Chris's questions

This is a generalization of a question I initially had asked about computer accounts. I asked:

When one sets Windows permissions for "Everyone", do these permissions apply to computer accounts (aka machine accounts) like MYDOMAIN\MYMACHINE$? Or do they, say, only apply to normal users/groups?

But the question of what Everyone means really deserves a full, general answer -- and ideally one that makes sense to someone who isn't an in-depth expert on Windows permissions. (As of today I've found it hard to get a good sense of Everyone by going through the first few pages of Google results.)

It seems there's at least some subtlety -- eg by default, "anonymous" network connections are not included in Everyone.

I'm confused about the NETWORK SERVICE account (group?) works on network shares:

On one hand, NETWORK SERVICE is generally described as an account that's local to a given machine. (See, e.g., here on serverfault or in Microsoft's Access Control in IIS 6.0 document.) So it's not a domain-wide account. And, for instance, if a process running under NETWORK SERVICE on SERVERA tries to request a resource on SERVERB, the authentication won't be under some hypothetical MYDOMAIN\NETWORK SERVICE, but rather under MYDOMAIN\SERVERA$. (The latter is known as SERVERA's "computer account".)

On the other hand, I've noticed I can go to a remote file share where I have admin rights, and set permissions on a particular directory for NETWORK SERVICE. (e.g. I can go to \\MYSHARE in Windows Explorer, right-click one of the directories, go to Security > Edit > Add, type "NETWORK SERVICE" in the "Enter the object names to select" box and click OK. Now I have a new NETWORK SERVICE entry in the list of "Group or user names", and I can change the permissions for it, just like I might change permissions for the "Users" group.)

If NETWORK SERVICE is strictly a machine-by-machine account, I don't understand what is supposed to happen when I create a set of permissions for NETWORK SERVICE on a remote share. Does that entry refer to NETWORK SERVICE on one particular (unspecified) machine? To judge by the icon, the permissions are technically for a NETWORK SERVICE group, rather than than a NETWORK SERVICE user. But I can't seem to find any documentation for a NETWORK SERVICE group or how it might work compared to a regular domain group.

My only guess so far is that, if you grant access to the NETWORK SERVICE group (assuming there is such a thing), this amounts to granting access to all the "computer accounts" on the whole domain. (That is, giving permissions to NETWORK SERVICE on a central file server would be the same as giving permissions to MYDOMAIN\SERVERA$, MYDOMAIN\SERVERB$, MYDOMAIN\SERVERC$, ..., MYDOMAIN\MYLASTSERVER$.)

I have a few perfmon performance counters that I'd like to track for a specific ASP.NET application over an extended period of time, say a week or a month. The trouble is that perfmon counters are generally process-centric, rather than ASP.NET application-centric, or AppPool-centric. So, for example, I can bind the counter

.NET CLR Memory performance counters\# Gen 0 Collections

to a specific IIS worker process (which, annoyingly, is identified via w3wp, w3wp#1, w3wp#2 -- but for a fix for that, see How to convert 'w3wp' process names to PIDs or usernames? (i.e.- "w3wp#29)), but I can't seem to bind it to "whatever process, now or in the future, that happens to be running ASP.NET Application X, or AppPool Y". This means that, if IIS recycles the worker process, or if someone restarts IIS, or restarts the machine, then my perfmon logs can't be counted on to keep tracking the same web application.

Is there some trick to use perfmon to monitor a given webapp even if the worker process (e.g. w3wp.exe) restarts, the machine restarts, etc.?

There are a couple of potential answers I've found searching other questions here, but they don't feel 100% right (though I'll upvote explanations of why they might, in fact, be right):

• From How to setup Perfmon/Logman to get the Thread performance counters for only a specific IIS process? I get the impression that perhaps I could log all the "# Gen 0 Collections" counts for all the separate .NET apps on the machine, and then after the fact throw out the ones that were not relevant. But first I don't know how to log the counts for all apps (note: critically, you need "all the apps, regardless of when they were started", not "all the apps that were started when you set up your perfmon task"), and second I don't know how you'd retroactively tell which data in the logs corresponded to your particular webapp
• From How to make Perfmon automatically track same process for IIS with multiple sites? I get the impression that this could perhaps be solved with a script that kept going in and tweaking the perfmon counter settings every minute or so, based on the output of iisapp.vbs. But that doesn't seem like a very clean way to do it.

I'm running Tomcat using the tomcat6 package from Ubuntu 9.04, which makes a daemon out of Tomcat using jsvc. I'd like to know the proper way to set Java heap options like -Xmx for Tomcat. I'd like to put the configuration wherever is most stylistically correct, and wherever is least likely to be overwritten by Ubuntu package updates.

The options I see right now:

• Hard-code them somewhere in /etc/init.d/tomcat6.
• Hard-code them somewhere in /usr/share/tomcat6/bin/catalina.sh.
• Create a line in /usr/share/tomcat6/bin/startup.sh to set CATALINA_OPTS to have the desired flags, and then export CATALINA_OPTS as an environment variable. (This looks like it will get picked up by catalina.sh.)

