joystick junkie

Boot from VHD is Wicked Awesome

2012-02-07T10:56:00.011-05:00

Boot from VHD is a great technology that enables you to host multiple self-contained operating systems on a single hard drive. Similar to dual-booting, but you don't have to worry about installing applications over each other or overwriting program file updates because your secondary OS is fully contained within a single virtual hard disk file.

As someone who spends a lot of time at customer sites, I find this invaluable to maintaining a clean, portable secondary environment. My boot-from-vhd enviornment can be joined/disjoined from customer domains without affecting my corporate laptop build; I can run beta apps and install troubleshooting tools without jeopardizing the stability of my daily work computer.

For my installation, I'm using Windows 7 Ultimate as my primary host computer and will install Windows 2008 R2 inside my VM environment.

Requirements:
- Windows Automated Install Kit (necessary for ImageX)
- Windows 2008 R2 Physical Media (or ISO + utility such as Virtual CloneDrive to mount it)

Now, some of you will probaby grumble about needing to download the whole 1.3GB+ WAIK package for less than 1MB of software necessary to perform this task. It does seem ridiculous, that Microsoft has not made it available separately for this specific purpose (and, since WAIK is a free download, most people don't see why you can't just get the tools you need out of it). If you search around, you can find the ImageX pieces available, such as here or here.

If you want to install just the ImageX componets, you need:
- imagex.exe
- intlcfg.exe
- vsp1cln.exe
- wimfltr.inf
- wimfltr.sys
- wimgapi.dll

Extract the files from such a download to C:\Windows\System32; copy wimfltr.sys to C:\Windows\System32\drivers, and then right-click > Install on wimfltr.inf.

Alternatively, download and install WAIK.

Moving on ...

Create a Directory to Store VHDs

From Windows Explorer, create a new directory (I used C:\VHD).
Yep, that's it.

Create a VHD

On the start menu, click Start, type in cmd, and then press Ctrl+Shift+Enter to start an Elevated Command Prompt. right-click Computer, and then click Manage.
In the User Account Control dialog box, click Yes.
Type compmgmt.msc and press Enter.
In the left pane of the Computer Management console, click Disk Management.
In the right pane, click More Actions, and then click Create VHD.
On the Create and attach Virtual Hard Disk page, specify the location as C:\VHD\Windows2008R2.vhd, the virtual hard disk size as at 50GB, and then set the virtual hard disk format to Fixed or Dynamically expanding (depending on your preference). If it's not something you're going to use often, you can use a Dynamically Expanding VHD to save space. If you choose Fixed, you're going to have to wait for the entire 50GB (or whatever size file it is) VHD to be formatted.
Click OK.
In Disk Management, right-click the newly-created 50 GB disk, and then select Initialize Disk.
On the Initialize Disk page, verify that the VHD is selected. Choose MBR as the partition style, and then click OK.
Once the disk is initialized, right-click the unallocated space of the disk, and then select New Simple Volume.
When the Welcome to the New Simple Volume Wizard starts, click Next.
On the Specify Volume Size page, leave the default values to use the entire disk, and then click Next.
In the Assign Drive Letter or Path list, choose an unused drive letter (I chose V:), and then click Next.
Under Format this volume with the following settings, specify NTFS for the file system, use the default Allocation unit size, specify a volume name Next.
On the Completing the New Simple Volume Wizard page, click Finish.

Mount the Windows Server 2008 R2 Media (If Necessary)

This example uses Slysoft Virtual CloneDrive

Navigate to the folder where you have downloaded the Windows 2008 R2 media.
Right-click the ISO file, and then select Mount (Virtual CloneDrive E:), where E: is the virtual DVD-ROM letter. Mine just so happens to be E:.

Apply the Windows Server 2008 R2 Image to the VHD

Go back to your Elevated Command Prompt (or launch a new one).
Run the following command to determine which Windows Server edition you wish to use:
dism /Get-Wiminfo /Wimfile:"E:\Sources\install.wim"
Select an index number that corresponds to the edition that you wish to install. In my case, I chose Index 3.
Run the following command to apply the installation image in the appropriate index to the VHD that is currently mounted as V:\:
imagex /apply "E:\Sources\install.wim" 3 v:

Update the Boot Configuration Data

We'll use BCDEdit /copy to use the current boot configuration entry as the starting point for our new entry.

Run the following command from your Elevated Command Prompt:
bcdedit /copy {current} /d "Windows 2008 R2 VHD Boot"
Copy the newly-created GUID to the clipboard.
Run the following commands (using the new GUID) to instruct the Boot Manager where to look for the VHD:
bcdedit /set {enter-new-GUID-here} device vhd="[locate]\VHD\Windows2008R2.vhd”
bcdedit /set {enter-new-GUID-here} osdevice vhd="[locate]\VHD\Windows2008R2.vhd”
Run the following command to force hardware detection during the initial boot:
bcdedit /set {enter-new-GUID-here} detecthal yes
Close the elevated command prompt.

Detach VHD

In Disk Management, right-click the disk that is the mounted VHD, and then click Detach VHD.
On the Detach Virtual Hard Disk page, ensure that the Delete the virtual hard disk file after removing the disk check box is NOT selected, and then click OK.
Close the Computer Management console.

Handy Office 365 PowerShell Cmdlets

2011-12-21T12:02:00.003-05:00

Here are some handy Cmdlets that you may find useful when managing Office 365.

Microsoft Online Services

- Connect to the Microsoft Online Services interface for account management tasks.
import-module MSOnline
$cred = Get-Credential
Connect-MSOLService

- Connect to the Microsoft Exchange Online interface for Exchange-related tasks.
$cred = Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential $cred -Authentication Basic -AllowRedirection
Import-PSSession $Session

- Set Office 365 passwords for all accounts to P@ssword1 and clear Change Password Flag
get-msoluser set-msoluser -NewPassword P@ssword1 -ForceChangePassword $False

- Set Office 365 passwords for all accounts to never expire
get-msoluser set-msoluser -PasswordNeverExpires $True

Copy Cisco Disk Image via FTP

2011-11-21T22:57:00.002-05:00

Tonight, I found myself having to copy the AnyConnect binaries from one ASA 5505 to another without a device on-LAN to TFTP to. I did, however, have a public FTP server that could use to move the data around.

This feature seems to be relatively un-discussed, so here is the syntax.

ASA/Router Binary: my-win-package-k9.pkg
FTP Server: ftp.myserver.com
FTP Server User Name: aarong
FTP Server Password: password1

copy disk0:my-win-package-k9.pkg ftp://aarong:password1@ftp.myserver.com/my-win-package-k9.pkg

Yes, it's really that simple. Would have been nice if someone told me.

Set "Password Never Expires" for Microsoft BPOS Standard Accounts

2011-08-24T16:46:00.008-04:00

Cries of joy are ringing throughout the Microsoft BPOS Partner community--the ability to set "Password Never Expires" for BPOS Standard Accounts has *finally* been released. Previously available only for BPOS-D customers, Microsoft has ported the command to the newest update of the Microsft Online Services Migration Tools (available for x86 here and x64 here).

So, once you've downloaded and installed the updated tools, how do you avail yourself of this helpful feature?

Set "Password Never Expires" for All Enabled Users
1. Open Migration Command Shell.
2. Copy/paste the following commands:

$cred = Get-Credential
Get-MSOnlineUser -enabled -Credential $cred | Set-MSOnlineUserPasswordNeverExpire -Credential $cred -PasswordNeverExpire $true

Drop in your BPOS administrative credentials (in the form of user@domain.com and password) in the pop-up dialog box when prompted.

Windows XP Automatic Updates service is missing

2011-07-20T10:35:00.007-04:00

Recently, there have been a rash of "fake antivirus" viruses and trojans floating around the internet. Two of the more frustrating issues:

- Why are all my icons hidden?
- Where the heck did my Automatic Updates service go?
- Why am I getting Windows Update Error 0x80072EFE?

The icons hidden one is fairly benign and relatively easy to resolve:
1. Open Windows Explorer.
2. Select Tools > Folder Options.
3. Select the View tab.
4. Select the Show hidden files and folders radio button and click OK.
5. From Windows Explorer, navigate to C:\.
6. Right-click on the folder "Documents and Settings" and click Properties.
7. Clear the "Hidden" checkbox.
8. When prompted, choose to apply to all subfolders and files.

As far as the Automatic Updates issue goes, it's a little trickier. These particular strains of malware do everything from unregister DLLs to removing the Windows Update service altogether. Most of the time, the solution involves one or more of the following tasks:
- Re-registering the WUAU DLLs
- Re-registering Internet Explorer DLLs
- Deleting the cached update downloads
- Resetting the cryptographic service database

Copy/paste the following script into Notepad and save it as a .bat file:

net stop wuauserv /y
net stop bits /y
net stop cryptsvc /y
ren %systemroot%\system32\catroot2 catroot2_old
rd /s /q %systemroot%\SoftwareDistribution
regsvr32 /s actxprxy.dll
regsvr32 /s atl.dll
regsvr32 /s browseui.dll
regsvr32 /s cdm.dll
regsvr32 /s cryptdlg.dll
regsvr32 /s dssenh.dll
regsvr32 /s gpkcsp.dll
regsvr32 /s initpki.dll
regsvr32 /s iuengine.dll
regsvr32 /s mshtml.dll
regsvr32 /s msxml.dll
regsvr32 /s msxml2.dll
regsvr32 /s msxml2r.dll
regsvr32 /s msxml3.dll
regsvr32 /s msxml3r.dll
regsvr32 /s msxmlr.dll
regsvr32 /s oleaut32.dll
regsvr32 /s qmgr.dll
regsvr32 /s rsaenh.dll
regsvr32 /s sccbase.dll
regsvr32 /s shdocvw.dll
regsvr32 /s slbcsp.dll
regsvr32 /s softpub.dll
regsvr32 /s urlmon.dll
regsvr32 /s wintrust.dll
regsvr32 /s wuapi.dll
regsvr32 /s wuaueng.dll
regsvr32 /s wuaueng1.dll
regsvr32 /s wuauserv.dll
regsvr32 /s wucltui.dll
regsvr32 /s wups.dll
regsvr32 /s wups2.dll
regsvr32 /s wuweb.dll
net start cryptsvc
net start bits
net start wuauserv

Run. The "Automatic Updates" service should now be visible in the Services applet.

Internet Explorer 8 and the continuous "Manage Add-Ons" Prompt

2011-05-20T00:16:00.004-04:00

While trying to deploy the Microsoft Online Services Single Sign-On Tool for a customer migrating to BPOS, I found myself sitting at a customer's computer banging my head against the wall. When I'd launch the tool and sign in as the user, I kept on getting the "Unable to prepare certificate" error.

The MSOL tool is dependent on a number of things:
- .NET Framework 2.0 or later
- Correct time (within 5 minute skew of the MSOL servers)
- Internet Explorer as your default browser

I was OK on the firsts two items, but I had noticed that my customer had installed both Firefox and Chrome. No big deal, right? I launch IE and set it as the default browser and attempt to reconfigure the sign-on tool (to no avail).

I proceed to follow the traditional troubleshooting steps:
- Uninstall/reinstall Online Services Single Sign-On Tool
- Uninstall/reinstall .NET Framework from 4.0 down to 2.0 and back again
- Reset IE to default settings.

Neither of these fixed my problem.

I launched IE and was faced with what I thought was an annoyance--the "Manage Add-Ons" window kept popping up with my default search providers. I'd set it, close IE, restart, and get the dialog box again.

I thought, "Now I'm getting somewhere." I thought maybe there was a piece of malware affecting the customer's system, so I downloaded one of my favorite programs, ran a scan, and didn't find anything.

In the end, I stumbled upon a tip from another hapless soul facing my same problem:

1. Make sure all IE windows are closed. To be sure, you can open a command prompt and run taskkill /im iexplore.exe /f .
2. Open Regedit.
3. Navigate to HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders.
4. Right-click, point to New > Expandable String Value.
5. Type AppData and press ENTER.
6. Double-click the new AppData value and enter %userprofile%\Application Data and click OK.
7. Try launching IE again.

Exchange 2010 Messages Stuck in Retry status in "MapiDeliveryQueue"

2011-02-02T23:47:00.003-05:00

In case your Exchange admin life wasn't difficult enough, you can always have this problem, manifested with the following symptoms:

- Mail delivery hung
- Messages stuck in local delivery "MapiDeliveryQueue" with a status of "Retry"

Classic tactics such as restarting the server or right-clicking the queue and selecting "Retry" have no effect.

The key here is that Exchange 2007 and later treat these messages differently than standard SMTP queues. In order to process these messages, they need to be re-submitted using the following Exchange cmdlet:

Retry-Queue -Filter {Status -eq "Retry"} -Server "exchangeserver" -resubmit $true

The default re-submit queue time is 12 hours. To modify this:

1. Using Notepad, edit the file: C:\Program Files\Microsoft\Exchange Server\V14\Bin\EdgeTransport.exe.config.
2. Modify the following line in the section:

<add key="MaxIdleTimeBeforeResubmit" value="<hh:mm:ss>"/>

3. Save the file.
4. Open up the Exchange Command shell and run restart-service *rt

IIS 6.0 404 Error for a file you know is there

2011-01-22T13:02:00.008-05:00

This morning I was doing some maintenance on a customer's machine and needed to reinstall the application. The customer site is closed, but the work still needs to be done. I had a copy of the ISO media available on a server in our office, so the solution seemed obvious: drop it on a web server and pull it down from the client's machine.

So, I created a directory on one of our web servers, placed the ISO file there, and turned on "Directory Browsing" for that directory. I then logged into my customer's machine and navigated to the site and found the file. I right-clicked on the file, hit "Save Target As..." and ....

Internet Explorer cannot download myfile.iso from my.webserver.com.
Internet Explorer was not able to open this Internet site. The requested site is either unavailable or cannot be found. Please try again later.

I went back to the site and this time, just clicked on the file name, and was greeted with the generic 404 message.

Fortunately, the solution is very simple and only takes a few seconds.

1. Open up IIS Manager.
2. Navigate to the web site (if you don't want to change the setting for the entire web server, you can just navigate to the directory path off the web site).
3. Right-click > Properties on the website (or directory).
4. Select the "HTTP Headers" tab.
5. Select the "MIME Types" button.
6. Click the "New" button.
7. Add the extension type (in my case, ISO).
8. Add the MIME type (in my case, application/octet-stream).
9. Click OK three times.

Try to re-download the file in your browser.

The reason for this behavior is described in detail in the IIS 6.0 documentation here.

How to fix a bad/corrupt/hidden source in Cydia

2011-01-04T11:32:00.005-05:00

I was adding a new Cydia repository the other day to my iPhone and apparently mistyped something. I deleted it from the GUI, but every time I went to search Cydia for an application or manage my source list, I received an error that the repository was unavailable and then received the following error:

Sub-process bzip2 returned an error code (2)

Fortunately, there's a way to fix it. You'll need a few pieces of software:

OpenSSH installed on your iDevice
WinSCP (free Windows Secure Copy client; available at http://sourceforge.net/projects/winscp)
plist Editor for Windows (Mac OS Property List editor; http://www.ipodrobot.com/blog/2009/02/free-plist-editor-for-windows-10-released.htm)

Make sure you have SSH access to your iDevice When you installed Cydia, you had the option for which tool sets you wanted. If you didnt' select a tool set that includes command-line tools, you'll need to install those first (OpenSSH is the main piece that's required). If SSH isn't working, you'll need to reinstall it and then respring your device.
Test your SSH login credentials by using an SSH client such as putty connecting to your device's WiFi address and logging in as 'root.' If you have not changed the root password, the default is 'alpine.'
Using a secure copy client (such as WinSCP), connect to your iDevice and navigate to /private/etc/apt/source.list.d.
Right-click > Edit the cydia.list file, remove the offending line, and click Save. Close the WinSCP editor.
Navigate to /private/var/lib/cydia.
Copy the metadata.plist file to your computer.
Using plist editor, open the metadata.plist on your computer.
Search for the repository you need to remove. The line will look something like deb:http://repositoryname/:./
Select and delete down to the next key tag. Your selection should start with an open key tag and end with a close dict tag and should contain approximately 9 lines of data.
Copy it back to /private/var/lib/cydia and overwrite the existing file.
Navigate to /private/var/lib/apt/lists and delete the files starting with the name of the source you wish to remove.
Navigate to /private/var/lib/apt/list/partial and do the same.
Close WinSCP and respring your iDevice.

