Windows OS

Patch Tuesday today.
A good time to manually sync your WSUS server now that they have been released and get those boxes up to date, at least your test network, before you go hog wild on your production boxes.

Thankfully nothing 'CNN crashing'-worthy this month.

http://www.microsoft.com/technet/security/bulletin/ms05-oct.mspx

Most people won't run into this until they start deploying more 64-bit servers and ASP.NET programs, but I might be running into this issue below on one of my newer 64-bit boxes.

[snip]

64-Bit Components

On a 64-bit version of Microsoft Windows, it is possible to run 32-bit applications using the WOW64 emulator. However, processes can only be 32-bit or 64-bit. You cannot have a process that runs both.

Internet Information Services (IIS) runs as a 64-bit application on 64-bit versions of Windows. The process type of a COM component must match the IIS worker process type. It is possible to run 32-bit components on the 64-bit version of IIS using one of the following solutions:

* Configure the COM component as a COM+ application so that it runs in Dllhost.exe.
* Configure IIS to run 32-bit applications. This option affects all applications on the IIS server. For more information, see Appendix D: Running 32-bit Applications on 64-bit Windows (IIS 6.0) in the IIS Deployment Guide.

It is recommended that you convert your components to 64-bit. In the case of Visual Basic components, this is not possible because there is no 64-bit version of the Visual Basic compiler.

[/snip]

Of course this is very unsupported and I bet MS would laugh at you if you called and complained that something didn't work right, but if I ever run MCE, I know it's going to be a member of a Domain.. whether a real AD domain or a Samba domain. I even left in the Google search markups since I'm in a hurry

Trolled from the SBS/MCE newsgroups from 'Stu':

[snip]

Hi gang,

As with everything like this - BE CAREFUL. I have done this and it does
work, although I now have a dedicated server for 3 MCE boxes on their own
workgroup - so I don't use it anymore.

Also, be aware of issues if you use My Documents redirection in SBS. In
that case, I would consider not using redirection, or using TweakUI to
change your MCE box's My Music etc... locations. Otherwise, the poor SBS
box will be syncing your music library, video library and photo library all
the time. Not too efficient if the library is big!

Good luck and let us know how you do.

Stu

Here's the hack:

Insert Windows XP CD.

Start > Run > X:\i386\winnt32.exe /cmdcons
(replace X: with the appropiate drive letter)

Acknowledge prompt by clicking 'Yes'.

Skip updating process by clicking 'Cancel' or by pressing 'Esc'

After installation, acknowledge success msg. by clicking 'Ok'

Start > Shutdown > Restart

At boot menu, select 'Microsoft Windows Recovery Console'

Select proper installation to log onto (default: 1) and press 'Enter'
(If prompted, enter Administrator password and press 'Enter')

Type (without quotes) and press enter: 'cd system32\config'

Type (without quotes) and press enter: 'copy SYSTEM C:\'

Type (without quotes) and press enter: exit

At boot menu, select 'Windows XP Media Center Edition'

Start > Run > Type: 'regedit' and press enter

Click on 'HKEY_LOCAL_MACHINE'.

File > Load Hive...

Browse and select C:\SYSTEM

Specify key name 'BANANA' and click OK

Expand: HKEY_LOCAL_MACHINE > BANANA > WPA > MedCtrUpg

On the right-hand side, double-click IsLegacyMCE value

Change selected value to 1 and click Ok. (THAT IS NOT AN L!)

Click on BANANA subkey (under HKEY_LOCAL_MACHINE).

File > Unload Hive. Confirm.

Start > Shutdown > Restart

At boot menu, select 'Microsoft Windows Recovery Console'

Select proper installation to log onto (default: 1) and press 'Enter'
(If prompted, enter Administrator password and press 'Enter')

Type (without quotes) and press enter: 'cd \'

Type (without quotes) and press enter: 'copy SYSTEM
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM'
(Yes, you want to overwrite - Go ahead and do it)

Type (without quotes) and press enter: 'del SYSTEM'

Type (without quotes) and press enter: 'exit'

At boot menu, select 'Windows XP Media Center Edition'

Join domain.

[/snip]

When an HP T700 or HP XR5500
Uninterruptible Power Supply (UPS) is connected to a ProLiant ML150 G2
server through the serial port using a serial cable, the CPU
utilization will remain constant at 100 percent. As soon as the serial
cable is removed, the CPU utilization immediately returns to normal
levels.

