John Gardeniers's questions

I need to deploy a certificate to a mix of Windows machines, including XP, Win7, Server 2003 and 2008, for the purposes of using Locally Published Updates with WSUS. This is a Samba 3 network, so there are no GPO or similar tools available to me.

This question asks the same basic question but the OP in that case was able to utilise SCCM, which we don't have. Is there a viable way of doing this without the use of GPO or machine startup scripts (the implementation of which presents the same problems as I am currently facing)?

I'm trying to find a way to create a WSUS report of updates that have been approved for computer group A that have not been approved for one or more other groups. Alternatively, a tabular report that lists the approval status for each update and each group, so that it can be processed to extract what I need. There doesn't appear to be such a report in WSUS itself, or at least not one I can find, so a script to produce such a report would be most welcome.

When I add new machines built with cloned drives to the network the fact that they have the same SID doesn't present any problems, except for WSUS, which shows only one instance of the clones, normally the last one added, rather than each instance. With newsid no longer being readily available how do others manage this? Alternatively, I'd be very grateful if someone who still has a copy of newsid can share it with me.

So far I've only done the cloning with Windows XP, so can't say yet if the same problem exists with later versions, although I'll be doing this with Windows 7 in a couple of weeks.

Before anyone asks why I don't use Microsoft's "approved" method of cloning, these machines have a lot of applications that need to be installed and configured correctly, which doesn't work properly, if at all, with sysdiff or sysprep. Despite the "official" statement that newsid never really worked, those of us who have used it know differently.

I have a client who uses an application that uses *.fr3 files, which as far as I am aware are nothing more than binary files in a proprietary format. Those files are periodically emailed from the software company to my client. Using Outlook (2003 or 2010) the client can save the attachment and then copy the file to the application that uses them. No problems and nothing unusual so far.

When the client uses OWA (Exchange 2003), even on the same machine, and tries to save the attachments they result in zero byte files. The solution they have employed for those staff members who only have access via OWA has been to ask the software vendor to zip them up and resend them. This works fine as far as the file goes but involves extra steps and bother that shouldn't be required.

I can find nothing to explain why this only happens with *.fr3 files. All other attachments they receive, such as *.zip, *.pdf, *.doc(x), *.xls(x), etc. save perfectly. The anti-virus software (Avast) is not treating *.fr3 as anything special either.

Are *.fr3 files something special as far as OWA is concerned that I'm unaware of? How can I convince OWA to treat them the same as other file types, which all save without issue? This isn't a show-stopping problem but is just one of the annoyances I'm trying to clean up for the client.

I've discovered that one of the sites on our web server is having part certain URLs stripped away. Specifically, when a user clicks the link to display images as a slideshow the URL for that page has ?show=slide appended. Just that part is what is being stripped away.

Apart from this problem the site works correctly. Furthermore, the site used to work properly and I'm really not even sure at what point it broke, as I rarely visit it and the only thing that appears in my change log is updates to WordPress and its plugins.

I've confirmed that it's not caused by anything in the .htaccess file by installing an exact replica of the site on my dev server, from where it runs as expected. I've also duplicated the Apache virtualhost config for the site to the test server.

The only significant difference between the live and dev servers is that the former is Centos 5.5 and the other is Debian 6.0.

I'm stuck for ideas. If it's not the Apache virtualhost config or the .htaccess file, where else can I look for what might be causing this?

Update

Although to a mere human it did appear that part of the URL was being eaten up it turned out to be mod-rewrite and a 301 redirect. It was a case of misleading symptoms. The site in question runs WordPress with a number of plugins. The permalink rewriting for the main code and the permalink rewriting for one of the plugins didn't like each other and wouldn't play nicely together.

A bunch of uninstalling and reinstalling, together with turning permalinks off and on in various sequences finally got it all to work properly. As it happens, the part of the URL that was apparently disappearing was wrong anyway, resulting in a broken feature on the site.

I've recently replaced our aging (386) monitoring machine with something a bit more recent and because I had driver issues with CentOS I decided to use Debian 6 (Squeeze) instead. While in the past I've preferred to compile from source this time I thought I'd try to stick with apt and install packages that way.

I suppose it was inevitable that there are issues. Of main concern is that there appears to be no image support in GD with error messages such as this whenever I try to create an image in code (PHP or Perl):

 Can't locate object method "png" via package "GD::Image"

I can replace "png" with "jpg" or "gif", all result in the same error.

I can't locate any packages which look like they might add the needed graphic support. How can I resolve this without creating a dependency hell for myself?

EDIT

Based on the various comments below I've come to the conclusion that something is screwed with at least part of my GD installation, so the question now becomes: How can I uninstall the various parts and reinstall them without causing myself any more problems than I already have? Sadly, I'm not in a position to wipe this machine and start over.

