Windows Vista Stuck on Please Wait Screen? + Rant

Well, it's finally happening - Vista is creeping into my Nursing Homes despite my dire warnings of impending irritation. Please people, if you're going to buy Vista, at least buy the Business or Ultimate editions - Home edition is WORTHLESS in a Windows Domain except for being in your own little computing world - don't expect roaming profiles or easy access t network resources.

That said, Vista has apparent troubles in a Windows 2003 domain. After applying Service Pack 1 the Vista machine may seem permanently stuck at Please Wait . . . Apparently the TCP receive window auto tunes itself and mudges things up - I'm not sure what the ingredients in this sausage are, I just know it sucks.

To boot up, turn of your computer, unplug the network cable, then log in. Once you have a working desktop plug the cable back in.

I found these instructions for fixing the Autotuning here. However, it manages to set itself back to automatic after a reboot!

Before you begin, reboot your computer into safe mode with networking enabled.

1. Open a elevated command prompt.
NOTE: For how, see: How to Open a Elevated Command Prompt in Vista

2. Click on Continue in the UAC prompt.
3. In the command prompt, type netsh interface tcp set global autotuninglevel=disabled and press Enter. (See screenshot below)
4. You will get a OK response. If not, repeat step 3.



5. Close the command prompt and restart computer to apply the changes.

Thanks for the awesome post, Brink!

Secure a subset of Windows computers in a larger Workgroup.

In a Workgroup environment it can be a daunting task to prevent unauthorized access to network shares while still allowing the convenience of using any old user name on each desktop, especially with XP Home Edition. For example:

In a network of 10 computers 1 of them is desired to act as a server, serving up critical financial and clinical data. Three computers are trusted to access that data as they are in locked offices and the employees using them need to access that data to get their job done. The other 6 computers are in common areas and can pretty much be used by anyone that can walk up to them. Consider your organization too cheap to use switches with VLAN's.

In such a situation where there is no Active Directory server with fancy schmancy Security Groups it is a huge pain to set up users and permissions. I looked at Group Policy settings for an hour trying to restrict our untrusted 6. Then it hit me:

The Windows Firewall can be configured to allow or deny access to computers based on their IP address. Set up your network so that the untrusted computers are in one range of IP's, and your trusted PC's are in a different range but the same net block, so don't make the untrusted PC's 192.168.222.x and the trusted PC's 192.168.000.x, that would screw things up.

So lets say you're using 192.168.0.x; set up your DHCP server to dole out addresses from 192.168.0.10 through 192.168.0.50 to anyone that asks. Then set up reserved IP's for your more secure desktops as 192.168.0.200-192.168.0.203. Next, go to each of the secured PC's, open up the Windows Firewall, open the File and Print scope and change it from localsubnet to 192.168.0.200, 192.168.0.201, 192.168.0.202, 192.168.0.203. OR you can set it to 192.168.0.199/255.255.255.251 if you're good at figuring out subnets. A subnet calculator can be found at http://www.subnet-calculator.com/.

Server 2003 Dynamic Disk - Don't Trust It!

I have a customer that ran out of space on their server's C: drive. I Googled for solutions to grow the partition and found that Dynamic Disk allows for a partition to be expanded into the unused space on the drive. Great, I have 12 GB unpartitioned, I'll just use that, right? So off I go . . .

WRONG!

It allowed me to convert the partition, but it still wouldn't allow me to grow it. This server was upgraded from a NT 4.0 Server, and apparantly the partition that was created isn't truly compatible with Dynamic Disk.

Just great, because now I cannot undo the dynamic disk and as an added bonus there is no good way to clone a dynamic disk - rumor has it that Ghost 2k3 will clone the disk and leave the partition as a standard one instead of dynamic. Ghost 2k3 wouldn't work on my server, likely because of the SCSI RAID.

So now what?

Fresh install and then copy the data from the old array. Bummer.

Secure File Transfer Using Off The Shelf Tools

OK, this is for those of you who are sending financial, health, or other critical information across the Internet to a 3rd party who we want to be able to read it. We don't want anyone in between reading it as it's private information.

We all know that E-Mail is as open as a post card. What most don't realize is that web pages and other Internet file transfers also occur mostly in the clear. A notable exception is Secure HTTP (actually it's HTTP over Secure Sockets Layer, but that's too hard) - HTTPS (port 443) uses certificates and encrypted communications to prevent eavesdropping. However, e-mail and most file transfers happen outside of HTTPS and are subject to all kinds of eavesdropping, even tampering.

So we have to encrypt our own files before sending them over this medium. All sorts of complicated encryption schemes have been devised for secure communications, but they take the position of trust no one, not even each other. This is a bit too paranoid, and should be reserved for matters of national security or the most sensitive of business transactions - we will simply trust that we know the person on the other end of the phone and that they can keep a secret, in this case, a password for a password protected Zip file.

There are numerous "Zip Password Recovery" applications available. I haven't tried them, but I'm willing to bet that they work reasonably well against the standard Zip password protection. However, 7-Zip (FREE, Open-Source) offers not just the standard Zip password protection, but AES-256 encryption - one of the best encryptions going. AES-256 takes a supercomputer to break, and even then it would take decades.

Using 7-Zip, create a new archive, go into its options, and note the Password section in the bottom right of the properties screen. Select AES256 and enter a password. Call your intended recipient, tell them the password, then send the newly zipped and encrypted file in any manner you desire.

IPCop and Windows SBS 2003

What ports are required to be forwarded to your Small Business Server 2003 (SBS2k3) to get maximum functionality while still retaining some semblance of security?

I trust the IPCop with some fairly important stuff, but I'm being required to provide multiple services using the same server - Mail, WebMail, and now Remote Desktops.

