Create a master plan and follow IT

Story behind the blog

noreply@blogger.com (Masterplan) — Wed, 22 Apr 2009 22:58:00 PDT

This blog reflects my personal experiences, thoughts, opinions and ideas about different kind of software that a system engineer have to deal in his daily job.There were 2 reasons which made me write my blog:
- the desire to help others that have the same problem;
- the desire to have a place accesible from every computer in the world where to find my information.

RSS feed crashed

noreply@blogger.com (Masterplan) — Wed, 22 Apr 2009 22:25:00 PDT

Today i received a notification from feedburner team:

FeedBurner Collision Notification
Due some poor planning on Google's part since you created your new feed, http://feeds2.feedburner.com/masterplan, we have been forced to change its address to http://feeds2.feedburner.com/masterplan2.
WHY DID THIS HAPPEN?
We have worked hard to ensure that any feed that already exists on feeds.feedburner.com cannot be created in the new Google-hosted feeds environment, feeds2.feedburner.com. However, a few feeds, including your own, did end up with the same address on both sides. We've used an automatic conflict-resolution system to determine which feed's address to change, and the choice ended up being this feed.

In this way, the old address of my feed is not good anymore; now it shows a chinese website. I am very dissapointed about that because unfortunately this affects all my curent rss subscribers.
I changed now the rss feed link on my blog, allthough the address changed 1 week ago.
I apologise for the inconvienence and with this occasion i want to thank you to all my readers and subscribers.

How to force users to logon on one domain controller

noreply@blogger.com (Masterplan) — Wed, 08 Apr 2009 07:53:00 PDT

Hello,

The scenario is : one active directory site with two domain controllers.
Question: How to force users to logon only on one domain controller?
The answer to this question resides in the srv records priority. See here how to do it:
http://www.windowsnetworking.com/kbase/WindowsTips/WindowsServer2008/AdminTips/ActiveDirectory/AQuickTiptodesignateadomaincontrollerforclientauthentications.html
You can verify the priorities by dns mmc console or by using nslookup like this:
http://technet.microsoft.com/en-us/library/cc738991.aspx

One-liners with dsquery

noreply@blogger.com (Masterplan) — Thu, 26 Mar 2009 09:31:00 PDT

Get all the members of a group:
dsquery group -name group_name dsget group -members

See all the users with their associated logon script:
dsquery * domainroot -filter "(&(objectCategory=Person)(objectClass=User))" -limit 0 -attr sAMAccountName sn distinguishedName scriptPath

See the groups from Active Directory that does not have any members:
dsquery * -filter "&(objectCategory=group)(!member=*)" -limit 0 -attr groupType sAMAccountName distinguishedName

See when a group was created, and membership:
dsquery * -filter "&(objectCategory=group)" -limit 0 -attr whenCreated samaccountname memberof

Check the expiration date of all users accounts in an OU:
dsquery user "OU=XXX,DC=test,DC=com" dsget user -dn -acctexpires

P.S. I see that for an unknown reason, the pipe command does not appear in my post. So, i must mention that before every dsget command in the upper scripts there is a pipe sign.

How to see the installed updates/fixes on a computer

noreply@blogger.com (Masterplan) — Tue, 24 Mar 2009 06:43:00 PDT

Before writing this post i was aware of a single method:
systeminfo find "KB"
To do it on a remote computer, i used the combination of psexec and the upper command or
systeminfo /s %computername% find "KB"
But the output of the command is not so easily readable. Recently, i found this great article which revealed me a second method, exporting the results in html format:
http://windowsxp.mvps.org/qfe.htm
So, here is the command:
wmic qfe list full /format:htable > C:\hotfixes.html
To do it on a remote computer:
wmic /node:”computername” qfe list full /format:htable > C:\hotfixes.html

How to recover from the failure of a subdomain single domain controller

noreply@blogger.com (Masterplan) — Tue, 24 Mar 2009 04:09:00 PDT

Supposing that your unique domain controller from a subdomain had a hardware failure, those are the 2 steps you need to follow to recover:
1) Remove orphaned domain from Active Directory:
http://support.microsoft.com/kb/230306/en-us
2) Restore the server through reinstallation of the operating system and subsequent restore of Active Directory from backup:
http://technet.microsoft.com/en-us/library/cc782127.aspx

