Sabre's questions

I asked this question a while back and it got bumped to chat because a lot of subjective opinions.

Original message here for reference: https://chat.stackexchange.com/rooms/139176/discussion-on-question-by-sabre-dns-forwarding-issue

And I found a seemingly similar issue, unanswered as well. Conditional Forwarding intermittent failures

So I figured I would try to consolidate it to basic information and try again. With log files for demonstration.

The core question is, without reporting errors, why would a DNS forwarder selectively fail for one host at random and then resume normal operation later? The details of how are as follows...

Edit: I can add to this, the issue happened again this AM (Day after post). The logs show when the incident occurred, one query happened correctly, then less than a second later, asked its WAN forwarder vs its cache or LAN. That cached the external IP, and failed everyone from that point forward until we deleted cache. First query after that followed the forwarder and cached the correct IP. Further making this mysterious, if cached, it should have not asked for a new IP anyway?

I have two DNS servers, two domains, both on LAN, both DC and DNS for their respective AD domains.

One domain is .local so cannot be queried from public DNS, the other is .ORG. The .ORG is split between hosts both on LAN and hosts on internet. We are only concerned in this scenario with intercepting hosts on LAN and let public DNS deal with the rest. So LAN hosts are handled by local server, anything else (Not a LAN host) goes out the next forwarder which is openDNS (And ultimately our SOA is Godaddy). I have learned this is what is referred to as SplitBrains DNS, and apparently a normal thing for hybrid DNS scenario just like mine.

So if you ask the DNS server for A.local where is one of the hosts on B.org, it should and almost always does ask B.org where that is (And never leave LAN unless it does not find a matching hostname there.)

I included a picture of the host that is failing to forward so we do not go down the "there is no such things as DNS forwarding" path again.

What is happening, is that randomly a host on the .org domain does not resolve, because .local DNS server does not ask the DNS server at the .org domain, meaning it never tries the conditional forwarder, I have now confirmed this with a simultaneous packet capture on both hosts, the path goes A.local=>openDNS not A.local=Forward=>B.org.

When it fails the .local does not even try to send to the .org, and the .org confirmed never receives any request.

If you query the .org directly not through the forwarder (NSLOOKUP), it works fine, host is there, and I can see its DNS record. As well the forwarder works fine during this time for other hosts on the .org domain. And the particular host that has these failures is not consistently the same.

This happens off and on, very infrequent, and random, with no change in configuration, and resumes normal operation later, again with no change in configuration.

Log files attached (From DNS logging on .local DNS server where failure is occurring), of the correct chain and the incorrect. The IP 10.1.1.250 is the DNS server for the .org, 10.1.0.16 is the IP of the client requesting the host resolution.

LogCorrect

• Request from client
• Request to .org DNS server (Forward/10.1.1.250)
• Response from .org DNS server to .local DNS server
• Response to client with information obtained via forward.

LogFailed

• Request from client
• Response from .local DNS server, directing it to external DNS (Forwarder never asked)

Hopefully those details will keep it in the question realm, not a chat :-)

Thank you.

LogCorrect:

10/12/2022 9:48:12 AM 0758 PACKET  000000883A640200 UDP Rcv 10.1.0.16       001e   Q [0001   D   NOERROR] A      (3)myhost(4)mydomain(3)org(0)
UDP question info at 000000883A640200
  Socket = 592
  Remote addr 10.1.0.16, port 57756
  Time Query=2147027, Queued=0, Expire=0
  Buf length = 0x0fa0 (4000)
  Msg length = 0x001e (30)
  Message:
    XID       0x001e
    Flags     0x0100
      QR        0 (QUESTION)
      OPCODE    0 (QUERY)
      AA        0
      TC        0
      RD        1
      RA        0
      Z         0
      CD        0
      AD        0
      RCODE     0 (NOERROR)
    QCOUNT    1
    ACOUNT    0
    NSCOUNT   0
    ARCOUNT   0
    QUESTION SECTION:
    Offset = 0x000c, RR count = 0
    Name      "(3)myhost(4)mydomain(3)org(0)"
      QTYPE   A (1)
      QCLASS  1
    ANSWER SECTION:
      empty
    AUTHORITY SECTION:
      empty
    ADDITIONAL SECTION:
      empty