The most secure way to do this is via SSH Tunnel (My posts on this). Pros and amateurs alike have had success using Putty, and even more success using my super-secret Plink connection script (I'll share it eventually).

However, there is a balance between security and convenience, and I'm going to violate the "Separation of Duties" that I so desire in order to provide a quick, convenient way to dial in to the desktop computers: SBS2k3's Remote Web Workplace.

So turn it on in the SBS's Server Management -> Internet and E-Mail -> Connect to the Internet Wizard, then connect to your IPCop and forward the ports as follows (I'm assuming you also want to enable E-Mail. Webmail and some other services may also be enabled in the Connect to the Internet Wizard)

• Port 25 (SMTP) to your internal server's IP and port 25
• Port 443 (HTTPS) to your server's IP and port 443
• Port 4125 (???) to the server's IP and port 4125

Windows 7 Beta Unleashed (OS X Failure Edition)

Our pals at Microsoft have decided to open the floodgates and let everyone who wants one have copy of Windows 7 Beta (download page here). However, it expires when, presumably, Microsoft will have another Beta ready for us to try; from the Microsoft Windows 7 Beta FAQ:

The Windows 7 Beta will stop working on August 1, 2009.

To continue using your PC, please be prepared to reinstall a prior version of Windows or a subsequent release of Windows 7 before the expiration date. See Installing the Windows 7 Beta.

Your feedback and our continued progress will determine when the final version of Windows 7 becomes available.

I decided to use my new Mac and run it in Sun's VirtualBox xVM 2.1, a great, free Virtual Machine program. I've had trouble installing it, however, when using the .iso I downloaded from Microsoft as a mounted DVD drive. It says that I'm missing install.wim shortly into the installation. So I re-downloaded it hoping that the image that I had was corrupt. It wasn't corrupted because OS X would mount it without a problem, and I could even find the file in question and view its properties. I tried burning the image to DVD to see if that would work. No dice!

So of course I Google for answers, and all it seems to turn up is people with the same question but no good answers. One promising track involved a gentelmen reporting that extracting the .iso to a folder under Vista then upgrading the Vista to 7 would work, but I never bought Vista. More far flung suggestions about the failing install (and these folks weren't even adding the extra complexity of virtualization) included too fast of burn speeds and changing the burn format to UDF. I'd say that MS has wasted lots of peoples time with a bad image. I'll have to wait for the next beta, I guess.

Server 2003 proves itself useful! (Free Virtual Machines for Windows Servers)

OK, I have to quit being a Mac Weenie and Linux fanboy and come clean: It's been months since I've set up a network with a Linux or Apple server providing what amount to Active Directory services, and except for IPCop, Windows Server 2003 has been doing my heavy lifting. My vendor says that I should give Server 2008 a try. Shoot, I'm still discovering what Server 2003 x64 is capable of.

Stuff like easily running multiple Virtual Machines seem to make the Windows Server line a bit more valuable. Microsoft's FREE (free as in beer, not as in puppies!) Virtual PC and Virtual Server have been a real treat. I've enjoyed Virtual Box on my Mac, but the business world doesn't seem to want to trust their data to an Apple server, and Linux is right out as many of the server softwares in the healthcare industry require a Windows server, so I would have to run Windows in a virtual machine anyhow to serve the Windows desktops that the end users know and love!

So, what could be better than Running an IPCop on your Windows 2003 Server? I couldn't think of anything either, so using this handy guide I first built an IPCop in Virtual PC. As I was a newbie and didn't read far enough in Virtual PC's manual, I soon discovered that a product called Virtual Server existed that wouldn't complain about running on my x64 2003 Enterprise server, and it was free.

IBM Enters the SMB Linux Server Space

This sounds like a dream come true: A Linux server that sets itself up, manages itself, and fixes itself if it breaks, for around $150.00 per user, with licenses starting at 5 users, and offering Document Management, E-Mail, and Lotus groupwares.

Have a look at IBM's documentation on "IBM Lotus Foundations Start" - it claims all of this is true, and if you BYOS (bring your own server) with these astoundingly minimal minimum requirements:

• x86-based system
• At least one hard disk (removable hard disk required to use all of the features)
• At least one Network Interface Card (NIC) (two NICs required to use all of the features)
• CD-ROM drive
• VGA-based video card
• At least 1 GB of RAM
• Monitor
• Keyboard

I'm going to try to get in on their beta program - wish me luck!

We want to keep XP!

Oh my gosh, how can I get together all of my friends, relatives, customers, and everyone that they know? If I knew it would mean Microsoft's continued support for Windows XP, I would personally organize a bus trip to Redmond and camp in front of Steve Ballmer's office with everyone I know, and everyone that they know. Everyone will have to kick in for the bus, though, I'm not THAT generous!

Okay, since you all aren't exactly beating down my door wondering when the bus leaves, maybe try sending an e-mail to Microsoft's Steve Ballmer at steveb@microsoft.com. If your e-mail doesn't get through, then leave a response on my site, and I'll try to figure out another way.

Installing Peachtree Accounting 2008 Server in a Headless Server

For those of you who aren't in the know, a headless server is a server without a keyboard, monitor, and mouse. Instead, you manage it using Microsoft Remote Desktop (RDP). If you call up a remote desktop on your Windows 2003 server and try to install Peachtree 2008, it will fail, saying it cannot be installed from the Windows Terminal.

Instead of dragging out the monitor, keyboard, and mouse, using your Remote Desktop download and install RealVNC or some other VNC app if you don't like that one, and set it up as a server. Close the Remote Desktop Session. Now, fire up yor VNC client, sign into your server, insert the CD, and feel the joy!