PhoneFactor is free for up to 25 users and reasonably priced after that. The beauty of PhoneFactor is that it utilizes something users already have – a mobile phone – as a token rather than a proprietary device.

PhoneFactor Agent, the software behind the service, acts as a RADIUS server for authentication to network resources such as a VPN. When a user attempts authentication, he will still first be prompted for a user name and password. After he enters those details, the service will place a call to his phone and require the user to answer the call and press the “#” button. Once this is completed, the user is successfully authenticated.

In this tutorial we will install the Agent on Windows Server 2008 R2, integrate with Active Directory, link a few user accounts, and set up a RADIUS server.

Getting started

You can download the PhoneFactor Agent after registering here. You will need a mobile phone to register since PhoneFactor utilizes their own system on their customer portal. Run the installer and launch the PhoneFactor Agent. You will be greeted by the Authentication Configuration Wizard, where you can:

• Enable replication between agents: Allows you to replicate data between multiple installations. Since we are only installing it on one server, do not check.
• Select Applications: You can apply PhoneFactor to a variety of applications, including Citrix, Outlook Web Access, and Remote Desktop. For our purposes, we will only choose VPN.
• VPN with Radius: Specify your VPN server IP address as well as a strong shared secret between the VPN server and PhoneFactor. Leave the default port options as-is.
• VPN Target: Since we want to authenticate against a Windows domain, we will choose Windows domain. However you can also use another RADIUS server (some firewalls have built-in RADIUS servers, so you can redirect back to the firewall).

Phonefactor Agent Configuration

Click Finish and let PhoneFactor do its magic. Once the setup is complete, you can begin using the Agent.

Locking down PhoneFactor

By default, PhoneFactor will allow any user who successfully authenticates against AD to sign in – if no user is defined (and no phone number is linked), it will just authenticate the user. In most cases, you would not want this to happen. Navigate to Company Setup and choose “Fail Authentication” when user is disabled.

Fail authentication

We will also want to specify a default search domain for AD users. Choose the “Username Resolution” tab and specify a default search domain for the option “Use Windows security identifiers (SIDs) for matching usernames.”

Security identifiers (SIDs)

Finally, if your Active Directory user account setup is non-standard, you should navigate to Directory Integration and confirm in the “Filters” and “Attributes” tabs that the data fields you wish to use are the ones that PhoneFactor will use. Most administrators will not need to do this.

Directory Integration

Adding users

Now we can begin adding users to our PhoneFactor implementation. Because of our previous setup, only users who have been added to PhoneFactor with a phone number defined will be able to authenticate successfully against AD. After all, not all users will require remote access. Navigate to the Users section and click “Import from Active Directory.”

This powerful interface allows you to select users by OU or filter terms. You can import all users at once – which is not advisable – or specify which ones to import in a granular fashion. The users you have selected will appear in the window on the right. You will notice that by default, “Only New Users with Phone Numbers” are enabled. This is the behavior you want, since users without a phone number will authenticate using only their AD credentials. Once you are ready, click “Import.”

Import users

In many cases, you will not have defined phone numbers yet for your users in Active Directory. This is OK; you will just need to do so now for each authorized user. Double-click the user, then define a phone number and enable the user.

Phone number – Enable user

Finally, you will see your newly-enabled user in the users listing. Once you have defined all of your users, you will need to configure your VPN server to authenticate using RADIUS.

User listing

VPN Server Configuration with PhoneFactor RADIUS

Since there are so many VPN servers out there, we will focus on a few general tips for setting this up. You will typically need to provide:

• PhoneFactor Agent IP
• PhoneFactor Agent Ports: Typically, 1645,1812 for authentication and 1646,1813 for accounting. Make sure the firewall on your Agent server does not block this traffic
• Shared Secret: This is the secret you had defined in the wizard and it should be strong since it will serve as a barrier between your VPN server and the RADIUS server.
• Timeout: Make sure you set a fairly high timeout value; by default, most VPN servers do not give you a lot of time to authenticate because the RADIUS server is local to the network and does not take long to perform the lookup. However, since PhoneFactor takes about 3-5 seconds to place the call, and the user can take anywhere from 2-20 seconds to actually respond, I would recommend a timeout of at least 30 seconds.

That’s it! Though PhoneFactor offers more powerful features (especially in paid versions), you are already set up and ready to authenticate. For small businesses with fewer than 25 users, PhoneFactor is a free and easy to implement two-factor authentication solution. Give it a try today!

PhoneFactor

• How to disable USB drive use in an Active Directory domain (0)
• Service Account best practices – Part 2: Least Privilege implementation (0)
• Four fast ways to improve security in SQL Server 2008 R2 (12)
• Managed Service Accounts in Windows Server 2008 R2 (7)
• Raffle: SetACL Studio – Set Windows permissions (1)

Nmap is a tool that needs no introduction. Quite arguably it should be in the hands, or at least the back pocket, of most systems administrators. Nmap can perform network host and service discovery, security scans, OS fingerprinting, and a whole lot more. Zenmap, a highly functional GUI for nmap, helps ease the learning curve by providing a user-friendly interface for both building scans and viewing scan results or reports. Plus, Zenmap is a multi-platform application that runs on Windows as well as Linux and Mac.

The Windows Zenmap GUI

How it works

You can think of Zenmap as a “syntax builder” for nmap. Rather than sitting on top of nmap, it simply sends commands to the platform-specific nmap executable and pipes the output back. This is very useful for nmap beginners who would like to harness the power of nmap while learning some of the deep syntax options it provides.

Zenmap makes it easy to build out command line options like this

The basic operation in nmap is network scanning and Zenmap allows you to perform and save scans as well as the results from those scans. Zenmap uses Profiles, which are basically nmap parameter presets, to specify how scans are performed. It ships with some handy preset profiles, such as Intense scan, which scans hosts with “all advanced/aggressive options,” Quick scan, which scans hosts without those advanced options, and Slow comprehensive scan, which is exactly as it sounds. Budding administrators can choose profiles that match their needs. For example, if your goal is host discovery, Quick scan might do the job. If your goal is to map out every single TCP port, you’ll need to do an Intense scan, all TCP ports at a minimum.

Defining a target

Every scan must be associated to a specific target, which can be a single host, an interval range of hosts, or a full subnet. Nmap uses the following syntax for target definitions:

• Single host: Just a hostname or IP address will do, like localhost or 127.0.0.1
• Interval: Intervals are denoted by a dash in the IP address; for example, if you want to scan 192.168.1.0/24 through 192.168.10.0/24, you would use 192.168.1-10.0-255
• CIDR Notation: Nmap accepts CIDR target specification, like 192.168.5.0/24
• Lists: Separate different targets with a comma; for instance, 10.1.1.0/24, 192.168.1.0/24

Reporting window

Zenmap provides different tabs for reporting on scan results. These tabs either directly report the output of nmap or expand on the output with diagrams and user-friendly reports. The tabs include:

• Nmap output: The piped output of the nmap command sent by Zenmap
• Ports/Hosts: If a host is selected on the left, this will display open and unknown ports. If a service is selected on the left, this will display all hosts for that service
• Topology: A neat diagram of the network topology as understood by Nmap
• Host Details: Displays a condensed report of pertinent host information from the scan

A sample Nmap output window from an Intense scan

Useful tools

Zenmap also ships with some useful tools that can help you track changes between scans and drill down to useful information within long scan results. The Compare Results tool provides an interface for differentiating between two scans, which can be used to monitor daily changes in network topology or available hosts. The Search Scan Results tool is great for finding specific text in results, and the Filter Hosts tool does exactly what you would imagine – it filters hosts, which comes in handy when scanning large subnets or lists of networks.