Now I remember why I've previously stayed away from these package managers and the dependency nightmares they create. :(

I'm trying to set up time sync on a CentOS 5.5 VDS but can't figure out why it won't update to the correct timezone. e.g. After manually setting the correct date and time when I run this:

date && ntpdate au.pool.ntp.org && date

I get this:

Mon Oct 17 08:58:48 EDT 2011
16 Oct 17:58:01 ntpdate[14659]: step time server 202.60.94.11 offset -54048.345159 sec
Sun Oct 16 17:58:01 EDT 2011

etc/localtime has been replaced with a link to the Australia/Melbourne timezone file and `/etc/sysconfig/clock' has been edited accordingly. The server has been rebooted since those changes and appears to (at long last) be using the correct timezone, so why does ntpdate appear to be ignoring it?

Incidentally, rdate simply times out and I've yet to determine why. I also have the ntpd service installed but have it disabled until I get this issue sorted out.

According to the docs for AWStats:

AWStats can do reverse DNS lookups through a static DNS cache file that was previously created manually.

Searching through the docs, as well as a fair bit of Googling, leaves me with one question. How do I manually create the DNS cache file? Is there a Linux command to do this that I've yet to find? This is on a Centos 5.5 machine.

We have a VDS running CentOS 5.5 that was created and configured with the EDT timezone. I have replaced etc/localtime with a link pointing to the Australia/Melbourne (UTC+10) timezone file. Running the date command displays the correct date and time.

The problem is that cron jobs are being run as if the server was still using the EDT timezone, even after a reboot. e.g. A job that should have run at 1:01AM just ran at 3:01PM.

What have I missed?

Our company web sites have just been moved from a shared host to a VDS, as the hosting company plans on retiring the less than completely reliable shared hosting server(s).

The VDS only has 256MB of RAM and hosts a few sites, all but one of which are very simple static sites with just a few pages and combined serve less than 20-30 visitors per day.

Our primary site, which runs a somewhat customized version of OSCommerce, is also low traffic (rarely more than 10 or so concurrent users) but does require MySQL. Unfortunately, since the move mysqld keeps crashing due to insufficient memory. I've edited the Apache config a bit (to reduce the number of threads) to ease the load but that's only sidestepping the real issue.

The server has no swap space but it does have considerably more disk space than we require, so I'm thinking about using some of that space for swap. I know that won't exactly help performance but we can live with that.

How can I create a swap file and enable it while the server is running? The OS is CentOS 5.5 (final) and Linux is not my native tongue.

Update: For anyone who may be wondering about the results, since implementing the swap file as described by quanta the server has not only been stable, with no more crashes of mysqld, it is actually serving pages faster than it did before. The performance gain is contrary to what I expected but I'm delighted to be wrong in this instance.

We have several users using a shared account and when messages in that account's in box have been processed they are drag and dropped into a public folder. Is there a way to determine who dropped a mail item in an Exchange 2003 public folder, so that we can have some accountability?

I suspect this can't be done natively in Exchange, so if there is a scripted solution to this I'd be very interested.

I have a CentOS box running Apache 2.2.3 and compression is working fine on HTTP connections, with the relevant information being logged to a separate deflate log. However, no information is being logged for HTTPS connections. I believe this is because the compression is being negotiated at the SSL layer but I'm not completely certain.

Compression over HTTPS has been tested and verified using information from this site, so I know it's working. Of course that test doesn't really tell me anything useful about how well compression is working or for which browsers. As the site in question has no static content it's not easily tested without using a browser, so just faking user agent strings won't help much.

Is there a way I can get information about compression logged for HTTPS connections?

I need to add Nagios checks for Windows SQL services that have a dollar sign in the name (e.g. MSSQL$TOLLCONNECT) but am so far unable to work out how to pass that name along without it being Nagios treating it as a variable name. What is the simplest way to do this, other than modifying the service name itself, which would break other things?

I'm running NSClient++ on the target machines and have considered creating checks with hard-coded names but that idea leaves a lot to be desired, as it creates a maintenance nightmare.

I have the admin tools install on a Win 7 64 bit machine but would like to see the Exchange tabs in ADUC. Googling shows this is a popular request and the most common solution (and the only one which appears to work to all) is to install Exchange Server Management for Vista using esmvista.msi /q. That may well have worked on beta versions of Win 7 but is definitely not working with my OEM copy of Win 7.

Can this perhaps be made to work by installing from an Exchange 2007 CD (which I don't have at this time), bearing in mind that we have Exchange 2003 only? Can someone please offer a solution that works? I figure some of you must have solved this by now.

Edit: I don't know if this is relevant or not but the Win 7 machine is also running Office 2010 Pro.

About the bounty I had intended to award the bounty to gWaldo for having taken the extra steps to try to help me with this issue. However, as I was about to do so my screen started scrolling and I actually clicked on the answer posted by natxo asenjo, whose answer offended me, without realising it. Perhaps if I wasn't rushing I might have noticed but that's now history.

When viewing the list of network computers in Windows Explorer on a Win 7 machine there appears to be no way of readily seeing the description field, which makes that pretty well useless. I believe this problem started with Vista but I'm seeing it for the first time because I was fortunate enough to skip over Vista.

We're currently rolling out Win 7 on new boxes and although I'm changing the naming system to something more sensible, the old boxes have names such as FWS01, FWS02, etc. Managing a network of computers with such names is made more difficult when you can't readily see who's machine each one is.

