In my opinion Microsoft Security Essentials does a decent job for the price :p – they don’t just do spyware anymore, they also do malware and  antivirus!  For a smaller company (or even a larger one for that matter) looking to save money they can try using it rather than a more “corporate” package from the big vendors (Norton, McAfee, AVG, Panda, Avast, etc, etc, etc…the list goes on).  There might be just a few small problems; MSE doesn’t really have a central administration tool (or server) but that’s not a big deal with a small amount of work you can kind of make one or centrally manage it yourself.  It also doesn’t alert and administrator if it finds something, it only alerts the end user so expect a phone call from time to time.  Those are the biggest downfalls but depending on what you’re looking for or can tolerate it might work out for you.  I’ve distributed this on about 75 workstations and I haven’t really heard a peep from anyone.

Again though; it’s free and does a decent job so if you’re willing to ‘trust’ it and you’ve got other layers of protection (like not letting end users run as power user or local admin, local firewall, corporate firewall, strong passwords, encryption, etc, etc, etc) then your comfort level should be better (mine is).

So here’s the recipe for pushing out various version of MSE and configuring it with the options you want.  In our MSE batch of goodness you need these tools:

1. A Windows Domain (Could work without this but it’s helpful to have it)
2. Group Policy Know How (moderate)
3. Batch file skills (moderate)
4. A file share
5. 7-zip to extract the exe’s from M$
6. Install MSE so you can configure it then export your configuration via the registry

Download 7-zip and install it (link above)

Download MSE

Available Versions:

• Windows XP 32-bit
• Windows Vista/Windows 7 32-bit
• Windows Vista/Windows 7 64-bit

You should be downloading a file called:  mseinstall.exe <- Same name for all version but the packages are different

With 7-zip installed you should then be able to right click mseinstall.exe and extract the contents.

What I would do here is create a share folder “mse”, of course permissions are up to you but read only is fine for everyone, you could / should also make it a hidden share or ONLY a hidden share ;).  You can append a $ sign at the end of your share name like “mse$”, this way it won’t be browsable on your network.  You’ll have to know it’s there to find it (\\servername\mse$).  Copy your extracted folder to the mse share, maybe put an “xp” folder in the mse folder and then 7×32 and 7×64 folder to keep your versions straight if you need to deal with multiple versions.

For this example I downloaded the XP 32 bit version, I extracted it, I made my mse share with the appropriate subfolder named xp.

start > run > \\myserver\mse\xp or \\myserver\mse$\xp if you used a hidden share (recommended)

Folder contents are:

en-us <-Folder
x86 <- Folder
compappsconent.dll
epplauncher.exe
eppmanifest.dll
setup.ini
setupres.dll

* I just noticed this but in the setup.ini if you’re upgrading versions it looks like you can mark “ShowUpgradeEULA=true” to =false so you don’t have to agree to the EULA again ;)

So what we’ve done so far is gather our ingredients, the tools and files we need to make our batch of goodness :)  We’ve downloaded and installed 7-zip, we’ve downloaded our versions of MSE and we’ve created our share then extracted the files to their respective folders.   Now it’s time to create out batch file that will:

1. Detect the OS
2. Detect the OS Architecture (32 or 64 bit)
3. Call the appropriate installer

In the \\servername\mse folder on your network create a batch file, I called mine push_mse.bat.  Then right click and ‘edit’ the file, it should open notepad.  For you sophisticated types you might like using notepad++, a favorite editing tool of mine because it highlights things in colors and has advanced search / replace filters.