Get mac and installed drivers

noreply@blogger.com (Masterplan) — Mon, 16 Mar 2009 02:12:00 PDT

Here is a command line that will show you the mac address of the network card of a remote computer:
getmac /S 10.1.1.1
And the following will list all the drivers on your system:
driverquery
Or on a remote system:
driverquery /S 10.1.1.1

Folder share names and permissions

noreply@blogger.com (Masterplan) — Thu, 19 Feb 2009 04:52:00 PST

How to delete the share of a folder which share name is "test share" from command line:
net share "test share" /delete
How to share a folder named "test share" with the shared name "test":
net share "test"="C:\test share"
How to make a folder named test with the shared name "test" and give everyone full access:
net share "test"="C:\test" /GRANT:everyone,FULL
Display all open shared files on a server:
net file

Customizable web error messages

noreply@blogger.com (Masterplan) — Fri, 13 Feb 2009 01:57:00 PST

With Web Page Error Toolkit, you can create pages that contain customized error messages to help users find the information they need. In fact, this toolkit is a customizable asp application that replaces the default error page on the IIS server.
See here a good review:
http://technet.microsoft.com/en-us/magazine/2009.02.utilityspotlight.aspx

Free inventory tool

noreply@blogger.com (Masterplan) — Thu, 12 Feb 2009 04:35:00 PST

Hi,

I want to present the Microsoft Assesment and Planning Toolkit, a powerfull free tool which seems to be very useful in an organization.
The Microsoft Assessment and Planning Toolkit performs three key functions: hardware inventory, compatibility analysis, and reporting. It collects and organizes system resources and device information from a single networked computer and does not require users to deploy software agents on the computers that must be inventoried. MAP uses technologies already available in the IT environment to perform inventory and assessments, like: Windows Management Instrumentation (WMI), the Remote Registry Service, SNMP, Active Directory Domain Services, and the Computer Browser service.
Assessments can be completed on the following Windows platforms:
Windows Vista
Windows XP Professional
Windows Server 2003 or Windows Server 2003 R2
Windows 2000 Professional or Windows 2000 Server
Windows Server 2008
The reports generated are very friendly, with a lot of excels and comprehensive graphics. It will report you, for example, how many of your Windows 2003 Server are ready, from hardware point of view, for deploying Windows 2008 on them or how many computers in your organization have Office 2003 or Office 2007 installed.
For more information, see this link from Microsoft:
http://technet.microsoft.com/en-us/library/bb977556.aspx?ca=NOT&su=WINSVR&sa=MAP&ct=NWSLR&cn=%20TNETFLASH&au=ITPRO&go=MAPTN&dt=02112009
and also read the Technet blog for this tool:
http://blogs.technet.com/mapblog/

Adfind (from joeware) - part1

noreply@blogger.com (Masterplan) — Sat, 07 Feb 2009 12:05:00 PST

Export Sites from AD sites and services:

adfind -config -f "(objectClass=site)" -dn

Export sites and associated subnets:

adfind -config -f "(objectClass=subnet)" distinguishedname siteobject

Show user which have certificates:
adfind -tdc -default -f "(&(objectCategory=person)(objectClass=user)(userCertificate=*))" -dsq
Show users whch don't have certificates:

adfind -tdc -default -f "(&(objectCategory=person)(objectClass=user)(!userCertificate=*))" -dsq Show useful informations about users:

adfind -tdc -default -f "(&(objectCategory=person)(objectClass=user))"

The output of the command above is shown in the above picture.

