Detritus Maximus's questions

The scenario is corporate laptop usage for users when they are off-site and "off the clock." The policy is that the hardware can be used for personal use, but not for things such as:

• finding another job
• hate speech
• porn

<***detail addition:> there is no willingness to depart from MS OS and at least some users having local admin access. The nature of the off-site work absolutely requires this.< /***detail>

Are there any good sources (with statistical data) I can refer to to make the case that it is not beneficial to even try--providing effective on-site policy and hw is in place?

What is the overall trend--how is it handled in your environment?

What are some software applications available out there that can track usage? How easily can they be circumvented?

I have a CentOS 5 server that is file hosting by samba on a small network of 25 or so desktop server 2003 environment. Every night, a folder on one of the samba shares of this server is mysteriously disappearing. Every day we restore from a backup, but every night it disappears. The samba config is thus:

    read only = No
    guest ok = Yes

The permissions for the folder itself is wide open. I think there might be a scheduled task on one of the desktops that is deleting it, but I don't know how to be sure. Is there a way to determine what is happening to the folder every night?

Here are 5 Server 2003 User CALs

Here are 5 Terminal Server 2003 User CALs

apart from the price disparity, what is the difference?

We recently lost our domains win2k3 enterprise server where users offline files were stored. Every user's My Documents folder was redirected to this server and the user's files were synchronized to this server at logoff and logon. We have a replacement server now, but none of the settings in group policy are configured for offline files, yet still errors at logoff/logon. What is configuring each users folder redirection and file sync to the old server?

There was a backup DC in place when the main server went down, so it isn't possible the group policy settings were wiped out. I personally installed many of the desktops and the folder redirection and file sync were not manually configured at install.

I have a user logon script that copies a file over to a subfolder of the current user's profile path:

Script (only showing the line that isn't working):

copy /Y c:\records\javasettings_Windows_x86.xml "%USERPROFILE%\Application Data\OpenOffice.org\3\user\config">>c:\records\OOo3%USERNAME%.txt 2>&1

To diagnose why it wasn't working, I did a >somelogfile.log parameter on the group policy script and found that what the above command is translating to is this:

C:\WINDOWS>copy /Y c:\records\javasettings_Windows_x86.xml "C:\Documents and Settings\test2\Application Data\OpenOffice.org\3\user\config" 1>>c:\records\OOo3test2.txt 2>&1

So the question is, how do I get rid of (exorcise) the " 1" in that line?

Update 1:

So the reason the script wasn't working was that the creator didn't have any permissions on the directory. I fixed the permissions, and now the file works but! I still have the " 1" showing on all the logs and would like to know why.

When I run psexec to the user desktop (xp pro) I get "There is a time and/or date difference between the client and the server." I also get "access denied" when I run the at \clientname time /interactive "net time \server /set /y" command. I cannot access the machine from my win2k3 server's AD Users and Computers utilities.

Is going to the machine the only way to remedy?

Clarify: Going to the machine and doing the net time command works, but I want a remote solution please.

POST SOLUTION DETAIL:

Thanks to Kyle for the local account psexec solution, I was able to achieve an all-remote fix. In my network, all pc's have the same local administrator account with the same password. Kyle's remote solution appeared to fail at first, but this was because we also had an active domain administrator account with the exact same login credentials. Once I disabled that account, I was able to psexec using the local admin credentials:

>psexec \\systemname -u Administrator cmd

Oddly, once I was in with psexec, I could not do time or net time no matter how hard I tried. I would even do net time remotely and it appeared to work, but when I looked reviewed the "at" commands locally it showed it "could not start."

However, I did notice that once I had made a successful remote connection using the local admin account, I was now able to do regular psexec using my personal domain account as well as entering the system name into explorer like this:

Now that I could access scheduled tasks remotely, I simply made a net time scheduled task using my domain admin account credentials with this run line:

net time \\servername /set /yes

did a right-click>run and that was that. With this seeming so bizarre, I experimented on another desktop by setting the time off, duplicating the previous "There is a time and/or date difference between the client and server" condition and then applying the same fix described successfully!

This document for one of our servers says:

I/O Slots 4 PCIe x 8 (x4 routing), 1 PCIe x 16 (x8 routing)

What does the routing mean? Does it mean the card in the x8 slot can only run a x4? That is what I fear from reading this bit in the Wikipedia write up, yet it doesn't use the term "routing."