The last option sounds like the best one, and it's advocated (without explanation of why) at Increasing Java's heapspace in Tomcat startup script. But I wanted to get a second opinion. Anyone want to confirm that there isn't a better way?

I was monitoring my JVM running Apache Tomcat 6, running on Windows, and I noticed that every 3 seconds or so the JVM process (C:\Tomcat\bin\tomcat6.exe) is polling to see whether or not

C:\Tomcatcat\java_pid3748.hprof

exists, where 3748 is the Windows process ID.

I haven't seen write to the hprof file, just test for existence.

(I'm using Sysinternals Process Monitor (procmon.exe) for this monitoring. In procmon the polling shows up as a QueryDirectory operation, which always returns Result "NO SUCH FILE".)

Is this normal, or is this a potential red flag? I gather that these hprof files are generated, perhaps among other times, when you enable the

-XX:+HeapDumpOnOutOfMemoryError

Java flag. I haven't enabled it myself, though I guess it could be enabled somehow in the Tomcat startup scripts.

I'm running Tomcat 6 under Windows, using the bundled Windows service runner. I seem to have the following behavior:

• If one of my webapps writes to stdout (via, say, System.out.println), then this output shows up verbatim in logs titled like stdout_xxx.log.
• If the jvm itself writes to stdout (as it does if you enable -XX:+PrintCompilation), then this output shows up in logs titled like jakarta_service_xxx.log.

Also, jakarta_service_xxx.log is not a direct dump of stdout; rather, something seems to be intercepting stdout and redirecting that through java logging. Thus whereas the JVM, running free of Tomcat, would normally print

283 s java.lang.StringBuffer::length (5 bytes)

what shows up in jakarta_service_xxx.log is this:

[2010-01-15 17:07:15] [info] 283
[2010-01-15 17:07:15] [info]  s    
[2010-01-15 17:07:15] [info]  java.lang.StringBuffer::
[2010-01-15 17:07:15] [info] l
[2010-01-15 17:07:15] [info] e
[2010-01-15 17:07:15] [info] n
[2010-01-15 17:07:15] [info] g
[2010-01-15 17:07:15] [info] t
[2010-01-15 17:07:15] [info] h
[2010-01-15 17:07:15] [info]  (5 bytes)

Can you clarify why stdout would be getting treated differently in the two cases? Alternatively, any hints on how to get the JVM output from -XX:+PrintCompilation to show up in stdout.log, instead of as the above craziness?

I have a huge directory on an NTFS file-system (i.e. a top-level directory containing tens or hundreds of millions of descendant nodes with the file nodes probably on average about three levels deep) that I need to change permissions for. In particular, I need to give a new user (or group) read-only access to absolutely everything in the directory tree.

The most obvious place to do this is in Windows Explorer by right-clicking the top-level directory and going to the security tab of the directory properties window. However, when trying the obvious things there Windows Explorer seems excited to recursively traverse the whole directory tree and try to modify something or other about the permissions of each node in the tree. This is extremely inefficient for such a large directory!

Can anyone offer any tips for changing permissions without this recursive descent? Do I need to click something particular in the GUI? Do I need to use command-line tools? Could this potentially be the result of a previous sysadmin doing something weird to the permissions in this directory?

I also need to enable network sharing and let the user/group mount the directory over the network. Haven't tried that yet, so I don't know if there will be a similar can of worms when I try to enable sharing.

This is on Windows 2008 Server if it matters.

EDIT: People are right that it probably makes more sense to give permission to a domain group rather than a particular account, so I've made note of this above (That's what I was doing anyway. I don't know why I specifically asked about adding a user in the original question. Sorry for the sloppiness). But of course adding a group to a folder's permissions list isn't any faster than adding a user (None of the existing groups are assigned read-only permissions).

I would like to know if you can make Sql Server look at incoming query strings and reject ones that match a certain pattern. In other words, for a certain class of queries (perhaps identified by a regular expression), I want to know if Sql Server could be made to return an error message rather than processing them as it normally would.

To be more concrete, and to give a potential use case, consider this description of a Sql Injection attack. If my website were under sustained attack from techniques along those lines, and if getting the website patched looked like a lengthy process, it would be tempting (if Sql allowed it) to try to get some provisional relief by putting something in Sql that basically said

If a query matches regex CAST(0x[0-9A-Za-z]{20,} then don't execute it!

My guess is that, if this sort of filtering is possible, then doing it would require writing some kind of custom Sql Server Add-In DLL. But maybe you can do something like this with Sql Server 2008's built-in auditing features? I really have no idea, and I'm not sure where in the documentation would be the best place to start looking.

If you want to point out why the database is a stupid place to try to block sql injection attacks, that's fine. But my primary question is not whether it's a good idea in this particular use case but whether this sort of query filtering/rejection is even possible.

I want to add a column to a Sql Server table with about 10M rows. I think this query would eventually finish adding the column I want:

alter table T
add mycol bit not null default 0

but it's been going for several hours already. Is there any shortcut to get a "not null default 0" column inserted into a large table? Or is this inherently really slow?

This is Sql Server 2000. Later on I have to do something similar on Sql Server 2008.