Saving scans

By going to File > Save Scan, you can save a scan result report in XML or plain text format for later consumption. This comes in handy when you perform a large scan and do not want to repeat the scan again later while reviewing results. The XML format is also very friendly for consumption by third party report generation packages as well as web service reporting.

A sample XML report generated by Zenmap

Custom profiles

Perhaps the best feature of Zenmap is its Profile Editor, which empowers users who are unfamiliar with nmap syntax to build powerful and custom scanning profiles. These profiles can be saved for later use and even exported to other interested admins. The Profile Editor window contains the following tabs:

• Profile: The name and description of your profile
• Scan: The most important tab, where you can specify targets, scan type (TCP, UDP, IP), timing template, and much more
• Ping: Specifies ping behavior. You can suppress pings or build a specific ICMP packet
• Scripting: Include nmap scripts in your scan. Zenmap comes with many useful scripts
• Target: Allows for greater target specification flexibility, including excluded hosts, target list files, and fast scan support
• Source: Specify how you would like the scanner to behave with respect to scanning identity, IP address, port, and interface
• Other: Includes options for verbosity level, TTL, and other scanner behaviors
• Timing: Defines timing profile with respect to maximum scan time, scan delay, and timeouts, among other things

Use the Profile Editor to develop custom profiles that meet your enterprise needs

Saving profiles saves time because it allows the administrator to quickly perform familiar and repetitive scans without specifying the target and options. Using saved profiles also ensures that when comparing two scan results you are working from the same scan options.

Wrapping up

Zenmap is an excellent Windows GUI for nmap and takes the edge off of the learning curve. Administrators who are versed in basic networking will have little trouble jumping into the simple, yet powerful interface that Zenmap offers. Since ZenMap is Open Source, it represents a great cost savings for the budget-strapped admin with excellent community support and regular updates. If you haven’t checked out Zenmap yet, give it a try! Achieving IT security is a moving target, and Zenmap makes it easier to reach your goal.

Zenmap

• FREE: SolarWinds Real-Time Bandwidth Monitor (0)
• Set up a 802.1x in a Active Directory domain – Part 2 (5)
• Set up an 802.1x Wi-Fi network in a Windows Active Directory domain – Part 1 (0)
• FREE: WhatsUp Gold TFTP Server (0)
• FREE: EMCO MAC Address Scanner (3)

Submitted by Igor Vinnykov

According to the Windows 7 Programs and Components info, I have 85 applications and 118 updates installed on my PC. No doubt, it’s hard to keep in mind all these installed programs even for a single PC, and I have to open the Programs and Components view every time I need to check the software installed on the PCs in my network. If you use the same approach when you need to audit installed software, let me show how you can optimize your software inventory procedures using the free Network Software Scanner utility from EMCO Software.

The Welcome screen of EMCO Network Software Scanner

EMCO Network Software Scanner Overview

As it should be evident from its name, EMCO Network Software Scanner is a network application that allows scanning network PCs to collect information about installed software. The collected information is stored in a centralized database and can be referred to anytime. Thus, you can use the application to check the list of installed software on a particular PC, detect changes in the list of installed application, export the software inventory information to a file and perform other actions. Let’s see how these features work.

The Application Requirements

In order to use the application, you should have an administrative access to the network PCs, because otherwise Windows security won’t allow you to connect to remote computers and extract software inventory information. It is worth mentioning that the application extracts inventory info directly from Windows Registry and doesn’t use WMI, so it should work in most network environments with no specific configuration of client computers required. If the application can’t connect to a remote PC or can’t extract information from it, a detailed error report is shown on the Application Log tab with useful hints how to resolve the problem, so it worth checking the log in case of problems.

Installed Software Scanning

To start a network scanning, you can click the Enumeration Wizard button on the Welcome screen. You will be prompted to select the enumeration scope by choosing from the available domains and workgroups or specifying the IP range of PCs manually. Once a scanning is started, you can start reviewing the scan results for already scanned PCs immediately, without waiting for the entire scan to complete. To see the scan results, switch to the Machine Scans tab and select the required PC in the Network Browser.

The list of installed applications on a selected PC

Installed Software Audit

For every PC, the application can display a list of installed applications and updates. Applications and updates are displayed in different views, and you can switch between them using the toolbar buttons. The default inventory view displays only general inventory information such as Application Name, Publisher and Version in the same way this info is displayed in the Programs and Components view in Windows. However, you can see more information if you choose to display additional columns in the grid. All the collected inventory information is also available when you export the data to a CSV file. Besides, you can use this information to create custom software inventory reports, if you like.

Using the described approach, you can collect software inventory information from network PCs, but what about auditing changes? That’s quite easy. You may notice that every time you perform a scan the application creates a new scan entry with a list of detected installations and updates, so you can compare two scans to see the applications and updates that were installed or uninstalled in the meantime. Any detected changes are displayed in a special view on the screen and can be exported to a file.

The detected installation changes

Conclusion

You can use EMCO Network Software Scanner as a basic software audit tool that can help you to quickly collect software inventory information from all PCs in the entire network, audit installation changes and export the collected data to files.

EMCO Network Software Scanner

• Raffle: ManageEngine Desktop Central – Part 2: Features (2)
• Raffle: Total Network Inventory 2 – Part 3: Reporting and software accounting (0)
• Raffle: Total Network Inventory 2 – Part 2: Software and hardware inventory (0)
• Raffle: Total Network Inventory 2 – Part 1: Reliable and fast inventory software (2)
• Raffle: XIA Configuration Server – Network documentation and audit software (0)

Does your organization employ a virtual machine (VM) infrastructure for server and/or desktop systems? Are you considering migrating some or all of these VMs to a cloud-based hosting infrastructure?

VM cloud pricing details

The research that is involved in this process is pretty staggering, to be sure. SolarWinds, has addressed this situation in an elegant and cost-effective (free!) manner: SolarWinds VM-to-Cloud Calculator.

This free Windows utility enables us to automatically inventory our VMware-based virtualization infrastructure and perform cost comparisons among three leading cloud hosting providers:

• Amazon Elastic Compute Cloud (EC2)
• Rackspace
• Microsoft Windows Azure

Let’s have a closer look at what this tool can do for you.

Creating a VM inventory

You can download the VM-to-Cloud Calculator tool simply by registering a new SolarWinds account.

After you’ve downloaded and installed the VM-to-Cloud Calculator (the .MSI installation package weighs in at less than 5 MB), start the app and enter your host credentials. These credentials consist of the following:

• IP address or hostname of your VM server
• Username
• Password

This screen is shown in the following screenshot.

Entering your VMware credentials

It is very important to note that the previously mentioned “VM server” must be an instance of one of the following virtualization server technologies:

• VMware vCenter Server
• VMware ESX/ESXi

Therefore, at least as of this writing in November 2011, the VM-to-Cloud Calculator is not compatible with virtualization servers such as Microsoft Hyper-V Server or Citrix XenServer.

Once you verify connectivity to your target VMware server, go ahead and let the application run the inventory for you. Sample results from a VM inventory scan are shown in the following image:

VM inventory report with cost information

NOTE: In order to show you appreciable real-world data with this tool, some of the screenshots in this piece are borrowed from SolarWinds product documentation.

The VM inventorying piece alone justifies the VM-to-Cloud Calculator’s utility, in my opinion. The report, which is exportable to various file formats including Excel, Adobe PDF, and CSV, can definitely save you quite a bit of time in undertaking manual analysis.

Performing Price Comparisons

The centerpiece of the SolarWinds VM-to-Cloud Calculator is its automatically generated cloud hosting price comparison matrix. A sample report is shown in the following image:

VM cloud pricing details

As you can see, the VM Cloud Pricing Details report gives you at-a-glance price comparisons among the Amazon EC2, Windows Azure, and Rackspace hosts on a VM-by-VM basis. And yes, you can export this report data as well.