In our batch file start by typing in or copy and pasting in this text with edits to match your environment:

****

@echo off

:: This is a comment – this will install MSE

echo Finding your Windows Version
:: Error = 0 for true
:: Error = 1 for false

:: This version number = Windows XP
ver | findstr/C:”Version 5.1.2600″
if %errorlevel% EQU 0 goto XP

:: This version number = Windows 7
ver | findstr/C:”Version 6.1.7601″
if %errorlevel% EQU 0 goto arch

:XP
:: Checking to see if the MSE folder exists, if it doesn’t then it’s not installed
if  exist “%ProgramFiles%\Microsoft Security Client” goto end
\\servername\mse\xp\x86\setup.exe /s /runwgacheck /o
reg import \\servername\mse\windows_security_essentials_default_settings.reg
goto end

:arch
:: Detecting 32 bit or 64 bit
wmic OS get OSArchitecture | findstr /C:”32-bit”
IF %ERRORLEVEL% EQU 0 goto 7-32
IF %ERRORLEVEL% GTR 0 goto 7_64

:7-32
:: Checking to see if the MSE folder exists, if it doesn’t then it’s not installed
if exist “%ProgramFiles%\Microsoft Security Client” goto end
\\servername\mse\7×32\x86\setup.exe /s /runwgacheck /o
reg import \\servername\mse\windows_security_essentials_default_settings.reg
goto end

:7-64
:: Checking to see if the MSE folder exists, if it doesn’t then it’s not installed
if  exist “%ProgramFiles%\Microsoft Security Client” goto end
\\servername\mse\7×64\amd64\setup.exe /s /runwgacheck /o
reg import \\servername\mse\windows_security_essentials_default_settings.reg
goto end

:end

****

I think that’s about right, the above is untested really, it’s similar to what I’m using but mine is much messier :p.  What you can do to see your errors is comment out the “@echo off” section and it’ll print every line on the screen, then end your script with a pause or put a bunch of pause statements in the script, I often do that to “step through” a program and when I’m done I get rid of all the pausing.  You can also “echo %errorlevel%” to see the output / result.

The ‘cherry on top’ are the settings.  You’ll notice above I’ve got a registry import for the settings.  To get these you’ll need to install MSE, configure it in the settings then export your settings from the registry to a reg file.  The settings seem to be the same from 32 bit to 64 bit and they have the same registry entry options.

start (or Windows Button how lame!) > regedit > OK or enter if you’re on Vista or 7.  This will open the registry editing tool, navigate down to:  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware

I have only exported things like my Exclusions list / paths, the scan settings like allowing pause located under “Scan” and not joining of SpyNet under “SpyNet”.  Here’s a sample of my registry:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths]
“%programfiles%\\someprogramfilderhere”=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Scan]
“AllowPause”=dword:00000001
“DisableCatchupQuickScan”=dword:00000001
“DisableCatchupFullScan”=dword:00000001
“CheckForSignaturesBeforeRunningScan”=dword:00000001
“QuickScanInterval”=dword:00000000
“ScheduleDay”=dword:00000000
“AvgCPULoadFactor”=dword:0000000a
“ScheduleTime”=dword:0000021c
“DisableRemovableDriveScanning”=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\SpyNet]
“SpyNetReporting”=dword:00000000

* Recent update / addition here; a fee command line options I’ve used to do scans remotely with a tool like psexec:

psexec -u domain\username \\computername
It’ll prompt you for your password (must have admin privilages)
Then cd to your directory “cd c:\program files\Microsoft Security Client\Antimalware”
mpcmdrun -SignatureUpdate
* That command above updates the MSSE detection database
mpcmdrun -Scan -ScanType 2
* That command above will run a full system scan, 0 = default, 1 = quick scan, 2 = full system scan and 3 = a single file custom scan but you’ll need to point it at your file with “-File “c:\somehwere\somefile.extension”

You could probably export the entire “Microsoft Antimalware” hive and call it good too ;).  You’ll notice things like “ScheduleTime” – it’s a bit cryptic so if you want to adjust all the scanning times (mine is at noon I think) you can make the change on your local machine, check that key for the change then update your registry file.  Now what you want to do (and I’m not going to go into the how) is make a system startup group policy and point your new batch file in the system startup for PC’s in your organization.  You can do it many ways.  Something I’ve done in the past is have one system batch file that runs at startup and I tweak it for installs or settings like this.  Then you don’t have to create more group policies and have a plethora of batch files out there.  You just edit the one file and you’re good to go; that us…unless you need specialized settings for various departments or people.

