Wireless LAN Links

OpenWRT

Vendors
Cisco 1130AG Series
  • (not work) after boot up, try DHCP, then assign 10.0.0.1 to itself in first 5 mins, then retry DHCP only
  • enter privileged EXEC mode with command: enable
  • Default login and password is: Cisco
  • Basic command to set ip
    enable
    configure terminal
    interface bvi1
    ip address [ip] [mask]
    
  • Aironet extension required for these features:
    • Load Balancing
    • Message Integrity Check (MIC)
    • Temporal Key Integrity Check (TKIP)
    • Repeater Mode
    • World Mode
  • 802.11a & 802.11b/g supported
  • Upto 16 SSID can be created
  • VLAN is required if need to use multiple encryption types,
    else encryption type is map to interface only

  • Reset to factory default: press and hold MODE button before reboot, then hold it for 2-3 seconds until Ethernet LED turn amber
Keywords
  • POD – Packet of Disconnect
  • CAC – Call Admission Control

Networking Links

Network Security

Network Management

Cisco

Networking

WAN – Wide Area Network

3G Data Network

PON – Passive Optical Network

xDSL

Tutorials

Ethernet

NAS Links

General

Synology

Router / Switch Links

Wireless Router
Huawei
Cisco

Cisco General

Cisco 1800 Series Router

Tutorials

Firewall Links

Hardware

Zeroshell

pfSense

  • pfSense homepage
    FreeBSD based mini firewall distribution
  • default password: admin / pfsense
  • show routing table: netstat -r
  • restart openvpn: disable, wait about 1min (to clear routing table), then enable again
  • by default the openvpn client will pull settings from server
  • openvpn to use tap mode, add command line option: tap

Monowall

Vyatta

Juniper Netscreen Firewall

OpenVPN

ISA Server 2006

  • Database path: ISA 2006\ADAMData\
  • ChangeStorageServer.vbs: Change array to use the current server as Primary Storage Server
  • Setup failed while registering ISA Server filters.
    • *** This problem could happen if there is a SQL Server installed at the same server
    • Can happen at both ISA Server 2004 SP2 update and ISA 2006
    • Related to Web Filter priority in ISA Server 2004 SP2

General

General Rules

  • Deny All is usually the best default rule
  • Handle ICMP carefully, block/limit from all outside
  • Fragmented packets can create DoS attacks
  • Source address filtering must always base on network interface
  • Always do logging, log archiving, or write to write only media
  • DNS TCP 53 is only used for zone transfer, in general can block the traffic
  • MSN, NetMeeting maybe better to have an application gateway because they are using dynamic ports
  • Screened Host is the intranet server after firewall (after port forwarding)
  • Screened Network / DMZ is the network segment after firewall

Interesting

  • Dynamic Packet Filtering (for Outlook-Exchange, Windows Messenger, etc?)
  • Sometimes static outbound mapping (port forwarding) maybe needed for outgoing traffic (Firewall outgoing ip always same for certain intranet IP group)
  • Some firewall products can do:
    • time-based filtering
    • access base on username (Microsoft ISA?)
    • bandwidth quota
    • Intrusion detection, logging, reporting and fire an alarm. Or even dynamic adjust the policy.
      • Zone transfer attempts
      • Address scans
      • Port scans
      • Ping-of-death DoS attack attempts
  • NAT-D (Detect) and NAT-T (Transversal) is needed to support IPSec over NAT gateways
  • PPTP does not protect the IP header while IPSec do. So IPSec/L2TP need NAT-D/NAT-T at gateway.
  • Any tool to evaluate Firewall effectiveness?
  • ICSA Lab (certify commercial Firewall products)

SQL Server Links

General
SQL Server Express 2005
MSDE 2000
User Instances
BCP Utility
  • SQL Server數據導入導出工具BCP詳解
  • If Format file defined wide character data but import data is normal character, then will have error: Error = [Microsoft][SQL Server Native Client 10.0]Unexpected EOF encountered in BCP data-file
Sample Database
Reporting Services

General

Development

Reporting Services Tutorials
Mirroring (After SQL2005)
Howto

Virtualization Links

General

VMware

VMware vSphere

HOWTO

  1. Troubleshooting Virtual Machine snapshot problems
  2. VMDK Handbook – Basics
    Explain the VMDK thin provision difference between VMware Workstation (can use a reduce sized VMDK) and ESXi (require VMFS support)
  3. *** VMWare Workstation conversion to ESXi 4
    Cannot rely on VMware Converter Standalone, must use: vmkfstools -i disk1old.vmdk -d thin disk1.vmdk, so that it can correctly convert to thin provisioned disk in ESXi. Apply for ESXi 5.0 also.
  4. KB1026437: Clipboard Copy and Paste option is disabled in vSphere Client 4.1 (Enable copy/paste from vSphere client, but does not allow file transfer yet)
  5. How to add a static route to VMWare ESXi server
    Use ‘esxcfg-route’ command in console mode, the setting will also save to persistent config file at /etc/esx.conf
  6. Setup any Static Ethernet Address
    • Remove these parameters
      ethernet0.generatedAddress
      ethernet0.generatedAddressOffset
      
    • Set these parameters
      ethernet0.checkMACAddress = "false"
      ethernet0.addressType = "static"
      ethernet0.Address = "00:0C:29:B0:27:E1"
      
  7. Manually set the time of a VM
    rtc.startTime = "1089395200"
    tools.syncTime = "FALSE"
    time.synchronize.continue ="FALSE" 
    time.synchronize.restore = "FALSE"
    time.synchronize.resume.disk = "FALSE"
    time.synchronize.resume.memory = "FALSE"
    time.synchronize.shrink = "FALSE"
    time.synchronize.tools.startup = "FALSE"
  8. Epoch Converter