10/12/2022 9:48:12 AM 0758 PACKET  000000883A4581A0 UDP Snd 10.1.1.250      d94e   Q [0001   D   NOERROR] A      (3)myhost(4)mydomain(3)org(0)
UDP question info at 000000883A4581A0
  Socket = 10476
  Remote addr 10.1.1.250, port 53
  Time Query=0, Queued=0, Expire=0
  Buf length = 0x0fa0 (4000)
  Msg length = 0x0029 (41)
  Message:
    XID       0xd94e
    Flags     0x0100
      QR        0 (QUESTION)
      OPCODE    0 (QUERY)
      AA        0
      TC        0
      RD        1
      RA        0
      Z         0
      CD        0
      AD        0
      RCODE     0 (NOERROR)
    QCOUNT    1
    ACOUNT    0
    NSCOUNT   0
    ARCOUNT   1
    QUESTION SECTION:
    Offset = 0x000c, RR count = 0
    Name      "(3)myhost(4)mydomain(3)org(0)"
      QTYPE   A (1)
      QCLASS  1
    ANSWER SECTION:
      empty
    AUTHORITY SECTION:
      empty
    ADDITIONAL SECTION:
    Offset = 0x001e, RR count = 0
    Name      "(0)"
      TYPE   OPT  (41)
      CLASS  4000
      TTL    32768
      DLEN   0
      DATA   
        Buffer Size  = 4000
        Rcode Ext    = 0
        Rcode Full   = 0
        Version      = 0
        Flags        = 80 DO

10/12/2022 9:48:12 AM 0758 PACKET  000000883E98E210 UDP Rcv 10.1.1.250      d94e R Q [8085 A DR  NOERROR] A      (3)myhost(4)mydomain(3)org(0)
UDP response info at 000000883E98E210
  Socket = 10476
  Remote addr 10.1.1.250, port 53
  Time Query=2147027, Queued=0, Expire=0
  Buf length = 0x0fa0 (4000)
  Msg length = 0x0039 (57)
  Message:
    XID       0xd94e
    Flags     0x8580
      QR        1 (RESPONSE)
      OPCODE    0 (QUERY)
      AA        1
      TC        0
      RD        1
      RA        1
      Z         0
      CD        0
      AD        0
      RCODE     0 (NOERROR)
    QCOUNT    1
    ACOUNT    1
    NSCOUNT   0
    ARCOUNT   1
    QUESTION SECTION:
    Offset = 0x000c, RR count = 0
    Name      "(3)myhost(4)mydomain(3)org(0)"
      QTYPE   A (1)
      QCLASS  1
    ANSWER SECTION:
    Offset = 0x001e, RR count = 0
    Name      "[C00C](3)myhost(4)mydomain(3)org(0)"
      TYPE   A  (1)
      CLASS  1
      TTL    1200
      DLEN   4
      DATA   10.1.1.218
    AUTHORITY SECTION:
      empty
    ADDITIONAL SECTION:
    Offset = 0x002e, RR count = 0
    Name      "(0)"
      TYPE   OPT  (41)
      CLASS  4000
      TTL    32768
      DLEN   0
      DATA   
        Buffer Size  = 4000
        Rcode Ext    = 0
        Rcode Full   = 0
        Version      = 0
        Flags        = 80 DO

10/12/2022 9:48:12 AM 0758 PACKET  000000883A640200 UDP Snd 10.1.0.16       001e R Q [8081   DR  NOERROR] A      (3)myhost(4)mydomain(3)org(0)
UDP response info at 000000883A640200
  Socket = 592
  Remote addr 10.1.0.16, port 57756
  Time Query=2147027, Queued=2147027, Expire=2147032
  Buf length = 0x0200 (512)
  Msg length = 0x002e (46)
  Message:
    XID       0x001e
    Flags     0x8180
      QR        1 (RESPONSE)
      OPCODE    0 (QUERY)
      AA        0
      TC        0
      RD        1
      RA        1
      Z         0
      CD        0
      AD        0
      RCODE     0 (NOERROR)
    QCOUNT    1
    ACOUNT    1
    NSCOUNT   0
    ARCOUNT   0
    QUESTION SECTION:
    Offset = 0x000c, RR count = 0
    Name      "(3)myhost(4)mydomain(3)org(0)"
      QTYPE   A (1)
      QCLASS  1
    ANSWER SECTION:
    Offset = 0x001e, RR count = 0
    Name      "[C00C](3)myhost(4)mydomain(3)org(0)"
      TYPE   A  (1)
      CLASS  1
      TTL    1199
      DLEN   4
      DATA   10.1.1.218
    AUTHORITY SECTION:
      empty
    ADDITIONAL SECTION:
      empty