Lastly, when the installation ‘kicks off’ there’s a bit of a pause or lul, it might take a few minutes to “do something” and for you to notice the Security Essentials little blue home logo in the system tray, the icon will probably be orange but it will shortly turn to blue after it updates which our command above on the install tells it to do ;).

There’s also a process I have to do an “update server” so all your clients don’t go out to the net for updates but rather they get updates from your local share.  I’m not going to post it here unless someone wants that process too.

All in all it’s been smooth and I’ve had no complaints.  It’s also saved the company a few thousand dollars in licensing fees to one of the big AV companies.

* Update *

I saw someone in my logs (yes you’re not anonymous Verizon Enterprise Center :P!) looking for pushing just the “updates” to clients.  In order to do that you can’t really “push” the update but rather push a pull :).  What I mean is you can (depending on the operating system) schedule an “at” job:  http://support.microsoft.com/kb/313565 <– For more information and here http://rafaelwolf.com/?p=300 <– For more information.  What you do is make one batch file on a network share (which has your code telling each client where and how to update – via the command line, I mention it on another post with mpcmdrun.exe:  http://rafaelwolf.com/?p=725), then schedule each PC via that scheduled task (at job) to update whenever you want, however often, etc bye editing your batch file with the commands in it.  You make one bat file with commands and paths for the update, use at or schtasks to schedule each pc to run the shared batch file at x time.  You could also “push” the “pull” too all the PC’s you wanted with a for loop.  Scheduling your task on any number of PC’s would be a snap.  I have examples on my blog for that as well.

Note that M$ is moving away from “at” but it still works, they’re favoring it over the “schtasks” command:  http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/schtasks.mspx <– Have fun!

* Oh and MAYBE just maybe they could have posted the questions and I would have thrown them the bone ;)

I was getting a few odd rsync backup issues that I banged my head against for a good…mmmmmm, 4 hours maybe.  It was perplexing only because the errors (to me) were cryptic.  I’m posting this because I didn’t seem to find any clear resolution on other sites.  I also can’t stand when someone posts an error only to later post an “Oh I figured it out” or “Oh I fixed it” WITHOUT leaving any clue as to HOW they fixed it.

First – lets download a cool chmod utility that shows you in a meaningful visual way how chmod works and what it all means:  Classical Web Designs

* That tool was quite helpful in figuring out what chmod number I had by comparing the ‘chmod string’ it also outputs.

Here goes:

RSYNC error:  rsync: change_dir#1 failed: Permission denied (13)

* This usually means the directory on your server has the wrong permissions.  Note that on FreeNAS the default permissions seem to be 755 or rwxr-xr-x.  To fix simply run this command ‘chmod 755 whateverfolder’.  You can also run ‘chmod -R 755 whateverfolder’ keep in mind though that I wouldn’t just yet because this will recurs through your folder tree and if it’s only the top level folder having problems you might overwrite sub folder permissions unintentionally.

* Interpreting the error, ‘change_dir’ means that rsync can’t navigate through your remote server directory tree

RSYNC error:  rsync: cannot stat destination “/somefolder/somewhere/there”: Input/output error (5)

RSYNC error:   rsync: ERROR: cannot stat destination : Permission denied (13)

* This usually means that rsync can’t WRITE to the destination folder so for example, “/somefolder/somewhere/there”.  Again this is a permissions issue and you should check the “there” folder permissions and work your way up.  Apparently when rsync ‘stats’ your stuff it’s shorthand for writing a temp file in that directory to facilitate the transfer.  I don’t pretend to know the nuts and bolts of how it woks but notice this to diagnose the issue.

“destination” – this isn’t your source :p

cd /somefolder/somewhere/there

ls -la

If you don’t see “rwxr-xr-x” or “youruser:guest” or depending on your system you might see “root:root” you should visit our old buddy chmod again and simply do a:  chmod 755 there or chmod 755 /somefolder/somewhere/there.  FYI on FreeNAS it’s ‘youruser:guest’, I also recently realized you could do a “chown -r youruser:guest /somefolder/somewhere/there” and that fixes permissions allowing the ownership to go from root:root to the afore mentioned.  I think this is preferred to chmod’ing.  Also note that you probably want to make a group and put that user into so it’s “customusername:customgroupname”.  IF by chance you have users who access the server via ssh, sftp, etc then they won’t be able to navigate to other user folders.  I also recently found an interesting article that the author of the article posted on LinkedIn here:  firewall.cx.  The author does a MARVELOUS job in explaining it.  As a result, you might want to setup your groups for your particular users, then do a recursive chown through the directory structure, you will want to then follow that up with a chmod 770.  If you do that then another user who tries navigating will get “access denied”…as they should ;)