VMware Tips

  1. KB1005208: Injecting SCSI controller device drivers into Windows when it fails to boot after converting it with VMware Converter
    Basically need to include these 2 registry keys and related driver (for lsiscsi)
    For booting in WinPE, edit with ControlSet1 instead of CurrentControlSet
    
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\symmpi
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\
      CriticalDeviceDatabase\pci#ven_1000&dev_0030
  2. KB1664: Disable PC Speaker Beep sound in VMware
    mks.noBeep = true
    
    Per VM setting add to: *.vmx file
    Linux add to: /etc/vmware/config
    
    Alternative method:
    Linux: xset -b
    Windows: Device Manager -> show hidden devices
    open non plug-and-play -> beep -> disable
  3. VMware image can reduce 40% size if used NTFS file compression
  4. Linux Forums: How to update initrd image
    Extract initrd image:
    gunzip < /boot/initrd.img | cpio -i --make-directories
    
    Re-make initrd image:
    find ./ | cpio -H newc -o > ../initrd.cpio
    gzip initrd.cpio
    mv initrd.cpio.gz initrd.img
  5. Creating bootable Linux ISO for ESX4
    mkisofs -l -J -R -r -T -o custom_esx4.iso -b isolinux/isolinux.bin -c isolinux/boot.cat -no-emul-boot -boot-load-size 4 -boot-info-table ./esx4
  6. Linux vi editor command reference

Windows Workstation Links

Windows 8

Windows 7

  • Fix psshutdown.exe tool in Windows 7 (Still cannot fix it)
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
    create or modify 32-bit DWORD: LocalAccountTokenFilterPolicy
    set the value to: 1
    
  • Wikipedia: Compare Windows 7 Editions
  • Pushing the Limits of Windows: Physical Memory
  • Windows 7 USB DRIVE This device cannot start. (Code 10) (Also valid for USB controller could not startup problem)
    1. Backup the registry
    
    3. run regedit
    4. Locate the “UpperFilters” value under the following key in the registry:
    HKLM\SYSTEM\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}
    
    5. On the “Edit” menu, click “Delete”, and then click “OK”.
    6. Locate the “LowerFilters” value under the same key in the registry:
    HKLM\SYSTEM\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000} 
    
    7. On the “Edit” menu, click “Delete”, and then click “OK”.
    8. Quit Registry Editor and restart the computer.
    
  • Troubleshooting whitebox displayed on top-left hand corner after Windows 7 resume from hibernate mode
    Maybe related to MSI Notebook Utility: MGSysCtrl.exe, remove/stop/disable this program immediately remove the white box

Windows Vista

Resources vs Windows XP

Windows Vista Ultimate RTM:
- Base RAM after install: 260M-300M (minimum can be 168M-230M?)
Boot up require 224M RAM else 0x7b error
- Disk: 5.3G
- Swap: 1G (with 512M RAM)
- Resolution: 800x600
- Install Time: 50m (inside VMware, Celeron 1.2G, 512M RAM)
- Others:
CJK languages are installed by default
64bit will not support 16bit application, 32bit drivers
64bit even will need Vista compatible 64bit applications
All versions will include both 32bit and 64bit DVDs, except Starter

[32bit Vista]
- Support max. RAM: 4G
- max. Virtual Memory: 4G

[64bit Vista Home Basic]
- Support max. RAM: 8G
[64bit Vista Home Premium]
- Support max. RAM: 16G
[64bit Vista Business, Enterprise, Ultimate]
- Support max. RAM: 128G



Windows XP Pro:
- Base RAM after install: 100M-128M
- Disk: 1.8G
- Swap: 256M (with 128M RAM)
- Resolution: 800x600 (640x480 many menu inaccessible)
- Install Time: 30m-45m
- Support max. CPU: 2
- Support max. RAM: 4G / (128G for x64)
- max. Virtual Memory: 4G / (16TB for x64)


Windows Server 2003:
[Web]
- Support max. CPU: 2
- Support max. RAM: 2G

[Standard, Standard R2]
- Support max. CPU: 4
- Support max. RAM: 4G

[Enterprise, Enterprise R2]
- Support max. CPU: 8
- Support max. RAM: 64G

[Datacenter, Datacenter R2]
- Support max. CPU: 32 / 64
- Support max. RAM: 128G

[Standard x64, Standard x64 R2]
- Support max. CPU: 4
- Support max. RAM: ? / 32G

[Enterprise x64, Enterprise x64 R2]
- Support max. CPU: 8
- Support max. RAM: 1TB

[Datacenter x64, Datacenter x64 R2]
- Support max. CPU: 64
- Support max. RAM: 1TB


Windows XP Pro:
- Base RAM after install: 100M-128M
- Disk: 1.8G
- Swap: 256M (with 128M RAM)
- Resolution: 800x600 (640x480 many menu inaccessible)
- Install Time: 30m-45m
- Support max. CPU: 2
- Support max. RAM: 4G / (128G for x64)



Ref: Paul Thurrott's SuperSite
  • Useful shortcuts (applies to Windows XP)
  • Useful commands (share with Windows XP)
    • tskill to kill process
  • Major differences with Windows XP
    • .\username to logon locally, domain\username or username@domain.com to logon domain account
    • Fast User Switching works in domain mode
    • Start -> Run is hidden! Customize the Start button or use Window-R
    • By default these start shortcuts are disappered: Favorites, Printers, Run
    • By default, the shutdown button does not do shutdown but turn the computer in Sleep mode. (not Standby in XP) It will create a hibernate file and keep the computer in standby mode. In case the power is loss, the computer can still start from the hibernate file.
      When in sleep mode, after 15min (?) the computer will auto enter hibernate mode and shutdown.

