Eduard Florinescu's questions

I have two computers in the same domain that I use, recently I changed the domain password on one of them.

When I tried to login with the same account on the other machine I get:

The trust relationship between this workstation and the primary domain failed.

I knew that I can log with that account and the old password if I just disable the network connection. So I logged in with the network disabled and the old password and it work. If I try to refresh the trust by locking and unlocking this time with the network enabled I get the same:

The trust relationship between this workstation and the primary domain failed. 

If I disable again the network I can log in with the old password. If I enable afterwords the network connection I am able to see the domain dns, etc.

How to establish trust relationship from this situation without having access to domain control server?

I am not getting an IP in the subnet 10.0.0.0/24 where the DHCP is working and should serve an IP, I am getting instead only an IP in the subnet 169.254.0.0/16(link local address) that is probably given by Windows which runs on the laptop I am using to test this, which makes me think it might be a problem of the network firewall blocking the DHCP Discovery service.

And if that is caused by the firewall, which ports I should be opening for DHCP Discovery to work?

nmap -p 7000-7020 10.1.1.1

Will output all the filtered ports

Starting Nmap 6.40 ( http://nmap.org ) at 2015-03-04 12:18 EET
Nmap scan report for 10.1.1.1
Host is up (0.00091s latency).
PORT     STATE    SERVICE
7000/tcp filtered afs3-fileserver
7001/tcp filtered afs3-callback
7002/tcp filtered afs3-prserver
7003/tcp filtered afs3-vlserver
7004/tcp filtered afs3-kaserver
7005/tcp filtered afs3-volser
7006/tcp filtered afs3-errors
7007/tcp filtered afs3-bos
7008/tcp filtered afs3-update
7009/tcp filtered afs3-rmtsys
7010/tcp filtered ups-onlinet
7011/tcp filtered unknown
7012/tcp filtered unknown
7013/tcp filtered unknown
7014/tcp filtered unknown
7015/tcp filtered unknown
7016/tcp filtered unknown
7017/tcp filtered unknown
7018/tcp filtered unknown
7019/tcp filtered unknown
7020/tcp filtered unknown

Nmap done: 1 IP address (1 host up) scanned in 2.78 seconds

Is there a way that I can see what exactly is filtering those ports?

I encountered the following situation: The network I administer was blocked, and this was traced down to a specific rack, after I reseted both switches, everything worked.

I supposed it was the core switch so I replaced the core switch. It happened again and this time I reset the secondary switch which practically connects all the stations in that building to the network and it work. The topography simplified is like in the image below.

Can this happen, can a faulty secondary switch block an entire network, and how can I detect when there are similar problems and I have two cascaded switches, which one is the culprit?

There are news that an unpatchable and unfixable USB firmware exploit is "out there".

This could seem unrelated to servers but since the affected hardware from Phison is not disclosed there is a possibility of devices that are connected to an internal network could be infected or potentially vulnerable. This could be the worst nightmare for a network & system administrator, an ICT consultant, etc.

Is there a way to check if a USB devices has the potential BadUSB vulnerability, so that USB devices can be "vetted by the IT departments"?

I have a print server running Windows Server 2012 which is shared in a domain and is used by terminal services clients.

The domain network spans between countries using tunnels and in some situations the print server and the printers are not in the same physical network and in this situations when the network is busy big documents fail to print.

If I check the Print Queue Window I don't get very much data on what happens the only available fields displayed are Document Name Status Owner Pages Size Submitted Port

Sometimes Size is empty and Status doesn't give too much information. The only solution remaining is to select Cancel All Documents from that same Print Queue window and when some print job is stuck that usually doesn't work.

Is there a way for system administrators to better track and debug what happens with files stuck in the print spooler ?

In our organisation we have around 30 printers an we are currently connecting for the user all the printers using a logon script that calls the command line app con2prt for a series of printers.

 con2prt /c %1

But this has the great problem that many user can stop the script and that means they end up not having all the printers available.

Can I connect all the available network printers without using the logonscript or the command line app?

I have started with 3x250 GB SATA array, but the old HDDs failed one by one and when the spare parts came they where bigger disk inside and I recently ended up with 3 HDDs of 500 GB.

I see reported unused space 698.6GB, can I optimize the present configuration?

I am using SyncBack to mirror two shared folders on two separate shared folders(SMB) on two servers in the same trust domain.

I checked the option to copy also the folder rights:

 Copy sub-directory and file security permissions (only valid for NTFS)

The SyncBack job reported successful when finished. But I had history where some rights were not copied or some files were missing.

How can I audit if the copy/mirroring was successful, check all the files and the security permissions against its original copy?

I use terminal-server Windows Server 2012 when a user inside the terminal session deletes a file on a shared drive (R: here) and gets the error bellow:

Could not find this item
This is no longer located in
R:\SHARE\etc
Verify the item's location and try again

The file is there and the file is indeed deleted, but in order to see it deleted in explorer, you need to press the F5 button to refresh the screen.