Bulk add host headers to IIS site

2010-12-16T11:01:00.004-05:00

Kind of in line with my previous post of bulk adding DNS zones and configuring secondaries is the need to bind multiple new host headers to a customer's site. Doing it from the IIS Manager is tedious, to say the least.

Fortunately, there is a way to bulk do this as well. This method is a little clunky, but still way better than doing it all manually.

1. From IIS Manager, locate the identifier for your website (if it's not the default site).
2. Open a command prompt and navigate to (default) \Inetpub\Adminscripts.
3. Run the following command:

cscript adsutil.vbs get w3svc/{site identifier}/serverbindings

The reason this has to be done is the adsutil.vbs set command will overwrite this settings (not add to them), so if you just plug in your new host headers, you'll lose all of your old ones!

You should get an output that looks similar to this:

":80:www.oldhostheader1.com"
":80:www.oldhostheader2.com"

4. Copy/paste the output into a notepad window. Delete the white spaces until it's all one continuous line.
5. Using the same format, add your new host headers to this list so that it looks like this:

":80:www.oldhostheader1.com" ":80:www.oldhostheader2.com" ":80:www.newhostheader1.com" ":80:www.newhostheader2.com"

6. At the beginning of the line, prepend cscript adsutil.vbs set w3svc/{siteidentifier}/server bindings, and save it as a .bat file.
7. Run.

Quick 'n dirty DNSCMD scripts

2010-12-16T09:42:00.003-05:00

Periodically, I get requests to bulk add domains to our DNS hosting environment. Here are a few simple DNScmd scripts to help make the job easier.

On the DNS Primary server, I created a batch script named "zoneadd_primary.bat" and put this in it:

@ECHO OFF
REM
REM Add DNS zones in from command line parameter file as
REM Standard Primary zones.
REM Replace n.n.n.n with IP address of primary/master DNSserver.
REM Replace x.x.x.x and y.y.y.y with your secondary/slave servers.

REM Check for command-line parameter
if "%1"=="" GOTO USAGE

for /F %%a in (%1) do dnscmd /zoneadd %%a /primary /file %%a.dns

REM Add secondary/slave servers to zones
for /F %%a in (%1) do dnscmd /zoneresetsecondaries %%a /securelist x.x.x.x y.y.y.y
GOTO END

:USAGE
ECHO.
ECHO Error: no file specified
ECHO.
ECHO Usage:
ECHO zoneadd_primary [filename]
ECHO.
ECHO where [filename] is a text file with a list of domains.
ECHO.
ECHO Example:
ECHO.
ECHO zoneadd_primary domains.txt
ECHO.
:END

And then, on the slave servers, I put a companion script called "zoneadd_secondary.bat" with a similar script:

@ECHO OFF
REM
REM Add DNS zones in domains.txt as secondary zones.
REM Replace n.n.n.n with IP address of primary/master server.

if "%1"=="" GOTO USAGE

for /F %%a in (%1) do do dnscmd /zoneadd %%a /secondary n.n.n.n
GOTO END

:USAGE
ECHO.
ECHO Error: no file specified
ECHO.
ECHO Usage:
ECHO zoneadd_secondary [filename]
ECHO.
ECHO where [filename] is a text file with a list of domains.
ECHO.
ECHO Example:
ECHO.
ECHO zoneadd_secondary domains.txt
ECHO.

:END

Not much to it, but I do find it useful.

Mitch McConnell, This One's For You

2010-12-11T00:00:00.004-05:00

Also titled, "Everything that's wrong with Republicans and Democrats."

It's been a while since I've posted something political; now that the dust is getting kicked up around the compromise deal between President Obama and the Senate Republicans, I think it's a good time to let my feelings out.

Hearing Mitch McConnell on the radio is an audio reminder of why I don't consider myself a Republican anymore. I have no idea how he can claim that extending the Bush tax cuts to the wealthiest 2% of Americans is going to help our ailing economy. Since it's obvious that it's been a few years since he's had an economics course, I'm going to share my limited recollection of college econ.

Now, mind you, I was born and raised in a house that bled Reaganomics. I still hear stories about how I ran around the Whitewater Armory on election day yelling "Ronald Reagan is a good man!" I was always told that the rich people create jobs and that you never asked a Wal-Mart greeter for a job. I was told that everyone's born a Democrat, and then they grow up.

However, I've come to the realization that this particular viewpoint was very one-sided and not very practical.

While rich people and businss owners *do* create jobs, they create jobs when there is sufficient economic cause to do so. Rich people didn't get to be rich by spending their money foolishly, and few things are more foolish than employing a bunch of people making stuff that isn't getting sold.

For some reason, Mitch McConnel seems sold on the idea that the richest 2% of Americans need all of these tax breaks extended because we're in a fragile economy and that extra oomph is needed to entice them to create jobs.

Mitch, I've got news for you--no one with bags of money sits around thinking, "I'm going to create some jobs by employing a bunch of minimum wage folks in hopes of stimulating the economy." There is no benevolent employer who is looking for the opportunity to create a warehouse full of unsold goods. Rich people don't get to be rich by hiring a bunch of people to stand around idle. What stimulates the economy is a lot of people buying stuff over a sustained period. The spending must come before the job creation does.

What he (and the other Congressional Republicans) need to remember is that the most direct ways to stimulate the economy and reduce the deficit are:

1. Extend unemployment benefits. People who are on unemployment aren't building a rainy day fund. UE is barely enough to keep food on the table for most families; every last penny of it is going immediately back into the economy.
2. Simplify the tax structure. It was tried in 1986, but didn't really have a huge net change. There are so many loopholes favoring the rich that they can, in some cases, pay less taxes than people making 1/10 of what they make. Eliminate the vast majority of deductions. There is no reason that the personal tax code can't be under 100 pages, or even 50.
3. Broaden the tax base. Get more people to pay taxes. Fewer exemptions and deductions means more people are affected.
4. Lower marginal tax rates. If the tax base is sufficiently broad, everyone's marginal rates can go down. This woul directly put money back into pockets to be spent. A family of four making $40,000 per year spends a much higher percentage of their income on necessities than a single person making $2m a year. Lowering the tax rates (especially on the low end of the income scale) again means that more money would be going directly back into the economy. And we all know that money flowing in means employers need to hire more people (that whole supply and demand thing).

The President and his Debt Commission have several recommendations; I think a lot of the ideas are good. There are only two ways to shrink the deficit--raise revenues and cut spending. Republicans and Democrats seem to think that those ideas are mutually exclusive. Democrats want to increase revenues, Republicans want to cut spending on bleeding-heart programs.

Things that I think would beneficial for a comprehensive tax plan:

1. Exempt first $35,000 from personal income tax.
2. Do away with all deductions except charity and medical expenses (EIC, mortgage deduction, etc)
3. Eliminate capital gains tax.
4. Eliminate inheritance tax.
5. Implement progressive income tax (maybe about 18% on $35,000-70,000; 22% on $70,000-150,000; 25% on 150,000-$500,000, etc. It would take a bit of math, but in the end, the marginal tax rates drop significantly, but with a broader base and only two deductions (charity and medical expenses), I think we'd see an overall increase in government revenue.

My numbers may need some tweaking, but I think in teh end, it's going to take some out-of-the-box ideas like that (like touching the sacred cow "Mortgage deduction") to put real money back in the pockets of the people most likely to spend it and start growing our economy.

How to Join Windows XP Media Center to a Domain

2010-12-09T22:38:00.004-05:00

During an SBS deployment, I ran into a few machines at my customer's site that were running Windows XP Media Center Edition (MCE). As most of you know, the only machines that are technically eligible to join a Windows domain are "Business" class operating systems, such as Windows XP Professional, Windows Vista Business, Windows Vista Enterprise, Windows 7 Professional and Windows 7 Enterprise (although not technically "business" class, Windows Vista/7 Ultimate Editions are also able to join domains, since they're supposed to be everything-but-the-kitchen-sink editions).

And, as luck would have it, the customer has critical LOB applications installed on these machines and some other pieces of legacy software for which the media is no where to be found, so a fresh install with Windows XP Professional media is out of the question.

No problem, right? I've upgraded dozens of Windows XP Home PCs to Windows XP Professional for this exact reason. I pop some newly acquired Windows XP Professional with SP3 "Get Genuine" media (designed for those folks that have potentially illegitimate Windows versions); the upgrade is going well until ... the part where I enter the license key. It won't take it, even though I know it's valid (tested against an XP Home machine in the same office).

While trying to find a reason why I can't upgrade, I stumble upon another blog with some basic instructions on how to join XP MCE to a domain. The first step the author lists is to install the Windows XP Recovery Console; I run the command and restart ... and ... bluescreen.

I turn to my trusty recovery tools disc (which has gotten me out of more tight spots than you can imagine) and boot to a WinPE shell which has a bunch of great tools loaded, including RegEdit PE.

To perform this feat of amazement yourself:

1. From a WinPE installation, launch RegEdit PE, point it to the Windows installation director, and load up the registry hives.
2. Navigate to HKEY_LOCAL_MACHINE\_REMOTE_SYSTEM\WPA\MedCtrUpg.
3. Double-click the value IsLegacyMCE.
4. Change the '0' to a '1'.
5. Close RegEdit PE and restart the machine into Windows.
6. Join domain.

Outlook Anywhere and Wildcard Certificates in Exchange 2010

2010-11-05T11:56:00.002-04:00

When migrating to a new Exchange 2010 environment, I decided to use a wildcard certificate instead of a UC certificate. It cost about twice as much, but seeing as how I have several other services that currently require SSL certificates, it seemed like a good investment.

When running through the Exchange Remote Connectivity Analyzer, I noticed that my configuration kept failing the Outlook Anywhere test with the following error:

Testing SSL mutual authentication with the RPC proxy server.
Verification of mutual authentication failed.
> Additional Details
>> The certificate common name *.domain.com doesn't validate against the mutual authentication that was provided: msstd:mail.domain.com

The solution was relatively easy. Log into your Exchange CAS server and run the following cmdlet from the Exchange Command Shell:

Set-OutlookProvider -Identity EXPR -CertPrincipalName *.domain.com

I've seen some documentation that replaced the CertPrincipalName value with msstd:*.domain.com, but I believe that is incorrect. The name on the actual SSL certificate is *.domain.com, not msstd:*.domain.com. For giggles, I did try using msstd:*.domain.com as the CertPrincipalName value, but it did not allow me to pass ExRCA.

Run the Get-OutlookProvider cmdlet to review your settings:

RunspaceId : 841d7d59-e89c-42b4-9c3c-9388d40dcd95
CertPrincipalName : *.domain.com
Server :
TTL : 1
OutlookProviderFlags : None
AdminDisplayName :
ExchangeVersion : 0.1 (8.0.535.0)
Name : EXPR
DistinguishedName : CN=EXPR,CN=Outlook,CN=AutoDiscover,CN=Client Access,CN=A
pex Digital Solutions,CN=Microsoft Exchange,CN=Services,
CN=Configuration,DC=domain,DC=com
Identity : EXPR
Guid : d81b1280-1843-4808-812c-48375ed744e0
ObjectCategory : domain.com/Configuration/Schema/ms-Exch-Auto-Discove
r-Config
ObjectClass : {top, msExchAutoDiscoverConfig}
WhenChanged : 11/5/2010 11:53:39 AM
WhenCreated : 1/30/2009 9:23:30 PM
WhenChangedUTC : 11/5/2010 3:53:39 PM
WhenCreatedUTC : 1/31/2009 2:23:30 AM
OrganizationId :
OriginatingServer : mydc03.domain.com
IsValid : True

Fun with PIX, Part Deux

2010-11-04T09:46:00.004-04:00

After getting my PIX to boot in my previous post, I decided to run through the password recovery procedures.

What you'll need:

PIX recovery images (availble from either the Cisco site individually or here in one ZIP file)
PIX firewall software version
TFTP server software (I used the TFTP server included in the PacketTrap pt360 Suite in this exercise)
Terminal Emulator (I typically use PuTTY)

Steps:

Connect Ethernet 0 on the PIX to your local LAN.
Open a command prompt and run ipconfig to determine your computer's IP address.
Download PIX recovery images to a directory on your computer (such as C:\tftp).
Point your TFTP server to the download directory containing your tools.
With a console cable attached and terminal emulator running, power on the PIX firewall.
Note the version of the PIX firewall software. If you missed the boot sequence, you can type sh ver at the prompt. The firewall software version will normally be the first line returned:
Cisco PIX Firewall Version 6.3(5)
Cisco PIX Device Manager Version 3.0(4)

In this case, the number you need is "Cisco PIX Firewall Version."
Power off the PIX.
Power on the PIX.
After the startup messages appear, press ESC or send a BREAK command. Note: If you do it too early, you'll get a testing/diagnostic menu. To continue the boot process, type C. A successful BREAK command should leave you at the monitor> prompt.
Type int e0 and press ENTER.
Type addr a.b.c.d and press ENTER (where a.b.c.d is an IP address you want to assign to the PIX. To reduce troubleshooting, choose an address on the same network as your the computer you're using).
Type server w.x.y.z and press ENTER (where w.x.y.z is the IP address of the computer you're using to perform this procedure).
Type file np[nn].bin (where [nn] is the version number corresponding to the BIN file for password recovery. For example, if your PIX is running version 6.3 of the firewall software, enter np63.bin).
Type tftp and press ENTER.
When prompted, type Y to erase the passwords.
If prompted to remove the commands from the configuration, type Y.
The device will reboot and will have a blank password.

Fun with PIX, Part I

2010-11-04T08:57:00.007-04:00

When meeting with a potential customer the other day, she mentioned that she had a running PIX with an unknown password.

I thought I'd refresh my PIX skills and decided to bust out an old PIX 506E we had sitting in the office. After the unfortunate re-realization that my laptop doesn't have a serial port (and the resulting short jaunt to the computer store to get a USB-to-Serial cable), I consoled into the PIX and turned it on.

My adventure was short-lived, however. While watching the boot-up, I was greeted with a hung firewall:

CISCO SYSTEMS PIX FIREWALL
Embedded BIOS Version 4.3.207 01/02/02 16:12:22.73
Compiled by morlee
32 MB RAM

PCI Device Table.
Bus Dev Func VendID DevID Class Irq
00 00 00 8086 7192 Host Bridge
00 07 00 8086 7110 ISA Bridge
00 07 01 8086 7111 IDE Controller
00 07 02 8086 7112 Serial Bus 9
00 07 03 8086 7113 PCI Bridge
00 0D 00 8086 1209 Ethernet 11
00 0E 00 8086 1209 Ethernet 10

And that's all she wrote.

Fortunately, there's an easy enough work-around.

1. Power off the device.
2. Remove the cover. There are two Phillips screws located at the top rear of the unit. The top half slides back about an inch or so and then lifts off.

3. Locate the J5 jumper. It should be right next to the CMOS battery. Move it over 1 PIN.

4. Power on the device.
5. After unit has booted, power off.
6. Replace cover.

"Saved-Critical" for Almost-Clustered Virtual Machines in Windows 2008 R2 Hyper-V

2010-10-06T11:15:00.001-04:00

While staging a clustered Hyper-V environment this week, I ran into a head-scratching issue. After provisioning a few LUNs, masking them, and adding them as available storage to Failover Clustering, I began setting up the virtual machines on one of my cluster nodes. During maintenance, the physical servers were restarted. When I went back to continue configuring the virtual machines (which were not yet clustered at this point), I connected to the physical host on which I had been configuring them. While my other clustered virtual machines were running fine, the new ones that I had not yet finished configuring were in a "Saved-Critical" state.