Fix it for me

noreply@blogger.com (Masterplan) — Thu, 05 Feb 2009 03:42:00 PST

Microsoft has created a team that works to improve the time needed to resolve any issues that we have with their products. So, if now KB articles provide us with a list of steps that can be followed to resolve our problem, since now we can click a button and have the issue resolved.
For example, see here what i mean:http://support.microsoft.com/kb/963547
Also, read here their blog:http://blogs.technet.com/fixit4me/default.aspx

Query distibution groups and their members

noreply@blogger.com (Masterplan) — Thu, 29 Jan 2009 05:41:00 PST

Here is the script that will export all distribution groups in the file groups.txt and then will put these groups and their members in the file membership.txt:

dsquery * forestroot -filter "(samAccountType=268435457)" -limit 0 > groups.txt
for /f "tokens=*" %%g in (groups.txt) do @echo %%g >>membership.txt && echo Members: >>membership.txt && dsget group %%g -members -expand >>membership.txt && echo **************************************** >>membership.txt

If you want to do a query on security groups, or on distribution groups that have managers assigned and then list their members, please see my other posts from the Scripts categories called Distribution lists and managers and Security and distribution groups and easily modify the upper script.

Microsoft Web Platform Installer is now released

noreply@blogger.com (Masterplan) — Thu, 29 Jan 2009 04:06:00 PST

The Web Platform Installer (Web PI) is a simple tool that installs Microsoft's entire Web Platform, including IIS, Visual Web Developer 2008 Express Edition, SQL Server 2008 Express Edition and the .NET Framework. Using the Web Platform Installer’s user interface, you can choose to install either specific products or the entire Microsoft Web Platform onto your computer. The Web PI also helps keep your products up to date by always offering the latest additions to the Web Platform.
Supported Operating Systems are: Windows Vista RTM, Windows Vista SP1, Windows XP, Windows Server 2003, Windows Server 2008.
See here: http://www.microsoft.com/web/channel/products/WebPlatformInstaller.aspx

Add mobile number to 1000 users

noreply@blogger.com (Masterplan) — Fri, 21 Nov 2008 04:25:00 PST

Hi all,

This is a script i wrote it in a response to a question asked by someone in Microsoft newsgroups:
how to add mobile numbers easily to 1000 users?
Let's assume that you have the users in a file named mobile.txt formatted like this:
User Phone number
Jon Kerry 0743221021
.
.
The first column is the name of the user, the second column is his mobile number (separated by a tab). The following script would do the trick:
For /F "Tokens=1,* Delims= " %%A In (mobile.txt) Do (
Set name=%%A
Set mobile=%%B)
dsquery user -name "%name%" dsmod user -mobile %mobile%
Pay attention that after Delims= it is a tab character.

Essential LDAP attributes

noreply@blogger.com (Masterplan) — Fri, 21 Nov 2008 04:14:00 PST

In this note i'll show you the essentials ldap attributes that can be used with different tools (like csvde or ldifde) to easily query for the required properties.

In the general tab, these are the ldap attributes (in the second column are the corresponding ldap attributes):
First name: givenname
Initials: initials
Last name: sn
Description: description
Display name: displayname
Office: physicalDeliveryOfficeName
TelephoneNumber: telephoneNumber
Webpage: wWWHomePage
E-mail: mail

In the address tab:
Street: streetAddress
P.O. Box: postOfficeBox
City: I
State: st
Zip code: postalCode
Country: co

In the account tab:
User logon name: UserPrincipalName
User logon name (pre Windows 2000): sAMAccountName
Account expires: accountExpires

In the profile tab:
Profile path: profilePath
Logon script: scriptPath
Home folder, drive: homeDrive
Home folder, local path: homeDirectory

In the telephones tab:
Home: homePhone
Pager: pager
Mobile:mobile
Fax: facsimileTelephoneNumber
Ip Phone: ipPhone
Notes: Info

In the organization tab:
Title: title
Department: department
Company: company
Manager: manager

Distribution lists and managers

noreply@blogger.com (Masterplan) — Thu, 09 Oct 2008 23:33:00 PDT

Another 2 useful scripts:
Find distribution lists and their managers:

dsquery * -filter "(&(samAccountType=268435457)(managedBy=*))" -Attr sAMAccountName managedBy -Limit 0

Find all groups which have managers:

dsquery * -filter "(&(objectclass=group)(managedBy=*))" -Attr sAMAccountName managedBy -Limit 0