You might be wondering how current the calculator’s pricing data is, and how it applies to a person depending upon where he or she lives in the world.

We can click the Settings tab to configure calculation/pricing metadata, such as:

• Your preferred currency units
• Disk size threshold to differentiate “true” VMs from storage instances
• The data refresh (“calculation”) period
• Data polling during application runtime

The Settings dialog is shown in the following screen image.

VM-to-Cloud Calculator Settings page

Conclusion

The SolarWinds VM-to-Cloud Calculator is a valuable tool for Windows systems administrators who currently leverage locally hosted VMware virtual machines and want to increase their availability by migrating them to a cloud service provider. I will leave you with a tip: SolarWinds offers an enterprise virtualization solution called SolarWinds Virtualization Manager; this software won the Best of VMworld 2011 Gold Award in Virtualization Management (a high honor, indeed). You can download a trial version if you’d like.

• Decaf – Amazon EC2 client for Android (0)
• Office 365 review – Part 8: SharePoint Online and conclusion (0)
• Office 365 review – Part 7: Lync Online (0)
• Office 365 review – Part 6: Exchange Online Hybrid, Archiving and IRM (2)
• Office 365 review – Part 5: Migrating to Exchange Online (0)

One of the duties of many Windows systems administrator is network management. That is, you may be called to detect, diagnose, troubleshoot and resolve network interface slowdowns.

As your network grows in complexity to include multiple line-of-business (LOB) Web applications, load-balancing configurations, and the like, interface troubleshooting and performance monitoring can easily become extremely cumbersome and complex.

Monitoring an interface with SolarWinds Real-Time Bandwidth Monitor

To assist us in this effort, SolarWinds gives us the Real-Time Bandwidth Monitor. This is a free utility that enables us to monitor network bandwidth utilization statistics for multiple interfaces in real time.

Setting up interface bandwidth monitoring

The Real-Time Bandwidth Monitor software can be installed on any modern 32- or 64-bit edition of Windows desktop and server operating systems.

However, it should be noted that because the interface polling and statistics gathering in this product relies upon Simple Network Management Protocol (SNMP), you need SNMP turned on for any device you will be monitoring, which it will be by default for your network devices.

In some cases, you will prefer to have an SNMP server in place in your domain prior to using this tool.

For instance, you can fire up Server Manager in Windows Server 2008 R2 and install the SNMP Server feature, as shown in the following figure.

Windows Server 2008 R2 – Install SNMP Server feature

Once you have SNMP Server installed, you can configure SNMP-related metadata like the community name and trap destinations by modifying the properties of the SNMP Service Windows service. This process is depicted in the following screen capture.

SNMP Service Windows service

Upon first launch of the application, you are asked to create a monitor. This task includes three pieces of information:

• The IP or hostname of a device (desktop PC, server, switch, router, wireless access point, etc.)
• The SNMP version in use on your network (1,2, or 3)
• The SNMP credentials (community name for SNMPv1 and v2; username, context, and authentication method for SNMPv3)

Configuring the device

The next step in the setup process is selecting the desired interface. If you are connected to a switch, then you will be able to monitor individual port IDs; if you are connected to a Windows server, you can choose among physical and virtual network interfaces.

Selecting an interface to monitor

We are almost finished. The final step in the configuration process is setting threshold values. The percentages that you specify for warning and critical values enable the Real-Time Bandwidth Monitor to give you feedback regarding degrees of bandwidth utilization.

Note in the following screenshot that you can also limit the chart date to a particular time interval or data points (sampling is performed at the half-second rate). Click Launch Monitor to start the monitor. Yes, you can have more than one monitor running on a host computer simultaneously.

Setting threshold values

Monitoring an interface

As you can see in the following screenshot, the monitoring screen is a resizable dialog box that is laid out in a very easy-to-understand manner. Inbound and outbound traffic on the selected interface are color-coded, as is the data line if it exceeds a threshold value.

Monitoring an interface

The line chart is active; you can analyze data points simply by hovering your mouse over them. This is shown in the following screen capture.

Analyzing a data point

You can make use of another of SolarWinds tools (this one is not free) called WAN Killer to simulate loads through monitored network interfaces.

While we are on the subject of related SolarWinds software, the Real-Time Bandwidth Monitor is a “smaller sibling” to their enterprise Orion Network Performance Monitor (NPM) software. NPM is a one-stop solution for automatically discovering and monitoring interfaces in your LAN and WAN environments. You can download a free demo from SolarWinds if you are so interested.

Conclusion

In summary, the SolarWinds Real-Time Bandwidth Monitor gives us systems/network administrators the ability to visualize network bandwidth utilizations on our interfaces. This data is extremely important not only for troubleshooting speed and access problems, but also for application performance tuning and enhancing the overall health of our network. Please feel free to leave your questions in the comments portion of this post.

Real-Time Bandwidth Monitor

• Poll: Are you currently using a monitoring solution? (11)
• FREE: Zenmap: Windows GUI for nmap (0)
• SCOM 2012 review – Part 8: Dashboards (0)
• SCOM 2012 review – Part 7: Linux and JEE monitoring (4)
• Notifications and Custom Commands in Nagwin/Nrpe (0)

Would you like to reduce your reliance on Windows roaming user profiles and the hassle that can be caused by corrupt profiles? How about having sub 20-second logon for all users? What about settings that work across all platforms and architectures, configured from one central place? Or applying just-in-time settings to applications as needed rather than all at the beginning of the user session?

Workspace Manager Express

Sounds great? All of this functionality is available for free with a tool that’s been around for a while: Workspace Manager Express from RES Software.

To install Workspace Manager Express, you need a SQL database that can be accessed by all your client machines. Workspace Manager Express supports the following database systems:

Microsoft SQL Server, 2000 or later, including express editions Microsoft SQL Azure Oracle, 9i and later IBM DB2, 8.1 and later MySQL, 5.0 and later

On each client there is a small software agent that caches a copy of all the settings. Thus, it only needs to check in with the DB server periodically for updates. This also means that settings can be applied even when a client is disconnected from the corporate network.

With Workspace Manager Express, user settings are applied across all OS platforms. For example, you can configure a folder that contains their Internet Explorer favorites that will be available on any platform on which you are running the RES agent.

The user preferences are stored in a SQL database and applied by the RES agent. This also works with all popular VDI and remote desktop solutions.

When you log on to a PC, lots of stuff is happening in the background. One of these is the processing of Group Policies. With Workspace Manager Express, not all settings are applied at the same time. That is, the agent applies them as needed; this, in turn, will give you faster logon times. For instance, if you only want an application to be able to print to a particular printer, that customization could be applied just before the application is run.

Managing printers with Workspace Manager Express

The functionality included in the express version of Workspace Manager may be all you’ll ever need. You can also review the functions that are available in the paid version; they are displayed but are unavailable unless you temporarily change the version you are using. Alternatively, you can hide the advanced features completely so that you can concentrate on just using the free functionality.

Feature of Workspace Manager’s full version

With Workspace Manager Express, you probably cannot do away with Windows user profiles altogether. However, you can replicate any setting that would normally have been applied via Group Policy. As there are literally hundreds, it would be quite easy to get lost; however, the RES help menu is very valuable here and even links you through to video tutorials on their YouTube channel.

Resources

Introduction to Workspace Management

Getting Started with RES Workspace Manager 2011 – This is for the full product but the Express version will set up the same.

Check out Virtual Engine for another free nifty tool currently in Beta that allows you to migrate GPO to WSM.

More great stuff can be found over at RESguru.