I attempted to start them, but received an eror that the saved state could not be restored. I attempted to delete the saved state, but received an "Unable to perform operation" error. Additionally, I could not view the properties of the virtual machines in the Saved-Critical state.

I opened up Failover Cluster manager and noticed that the storage was now owned by the other cluster node. The problem is now obvious--the storage is no longer being presented to the host on which I was configuring the virtual machines. So, how to move these disks? Since the disks are marked "Available" (not having run through the new service Failover Clustering wizard to make the virtual machines highly available), I can't move them by right-clicking on them and selecting a new node.

There is another solution, however, and it involves the cluster.exe command.

1. Open up a command prompt.
2. Run the following command: cluster.exe GROUP "Available Storage" /Move

Voila! The disks moved back to the other node and the virtual machine state in Hyper-V manager changed from "Saved-Critical" to "Off." I was then able to cluster the machines normally through Failover Clustering.

How to Expand a Virtual Disk on the Dell MD3000i

2010-09-28T09:49:00.008-04:00

I recently found myself in the position of having to expand a virtual disk on a Dell MD3000i. The Dell MD3000i is a great entry-point SAN, but the GUI lacks some of the functions that you think would be there (such as online volume growth).

The feat, however, can be accomplished. It just requires using the arcane command-line interface.

1. Log into the MDSM GUI and make sure no other operations are currently in progress (disk initialization, rebuild, etc). You can find this information on the Summary tab under Operations in Progress.
2. Note the virtual disk name that you want to expand (such as server_a_vol_1). To see a list of your virtual disks from the GUI, click on the Summary tab and then the Disk Groups & Virtual Disks link.
3. Note the name of the array. You can find this information on gray menu bar above the tabs.
4. Exit the MDSM GUI.
5. Open a command prompt and navigate to the directory where the MD storage software is installed (for the newer versions, the default location is C:\Program Files (x86)\Dell\MD Storage Manager\client on x64 platforms or C:\Program Files\Dell\MD Storage Manager\client on x86 platforms).
6. Run the command:

smcli -n arrayname -c "set virtualDisk [\"virtual disk name\"] addCapacity=n;"

Where:
arrayname is the name of the storage array
virtual disk name is the name of the virtual disk
n is the capacity in bytes to add (to convert GB to bytes, multiply the number in GB by 1073741824)

For example, if you want to add 50GB to the virtual disk server_a_vol_1 on the MD3000i array named production, you would type the following:

smcli -n production -c "set virtualDisk [\"server_a_vol_1\"] addCapacity=53687091200;"

From the Windows side, the LUN will not show up as its new size until the operation is complete. The volume growth process doesn't tack on space to the end of the volume, rather, it appears to move the volume to the end and then append the storage. For newly created volumes with no data, it is much faster to destroy the LUN and recreate it than to go through an online expansion. If the volume has data on it, though, you are left with little option.

Once the operation is complete, you can expand the volume using either the disk management snap-in (diskmgmt.msc) or diskpart.exe.

Outlook 2007 Continuously Prompting for POP3 Credentials

2010-09-20T20:43:00.003-04:00

Recently, I had a customer running Outlook 2007 on Windows 7 that experienced a condition I like to refer to as "the dreaded attack of the authentication dialog box." She was connecting to a POP3 server and had the "Save password" box checked, but during every Send/Receive session, would get prompted twice for credentials.

The solution was simple, but elusive.

1. Close Outlook.
2. Open Windows Explorer.
3. Tools > Folder Options > View; click "Show hidden files, folders, and drives."
4. Deselect "Hid protected operating system files (Recommended)" and click OK.
5. Navigate to %USERPROFILE%\AppData\Roaming\Microsoft\Protect.
6. Rename the folder S-1-5-21- to S-1-5-21--old.
7. Rename the file CREDHIST to CREDHIST-old.
8. Restart.
9. Launch Outlook, enter credentials when prompted, and click Save Password.

General Authentication Failed when using IMAP over SSL on Exchange 2010

2010-09-07T14:14:00.004-04:00

Ran into an interesting certificate issue with Exchange 2010 and wildcard certificates.

I had installed a wildcard certificate for our domain on an Exchange 2010 server (just like I had previously for Exchange 2007) and enabled the IMAP service (Microsoft Exchange IMAP4 is the Exchange 2010 name of the service). However, when running the Enable-ExchangeCertificate cmdlet, I received an error enabling the wildcard certificate for IMAP services.

I eventually stumbled across this KB Article, Certificates that contain wildcard characters may not work correctly on an Exchange 2007 Service Pack 1-based server. When I ran the Get-ImapSettings cmdlet, I received the following output:

UnencryptedorTLSBindings SSLBindings LoginType X509CertificateName
------------------------ ----------- --------- -------------------
{:::143, 0.0.0.0:143} {:::993, 0.0.0.0:993} SecureLogin myservername

According to the KB, this is due to a problem with the way the cmdlet generates the X.509 certificate name. It can't interpret the wildcard character correctly, so it says that the FQDN of your server is just the NetBIOS name of your server. Oops. Exchange 2007 SP1 Roll-Up 4 is supposed to fix this behavior, but I experienced it on an Exchange 2010 server that was updated to current before deploying the certificate.

After I updated the X.509 Certificate name (using the command Set-ImapSettings -X509CertificateName "myserver.mydomain.com"), I restarted the IMAP service.

To make sure everything was working, I configured an Outlook profile with the IMAP settings of my test mailbox. When I clicked the "Test Connection" button, I was greeted with yet another error:

Log on to incoming mail server (IMAP): General authentication failed. None of the authentication methods supported by your IMAP server (if any) are supported on this computer.

The answer, was, in fact, in the output of the Get-ImapSettings cmdlet that I previously ran. Apparently, it was looking for a secure login method. However, in most SSL-enabled configurations, data is submitted in clear text through the SSL tunnel. To test my theory, I ran the command Set-ImapSettings -LoginType PlainTextlogin and restarted the IMAP service again. In my Outlook client, I clicked the "Test Connection" button again and all was right with the world.

Emailreg.org is a scam

2010-04-15T14:15:00.008-04:00

Barracuda ... The mere mention of their name strikes fear in the hearts of any email admin unlucky enough to have to do relay mail through one of their devices.

One of my customers today submitted a ticket with problems relaying mail to one of their customers using a Barracuda device. My customer's relay responds with this message:

#554 Service unavailable; Client host [XXXXXXXXXX.XXXXXXX.XXX] blocked using Barracuda Reputation; http://bbl.barracudacentral.com/q.cgi?ip=XXX.XXX.XXX.XXX ##

Ah, yes, the Barracuda Black List. Clicking on the link they provide takes you do a page where they tell you, "Sorry, your email was blocked....Barracuda Networks is not attempting to block your individual emails in particular. The repuation systemed uses automated algorithms for determining its results -- very similar to the anti-fraud mechanisms used for credit cards."

Yeah, whatever. You can put any IP address in the URL, and it will give you the same message for each one. It's a generic page they use to try to get you to buy into their Emailreg.org scam.

Clicking on the "Click here to register your domain" link and you have the ability to sign up and register your domains. Sounds great, right? Except for the $20 USD fee per domain registered.

For a while, Barracuda Networks denied that they had anything to do with Emailreg.org and said that they only used the list provided there to help determine what mail was spam. And, if you queried emailreg.org for the WHOIS information, it's obscured, so it's hard to know:

Domain ID:D152388600-LROR
Domain Name:EMAILREG.ORG
Created On:12-Apr-2008 21:40:49 UTC
Last Updated On:14-Mar-2010 12:46:16 UTC
Expiration Date:12-Apr-2011 21:40:49 UTC
Sponsoring Registrar:eNom, Inc. (R39-LROR)
Status:CLIENT TRANSFER PROHIBITED
Registrant ID:77b4c5687ae40560
Registrant Name:Whois Agent
Registrant Organization:Whois Privacy Protection Service, Inc.
Registrant Street1:PMB 368, 14150 NE 20th St - F1
Registrant Street2:
Registrant Street3:
Registrant City:Bellevue
Registrant State/Province:WA
Registrant Postal Code:98007
Registrant Country:US
Registrant Phone:+1.4252740657
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:tsbnwxhk@whoisprivacyprotect.com
Admin ID:77b4c5687ae40560
Admin Name:Whois Agent
Admin Organization:Whois Privacy Protection Service, Inc.
Admin Street1:PMB 368, 14150 NE 20th St - F1
Admin Street2:
Admin Street3:
Admin City:Bellevue
Admin State/Province:WA
Admin Postal Code:98007
Admin Country:US
Admin Phone:+1.4252740657
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:tsbnwxhk@whoisprivacyprotect.com
Tech ID:77b4c5687ae40560
Tech Name:Whois Agent
Tech Organization:Whois Privacy Protection Service, Inc.
Tech Street1:PMB 368, 14150 NE 20th St - F1
Tech Street2:
Tech Street3:
Tech City:Bellevue
Tech State/Province:WA
Tech Postal Code:98007
Tech Country:US
Tech Phone:+1.4252740657
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:tsbnwxhk@whoisprivacyprotect.com
Name Server:NS2.MYDYNDNS.ORG
Name Server:NS1.MYDYNDNS.ORG
Name Server:NS3.MYDYNDNS.ORG
Name Server:NS4.MYDYNDNS.ORG
Name Server:NS5.MYDYNDNS.ORG
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
DNSSEC:Unsigned

But alas, IP address information is not hidden from ARIN:

Network Information for: 64.235.146.64
--------------------------------------------------------------

OrgName: Barracuda Networks, Inc.
OrgID: BARRA-7
Address: 3175 S. Winchester Blvd
City: Campbell
StateProv: CA
PostalCode: 95008
Country: US

NetRange: 64.235.144.0 - 64.235.159.255
CIDR: 64.235.144.0/20
OriginAS: AS15324
NetName: BARRAUCDA
NetHandle: NET-64-235-144-0-1
Parent: NET-64-0-0-0-0
NetType: Direct Assignment
NameServer: NS1.P23.DYNECT.NET
NameServer: NS2.P23.DYNECT.NET
NameServer: NS3.P23.DYNECT.NET
NameServer: NS4.P23.DYNECT.NET
Comment: http://www.barracuda.com/
RegDate: 2006-10-31
Updated: 2010-03-04

RAbuseHandle: BARRA1-ARIN
RAbuseName: Barracuda Hostmaster
RAbusePhone: +1-408-342-5400
RAbuseEmail: hostmaster@barracuda.com

RNOCHandle: BARRA1-ARIN
RNOCName: Barracuda Hostmaster
RNOCPhone: +1-408-342-5400
RNOCEmail: hostmaster@barracuda.com

RTechHandle: BARRA1-ARIN
RTechName: Barracuda Hostmaster
RTechPhone: +1-408-342-5400
RTechEmail: hostmaster@barracuda.com

OrgTechHandle: BARRA1-ARIN
OrgTechName: Barracuda Hostmaster
OrgTechPhone: +1-408-342-5400
OrgTechEmail: hostmaster@barracuda.com

# ARIN WHOIS database, last updated 2010-04-14 20:00
# Enter ? for additional hints on searching ARIN's WHOIS database.
#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at https://www.arin.net/whois_tou.html

Sneaky. But, that's the way Barracuda is.

Thankfully, there's another way, although Barracuda devices may or may not look at it (I've not confirmed it either way). The method is called Sender Policy Framework, and it's free. The Sender Policy Framework relies on a DNS record to check which hosts are "permitted" to send email for a particular domain. Check out http://www.openspf.org for a wizard to help create your SPF record.

Windows 2008 Hyper-V R2 Background Merge

2010-04-07T13:16:00.005-04:00

When you remove a snapshot or snapshot subtree from a Hyper-V VM, there is a merge process that combines the data in the .avhd snapshot file back into the VM's VHD.

In Windows 2008 RTM, the merge process only happened once the virtual machine was shut down. The VM was unavailable for the duration of this process. There was, however, a progress bar displayed in either SCVMM or Hyper-V Manager that would indicate the completion percentage.

In Windows 2008 R2, however, the merge process happens in the background. Any indication of it happening is no longer easily visible in the console.

To view the progress of a merge, run the following PowerShell command:

Get-WmiObject -Namespace "root\virtualization" -Query "select * from Msvm_ConcreteJob" | Where {$_.ElementName -eq 'Merge in Progress'}

This will give you output about all merges happening, the elasped time (in seconds, so be prepared to do some math), as well as the job completion percentage.

Troubleshooting WinSXS (Side-by-Side) problems

2010-02-11T09:44:00.004-05:00

While attempting to run a newly-installed OmniPage Pro 17 on a Windows 2008 x64 machine, I received a cryptic and frustrating error:

The application has failed to start because its side-by-side configuration is incorrect. Please see the application log for more details.

So, what do I do? I try re-running it. I try removing and reinstalling it. I run a repair from the Programs and Features Control Panel Applet. Nothing seems to be yielding any results.

So, I decide to check out the Application Log, like the dialog box suggested.

The Application Event Log has a little more detail about what's missing:

Activation context generation failed for "C:\Program Files (x86)\Nuance\OmniPage17\OmniPage17.exe". Dependent Assembly Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762" could not be found. Please use sxstrace.exe for detailed diagnosis.

So, I crack open a command prompt and run the following command:

sxstrace trace -logfile:omnipage.etl

The system returns the following message:

Tracing started. Trace will be saved to file omnipage.etl.
Press Enter to stop tracing...

I launch the application again, generate the error, tab back to the command prompt window, and then press Enter to stop tracing.

You can try to read the trace file, but it's not going to do you any good. You need to convert it to human-readable form with the following command:

sxstrace parse -logfile:omnipage.etl -outfile:omnipage.txt

After a few moments, you should receive a notification that it's complete:

Parsing log file omnipage.etl...
Parsing finished! Output saved to file omnipage.txt.

At that point, you can open up the result file (omnipage.txt in my case) to get a detailed analysis of what is wrong.

=================
Begin Activation Context Generation.
Input Parameter:
Flags = 0
ProcessorArchitecture = Wow32
CultureFallBacks = en-US;en
ManifestPath = C:\Program Files (x86)\Nuance\OmniPage17\OmniPage17.exe
AssemblyDirectory = C:\Program Files (x86)\Nuance\OmniPage17\
Application Config File =
-----------------
INFO: Parsing Manifest File C:\Program Files (x86)\Nuance\OmniPage17\OmniPage17.exe.
INFO: Manifest Definition Identity is (null).
INFO: Reference: Microsoft.VC80.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"
INFO: Reference: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"
INFO: Reference: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="x86",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"
INFO: Resolving reference Microsoft.VC80.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762".
INFO: Resolving reference for ProcessorArchitecture WOW64.
INFO: Resolving reference for culture Neutral.
INFO: Applying Binding Policy.
INFO: No publisher policy found.
INFO: No binding policy redirect found.
INFO: Begin assembly probing.
INFO: Did not find the assembly in WinSxS.
INFO: Attempt to probe manifest at C:\Windows\assembly\GAC_32\Microsoft.VC80.CRT\8.0.50727.762__1fc8b3b9a1e18e3b\Microsoft.VC80.CRT.DLL.
INFO: Did not find manifest for culture Neutral.
INFO: End assembly probing.

The long and short of it is that OmniPage is looking for some C++ components that it can't find in the program files directory or the SxS manifest. Specifically, it can't find the x86 platform version of the C++ components. So, I download and install the Visual Studio 2005 C++ Redistributable package (which the application vendor should have bundled), and the problem is resolved.

You can download the components here:

Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)

Microsoft Visual C++ 2005 SP1 Redistributable Package (x64)

A Series of Unfortunate Events

2010-02-07T14:23:00.007-05:00

While reading about and watching coverage of Sarah Palin's closing remarks at the Tea Party convention, I couldn't help but compare it to a car accident--you want to look away, but you can't.