LogFailed

10/12/2022 9:39:38 AM 0748 PACKET  000000883EE821D0 UDP Rcv 10.1.0.16       3858   Q [0001   D   NOERROR] A      (3)myhost(4)mydomain(3)ORG(0)
UDP question info at 000000883EE821D0
  Socket = 592
  Remote addr 10.1.0.16, port 62365
  Time Query=2146514, Queued=0, Expire=0
  Buf length = 0x0fa0 (4000)
  Msg length = 0x001e (30)
  Message:
    XID       0x3858
    Flags     0x0100
      QR        0 (QUESTION)
      OPCODE    0 (QUERY)
      AA        0
      TC        0
      RD        1
      RA        0
      Z         0
      CD        0
      AD        0
      RCODE     0 (NOERROR)
    QCOUNT    1
    ACOUNT    0
    NSCOUNT   0
    ARCOUNT   0
    QUESTION SECTION:
    Offset = 0x000c, RR count = 0
    Name      "(3)myhost(4)mydomain(3)ORG(0)"
      QTYPE   A (1)
      QCLASS  1
    ANSWER SECTION:
      empty
    AUTHORITY SECTION:
      empty
    ADDITIONAL SECTION:
      empty

10/12/2022 9:39:38 AM 0748 PACKET  000000883EE821D0 UDP Snd 10.1.0.16       3858 R Q [8081   DR  NOERROR] A      (3)myhost(4)mydomain(3)ORG(0)
UDP response info at 000000883EE821D0
  Socket = 592
  Remote addr 10.1.0.16, port 62365
  Time Query=2146514, Queued=0, Expire=0
  Buf length = 0x0200 (512)
  Msg length = 0x0067 (103)
  Message:
    XID       0x3858
    Flags     0x8180
      QR        1 (RESPONSE)
      OPCODE    0 (QUERY)
      AA        0
      TC        0
      RD        1
      RA        1
      Z         0
      CD        0
      AD        0
      RCODE     0 (NOERROR)
    QCOUNT    1
    ACOUNT    0
    NSCOUNT   1
    ARCOUNT   0
    QUESTION SECTION:
    Offset = 0x000c, RR count = 0
    Name      "(3)myhost(4)mydomain(3)ORG(0)"
      QTYPE   A (1)
      QCLASS  1
    ANSWER SECTION:
      empty
    AUTHORITY SECTION:
    Offset = 0x001e, RR count = 0
    Name      "[C010](4)mydomain(3)ORG(0)"
      TYPE   SOA  (6)
      CLASS  1
      TTL    466
      DLEN   61
      DATA   
        PrimaryServer: (6)pdns07(13)domaincontrol(3)com(0)
        Administrator: (3)dns(5)jomax(3)net(0)
        SerialNo     = 2022083000
        Refresh      = 28800
        Retry        = 7200
        Expire       = 604800
        MinimumTTL   = 600
    ADDITIONAL SECTION:
      empty

We are being forced to install a component of a system that has a strictly HTTP login method. Vendor has stated it was 'Designed to be an internal application and not designed for internet access." like LAN app are somehow immune to credential theft, etc... Here not there, they will not budge, and I have no choice because we have no alternative at the moment. The service is on the other side of a VPN to make it worse, and I only control one side's networking.

Is there a service out there that would allow me to designate an IP on my network to impersonate the remote server, where an HTTPS session could be established, and have that system exclusively communicate with the remote?

I know this would only encrypt the traffic to and from my clients, but I could then firewall the remote IP to where communication could only come from my one host, and that reduces my overall places to intercept data form n<>1 to 1.