    • Most files can have tags (keyword) attach to it
    • Can save the search results and re-use later. Saved search is regular file.
    • For disc burning. By default Windows Vista use Live File System (UDF?), XP use mastered format (ISO?)
    • Vista support read/write UDF upto 2.5 (default use multi-session UDF 2.01), read upto 2.6. XP only support read upto 2.0x (Wikipedia)
    • Window+Tab will use the Flip 3D feature, if Aero color scheme is used
    • Connect to a Network Projector utility can see other computer’s projected screen
    • Windows Meeting Space for peer-to-peer ad-hoc file sharing, replace NetMeeting in XP.
      • Meeting can be visible or hidden on the network
      • Meeting can set a password
      • Require Vista in a private network setup
      • Document sharing only keep the latest version, there is no conflict management!
      • May affected by firewall
    • Default XPS printer driver for printing XPS document (PDF competing format)
    • Windows Photo Gallery replace XP’s Picture and Fax Viewer
    • Windows Defender is build-in
      • Note that Windows Defender can have an Allowed Programs List
    • Parental Controls in Home & Ultimate editions
    • Windows Mail replaced Outlook Express (or just rename)
      • SmartScreen technology JunkMail Filtering
      • WARNING: Single identity only, no more multiple identities!
    • Windows Contacts replace personal address book in Outlook Express
      • Contacts keep at user profile’s Contacts folder as individual file
    • Windows Calendar
    • Sync Center to do file syncing for laptop
    • Windows Mobility Center to adjust laptop related settings
    • ReadyBoost function to use Flash drive to speed up machine boot up time
      • USB 2.0
      • at least 64M free
      • 3.5M/s minimum random read for 4kB data
      • 2.5M/s minimum random write for 512kB data
    • SuperFetch (share with ReadyBoost?) to preload programs / data to speed up things
    • Complete PC Backup possible to make a complete system image backup (Business/Enterprise/Ultimate only)
      • Create clone of disk into VirtualPC vhd image
      • Can only backup to disk/removable disk in NTFS partition
      • Restore can be done at the Vista DVD (the Windows PE enviornment)
    • New Policy for UAC at: Security Settings/Local Policies/Security Options
    • Redirect function to redirect protected writes to user profile: AppData\Local\VirtualStore (replace C:)
    • BitLocker Drive Encryption
      • At least 2 partitions, 1.5G for bootup unencrypt and the rest for C:
      • TPM 1.2 BIOS is needed, or
      • USB key with BIOS support use of USB key at bootup, with
      • Use Group Policy to enable use BitLocker in a non-TPM computer
    • Troubleshooting / Problem Reporting: Control Panel -> [System and Maintenance] -> Problem Reports and Solutions
    • sfc.exe now can specify the location of offline windows/boot directory
    • Snipping Tool allow capture part of the screen and do annotation
    • clip command which can pipe (|) stdout data to Windows Clipboard
    • where command similar to Unix is available
    • whoami command similar to Unix is available
    • timeout command, similar to Unix sleep, is available
    • User profiles keep in C:\Users, not C:\Documents and Settings (XP)
    • Documents folder in profile replace “My Docuemnts" (XP)
    • Aero user interface, which will be used when computer rating is at least 3.0
    • In Windows Explorer, can use checkbox next to icon to select files instead of Ctl click multiple files
      (Organize -> Folder and Search Options, turn on Use Checkbox to select files

    • The build-in defragmenter now can have schedules!
    • Automatic Backups replace ntbackup, however it does not allow you to choose folder to backup!
    • Shadow copy (used in Windows Server 2003) can keep file version, Business/Enterprise/Ultimate only
      • Created with System Restore point
      • When dual boot Windows XP, all Shadow Copies and Restore point will get erased!
    • Driver Signature Enforcement: Vista now seems only use signed drivers? (Need to clarify)
    • The build-in Administrator account can by-pass the UAC, but is disabled by default
    • References
  • Windows Vista Home

Windows XP

Vista System Restore

  • Works for NTFS partition only
  • 15% space will be used for System Restore
  • Shrink System Restore point will remove backup
  • vssadmin CLI tool to manage shadow copy
  • Resize Storage usage for C drive: vssadmin Resize ShadowStorage /For=C: /On=C: /MaxSize=2GB
  • Vista System Restore Management
  • Schedule Vista System Restore
    Change in Control Panel > Admin Tools > Task Scheduler

Vista UAC

Vista BitLocker Encryption

Vista Windows Aero

  • Requires
    • WDDM driver
    • 64M display
    • 32bit color
    • Windows Aero Theme & Color Scheme
    • Pass WGA check

Vista Bluetooth

Vista Windows Mail

  • Replace Outlook Express in XP
  • Only support IMAP and POP3, no longer support Hotmail’s HTTP
  • Can export messages to Outlook/Exchange (need MAPI client e.g. Outlook installed)

Vista Windows Calendar

  • Not support to sync with PDA Windows Mobile Device Center
    WMDC only support Outlook and does not support Windows Mail, Windows Address Book or Windows Calendar

  • Subscribed Windows Calendar cannot be re-published, only local Calendar data can publish to a share/website. Alternative is to export/import the Calendar and then publish it.