While we all have the right--even duty--to criticize our leaders, I find it frustrating that she is speaks with vehemence about things of which she has little or no knowledge. Since it's now rumored that she may not have been the only one in the Governor's office, one must wonder how much of this opportunist's speech is her husband's thoughts.

Her speech was light on real details, quoting few specific policies or circumstances that she was criticizing. It's typical fiery rhetoric that panders to the audience. It's much easier to criticize than it is to offer solutions (look at this post, for example).

One of few specifics that she did mention was her perspective on trying the Christmas Day bomber in civilian courts. "Because that's not how radical Islamic extremists are looking at this. They know we're at war, and to win that war we need a commander in chief and not a professor of law standing at the lectern," she was quoted as saying.

She seems to have forgotten that under Bush, more than 200 alleged terrorists were tried and convicted in the civilian court system. Apparently, what was good for the goose isn't good for the gander. One interesting study from the Center for American Progress notes that terrorists tried in military tribunals get substantially less jail time.

In the case of Salim Hamdan, Osama bin Laden's driver, a military tribunal punished Hamdan with 5 years in prison. He was credited for time served, and only was only imprisoned for an additional 5 months after his conviction. Salim Hamdan is now running around free in Yemen. Similar is the case of David Hicks, who was convicted in a military tribunal of material support for terrorism. He now lives in Australia--a free man.

Contrast those with terrorists charged in criminal court. Ali Asad Chandia, convicted in civil criminal courts for driving a member of Pakistani extremist group Lashkar-e-Taibi from Washington National Airport and helping him ship packages containing paintball equipment back to Pakistan, was punished with 15 years in prison in 2006. John Walker Lindh, the "American Taliban," is also still serving out his 20-year sentence for providing material support to terrorists and being involved in a terrorist army faction.

Palin also made remarks criticizing President Obama for his foreign policy, stating that his policies don't recognize the true threats America faces.

Perhaps her memory needs a little jogging. There were reports all over the news from 2004 through 2006 of military leaders in Iraq begging for more troops, more armor, more weapons, and more equipment in general. And, even in 2008, well after "the surge," Gen. David McKiernan had asked for up to three additional combat brigades in Afghanistan--a request that President Bush ignored. President Obama committed 17,000 troops within two months after taking office. And, when General Stanley McChrystal asked in the now-famous "McChrystal Report" for another infusion of Troops in October 2009, Obama started preparing the citizens of the US to send more of their sons and daughters. He answered by announcing in November that he would sending an additional 34,000 troops to fulfill the General's request. It would appear (to me, at least), that President Obama takes the requests seriously and processes them in a timely fashion.

As Brad Woodhouse from the DNC was quoted in the Washington Post, "No one should take national security advice seriously from a person who told the world in 2008 that her qualifications in this area were that she could see Russia from her home state." Well played.

While in one moment calling President Obama a "charismatic guy with a teleprompter," she misspoke when reading from her notes in saying that U.S. policies might discourage those who "see Alaska as a beacon of hope" (presumably instead of America). Pot? Kettle? At least the charismatic guy can read.

The principles advocating smaller, more nimble government seem like laudable goals, but champions of this effort leave a sour taste in my mouth. If people like *that* support efforts like these, what else is lurking under the covers that I should know about?

At the end of the day, I admire grass-roots movements like the Tea Party that want to put control back in the hands of the people. While I'm not a Tea Partier, I do respect the mobilization that they have achieved. Palin was quoted as saying that the Republican party would do well to try to absorb as much of the Tea Party movement as possible. I think it would be more profitable to capture the fire into your own organization as opposed to trying to dilute your core principles to get more votes.

Many Democrats who see the Tea Party as an almost-off-the-map right organization, would welcome Palin's call to action. The truth for any party is that the more mass media coverage these growing fringe groups get, the more folks are driven to the other side.

Masterful Mojito

2010-02-03T21:40:00.005-05:00

I like to make the kinds that people talk about. The ones that are so good, that you can't order them out any more.

As the days grow longer, my thoughts turn to summer. Yes, it's only February, but a great drink is always in season.

Masterful Mojito
1 1/2 oz Bacardi Superior Rum
1/4 oz Cointreau Orange Liqueur
3 tsp sugar
1 lime
Mint leaves

Quarter the lime. In a shaker, combine ice, Bacardi Superior, Cointreau, sugar, and the juice from one half of the lime. Shake until frosty. Gently muddle 12-14 fresh mint leaves in the bottom of a Collins glass with the juice from one lime quarter. Add 6-8 ice cubes to the glass and pour the contents of the shaker over the ice. Top off with club soda and a mint sprig and garnish with the remaining lime quarter.

Change it up a little bit by adding a splash of your favorite limoncello.

How to change the company name displayed in Windows Small Business Server 2008 Remote Web Workplace (RWW)

2010-02-03T13:31:00.002-05:00

I recently found myself in a place where I had misspelled the name of a company during one of the SBS Setup Wizards and could not find where to change it.

The file that needs to be modified is C:\Program Files\Windows Small Business Server\Data\RWWConfig.xml

Look for the section that says signinorgname and change it to the correct spelling.

<?xml version="1.0" encoding="utf-8" ?>
<RWWConfig>
<fileName>RWWPluginSBS, Version=6.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35</fileName>
<className>Microsoft.WindowsServerSolutions.IWorker.RWW.RWWPluginSBS</className>
<signinOrgName>Company Name</signinOrgName>
<signinBackgroundImage>images/background.jpg</signinBackgroundImage>
<signinUserBackgroundImage />
<orgLogo />
<wssgLogo>images/RwwOemLogo.png</wssgLogo>
<readEmailIcon>images/E-mail.png</readEmailIcon>
<connectToComputerIcon>images/RemoteDesktop.png</connectToComputerIcon>
<internalWebSiteIcon>images/CompanyWeb.png</internalWebSiteIcon>
<changePasswordIcon>images/changepassword.png</changePasswordIcon>
<helpDocumentationIcon>images/Help32.png</helpDocumentationIcon>
<adminConsoleIcon>images/AdminConsole.png</adminConsoleIcon>
<helpDeskIcon>images/helpdesk.png</helpDeskIcon>
<techNetIcon>images/technet.png</techNetIcon>
<showOWALink>true</showOWALink>
<showTSLink>true</showTSLink>
<showSharepointLink>true</showSharepointLink>
<showChangePasswordLink>true</showChangePasswordLink>
<showHelpDocumentationLink>true</showHelpDocumentationLink>
<showAdminConsoleLink>true</showAdminConsoleLink>
<showHelpDeskLink>true</showHelpDeskLink>
<showWebGadget>true</showWebGadget>
<showCustomOrgLinks>true</showCustomOrgLinks>
<showCustomAdminLinks>true</showCustomAdminLinks>
</RWWConfig>

How to enable Outlook Logging

2010-02-02T16:01:00.002-05:00

From time to time, we get customers complaining about Outlook POP3/SMTP problems. 99% of the time, the customer has configured Outlook incorrectly (wrong username/password, wrong server, wrong ports, etc). Enabling Outlook logging can help you make the most of your troubleshooting session.

To turn on Outlook logging:

1. Launch Outlook.
2. Navigate to Tools > Options.
3. Click the Other tab.
4. Under the General section, click the Advanced Options button.
5. Place a checkmark in the Enable logging checkbox.
6. Click OK three times, acknowledging that the settings will take effect next time you start Outlook.
7. Restart Outlook.
8. Retry the action that was causing the problem.

Now, where to find this elusive logfile?

If you're running Outlook 2000, 2002/XP, or 2003 on Windows 2000, 2003, or XP:
C:\Documents and Settings\%username%\Local Settings\Temp\OPMLOG.LOG.

If you're running Outlook 2007 on Windows 2000, 2003, or XP:
C:\Documents and Settings\%username%\Local Settings\Temp\Outlook Logging\OPMLOG.LOG.

If you're running Outlook 2007 on Windows Vista, Windows 7, or Windows 2008:
C:\Users\%username%\AppData\Local\Temp\Outlook Logging\OPMLOG.LOG.

For more information, check out the following Microsoft articles:

What is the Enable logging (troubleshooting) option?

How to enable transport logging in Outlook

I love my IPhone, but...

2010-01-13T21:05:00.002-05:00

There are so many things from a design and features perspective that keep holding this device back (at least for me, anyway). Having owned, used, and supported numerous smart phones for the last 6 years, I can definitely see places where some improvements can be made.

Don't get me wrong--this is a good device. There are some fantastic concepts here, but even Apple needs a little help now and then.

1. I think the foremost feature missing from the IPhone is Adobe Flash. We live in a Web 2.0 world--a world depedent on interactive Flash applications. It's not like the device doesn't have the capability to run Flash--the IPhone 3GS is arguably one of the most powerful devices currently on the market. The reason is that Apple sees Flash as a competitor to its own QuickTime/h.264 technologies. Flash means that developers can bypass the App Store, which further would loosen Apple's stranglehold.

2. The next big hitter is the App Store. The App Store is one of the greatest innovations in the mobile device market--it's a place where the Microsoft Windows Mobile platform totally missed the boat. It's great to be able to go to one spot to find all of the software available for the platform. Of course, having that the *only* place from which to get content seems very restrictive and very un-internet-like.

3. Cut and paste. Yes, "Cut and Paste" now works--sort of. I can't believe the massive oversight here. Every smart platform before it had this type of "feature." I had Windows CE and Windows Mobile 2003 devices that could do this. Apple had the gall to herald it's coming to the IPhone like they'd revolutionized the market. Its implementation isn't that great (a triple-tap to select a paragraph or functionality in all Apps would be nice), so there's places where its intuitiveness could be improved.

4. Where is smart dialing? I'm spoiled as a Windows Mobile user here--the phone dialer on the IPhone is absolutely awful. Even non-smartphones have a better auto-filtering interface. Most phones filter the contact list automatically as you type in either letters or numbers. Not the IPhone. You either have to go to your contact list and search or go to the Search screen to hunt up a contact. Too many steps.

5. The ability to call someone directly from anywhere in an SMS message. It's great that I can copy the text of an SMS, but in order to initiate a phone call to someone with whom I'm texting, I need to scroll to the top of the window and press the "Call" button. Let me tap (or double-tap) the user's name anywhere in the SMS message and prompt me to call from there.

6. Select multiple messages for delete in Mail. So, I can search for messages; that's great. What if I want to mass delete all messages that meet a certain search criteria (such as a particular subject)? That would be nice. You can't even single-delete messages from a Mail search, much less select multiple messages.

7. Folder expand/collapse in Mail. As an Exchange ActiveSync user, I can see and retrieve content from any of my Outlook folders without having to individually select folders for synchronization. I dig it. But what I don't dig is the fully-expanded view of all my folders. I have about 150 folders in my Outlook tree. If I want to go to "Sent Items," it takes several swipes to get there--and then I usually have to swipe back up.

8. Speaking of Mail navigation, don't give me what appears to be a scroll/position bar on the right side of the screen when I'm scrolling through folders without the ability to click/drag it. That's just plain frustrating.

9. "Invisible" Bluetooth. While it does display a small icon next to the battery, it would be nice to see a low-power blinking LED to remind me that it's on, since a lot of my apps run full-screen and I lose the on-screen icon. All of my other phones had a little blue light that flashed whenever Bluetooth was activated. Throw a guy a bone, please, Apple.

10. Ability to password-prompt for app removal. I can't tell you how many Apps have been uninstalled inadvertently by my kids. You require a password to buy something from the App store; require one to remove the app as well.

Anyone else have features they'd like to see native to the IPhone?

Installing Data Protection Manager 2007 on a Dell NX3000

2010-01-10T21:48:00.007-05:00

Dell has this great NAS device that runs Windows 2008 Storage Server Standard--the NX3000. The only problem is that Dell treats it like an "appliance," meaning you can't partition it the way you want. I recently ordered two with 6x1TB drives and wanted to deploy DPM to them. Unfortunately, Dell's RAID1/RAID5 combo doesn't make very good use of the available storage. I wanted to be able to use most of the space for DPM storage, so I needed to re-set it up from scratch.

Dell only provides "recovery" media (an image as opposed to install media), so you need to obtain the Windows 2008 Storage Server media on your own (such as from MSDN). Note: Dell's recovery media will not work if the disk configuration if the first two drives are not in a mirror set.

I spent two days figuring it out so you don't have to.

Once you have the media, here are the steps to get it set up completely:

1. Download all of the drivers from the Dell Support Site and save them to a USB stick.
2. Install from Windows Storage Server 2008 media. Be sure to select the edition (if installing from media with multiple editions) that matches the WSS key on the system chassis). Use the WSS key on the chassis for installation.
3. Install drivers from USB stick.
4. Log in to server with username administrator, password wSS2008!. This would be the only OS I've ever installed with a pre-configured administrator password.
5. Install Dell OpenManage software from Dell System Build DVD.
6. Restart.
7. Add Web Server role and add all role services (except FTP).
8. Open command prompt and run start /wait ocsetup.exe SIS-Limited /norestart.
9. Run Windows Update and install all available updates to bring current.
10. Restart.
11. From System Center Data Protection Manager DVD, navigate to SQL2005 installation directory.
12. Run Setup to install SQL 2005.
13. Select Database, Reporting Services, and Workstation/Client components. Ensure all sub-items are selected by clicking "Advanced" button and expanding each component.
14. Specify an instance name of MS$DPM2007$.
15. On the Service Account page, select the Customize for each service check box and configure as follows:
a. Select Customize for each service account.
b. In the Service box, select SQL Server.
c. Select Use the built-in System account, then select Local System account.
d. In the Service box, select SQL Server Agent.
e. Select Use the built-in System account, then select Local System account.
f. In the Service box, select Reporting Services.
g. Select Use the built-in System account, and then select the Network service account.
h. In the Service box, select SQL Browser.
i. Select Use the built-in System account, then select Local Service account.
16. Accept defaults for the rest of the SQL 2005 installation.
17. Open the Internet Services Manager (Windows 2008 version).
18. Expand Web Sites, expand Default Web Site, and then click the virtual directory for the report server.
19. Under Features View, double-click Handler Mappings.
20. Under Actions, click Edit Feature Permissions.
21. Click to select the Scripts check box, and then click OK.
22. Close Internet Services Manager.
23. Open Services applet.
24. Stop all SQL services.
25. Run SQL 2005 SP2 setup.
26. Restart.
27. Launch System Center Data Protection Manager 2007 setup.
28. Select the local database instance (MS$DPM2007$).
29. Enter a strong password for the DPM account.
30. Complete setup, accepting all defaults.
31. Restart.
32. Download and install DPM 2007 SP1.
33. Restart.
34. Download and install most recent hotfixes from http://support.microsoft.com/kb/961659/EN-US.
35. Call 1-888-571-2048 (if in USA) to activate WSS by phone (online activation will most likely not work in this instance; you will need to speak to a representative).

Good luck!

A Long Way Home

2010-01-07T22:33:00.003-05:00

Most bar Long Island Iced Teas are made with a mix of bottom-shelf liquors and sour mix. This one is not.

1/2 oz Tanqueray Gin
1/2 oz Cointreau Orange Liqueuer
1/2 oz 1800 Silver Tequila
1/2 oz Bacardi Superior Rum
1/2 oz Absolut Citron Vodka
1/2 oz filtered water
1 Lemon
3 tsp sugar
Coca-Cola, Royal Crown, or other cola with a sweet aftertaste

Fill a shaker with fresh cracked ice and add all alcohols, water, and sugar. Cut lemon in half; squeeze one half into the shaker. Shake vigorously and strain into ice-filled glass. Top with Coca-cola or RC until it is the color of traditional iced tea. Cut the remaining lemon half in half and garnish drink.