RSYNC error:  rsync: recv_generator: failed to stat “somefolder/somewhere/there”: Input/output error (5)

* This usually means that rsync can’t write to the directory in your SOURCE folder.  For example if you use cygwin on a Windows machine and you’re backing up c:\temp ” cygwin ‘/cygdrive/c/temp'” then go into that directory in cygwin and check your permissions.

cd /cygdrive/c/temp

ls -la

you might see an owner of ????????? or something that doesn’t look right.  In my case the user I was using to run rsync and backup directories didn’t own the directory and couldn’t write files to the root of that directory (I think rsync calls it a ‘manifest’ (list of files to xfer)).  So I then looked at the permissions on the Windows side of life and retried the xfer.

What it looked like:

drwx——+ 1 administrator  Domain Users 0 Jun  3  2010 Folder1
d———+ 1 ????????       Domain Users 0 May 12 23:11 Folder2

Success!

Moral of the story it would seem with RSYNC is that permissions are everything and if you get some type of error it’s usually because rsync can’t hook onto a file or directory with the user you’re running it as.  Let me know if this helped you because I spent 4 hours of my life to save you 3 hours and 45 minutes of yours :p

** Update **

I ran into an entirely NEW issue, not sure when this started but when I was reviewing log files on the source server I saw errors:

failed: Permission denied (13)

rsync: recv_generator: failed to stat

My previous methods for troubleshooting this issue didn’t work so…

The FreeNAS forum had a solution for me thanks to poster “danmero”:  http://sourceforge.net/apps/phpbb/freenas/viewtopic.php?f=51&t=365

You might need to add the option:  “-p –chmod=u=rwx,g=rwx,o=rwx”

This sets permissions on the destination directory and solved my “access denied” issue this round!  :)

Years ago (maybe 7 or better) I found a cool utility with a small footprint for testing bandwidth.  You could expose this to the WAN if you wanted to and let others test their bandwidth against yours which is what Rutgers seems to be doing but don’t abuse them or you’ll be whacked! :P

I also downloaded iperf from their website and at the time of posting this supposedly you could get it from iperf’s homepage but it doesn’t seem to be working for me.  You might also have luck at Sourceforge.

* Update:  It seems that iperfs homepage is dead, the Rutgers team no longer has the Windows IPerf download on their server and Sourceforge only has the source and no Windows Binary.  FORTUNATELY FOR YOU I still have the Windows Binary of IPerf I downloaded when the link did work from Rutgers, it’s the older 1.7 version BUT it still works and might help you out.

Download it here:  Link to iperf-1.7.0-win32.exe

If anyone else has a link to the 2.x Windows binary feel free to share, I don’t feel compelled to compile it myself but maybe I’ll get around to it, we’ll see :p

To use it you need to make sure that port 5001 is open (unless you specify another port), you can adjust that with the port command to use a different port.  By the way, this is all for Windows users.  I haven’t used it on Linux but maybe the commands port over 1 for 1?

Basic commands for iperf:

Get command line help with iperf:  iperf –help

Makes an iperf ‘server’ clients will connect to:  iperf -s

You’ll see this output:

Server listening on TCP port 5001
TCP window size: 8.00 KByte (default)

* Also note the default listen port is 5001 with this command

Makes an iperf server listen on port 80:  iperf -s -p 80

To end the program use control C like you typically would in windows to break a batch file or command line action.

There are many more options for iperf that I haven’t used like making it a daemon (service) with the -D option, changing how it reports transfer bandwidth in Mb, KB or MB’s, you can create an output interval, etc.  It’s a nice tool to use!