Deployment

Workstation Troubleshooting

  • Windows tip of the day: viewing your chkdsk report
    Recorded in Application Event, From: wininit event id 1001

  • KB196452: Why Windows NT Reports 6005, 6006, 6008, and 6009 Event Log Entries
    Bootup event log

  • Cannot find user profile and loaded with a temp profile, unlike XP it will not create a new profile
    Goto registry
    hkey_Local_machine\software\microsoft\windows NT\CurrentVersion\ProfileList

    Locate the key(S-1-5…) that had the old profile(C:\users\username) and delete it. Reboot.

  • Trustedinstaller.exe use up 100% CPU in Vista
    • Caused by Windows Update, no solution found yet, turn off Windows Update for the time being until a fix is out
  • Multi-monitor problem in Vista
    All display cards must use same WDDM driver (card from same vendor) in Vista to do multi-monitor, or force install older XPDM driver that allow mixing different drivers

  • Cannot Add program into the “Open With" context menu
    A thread in UltraEdit Forum suggested maybe an older version of the program was installed, but the newer version didn’t updated the HKEY_CLASSES_ROOT\Applications\ProgramName.exe\shell\open\command\(Default). Can try to manual correct the problem, or simply delete the open\command\(Default) key and let it re-create.

  • Removing hidden Com ports on PC / High com numbers
    set devmgr_show_nonpresent_devices=1, run devmgmt.msc and show hidden devices