Microsoft and EC Reach Settlement

2009-12-22T01:40:00.004-05:00

In Geek news last week, Microsoft reached an agreement with the EC for their antitrust case (yes, THAT antitrust case). Microsoft has agreed to give users the option of choosing from 12 web browsers upon the installation of Windows versions shipped to the EU.

Now, no matter how you feel about about Microsoft (love 'em, hate 'em, indifferent), I think this settlement has a much farther-reaching effect than many people care to consider.

For those of you who haven't been paying attention to this, the case stems back to the 90s, when Microsoft's Internet Explorer browser dominated the marketplace. It was argued that some of Microsoft's business tactics were anti-competitive (such as its agreements with OEMs), and the result was driving competitors like Netscape out of business. Lawsuits were filed, and Microsoft defended its position stating that Internet Explorer was an integral and inseparable part of Windows. It lost that argument, and now, for its punishment, must give consumers the opportunity to shop around for other browsers.

The plaintiffs contend that if given a choice, people will choose browsers other than Internet Explorer. Microsoft, of course, asserts that if people really wanted something different, they'd go get it.

Again, no matter how you feel about Microsoft, one has to really consider the implications of this agreement.

Showing (what I would consider to be) an utter lack of misunderstanding of the marketplace, EU Competition Commissioner Neelie Kroes said, "Millions of European consumers will benefit from this decision by having a free choice about which web browser they use."

She went on to say, according to The Register, "Microsoft’s biz strategy of tying its IE browser to the firm’s Windows OS was akin to a supermarket only offering one brand of shampoo on the shelf, with all other choices tucked away out of sight. “What we are saying today is that all the brands should be on the shelf.”"

Her analogy is very poor, not taking into consideration that the supermarket in her example might have a marketing deal with a particular shampoo company or have a family feud going between the maker of another brand of shampoo.

And, if you just go to the gas station on the corner, they might only stock one or two shampoos, unlike one of the megaliths (Wal-Mart, Target, etc.) that will stock dozens. Her idea of competition is more like forcing a particular chain of supermarkets to carry a set variety of product lines.

With the forthcoming release of a Google-branded netbook running Chrome OS (which, is essential, a browser on hardware), one has to wonder if lawsuits are going to pop up against Google to allow other browsers to be run? Google may very well try the "our hardware and software are inextricably linked" argument, if such a suit were to be filed.

If such a suit were to be filed (and Google were to lose with such an argument), that opens yet another Pandora's box:

Can anyone sue any vendor to be able to run any application they choose on the vendor's platform? Could I sue Sony to let me run the Nintendo OS on a PS3? Now that Apple is selling x86-based hardware, should I be able to sue so that I can get Windows factory-loaded on a MacBook Pro?

Even one step further, would it open the door for any competitor of any type of product to sue for compatibility and integration, predicated on the assumption that customers want a choice. For example, if ABC auto OEM sells 123 accessory, and XYZ auto OEM sells 789 accessory that performs a similar function--could XYZ sue ABC to make their interface compatible so that customers could choose to run XYZ's 789 accessories in ABC's autos?

Conversely, if Google were to win such a suit with the "our hardware is made to run only our software" argument, the opposite question is valid:

Could Microsoft (or any other vendor) start branding computers and sell Microsoft-branded laptops with Windows and Internet Explorer only and bypass the EC's judgment?

One could argue that if a consumer goes to a Microsoft brick-and-mortar store and buys a Microsoft-branded computer, that they are overtly choosing the Microsoft platform.

It may sound ridiculous, but if you really look at the arguments that have been played over the last decade, I don't think those types of questions are outside the realm of legal possibility. And, seeing as how we are quite a litigious race, I could imagine such lawsuits being on the horizon.

Raspberry Lemon Drop

2009-11-21T09:13:00.007-05:00

Last night, I was kicking around ideas for a new drink. I really enjoy Lemon Drops, and I really enjoy raspberry lemonade, so I thought it might be good to mix the flavors.

This is what I came up with.

Raspberry Lemon Drop
3/4 oz Absolut Citron Vodka
3/4 oz Effen Raspberry Vodka
3/4 oz Simple Syrup
1/2 oz Cointreau Orange Liqueur
1 lemon

Combine all ingredients in a stainless cocktail shaker with ice. Shake vigorously until shaker is frosty. Strain into martini glass.

Troubleshooting 0xc0190036 Errors on Windows Vista / Windows 2008

2009-10-20T13:14:00.001-04:00

This morning, I found myself in the unfortunate circumstance of the dreaded 0xc0190036 error. There is not a lot of information about this particular error code. It is, in fact, related to inaccessible or corrupt files.

During an update process, many files are flagged for replacement during the next system boot--that way, the system can keep running until the next convenient restart. In this case, however, some of the files are corrupt for whatever reason (bad blocks on hard drive, bad memory causing CRC errors, lots of potential sources). The solution is relatively easy once you know what the problem is.

To repair this problem, you will need:

- Windows Vista or 2008 Boot Media
- USB thumb drive containing
-- disk controller drivers not included on Windows Media
-- replacement for corrupt file
- ImageX (or another way to read the Windows install.wim from either the original media or service pack installation)

ImageX is part of the Windows Automated Installation Kit (WAIK). It's a 1GB download; a few folks have been kind enough to extract the necessary bits and host them. If you are unable to find them, leave a comment and I'll send them to you.

The file listed in the 0xc0190036 error is most likely the corrupt file. The first step is to extract the replacement files using ImageX. In this case, I'm going to be using the Windows 2008 SP2 installation media since it contains the updated file that I need (hvboot.sys).

1. After extracting the ImageX support files, right-click wimfltr.inf and select "Install." This will install the WIM Filter Driver (required to mount WIM files).
2. Create a temporary directory to which the WIM file will be mounted (such as C:\Mounted_Images).
3. Run the command imagex /mount e:\sources\install.wim 1 C:\Mounted_Images to mount image 1 inside the install.wim file to C:\Mounted_Images.
4. Copy the necessary file (in my case, C:\Mounted_Images\Windows\winsxs\amd64_microsoft-hyper-v-drivers_31bf3856ad364e35_6.0.6002.18005_none_c73bce55acf5cb5f\hvboot.sys) to a USB thumb drive.

Next, you'll need to make sure you have the appropriate RAID drivers for your system if they are not included on the Windows media. If you presented driver media during the original Windows installation, you can use that media.

Finally, the repair:

1. Boot to the Windows Vista or 2008 installation media.
2. Attach your USB thumb drive containing the replacement for the corrupt file as well as controller drivers.
3. Select "Repair My Computer."
4. Select "Load drivers" and browse to the drive containing your controller driver (in my case, the USB drive was mounted as C:\).
5. Select the driver from the list presented and click "Add driver."
6. Click Next to go to the repair menu.
7. Select "Command Prompt" to launch a command prompt session.
8. Run chkdsk /F on your system volume (in my case, the system volume had been mounted as E:\, so I ran chkdsk /f e:\).
9. When prompted, dismount the volume so Chkdsk can have exclusive access to it.
10. When Chkdsk is complete, copy the replacement file from your USB thumb drive to the appropriate location on your system drive (since the system volume had been mounted as E:\, I needed to copy hvboot.sys to E:\Windows\system32\drivers).
11. Restart.

If you encounter more c0190036 errors, you can repeat the process for each damaged file.

The Lemon Drop

2009-09-29T21:20:00.004-04:00

Any bartender can combine cheap ingredients and pre-made mixes. But if you want to make incredible drinks people really enjoy, you need to start with good quality ingredients.

A little high school chemistry never hurt, either.

The Lemon Drop is a drink that is routinely desecrated with bottom-shelf vodka and sour mix. If you've spent any time on my drinks blog posts, you'll find that I favor drinkability and flavor over just about everything else.

This is no different.

Lemon Drop
1 1/2 oz Belvedere Vodka
3/4 oz Caravella Limoncello
-or-
2 oz Absolut Citron Vodka
1/4 oz Caravella Limoncello

3/4 oz simple syrup
1/2 oz Cointreau Orange Liqueur
1 fresh-squeezed lemon

Rim either an old-fashioned or martini glass with the squeezed lemon and dip in sugar. Combine the spirits and fresh-squeezed lemon in a metal shaker full of ice. Shake until the canister is frosty and strain into the glass. Garnish with a lemon wedge.

If the drink is too strong, you can add a splash of club soda without affecting the flavor.

An Old Fashioned Drink for the Modern Man

2009-09-24T20:56:00.005-04:00

If you're looking for a drink that hearkens back to simpler times or a crisp drink that none of your neighors are drinking, look no further than the Old Fashioned. Concocted as early as 1806 (according to some), this blend of whisky or bourbon tempered by a little sugar and bitters hits the spot every time.

Old Fashioned
1 tsp or so of simple syrup (or about 1/2 tsp of loose sugar)
Splash of club soda or water
2 or 3 dashes of Angostura bitters
1 1/2 oz of whisky or bourbon (I prefer Maker's Mark)

Comine the syrup, club soda (or not, if you're a purist), and bitters in a glass with an ice cube. If using loose sugar, make sure it's fully dissolved. Swirl around until the inside of the glass is coated. Add the whisky or bouron. Serve with a cherry or two and an orange slice.

Setting up a Receive Connect for Postini Re-Injection

2009-09-24T09:10:00.009-04:00

For any of you that use Postini for email services, setting up reinjection for the receive connectors in Exchange 2007 is a lot more work than allowing connection and relay through a vSMTP server in Exchange 2003.

Exchange 2007 has a lot of great features, such as the uber-powerful Exchange Management Shell. IMHO, Exchange 2007 also has a lot of drawbacks, such as a half-assed GUI. You can only achieve the most basic things through the GUI; anything that requires thought or a little more configuration is done through the cumbersome Exchange Management Shell interface.

To achieve the previously simple task of allowing relay through a vSMTP server, you can go one of two routes. I'm going to document the route that grants least privilege. The MSExchangeTeam blog as well as Technet both have variations on this as well as the Pro's and Con's of using it.

Allow Anonymous Relay
1. Open the Exchange Management Console.
2. Expand Server Configuration > Hub Transport.
3. Select the server in the top pane, and then click New Receive Connector... in the right pane.
4. Enter a name for the connector, such as "Postini Receive Connector," select "Custom" as the intended use for the connector, and click Next.

5. Select the "All availble IPv4 addresses" entry and click the Edit... button.

6. Select the "Specify an IP address:" radio button, enter the IP address of the interface that will be communicating with Postini, and click OK.

7. Enter the Fully-Qualified Domain Name the connector use to respond to connection attempts (most likely something like mail.mydomain.com) and click Next.

8. Click the 0.0.0.0-255.255.255.255 enter and click Edit....

9. Enter the appropriate address range for the Postini system you use. Systems 5, 6, 7, 8, and 20 are 64.18.0.0/20 (64.18.0.0./255.255.240.0); System 9 is 74.125.148.0/22 (75.125.148.0/255.255.252.0); Systems 20, 200, and 201 are 207.126.144.0/20 (207.126.144.0/255.255.240.0) and click OK.

10. Click Next.
11. Click New.

12. Right-click on the new connector, select Properties, select the Authenticaion tab and Ensure "Transport Layer Security" and "Basic Authentication" are selected.
14. Click the Permissions Groups tab and ensure Anonymous Users is selected.
15. Click OK.

So that gets you about half-way there. To finish it up, open the EMS and Copy/Paste the following cmdlet in:

Get-ReceiveConnector "Postini Receive Connector" | Add-ADPermission -User "NT AUTHORITY\ANONYMOUS LOGON" -ExtendedRights "Ms-Exch-SMTP-Accept-Any-Recipient"

Replace "Postini Receive Connector" with the name of the connector you created in Step 4 above.

If you want to use the EMS to create and set the permissions on the new connector, you can use these cmdlets:

New-ReceiveConnector -Name "Postini Receive Connector" -AuthMechanism "Tls,BasicAuth" -Usage Custom -PermissionGroups AnonymousUsers -Bindings 10.0.0.11:25 -RemoteIpRanges 64.18.0.0/20

Get-ReceiveConnector "Postini Receive Connector" | Add-ADPermission -User "NT AUTHORITY\ANONYMOUS LOGON" -ExtendedRights "Ms-Exch-SMTP-Accept-Any-Recipient"

Replace the values for -Name, -Bindings, and -RemoteIPRanges as necessary.

For more information on these types of connectors:
MSExchange Team Blog
Microsoft Technet

Using LDIFDE and CSVDE to find computers in Active Directory

2009-09-03T09:09:00.005-04:00

LDIFDE is an oldie-but-goodie tool for finding specific information in Active Directory. If you know the name of the attribute that contains the data you're looking for, you can construct a pretty powerful query.

For example, you can search for all computers in the Active Directory domain mydomain.com:

ldifde -f output.txt -r "(objectClass=computer)" -d "dc=mydomain,dc=com"

You can filter it down to all workstation-class computers (running Windows XP), as well:

ldifde -f output.txt -r "(&(objectClass=computer)(operatingSystem=Windows XP))" -d dc=mydomain,dc=com

Or even all workstations running Windows XP and Vista:

ldifde -f output.txt -r "(&(objectClass=computer)((operatingSystem=Windows XP)(operatingSystem=Windows Vista)))" -d dc=mydomain,dc=com

And workstations running Windows 2000, XP, and Vista:

ldifde -f output.txt -r "(&(objectClass=computer)(((operatingSystem=Windows XP*)(operatingSystem=Windows 2000 Pro*)(operatingSystem=Windows Vista))))" -l "cn,operatingSystem" -d dc=mydomain,dc=com

"But Aaron," you ask, "LDIFDE returns a lot of fields I don't need. How can I control the output?" Glad you asked.

You can use the -l switch to do just that:

ldifde -f output.txt -r "(&(objectClass=computer)(operatingSystem=Windows Server*))" -d dc=mydomain,dc=com -l "cn,operatingSystem"

Will return an output like this:

dn: CN=SERVERA,OU=Servers,DC=mydomain,DC=com
changetype: add
cn: SERVERA
operatingSystem: Windows Server 2003

You can swap out LDIFDE for the tool CSVDE to generate the output in a CSV format.

How to Schedule Recycling an IIS Application Pool

2009-07-31T10:21:00.012-04:00

We have a customer with an IIS 6.0 application that crashes randomly--either the Application Pool worker process runs the server out of memory or hangs.

If you have a need to recycle the Application Pool between scheduled maintenance intervals, there are a couple of available solutions.

Windows 2003 (IIS 6)

IISApp.vbs
This script is part of the Windows 2003 Platform. Windows 2003 SP1 introduced the ability to recycle application pools. The syntax is pretty easy:

IISApp /a /r

Save this into a batch file and drop it into the task scheduler.

Application Pool Recycling through IISAdmin
1. On the taskbar, click Start, point to Administrative Tools, and then click Internet Information Services (IIS) Manager.
2. Expand the server name, and then click Application Pools.
3. Right-click > Properties on the Application Pool you wish to recycle.

4. Set the appropriate properties for recycling.

5. For example, to recycle the worker processes at 6AM, select the "Recycle worker processes at the following times" checkbox and enter the appropriate time (24-hour format).

6. Click OK.

Windows 2008 (IIS 7)

1. On the taskbar, click Start, point to Administrative Tools, and then click Internet Information Services (IIS) Manager.
2. In the Connections pane, expand the server name, and then click Application Pools.
3. In the Application Poolspane, select the application pool you wish to edit.
4. In the Actions pane, click Recycling...

5. On the Recycling Conditions page of the Edit Application Pool Recycling Settings Wizard, select at least one of the options in the Fixed Intervals section, select the checkboxes and enter values for "Regular time intervals" or "Specific Times" as necessary, and then click Next.
6. Click Finish.

Obama Drinks to Race Relations

2009-07-30T21:02:00.004-04:00

Sometimes a man just can't catch a break.