On the other PC (the client) you simply type this command to connect:

iperf -c yourserver

* You can type in an IP, a host name or ‘localhost’ like I did for my test.

My output for localhost was:

[1900] local 127.0.0.1 port 5001 connected with 127.0.0.1 port 4194
[ ID] Interval       Transfer     Bandwidth
[1900]  0.0-10.0 sec  2.39 GBytes  2.05 Gbits/sec

Adobe X MSI installer file

I see Adobe released a new version of Reader, Adobe X which confused me because I was expecting a 10 there.  I don’t use a MAC often so I’m not used to seeing Roman numerals representing numbers.  Anyway…so you want to install the latest bloatware offering of Adobe Reader 10 eh?  Here’s how!

Download Adobe X from Adobe’s website and let the automatic installer help you because you’re clearly incapbable of installing a program yourself.  I didn’t want to take the time and figure out how to get the download without the excellent help of Adobe.  By the way, one annoying point is the download manager plugin for Firefox, they want you to restart your browser like all Firefox plugings – that’s just annoying Adobe come on!!!

* Let me know where the Windows 7 Directory is, it must be different seeing they use a c:\users folder

Once Adobe so graciously helped you by installing their application migrate here:

%ALLUSERSPROFILE%\Application Data\NOS\Adobe_Downloads or to the layman C:\Documents and Settings\All Users\Application Data\NOS\Adobe_Downloads

Update: It looks like in my install of Adobe Reader 10.1 they put the installer files here:

C:\Documents and Settings\All Users\Application Data\Adobe\Setup\{insert an app SID here}
%ALLUSERSPROFILE%\All Users\Application Data\Adobe\Setup\{insert an app SID here}

Copy the contents to a temp directory and use 7-zip to extract it / unpack it or whatever you’ve got that will extract the AdbeRdr1000_en_US.exe file.  I also tried this historical command but it didn’t work out quite like I expected.

AdbeRdr1000_en_US.exe -nos_ne -nos_o “Reader” <– It prompts you for a location to extract instead of just doing it.

* The above doesn’t really seem to work well, download 7-zip and extract the exe with that :p

Download the Adobe x customization wizard:  Link here <– Updated because the link in the forum below doesn’t work anymore!

* Reference for download here:  Adobe X Customization Wizard

* Reference II:  Adobe X Blog

* Lastly, you can find all kinds of interesting Adobe downloads here:  ftp://ftp.adobe.com/pub/adobe

Open the customization wizard, point it at your AcroRead.msi (file > open > AcroRead.msi) and modify to suite.

When done click “Transform” > “Generate Transform” > Save the file as “AcroRead.mst”

File exit – do not save changes to your MSI, I’ve personally had bad luck with that method :P

Here’s a link to my AcroRead.mst file, no license confirmation, no bells and whistles, and securely locked down.

To install use a group policy pointing at your MSI and your .mst transform or use a batch file command like:  msiexec /i AcroRead.msi TRANSFORMS=AcroRead.mst /quiet

Let us know how it works out for you :)

* Oh one more note:

Should you find yourself with the McAfee crapware on your PC you can uninstall it with this command:  C:\Program Files\McAfee Security Scan>uninstall /S /NCRC

* Helping reference for the NullSoft command was –> Here

In the past I’ve created batch files to do some scripted redundant scheduled task for me, usually it’s related to backing up folders or files but I have a colleague who set one up when his server reboots or specific users log on to their systems on his terminal server.  When the script is done I usually have it call and execute an email VB script letting me know the task was completed with a specific message telling me what happened.

I ran into a bit of a problem recently with  Server 2008!

In the past I’ve used these well written, simple and useful scripts from Paul Sadowski but they failed to work on Server 2008.  Here’s the link to Paul’s site, all his stuff works GREAT on Server 2003 or Windows XP and I continue using them on those systems.  –> Link.  By the way, my scripting ability is limited so I have to once again thank people like Paul and James (who’s script I ended up using) for posting their scripts online for us to use!

