We have a security appliance that manages user passwords.  One feature of this appliance is it can initiate a RDP session to a Windows box and pass the user’s credentials for authentication, which allows the users to access the remote system without knowing their password. 

Related Posts

• Microsoft releases load simulation tools for desktops
• Fix: rdpclip.exe won’t run on Windows Server 2003
• A Portable Remote Desktop Connection (mstsc.exe)
• Howto: Install rdesktop on SLES 10 SP2 Linux
• Howto: Log Connections to Specific Ports and Processes on Windows Machines

Microsoft Press is making the Windows Vista Resource Kit, Second Edition a free download for one month only.

The catch is you have to sign up for the Microsoft Press Book Connection Newsletter, which will give you notification of offers, register, and download the free eBook selection of the month.

The book is written by Mitch Tulloch, Tony Northrup, and Jerry Honeycutt with the Windows Vista Team. If you’d like to purchase the print copy of the book, you can pick it up for $44.09 on amazon.com, a savings of $25.00.

Related Posts

• Direct patch download links for MS10-002 KB978207
• Find Windows system uptime from the command line
• Vista x86 patch to address 4GB+ of RAM
• Howto: Do not display the name of the user who has locked a Windows computer or server
• Fix: Windows 2008 server is displayed as Windows Vista in McAfee EPO agent console

Normally reinstalling the McAfee Common Management Agent (CMA) requires a reboot in order for the server to be properly displayed in the EPO management interface.  Here’s how to perform the reinstall, minus the reboot requirement. 

• Prevent McAfee Services from being stopped
• Enable Access Protection.  

cd C:\Program Files\McAfee\Common Files 

Related Posts

• Fix: McAfee ePo Error “Server Policy Invalid”
• Fix: Windows 2008 server is displayed as Windows Vista in McAfee EPO agent console
• Howto Fix: McAfee VirusScan 8.5i McAfee Common Framework returned error fffff95b
• Fix: Cannot Telnet from computer running McAfee VirusScan due to port blocking rules
• McAfee consumer products uninstaller tool

All admins should read the Microsoft Malware Protection Center’s analysis of the Win32/Conficker.B worm. It references the weak passwords the worm attempts to use. I’ve finally found a list of these weak passwords on the Analysis tab. Here they are, make sure none are in use in your network!

123
1234
12345
123456
1234567
12345678
123456789
1234567890
123123
12321
123321
123abc
123qwe
123asd
1234abcd
1234qwer
1q2w3e
a1b2c3
admin
Admin
administrator
nimda
qwewq
qweewq
qwerty
qweasd
asdsa
asddsa
asdzxc
asdfgh
qweasdzxc
q1w2e3
qazwsx
qazwsxedc
zxcxz
zxccxz
zxcvb
zxcvbn
passwd
password
Password
login
Login
pass
mypass
mypassword
adminadmin
root
rootroot
test
testtest
temp
temptemp
foofoo
foobar
default
password1
password12
password123
admin1
admin12
admin123
pass1
pass12
pass123
root123
pw123
abc123
qwe123
test123
temp123
mypc123
home123
work123
boss123
love123
sample
example
internet
Internet
nopass
nopassword
nothing
ihavenopass
temporary
manager
business
oracle
lotus
database
backup
owner
computer
server
secret
super
share
superuser
supervisor
office
shadow
system
public
secure
security
desktop
changeme
codename
codeword
nobody
cluster
customer
exchange
explorer
campus
money
access
domain
letmein
letitbe
anything
unknown
monitor
windows
files
academia
account
student
freedom
forever
cookie
coffee
market
private
games
killer
controller
intranet
work
home
job
foo
web
file
sql
aaa
aaaa
aaaaa
qqq
qqqq
qqqqq
xxx
xxxx
xxxxx
zzz
zzzz
zzzzz
fuck
12
21
321
4321
54321
654321
7654321
87654321
987654321
0987654321
0
00
000
0000
00000
00000
0000000
00000000
1
11
111
1111
11111
111111
1111111
11111111
2
22
222
2222
22222
222222
2222222
22222222
3
33
333
3333
33333
333333
3333333
33333333
4
44
444
4444
44444
444444
4444444
44444444
5
55
555
5555
55555
555555
5555555
55555555
6
66
666
6666
66666
666666
6666666
66666666
7
77
777
7777
77777
777777
7777777
77777777
8
88
888
8888
88888
888888
8888888
88888888
9
99
999
9999
99999
999999
9999999
99999999

To easily audit your network, use the above list along with a utility like John the Ripper to check for weak password usage. Or you could use the Nessus plugin, which is described in detail on the Tenable Security Blog, to identify machines with the MS08-067 vulnerability.