The blogosphere buzz from the Right is downright crazed about how Obama sat down to share beers with William Gates and the police officer who arrested him. Reading the tweets and Facebook replies to a recent NRP segment with Ken Rudin shows how so many people missed the boat:

Dear Mr. President: Stop wasting your time and acting "stupidly" in things that you should NOT be involved, stop giving your opinion for the actions of a "cranky old friend with a minority complex", and stop solving your verbal diarrhea with beer happy hours at the expense of Tax Payers. ...Ah, and stop walking like John Travolta in Saturday Night Fever ..."Not Cool"...

Oh yeah... drinking beer is the answer to all our problems today... why don't we smoke a joint while we are at it... or now how did Bob Dylan put it... Tellin' me he loves all kinds-a people. He's eatin' bagels. He's eatin' pizza. He's eatin' chitlins.

I think everyone should take a step back and think about how you would resolve a situation involving inflammatory remarks and strong disagreements. Maybe duke it out in the parking lot? That doesn't seem very productive.

I think I have to vote with the President on this one. Go grab a couple of beers and sit around and talk about what happened. That one-on-one personal communication works in any number of situations. I think the world would be a lot better off if we followed Obama's lead and talked out our problems instead of gossiping or backstabbing or lashing out in some other way.

One of the most powerful properties of social drinking is the socialization aspect. Alcohol tends to remove the inhibitions we have in our normal lives, which if not controlled, can have disastrous consequences. But, it can also be an excellent catalyst for very frank discussions.

To put the Biblical spin on it, Jesus presents it this way in Matthew 18:15-17:

Moreover if thy brother shall trespass against thee, go and tell him his fault between thee and him alone: if he shall hear thee, thou hast gained thy brother. But if he will not hear thee, then take with thee one or two more, that in the mouth of two or three witnesses every word may be established. And if he shall neglect to hear them, tell it unto the church: but if he neglect to hear the church, let him be unto thee as a heathen man and a publican.

The admonition is clear--get the parties in a room and talk about it. If everyone makes up, then you've gained an ally. If you can't come to an agreement, get another trusted person involved.

For all of you asking WWJD, I think Obama is on-track here.

I would challenge anyone this:

The next time you have a serious disagreement with someone at work, be the bigger person. Invite them out for a few drinks, talk about what's bothering you, explain how you feel. And then pay for the drinks. See how much that changes your relationship with that person, and consequently, your standing in the office. You have nothing to lose and everything to gain.

Bottoms up to that.

My Favorite Whisky Sour

2009-07-19T22:20:00.003-04:00

Sometimes, you just need a good whisky. Or whiskey. Take your pick. And sometimes, you need a good whisky sour.

Whisky Sour
2 oz Maker's Mark Bourbon
1 oz fresh squeezed lemon
1 oz water
Splash of Southern Comfort 100
1 tsp sugar

Combine in a shaker with ice. Shake vigorously for about 15 seconds and strain into a double old-fashioned filled with ice. Good to the last drop.

Longhorn Steak House "Perfect Margarita"

2009-07-03T00:16:00.002-04:00

The Longhorn Steak House in Sterling, Virginia makes a great margarita. So great, in fact, that I decided to try to make it myself. No mixes here--only the real deal.

Longhorn Steak House Perfect Margarita
1 1/2 oz 1800 Reposado Tequila
1/2 oz Cointreau orange liqueur
1/2 oz Grand Marnier orange liqueur
1/2 oz pulp-free orange juice
2 1/2 oz fresh-squeezed lime juice
1/2 oz fresh-squeezed lemon juice
1 oz water
2 tsp sugar

Combine all ingredients in a shaker with cracked ice. Shake vigorously for 10-15 seconds and strain into salt-rimmed glasses.

Delicioso!

Best Damn White Russian. Ever.

2009-06-21T22:33:00.007-04:00

A few months ago, I posted this most excellent recipe for a White Russian.

This one is even better.

The Dude would be proud.

Best Damn White Russian
2 oz Kahlua Coffee Liqueur
1 oz Stoli Vanil (vanilla Vodka)
2 oz Bailey's Irish Cream
1 oz milk or cream

Add all ingredients to a double-old fashioned glass with ice. Stir gently and enjoy.

Vida la Cuba Libre!

2009-06-21T22:18:00.004-04:00

At the beginning of this fine Father's Day weekend, I was trying to think of a new drink to make. I stumbled upon this gem--the Cuba Libre. I made it a couple of different ways; each one brings its own pleasure.

Cuba Libre
1 1/2 oz white rum, such as Bacardi Superior
1 lime
Coca-cola

Fill a collins or highball glass with ice cubes and squeeze in the juice of one lime. Add rum, and top off with the Coca-cola. Stir gently.

If you're more of a Captain and Coke kind of guy (or girl), you can also try adding a lime to it. It enhances the flavor in an interesting way and makes for a new twist on an old standard.

Exchange Delegates

2009-06-19T14:27:00.004-04:00

I recently found myself in a spot where I needed to troubleshoot a delegate issue--a user was set as a delegate but no longer was with the company and didn't have a mailbox anymore, so periodic NDRs were being generated for mail destined for the delegate.

To discover all of the mailbox for which this person had been a delegate, I ran the command (on a domain controller or machine that had ldifde.exe):

ldifde -f delegates.txt -d "dc=domain,dc=com" -r "(publicDelegatesBL=CN=First Last,OU=AppropriateOU,dc=domain,dc=com)" -l name,publicDelegatesBL

Active Directory holds delegate information in two attributes--publicDelegates (listing which users are delegates of "n" mailbox) and publicDelegatesBL (listing which users "n" mailbox is a delegate of).

To find out all of the the mailbox of Aaron Guilmette in OU=Home,DC=aaronguilmette,DC=com:

ldifde -f delegates.txt -d "dc=domain,dc=com" -r "(publicDelegates=CN=Aaron Guilmette,OU=Home,DC=aaronguilmette,DC=com)" -l name,publicDelegates

To find out all of the mailboxes for which Aaron Guilmette in OU=Home,DC=aaronguilmette,DC=com is a delegate:

ldifde -f delegates.txt -d "dc=domain,dc=com" -r "(publicDelegatesBL=CN=Aaron Guilmette,OU=Home,DC=aaronguilmette,DC=com)" -l name,publicDelegatesBL

To find out all of the delegate relationships for a domain:

ldifde -f delegates.txt -d "dc=domain,dc=com" -r "((publicDelegates=*)(publicDelegatesBL=*))" -l name,publicDelegates,publicDelegatesBL

Hope this is helpful to some of you.

Fuzzy Navels for All

2009-05-20T12:01:00.007-04:00

Here's a drink that's a crowd pleaser at just about any get-together. In fact, here's the same drink three different ways.

Fuzzy Navel - Original Recipe
1 1/2 oz DeKuyper Peach Tree Schnapps
Pulp-free orange juice

Add ice to a collins or highball glass. Pour in peach schnapps. Top off with orange juice and stir.

Since most schnapps aren't very high proof, this drink isn't very strong. It does have a good flavor, though, which counts for something.

Fuzzy Navel - Bar Recipe
1 1/2 oz DeKuyper Peach Tree Schnapps
1/2 oz vodka
Pulp-free orange juice

Add ice to a collins or highball glass. Pour in peach schnapps and vodka. Top off with orange juice and stir.

This is the typical recipe that you'll get at a bar. It's got a little more kick to it, but depending on the vodka used, sometimes comes off a little sharp.

Fuzzy Navel - Top Shelf
1 1/2 oz DeKuyper Peach Tree Schnapps
1/2 oz Cointreau orange liqueur
1/2 oz vodka
Pulp-free orange juice

Add ice to a collins or highball glass. Pour in peach schnapps, Cointreau, and vodka. Top off with orange juice and stir.

This is my own recipe. It's packs even more punch, but since Cointreua is such an easy sipper, it's much more subtle. The Cointreau really blends well with the schnapps and creates a most excellent drink, in my opinion.

Mix and enjoy.

Lemon Rickey

2009-05-17T22:48:00.003-04:00

Out of limes tonight, I decided to start mixing something new. I at least had some other key ingredients.

Lemon Rickey
1 1/2 oz Bombay Sapphire Gin
1/2 oz Cointreau orange liqueur
Juice of 1 lemon
2 tsp sugar
club soda

Squeeze a lemon into a highball glass filled with ice. Add the sugar, gin, and Cointreau. Top off with club soda and stir.

Active Sync Error 85010014 OTA with Exchange 2003

2009-05-08T11:25:00.004-04:00

Recently, we renumbered a client's network to reduce broadcast traffic and introduced two new redundant internet connections. Everything seemed fine in the initial testing, and we all went home.

The next day, when we were sifting through the fallout tickets, there was a recurring theme--Windows Mobile devices were no longer synchronizing. During an ActiveSync over the air, they would receive error 85010014. It's a dreaded error and is usually seen when using ActiveSync 4.1 on a desktop.

I had just set this Exchange server up a few weeks ago, and ActiveSync was previously working. It appeared to stop working after the IP address for the Exchange server changed.

The server was the only Exchange server in the environment and had an SSL cert bound to the default website for mail.[domain].com. OWA and RPC/HTTPS connections were working fine.

However, when browsing to mail.[domain].com/OMA, I received a server processing error. Once I got that response, I immediate knew where to look. I navigated to IIS Manager > Web Sites > Default Web Site > exchange-oma. What is exchange-oma you ask? If follow Microsoft KB 817379 for doing single-server deployments where you have Forms-based authentication and SSL enabled on your only Exchange server, you know what I'm talking about.

In Exchange scenarios where you have both front-end and back-end servers, this isn't typically an issue. There are a number of HTTP calls that are made to the /exchange directory on the back end server, which execute normally. However, when you only have a single server deployment and apply Forms-based authentication, the /exchange directory is protected via SSL. The work-around that KB 817379 walks you through is to create a secondary virtual directory that ActiveSync devices will use for communication that does not have Forms-based authentication.

My problem was in steps 13-14 for re-creating the virtual directory under Method 2 of KB 817379. You are supposed to add an IP Address restriction for the newly created virtual directory for ActiveSync/OMA users so that all except the IP address of the server you're configuring can connect.

Once I had updated that IP address entry to reflect my server's new address. the errors went away.

Cinco de Mayo Drinks

2009-05-05T11:50:00.007-04:00

Ahh! Summer is upon us. Today we celebrate Cinco de Mayo, the day set aside to commemorate General Ignacio Seguin's victory over the French at the Battle of Puebla. As to how this translates to fajitas, tequila, and piñatas, I'm not quite sure.

But, who am I to argue with tradición?

Here are a few classic drinks to make your cinco sensational.

Classic Margarita
1 1/2 reposado tequila
1 oz Grand Marnier orange liqueur
3/4 oz fresh squeezed Mexican lime juice
Splash of orange juice

Shake all ingredients with ice. Strain into a salt-rimmed cocktail glass and serve with a lime wedge.

If you don't use Mexican limes, add a tsp or so of sugar.

La Paloma
1 oz blanco tequila
3/4 - 1 1/2 oz lime (depending on taste)
pinch of salt
grapefruit soda (such as Squirt)

Fill a collins or highball glass about half-way with ice cubes. Add the tequila and salt. Squeeze in the lime and then drop the rind in the glass. Top off with grapefruit soda.

Tequila Sunrise
1 1/2 oz reposado tequila
1/2 oz Rose's Grenadine
4 oz orange juice

Fill a collins or highball glass about halfway with ice and add tequila. Pour in orange juice to taste. Tip glass and pour grenadine down the inside of the glass. It should hit the bottom and begin swirling up. Garnish with a cherry and orange wheel or slice.

If anyone else has a favorite Cinco drink, feel free to share!

Summertime Drink: The La Paloma

2009-05-01T01:14:00.003-04:00

I had the pleasure of mixing up this delightfully fresh summer drink tonight. It was kind of a dreary day, so I was trying to bring out the sun (even though it was 9:00pm). This tasty Mexican beverage is very similar to a margarita, but easier to make and more forgiving.

La Paloma (Classic)
2 oz blanco tequila
1/2 oz lime
pinch of salt
grapefruit soda (such as Squirt)

La Paloma (All-day sipper)
1 oz blanco tequila
3/4 oz lime (about 1/2 lime)
pinch of salt
grapefruit soda (such as Squirt)

Fill a collins or highball glass about half-way with ice cubes. Add the tequila and salt. Squeeze in the lime and then drop the rind in the glass. Top off with grapefruit soda.

Oatmeal Cookie

2009-04-17T01:14:00.004-04:00

There are a lot of "food-like" drinks around right now. Chocolate Cake. Banana Creme Pie. Oatmeal Cookie. Yes, Oatmeal Cookie. All that's missing are the raisins:

Oatmeal Cookie
2 oz Bailey's Irish Cream
1 oz DeKuyper Hot Damn or Goldschlager Cinnamon Schnapps/Liqueur
1 oz DeKuyper ButterShots Liqueur

Shake all ingredients with ice and strain into glass.

Erratic or Negative Ping Times in Hyper-V Guests

2009-04-16T14:14:00.011-04:00

A customer approached me with a some puzzling issues. They noticed a bunch of 1053 and 1054 Userenv errors in their event logs on their virtual machines. 1053 and 1054 error messages have very similar wording:

1053 - Windows cannot determine the user or computer name. (description>). Group Policy processing aborted.
1054 - Windows cannot obtain the domain controller name for your computer network. (). Group Policy processing aborted.

Typically, these are related to DNS. In this instance, however, the customer also presented some other interesting issues--negative ping times or very high ping times (in excess of 5000ms). And, to boot, these erratic ping times were only present on virtual machines with two or more virtual processors.

So, what's the relationship?

It turns out to be a relatively simple explanation.

In order for a Group Policy client to be qualified to process GPOs, AD measures the RTT time between the client and the DC processing the logon and group policy request. If the average RTT is > 10ms for 2048 byte packets, the link is generally considered "slow" by default (another value can be configured). Under "slow" conditions, group policy will not process. I’ve seen this issue before in environments where authentication is happening over a WAN (where times are greater than 10ms) or with routers dropping or fragmenting large ICMP packets (affectionately known as “blackhole router syndrome”).

So, if a machine is reporting a 5000ms ping, it stands to reason that the OS might think that the link is indeed slow.

As previously mentioned, this problem is occurring on Windows 2003 hosts that are configured for multiple virtual processors (VPs). All operating systems use some sort of clock timing mechanism, and frequently they rely on the Time Stamp Counter (TSC), which counts CPU ticks since system start. Each processor has its own TSC, and the TSC for each processor can be different because they’re not necessarily synchronized. What this ends up meaning is that if a VM is reading the TSC from multiple VPs, the date stamps may actually go backwards or be out of order. This does not happen in a single CPU scenario (physical or virtual), since only one TSC is being used.

The three possible workarounds:
1. Upgrade to Windows 2008. Obviously, this won't work for everyone, so for those people, workarounds two or three should provide some relief.
2. Shut down the VM, change the number of CPUs to 1 in Hyper-V manager and then start the VM.
3. Add the /usepmtimer switch to the boot.ini configuration of each Windows 2003 server using multiple processors. In the physical world, this phenomenon only appears to only happen on AMD processors. The VM world is less discriminating against processor type. Windows 2003 SP2 normally is supposed to use the ACPI Power Management Timer (PM Timer), as long as the BIOS check for it succeeds. In the case of Hyper-V, the BIOS check fails, so it falls back to the TSC. Remember, modifying the boot.ini requires a reboot for the change to become effective.

The Win32 API call, QueryPerformanceCounter, uses the TSC by default. Adding the /usepmtimer boot.ini flag tells QueryPerformanceCounter to use the ACPI/PM timer.

Related information:

Wikipedia - Time Stamp Counter

A Windows Server 2003-based server may experience time-stamp counter drift if the server uses dual-core AMD Opteron processors or multiprocessor AMD Opteron processors

Programs that use the QueryPerformanceCounter function may perform poorly in Windows Server 2000, in Windows Server 2003, and in Windows XP

Explanation for the USEPMTIMER switch in the boot.ini

Windows Server Performance Team Blog : Hyper-V and Multiprocessor VMs

Negative ping times in Windows VM's - what's up?