Workspace Manager Express

• Raffle: ManageEngine Desktop Central – Part 2: Features (2)
• Raffle: ManageEngine Desktop Central – Part 1: Overview (0)
• Spiceworks installation guide (1)
• FREE: nspaces – Virtual Desktop Manager (3)
• FREE: WMI Explorer – Browse WMI classes and execute any WMI query (3)

Now more than ever before in your career as a Windows systems administrator, you may find yourself partially or fully responsible for the availability of your company’s Web applications. “But I’m not a Web admin!” you might exclaim. Like it or not, the migration of applications from the desktop to the Web browser means that we systems admins must take ownership of application uptime, regardless of form factor.

Here are some thought questions for you to consider: Does your organization do business over the Web? If so, how can you verify that your e-commerce engine is functional at any particular point in time? How can you diagnose bottlenecks and latencies in your Web application from the user’s’ perspective?

Many organizations rely upon internal line-of-business (LOB) Web applications. Again, we administrators are often faced with service-level agreements (SLAs) or organizational mandates that guarantee application availability for our users.

SolarWinds offers the free tool Web Transaction Watcher that enables you to run live transaction tests against your Web applications in a completely no-code, graphical environment.

The typical workflow for running Web application transaction tests is to author and run often complicated shell scripts or programming language scripts. By contrast, Web Transaction Watcher includes an intuitive recorder with which we step through a typical Web transaction and store those steps for analysis and future reuse.

Recording a Web transaction

To download Web Transaction Watcher, simply provide SolarWinds with a contact e-mail address. Once you have the software installed (the disk footprint is tiny; the installation .MSI weighs in at under 5 MB), fire up Web Transaction Watcher; the application view defaults to the Recording tab. Next, use the tool’s integrated Web browser to navigate to your desired Web application. The Web Transaction Watcher main interface is shown in the following screen capture.

Web Transaction Watcher main interface

Let’s use the previous screen capture as our reference as we walk you through the process of recording a Web transaction. After you have the integrated browser pointed at the proper page within your Web application, press the Record button (A) and begin your desired transaction. For our purposes, a Web transaction is simply a series of steps that an end-user might take in your app; these could include:

• Adding an item to an online shopping cart
• Completing an online purchase
• Posting a message to an online forum
• Downloading a file

You’ll notice that the Time Line (C) records each step in the transaction process in much the same way the macro recorder traces your steps in Microsoft Office applications. However, what sets Web Transaction Watcher apart from its competition is that you can actually edit and delete any step in your Web transaction during recording.

The process of editing a task sequence is easy; simply right-click the appropriate transaction step and select Edit or Delete from the shortcut menu. This is shown in the following screen capture.

Editing a Web transaction step

When your Web transaction is complete, press the Stop button (B). Make sure to save your recorded transaction for future playback. Web Transaction Watcher recording files use the intuitive .recording file extension.

Analyzing and replaying Web transactions

To analyze your recorded Web transaction, navigate to the Monitoring Console tab in the main interface. Web Transaction Watcher stores the last five runs of your recorded transaction and displays the status of each with a color-coded bubble icon (shown at A in the following screen capture).

Monitoring a Web transaction

In the Steps area of this interface (B in the above screen capture) you can check the status of individual steps in the captured transaction. Again, the feedback is color-coded: errors are shown with a gray callout bubble. Clicking the status indicator bubble calls up a dialog with timing information to help you diagnose and troubleshoot latency.

Examining latency

Do you see the hyperlink that says Try the SEUM evaluation for configurable thresholds? This is a reminder that the SolarWinds Web Transaction Watcher is the free “little sibling” to their enterprise product Synthetic End User Monitor (SEUM).

SEUM is cool because it greatly broadens and deepens the Web transaction monitoring functionality contained in the Web Transaction Monitor. For instance, SEUM has robust scheduling capability (Web Transaction Watcher includes limited functionality for automatically replaying your stored Web transaction sequences).

Moreover, SEUM makes it easy to run your Web application tests from multiple hosts. For example, you may want to simulate your Web app user experience from multiple locations around the world using various Internet connection speeds.

Conclusion

You should know that Web Transaction Monitor is only one of over 20 completely free utilities that are offered by SolarWinds. I’ve been a fan of these tools for many years; their Advanced Subnet Calculator has historically been one of my favorite free utilities from any vendor.

Web Transaction Watcher

• IEAK Boot Camp – Part 4: Maintaining Internet Explorer 9 (0)
• IEAK Boot Camp – Part 3: Deploying a custom build of Internet Explorer 9 (0)
• IEAK Boot Camp – Part 2: Creating a custom build of Internet Explorer 9 (0)
• IEAK Boot Camp – Part 1: Whys and Initial Configuration (0)
• Chromebooks – Eight disadvantages – Part 5: Costs and conclusion (2)

Submitted by Eugene Rublovka

Verax NMS supports network elements (CISCO, Juniper, Adva, Foundry , etc.), applications (MySQL, Oracle RDBMS, Microsoft Internet Information Server, Apache Tomcat, IBM WebSphere, etc.), and data center elements (IP cameras, power supplies, etc.) in a single, integrated system.

Network and application monitoring – Verax NMS – Sensor summary

The Rich Internet Application (RIA) front-end GUI is a differentiator, as well as built-in business reports (users can design their own), plugin based architecture (SDK available) and rules engine (for event processing and IT automation).

Network and application monitoring – Verax NMS – Business Reports

Verax NMS

• Poll: Are you currently using a monitoring solution? (11)
• SCOM 2012 review – Part 8: Dashboards (0)
• SCOM 2012 review – Part 7: Linux and JEE monitoring (4)
• Notifications and Custom Commands in Nagwin/Nrpe (0)
• SCOM 2012 review – Part 6: Application Performance Monitoring (APM) (1)

Submitted by Igor Markin

The program allows you to manage users, groups, client computers, servers and domains. Metro interface makes the program easy. You do not need to install software on the server.

Active Directory Management -SysAdmin Anywhere

SysAdmin Anywhere supports these features:

Computer Management

• Quickly search for a computer in the list of computer
• View and edit properties
• View events on a remote computer
• View processes on a remote computer
• Monitor a remote computer’s performance (CPU, available memory)
• Run any command on a remote computer
• View the list of hardware installed on a remote computer
• View the list of software installed on a remote computer
• Reboot a remote computer
• Shutdown a remote computer
• Quickly view basic information about your computer

User Management

• Quickly search for a user in the list of users
• View and edit properties
• Add photos
• Add a new user with filling all required fields automatically and creating a login by using a template
• Include and/or exclude certain groups
• Reset a user’s password
• Quickly view basic information about a user

Group Management

• Quickly search for a group in the list of groups
• View and edit properties
• Include and/or exclude certain groups
• Quickly view basic information about a group
• Contacts Management
• Quickly search for a contact in the list of contacts
• View and edit properties
• Include and/or exclude certain groups
• Quickly view basic information about a contact

Reports

• Print out various reports
• Set up document parameters before generating a report
• View a report at different scales

SysAdmin Anywhere

• Microsoft Exam 70-640 – Active Directory trusts (0)
• Microsoft Exam 70-640 – Active Directory Forests and Domains – Sample question (5)
• Microsoft Exam 70-640 – Active Directory Forests and Domains (0)
• How to synchronize Windows Server 2008 with an external time server (6)
• How to disable USB drive use in an Active Directory domain (0)

Now that we have configured WPKG on the server side, all that remains to be done, is to tell our client system to run the WPKG script (with administrator privileges). WPKG should then manage our software as per our config files. Whereas the WPKG project does provide a client, I prefer to use the alternative WPKG-GP client.

The reason I prefer WPKG-GP is that it hooks into the startup process via Group Policy extensions, and runs WPKG before users have a chance to login, so you don’t need to worry about applications being open when you are trying to upgrade them.