For a nice overview of how to keep this worm from infecting your machine in the first place, check out Woody Leonhard’s article at windowssecrets.com

Random Posts

• Howto: Fix the Outlook 2007 Double Spacing Problem
• Howto: automatically remove files older than ‘x’ days, Part II
• Howto: Migrate file shares, permissions, and user profiles paths in a Windows 2003 domain
• FIX: Event ID: 57860 “An error occurred while attempting to log in to the following server… SQL error number: “0011″ is seen when backing up a server with SQL installed
• Howto: Install VMware Tools on Windows 2008 Server Core

I always forget this, so I’m posting this here for the next time I need to review a Dell Dset report, that the default password is ‘dell’.

If you are not familiar with Dset, you can download it from http://ftp.us.dell.com/sysman/Dell_DSET_1.5.0.120.exe

It’s a nifty utility that provides configuration and diagnostic information for Dell’s technical support staff. I like it because I can have someone run it on a remote server and email me the report. It’s very helpful when trying to determine if a hardware failure has occurred (or is occurring).

The Dset readme describes the product in the following manner:

Dell Server E-Support Tool (DSET) provides the ability to collect hardware, storage and operating system information of a Dell PowerEdge or PowerVault server. This information is consolidated into a single “System Configuration Report” that can be useful for troubleshooting or inventory collection of a system. The browser user interface provides a convenient means to view specific data through hierarchical menu trees.

DSET is intended to be a small, non-intrusive tool that does not require a reboot of the system to provide full functionality. DSET can collect information about Linux modules, services, network settings, etc. as well as system logs. DSET will also collect extended hardware information such as processors, memory, PCI cards, ESM log, BIOS/firmware versions and system health (fan/voltage levels) as well as storage configuration information (RAID controllers, hard drives).

Related Posts

• Determining when a local Windows account password was last changed
• Finding Windows user accounts with non-expiring passwords
• Workaround for Dell OpenManage Server Administrator installation fails prerequisite checks
• Howto: Reset a lost VMware guest password
• Howto: Change the IP address of a Dell 4/P DRAC from the command line without rebooting the server

To dump a listing of your organization’s Groupwise user FIDs, run the following from a Netware server’s SYS:\PUBLIC directory:

nlist user=* show “NGW: File ID” >fids.txt /R /S

where:

[update November 21, 2008]

The above command only dumps Groupwise user FIDs. To dump Groupwise External Entity FIDs follow these instructions.

Related Posts

• Howto: export Groupwise External Entity File IDs (FID) to a text file
• Novell TID 3801441 Is Wrong! – How to create a GroupWise user with a specific File ID (FID) for accessing an archive, or restoring a deleted user
• Groupwise GWcheck Error: Mailbox/library maintenance can not be executed because a duplicate request is running
• Fix: Groupwise Login Failed Login Rejected (8219)
• HowTo: Export a list of all computers in an AD OU

I’ve been trying to troubleshoot an email server problem all day, and one of the tests I’ve been performing is trying to connect to port 25 of the mail server through Telnet.  Every time I tried I get connection refused messages, and the connection would drop. 

1. Started McAfee VirusScan Console
2. Double clicked Access Protection
3. Highlighted the Anti-Virus Standard Protection category from the left column
4. Highlighted the Prevent mass mailing worms from sending mail rule in the right column



 

5. Pressed Edit
6. Under Processes to Exclude, I put my cursor at the end of the list of processes, which was winpm-32.exe in my case.  I typed a comma following winpm-32, exe, and then added a space and telnet.exe to the list
7.  I pressed OK twice, exited VirusScan Console, and was able to Telnet to my mail server.

Related Posts

• Howto Fix: McAfee VirusScan 8.5i McAfee Common Framework returned error fffff95b
• Fix: McAfee ePo Error “Server Policy Invalid”
• Fix: Blank screen when using Windows XP telnet client
• Fix: Windows 2008 server is displayed as Windows Vista in McAfee EPO agent console
• Reinstalling the McAfee Common Management Agent Framework (framepkg.exe) without a reboot

I’m preparing to migrate our Netware 6.5/Groupwise 6.5 servers to Windows 2003 R2 SP2/Groupwise 7.0.3, with the Groupwise data located on an EMC Clariion SAN with 4GB fibre channel connectivity.  The Groupwise agents will run locally on the server’s direct attached storage.  