How a slow link is detected for processing user profiles and Group Policy

How to enable user environment debug logging in retail builds of Windows

Available switch options for the Windows XP and the Windows Server 2003 Boot.ini files

Rebuild a Corrupt WMI Repository

2009-04-14T14:25:00.003-04:00

From time to time, many administrators have found themselves faced with a corrupt WMI repository. Here's a quick fix. Copy/paste into a .bat file and run on the affected computer.

NET STOP WINMGMT /y
RD /S /Q C:\Windows\system32\wbem\Repository
%windir%\system32\rundll32 wbemupgd,UpgradeRepository
FOR %%i in (%windir%\system32\wbem\*.dll) do RegSvr32 -s %%i
FOR %%i in (%windir%\system32\wbem\*.exe) do %%i /RegServer

You'll probably get a pop-up for wbemtest when you run this script because of the FOR loop including all *.exe files. Simply click "exit" when the wbemtest application launches.

Chocolate Martini

2009-04-09T09:55:00.001-04:00

A great meal is in need of a great dessert drink.

This is that drink.

Chocolate Martini
2 1/2 oz Bailey's Irish Cream
1 1/2 oz Stolichnya Vanilla Vodka
1 oz Godiva Chocolate Liqueur or Crème de Cacao
Splash of milk or half and half

Rim a chilled martini glass with milk and then roll the rim in a good powdered hot chocolate. Tip the glass up and drizzle chocolate syrup on the inside. Combine all ingredients in a shaker with ice. Shake vigorously 10-12 times and strain into glass. Garnish with a shaved piece of chocolate.

New White Russian on the Block

2009-03-30T16:00:00.008-04:00

It's been a while since I've posted a new recipe (or a twist on an old one). Out of one the normal ingredients (whole milk or cream), I substituted and came up with this delightful blend:

New White Russian
2 oz Kahlua Coffee Liqueur
1/2 oz vodka
1 oz Bailey's Irish Cream
2 oz Silk Soy Milk

Combine all ingredients in a shaker with ice. Shake a couple of times, but not too much; it's not supposed to be a frothy drink. Strain into a double old-fashioned glass with a few cracked ice cubes.

It's creamy, coffee goodness. And, with Silk, it's a little less of a calorie hit than cream or whole milk. ;-)

Because you know me. Concerned about health and all.

Using WinDbg for Quick Memory Dump Analysis

2009-03-20T15:50:00.011-04:00

Blue screens are no fun. Trying to resolve them without the proper tools can be even less fun.

In my experience, a large percentage of blue screens are the result of some poorly-tested or incompatible third-party device drivers. For the desktop crowd, a round up of the usual suspects includes scanner, printer, and video drivers. On the server end of things, the most likely culprits are usually backup/continuous data protection filter drivers or printer drivers.

All standard troubleshooting questions apply in either case:
- Has any new hardware been installed?
- Has any software recently been installed (either new applications or patches)?
- Have any existing device drivers been updated?
- Can you reproduce the conditions that cause the blue screen (for example, under heavy load conditions or during a backup window)

Take this case. I recently received a dump file from a server that had crashed and recovered overnight. To analyze the dump file, head on over to the microsoft.com site and get the appropriate debugging tools for your platform (x86 or x64/ia64).

In my case, I needed the 32-bit debug package. I downloaded and installed it, and then ran C:\Program Files\Debugging Tools for Windows (x86)\windbg.exe.

Before we can make any progress, we should grab the Windows symbols, which will allow the debugger to go through the crash dump and identify components.

Make a directory on your local computer, such as C:\Symbols. From inside WinDbg, go to File > Symbol File Path.

In the dialog box, type in

SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

and click OK. This will instruct WinDbg to contact the Microsoft symbols server and download the parts that you need and store them in C:\symbols.

Now that the symbols are configured, click File > Open Crash Dump.

Browse to your memory dump file, and select it. WinDbg will process it, and should return something like this:

At this stage, WinDbg has identified vsp.sys as a likely source of the problem. Type !analyze -v in the text box at the bottom and hit enter.

WinDbg will process a bit more and return some (hopefully) useful information.

The key area to look at is the "DEFAULT_BUCKET_ID," which, in this case, says "DRIVER_FAULT_SERVER_MINIDUMP." Browsing through the dump file, you can see that the system ran out of PTEs and subsequently crashed.

Having worked with NetBackup for a number of years, I recognized vsp.sys immediately as part of NetBackup. However, if you want to try to figure out more from the dump file, typing the command lmv will list the loaded modules. After it's done listing the images, press Control-F to and enter the driver that was listed as faulting.

Unfortunately, the dump file didn't have the full path to the loaded driver, so we've hit a little bit of a wall.

In this instance, the faulty driver (vsp.sys) is part of the Advanced Open File option for the Veritas NetBackup client. We upgraded the NetBackup agent to the latest version and all is well again.

Good luck!

Windows 2008 Server Backup

2009-03-15T23:26:00.004-04:00

This is not your father's backup. This is not your backup. Frankly, this should be nobody's backup.

Recently, I found my self in need of having to make a quick snapshot of a physical server's configuration before making some complex configuration changes.

So, I hit the Windows Key + R, and typed the tried-and-true ntbackup. No dice. What? Where did this go?!

It's not there anymore. Instead, we now have "Windows Server Backup," a rewrite that adds a lot of new features (backup files are stored as a VHD, which is pretty neat), but they come with a price--an unintuitive and complex command line.

After performing my initial backup without incident, I made my configuration changes, but eventually found myself in need of restoring from backup. I entered the Windows Server Backup console and went to restore, but was dutifully informed that if I wanted to restore the System State, I would have to do it from the command line.

So, I launch the command-line tool, wbadmin.

C:\Users\Administrator>wbadmin
wbadmin 1.0 - Backup command-line tool
(C) Copyright 2004 Microsoft Corp.

ERROR - Command incomplete. See list below.
For more help, type wbadmin -help

---- Commands Supported ----

ENABLE BACKUP -- Enable or modify a scheduled daily backup
DISABLE BACKUP -- Disables running scheduled daily backups
START BACKUP -- Runs a backup
STOP JOB -- Stops the currently running backup or recovery
GET VERSIONS -- List details of backups recoverable from a
specific location
GET ITEMS -- Lists items contained in the backup
START RECOVERY -- Run a recovery
GET STATUS -- Reports the status of the currently running job
GET DISKS -- Lists the disks that are currently online
START SYSTEMSTATERECOVERY -- Run a system state recovery
START SYSTEMSTATEBACKUP -- Run a system state backup
DELETE SYSTEMSTATEBACKUP -- Delete system state backup(s)

Seeing this, I discover what I believe is the appropriate option--START SYSTEMSTATERECOVERY, since the System State is what I'm trying to recover.

So, I run wbadmin START SYSTEMSTATERECOVERY, but ... then I get another screen.

C:\Users\Administrator>wbadmin START SYSTEMSTATERECOVERY
wbadmin 1.0 - Backup command-line tool
(C) Copyright 2004 Microsoft Corp.

ERROR - An option required for command is missing: Version. See usage below.

Usage: WBADMIN START SYSTEMSTATERECOVERY
-version:VersionIdentifier
-showsummary
[-backupTarget:{VolumeName | NetworkSharePath}]
[-machine:BackupMachineName]
[-recoveryTarget:TargetPathForRecovery]
[-authsysvol]
[-quiet]

Runs a system state recovery based on the options specified.

-version Version identifier of the backup in MM/DD/YYYY-HH:MM format,
as listed by WBADMIN GET VERSIONS.

-backupTarget Specifies the storage location that contains the backups for
which you want to do the recovery. Useful when the backups are
stored in a different location than the normal location for
backups of this computer.

-machine Specifies the name of the computer for which you want to do the

recovery. Useful when multiple computers have been backed up to

the same location. Should be used when -backupTarget is
specified.

-recoveryTarget Existing directory path to restore to. Useful if the restore
is to be done to an alternate location.

-authsysvol Perform an authoritative restore of SYSVOL

-quiet Runs the command with no user prompts.

-showsummary Reports the summary of the last run of reboot status of last
successful online system state recovery. This option cannot be
accompanied by any other options.

Examples:
WBADMIN START SYSTEMSTATERECOVERY -version:03/31/2005-09:00
WBADMIN START SYSTEMSTATERECOVERY -version:04/31/2005-09:00 -backupTarget:\\serv
ername\share
-machine:server01

C:\Users\Administrator>

Ug. How do I discover the version that I need to restore? Scrolling back through the list reveals another option--GET VERSIONS.

C:\Users\Administrator>wbadmin GET VERSIONS
wbadmin 1.0 - Backup command-line tool
(C) Copyright 2004 Microsoft Corp.

Backup time: 3/14/2009 6:01 PM
Backup target: Network Share labeled \\server\c$\Software
Version identifier: 03/14/2009-22:01
Can Recover: Volume(s), File(s), Application(s), Bare Metal Recovery, System State

Ahh. The version is 03/14/2009-22:01--the time I made the backup.

So, I now run:

C:\Users\Administrator>wbadmin start systemstaterecovery -version:03/14/2009-22:01
wbadmin 1.0 - Backup command-line tool
(C) Copyright 2004 Microsoft Corp.

Do you want to start the system state recovery operation?
[Y] Yes [N] No

Finally. Progress. I Enter "Y" and then see my progress...

Starting System State Restore [3/15/2009 11:31 PM]
Processing files to restore (This may take a few minutes)...
Processed (1279) files
Processed (5733) files
Processed (11025) files
Processed (21513) files
Processed (34191) files
Processed (47192) files
Processed (60265) files
Processed (62310) files
Processed (62310) files
Processing of files complete
Starting restore of files from backup
Preparing for Restore...
Restore of files reported by 'COM+ REGDB Writer' completed
Overall progress - 1% (Currently restoring files reported by 'System Writer')
Overall progress - 3% (Currently restoring files reported by 'System Writer')
Overall progress - 4% (Currently restoring files reported by 'System Writer')
Overall progress - 6% (Currently restoring files reported by 'System Writer')
Overall progress - 7% (Currently restoring files reported by 'System Writer')
Overall progress - 9% (Currently restoring files reported by 'System Writer')
Overall progress - 11% (Currently restoring files reported by 'System Writer')
Overall progress - 13% (Currently restoring files reported by 'System Writer')
Overall progress - 15% (Currently restoring files reported by 'System Writer')
Overall progress - 18% (Currently restoring files reported by 'System Writer')
Overall progress - 19% (Currently restoring files reported by 'System Writer')
Overall progress - 21% (Currently restoring files reported by 'System Writer')
Overall progress - 24% (Currently restoring files reported by 'System Writer')
Overall progress - 26% (Currently restoring files reported by 'System Writer')
Overall progress - 28% (Currently restoring files reported by 'System Writer')
Overall progress - 30% (Currently restoring files reported by 'System Writer')
Overall progress - 32% (Currently restoring files reported by 'System Writer')
Overall progress - 36% (Currently restoring files reported by 'System Writer')
Overall progress - 40% (Currently restoring files reported by 'System Writer')
Overall progress - 43% (Currently restoring files reported by 'System Writer')
Overall progress - 46% (Currently restoring files reported by 'System Writer')
Overall progress - 49% (Currently restoring files reported by 'System Writer')
Overall progress - 52% (Currently restoring files reported by 'System Writer')
Overall progress - 54% (Currently restoring files reported by 'System Writer')
Overall progress - 57% (Currently restoring files reported by 'System Writer')
Overall progress - 61% (Currently restoring files reported by 'System Writer')
Overall progress - 64% (Currently restoring files reported by 'System Writer')
Overall progress - 68% (Currently restoring files reported by 'System Writer')
Overall progress - 71% (Currently restoring files reported by 'System Writer')
Overall progress - 73% (Currently restoring files reported by 'System Writer')
Overall progress - 76% (Currently restoring files reported by 'System Writer')
Overall progress - 79% (Currently restoring files reported by 'System Writer')
Overall progress - 81% (Currently restoring files reported by 'System Writer')
Overall progress - 84% (Currently restoring files reported by 'System Writer')
Overall progress - 85% (Currently restoring files reported by 'System Writer')
Overall progress - 88% (Currently restoring files reported by 'System Writer')
Overall progress - 91% (Currently restoring files reported by 'System Writer')
Overall progress - 95% (Currently restoring files reported by 'System Writer')
Overall progress - 98% (Currently restoring files reported by 'System Writer')
Cleaning up...

Summary of recovery:
--------------------

Restore of system state completed successfully [3/15/2009 11:40 PM]

Log of files successfully restored
'C:\Windows\Logs\WindowsServerBackup\SystemStateRestore 15-03-2009 23-31-27.log'

Please restart the machine to complete the operation.
NOTE: When you restart your server, System State Recovery will attempt to
recover many system files which may take several minutes to complete depending
on the number of files that are getting replaced. The machine might reboot multi
ple times in the process. Please be patient and do not interrupt the reboot process.

C:\Users\Administrator>

So this is progress? Better than selecting it through the familiar interface? I must be getting old.

Dell DRAC Virtual Media Plugin Problems

2009-03-14T01:04:00.004-04:00

Symptoms:
- Trying to access the "Virtual Media" section of a DRAC console
- Client is Windows 2008
- When accessing "Virtual Media," get prompted to accept ActiveX control; accept, and get redirected to login page

Solution:
- Open Internet Explorer, Tools > Internet Options; select Intranet, and select "Automatically detect Intranet network"

- Open %systemroot%\system32\drivers\etc\hosts
- add hosts entry for DRAC (such as 10.1.1.1 server-drac server-drac.domain.com)
- Save and close

Browse to https://server-drac, accept the warning that IE is trying to access a page on your intranet and login. Good to go.

So, what causes this problem?

Internet Explorer's security settings are preventing ActiveX controls from being installed. Once you add the DRAC interface you're trying to work with to what IE considers your local intranet (site able to be browsed by hostname plus local domain suffix), the restrictions are loosened.

Happy DRAC'ing!

If I Could Turn Back Time

2009-03-09T16:53:00.007-04:00

For anyone who manages an Active Directory environment, you've undoubtedly come to understand the need for keeping time in sync. In short, you won't be able to log in if the local computer time has more than 5 minutes difference than the logon server.

By default, Windows machines are configured to use NTDS5 or domain hierarchy time synchronization. The idea is that clients and servers synchronize their time with domain controllers, and the domain controllers synchronize their time with the domain controller holding the PDCE FSMO role. The idea is that administrator is supposed to configure the PDCE role holder to synchronize time with an outside NTP source.

However, you may someday find yourself in an environment where "things were changed." Unwitting administrators may have configured their environment differently, and if your luck is anything like mine, you'll eventually find yourself inheiriting or troubleshooting such an environment.

To reset a Windows Server 2003 computer back to default NTDS5 synchronization, run the following command:

w32tm /config /syncfromflags:domhier & w32tm /config /update

"But, Aaron," you say, "I have hundreds of servers!"

No worry, there's help for you as well. Grab the free PSTools from http://www.microsoft.com/sysinternals. Inside you'll find the Windows Administrator's best friend--psexec. With that great tool, you can run any command against a list of servers.

In addition, you'll want to grab a copy of the Gnu32 core utilities, which has Win32 versions of the great *nix utilities. Windows prettymuch sucks at command-line text manipulation, which makes this toolset invaluable.

So, armed with the right tools, how to get that list?

