It's "pwned" idiots not "pawned"

Tail is a helpful Linux utility and Windows also has a tail option, but you have to download it.  It’s part of the “Windows Server 2003 Resource Kit Tools” from Microsoft.  As of this posting I don’t think there is a resource kit for Server 2008 that’s been released but I bet this version works on 08 as well.  There are other tail versions on the net for Windows but I’d stick with what M$ provides in the resource kit, it’s simple and just works!

This small helpful utility allows you to watch log files as they populate or fill up in a command prompt.  Download it –> Here or you can download the resource kit previously mentioned where the file is also contained.

What you should do is copy tail.exe to your “%systemroot%\system32”, on my machine it’s “C:\Windows\System32 but depending on how Windows was installed yours might be different.  Click Start > Run > copy that %system…line in quotes into the run dialog then click OK, then copy your tail.exe into that folder.

by default many Windows log files are kept in a subdirectory in your System32 folder, particularly the firewall log on a Windows XP systems ( “%windir%\System32\LogFiles”).  I’d poke around and see what you see.  Lets next open a command prompt, Start > Run > CMD.

Lets try the firewall.log file!

Type:

tail -f  “%windir%\pfirewall.log”

Your firewall log file might be in a different location so be sure to find it and change where tail is looking, if it’s wrong tail won’t work until it can read a file that exists.  Depending on what your firewall is logging you should see your screen light up with activity.  This can be particularly helpful for troubleshooting potential firewall problems, or maybe you’re running IIS servers or other servers that log to readable text based files.  If so tail is for you!

Lastly – from the command line you can type “tail /?” for options, there aren’t many but you might want to display only the last 50 lines of the log in your screen.  For this we’d type:

tail -n 50 -f “c:\whateverfolders\morefolders\yourlogfile.log”

50 lines are easier to follow than the default 10 lines.

Have you ever needed to gather system information from remote machines and wish you had a sweet script or batch file to do it?  I happened to have one!

It’s an easy one, Keep It Simple Stupid (KISS) right?

What you’ll need:

• sysinfo.exe (which I bumped into on Windows XP in some service pack directory)
• Text file of machines you want to query

You can find sysinfo.exe in “C:\Windows\ServicePackFiles\i386”, for the list of machines to query it’s all you!

Here’s what to do:

Put your sysinfo.exe and pclist.txt files in a directory anywhere on your computer.  Open a command prompt, Start > Run > CMD > OK.  Navigate to the directory with sysinfo.exe and your text file in it.

Type:  for /f %i in (pclist.txt) do sysinfo /S %i /U %i\administrator /P “your local admin password can have spaces” /FO CSV >>PClist.csv

What this does is “for” every line  in your text file (computer1, computer2, etc) it calls the sysinfo.exe command to get the system information of a particular system, i.e. /S %i.  By using our “for loop” we tell it to iterate through the file repeating our system information request on as many machines as we’ listed in the text file.  Our command continues executing on each line then it appends the result “>>” to a CSV file we can then open with Excel or manipulate in other ways.

/S is system, specifying the REMOTE system connection

/U is our credentials, domain\username OR as we did %i\username, we used the local administrator account!

/P is our password, it’s plain text here people so don’t type this while Joe Shmoe is looking over your shoulder!

/FO is our format, we specified a CSV but you also have “TABLE” and “LIST” which might be helpful.

You should get output that has great information in it.  The stuff I was looking for were host-name, OS, a hardware vender like Dell, HP, etc what type of processor it has, the up-time is great to have, how many processors it has (class of processor) and the service pack level.  It’s an easy way to run a quick audit because it also lists the patches you have installed, it doesn’t hurt to take a quick look at them.

Does your company use network mapped drives?  Do you have so many that things are getting out of hand or do you want to map your drives with more precision?  I used to work for a company that almost used every letter in the alphabet.  They had mapped drives E – Z and wanted more, things were truly out of hand.  One of the other problems was the distributed environment, they sometimes wanted drives from other sites and locations over a WAN connection.

Security was a problem too; everyone could read, write and delete to network shares and everyone mapped every drive possible.  A former Network Administrator set it up that way and I was left holding the bag (but that’s OK because I like a challenge!).  It’s something I didn’t change because a massive change like that needed planning.  People find data on the network and get used to their locations, had I made a sudden change it would be pulling the rug on productivity for sure.  It wasn’t a priority at the time as I had bigger fish to fry and management had other plans for the data (SharePoint).  The company later closed their doors (it was an Automotive company) but the memory still haunts me of all those networked drives!