I know network devices such as Junpier's SSL gateway devices do something similar, you log into a web portal and it "rewrites" all data to and from to sources on the LAN side of the gateway.

Does anything this exist in the software only world?

We use Office 365 as our primary mail provider. We have an internal mail server that we use for relaying things like reports from our SSRS, scan to inbox for old scanners, etc. It is an IIS SMTP on server 2008R2. This server is not exposed through the firewall for any service, and certainly not SMTP, and is connection restricted and relay restricted to the few internal IP addresses on our network that use it as a relay. We use this because not every device we use is capable of using the office 365 services directly (we are a nonprofit and some of our older devices are indeed quite older), along with process control equipment in our manufacturing, things that just do not allow for authenticated/TLS SMTP, to make a short story long, there are several essential conveniences that this system provides to the local network, and there should be no reason we should not be able to use the conveniences. We took all of our precautions, we have proper DNS entries for the server. I have SPF records set for its IP, the name the server advertises when it delivers resolves to its public IP. Everything has worked great for over 1.5 years (since migrating to office 365) in this configuration without issues.

Suddenly one day all mail coming form it started getting rejected, by proxy of being listed in spamhaus and CBL.abuseat, spamhaus states that they are listing by proxy of the CBL entry, CBL states we were listed for sending “staggering large volumes of spam”, they cite that server’s DNS name as being the source. Unless it is using telepathy protocols, we average about 60, and have never sent more than 100 emails in a day, and I have now over three month of captured traffic that show not a SINGLE message that did not originate from a known source, and was not destined for an address that we commonly send to (99% of which are all internal addresses anyway!) So aside from the diatribe that the “help page” spews about all the potential causes for this, how we likely been compromised, how to scan for infections in services we do not even run, etc…. We have without question verified that the claim is false, we have monitored all network traffic to and from that machine from a mirrored switch port using Wireshark, we have monitored all traffic at our border firewall, we have had our ISP confirm the same from their side, we simply are NOT sending any mail we have not explicitly wished to send. From that machine or this IP address. Yet this if now the 4th removal request I have had to process with them. I managed to get two emails from their system, as I was requesting samples of the mail that they claim to be transmitted by us, one is a verbatim copy of their “Help Page” and a request for the IP in question, the other is some chipper reply that is worded like a robot, signed “Murray”, and of no help whatsoever. It seemed that one was a canned reply to the first’s IP request stating it had been submitted for removal already.

We contacted Microsoft to find out that their connection filtering occurs prior to our admin control, meaning setting an “approved sender” is useless if the IP reputation filters disconnect us before it gets to that level. So we cannot whitelist ourselves around this. And they claim zero responsibility for using the service, or the fact that it controls mail flow between our paid service and our business network in a manner neither of us can modify. The only thing we can even conceive is that maybe one of the scan to inbox messages is being forwarded to some overzealous spam filter somewhere, and we are being flagged as being a transport method in the chain of. So I am stuck with nothing to go on, I cannot get movement out of abuseat, I cannot get Microsoft to budge, I have proof that we are being falsely listed, and no evidence to the contrary to even begin to look further into, at a complete loss for what to do other than start changing my public IP and all services dependent on it. I have dealt with open relay securing in the past, and cleaning up the fallout thereof, but this one is absolutely confirmed bogus, and no one to take it up with. But they have us by the short hairs.

I have a case, where a user once had access to a directory and that user has been removed now. In fact their account has been deleted out of the AD entirely.

Typically when one sees a user deleted, but having an explicit ACL defined on a directory, then their will be a SID left behind noting the ACL is there, and no longer has reference to all of the other AD attributes like name, etc. Essentially an orphaned ACL entry, left there I assume by design in case you needed to undelete the user.

However I have a case of something different, if I look at the directory properties / security tab, the user in question nor the SID of the user is present.

However if I check the access property of object returned by the CMDLET Get-ACL I get a different result.

If I execute the command on the file server, I actually get the DOMAIN\username having an explicit permission

If I run the exact same command on the same directory from another server (like the domain controller) I get the samne list, but in all other instances than local, the user shows up as the SID. So I have to assume that the file server simply has his SID to UN cached somewhere, this accounts for that variance, however it does not account for the fact that the security tab does not show this same permissions entries.

