Blog

Archive for October, 2007

DHCPLOC Utility - Detect Rogue DHCP Servers on your network

Wednesday, October 31st, 2007

http://technet2.microsoft.com/windowsserver/en/library/8fa42e83-ec08-4a9b-9057-8909f7ed433e1033.mspx?mfr=true
This command-line tool displays the DHCP servers active on the subnet. If it detects any unauthorized DHCP servers, it beeps and sends out alert messages. It also displays packets that it detects from DHCP servers; you can specify whether to display packets from all DHCP servers or only those from unauthorized servers.

You can also use this tool to determine which DHCP servers are available to a DHCP client and to detect unauthorized DHCP servers on a subnet.

Here is the DHCPLOC syntax:

dhcploc /p /a:”AlertNameList” /i:AlertInterval ComputerIPAddress [ValidDHCPServerList]

/p suppresses display of detected packets from any of the authorized DHCP servers specified in ValidDHCPServerList. /a:”AlertNameList” sends alert messages to the names in AlertNameList if any unauthorized DHCP servers are found.

/i:AlertInterval specifies the alert frequency in seconds.

ComputerIPAddress specifies the IP address of the computer from which you are running DHCPLoc. If the computer has multiple adapters, you must specify the IP address of the adapter that is connected to the subnet you want to test.

ValidDHCPServerList specifies the IP addresses of any number of authorized DHCP servers. The tool does not send alerts when it detects packets from the servers in this list; however, it displays those packets unless you use the /p parameter.

Kazmarek Employees can find the utility on the KTS FTP server in the \Downloads\Microsoft Windows - Server\DHCPLoc\ location

Alternativily the utilty is available in the Support Tools directory on the Windows Server CD.

Enable Remote Desktop Connections from a Remote Location

Wednesday, October 31st, 2007

If you dont have physical access to a PC or Server and you need to get remotely connected but the PC doesnt have the option to accept remote desktop connections, you can create a simple vbscript executable to do the trick. 

Copy the text below into a new text document.  Rename the file to .vbs  Run the file from the same network as the target system and be sure you are logged in with domain admin credentials.  You will be prompted to enter the PC name or IP address and thats it!

Code starts below this line =========================================

Const ENABLE_CONNECTIONS = 1

strComputer = InputBox(”Enter a computer name or IP:”,”RDP Remote Enable”)
If Len(strComputer) > 1 then
 Set objWMIService = GetObject(”winmgmts:” _
      & “{impersonationLevel=impersonate}\\” & strComputer & “\root\cimv2″)

 Set colItems = objWMIService.ExecQuery _
      (”Select * from Win32_TerminalServiceSetting”)

 For Each objItem in colItems
      errResult = objItem.SetAllowTSConnections(ENABLE_CONNECTIONS)
 Next
End If

Code ends above this line=========================================

Office Communication Server Mobile “You are currently not using the recommended version of the client”

Monday, October 29th, 2007

If you receive the error: “You are currently not using the recommended version of the client” on your OCS mobile client then you are probably running into the Client Version Filter.  To remedy this, you have to change the CPE value in the Client Version Filter to a value greater than the current version of your mobile client on both the Standard server and the Access Edge server. 

1)check the version on the mobile client by going to the options screen (from the client menu) and selecting Help.
2) In the OCS Console for the Standard Server, right-click the pool, select Application Properties -> Client Version Filter.  You will get a screen that looks like the one below:

3) Edit the CPE value to one less then the current version on your device.
4) For the Access Edge Server, use the ClientVersionFilterConfig.exe under \Program Files\Common Files\Microsoft Office Communications Server 2007 to change the CPE.
5) Restart the RTCSRV on both servers.

 Thanks to this article for the info!

Microsoft Active Directory Topology Diagrammer

Friday, October 12th, 2007

Microsoft has created an automated Visio diagrammer that pulls your Active Directory information and generates a Visio diagram.

link: ADTD

How to Move WSUS Content (Update Files)

Thursday, October 11th, 2007

You can use WSUSUtil.exe (found in \Program Files\Update Services\Tools) to move the downloaded update files (if you are storing them locally) and reconfigure WSUS to use that location for future updates.  The procedure is this:

 wsusutil.exe movecontent [path to new location] [name of log file]

If you so desire, you can also add the -skipcopy switch to reconfigure WSUS without physically moving the existing files. 
To see the full information on the WSUSUtil, visit the TechNet page for it here

Trend Micro Internet Security 2007 - PcScnSrv.exe Consumes Too Much CPU

Wednesday, October 10th, 2007

Trend Micro’s PcScnSrv.exe process can be seen spiking often to almost 100% of the CPU.  This issue is caused by the Immunization feature of Spybot S&D.  Apprently the two products do not play well together…in fact, during the install of Trend Micro Internet Security 2007, the removal of Spybot S&D is recommended.  If you do have both products installed, Trend Micro’s recommended solution can be found here

The basic steps are this:

1. Open Spybot and go to the Immunize section.
2. Click the undo button to allow all bad products previousely blocked by Spybot.
3. Delete: C:\Program Files\Trend Micro\Internet Security 2007\usrwl.dat
4. Reboot

Vista Network and Volume Icons Disappear from the System Tray

Monday, October 8th, 2007

It seems to be a common problem that your Network and Volume icons may disappear from the system tray.  If this happens, it may be a quick fix by going to the properties of the taskbar and checking off each one on the Notification Area tab.  If however, these options are greyed out, then the problem may be the icon “History”.  To resolve this, delete the following keys in the registry then restart the Explorer.exe process.

HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion \TrayNotify\IconStreams
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion \TrayNotify\PastIconsStream

Printer Mapping File in Windows Terminal Server

Tuesday, October 2nd, 2007

There is a way to use an .inf file to manage the mapping of printer drivers on Terminal Server (similar to how Citrix manages printer mapping).  To enable this feature, the following two registry keys need to be created:

HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\PrinterMappingINFName
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\PrinterMappingINFSection

Each of these is a string (REG_SZ) type.  The first refers to an inf file that you create and store in C:\WINDOWS\SYSTEM32\.  The value only needs to be the name of the file, not the entire path.  The second refers to the section within that file that will deal with the printer driver mapping (in the example below, “Printers”).  An example would look like this:

[Version]
Signature=”$Windows NT$”
;
[Printers]
;
; ***Client Driver Name***                        ***Server Driver Name***
;
“Brother HL-1250″   = “HP LaserJet 5