.0.203. Next, go to each of the secured PC's, open up the Windows Firewall, open the File and Print scope and change it from localsubnet to 192.168.0.200, 192.168.0.201, 192.168.0.202, 192.168.0.203. OR you can set it to 192.168.0.199/255.255.255.251 if you're good at figuring out subnets. A subnet calculator can be found at http://www.subnet-calculator.com/.

Server 2003 Dynamic Disk - Don't Trust It!

I have a customer that ran out of space on their server's C: drive. I Googled for solutions to grow the partition and found that Dynamic Disk allows for a partition to be expanded into the unused space on the drive. Great, I have 12 GB unpartitioned, I'll just use that, right? So off I go . . .

WRONG!

It allowed me to convert the partition, but it still wouldn't allow me to grow it. This server was upgraded from a NT 4.0 Server, and apparantly the partition that was created isn't truly compatible with Dynamic Disk.

Just great, because now I cannot undo the dynamic disk and as an added bonus there is no good way to clone a dynamic disk - rumor has it that Ghost 2k3 will clone the disk and leave the partition as a standard one instead of dynamic. Ghost 2k3 wouldn't work on my server, likely because of the SCSI RAID.

So now what?

Fresh install and then copy the data from the old array. Bummer.

Secure File Transfer Using Off The Shelf Tools

OK, this is for those of you who are sending financial, health, or other critical information across the Internet to a 3rd party who we want to be able to read it. We don't want anyone in between reading it as it's private information.

We all know that E-Mail is as open as a post card. What most don't realize is that web pages and other Internet file transfers also occur mostly in the clear. A notable exception is Secure HTTP (actually it's HTTP over Secure Sockets Layer, but that's too hard) - HTTPS (port 443) uses certificates and encrypted communications to prevent eavesdropping. However, e-mail and most file transfers happen outside of HTTPS and are subject to all kinds of eavesdropping, even tampering.

So we have to encrypt our own files before sending them over this medium. All sorts of complicated encryption schemes have been devised for secure communications, but they take the position of trust no one, not even each other. This is a bit too paranoid, and should be reserved for matters of national security or the most sensitive of business transactions - we will simply trust that we know the person on the other end of the phone and that they can keep a secret, in this case, a password for a password protected Zip file.

There are numerous "Zip Password Recovery" applications available. I haven't tried them, but I'm willing to bet that they work reasonably well against the standard Zip password protection. However, 7-Zip (FREE, Open-Source) offers not just the standard Zip password protection, but AES-256 encryption - one of the best encryptions going. AES-256 takes a supercomputer to break, and even then it would take decades.

Using 7-Zip, create a new archive, go into its options, and note the Password section in the bottom right of the properties screen. Select AES256 and enter a password. Call your intended recipient, tell them the password, then send the newly zipped and encrypted file in any manner you desire.

IPCop and Windows SBS 2003

What ports are required to be forwarded to your Small Business Server 2003 (SBS2k3) to get maximum functionality while still retaining some semblance of security?

I trust the IPCop with some fairly important stuff, but I'm being required to provide multiple services using the same server - Mail, WebMail, and now Remote Desktops.

The most secure way to do this is via SSH Tunnel (My posts on this). Pros and amateurs alike have had success using Putty, and even more success using my super-secret Plink connection script (I'll share it eventually).

However, there is a balance between security and convenience, and I'm going to violate the "Separation of Duties" that I so desire in order to provide a quick, convenient way to dial in to the desktop computers: SBS2k3's Remote Web Workplace.

So turn it on in the SBS's Server Management -> Internet and E-Mail -> Connect to the Internet Wizard, then connect to your IPCop and forward the ports as follows (I'm assuming you also want to enable E-Mail. Webmail and some other services may also be enabled in the Connect to the Internet Wizard)

• Port 25 (SMTP) to your internal server's IP and port 25
• Port 443 (HTTPS) to your server's IP and port 443
• Port 4125 (???) to the server's IP and port 4125

Windows 7 Beta Unleashed (OS X Failure Edition)

Our pals at Microsoft have decided to open the floodgates and let everyone who wants one have copy of Windows 7 Beta (download page here). However, it expires when, presumably, Microsoft will have another Beta ready for us to try; from the Microsoft Windows 7 Beta FAQ:

The Windows 7 Beta will stop working on August 1, 2009.

To continue using your PC, please be prepared to reinstall a prior version of Windows or a subsequent release of Windows 7 before the expiration date. See Installing the Windows 7 Beta.

Your feedback and our continued progress will determine when the final version of Windows 7 becomes available.

I decided to use my new Mac and run it in Sun's VirtualBox xVM 2.1, a great, free Virtual Machine program. I've had trouble installing it, however, when using the .iso I downloaded from Microsoft as a mounted DVD drive. It says that I'm missing install.wim shortly into the installation. So I re-downloaded it hoping that the image that I had was corrupt. It wasn't corrupted because OS X would mount it without a problem, and I could even find the file in question and view its properties. I tried burning the image to DVD to see if that would work. No dice!

So of course I Google for answers, and all it seems to turn up is people with the same question but no good answers. One promising track involved a gentelmen reporting that extracting the .iso to a folder under Vista then upgrading the Vista to 7 would work, but I never bought Vista. More far flung suggestions about the failing install (and these folks weren't even adding the extra complexity of virtualization) included too fast of burn speeds and changing the burn format to UDF. I'd say that MS has wasted lots of peoples time with a bad image. I'll have to wait for the next beta, I guess.