Worse still, is if I go multiple levels deeper, and check sub objects of this directory using powershell, I see the same results, this permission defined, but only in powershell, windows still shows nothing.

So I went for a third opinion and used accessenum from sysinternals, it does NOT show the extraneous ACL, however CALCS does! so now we are back to a 1-1 ratio of does/does not have the setting with no evidence to support the validity of either.

The directory is directly on the root of a drive, no method powershell, CACLS, etc show this permission defined on the drive itself, nor do I have any reason to suspect it would have been in the past.

I am hesitant to try and do something like remove the ACL with powershell or CACLS without understanding what is going on here. Likewise, the typical enforce ownership/inheritance down the directory tree, remove all permissions and redefine will be a huge undertaking because there is a large file structure UNDER this directory whose ACLs fork many places.

Just to make sure I was not dealing with disk corruption or invalid data, I did a CHKDSK on the drive in question, which reported no error.

I am thinking this either has to be a bug, or corruption somewhere, but at a loss for where to look further, maybe hex editor on the disk itself?

So have I found some bug, error, or just overlooking something glaringly obvious?

I have come into the position of administering a network where there was once an exchange server, and that server is no more. The company has migrated to office 365 cloud based, and there has been no synchronization past the initial migration. The exchange server taken offline but not removed/uninstalled in any capacity, just turned off and deleted (Was virtual machine)

So this has left everything it had integrated with AD, still in the AD. (2 x Server 2008 Domain controllers)

to compound this issue it appears that at one time exchange was installed, then installed again, so for each of the accounts I have a second with a "1" at the end So I have things like

Exchange Servers
Exchange Organization Administrators
Exchange Recipient Administrators
Exchange View-Only Administrators
Exchange Public Folder Administrators
Exchange Trusted Subsystem
ExchangeLegacyInterop

and then

Exchange Servers1
Exchange Organization Administrators1
etc...

along with a collection of objects like health mailboxes, public folders, etc...

So this raises the question, how to even begin to fix this without it becoming a "lets see what happens" time bomb.

Since all of these accounts have descriptions that read along the lines of "This account should not be deleted" it raises a lot of "what if"

So what is the sane way to even approach this project? This is the start of what will likely become a very involved cleanup project...

I am not sure how to tell exactly, but the consensus is it was exchange 2010.

Advise on where to start that is not my gut feel of "start a new AD"?

As a side note, there may be an old backup of the VM archived in some offsite backups, if I could get it, get it restored to another VM host, and back online would the fact it is 6+ months old at best just be more headache than it was worth?

I am trying to get information from the command "show mac-address" out of a collection of 12 procurve switches in 2 different locations all connected via fiber PTP. I want to import this into SQL for some scheduled reporting of statistics, movement, routes, etc... I have managed to generate some very interesting and useful data that will eventually allow me to get this monster I inherited into less of the monster it is.

I have all components of this working other that the fact I have to manually go grab the data per switch using putty, save them in a directory where a scheduled task formats the dumps into csv, cleans them up, and imports them using BULK INSERT.

Now I want to automate retrieval of the data from the switches so I can focus on the data side, and stop spending so much time on the collection side.

I have tried PLINK, however there seems to be some sort of emulation issue where the data is interpreted as the incorrect format, and I get files full of gibberish.

using...

plink -batch -ssh -l <username> -pw <password> xxx.xxx.xxx.xxx < cmds.txt > out.txt

the switches are in stacks, so i have to get past the "not hp management" messages, and "what switch do you want to log into" prompts, this seems to work with just \n\n in the file (same as I would when I log into putty, enter twice) But past that I get long ASCII sequences that seems odd because everything up to that point sees to work without issue.

I have already accepts the key in putty, and again since I am getting all the login and stack commander messages, I am assuming all of this is working.

Any clues on how to either get this to work, or a reasonable alternative to achieve the same?

Example of what I am getting...

HP J9148A 2910al-48G-PoE Switch

Software revision W.15.13.0005



Copyright (C) 1991-2014 Hewlett-Packard Development Company, L.P.

