Robbie

I’m studying on BranchCache and needed a way to simulate a low speed WAN connection. I found someone who referenced a tool written by some guy who works for Microsoft called the Network Emulator for Windows Toolkit.  It allows you to simulate just about any kind of network connection or network level of reliability.

You want a connection with 60ms response time, 2% packet loss and 512k down and 128k?  You got it.  I took a few sample screenshots from the product as I was testing it out:

Read more

I have been playing around with Dynamic Access Control in Windows Server 2012 for a few hours now and finally got it doing something useful. I wanted to document in broad terms what steps were needed to configure DAC:

• Edit your default Domain Controllers policy and enable support for Claims
  
  • Claims are essentially the ability to perform authentication look ups based on any attribute stored in Active Directory
    
  • Computer Configuration / Policies / Administrative Templates / System / KDC / KDC support for claims, compound authentication and Kerberos armoring = Enabled
    

     

• Open up the Active Directory Administrative Center and go to Dynamic Access Control section
  
  • Select Claims Type
    
  • Create a new claim type for the AD attribute you want to authenticate with (ie Job title)
    • Select the AD attribute from the existing list, give it a friendly name and set the Suggested Values to what you’re going to look up
  • Select Resource Properties next and go to New / Reference Resource Property
    • Choose the claim type you created before and assign it either a multi-value choice (This will allow you to perform more complex logic later on)
  • The reason for creating these claim types and resource properties is so that they are selectable on any of your File Servers with the FSRM role installed automatically
  • In order to push them out, go to Resource Property Lists, edit the Global Resource Property List and add the resource properties you created
  • Next Select Central Access Rules and create a new rule. Under Target Resources, assign the resource property you created. This will mean this rule will apply to any objects that have this classification configured
  • Under Current Permissions, press Edit and apply permissions using Conditions similar to what you see below. Note for the Principal, use Authenticated Users. That means this will apply to everyone for the restrictions
    • It’s obvious this can get insanely granular and therefore it’s up to us as administrators to exercise significant restraint at every opportunity. Just because you can, doesn’t mean you should

  

Read more

This HOWTO describes the process of configuring a Citrix Netscaler to monitor for a keyword on a load balanced website and if that key word is not found (ie the node has failed), remove it.  Once removed, continue scanning and once the node is back up, read it.

• The foundational technology we use here is called a “Monitor” which in Citrix parlance is a entity that can be used to repeatedly check some condition against some service
• While you can configure monitors from the GUI, it turns out the GUI adds some random carriage returns that breaks the entire process so you have to do it from the CLI
• So first you want to putty into the Netscaler.  Once logged in, you can type “shell” to access the full linux command line.  In our case, we don’t want to do that as we are running Netscaler specific commands
• Create a new monitor using the command:

add lb monitor [monitorname] TCP-ECV -send “GET / HTTP/1.1\r\nHost:[hostheadername]\r\nConnection:Close\r\n\r\n” -recv [Keywordtosearchfor] -LRTM ENABLED

• What this command does is:
  • creates a monitor called monitorname and makes it based on the built in template “TCP-ECV”.  The arguments provided to the –send parameter tell it what to send to the IP address you’ll configure later.  (You can probably configure it on the same line but I don’t know how to do that yet).
  • The GET / says get the root page.  So in this case, hostheadername doesn’t have an index.html or anything on the end so we can simply request the root page.
  • Because we are using host headers, we have to provide the host we are looking to connect to.  (This was the hardest part to figure out).  You’ll note the line remarks for \r and \n.  Those are critical as they must follow the HTTP standard.
  • The “connection close” close the connection after you obtained the information you needed so you don’t leave it hanging open.
  • Keywordtosearchfor is the string we’re looking for in the results to determine if the page is serving the content you expect or not.
  • The LRTM stands for “Least Response Time using Monitoring”.  I don’t know what it does but it seems like I need it.

  Read more

I was troubleshooting a low disk space alarm on a server.  After running TreeSizeFree, I discovered that the bulk of the space was in use in the Recycling bin which is stored in a hidden directory called #:\RECYCLER (I say # because on exists on each drive present in the machine).

You’ll note however that windows doesn’t store the username that deleted the files but rather the SID of the user.  Now one could argue that if it’s in the recycle bin already then that’s tantamount to bringing your garbage to the curb and thus can be removed at any time.  With that said, I still like to confirm the data first with the user if possible, mostly so I can explain the importance of either using “shift-delete” to permanently delete data or by regularly emptying the recycle bin.  An ounce of prevention and all that.

At any rate, I now have the requirement of understanding just who S-1-5-21-77810565-118882789-1848903544-39792 actually is.

It turns out you can run a vbs script to tell you that.  (Source code below)

When you double click on from explorer, you’ll be given a Windows message box.  Copy and paste the SID here and press OK:

Read more

This HOWTO will allow you to accomplish the following tasks using Macrium Reflect:

– Detect if a external NAS device is powered on and if not, power it on for the duration of the backup and power it down again
– Wait for the web management interface of the NAS device to come online before starting the backup
– Use Powershell to connect to the ISCSI target by verifying several characteristics of the NAS and assign it to a known drive letter
– Start a Reflect Backup and write to this data store

Click below read more link to check out the full source code!

Read more