There are two ways you can accomplish drive mapping with some precision.  One way is by using Group Policy, creating your group, adding your users o that group, creating your logon policy, filtering the policy by the group you created thus all members of that group will execute that script via the logon policy.  Anyone not in that group wont’ execute the script.  This is my personally preferred method BUT there’s another way for people who already have users using a login script.  I’ve used both methods in the past and both work equally well.  Most companies still use a logon script located in “\\yourdomain\netlogon” folder.  It’s usually a batch file and if it is you’re in luck!  You can get to it by clicking “Start > Run > Type in:  \\yourdomain\netlogon” > OK”.

What you can do is this…

1 – Download “IFMEMBER.EXE” from M$ —> Here and extract the file (Install it)
2 – Create security groups for your respective shares, add permissions to those shares if they don’t already exist
3 – Copy the “IFMEMBER.EXE” from “C:\Program Files\Resource Kit” to your network “\\yourdomain\netlogon”
4  – Add similar lines of code to your batch file logon script…

__________________________________________________

:: This is a comment – Beginning IFMEMBER process
REM This is another comment – which looks cleaner REM or ::?
ifmember “yourdomain\yoursecuritygroup1”
if not errorlevel 1 goto 1
net use “\\yourserver\yourfolder1”

:1
ifmember “yourdomain\yoursecuritygroup2”
if not errorlevel 1 goto 2
net use “\\yourserver\yourfolder2”

:2
end

__________________________________________________

* I had a mistake in my code, bolded above – needs to always be “errorlevel 1 goto #“, notice it’s always “errorlevel 1”

What this simply does is query if the user running the logon batch file is a member of the listed group, if they’re NOT a member it will error, i.e. “if not” then it will skip the next command “net use” and go to the error number you specify, we specified :2, and so on.  This could clean up many network mapping scenarios for network administrators that aren’t too familiar with this utility.

Tip:  For IFMEMBER options just type in IFMEMBER from a command prompt.

__________________________________________________

usage: ifmember [/verbose] [/list] groupname …
/verbose will print out all matches.
/list will print out all groups user is a member of.
Return Code shows number of groups this user is a member of.
Example: ifmember /v /l “MyDomain\Domain Users” Users Everyone

__________________________________________________

Lastly, another way to use the tool is to just run it against a group to see who are members of a group.

Try this one:  “ifmember /list administrators”

You might turn up some surprises!

I found a cool utility called “Remote Reboot X” the other day and thought It deserved MORE than an honorable mention.  I didn’t read much about the application but I think it comes from – at least in part – Microsoft, thanks to their WSUS API.

Microsoft has a cool VB script you can call with the cscript command.  You can find the script source —> Here

What that script does is search for updates, downloads updates and then installs updates.  It’s quick and dirty and doesn’t allow you to control your options (as far as I know, I only fiddled with it).  What you can do is batch out a copy of the script to c:\temp on a remote machine then use psexec.exe to call that script.

If you’re looking for more control (and I know you are!) download a program called “Remote Reboot X“, brought to you by Doug Zuck.

The program was originally designed by Doug to just remotely reboot machines but he then added functionality to hook into WSUS and do what the Microsoft script does except with more control!

One note: The program needs psexec.exe in the same directory as RemoteRebootX.exe and you can get that —> Here.  Also note that the program creates a directory on the remote machine on the root of C, “C:\RR”.  If you’re all done you can delete that on the remote directory but there is a log you might want to check before doing so.

Great job on that helpful application Doug!

I should have saved this for Valentines Day but I couldn’t wait and I missed the Sweetest Day deadline.

FileZilla FTP Power:

We all love for things to be easy right?  What could be easier than FileZilla FTP Server also known as FZ for short.  I LOVE this product and why you might be thinking?  Because it has so many cool features.  Sure you could setup an FTP server with IIS or use an open source Linux distribution but I think for Windows that FileZilla is one of the easiest and most useful I’ve found for anyone to use.  I’ve used it for years and have never had a problem but then again, I suppose it’s been the right tool for the job I needed to be done.