                   RESTRICTED RIGHTS LEGEND
 Confidential computer software.  Valid license from HP required for possession,
 use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer
 Software, Computer Software Documentation, and Technical Data for Commercial
 Items are licensed to the U.S. Government under vendor's standard commercial
 license.
                   HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P. 
                   20555 State Highway 249, Houston, TX 77070


Non-HP transceiver detected, which may cause network problems.
Use 'show interface transceiver' command for details.
HP will not support or troubleshoot problems with these transceivers.
[1;15r[1;1H[24;1HPress any key to continue[15;1H[?25h[24;27H[2J[?7l[1;15r[?6l[24;27H[?25h[23;1H  Stack Members

  SN MAC Address   System Name   Device Type          Status                   
  -- ------------- ------------- -------------------- -------------------------
  0  xxxxxx-xxxxxx Switch1        HP 2910al-48G-PoE   Commander Up             
  1  xxxxxx-xxxxxx Switch2        HP 2910al-48G       Member Up                
  2  xxxxxx-xxxxxx Switch3        HP 2910al-24G-PoE   Member Up                                

[23;1HEnter switch number to connect to or <CR>:[23;1H[23;44H[?25h[23;1H[?25h[23;44H[?6l[1;24r[?7l[2J[1;1H[1920;1920H[6n[1;1HYour previous successful login (as manager) was on 2016-01-29 19:31:41     
 from xx.x.x.xxx
[1;24r[24;1H[24;1H[2K[24;1H[?25h[24;1H[24;1HSwitch1# [24;1H[24;11H[24;1H[?25h[24;11H[24;0HE[24;1H[24;11H[24;1H[2K[24;1H[?25h[24;1H[1;24r[24;1H[1;24r[24;1H[24;1H[2K[24;1H[?25h[24;1H[24;1HSwitch1# [24;1H[24;11H[24;1H[?25h[24;11H[24;0HE[24;1H[24;11H[24;1H[2K[24;1H[?25h[24;1H[1;24r[24;1H[1;24r[24;1H[24;1H[2K[24;1H[?25h[24;1H[24;1HSwitch1#

So I am getting so far as the Switch1# prompt at the switch console.

my input file is at the moment just

show mac-address

With two blank lines above to perform the two "any key" and to continue" requests.

Any help greatly appreciated.

I asked this here, it was requested that I move it to this forum instead.

I have a question that I need some counsel on concerning DHCP and what may happen in a certain situation.

I have a case where a DHCP server started handing out IP addresses to devices that had reservations otherwise, ignoring the fact that the reservations where there.

Server is an x64 2008R2 Standard install, serving as a domain controller.

When it would hand out an IP, I would see that the "Unique ID" was the same MAC address for which I had a reservation configured, and the end device would get the IP it showed coming from my dynamic pool, not the one reserved.

Rebooting the Server cleared this condition and all reservations worked properly afterward.

Having never seen this type of behavior, in this network or any other, I started trying to figure out what may have caused it to begin with, software error, incorrect configuration, etc?

Then it occurred to me I had been working on some IP phones not long before it happened, two of which have incurred some sort of internal failure that resulted in their MAC address being set to FF:FF:FF:FF:FF:FF.

These devices would have requested an IP with both a source and destination address of the same thing, and that address it the network broadcast.

They did not successfully pull an IP address, and reported DHCP failure, so I set a static IP on one, scanned it with NMAP to see if it was up, and than is when I noticed it report its MAC as FF:FF:FF:FF:FF:FF (Unknown), I repeated the process with the second dead device, received the same results, and had not considered what the affects could potentially have been on the network when it was attached.

So to make a short story long, what would the affect be in that environment of requesting an IP for a broadcast address, would it have send out DHCP offers to anything listening? Could it have freaked out the database that managed the pool?

Did I shoot myself in the foot, or was this looking for a problem to fit the symptom?

It would seem that if this would cause the mayhem I saw, that it would be a glaring DOS attack vector, and I cannot be the first one to have crossed it or have asked how to protect against it.