Once you downloaded WPKG-GP, run the setup, and install all components. For simplicity we will enable local policies, although it is possible to configure WPKG-GP via Group Policy. During the setup process you will need to browse to the file share where you copied the WPKG files to. The final screen of the installer will ask you for an account that has permissions to connect to the WPKG share. I suggest creating a dedicated account for WPKG for this.  Don’t forget to give this account read access to your WPKG share!

At this point we have our WPKG configuration files on our server and the WPKG-GP client installed. If we reboot and carefully watch the bootup process, just after “Applying computer settings…” you should see WPKG-GP kick in and do its thing. If all went well, WPKG-GP will install the 7-Zip package.

WPKG-GP installing 7-zip

Occasionally, you might encounter a problem with WPKG, where your package isn’t correctly installing (It might be attempting to install every time, but never appearing on the client). We can locate the problem by running the WPKG.js from the command line, and watching the output. Fire up an administrator command prompt and run the following command:

cscript \\SERVER\WPKG\wpkg.js /debug /synchronise |more

This will run the WPKG engine and display its progress step-by-step. While writing this article 7-Zip wasn’t installing and the output of the above command told me that the installation was returning error code 1619.  A quick search revealed that this error means the installer package couldn’t be found. I corrected the typing mistake in the MSI path in my packages.xml, increased the revision number, then retried to find that 7-zip installed without problems.

WPKG installation progress

Once you are happy with your WPKG software deployment setup, it’s relatively simple to tie it in so that it kicks in after a system deployment via WDS.

From WDS we just need to run the WPKG-GP client installer as a “FirstLogonCommand” in our unattend.xml. Luckily, we had already configured the batch script postbuild.cmd which we can use for this purpose. Just add the following command to the batch script:

wpkg-gp-version_x86.exe /S /NetworkUsername CONTOSO\WpkgInstallUser /NetworkPassword Pa$$w0rd /WpkgCommand \\server\Wpkg\Wpkg.js shutdown /t60 /r

Obviously you will need to replace the relevant parts to suit our environment. This will cause the WPKG-GP client to be silently installed, reboot system, and then start installing the software packages.

You should now have a configuration that is ready for remote bare metal system and software deployment. While it does take a bit of time and patience to get all your software properly installing with WPKG, it will certainly make life a lot easier in the long run.

WPKG-GP

• MDT Workbench and Windows deployment (0)
• MDT (Microsoft Deployment Toolkit) prerequisites and add-ons (0)
• Introduction to the Microsoft Deployment Toolkit (MDT) (0)
• Raffle: ManageEngine Desktop Central – Part 2: Features (2)
• Deployment toolkit Part 2: Driver deployment tools (0)

The great thing about WPKG is that it doesn’t require any infrastructure other than an SMB network share, oh, and it’s free! To follow this introductory tutorial to WPKG, head over to the download page to get the latest version of WPKG, unzip the file and copy hosts.xml, packages.xml, profiles.xml and wpkg.js to C:\WPKG or a location of your choice. You should also share this folder, as you will need to access it over the network.

WPKG configuration files

The wpkg.js file is the main engine of WPKG. It first looks through the various XML configuration files, and then runs any required commands to install, upgrade or remove software from your client systems.

So-called profiles are defined in profiles.xml. A profile basically contains a list of software packages that will be installed on the remote system.

In hosts.xml you can assign computers to a WPKG profile. For example, you could assign all hosts that belong to accounting to the finance profile.

Finally, packages.xml contains information about all the available software packages that  you can manage with WPKG. Each package definition should include a “check” to determine if the software is installed or not, a set of installation commands, a set of upgrade commands, and finally commands to remove the software.

If you take a look at the files you have copied to your WPKG folder, it should be relatively easy to gain an understanding of the way the WPKG configuration works:  A host is allocated to a profile, and a profile then refers to packages which contain information about the way how the software has to be installed.

To keep this example easy, we will just deploy a single application( 7-Zip) to our clients. Download the 32-bit MSI and then save it to C:\WPKG\Software\7-zip\7z920.msi.

WPKG sample configuration

First, open profiles.xml. Take note of how the example profiles define dependencies. The “other” profile section includes the openoffice package and refers to the software packages in the “default section”.  The definition of default packages is useful for deploying a base set of applications to all workstations.

<?xml version="1.0" encoding="UTF-8"?>

<profiles>

 <profile id="default">
 <package package-id="firefox" />
 <package package-id="thunderbird" />
 </profile>

 <profile id="custom">
 <depends profile-id="default" />
 <package package-id="openoffice" />
 </profile>

 <profile id="administration">
 <depends profile-id="default" />
 <package package-id="openoffice" />
 <package package-id="acrobat7" />
 </profile>

 <profile id="other">
 <depends profile-id="default" />
 <package package-id="openoffice" />
 </profile>

</profiles>

Remove the example configuration from profiles.xml, and insert this very basic profile, containing just one package:

<?xml version="1.0" encoding="UTF-8"?>
<profiles>
 <profile id="default">
 <package package-id="7-zip" />
 </profile>
</profiles>

The example hosts.xml file adds any unknown/unmatched clients to the “other profile”, so we don’t need to edit this file for now, although you probably will want to do that later when you’re getting more adventurous with WPKG.

Packages.xml also contains examples, which you should remove and replace with a simple configuration containing just one package. In a common WPKG setup, you would have multiple packages listed here. Replace packages.xml with the following configuration:

<?xml version=”1.0″ encoding=”UTF-8″?>

<packages>

<package id=”7-zip” name=”7-Zip” revision=”9.20″ reboot=”false” priority=”1″>

<check type=’uninstall’ condition=’exists’ path=’7-Zip 9.20′ />

<install cmd=’msiexec /qn /norestart /i “\\SERVER\WPKG\Software\7-Zip\7z920.msi” REBOOT=ReallySupress’ />

<upgrade cmd=’msiexec /qn /norestart /i “\\SERVER\WPKG\Software\7-Zip\7z920.msi” REBOOT=ReallySupress’ />

<remove cmd=’msiexec /qn /norestart /x “\\SERVER\WPKG\Software\7-Zip\7z920.msi”‘ />

</package>

</packages>

I will quickly outline what’s going on in this file, as the packages.xml is certainly the most complex configuration aspect of WPKG. You can find the full documentation for packages.xml at WPKG.org.

Package id – The ID of the package, must be unique and match the package-id that you used in profiles.xml so that WPKG can create the link between the two.

Package name – This is just a friendly name that is displayed while the software is being installed.

Package revision – I usually use the software version, although you can just use an incrementing number – if you increase the revision number, WPKG will run the upgrade commands for the package.

Package reboot – Some packages might require an immediate reboot, in this case you should set reboot to “true”. In our example the package won’t require a reboot, so I’ve left it at “false”.

Package priority – Defines the order in which packages will be installed by WPKG. The higher this number is, the higher the priority of the package is (5 will be installed before 1).

Check – This section defines how WPKG will verify whether the package is installed on the client. There are a number of different checks that can be performed. In my example, I am just checking for a certain entry in the “Add/Remove programs” control panel applet. You can combine multiple checks if required.

Install – This is the command used to install the software for the first time. For automated software deployment, it is important that this command runs without any user intervention (unattended installation). It can sometimes take a bit of time to find out the required command line arguments for unattended installation. WPKG wiki and appdeploy.com are great resources if you are searching for command line parameters of well-known installers. Luckily the 7-Zip installer comes as a Microsoft Installer package (MSI) . You can use “/qn2″ for quite (unattended installs). As you probably already guessed, “/i  stands for “install”. You can see the full list of command line arguments for MSI installers by running “msiexec /?” If you add multiple install commands, WPKG will run them sequentially.

Upgrade – Upgrades work the same way as installations, however this command is only executed when the revision number of the package is increased.

Remove – If a package has been removed from a profile, but is still present on the system, WPKG will run the remove command(s) to uninstall application from the system. This takes the same options and format as the install and upgrade commands.