Allow dial in access by script

noreply@blogger.com (Masterplan) — Wed, 27 Aug 2008 01:53:00 PDT

I will show you how to enable the Remote Access Service "Allow Access" permission in the Remote Access Permission of the Dial-In tab in the user's properties.
There are 2 cases:
1) For Windows 2000-based domains in Mixed mode or Windows 2000-based domains in Native mode that include RAS servers hosted by Microsoft Windows NT-based computers, see here http://support.microsoft.com/default.aspx?scid=kb;en-us;252398
2) For Windows 2000 domains in native mode and Windows 2003 Server mode, this is the script that will enable Dial-in access for all the users in Test OU:

OUPath ="LDAP://OU=Test,DC=test,DC=com"
Set CNUsers = GetObject (OUPath)
CNUsers.Filter = Array("user")
For Each User in CNUsers
Set objUser = GetObject("LDAP://" & User.DistinguishedName)
objUser.Put "msNPAllowDialIn", True
objUser.SetInfo
Next

Complete script to create users, home folders and ntfs permissions

noreply@blogger.com (Masterplan) — Thu, 17 Jul 2008 11:37:00 PDT

Assuming that you have a file users.txt with this format:
Last_name First_name Group Password
This script automatically create groups in the specified ou Sales, add users to this ou and to the respective groups, give users specified passwords, assign a logon script, create and share home folders and give ntfs permissions on them....a lot of work isn't it?
I must say that the script uses the rmtshare tool for setting shares, available for download from Microsoft.

@setlocal
@set ou=OU=Sales,DC=test,DC=com
@set domain=test.com
@set domainadmins=CN=Domain Admins,CN=Users,DC=test,DC=com
@set domainusers=CN=Domain Users,CN=Users,DC=test,DC=com
@rem Creation of groups
for /f "tokens=1,2* delims= " %%a in (users.txt) do dsadd group "CN=%%c, %ou%"
@rem Creation of users
for /f "tokens=1,2* delims= " %%a in (users.txt) do dsadd user "CN=%%b %%a, %ou%" -upn "%%b %%a" -fn %%b -ln %%a -display "%%b %%a" -loscr Scripts\logon.bat -pwd %%d -memberof "CN=%%c, %ou%"
@rem Creation of personal folders (home folders)
for /f "tokens=1,2* delims= " %%a in (users.txt) do md "D:\Homes\%%b %%a"
@rem Make shares on home directories
for /f "tokens=1,2* delims= " %%a in (users.txt) do rmtshare \\%COMPUTERNAME%\"%%b %%a$" = "D:\Homes\%%b %%a"
@rem Grant share rights on home folders
for /f "tokens=1,2* delims= " %%a in (users.txt) do rmtshare \\%COMPUTERNAME%\"%%b %%a$" /grant "%domain%\%%b %%a":CHANGE /grant "%domain%\Domain Admins":"FULL CONTROL"
@rem Give NTFS rights on home folders
for /f "tokens=1,2* delims= " %%a in (users.txt) do cacls "D:\Homes\%%b %%a" /T /C /G "%domain%\%%b %%a":C "%domain%\Domain Admins":F

Rename all users from AD

noreply@blogger.com (Masterplan) — Wed, 16 Jul 2008 11:53:00 PDT

This was one problem I faced a time ago. I must change all active directory users name from "name surname" to "name.surname". The magic was done for me by this little vbscript which has done in seconds the amazing job. All users were in the organizational unit Test.

OUPath = LDAP://OU=Test,DC=test,DC=com
Set CNUsers = GetObject (OUPath)
CNUsers.Filter = Array("user")
For Each User in CNUsers
NewNameFormat = User.givenName & "." & User.sn
Set objUser = GetObject("LDAP://" & User.DistinguishedName)
objUser.SamAccountName = NewNameFormat
objUser.UserPrincipalName = NewNameFormat
objUser.SetInfo
Next

Security and distribution groups

noreply@blogger.com (Masterplan) — Wed, 16 Jul 2008 11:39:00 PDT

Useful one-step scripts:

- Show the creation date of all groups from AD forest:
dsquery * forestroot -filter "(&(objectClass=Group))" -attr name whenCreated description -limit 0

- Show the date of modification of all groups from AD forest:
dsquery * forestroot -filter "(&(objectClass=Group))" -attr name whenChanged description -limit 0

- Show the creation date of all users from AD forest:
dsquery * forestroot -filter "(&(objectClass=User))" -attr name whenCreated description -limit 0