  • Becoming NT AUTHORITY\SYSTEM on Windows

Windows PE

Plugins

Common Network Drivers

PE Troubleshooting

Windows Server Links

Windows Server 2012

Windows Server 2008 R2

General

Windows Server 2008 R2 Foundation

Windows Server 2008
Community
Active Directory
  • Study Checklist
    • Routing Status in sites
    • multiple DC enviornment
    • full / partial (OU) recovery / non-authorative recovery / restore to another server
    • Restore System State to another server for AD recovery, what is the side effect to existing member server?
    • Forest / Domain Function Levels
    • Universal Group Caching effects
    • Forest Trust with selective authentication
    • DACL (discretionary ACL)
    • PDC Emulator is only needed if there is Windows NT PDC/BDC?
  • Windows 2000 Server SP2 or earlier use only NTLM authentication in AD?
  • In a Native or 2003 Mode domain, GC is required for users to logon because it keep Universal Group information. In Mixed Mode, GC is not required for normal user to logon.
    In some case, Universal Group Caching may not work if the caching is out-dated.
  • Unless there is only 1 DC in the domain / all DC are GC, the Infrastructure Master must not be also a GC else it won’t work
  • TombstoneLifetime
    • Locate at: tombStoneLifetime attribute on: cn=Directory Service, cn=Windows NT, cn=Services, cn=Configuration,
    • Fixing Replication Lingering Object Problems (Event IDs 1388, 1988, 2042)
      If a domain controller does not replicate for a period of time that is longer than the tombstone lifetime and the domain controller is then reconnected to the replication topology, objects that were deleted from Active Directory while the domain controller was offline can remain on the domain controller as lingering objects.
      If backup restored contain deleted objects but the backup is older than the tombstonelifetime, then deleted objects will get added back to AD because the tombstone objects no longer exist.
    • 216993: Useful shelf life of a system-state backup of Active Directory
  • Forest Trust could not extend over the neighbour forest
  • Use ntdsutil to change the password in AD Restore Mode in a Domain Controller
  • Create Active Directory for a server from a backup: dcpromo /adv
    Further detail can refer to this article from petri.co.il
  • Using Scripts to Delegate Active Directory: Working with Property Sets
  • Difference between Local Groups, Global Groups and Universal Groups
    Universal Groups are useful in multi-domain enviornment only, as it can contain members from any domains
  • TechNet: Best Practice Active Directory Design for Managing Windows Networks
    Windows 2000 age, but still useful for multi-site AD planning
  • 315131: HOW TO: Use Ntdsutil to Manage Active Directory Files from the Command Line in Windows 2000
  • When restore a subtree in ntdsutil Authoritative mode, subject need to specify in: OU=OU Name, DC=domain, DC=lan
  • Restore an AD using System State will reset the DSRM password, please confirm the password before restore
  • Change DSRM Password
    • Win2k and Win2k3 are different
    • Win2k use setpwd, if use the wizard to create domain, default DSRM password is empty!
    • Win2k3 use: ntdsutil
    • It seems cannot change DSRM password inside DSRM mode, need to change when AD is running
    • Safe Mode password is NOT same as DSRM password, it is same as the AD administrator password!
    • Inside Safe Mode, net user administrator password seems will change the AD administrator password?
    • Inside DSRM, it is NOT possible to change the AD administrator password. net user administrator password will change the DSRM administrator password
    • Can use Linux ntpasswd to reset the DSRM password, but make sure NTFS is clean (boot into Safe Mode and do a reboot) else it will report “read-only filesystem"
  • Domain Rename
    • Only possible in 2003 Forest Level and 2003 Domain Level, with all DC using 2003 Server
    • Use rendom.exe on 2003 CD ValueAdd directory
  • DC Rename
    • Run by Domain Admins
    • Need 2003 Domain Level
    • Use netdom.exe in Support Tools
    • Rename with Full Computer Name (FQDN)
    • Both old and new names are keep to prevent service interruption, unless remove with the netdom.exe command
  • Move object between domains
    • Do at RID Master role server
    • use movetree.exe
  • PDC Emulator special function
    • If authentication failed at any DC, will forward request to PDC Emulator
  • Infrastructure Master
    • Contain latest group membership info
    • Should not mix role on a GC
  • Active Directory Schema Management
    • MMC Snap-in not activated to prevent modify wrongly
    • Activate with: regsvr32 schmmgmt.dll
    • Add Scap-in: Active Directory Schema
    • Change Schema Master role inside this MMC
  • Check Sync Status (Show USN number to each sync partner)
    repadmin / showutdvec dcname dc=domain,dc=tld
  • Find FSMO roles
    • Use MMC GUI Tools
    • replmon
    • ntdom
    • ntdsutil
  • Seize FSMO with ntdsutil
    • ntdsutil
    • roles
    • connections
    • connect to server newdcname
    • [quit to roles prompt]
    • seize schema / domain naming master / RID master / PDC / infrastructure master
    • [quit twice to quit]
  • Add additional DC do a domain / new domain
    • “An Active Directory domain controller for the domain xxx could not be contacted", although DNS was successfully queried
      It is *possible* the AD on the DC is corrupted and require other DC to provide the AD service on LDAP port (tested)
    • When add a child domain, must have an account as a Domain Admins of the parent domain (tested, seems even need the Domain Admins of root domain!)
    • If DNS server point to the parent’s DNS IP, there is no delegation and records created at the parent’s DNS server instead!
    • If DNS server point to new server’s own IP, delegation seems NOT setup automatically at parent domain.
      And only the initial AD related records are created at the parent’s domain (same as point DNS ip to parent domain’s DNS)
      The _msdcs subdomain seems created at all the child domain new servers!
  • AD Directory Service Logging debugging
    • HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics\*, default value = 0, recommend increase value upto 3 for verbose logging
    • Relogon to update the Event log with new entries
    • Only increase the value on debug purpose, keep normal use at level 0
DNS
DHCP
  • Study Checklist
    • netsh utility usage
    • DHCP Relay Agent
    • RFC 1542 compliant router
    • Superscope
  • Repair button on client do
    1. broadcast renew instead of unicast renew
    2. Flush ARP cache (arp -d *)
    3. Flush NBT cache (nbtstat -R)
    4. Flush DNS cache (ipconfig /flushdns)
    5. Register to WINS (nbtstat -RR)
    6. Register to DNS (ipconfig /registerdns)
  • 142042: Description of TCP/IP Node-Type Settings
    Describe DHCP 046 option node types when using 044 option WINS Server
  • DHCP error 14 is “out of address" error
    Also contain a brief list of important points on DHCP, RRAS, RIP
  • Reconcile database to fix inconsistency database error
  • getmac CLI (Support Tools) to get MAC address of a machine, even on remote subnet (I think need to in a same AD)
  • “netsh dhcp show server" display all DHCP servers in AD
  • dhcploc CLI (Support Tools) to check for DHCP servers on the network
  • Should not set DnsUpdateProxy group assign to a DC, else all records updated by DC has no ownership
    Alternative solution maybe specify the account to handle dynamic update in 2003 DHCP or specify the DHCP service account in 2000 SP2
  • use jetpack.exe to offline compact database if growth above 30M or report db error
  • DHCP manual backup include all data except credential for DNS dynamic update
  • TechNet detail on Conflict Detection
  • Exclusion has higher priority than Reservation
Routing and Remote Access (RAS)
  • By default, the username created for demand-dialin is same as the demand dial interface name for site-to-site connection
Group Policy
  • Study Checklist
    • Orders and relationship of GPO
  • Policy Management in Server 2003 No Override is renamed in GPMC, which is called Enforced
  • Group Policy Management Console
    Group Policy backup/restore, HTML report for policy
  • Group Policy Settings Reference for .adm files included with Windows XP Professional Service Pack 2
    Excel spreadsheet contain all the policies used in WinXP SP2
  • Group Policy Event Log verbose logging
    • HKEY_LOCAL_MACHINE/Software/ Microsoft/Windows NT/Current Version/Diagnostics/RunDiagnosticLoggingGroupPolicy, DWORD, value=1
    • Relogon to take the effect in Application Log
  • Group Policy Diagnostic Log
    • HKEY_LOCAL_MACHINE/Software/ Microsoft/Windows NT/Current Version/Winlogon/UserenvDebugLevel, DWORD, value=30002
    • Relogon to take the effect
    • Log file is at: %Systemroot%\Debug\Usermode\Userenv.log
    • 1M file size limit, will create bak file
  • Group Policy Software Deployment debugging
    • Change at target client computer
    • HKEY_LOCAL_MACHINE\Software\Microsoft\ Windows NT\CurrentVersion\Diagnostics\AppMgmtDebugLevel, DWORD, 4b
    • Restart the computer / relogon user (depeneds on publish or assign)
    • Log file is at: %Systemroot%\debug\usermode\appmgmt.log
    • Remove the debugging once finished
PKI
Windows Firewall
Administration
  • Study Checklist
    • WMI, applicable area
    • Virtual Tape Drive software? (Testing ARCserve)
    • Virtual Cluster with VMware
    • Internet printer sharing
    • ds* utilities
    • csvde utility
    • diskpart utility
    • wmic utility
    • Remote Assistance
  • Reset a password for the user by Administrator will make EFS encrypted files inaccessible, need to decrypt with recovery agent!
  • Microsoft: Trust between Windows Server 2003 and Windows NT 4.0 domain
  • Disable Disable Windows XP’s builtin zip support
    regsvr32 /u %windir%\system32\zipfldr.dll
    Better rename or remove the zipfldr.dll afterward
    Then re-associate ZIP extension with your ZIP program such as WinZIP
  • Guy’s Windows Logon VBScripts
    Include printer mapping scripts
  • Windows XP Fixes, Tips and Tweaks
    Contain a lot of registry fixes for Windows XP registry crashed by virus/malwares
  • AppDeploy.com – The Application Deployment Information Center
    Contain a lot of examples on how to automate software install!
  • Copy User profile to new account
    Copy a User Profile:
    Open System in Control Panel. On the User Profiles tab, and under Profiles stored on this computer, click the user profile you want to copy, and then click Copy To.
    In the Copy To dialog box, under Copy profile to, type the location for the new profile, or click Browse to select the path.
    Click Change to open the Choose User dialog box, click a new user from the Names list, and then click Add. The new user name will appear in Add Name. Click OK to add the user as a new user profile on your computer.
    Note: You must be logged on as an administrator to the local computer to copy user profiles. To open a Control Panel item, click Start, point to Settings, click Control Panel, and then double-click the appropriate icon.
  • AdminScriptEditor
    Tool to help admin create scripts, support: Batch, PowerShell, VBScript, AutoIt, KiXtart
  • Delete Files Older Than (Tool to delete files older than n days)
Computer Browser Service
Windows Rights Management Services
Windows Deployment Services
Software Update Services (SUS) – Obsolete
Windows Server Update Services (WSUS)
Volume Shadow Copy
Scripting
Rescue
Application Deployment
  • Study Checklist
    • Publish & Assign MSI applications via GPO
    • Publish & Assign’s differences
  • Terminal Server will not accept assigned / published applications from GPO, need manual install
  • Published application can be added to “Add/Remove Programs" and let the user choose to install it
Wireless Network Management
  • Study Checklist
    • Wireless Monitor
    • 802.1x and certificates
    • Wireless Policy for machines in domain
  • Define 802.1X authentication for wireless networks
    PEAP fast reconnect allows roaming users to maintain continuous wireless network connectivity when traveling between different wireless access points on the same network
  • Microsoft Virtual Wifi
    Single Wifi card connect to multiple Wifi network
Load Balancing
  • Study Checklist
    • Cluster Service in Enterprise Server (setup and recovery)
    • Cluster aware services
    • Shared SCSI drive configuration
    • Network Load Balancing
    • NLB Cluster in unicast/multicast mode
    • IGMP effect for NLB
  • Use Cluster Administrator GUI or cluster.exe utility to manage all servers inside a cluster (e.g. administrator password)
Backup & Restore
  • Study Checklist
    • ASR Backup
    • Copy Backup vs Normal Backup
    • Emergency Management Services in Recovery Console
RAS / VPN / IPSec
Legacy Technology
  • Study Checklist
    • WINS
    • Signed SMB
Security
  • Study Checklist
    • secedit
    • Security Template INF files
    • compatws.inf
    • securedc.inf
    • syskey utility
    • EFS Filesystem Encryption
  • Terminal Server Security
    Talk about: System Auditing, File System Auditing, Registry Auditing, Connection Auditing
Troubleshooting
  • RDP Slow problem
    – Tuning with TcpWindowSize or
    – Vista build-in Auto-tuning TCP/IP Receive Window Size
    – Follow Citrix client to set it to 64512 (More Info)
  • Client cannot join domain
  • svchost.exe 100% CPU during Windows Update (apply for Windows XP too)
    • Some dll may need re-register
      	net stop wuauserv 
      	
