Windows 7 Kiosk Lockdown

Why oh why won't Microsoft make a Steady State for Windows 7?  Even when users don't have administrative access to a Windows 7 desktop there are still a multitude of ways to waste time or foul things up.  My biggest concern is time wasting - I've seen staff try their hand at ASCII art, figure out how to invoke supposedly hidden applications, and do anything but get their work done using the computer.

If you've been itching to make your Windows 7 computer into a system that may only perform just a few tasks consider Inteset Secure Lockdown V2 - it's not free, but it will more than pay for itself in reduced headaches and increased productivity!

Check it out at http://shop.inteset.com/Category/14-lock-down-windows-7-and-internet-explorer-for-kiosks.aspx

IT's Kris Haynes: Scan to Email - Exchange 2007

This one had stumped me for quite some time.  Even after reading numerous blogs and expert advice sites I couldn't make this work to my satisfaction - I could get it working internally but not externally.  Today I found IT's Kris Haynes: Scan to Email - Exchange 2007 - Thank you Kris, you rock!

HP LaserJet Printer Drivers for Windows 7 x64

64 Bit Windows has finally come into its own and is the preferred platform versus 32 Bit in most situations.  Unless you're using an old HP printer, then it becomes a potentially serious issue.  I've found that most of the Vista 64 bit drivers work just fine in Windows 7.

If you're using a network printer it becomes a bit trickier - the Host Based Printing Systems don't print across the network, so they're right out even though they are often available in a 64 bit edition.

HP Universal Printing often works, and often does not.  For example it wouldn't work with a network connected Color LaserJet 3600 Series.  Instead I used the Vista driver from http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareIndex.jsp?lang=en&cc=us&prodNameId=501046&prodTypeId=18972&prodSeriesId=501044&swLang=8&taskId=135&swEnvOID=2100.

Setting Up pfSense 2.x with Multiple WAN Connections and Squid in Transparant Mode

Setting up pfSense with multiple WAN connections configured for failover is easy.  Setting one up in a pfSense that has Squid Proxy is not obvious - in fact, there is a lot of conflicting information.  Ultimately http://forum.pfsense.org/index.php/topic,38882.0.html provided the answers I was looking for.

Interesting Note 27-Aug-2012:  This configuration broke the ability of the package manager to check the repository and install packages resulting in unpredictable behavior at best.  To compensate you must  disable the Transparent Proxy and disable Allow Users on Interface as well as disabling the new floating rule that enables Squid to function.

Update 15-Oct-13:  The proper floating firewall rule + adding your DNS servers to the Squid General configuration page will fix the broken updates.  The Floating Firewall Rule you must create is:  Pass, select your WAN and Opt1 (or whatever you called your public interfaces), direction: Out, protocol: TCP, Source: Any, Destination: Any, Destination Port Range: HTTP, then under Advanced, Gateway: select your failover group.

IPCop 2.0 - Not As Dead As I Thought?

Oh yeah, IPCop 2.0 has been available for a while.  They have tailored it for the Small Office/Home Office space.  If you liked IPCop 1.4, you will likely love IPCop 2.0.

Free Ghost Clone Clones Windows Using Linux!

For disk to disk copying there are a dizzying array of options.  I prefer to use open source and free tools - most Google queries in this category will lead you to Clonezilla and PING (Partimage Is Not Ghost).  Clonezilla is anything but simple, but can be used.  PING is also simple, but requires an intermediary drive to save the image before restoring it - what a pain.  Whither G4L?  Ghost 4 Linux, as you may have not have heard, is any easy reliable free drive cloning solution that offers easy operation.

The opening menus are somewhat intimidating - choose the latest version, select Exit on the notes screen, then input g4l at the prompt.  From there it is menu driven and you will desire to use the Click-N-Clone option.

Did I mention it's easy?  There is an excellent guide to cloning disk to disk at www.oakdome.com.

SBS 2008 Running Out of Memory? SBSMonitoring may be the culprit!

Limit the SBSMonitoring SQL Service's RAM useage, full details at http://www.thirdtier.net/2009/08/setting-the-maximum-memory-usage-on-sbsmonitoring/

pfSense and Squid Proxy - Managing RAM Usage

My systems RAM usage typically hovers between 60% and 80% and the installed system is pfSense 2.0.1 with Squid, SquidGuard, and LightSquid.


To manage your cache effectively and reduce memory usage:

On the Cache Management page: Reduce the Memory Cache Size parameter - I use around 25% of host system's installed RAM . This controls how many ``hot'' objects are kept in memory. Reducing this parameter will not significantly affect performance, but you may recieve some warnings in cache.log if your cache is busy.

Reduce the Hard Disk Cache Size on the Cache Management page (on a system with 4GB of RAM I use 10,000 MB, on an old 1GB I use 512 MB). This will reduce the number of objects Squid keeps. Your overall hit ratio may go down a little, but your cache will perform significantly better.