If there are any syntax errors in your XML files, WPKG will not process the configuration. It is often helpful open the files in Internet Explorer as this will highlight syntax errors.

In my next article, I will show you how to set up the WPKG client WPKG-GP.

WPKG

• MDT Workbench and Windows deployment (0)
• MDT (Microsoft Deployment Toolkit) prerequisites and add-ons (0)
• Introduction to the Microsoft Deployment Toolkit (MDT) (0)
• Raffle: ManageEngine Desktop Central – Part 2: Features (2)
• Deployment toolkit Part 2: Driver deployment tools (0)

Submitted by Dion Zhu

Virtual desktops are always useful for separating your work into multiple workspaces for more efficiently organizing and managing your work. nSpaces is a virtual desktop manager application to manage multiple workspaces.

Virtual Desktop Manager – nspaces

Open one of workspaces, launch applications separately in each workspace to avoid clutter, make a tag to identify each workspace easily, set a different wallpaper/background color for each workspace, and set hotkeys to perform workspace switching tasks more easily. Unlike many virtual desktop application, nSpaces allows you to password protect your workspaces.

From the system tray, you can access settings, configure spaces, open space switcher and exit nSpaces. To configure properties for each workspace, select nSpaces option from the system tray, and click on a workspace to set your desired settings. The (+) and (-) buttons allow adding and reducing workspaces.

For example, you can add more workspaces by clicking on the (+) button and reduce them from the (-) button. The Label tab allows selecting a custom name for each workspace, whereas, the wallpaper and color tabs allow selecting a custom wallpaper/background color for each workspace.

Likewise, the Hotkey tab can be used to select a custom hotkey for launching nSpaces configurations. The apps tab allow you adding which applications you want to launch on each workspace.

nSpaces

Also check out the free virtual desktop manager WindowsPager

• Raffle: ManageEngine Desktop Central – Part 2: Features (2)
• Raffle: ManageEngine Desktop Central – Part 1: Overview (0)
• FREE: Workspace Manager Express – A roaming user profiles alternative (0)
• Spiceworks installation guide (1)
• FREE: WMI Explorer – Browse WMI classes and execute any WMI query (3)

This review was written on SCM v2 beta, the beta period has ended and SCM v2 is now available for download here. Note that the release date on the download page is incorrect, this is the final RTW (Release To Web) version of SCM v2.

Foreword

Group Policy is one of the most powerful tools in a sysadmin’s arsenal, not only for making sure users don’t get themselves into too much trouble but also to establish security standards across client and server machines.

For quite some years Microsoft have produced security guidance for Group Policy, what settings to use and how to configure them but most administrators don’t have time to trawl through lots of documentation. To make it easier for busy administrators to make well informed decisions when building Group Policy Objects (GPOs) Microsoft published the free tool Security Compliance Manager (SCM) v1 in early 2010.

This tool contained baselines for various products with best practice security settings and the ability to export a customized baseline as a GPO. The one glaring omission in v1 however was that it didn’t allow you to import your current GPO security settings and compare them to Microsoft’s recommendations, SCM v2 remedies this as well as adding some other great features, in this three part article we’ll examine why this tool should be in every admin’s toolkit.

The one thing that shines through in the SCM v2 is the real world feedback that’s obviously gone into the design: Jeff Sigman, Senior Software Design Engineer with the SCM team at Microsoft agrees. “Everything we did in SCM v2 was because of direct customer feedback. We did a number of surveys and interviews throughout the development cycle of SCM v1 and then again after SCM v1 was released publicly. The results were quite clear; SCM v1 had three areas which needed improvement: GPO Import, User interface facelift and SQL database flexibility.”

Installation of SCMv2

Installation is mostly a “click-next affair” but as mentioned above, unlike SCMv1 you have the option of pointing to an already installed local instance of SQL Server / SQL Server Express. SCM v1 always had to install its own copy of SQL Server Express.

If you have SCMv1 or SCMv2 CTP (which preceded the beta) the installer will automatically upgrade it, with all data preserved. This beta also contained 10 baselines that installed directly after SCM is installed, this takes a couple of minutes.

Being able to choose which SQL database to use makes SCM v2 more flexible than its predecessor.

The SCMv2 Console

Since SCM can be used in a few different ways the welcome screen is a handy tool. It has a whole heap of links for various topics that leads to in-depth information on parts of the program.

On the left is the Baseline Library with all your installed baselines, sorted by product. The main area in the middle displays information about the part of a baseline that’s currently selected whereas the right hand Action pane has context sensitive task links.

The SCM console has a simple layout and is easy to navigate.

A downloaded baseline from Microsoft is signed with a digital signature so when you want to create a custom baseline based on an “official” one you have to duplicate it to create an unsigned, modifiable copy. If you want to work with other baselines than the 10 included in the beta package go to Tools – Check for Baselines, during the installation you can let SCM create copies automatically so you can start customizing immediately.

In the next part of this series we’ll examine the new GPO Import functionality in SCM v2 as well as see how Microsoft actually creates a baseline and the different classification in the new baseline format.

• Troubleshooting Group Policy – Part 6: Common problems (0)
• Troubleshooting Group Policy – Part 5: Active Directory problems (0)
• Troubleshooting Group Policy – Part 4: Client problems (0)
• Troubleshooting Group Policy – Part 3: Group Policy not applied? (0)
• Troubleshooting Group Policy – Part 2: Test and deploy (1)

Submitted Michel Roth

Quest just launched a new free tool on the vWorkspace Community called the vWorkspace Desktop Optimizer. It is important to note that this tool not only works for Quest vWorkspace but also works for other desktop virtualization product like Citrix XenDesktop and VMware View or other.

Tests have shown that the impact of the vWorkspace Desktop Optimizer can be quite big.

VDI performance -  vWorkspace Desktop Optimizer

As you can see the big savings are in the area of storage. Because of the optimizations applied to an idle (so no user logged on) Windows 7 Enterprise VM by the Quest vWorkspace Desktop Optimizer the read and write IOPS were reduced by more than 90%. This has a huge effect on the scalability of VDI environments since (lack of) IOPS is currently the most common bottleneck in VDI deployments.

There are also disk space savings. We deployed two virtual desktops via the Quest vWorkspace rapid provisioning options (Differencing Disks / Linked Clones) and then we compared the vanilla Windows 7 virtual desktop to the virtual desktop optimized with the Quest vWorkspace Desktop Optimizer. The virtual desktop optimized with the Quest vWorkspace Desktop Optimizer consumed 43% less disk space.

In addition, the Quest vWorkspace Desktop Optimizer also introduced RAM savings of up to 10%. Some people have seen more savings, up to 200 MB per virtual desktop but this depends heavily on the characteristics of the virtual desktop.  Finally, a virtual desktop optimized by Quest vWorkspace Desktop Optimizer also consumed up to 37% less CPU although it has to be stated that this was measured on (as stated earlier) a desktop with no users logged on so even though the relative savings are high, the absolute savings are not that dramatic.

The vWorkspace Desktop Optimizer is a collection of 40 optimizations to Windows to make them more ‘VDI friendly’. VDI friendly in this case primarily means that it will consume less system resources and thus improve the resulting scalability of the VDI environments. The vWorkspace Desktop Optimizer provides the capability to filter optimizations based on ‘impact’ allowing you only to apply those optimizations. It also allows you to filter by category so you can see to which area the optimizations apply with the categories being Storage, CPU&Memory and User Experience.

Quest vWorkspace Desktop Optimizer

Next to the main UI the vWorkspace Desktop Optimizer also accepts command line switches. One switch, the –edit switch, allows you to open up to UI so you can change the description and justification fields using the editor. The other switch is the –run switch. This will allow you to run the vWorkspace Desktop Optimizer from the command line so you can use the vWorkspace Desktop Optimizer in scripts.