      	Repeat for the following: 
      	regsvr32 wuapi.dll 
      	regsvr32 wups.dll 
      	regsvr32 wuaueng.dll 
      	regsvr32 wuaueng1.dll 
      	regsvr32 wucltui.dll 
      	regsvr32 wuweb.dll 
      	regsvr32 MSXML3.dll 
      	regsvr32 qmgr.dll 
      	regsvr32 qmgrprxy.dll 
      	regsvr32 jscript.dll 
      	
      	net start wuauserv 
      
    • Try to Disable Microsoft Update and revert to Windows Update
      In MU, click “Change settings" in the left-hand sidebar,
      then check “Disable Microsoft Update software and let me use Windows Update only",
      and click “Apply changes now".

Redhat Linux Links

General
RedHat Network
RPM Packages
RPM Usage
  • Building RPM SRC Packages
    Most simple for RedHat 8.0:
    1. install the: rpm-build package
    2. run: rpmbuild -ba [spec file name]

  • query rpm package file
    • How to list package dependencies:
      	#rpm -qpR [package-1.2.3-1.i386.rpm]
      	
    • How to install rpm-s in correct order:
      	put all rpm's that you want to install in a one dir... 
      	and then :
      	#rpm -ihv *.rpm
      	Rpm will install them in correct order 
      	
    • How to extract files from an rpm:
      	Extract all the files inside an rpm to the current directory:
      	#rpm2cpio /path/to/rpm/filename.rpm | cpio -ivd
      	
    • List all the RPM with name & version seperate:
      	#rpm -qa --qf "%{NAME}\t%{VERSION}-%{RELEASE}\n"
      	
HOWTOs
  • HowtoForge
  • Rescue Fedora Core 4
    • Since Fedora Core 4 is using GCC 4.0 to compile, it cannot use most 3rd party boot CD / boot floppy to rescue the system (in chroot enviornment) and must use Fedora Core 4’s CD1
    • When using other boot CD to chroot Fedora Core 4 root, these error may happen:
      1) child setpgid (4061 to 4061): No such process,
      2) when doing grub-install, /boot/grub/stage1 not read correctly
  • Using iptables to rate-limit incoming connections
    This is generic, not only for Debian Linux.
    