Any ProLiant ML150 G2 server running
System ROM Version 1.10 (or earlier)Â and is connected to a HP T700 or
HP XR5500 Uninterruptible Power Supply (UPS) via a serial cable.

To prevent the processor utilization
from immediately increasing to 100 percent when a UPS is connected to
the serial port, upgrade the ProLiant ML150 G2 System ROM using the Single Point Solution Systems ROMPaq Firmware Upgrade Diskette for HP ProLiant ML150 G2 Servers, available at the following URL:

ftp://ftp.compaq.com/pub/softpaq/sp31001-31500/SP31081.TXT

ftp://ftp.compaq.com/pub/softpaq/sp31001-31500/SP31081.EXE

Originally from: http://msmvps.com/bradley/archive/2005/10/09/69944.aspx

O20 - AppInit_DLLs: tzthmn29jnzuke1.dll.dll.dll.dll.dll.dll.dll.dll

[note to reader: It's part of a trojan]

Yep. I know lots of DLLs that are named that. In other news, 9 patches come out next Tuesday. I'm ready for the next round of regression testing so those patches don't hamper our custom apps. In theory, they shouldn't, in practice, sometimes, they do.

For some reason (I'm guessing it is an esoteric bug if the session ID is other than 0 and/or not having to "worry" about multiple user issues), Peachtree 2006 will not install any updates if you are connected into it with Terminal Services.

Ah yes.. but the server in question is running Windows 2003, so I was sneaky and connected into the console session instead and installed the updates that way.

I don't like physically logging into headless machines, miles away, if I don't have to.

Edit: I see why, it uses RTPatch to do the dirty work. The same program (at least in Windows form) of the old patch utilities a lot of games like Doom used way back when.

To: bugtraq (at) securityfocus (dot) com [email concealed]

Shamelessly stolen from: http://blogs.technet.com/technetwebcasts/archive/2005/10/05/412094.aspx

Did you know that there is a new version of Windows Server 2003 coming? Did you know there are new features coming in Windows Server 2003 that will help you extend your connectivity and control your management costs? Windows Server 2003 R2 is almost here. In this webcast series for IT professionals, Microsoft subject matter experts walk through the new R2 enhancements.

http://technet2.microsoft.com/windowsserver/en/r2webcasts.mspx

See also:

http://blogs.technet.com/kevinremde/archive/2005/10/05/412078.aspx

Note to self: Run on any Dell 2003 box before we take them to SP1.

I found this problem by accident when we had to get a machine up to date with Security patches.

If you've installed Windows 2003 SP1 on a Dell PowerEdge server that came from the factory with Windows 2003 RTM on it, you've probably already downloaded this update. The dreaded blue screen on bootup of "Stop 0x00000051 (REGISTRY_ERROR)".

If not, you really need to take a look at http://support.microsoft.com/kb/898792 before upgrading.

Microsoft's fix:

http://www.microsoft.com/downloads/details.aspx?FamilyId=B16BE1A3-A567-40EE-9012-EEC238C000AE&displaylang=en

Treats it just like NTFS or FAT drives...

http://www.fs-driver.org/index.html

Adobe doesn't support 64-bit yet but this product does - and it runs under 32-bit just fine.

http://www.docudesk.com/deskPDF_Professional.asp

Think of SVCHOST under Win 2000/2003/XP much like inetd under unix - same principle - sort of.

The services that are launched (and seem to eat up a lot of non paged pool ram on some misbehaving servers) are located under:

HKLM\Software\Microsoft\WindowsNT\CurrentVersion\svchost

If you want to get tricky you can run multiple copies so it isn't an 'all or nothing' service failure:

Details here:
http://blogs.msdn.com/danvdw/archive/2003/09/26/51956.aspx

From a command prompt in XP [or 200x], to backup your file associations:

FTYPE >backup_types.txt
ASSOC >backup_ext.txt

This will create 2 files which can be used to restore the file associations later with:

FOR /F "tokens=* delims=" %G IN (backup_types.txt) DO FTYPE %G
FOR /F "tokens=* delims=" %G IN (backup_ext.txt) DO ASSOC %G

This will recreate the CLASS ID's in the registry at HKCR\.
If you put the commands above in a batch file change the %G to %%G

Click below for a list of 4 character non-paged pool reference IDs, which helps you track and trace memory leaks in Windows.

Can you tell I've been memory leak hunting on some of our hosted servers lately?