JohnB's questions

We have a policy of disallowing scripts and ActiveX controls to run on in IE our network (instead opting to use Firefox) thereby skirting a number of security issues dating back to IE 6, but we recently decided to purchase QuickBooks, which requires IE, scripts, and ActiveX controls. We aren't about to change our Firefox policy now, but we do need to get IE to play nice with QuickBooks without reducing IE security in general. So far our set up is as follows:

Trusted Sites Zone setting

• Enable "Allow active scripting"
• Enable "Run ActiveX controls and plugins"

The remaining settings are not configured. I've set the same settings to "prompt" for the internet zone for testing purposes, and I put the following in the "Site to Zone Assignment List":

Site to Zone Assignment List

• *.intuit.com : 2
• *.quickbooks.com : 2
• *.intuitmarket.com : 2
• *.payroll.com : 2

This has eliminated the majority of issues we have with prompts while using QuickBooks, but we are still getting prompts on a number of screens, and I can't figure out what could be causing them. For example, Quickbooks Forms Customization (I need to load the URL 2x before the forms page loads in IE) gives me both prompts:

• "Scripts are usually safe. Do you want to allow scripts to run?"
• "Do you want to allow software such as ActiveX controls and plug-ins to run?"

I've discussed the issue with QuickBooks support, but their support team was unhelpful. How can I get rid of the prompts?

I am setting up a backup system using the latest Backup Exec 2010 R3, and I would like to use usb hard drives as a backup media. I'm trying to figure out the best hassle-free way to introduce a disk rotation strategy into Backup Exec, but I'm coming up with the following problems:

Setup (simplified to address the problem at hand)

• Backup Exec 2010 R3 server on a Windows 2003 R2 server
• Use a different backup-to-disk folder for each day of the week
• Rotate external disks based on the day of the week

Using the built-in removable backup to disk option

This option has problems, because backup-to-disk folders are based on drive letters instead of disk IDs. That means that:

• More than one removable backup to disk drives cannot be assigned to the same drive letter.
• If drive letters are assigned to disks to permit the creation of multiple removable backup to disk drives, you can easily use up all available drive letters when creating a comprehensive year-round backup system. Additionally, special setup is required to prepare disks for use (assigning a drive letter) to a drive.
• If drive letter assignment gets re-arranged due to windows USB drive behavior, backup drives won't come online.

All this means that I don't have a straightforward way to link removable backup to disk folders to external drives.

Using a backup to disk setup

This setup seemed to work, at first, since Backup Exec was finding disks and using them. However, the system does not seem to care which physical disk to use for a backup, and creates backup to disk folders on the drives that have already been set up with other backup to disk folders. Imagine this scenario:

Backup Exec Devices:

• BED001
• BED002

Corresponding Physical Devices:

• PD001
• PD002

PD001 and PD002 are attached to the system to handle two days worth of backups. However, Backup Exec uses BED001 for both backups, and creates a new backup to disk folder on PD001 to handle the backup.

The BIG Question

The big question here is how do I set up the system to make it easy to identify which disk is needed in the event a restore operation is required to retrieve data from a specific date?

We have a small network that doesn't currently take advantage of IPv6, and I am in the process of introducing a windows 2008 server into the domain. I'd like it to eventually become our primary dns server. Our network is currently composed of a single Windows 2003 R2 domain controller.

After setting the Windows 2008 server up as a DNS server, I am getting the message,

DNS servers on Local Area Connection should include the loopback address, but not as first entry.

The IPv4 address is set up correctly with the primary DNS server as the first entry and the loopback address as the second, but I have never worked with IPv6 before, and the Windows server 2003 server doesn't have a IPv6 address (and I wouldn't mind leaving it that way for as long as possible - if it ain't broke don't fix it). Hence, the IPv6 configuration on the 2008 server only contains the loopback address in the DNS configuration of the network adapter.

My question then, has three parts:

1. Can (should?) I disable IPv6 on the 2008 server, or barring that,
2. Will the current setup affect Active Directory replication, or
3. Is it strongly encouraged to set up the 2003 server with an IPv6 address despite the size of our network (and how should I go about doing that?)

I'm working on setting up SSL on our WSUS server using a self signed certificate, but I'm running into trouble. Specifially, after running selfssl /n:CN=server.domain.local /t /v:365, and ensuring that Require Client Certificates is selected in the following directories:

• SimpleAuthWebService
• ServerSyncWebService
• DssAuthWebService
• ClientWebService
• APIRemoting30

I am receiving Event 120[2-5]2 upon running wsusutil.exe checkhealth. Basically, each of the directories I require the certificate on fails to work. What am I missing?

I'm looking for a way to grant limited access to the BE10d client: basically, I'd like to grant one of my users access to check on a job's status and (a limited number if possible) other BE management features. I know how to install the client already, but I don't want to give him access to the domain administrator. Can anyone point me in the right direction for setting up an account that can access the Backup Exec 10d interface?

we just got through a power outage. All our servers came back up properly, except out web server gives me this error when attempting to start apache:

# apachectl start
no listening sockets available, shutting down
Unable to open logs

I've verified that there are no processes using the port apache is configured to listen on, and I can't fine apache running in ps aux. Does anyone have any suggestions for troubleshooting this?