    e.g. Limit 3 SSH connections per minute (the 4th+ connections will get droped)
    iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
    iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update \
    --seconds 60 --hitcount 4 -j DROP
    
  • Software RAID in RedHat Linux
    • Linux RAID FAQ
    • Root-on-LVM-on-RAID HOWTO
    • Unofficial Kernel 2.4 Root-on-RAID and Root-on-LVM-on-RAID HOWTO
    • 1U-Raid5.net – Linux Software RAID website
      A bit out-dated, but get the idea of how a bootable Linux Software RAID will work

    • To transfer an existing partition /dev/hda1 into a software RAID-1 partition /dev/md0 in Fedora Core 3
      1. Create enough md devices:
        		mknod /dev/md0 b 9 0
        		mknod /dev/md1 b 9 1
        		mknod /dev/md2 b 9 2
        		
      2. connect the prepare to be RAID disk as /dev/hdc
      3. boot up Linux, create partition(s) at /dev/hdc:
        hdc1, type: fd, bootable (for root)
        hdc2, type: fd (for swap)

      4. Create & activate initial single disk RAID devices:
        /sbin/mdadm –create –verbose –force /dev/md0 –level=1 –raid-devices=1 /dev/hdc1
        /sbin/mdadm –create –verbose –force /dev/md0 –level=1 –raid-devices=1 /dev/hdc2

      5. mke2fs -j /dev/md0
      6. mkswap /dev/md1
      7. mount the /dev/md0 to e.g. /mnt2, and transfer files from /dev/hda1
      8. chroot to /mnt2, modify the fstab to e.g.:
        /dev/md0                /                       ext3    defaults        1 1
        none                    /dev/pts                devpts  gid=5,mode=620  0 0
        none                    /proc                   proc    defaults        0 0
        none                    /dev/shm                tmpfs   defaults        0 0
        /dev/md1                swap                    swap    defaults        0 0
        

        *** Note that a label is not needed at the /dev/md0

      9. make sure /etc/modprobe.conf contain this for the md0 to be bootable:
        alias md-personality-3 raid1

      10. create an initrd file for booting the software RAID-1
        /sbin/mkinitrd –preload raid1 initrd-`uname -r`-raid1.img `uname -r`
        *** Make sure /dev/md0 and /dev/md1 is running before run mkinitrd, check with: cat /proc/mdstat
        *** Expect run more than 3 min even on a P3 1Ghz system

      11. modify the grub.conf to contains e.g.:
        title Fedora Core-up (2.6.9-1.667) SWRAID1
                root (hd0,0)
                kernel /boot/vmlinuz-2.6.9-1.667 ro root=/dev/md0
                initrd /boot/initrd-2.6.9-1.667-raid.img
        
      12. Run grub to make /dev/hdc bootable:
        		#> grub --batch --no-floppy
        		grub> root (hd1,0)
        		grub> setup (hd1)
        		
      13. exit from chroot, unmount the /dev/hdc, shutdown
      14. remove the old /dev/hda disk or clean the partiton before boot up.
      15. boot with hdc, You should be able to boot from the software RAID partition
      16. After boot up, set the RAID devices to 2 disks:
        /sbin/mdadm –grow /dev/md0 –raid-disks=2
        /sbin/mdadm –grow /dev/md1 –raid-disks=2

      17. Create the partitions at hda:
        hda1, type: fd, bootable (for root)
        hda2, type: fd (for swap)

      18. Add the partitions at hda to the RAID devices:
        /sbin/mdadm –manage /dev/md0 –add /dev/hda1
        /sbin/mdadm –manage /dev/md1 –add /dev/hda2

      19. Wait until the rebuild finish
      20. Run grub to make /dev/hda bootable, too:
        		#> grub --batch --no-floppy
        		grub> root (hd0,0)
        		grub> setup (hd0)
        		
      21. *** Other Useful commands:
        		Stop a MD device:
        		/sbin/mdadm --manage --stop /dev/md0
        		
        		Remove a partition from a MD device by clear the superblock:
        		/sbin/mdadm --misc --zero-superblock /dev/hdc1
        		
        		Remove a partition from a MD device by clear the superblock:
        		/sbin/mdadm --misc --zero-superblock /dev/hdc1
        		
        		Fail and remove hda1 from md0:
        		/sbin/mdadm --manage /dev/md0 --fail /dev/hda1
        		/sbin/mdadm --manage /dev/md0 --remove /dev/hda1
        		
      22. *** root at RAID-5:
        You can consider setup the /boot partition with RAID-1 across all the drives (hda1, hdb1, hdc1…etc) , then setup the / partition with RAID-5 on all the drives (hda2, hdb2, hdc2…etc)

    • To resize a RAID-1 array in Fedora Core 3 (replace a larger disk)
      1. Fail and remove a disk, then shutdown, replace with a larger disk, hot add it and let them rebuild. Repeat for all disks.
      2. Reboot the system after rebuild
      3. resize the MD device with:
        /sbin/mdadm –grow /dev/md0 –size [cal_size]
        *** NOTE: [cal_size] number should be 128 smaller than you see in fdisk (reserve 128k at the end for RAID use)

      4. The sync may be delayed, reboot to let the new MD device sync
      5. Resize with ext2online: (Need kernel support, I tested Fedora Core 3’s 2.6.9-1.667 works)
        /usr/sbin/ext2online -v /dev/md0