The final feature I would like to put out is the ‘Export’ function. This allows you to export your current vWorkspace Desktop Optimizer configuration to an formatted XML file for easy use in your documentation efforts.

Quest vWorkspace Desktop Optimizer – Export

If it wasn’t clear, the vWorkspace Desktop Optimizer is completely free, directly available from the vWorkspace Community. All feedback is welcome as next version of the vWorkspace Desktop Optimizer will be built based on suggestions from the community.

vWorkspace Desktop Optimizer

• SCVMM 2012 review – Part 5: Integrating with VMware and Citrix XenServer, Cluster patching (0)
• VMware Backups – Troubleshoot the Consolidate Helper-0 backup error (1)
• Installing a driver in an existing VMware vSphere 4.1 ESX/ESXi host (1)
• How to add VMware vSphere 4.1 ESX/ESXi hosts to Active Directory (1)
• Microsoft Hyper-V Dynamic Memory vs. VMware Memory Overcommit (5)

This is part three of a three part series of articles covering two great WMI tools, the second and final tool being WMI Explorer.

WMI Explorer v1.10 is another lightweight (at 533KB), portable tool. To demonstrate its abilities I need to use WMI to find something I don’t already know and without using any books or the web. My example is to list the games I have installed and the path. The first step is to connect to a different namespace, as in the screenshot below.

WMI Explorer – Connecting to different namespaces

The interface lets you click on the open book icon to open a browse window, or you can just type directly into the namespace field if you already know what you want. You can also enter security credentials if you need to.

Clicking OK takes you to the main screen.

Browsing the “game” class with WMI Explorer

I want to see what properties exist for the “game” class, so selecting “game” in the top window queries the machine and gives you live results in the bottom left window. The right-hand window obviously lists the properties at your disposal. Note, the query field defaults to the favourite “select * from”. I did not type that string, WMI Explorer wrote it for me. Clicking “Execute” reveals the answer to my example, in figure 7.

The output from WMI Explorer

So, now you can the list of games in the name column and thus see my taste in games but that’s not quite the end of the story. You can now fine tune your WMI query and potentially speed it up. Note the time in the status bar at the bottom of figure 6, as 0.11 seconds.

The Win32_Volume class, Vista or later

Whilst this is just a basic example the issue of efficient queries is vital if you intend to run a script on machines remotely. Owing to the sheer wealth of data that WMI provides, the results can quickly get out of control. For example the trivial task of scanning machines for how much disk space they have left is easy using the win32_Volume (figure 8).

However it has 44 properties, so even running on 100 machines will scale up to 4400 properties. Rather than query everything with the crude use of “*” you can be more selective and choose only the properties you want. You probably know you achieve this using either the “where” clause or specifying explicit properties alone. Figure 9 shows just the name and path of the games on this machine. Note the time is now only 0.08 seconds.

A more efficient WMI query, perhaps

Using the two tools will make your job easier at the very least, but better still will help you to not upset the network team by dragging all the obscure WMI properties you don’t need over the LAN or worse over a low bandwidth and expensive leased line.

WMI Explorer

• MDT Workbench and Windows deployment (0)
• MDT (Microsoft Deployment Toolkit) prerequisites and add-ons (0)
• Introduction to the Microsoft Deployment Toolkit (MDT) (0)
• Raffle: ManageEngine Desktop Central – Part 2: Features (2)
• Deployment toolkit Part 2: Driver deployment tools (0)

Submitted by Steve Kradel

It taps into the new 2008 / Windows 7 logging infrastructure when available, but will fall back to 2003 mode when necessary, and supports filtering on event IDs, and start and end dates, as well as text within the event message.

Zetetic.Events automatically discovers your environment’s domain controllers, which makes it especially valuable for diagnosing login failures, account lockouts, and security audit events.

Here is an example:

ZeShell -e 4728-4758,after=19-July-2011
-----------------------------------------------------
Event ID:    4728
Level:       Information
Keywords:    Audit Success
Publisher:   Microsoft-Windows-Security-Auditing
Created:     7/20/2011 2:35:17 PM
Machine:     dc-1.demo.net
Log:         Security
Description: A member was added to a security-enabled global group.

Subject:
        Security ID:            S-1-5-21-950928700-2040260430-2032203972-500
        Account Name:           Administrator
        Account Domain:         DEMO
        Logon ID:               0x454d11

Member:
        Security ID:            S-1-5-21-950928700-2040260430-2032203972-187428
        Account Name:           CN=Uncle Fester,OU=ZetDemo,DC=demo,DC=net

Group:
        Security ID:            S-1-5-21-950928700-2040260430-2032203972-187514
        Group Name:             Global1
        Group Domain:           DEMO

Additional Information:
        Privileges:             -

• FREE: EventSentry Light – Real-time event log monitoring (11)
• FREE: LogFusion – Log file monitoring in real time (0)
• FREE: NetWrix Logon Reporter – Logon auditing (4)
• FREE: Event Log Manager – Event log collector (0)
• Free Windows Error Reporting (WER) viewing tool – AppCrashView (0)

WMI Code Creator is a tiny (300KB) Microsoft tool available here. To demonstrate its features, the code snippet below is for querying a machine’s model and gives us enough info to start using the tool.

strComputer = "."
Set WshShell = WScript.CreateObject("WScript.Shell")
strQuery="SELECT * from Win32_ComputerSystem"
Set col=GetObject("WinMgmts://" & strComputer & "/root/cimv2").ExecQuery(strQuery)
For Each WMIProperty in col
PCModel = WMIProperty.Model

First, I need to select the CIMV2 namespace and then find the win32_computersystem class in the class drop-down box. Without reference to a huge book or the internet, you would struggle to discover the properties in the class without perhaps writing a script. Code creator makes this trivial, with the click of a single button which lists all properties. The model is just one property of many, as you can see in figure 2 below:

WMI Code creator showing model

I’ve clicked all three buttons on the tab simply to show you what else the tool gives you. As you can see you can use this class to write a script to join the domain, or you can do less work at let Code Creator live up to its name and write it for you, using the “Execute a method” tab. One minor feature is that the script does not appear in the right hand window until you highlight the instance, as in figure 3.

Choosing a method and generating the code

The final feature of code creator is its ability to create code to query explicit properties. You can get as many or as few of the properties as you like by control-clicking each one you want. Again the script generates on the fly on the right pane, in the next figure.

Selecting multiple properties and generating more code

As you can see Code Creator even saves you the trouble of using copy and paste with the “open in notepad” button!

Returning to the OS deployment task example, I later found I needed a full script to check certain BIOS values on the HP hardware. Browsing through Code Creator I found Win32_BIOS. This gave plenty of information, but then someone asked to change the boot order in the BIOS. As the Win32_BIOS class has no methods at all, it meant looking deeper. HP has designed a whole new namespace, “root/HP/InstrumentedBIOS” that provides access to altering various BIOS settings from within Windows. This complication called for some experimentation that Code Creator does not have – real-time custom queries. The solution is WMI explorer.

• MDT Workbench and Windows deployment (0)
• MDT (Microsoft Deployment Toolkit) prerequisites and add-ons (0)
• Introduction to the Microsoft Deployment Toolkit (MDT) (0)
• SCOM 2012 review – Part 8: Dashboards (0)
• SCOM 2012 review – Part 7: Linux and JEE monitoring (4)

Submitted by Helge Klein

If you look under the hood of Windows you find permissions everywhere. Files and folders, registry keys, network shares, printers, services and WMI objects – all of these have security descriptors storing ownership, permission and auditing information. That opens up powerful management options and SetACL is the great tool for the job. It sets and lists permissions practically anywhere in the system, locally and over the network, from the command line, scripts or programs.