If I tried executing his scripts on Server 2008 I’d get weird errors like these:

• “The server rejected the sender address. The server response was 530 5.5.1:
• “Send Error: The server rejected the sender address. The server response was: 550 Access denied – Invalid HELO name (See RFC2821 4.1.1.1)”
• “550 Access denied – Invalid HELO name”
• “CDO.Message.1 error ‘80040213’ The transport failed to connect to the server”

* Also keep in mind that all these errors were not specifically from Paul’s scripts that he so kindly shared, most of them were due to me trying to edit and tweak his existing script in an attempt to eliminate the errors which I did a poor job of doing :)

I decided to start over and I stumbled upon James Koopman’s script:  http://www.jameskoopmann.com/?p=20

Thanks James for your excellent script!  You can download his script from the site above or download the script I edited and used (sensitive security information gone of course!) here –> Server 2008 compatible Email VBscript

For your information my script does NOT use a local email server, most of my problems were because I wanted to use an external email server.  The above errors are due to not having a username type in correctly, the wrong password, trying to use ssl or NTLM when you should use the “1” option for clear text.  A security wonk might balk at the idea of a clear text email authentication BUT I’d also like to remind the wonk that the script sitting on the physical server isn’t encrypted either although it’s in a safe place :).  This solution “works”, it’s not the best but it’s not the worst.

Good luck out there!

To all my brothers and sisters out in Internet land!  I had an unusual time finding this download, I finally found it on some obscure Micro$oft website but have since lost the actual link.  I tried to find the link for a colleague and I gave up shortly thereafter realizing I already had the file and that I could just send it to him.  If you’re looking for the RoboCopy Gui (which also includes robocopy.exe) get it here!

–> RoboCopy Gui

Robocopy is a great utility, it’s a bit more robust than xcopy, it has some great options like backup mode which from what I gather uses the system account to leverage shadow copy for backing up files with different permissions than the user you’re running your script with.  It’s good stuff all around.

Here’s an example robocopy script I happen to use, it backups up end user files once a week.  I run it 4 times per month and store the data in 4 different locations, week1, week2, etc, etc.  It backs user data up, then my next line says to move the log to a different location and finally it calls my email notifier letting me know the job was complete.

• robocopy “\\myserver\users” “E:\myusers_Users_Backup\Week1″ /E /SEC /COPYALL /V /XO /LOG:”Week1_backup.log” /FFT /Z /B /ZB /R:10 /W:30
• move /Y “C:\Documents and Settings\Administrator.MYDOMAIN\Application Data\Microsoft Robocopy GUI\Scripts\Week_1_backup.log” “E:\Users_Backup”
• call “\\myserver\myshare\somesubfolder1\User Documents\Week_1_Email_Notification.vbs”

Get it while it’s HOT!  For years ClamAV has probably been protecting you to some degree without you even knowing it.  It has historically been used for appliances like email servers, web servers, file servers, etc and usually only on a Linux OS.  Why?  Because that’s where it all started :).

At one point they had a Windows version of ClamAV called ClamWin but it must have been a few years ago it vanished (or at least seemingly vanished) because they decided to develop it further.  I have been keeping my eye open and occasionally checking for a Windows version and it’s now finally out! Updated 12-27-2010:  ClamWin is what I’d recommend getting here –>  Link

If it’s good enough to scan your email it’s good enough to protect the desktop.  I suppose there are several schools of thought on this.  One saying you’ll want one AV scanner to scan inbound files on the server, a different one on the firewall (if it has that feature) and yet another on the desktop.  Sure – but for home losers like us anything that’s both good and free works for me!

The good thing about ClamAV for windows:

• Real-Time Scanning (with additional plugin)
• Simple feature set
• Folder exclusion
• Open Source

The bad thing about ClamAV:

• Doesn’t seem to do a “full system scan” from the gui, I have a batch file to help you though (for WindowsXP, ClamAV version 1.0.26, feel free to edit for your OS’s directory path –> Here)  Update:  I’ve left that old link for historical purposes, I recommend download this version instead as it’s MUCH BETTER –> Link
• Currently have to be “online” for it to scan (they plan on offline in the future)
• Note that the version I had pointed to was one from Clamav.net NOT the one from ClamWin.  ClamWin is where it’s at!  :)