      6. Resize swap by rebuild the swap again:
        swapoff /dev/md1
        mkswap /dev/md1
        swapon /dev/md1
    • To transfer an existing partition /dev/hda1 into a software RAID-1 partition /dev/md0 in RedHat 8.0
      1. connect the prepare to be RAID disk as /dev/hdc
      2. boot up Linux, create partition(s) at /dev/hdc, type: fd
      3. prepare a dummy /etc/raidtab, create more md devices if needed:
        raiddev             /dev/md0
        raid-level                  1
        nr-raid-disks               2
        chunk-size                  4k
        persistent-superblock       1
        nr-spare-disks              0
            device          /dev/hdc1
            raid-disk     0
            device          /dev/hdp1
            failed-disk     1
        
      4. mkraid /dev/md0 to activate the ‘failed raid-1 array’
      5. mke2fs the /dev/md0
      6. mount the /dev/md0 to e.g. /mnt2, and transfer files from /dev/hda1
      7. chroot to /mnt2, modify the fstab to e.g.:
        /dev/md0                /                       ext3    defaults        1 1
        none                    /dev/pts                devpts  gid=5,mode=620  0 0
        none                    /proc                   proc    defaults        0 0
        none                    /dev/shm                tmpfs   defaults        0 0
        /dev/md1                swap                    swap    defaults        0 0
        
      8. make sure /etc/modules.conf contains:
        alias md-personality-3 raid1

      9. create an initrd file for booting the software RAID-1
        /sbin/mkinitrd –preload raid1 initrd-`uname -r`-raid1.img `uname -r`

      10. modify the grub.conf to contains e.g.:
        title Red Hat Linux (2.4.18-14smp) SWRAID1
                root (hd0,0)
                kernel /boot/vmlinuz-2.4.18-14smp ro root=/dev/md0
                initrd /boot/initrd-2.4.18-14smp-raid1.img
        
      11. Run grub to make /dev/hdc bootable:
        #> grub –batch –no-floppy
        grub> root (hd1,0)
        grub> setup (hd1)

      12. exit from chroot, unmount the /dev/hdc, boot up the hdc dummy RAID-1 partition
        replace the /dev/hda or clean the partiton before boot up.

      13. You should be able to boot from the software RAID partition
      14. Afterboot up, transfer the partition information from /dev/hdc to /dev/hda: (or manual create with fdisk)
        sfdisk -d –no-reread /dev/hdc > /tmp/partition
        sfdisk /dev/hda < /tmp/partition
      15. correct the /etc/raidtab:
        replace ‘failed-disk’ to ‘raid-disk’
        replace ‘/dev/hdp1’ to ‘/dev/hda1’

      16. rebuild the array:
        raidhotadd /dev/md0 /dev/hda1

      17. Run grub to make /dev/hda bootable, too:
        		#> grub --batch --no-floppy
        		grub> root (hd0,0)
        		grub> setup (hd0)
        		
  • How to change runlevel at boot time?
  • Promise RAID card with RedHat / Fedora Linux
  • Persistent connection using wvdial
    • Special config may needed for persistent connection using wvdial
      At /etc/sysconfig/network-scripts/ifcfg-pppX, removed all entries except the following:
      
      DEVICE=ppp2
      NAME=mobilcom
      WVDIALSECT=mobilcom
      MODEMPORT=/dev/ttyS0
      LINESPEED=115200
      PAPNAME=x
      USERCTL=true
      ONBOOT=no
      PERSIST=no
      
      modify /etc/wvdial.conf, set:
      Stupid mode = 1
      
  • Setup PPP Server
  • Steps to upgrade RedHat 8.0 MySQL from 3.23.xx to 4.0
    1. install MySQL-shared-compat (4.x)
    2. uninstall mysql-server (3.x)
    3. uninstall mysql (3.x)
    4. install MySQL-client (4.x)
    5. install MySQL-server (4.x)
Enterprise Volume Management System
Virtual Private Network (VPN)

IPSec

PPTP

Troubleshooting
  • Fedora Core 4: Public key for autoconf-2.59-5.noarch.rpm is not installed:
    Retrieving GPG key from file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora
    GPG key at file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora (0x4F2A6FD2) is already installed
    The GPG keys listed for the “Fedora Core 4 – i386 – Base" repository are already installed but they are not correct for this package.

    • Solution: install the GPG key by: rpm –import /usr/share/rhn/RPM-GPG-KEY
  • module-info and system.map
  • Fedora Core 1 on VMware installation problem (VMware Workstation internal monitor error)
  • HTML::Mason perl module in RedHat 8.0
  • Setup Perl CPAN
  • After installed a kernel RPM, grubby fatal error: unable to find a suitable template
  • There was an SSL error: [(‘SSL routines’, ‘SSL3_GET_SERVER_CERTIFICATE’, ‘certificate verify failed’)]
  • “Call to undefined function: pg_connect()" in PHP script
    • Try to re-install the php-pgsql package with both latest php & postgresql installed
  • RPM hang when using ‘rpm -e package-name’
    • This is an rpm bug. remove /var/lib/rpm/__db.*, then run rpm –rebuilddb (15mins on a P3 700Mhz machine)
  • Fedora Core 1 cannot use up2date due to Keyring error
  • RedHat 7.0 hangs at “Freeing unused kernel memory: "
    • glibc & glibc-common maybe installed with i686 binary, try to find a way to replace the system’s glibc into i386 binary
    • Maybe due to glibc for Pentium Pro used
      …RH 7.0 automatically installs glibc for a Pentium Pro or later if that cpu is present during install…?

    • Maybe turn off apm
      pass kernel parameter: apm=off (not work for me)