Later edit:

It seems that this happens only for .xlsx files

This is, how can I reproduce the problem:

• create file in R:\SHARE. Call it test.xlsx

• when I try to delete the file, I get the error

• create file in R:\SHARE. Call it test.txt

• when I try to delete the file, no error is displayed

Why this false error happens and how can I fix this?

I am administering a network with many locations and work with multiple providers I checked out with my DNS provider to change the PTR records for one of the IPs, they replied:

Dear Sir,

We can not modify the PTR records of the IP addresses that you provided, because these IP addresses are not managed by ZZZZZZZ.

You will have to contact the provider of the IP addresses to modify the PTR records.

Is this general practice and PTR records can be added only by the ISP companies that manage the IPs, or is just the practice for this DNS provider?

I am using terminal-service server with Windows Server 2012 and we have two terminal servers share trough NLB, users connect to a terminal in the DOMAIN1 domain with Remote Desktop Connection (see picture below).

I need to map a network drive for the users in terminal to a share on another domain (DOMAIN2 which has the domain controller Windows Server 2003). I try creating a GPO in DOMAIN1 through DC1 (domain controller for DOMAIN1 with Windows Server 2012) to map the network drive.

DC1 and DOMAIN2 are physically connected in the same network.

How to map a network drive to a share in the other domain (DOMAIN2) on terminals in the main domain (DOMAIN1)?

I use terminal-server Windows Server 2012 and I need to create a map drive GPO, but it doesn't take effect and I think it might be because I nee to activate network discovery.

How to enable network discovery in GPO in Windows Server 2012?

We have two terminal-service server and we use Network Load Balancing (NLB) to cluster this two terminal-service servers together.

We need to have the same applications installed on the two servers, because if one user who uses the terminal is redirected to any other of the two servers need to have the same applications.

Is possible to synchronize installing of applications between the two terminal-service servers so that we could have the same applications on the two-severs?

This the diagram representing the topology of the configuration:

All the servers are running Windows Server 2012.

I need to setup PTR for a domain and lets say my domain is domain.com and I have my email addresses like [email protected].

I came over this mailing-list article that says:

The reverse entries for your nameserver don't have to match your mailserver name but they must be consistent, i.e. the reverse must resolve forward to the IP addresses.

Does this mean that I could have this PTR record:

44.33.22.11.in-addr.arpa  300  IN  PTR subdomain.domain.com.
88.77.66.55.in-addr.arpa  300  IN  PTR subdomain2.domain.com.

and this A records:

subdomain.domain.com.   3256    IN  A   11.22.33.44
subdomain2.domain.com.  3256    IN  A   55.66.77.88 

and it will work ?

Or do I need to have also:

domain.com. 3256    IN  A   11.22.33.44
domain.com. 3256    IN  A   55.66.77.88 

or

domain.com. 3256    IN  MX  subdomain.domain.com. 
domain.com. 3256    IN  MX  subdomain2.domain.com.

for everything to work?

I had the following error:

<[email protected]>: host yyyyyyyyyyyy.yyyyyyyyyyyyy.de[33.33.33.33] refused to
    talk to me: yyyyyyyyyyyy.yyyyyyyyyyyyy.de (mxeue106) Nemesis ESMTP Service not
    available 554-No SMTP service 554 invalid DNS PTR resource record

Evidently I need to set the PTR records, in this forum thread invalid DNS PTR record.... I see that :

whilst the IP is backwards, the numbers themselves are not

So if i have an IP like 22.33.44.55 I supposedly need to have this add:

55.44.33.22.in-addr.arpa  300  IN  PTR  www.dummy_domain.com

Is .in-addr.arpa suffix mandatory?

Also I have IPs that are not managed by the my DNS provider can I add those too to my IP?

Thanks

_{Note: IP and names here are not reflecting reality, 22.33.44.55 and www.dummy_domain.com are not mine and [email protected], yyyyyyyyyyyy.yyyyyyyyyyyyy.de, 33.33.33.33 are changed}

There are a lot of embedded Linux device that are built on Linux, that are used exactly for security purposes, like gateways, if I check OpenSSL I get:

openssl version -a

gets -»

OpenSSL 1.0.0k 5 Feb 2013

But this maybe patched or merged and I don't have access to the sources, how can I check that my system is not vulnerable without relying on openssl version -a

I have a backup service which stores the backup files in a share directory on a Windows server , but it fails and if I look in the logs I see this error:

13:02:13 AXSDBG notice tsrv-cmdqx(Backup->server)[30043] Result::_add(514) Connection to myfileserver failed (Error NT_STATUS_BAD_NETWORK_NAME)

13:02:13 AXSDBG notice tsrv-cmdqx(Backup->server)[30043] Result::_add(514) Connection to myfileserver failed (Error NT_STATUS_BAD_NETWORK_NAME), repeated 1 times

I googled it as saw this is a SAMBA error.

If I try to connect to myfileserver and path with the provided credential from a windows system it works.

How can I check why the services doesn't sees this name?