- Show all distribution groups mail enabled from AD forest
dsuery * forestroot -filter "(&(samAccountType=268435457)(mail=*))" -limit 0

- Show all distribution groups without mail enabled from AD forest
dsquery * forestroot -filter "(&(samAccountType=268435457)(!mail=*))" -limit 0

- Show all security groups mail enabled from AD forest
dsquery * forestroot -filter "(&(samAccountType=268435456)(mail=*))" -limit 0

- Show all security groups without mail enabled from AD forest
dsquery * forestroot -filter "(&(samAccountType=268435456)(!mail=*))" -limit 0

- Show membership of a group named "XXX"
dsget group "XXX" -members -expand

Filter information from event log

noreply@blogger.com (Masterplan) — Sat, 12 Jul 2008 07:43:00 PDT

The following script will show when specific events logged in event viewer happened. This helped me find out if a computer was shut down daily during a month. For this, i searched for specific event id 6009 in the System event log and put in a text file the date and time when it was logged:

Set dtmDate = CreateObject("WbemScripting.SWbemDateTime")
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery _("Select * from Win32_NTLogEvent Where Logfile = 'System' and " _& "EventCode = '6009'")
For Each objItem in colItems
Wscript.Echo "Computer Name: " & objItem.ComputerName
Wscript.Echo "Event Code: " & objItem.EventCode
dtmDate.Value = objItem.TimeWritten
dtmTimeWritten = dtmDate.GetVarDate
Wscript.Echo "Time Written: " & dtmTimeWritten
Next

Find users who are local admins

noreply@blogger.com (Masterplan) — Sat, 12 Jul 2008 07:38:00 PDT

Here is a Visual Basic script, which will audit what accounts/groups are members of the local administrator group. I put it as a a logon script. It puts in a shared folder named public a text file with the computer name and users which are in the local administrators group and are not domain admins or administrator:

Option Explicit
Const ForAppending = 8
Dim objGroup, strComputer, objMember, WshNetwork, objRecordSet, objFSO, objFile, strFileName
strComputer = "."
Set WshNetwork = WScript.CreateObject("WScript.Network")
WScript.Echo "Computer Name = " & WshNetwork.ComputerName
Set objGroup = GetObject("WinNT://" & strComputer & "/Administrators,group")
For Each objMember In objGroup.Members
If objMember.Name <> "Administrator" and objMember.Name <> "Domain Admins"
ThenSet objFSO = CreateObject("Scripting.FileSystemObject")
strFileName = "C:\Public\" & WshNetwork.ComputerName & ".txt"
Set objFile = objFSO.OpenTextFile(strFileName, ForAppending, True)
objFile.WriteLine (objMember.Name)
objFile.Close
End If
Next

Add users from a file to a specific OU

noreply@blogger.com (Masterplan) — Sat, 12 Jul 2008 07:26:00 PDT

Hi all,

Today i will post a bunch of useful scripts for a system administrator. This is the one about adding a users from a text file (users.txt) in which you have the first and last name of the users. The users will be created with the password P@ssw0rd.

for /F "tokens=1,2 delims= " %%i in (users.txt)
do dsadd user "cn=%%i %%j,ou=Sales,dc=test,dc=ro" -samid "%%i %%j" -upn "%%i %%j"@test.ro -fn "%%i" -ln "%%j" -display "%%i %%j" -pwd P@ssw0rd -disabled no

The script can be easily customized, For example, if in the users.txt you have the first name, last name and a description of every user, the script will look like this:

for /F "tokens=1,2,3 delims= " %%i in (users.txt) do dsadd user "cn=%%i %%j,ou=Sales,dc=test,dc=ro" -samid "%%i %%j" -upn "%%i %%j"@test.ro -fn "%%i" -ln "%%j" -display "%%i %%j" -pwd P@ssw0rd -disabled no -desc=%%k

Find Exchange Server for a given account

noreply@blogger.com (Masterplan) — Mon, 26 May 2008 10:02:00 PDT

Set User = GetObject(LDAP://CN=Username,CN=Users,DC=test,DC=com)
Server = User.msExchHomeServerName
WScript.Echo "Exchange Server is " & Server