What’s great:

FTP or FTPS (FTP over SSL / TLS) although the secure feature seems tricky to setup for FZ server
(*If you’re setting up a “secure” FTP server you’re truly better off with ProFTPD with SSH running on a Linux Distro)
A virtual file system so you can direct people to folders anywhere on your server
Adjustable autoban features disabling IP’s from attempting too many logons which is a nice security feature
Bandwidththrottling
…just to name my favorites!

I would also like to put emphasis on my * comment, I haven’t had the need to do secure FTP transfers with FileZilla but the brief amount of time I looked at it, did some extra looking online about it, etc; it seems difficult to setup, quirky and you’d be MUCH better off using another solution.

Get it here: —> File Zilla
__________________________________________________________________________________________

Backup power of zip:

I also love file compression, it’s great especially if you have to transfer your files somewhere.  I have fond memories of trying to get more than 1.4 megabytes of data on a floppy disk by compressing 3 megabytes down to 1.4megaytes so I could maximize every bit of that floppy disk.

Most compression utilities have a command line feature, here are a few I’ve used:

• 7-Zip (Open Source)
• WinZip (Commercial)
• WinRar (Personal Favorite & Commercial)
• * CabPack (Free)

CabPack is special to me because I’ve used it to make 16 bit cab files for use with a 98 DOS boot disk to make a Windows XP Unattended installation disks.  With nice Open Source Imaging technologies and the fact that Windows now has nice built in utilities for imaging I don’t see much use for CabPack to make Cab files for DOS boot disks BUT again; it’s special to me and worthy of mention.

Compression utilities are especially helpful with compressing databases.  This example will deal with Peach Tree because I know LOTS of SMB’s that use Peach Tree or other similar SMB products like ACT, QuickBooks, etc.  Because some accessed files can become locked and won’t let you copy them while in a locked state you’ll have to shut off the service accessing those files.  As a result of the afore mentioned products typically being used during business hours (8am – 5pm) you can use Windows to schedule a batch file task doing these things…

Tasks:

• Shut off any services Peach Tree might be using
• Zip and compress applicable directories / companies
• Turn your Peach Tree services back on
• FTP your archive file on or off site for safe keeping

Shut off services:  net stop “my service”:

Find your service in Windows Services and create a batch file with these commands

_________________________________________________________________
net stop “Peachtree SmartPosting 2009”

net stop “Pervasive PSQL Workgroup Engine”
_________________________________________________________________

If you’ve got ACT:

_________________________________________________________________
net stop “SQL Server (ACT7)”
_________________________________________________________________

…there might be others, experiment and find out!

Zip and compress:

For command options open a command prompt and type rar /?

_________________________________________________________________
cd \

cd “c:\program files\winrar” or if you’r on 64 bit “c:\program files (x86)\winrar”

rar a -inul -m5 -r “c:\filenameyouwant.rar” “your data”
_________________________________________________________________

* Your data can be “c:\somedirectory” or a UNC path “\\yourserver\yourshare”

Restart Services:

_________________________________________________________________
net start “Peachtree SmartPosting 2009”

net start “Pervasive PSQL Workgroup Engine”

_________________________________________________________________
FTP somewhere:

This can be a bit of a challenge to figure out what command to use.  You can use in Microsoft’s built in FTP to do the job.  Here’s a link to their Knowledge Base (KB) —> Link.

You basically make yourself two batch files, instead of .bat that you might be used to this file has a .scr extension.

Bat file one = FTP Command pointed at your script with actions:  ftp -s:c:\yourscriptfile.scr yourservertarget

Bat file two = Your ftp actions

usernamegoeshere
passwordgoeshere
put c:\path\filestoupload
quit

If you’re using sftp (Secure FTP) you can download a nice sftp (psftp.exe) executable from the Putty website here:  —> Link.

It’s similar in function but slightly different if you want to automate it.

You basically make yourself two batch files again.

Bat file one = FTP Command pointed at your script but it’s a lot longer for automatically logging in:

psftp yourserver -l username -pw “your password” -b yourscriptfile.scr

Bat file two = Your FTP actions

put c:\path\filestoupload

bye
__________________________________________________________________________________________

NOTE:  With psftp I think you have to have the spaces, so hit enter twice in your script file between each command, Windows is less discriminatory.
__________________________________________________________________________________________

Some final comments:

This is pretty obvious but you’ll have to protect your scripts since your user names and passwords are stored in plain text.