Googling the problem brought up a workaround involving creating a shortcut on an XP machine and copying that to the Win 7 box but that's a long way from ideal. Is there some kind of hack that can be applied to machines, the operator of which needs to be able to see the description field?

We have a staff member in sales who has gone onto a 4 day week (getting ready for retirement), so each Thursday afternoon her email needs to be forwarded to another user and each Friday afternoon it needs to be set back.

I'm using the VBS script below to do this, run via the Task Scheduler. Although the script appears to do it's job, based on what I see when I view the user's Exchange settings, Exchange doesn't always recognise that the setting has changed. e.g. Last Thursday the forwarding was a enabled and worked correctly. On Friday the script did it's thing to clear the forwarding but Exchange continued to forward messages all weekend.

I found that I can force Exchange to honour the changed setting be merely opening and closing the user's properties in ADUC. Of course I don't want to have to do that. Is there a non-manual way I can have Exchange read and honour the setting?

The script (VBS):

' Call this script with the following parameters:
'
' SrcUser       - The logon ID of the suer who's account is to be modified
' DstUser       - The logon account of the person to who mail is to be forwarded
'                           Use "reset" to clear the email forwarding

SrcUser = WScript.Arguments.Item(0)
DstUser = WScript.Arguments.Item(1)

SourceUser = SearchDistinguishedName(SrcUser) 'The user login name
Set objUser = GetObject("LDAP://" & SourceUser)

If DstUser = "reset" then
objUser.PutEx 1, "altRecipient", ""
Else
ForwardTo = SearchDistinguishedName(DstUser)' The contact common name
objUser.Put "AltRecipient", ForwardTo
End If

objUser.SetInfo

Public Function SearchDistinguishedName(ByVal vSAN)
Dim oRootDSE, oConnection, oCommand, oRecordSet

    Set oRootDSE = GetObject("LDAP://rootDSE")
    Set oConnection = CreateObject("ADODB.Connection")
    oConnection.Open "Provider=ADsDSOObject;"
    Set oCommand = CreateObject("ADODB.Command")
    oCommand.ActiveConnection = oConnection
    oCommand.CommandText = "<LDAP://" & oRootDSE.get("defaultNamingContext") & ">;(&(objectCategory=User)(samAccountName=" & vSAN & "));distinguishedName;subtree"
    Set oRecordSet = oCommand.Execute
    On Error Resume Next
    SearchDistinguishedName = oRecordSet.Fields("DistinguishedName")
    On Error GoTo 0
    oConnection.Close
    Set oRecordSet = Nothing
    Set oCommand = Nothing
    Set oConnection = Nothing
    Set oRootDSE = Nothing
End Function

Edit:

If someone has another way to achieve the same goal (scheduled forwarding and cancellation of same) I'm open to suggestions. Surely this need has been encountered and met before.

Update:

For reasons I won't even try to guess, without changing anything the script system has been working almost completely reliable for some time. Over the last 3 or 4 months it has only failed once.

On a machine with multiple NICs, running either Windows or Linux, is it possible to dedicate a NIC to a VM such that the host won't even try to use it for itself? I suspect it isn't even possible but if it is, which OS and version and just how would I set it up?

The reason for this, apart from academic curiosity, is that I'm trying to set up a network lab for testing purposes. I currently have only a single spare machine, otherwise this wouldn't be an issue. One of the VMs will be the firewall for this lab network, so will need a dedicated NIC for the WAN interface. Neither ESXi nor Xen server will run on the machine, so I have to use a host OS.

Scenario: Two Windows Server 2003 machines running RRAS VPNs. The firewall port forwards 1723 to one of those machines for normal remote access. I'd like to find a way to connect to the second machine as well. Not because I need to but just because it's the sort of thing I reckon should be possible but can't figure out how to do.

Is it possible to have the Windows PPTP VPN client (on XP in this instance) connect on a port other than 1723? If so, I can simply port forward another port to the second server. I've done a fair bit of Googling over the last few days and have only found others asking the same question but no answers.

I have of course tried to add a port number in the host name or IP connection box, in various formats, but to no avail. While this might be possible with a third part client I'm really only interested in whether or not it can be done with the Windows built-in client and if so how?. Perhaps there's a registry hack I'm not aware of?

Reading this question got me to wondering. Assuming screen is not being used. If an SSH session on a Linux target is dropped, for whatever reason, and you reconnect before the server kills the session because of timeout, is it possible to regain control of the running command such that it will not be aborted because of the broken session?

From time to time I eject a USB device, generally a memory stick or external HDD, when I think I have finished transferring data only to realise there's something else I need to do with it. Normally this involves nothing more than unplugging the device and plugging it back in. What about if I'm doing the work from remote? Is there a command I can run that will have Windows re-detect and mount the device?

Update:

Thanks to all who responded.

Although some of the suggested methods will work they also cause problems if another device is connected via the same hub. Others, such as devcon, may well work for others but failed for me, although I don't know why not and won't be investigating it any further.

I would have preferred not to have to rely on a commercial product but Safelyremove, suggested in the accepted answer, worked so well in my tests I consider it a keeper.