We have a couple servers hosting Citrix VM's. We are planning on adding SAN storage to our network so that we can do the quick migration and high availability thing. The question comes up with deciding what NICs to buy for the servers. We have scads of available pci(e) slots on the servers, so density is not a factor. We're not going to do 10Gbs.

The concerns are gigabit, jumbo frame support (which any old nic is apparently capable of) and making sure none of the processing load is put on the server itself (no softmodem type deal).

I see some nics advertise "copper connection." Is there any benefit to that? What other options should I not compromise on?

Wouldn't it be preferred to have single port nics over dual for redundancy purposes? That's kinda what I gathered from this SF thread.

The San setup we're looking at if anyone's interested:

Clariion: http://www.emc.com/collateral/hardware/data-sheet/h4097-clariion-ax4-ds.pdf (data sheet) http://www.tigerdirect.com/applications/SearchTools/item-details.asp?EdpNo=6076470 $9679.99

OR

Dell: http://www.dell.com/us/business/p/powervault-md3200i/pd?refid=powervault-md3200i&baynote_bnrank=0&baynote_irrank=1&~ck=dellSearch $10,749 (not configured as printed--baseline 1tb) $12,905.00 (8tb configured)

Managed Switch: http://www.newegg.com/Product/Product.aspx?Item=N82E16833122074 x1 $599 OR http://www.tigerdirect.com/applications/SearchTools/item-details.asp?EdpNo=3334993&sku=C50-2162 x1 $350

Edit: to clarify the intent of the SAN setup, the illustration below shows the added isolated network we are adding on for the storage for the 2 xen servers. We don't (I believe) need a fancy switch, just one with jumbo frame capability, standard management features and vlan capability:

Ok, maybe not selling your soul, but so far Dell has had me fill out a quote form explaining all sorts of details as to what my needs are. I fill it out and send it in stressing that all I want is a baseline quote of both the PS4000X and PS4000E with 6TB of storage and I get a call 5 minutes later with some rep asking me the same questions (plus some) in the quote form that I already sent in. She couldn't even tell me the price but said some "storage specialist" would be calling me in 24 hours.

Where can I go to just get the price of what I want without all this garbage? Here's some of the q's on the form:

How do you currently backup your data?

How long can you afford to be down if something happened to your server?

Do you have any legal requirements on how long you must archive your data? (HIPPA regulations, etc)

Do you need a rack or tower server? (Please choose one)

What is more important, current technology and expandability or price?

Is there a budget you need to stay within?

How soon are you needing the server?

Here's the link to one of the 2 models.

Extremely frustrating. Why can't they just configure to order like they do their workstations?

That question isn't that important. What I really want to know is, is there somewhere I can go--a reseller maybe--that will just quote me what I want without all this hassle?

Both servers are CentOS 5.4 with MySQL, Ruby, Rails, Phusion Passenger and Apache. I simply tar'd the original app as it sat in /var/www and untar'd it on the new server at the same loc. I ran

rake db:migrate RAILS_ENV=production

restarted httpd but cannot get anything but the default apache page.

I have a vhosts conf:

/etc/httpd/conf/vhosts/tutorials.conf

that matches the original and I edited my httpd.conf appropriately.

Is it possible to do what I'm trying to do? Is there a step-by-step out there for this particular scenario?

How do I export table "practices" from db1 into db2? How do I do all tables from db1 into db2?

With Mysql, fill in the blank. What do I type at the prompt:

Mysql>

CentOS 5.4, with IP tables stopped, I can do it. What's the line I need to add to IPtables so I can keep it on and have remote (domain) access to the mysql databases?

my current table:

# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.1/24 -m state --state NEW -m udp -p udp --dport 137 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.1/24 -m state --state NEW -m udp -p udp --dport 138 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.1/24 -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.1/24 -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.1/24 -m state --state NEW -m udp -p udp --dport 445 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

I've seen stuff on how to enable remote access, but never how to restrict it so that users cannot make any changes. I tried doing this:

mysql> create user 'dude'@'boingoboingo.local' IDENTIFIED BY '007'; Query OK, 0 rows affected (0.00 sec)

This user cannot access any databases remotely. What do I need to grant for read only.