I had also considered what happens if the server was responding to the request trying to tell FF:FF:FF:FF:FF:Ff that is IP was x.x.x.x, and the next one requesting may have intercepted the incorrect message, in some sort of race condition, believing it was receiving a solicited response? (Is that even possible)

I have what may seem like a strange question, however I believe I have identified a real need for something like this and would like to know A. If anyone else has suggestions, or B. if anyone has crossed this bridge and has pointers to products that may already provide function like this.

I work with a company that employs and assists a large number of visually impaired people. There are a multitude of choices for assisting software inside the OS that does everything from read your email to navigate windows....

The issue is that when a computer is shutting down and it is at that screen installing updates X of X, please do not power down or turn off your computer...

Someone who cannot see, will eventually declare that their computer is hung and take the normal remediation steps which is shut it off or power it down!

When I took this position I thought this may have been a bad image from the last admin that kept leading to computers in boot repair, and with random error associated with failing updates. It appears the cause is that end users are doing just this.

So would I would like to do is perhaps detect this condition and make it do a periodic system beep or something to indicate it is in this state, and that they should not consider it hung / in need of power down until the beeping has ceased for x seconds or something like that.

Any one have any suggestions on where to start? (Or where this question would be better asked?)

Our corporate email is hosted on Google Apps, along with 5 domains for various products. Internally (Behind our firewall, not exposed to the internet) we have an IIS server running Microsoft ESMTP MAIL Service, Version: 7.0.6002.18264

This SMTP server is only used for internal applications to message users in the organisation, backup alerts, scheduled scripts notifying admin accounts, etc...

It has worked for many years, but as of last week, stopped working, the message I am getting is FROM google, when my SMTP server attempts to deliver to the end user, I am getting

Final-Recipient: rfc822;[email protected] Action: failed Status: 5.5.0 Diagnostic-Code: smtp;554 Relay Access Denied - psmtp

So my SMTP server is accepting it, trying to send it to google who hosts the mail account, and it stops there, with google's mail server saying the relay is denied.

This makes my SMTP server send ALL mail to the badmail folder.

The messages contain no spam content, and in fact one of the processes is the Google Apps Sync for Active Directory integration reports, so a google product configured like their integrator left it.

So I can only assume google implemented some new criteria on what is and is not acceptable for other SMTP servers to be allowed to send mail to them, but I cannot put my finger on what.

Nothing in our configuration on most of this has changed in years, and it has sent hundreds of messages daily during that time.

windows server 2008 enterprise, without hyper-v x64

We have a client server that I am trying to automate some functions on using power shell directly on the server. I have the gateway service installed, and can manage via RSAT from a client machine, but I want to have the cmdlets on the server itself so I may schedule the task to run locally.

Is there any way to actually get the AD powershell tools installed on the server, or will this HAVE to be done from a client machine?

If so, are there any viable reasons to not do this? If not, why is it not possible? (just because it is not supported, or is there a technical barrier I do not understand that prevents it?)

I have a base new install of windows 7, and when I went to look for something else I saw the attached netstat output.

What concerns me is that this is Windows + Truecrypt + drivers, nothing else installed.

The sequential high ranged ports belonging to several different seemingly not out of place services seemed odd.

So I torched the install, used Active@ to scrub the disk, re-downloaded the ISO from MSDN, and did a fresh reinstall, viola, they are there again.

It just seems out of place, I have seen a many netstats over the years, this one just strikes me as odd, so I started thinking rootkit? (JUst FYI, when I reloaded I named the machine "Error" so that is why the task manager reads the computer name as such.)

So I would like to know if anyone else could explain it, and therefore is may be normal, or would they be worried as well, and should I start considering I have some very strange thing occuring on my network?

I would like to run a backup of an SQL database (MSSQL) and then delete everything that was included in that backup, essentially a purge of the backed up data, the intent being to archive it at a point in time.

The database structure is simple, only six tables, with only implied FKs. Original thought was to perhaps grab the max PK from all the tables into variables, backup and then delete where PK <= the pre backup capture.

This of course fails to do what I want if an insert occurs between grabbing and deleting (backing up in the middle)

And since I cannot perform a backup in a transaction….

The only way I have been able to come up with reliably is to back it up, temporarily restore as a different name, set my variables from the backed up data, and then go back to the original db to delete. Sure seems like a long way to get to what would seem like a simple task.