You should use non administrative usernames for doing your processes, only assign authority for that account to do the few actions you need it to do.

There are other backup methods like NTBackup which is built into Windows and since Windows Server 2003 it’ll even do open files like Enterprise Level backup software.  You could then FTP that file somewhere.

If you’re on a LAN you can easily just copy the files via a UNC path \\yourserver\yourshare either way works, with File Zilla you can use bandwidth throttling if your network is busy or feels the effect of the bandwidth usage.  Most modern networks are OK with large file transfers.

With respect to end user remote support some organizations struggle.  Perhaps they have a limited budget so a paid for product like CA’s Remote Control (Those Canadians are real original aren’t they?) is out of their budget structure or perhaps it’s a more feature rich product than they’re looking for?  Maybe they’re using Microsoft’s built in Remote Desktop with Remote Assistance but perhaps all their workstations aren’t Windows computers?  Security is certainly a concern also, with an Enterprise level product like CA’s things are usually tighter, that is if the person managing that product tightens it.  Feature rich products are usually flexible so you can be as loose or as tight with respect to security as you’d like it to be.  VNC is not necessarily an Enterprise product but it’s something I’d like to discuss.  VNC for example keeps the password in the registry which isn’t the best option for Enterprise level organizations but for SMB’s it might fit the bill.  If an Enterprise wanted to use VNC, they’d have to properly secure their registry on end user pc’s, laptops or Terminal Servers so an end user couldn’t access VNC registry keys (which should usually be done as a base line security principle anyway).  It would keep honest users – honest.  Unlike some products both enterprise paid for products and cheap or free VNC is platform independent, it can go on virtually any operating system.

FastPUSH is a utility / script I’ve used in the past.  You can leverage it to whatever degree you’d like.  With it you can push various VNC versions (or derivatives) out to all your machines or pinpoint just a few with precision for your personal use.

When I worked for an organization that leveraged CA’s product I had to revert to using FastPUSH because the CA product was broken and since I didn’t manage that product it was quite some time before the issue was resolved.  That’s not to say if I manged it I would have fixed it any sooner, who knows?  To provide a high level of support I used FastPUSH to push out VNC 4, then remotely control the end user’s PC just like CA’s product.  The end users didn’t notice a difference.  When I was done, I’d uninstall it, delete any registry keys if there were any and I was done.  One thing to note, some antivirus programs see what FastPUSH does with VNC as malicious so if you get errors check your antivirus activity then make exceptions as necessary.

A common feature of VNC software is the Java plugin, it’s usually built into a VNC installation so you can open a web browser to connect to your client instead of the actual client executable.  Watch out for any host based firewalls because they’ll probably block the port if turned on BUT FastPUSH ususally opens those ports up with a netsh command to the firewall, it’s all in the script.  You’ll definitely need to open the batch file in the root directory and make edits as appropriate.  Once you tweak it to your environment and you test it you’ll be thanking yourself because you’ll be able to deploy it in seconds and get the job done.  Back to the browser connection method – you’d open a web browser to http://hostnameORipaddress:5800 which would then trigger the Java client, if you don’t have Java installed it’ll ask you if you want to install it.  It’s quite nice!

Another cool VNC product is brought to us by UltaVNC.  They have some cool addons.  One in particular that I like is “SingleClick” it’s also called “Ultra VNC SC”.

They describe it as this:  “UltraVNC SC (SingleClick) is a customizable mini UltraVNC server for download. This is very convenient for help desk support because the customer doesn’t need any preinstalled remote control software. Just have him or her download UltraVNC SC and start remote controlling. At the end of the remote control session UltraVNC SC deinstalls itself and leaves the computer without additional software.”

How great is that?  You make it available on your Intranet (or you can also use another addon for WAN deployments with servers that can repeat the connection through a NATTED environment), the person requesting support downloads the executable and within seconds they’re getting help.  When the tasks are done it deinstalls and it’s gone!  You can also customize the icon to better integrate into your organization rebranding it with your organizations color scheme or logo.

You can easily see how both FastPUSH and UltraVNC can be great utilities and best of all, they’re open source and free!  Free certainly does wonders on a tight budget.

* Addendum – I was pushing this out to a workstation with fastpush the other day and it DOES encrypt the password, not sure how it’s doing that but it does use some method of protection to guard against end users finding out what your password is.  Now – it still might be easily decrypted but it’s better than I thought!  :)