SetACL – Manage access control lists

Managing Windows permissions

With nearly 500,000 downloads SetACL is a proven tool for automating and managing permissions. SetACL does everything Explorer does and much more. It has, for example, no problem whatsoever processing very long paths with more than 260 characters.

When you start to work with SetACL the command line options may first seem intimidating. That is because the program packs many features you will appreciate, like being able to bypass security when listing permissions.

If you have always wanted to check out the content of the “System Volume Information” folder stored in the root of every drive, try the following command on an elevated command prompt:

SetACL.exe -on "c:\System Volume Information" -ot file -actn list -lst f:tab -rec cont_obj

This instructs SetACL to list (-actn list) the permissions of the file system object (-ot file) System Volume Information (-on) recursively (-rec cont_obj), i.e. including all subfolders and files. The listing is printed in easy-to-read tabular format (-list f:tab) on the screen.

Automatic re-acling in migrations

Obviously SetACL is very good at setting permissions and changing object ownership. But let us rather skip to some very special capabilities, one of which is the re-acling feature. Copying existing permissions between domains can be extremely useful when you are performing a domain migration.

Suppose you have a domain OldDom whose user accounts you need to recreate in NewDom. You have already created all user accounts in NewDom with identical attributes as in OldDom, but the new user accounts still have no access to the company’s file shares. That is because although the user names in NewDom are the same as in OldDom, the users’ SIDs are different, and SIDs are what is stored in security descriptors, not user names.

In such a situation the following SetACL command would help:

SetACL.exe -on "\\server1\share1" -ot file -actn domain -rec cont_obj -dom "n1:OldDom;n2:NewDom;da:cpydom;w:dacl"

This instructs SetACL to copy all permission entries from OldDom to the corresponding account in NewDom for every file and folder below “\\server1\share1″.

SetACL can do much more than could be described in this article. To learn more, download SetACL, check out the program’s documentation and have a look at the examples. Any remaining questions are likely answered quickly in the support forum

SetACL

• FREE: Console – Windows Command Prompt alternative for Windows and PowerShell (9)
• Free BAT to EXE converter – 4 ways to convert a batch file to an EXE file (2)
• Four ways to stop a shutdown or reboot (7)
• DOSBox – Run DOS programs on 64-bit Windows (13)
• Poll results: GUI vs. CLI (0)

Submitted by Helge Klein – Website: helgeklein.com

While user profiles are great for personalization, sometimes a cleanup is required and some or all profiles need to be deleted. As it turns out, Windows has no tool for automating this task from the command line. There used to be a tool called Delprof, but it does not work correctly on Windows 7 and Server 2008 (R2). Delprof2 does. It is a kind of unofficial successor to Delprof. Although it is more powerful than the original it is still syntax-compatible, so existing scripts can be reused without any change.

Delprof2 – Delete user profile

Delete local and remote user profiles

Delprof2 works both locally and remotely. Given administrative privileges it deletes any user profile, regardless of the current permissions. Delete user profiles remotely on a different computer? Use /c:computername.

Run Delprof2 in unattended mode? Use /u and it stops asking for confirmation.It also is not stopped by very long paths which most tools and even Windows Explorer cannot handle. In short: if you tell it to delete a user profile, it will.

Delprof2 has additional filtering options: you might want to delete locally cached copies of roaming user profiles only or delete only profiles that have not been used in a specified number of days. Delprof2 does it all. Of course it will never touch the currently active user profile. Neither does it delete user profiles needed by the operating system (like “Default”).

Delete multiple user profiles

If you want to reclaim disk space just run it without parameters and it will delete all user profiles except your own and some special profiles needed by the operating system. There is no risk involved – it only starts deleting after politely asking for confirmation.

If that still sounds too dangerous, add the parameter /l to invoke what-if mode and have Delprof2 list what it would do. Often, only cached copies of roaming profiles need to be deleted, leaving all local user profiles intact. Just add /r to the command line and you are good to go.

As you can see, Delprof2 is a versatile tool for dealing with user profiles.  Support is provided via a forum.

Delprof2

• Raffle: ManageEngine Desktop Central – Part 2: Features (2)
• Raffle: ManageEngine Desktop Central – Part 1: Overview (0)
• FREE: Workspace Manager Express – A roaming user profiles alternative (0)
• Spiceworks installation guide (1)
• FREE: nspaces – Virtual Desktop Manager (3)

Windows is not really made to be managed from a command-line interface, and the somewhat primitive Windows Command Prompt stresses this fact. But the strongest side of Windows is that, for every weakness, a third party steps into the breach—and, in many cases, the stopgap is free. (Which is why the 4sysops list of free Windows admin tools now already contains 343 tools.) Console is another candidate.

Windows Command Prompt alternative – Console

Console’s list of features reads like a list of Windows Command Prompt shortcomings:

Resizing the Windows Command Prompt

To enlarge a Windows Command Prompt window, you have to specify width and height through the window properties. Can someone please tell me what the point of this “feature” is? The majority of commands and messages don’t fit into the tiny default size. Of course, you can change the default size, but then when you need a smaller window, you have to go through this cumbersome resizing procedure again.

With Console, you can resize the shell with the mouse, just like with every other Windows application. Yes, you can decrease the window size of the Windows Command Prompt with the mouse, but then you have to scroll horizontally to view lines that don’t fit into the window. Console creates line breaks, which makes the reading of long lines much easier. The only thing missing here in Console is that it is not possible to maximize the window.

Copy and paste on the Windows Command Prompt

Copying and pasting on the Windows Command Prompt only works after you enable Quick Edit. I’m not sure why this is necessary. But my main critique here is this strange highlighting method that allows you to select only a rectangular area. Whenever you want to copy a command or output messages that extend over multiple lines, you have a problem. You either select too much text or not enough—never what you want.

Copy and paste – Windows Command Prompt

Copy and paste – Console

Console allows you to select text just as in any other Windows program by moving the cursor to the position where the command ends, which is the only highlighting method that really makes sense. By default, you have to press the SHIFT key while selecting text. However, you can configure this. You can copy text through the context menu, or you can configure a hot key. Avoid using CTRL + C though, because you might need this key combination to abort commands. The default setting is CTRL + INS. To paste text, you have to press SHIFT + INS. I don’t see any reason not to configure CTRL + V here. By the way, there are many other hot keys. Check out the Console Settings.

Tabs

If you only launch the Windows Command Prompt whenever you want to ping a remote host, you probably won’t need this feature. But for those admins who think that GUI administration tools are only for sissies and who curse in PowerShell when you wake them up in the middle of the night, tabs are a must-have feature. If you want to use PowerShell with Console, you have to add a tab in the Console Settings and use this command for the shell on a Windows 7 machine: %SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe. You can then open a PowerShell tab through the toolbar.

PowerShell geeks might prefer the Windows PowerShell ISE, especially for writing scripts. However, Console has more settings to offer when it comes to working on the command shell. In particular, the hot keys that allow you to switch quickly between tabs are quite useful.

Moreover, you can assign different kinds of shells to each tab. You just have to point the tab to the corresponding executable. Just in case you’re thinking of using Putty with Console, well, this doesn’t work. This would be my second favorite feature for the next Console version. My favorite feature? Support for Windows Server 2008 2 Server Core.

By the way, Console is portable. The settings can either be stored in an XML file in its folder or in the user profile.

Do you know of another good Windows Command Prompt alternative?

Console

• FREE: SetACL – Manage access control lists (acl) (0)
• Free BAT to EXE converter – 4 ways to convert a batch file to an EXE file (2)
• Four ways to stop a shutdown or reboot (7)
• DOSBox – Run DOS programs on 64-bit Windows (13)
• Poll results: GUI vs. CLI (0)