Reduce the Maximum Object Size parameter (I use 512 on new 4GB systems, 64 on an old 1GB). You won't be able to cache the larger objects, and your byte volume hit ratio may go down, but Squid will perform better overall. (The preceding uses information borrowed heavily from http://www.comfsm.fm/computing/squid/FAQ-8.html - all credit to the original author!)

Squid Proxy - Cache Windows, Adobe, and Java updates

Your pfSense has the ability to cache popular updates like UpdateAccelerator for your favorite OS and its ancillary applications.

You will need to install the Squid Proxy package then go to the Proxy Server under the Services menu.

• Select the Cache Mgmt tab then set your hard disk cache size to 3000 MB or better (I set mine to 10000 MB because I have a 250GB hdd and there's still plenty of room left).  
• Up your memory cache size to around 1/4 of the installed memory - this will speed up your proxy over all.
• Set your maximum object size to 512000 - this will cache files up to 512MB, a bit bigger than the biggest service packs I've come across.  You can adjust this size as you see fit!

Once you have completed these steps paste the following into your pfSense Squid Proxy "Custom Options" and, save it, watch your updates fly (after the initial download):

refresh_pattern ([^.]+.|)(download|(windows|)update|).(microsoft.|)com/.*\.(cab|exe|msi|msp) 43200 100% 43200 reload-into-ims;range_offset_limit -1;refresh_pattern ([^.]+.|)windowsupdate.com/.*\.(cab|exe|msi|msp) 43200 100% 43200 reload-into-ims;range_offset_limit -1;refresh_pattern ([^.]+.|)adobe.com/.*\.(zip|exe) 43200 100% 43200 reload-into-ims;refresh_pattern ([^.]+.|)java.com/.*\.(zip|exe) 43200 100% 43200 reload-into-ims;refresh_pattern ([^.]+.|)sun.com/.*\.(zip|exe) 43200 100% 43200 reload-into-ims

Ugh, SSL Certificates

Through much trial and error I think I have it figured out:  there are three ways to go when it comes to SSL certificates for your business server needs, and each one can be painful.

1. Self-signed certificates:  With Server 2003 a self-signed certificate meant that you just had to ignore that overly dire warning you were given in your browser.  It turns out that it is difficult for non-techies to ignore and has been quite a source of worry for the end user, who then decides that the system is broken and finds something else to do.  SBS 2008 changed that in that it becomes a pain in the neck to get your Outlook to work.
2. Get a certificate from your favorite Certification Authority, like my favorite registrar Register.com.  It's fast, easy, and somewhat expensive - a certificate for a single domain name (remote.yourdomain.com  is probably the one to invest in) is $72.00 per subdomain for three years.  Then it gets ridiculous:  Outlook 2007+, Windows Server 2008 SBS or Exchange 2007 and 2010 want you to have a valid certificate that applies to each required subdomain, so a "wildcard certificate" would seem to be in order - I confirmed this by calling Register.com's tech support and asking them which certificate I should use to secure my SBS 2008 - they recommended the wildcard certificate as the answer to all of my needs.  $730 for 3 years.  Fortunately there are ways around this, so DON'T DO IT. See the excellent Third Tier Blog's explanation of how to configure your DNS to work around this.
3. Get your certificates from StartSSL.  While I have not tried the truly free certificates that they offer, I did undergo the personal and organization validations which were $49.90 each (total of $99.90, I'm not sure what it will cost come renewal time) with the certs being good for two years.  Since I manage systems for multiple organizations it makes sense for me to validate each organization so that my personal details don't appear on their certificates!  Validating yourself and your organization means getting together your personal identifying docs like your drivers license, birth certificate, and phone bill, then your business identifying docs like Articles of Incorporation, Certificate of Insurance, and maybe your business license - whatever you can show that proves you are you and your business is on board with your plans to get a certificate with their name on it (meaning a letter from the owner or CEO).  When requesting certificates you have no option for a "wildcard" certificate, but you may specify as many subdomains as you desire for each of your verified domains - sweet.

An interesting note about StartSSL:  there has been some debate as to the legitimacy of StartSSL as a valid Certification Authority, especially with regards to the free certificates.  While it is easy to get their free certs if you can prove you own the domain, it is also easy to get certs from other CA's.  The barriers to entry to receive a basic SSL cert from the Registrars and other commercial CA's are:  verifying that you own the domain and paying their fees.  StartSSL's Class 1 performs domain name ownership verification.  StartSSL's Class 2 validates your identity using personal documents and business documents then calls your organization and verifies the info, even asking to speak with the owner or CEO!

The real debate is not whether freedom reduces crime with regards to SSL (IMHO it does not - even scammers know it takes money to make money) but whether users have the ability to truly trust an organization - a valid certificate is certainly NOT a guarantee you won't be ripped off, and I feel annoyed that SSL is presented in such a manner - like somehow the crummy lock icon means the web site is not owned and operated by a bunch of crooks

Since StartSSL isn't always considered when adding the Root CA's to OS's and devices you may also have some certificate issues, especially with ActiveSync - by the way, check your Exchange connectivity and certificate problems at https://www.testexchangeconnectivity.com/.