 

Random Posts

• Capturing Virtual Machine Blue Screens via Powershell
• Recommendations for securing Internet Explorer, Firefox and Safari web browsers
• Howto: Automatically Boot Windows XP with Last Known Good Configuration
• My unattended Windows XP deployment methods
• Howto: Find eDirectory SSL certificates and determine when they expire

Better think twice about integrating Adobe Acrobat 9.x into your environment.  From Adobe KB Technote 333223.

Although you can install Adobe Acrobat 9.x or Adobe Reader 9.x on a computer that contains an installation of previous Acrobat versions, it is not recommended. Acrobat 9.x Professional and Acrobat 9.x Standard use the Acrobat 9.x version of PDFMaker and Adobe PDF printer. When two or more versions of Acrobat are installed on the same computer, removing one version of Acrobat may disable functionality.

If two versions of Acrobat are installed on the same computer, only the Acrobat 8.0.x version of PDFMaker and Adobe PDF printer will be used, although conflicts may occurs if multiple version PDFMaker files are attempting to load.

When multiple versions of Acrobat exist on a machine, the running version will be used to display PDF files regardless of the preferences.

Removing previous versions of Acrobat or Adobe Reader after you install a more recent version can disable functionality. Repair the current version of Acrobat after removing the previous version. If the repair process does not restore all functionality, reinstall the current version.

Note: Adobe Technical Support does not recommend or support having multiple versions of Acrobat or Adobe Reader installed on the same machine (for example Acrobat 8, with Adobe Reader 9 or Acrobat 7 with Adobe Reader . Acrobat and Adobe Reader have numerous components that have similar functionality and can cause conflicts on a machine. The most prevalent among these conflicts involves the plug-ins for rendering PDF files in the browser, PDFMaker inside of Office Applications, and the Adobe PDF printer. Using the Version Interoperability table below, remove all versions of Acrobat and Adobe Reader, and then install the current version.

Version interoperability

This chart shows what will happen if you install Adobe Acrobat 8.0.x when the computer already has Acrobat or Adobe Reader installed.

• Allowed indicates that this state will function and should not generate any error messages.
• Replace indicates that the new version will replace the original version with no option to remove the original version.
• Repair indicates that you are trying to install a version of Acrobat or Adobe Reader that is already installed on your computer, and the installer allows you to modify, repair, or remove the program.
• Rec Removal indicates that you should cancel the installation of Acrobat 8.0.x and remove the older version, reboot, and then install Acrobat 8.0.x
• Rec Auto Removal indicates that you will receive a warning indicating that an older version has been encountered. You can remove the older version or ignore it and have Acrobat and Adobe Reader coexist.
• Required Auto Removal indicates that you will receive a warning that an older or less functional product has been detected. You can remove the less functional product or cancel the installation.
• Manually Remove indicates that you must quit the installer, remove the version of Acrobat or Adobe Reader that is currently installed, and then install Acrobat 8.0.x.

Upgrade eligibility

The following products do not qualify for an upgrade to Acrobat 9:

• Acrobat 5.x or earlier
• Acrobat Elements
• Acrobat Business Tools
• Acrobat Approval
• Adobe Reader
• Acrobat Reader
• Acrobat Reader-Writer
• Acrobat Distiller PE or LE, or any version of Acrobat Distiller that’s bundled with Adobe PageMaker or Adobe FrameMaker

Random Posts

• Simple script to backup Groupwise 7 configuration files on SLES Linux
• Howto: Block Windows 2003 SP2 from Automatic Updates
• Windows XP firewall service is enabled after installing XP SP3 – even if it was previously disabled
• 64-bit Windows isn’t displaying files saved in the Office 2007 format when searching for Documents
• Assigning Netware rights via the command line

I was Director of Network Services at my previous job, and as Director, it was my job to make sure no one employee had all the keys to the castle – meaning not one person could hold the company, or it’s customers hostage like Terry Childs has done to the City of San Francisco.

If you’re not aware of this incident, Mr. Childs, a CCIE, locked out other City IT staff from using the Wide Area Network.  He was able to do this because only he controlled the passwords that allowed access to the City’s routers.

According to a source that has inside knowledge of the incident, “A key point made in the e-mail is that Childs’ managers and coworkers all knew that he was the only person with administrative access to the network. In fact, it was apparently known and accepted in many levels of the San Francisco IT department.”

If I was in charge of IT on this network, I’d be re-assessing my change control procedures, as well as diversify who has access to network configurations.  Not having backup copies of the router configurations is incomprehensible, especially when a program like RANCID is freely available.  And as head of IT, I’d be having conversations with Mr. Childs’ supervisors to find out who thought it was a good idea to allow one person to have so much control over a mission critical network.

Related Posts

• Howto: Export 3com 4xxx family switch configurations to a text file for backup and change management