From either a domain controller (or a server/workstation with the AdminPak, PSTools, and Gnu32 Core Utilities installed):

1. ldifde -f temp1.txt -d "dc=domain,dc=com" -r "(&(objectClass=computer)(operatingSystem=Windows Server*))" -l cn
2. findstr /i "cn: " temp1.txt tr -d "cn :" >> temp2.txt

The resulting file (temp2.txt) will contain all of the Windows Server 2003 and 2008 machines in your environment. Once you have that list:

psexec @temp2.txt w32tm /config /syncfromflags:domhier & w32tm /config /update

The last step is to configure the server holding the PDCE FSMO role to use an external NTP time source.

w32tm.exe /config /syncfromflags:manual /manualpeerlist:time.windows.com /reliable:yes & w32tm.exe /config /update

Replace time.windows.com with whatever NTP server you want to use. Make sure you can get to it on UDP 123.

And ... you're done.

Now You See It, Now You Don't

2009-03-07T21:26:00.008-05:00

Lots of programs on the internet will claim to "erase your tracks" on your Windows-based computer. Well, you don't need to waste your money. Windows XP and later come with a built-in utility, that when used correctly, will overwrite the free space on your hard drive with ones and zeroes.

To make a long story short, when a file is deleted, the data blocks for the file still exist on the hard drive. The blocks that the deleted file occupy have been marked "available" for use by the filesystem. Recovering deleted data depends on these data blocks not having been overwritten yet.

Every act of creating, copying, or saving data on the hard drive with deleted data increases the chances that those "maked" data blocks will be overwritten, eliminating chances for a full, successful recovery.

If you want to ensure that data you've deleted is not going to be recoverable, you may think that simply formatting a drive will wipe the data. However, several types of "quick" formats may only specify the filesystem type and wipe the MFT or FAT, leaving the data blocks still intact on the drive.

To totally "erase" your data, you'll need to actually write data to every free region of your hard drive.

Now, as I previously mentioned, there are plenty of companies that will sell you programs to wipe your NTFS or FAT16/FAT32 filesystems--but they're not counting on you using a built-in utility to do the task.

What is this marvelous utility, you ask?

The utilitiy is cipher.exe. The main purpose of the utility is for EFS encryption. However, one of the switches can wipe the free space.

Running cipher /? at the command prompt in Windows 7 shows a whole host of options (in fact, too many to display here). The option we're looking for is the /W option:

C:\>cipher /?
Displays or alters the encryption of directories [files] on NTFS partitions.
...
CIPHER /W:directory
...
/W Removes data from available unused disk space on the entire
volume. If this option is chosen, all other options are ignored.
The directory specified can be anywhere in a local volume. If it
is a mount point or points to a directory in another volume, the
data on that volume will be removed.

Cipher with the /W switch will create a temporary file that will write over every block on your filesystem.

The appropriate syntax:

cipher /W:C:\

Will yield a screen like this:

As the screen indicates, close as many programs as possible. To achieve maximum data clearing effect, try grabbing a program like CCleaner to remove temporary internet files, temporary setup files, cookies, and a bunch of other personal data before wiping with cipher.

A Purple Nasty, Snake-Bitin' Good Time

2009-03-02T08:59:00.008-05:00

I was introduced to this fine UK collegiate-style drink this weekend by my sister-in-law's most excellent boyfriend, Eddie. It's quite tasty, and definitely sneaks up on you. It's made by mixing a dry cider and a lager.

Depending on your lager choice, you may need to add more cider to gain the desired level of sweetness.

Snake Bite
5 oz Stella Artois Belgian Lager
5 oz Strongbow Cider

Combine ingredients in a Pilsner glass and enjoy.

Adding black currant turns it into a Snake Bite Black.

Snake Bite Black
5 oz Stella Artois Belgian Lager
5 oz Strongbow Cider
2 oz Black Currant

Change the ratio a bit, and it becomes a Purple Nasty.

Purple Nasty
6 1/2 oz Strongbow Cider
3 1/2 oz Stella Artois Belgian Lager
2 oz Black Currant

This is supposedly the drink of Loughborough University in England.

However you mix it and whatever you call it, it's well worth trying.

How to Re-Create MSDB

2009-02-23T10:49:00.003-05:00

From time to time, I've found myself in a situation where I've needed to re-create MSDB. Unfortunately, most of the guides on how to do it give just basic overviews, leaving the unlucky admin muddling around.

Here is a real step-by-step for SQL Server 2005.

1. Shut down SQL Server.
2. CD to the SQL installation directory, such as %ProgramFiles%\Microsoft SQL Server\MSSQL.1\MSSQL\Binn and run start sqlservr.exe -c -T3608 or go into the Services applet, select the SQL Server service, and enter -c -T3608 in the parameters text area, and click Start.
3. Open SQL Management Studio.
4. Expand Database > System Databases, right-click Master and select New Query.
5. Type sp_detatch_db 'msdb' and press F5 to run.
6. Locate the MSDB files (usually msdbdata.mdf and msdblog.ldf) on your server; typically in %ProgramFiles%\Microsoft SQL Server\MSSQL.1\MSSQL\Data. Move/rename them.
7. Navigate to %ProgramFiles%\Microsoft SQL Server\MSSQL.1\MSSQL\Install and run instmdb.sql by double-clicking it.
8. Shut down SQL server service and restart it normally.

The Ever-Helpful Microsoft Office Project 2007

2009-02-16T16:43:00.003-05:00

Microsoft Office Project 2007 is a relatively complex application. There have been a lot of improvements over the years, but one spot for which improvement is sorely needed is in problem identification. Most applications, when you have a syntax or property problem, will tell you on which line the problem occurs or will highlight the affected region.

If only.

In this example, I was working on a relatively complex Project and had made start-date type dependencies on some tasks (Task B can't be started until Task A is finished). I moved a section of tasks from one spot to another several weeks ago, and recently was attempting to update it. Unfortunately, I had set some task dependencies and could not figure out where to go (in a 500+ task project, it can get quite cumbersome). When trying to change a dependency, I was greeted with this oh-so-helpful dialog box:

Huh?

I eventually found it, after reviewing my project line by line. It could have been so much easier if the conflict had just been highlighted. The program obviously knows what lines are affected, since it detected the dependency as circular.

Creating a Windows 2003 TFTP Server

2009-02-12T15:02:00.006-05:00

If you read my previous post on configuring Windows Server 2003 DHCP to serve PXE clients, you probably noticed option 066 for Boot Server Host Name.

What is a Boot Server, you may ask?

In simple terms, a boot server runs a TFTP (Trivial File Transfer Protocol) instance that is used to transfer small amounts of data. TFTP is unauthenticated, making it an easy choice for automating remote-boot tasks such as jumpstart and kickstart. For more general information on TFTP, check out Wikipedia.

Windows 2003 has a little-known TFTP daemon. Microsoft stopped advertising some time ago, but it still remained as part of the OS load through 2003 (it is no longer present in 2008) because of its usefulness.

Configuring the Native Windows Server 2003 TFTP Daemon
1. Copy the tftpd.exe file from %windir%\system32\dllcache to %windir%\system32.
>> copy %windir%\system32\dllcache\tftpd.exe %windir%\system32

2. Register tftpd as a service.
>> sc create tftpdsvc binPath= C:\Windows\System32\tftpd.exe DisplayName= "TFTP Server" start= demand

3. Set the Directory parameter to the location where your TFTP boot image files will be stored.
>> REG ADD HKLM\SYSTEM\CurrentControlSet\Services\tftpdsvc\Parameters /v Directory /t REG_SZ /d C:\tftpd

Here's a screen capture of the whole process:

Start the TFTP Server inside the Services MMC (or type net start tftpdsvc from the command prompt). You may get an error if the directory you specified in step 3 doesn't exist, so make sure it does. Also, if you have problems accessing files (you shouldn't, since in this configuration tftpdsvc is running as LocalSystem), you may need to grant "Everyone" or "ANONYMOUS LOGON" access to the boot file directory.

Configuring Windows 2003 DHCP for PXE Clients

2009-02-12T09:46:00.015-05:00

Today, I was lending a hand to one of our Linux admins who was trying to get his servers Kickstarted. For the unitiated, Kickstart is the Linux equivalent to Windows RIS.

PXE stands for Pre-boot eXecution Environment. PXE clients (commonly known as "diskless workstations") rely on DHCP to tell them where to go for their boot configuration and software. Windows 2003 can handle these requests, with a little bit of work.

Supporting PXE clients requires the following options:

003 Router (potentially, if resources you need are on a different subnet)
013 Boot File Size
043 Vendor Specific Info
060 ClassID
066 Boot Server Host Name
067 Bootfile Name

So, off you go to configure it. But wait, Windows 2003 DHCP doesn't have option 060! What now?

Relax. Fortunately, there's a way to configure the DHCP service to have this option.

On your DHCP server, open up a command prompt and launch netsh.

As you can see, the commands are:

C:>netsh
netsh>dhcp
netsh dhcp>server \\test
netsh dhcp server>add optiondef 60 ClassID String 0
netsh dhcp server>set optionvalue 60 STRING PXEClient

You can actually add any of the RFC options for DHCP through this context. Microsoft ships the basic ones, but with netsh, you can customize the DHCP service.

Then, restart the DHCP service. If you have the service and management console running while you do this, you'll see "Unknown Option" when you look under server options.

Launch the DHCP Admin Conosole, and navigate to your scope (or server) options, depending on where you want to set your PXE boot options.

Right-click "Scope Options" (or "Server Options," as appropriate) and select Configure Options.

Select option 013 Boot File Size, and enter the boot file size in 512 octet blocks. For example, if your boot file is 32KB, convert it to bytes (1024*32, which is 32768), and then divide that number by 512 (32768/512). Put the result (64) in the data field.

Select option 043 Vendor Specific Info and enter the following binay value:
01 04 00 00 00 00 ff

Select option 066 Boot Server Host Name and enter the IP address of the TFTP server hosting your boot image in the data field.

Select option 067 Bootfile Name and enter the name of the boot image that you wish to use.

Ensure your devices have PXE-enabled NICs (if you're using newer servers, nearly all of them do) and boot. If you need help on setting up a TFTP Server on Windows 2003, look no further.

Optimizing Exchange Disk Performance with Diskpart

2009-02-08T12:35:00.017-05:00

Since a lot of folks (myself included) are still running a lot of Exchange 2003 in the enterprise, I though I would post a bit about setting the track alignment properly in various kinds of storage.

According to Microsoft, when creating disk partitions, the "Disk Management" MMC snap-in mis-aligns the partition with the underlying physical disk. On disks where there are 64 sectors per track, for example, the Disk Management MMC starts the partrition at the 64th sector instead of the 65th sector. It may not sound like a big deal, but in Exchange-land (and really any high-performance database), I/O that overlaps two tracks can degrade your performance by as much as 20%.

On Windows 2003, you use Diskpart.exe to set the starting offset for partitions. You can look in the Disk Management MMC snap-in to determine which disks you want to manipulate. Note the disk numbers on the left-hand side. You will reference these numbers inside Diskpart.

In this example, the disk that I want to manipulate is Disk 24.

Click Start > Run and type diskpart.

Diskpart is a command-line utility. Never fear, the syntax is pretty simple. You can type help for a list of commands. Commands have context sensitive help, so typing create partition ? will return a list of modifiers you can use.

In this example, I'm using a Pillar Axiom 600, and the vendor has recommended using an offset of 128. Armed with that knowledge, I will select disk 24 and perform the partition creation command.

From there, you can go back into the Disk Management MMC, assign a drive letter or mount point and format the volume. It's now ready for databases.

I'll update this post periodically with recommended offsets for various types of storage. As an info-byte, Diskpar (Windows 2003) creates partition offsets in KB while Diskpar (Windows 2000) creates them in sectors or blocks.

Storage System	Recommended Diskpart Alignment
EMC Symmetrix DMX	64
HP StorageWorks EVA	64
Pillar Axiom	128

Use these settings to optimize your Exchange storage. For more interesting and informative articles on disk alignment, check out these links:

Optimizing Storage for Exchange Server 2003 - (Microsoft Technet)

Why should you use Diskpar (Diskpart in W2003 SP1)? - (MSExchange Team Blog)

Disk Sector Alignment - (Christian Bolton's SQL Server Blog)

Disk Partition Alignment (Sector Alignment) for SQL Server: Part 1: Slide Deck - (Jimmy May, Aspiring Geek)

Classic Margarita

2009-02-06T14:31:00.008-05:00

Strip away all the bells and whistles. Want a margarita you can make from scratch in a few minutes? Look no further.

Classic Margarita
1 1/2 oz silver or reposado tequila
1 oz Grand Marnier orange liqueur
3/4 oz fresh squeezed Mexican lime juice
Splash of orange juice

Shake all ingredients with ice. Strain into a salt-rimmed cocktail glass and serve with a lime wedge.

If you don't use Mexican limes, add a tsp or so of sugar.

Times Is Hard

2009-02-06T09:44:00.004-05:00

On the way home from work the other night, I heard a very folksy/Dylan-esque song by Loudon Wainwright III called "Times Is Hard." I've dropped the lyrics here (without permission). To hear the song, head on over to NPR.

Times Is Hard

Times is hard. Times is tough.
Nothin's easy. It's all rough.
There's not much right; so much gone wrong.
All I can do is play this song.

You're watchin' the news. It all looks bad.
The worst half-hour you ever had.
What in God's name is goin' on?
All I can do is play this song.

You're losin' your job, your house and your car.
Hittin' rock bottom don't feel that far.
Nothin' good is gonna come along.
All I can do is play this song.

Folks are scared watchin' that news.
Folks feel bad. They're gettin' the blues.
My poor stomach, it ain't that strong.
All I can do is play this song.

Times is rough. Times is hard.
Take a pair of scissors to your credit card.
Circuit City just said, 'So long.'
All I can do is play this song.

Who's at fault? Who gets the blame?
Let's string up Bernie what's-his-name.
And ask Alan Greenspan to come along.
All I can do is play this song.

They want your gold, and they'll pay cash.
The only silver lining is the price of gas.
Money's short and the odds are long.
All I can do is play this song.

The factory's closed. The bank is bust.
On the money it says, 'In God We Trust.'
So pray for all your stocks and bonds.
All I can do is play this song.

Outta luck. Outta hope.
I'm wonderin' why I even cast that vote.
I took that sign offa my front lawn.
All I can do is play this song.

There's a new man down there in D.C.
They say he's gonna help you and me.
They sure know how to bang the gong.
All I can do is play this song.

Last man in D.C., he had eight years.
Now the whole damn country is in arrears.
We got two, three, four wars goin' on.
All I can do is play this song.

Times is hard. Times is rough.
I guess you folks need some cheerin' up.
Well it ain't me babe. You got that wrong.
All I can do is play this song.

You heard it here. I sang it first.
Don't feel so bad; things are gonna get worse.
Consider yourselves all strung along.
All I can do is play this song.

All I can do is ...

Project 2007 Dialog Box

2009-02-03T00:39:00.002-05:00

I'm a sucker for funny dialog boxes. This one happened to me tonight while I was cutting/pasting a coule of task items around in Microsoft Project 2007:

Actual values, eh? Not made up ones?

Outlook and 0x80004005

2009-02-02T21:50:00.003-05:00

This afternoon, while troubleshooting a user's NDR problem, I ran into a problem of my own:

Your message did not reach some or all of the intended recipients.

Subject: RE: Service Desk Ticket 00173590
Sent: 2/2/2009 4:28 PM

The following recipient(s) cannot be reached:

Lastname, Firstname on 2/2/2009 4:28 PM
This message could not be sent. Try sending the message again later, or contact your network administrator. Error is [0x80004005-00000000-00000000].

Like many admins when troubleshooting end-user problems (missing/deleted messages, screwy appointments, etc.), I grant a dedicated account service-level permissions on the problem mailbox and begin testing by creating a new profile and logging into the problem mailbox. Tonight, after the troubleshooting session was resolved, I went to log in to my own mailbox profile and all seemed well. A few minutes later, I sent a message, and immediately got the above NDR. Having done this hundreds of times, I was pretty perplexed.

Starting to troubleshoot my own mailbox like I have hundreds of others, I went to verify that there was nothing wrong with my account by hitting my back-end mailbox server.

Logged off, logged back in, and retried sending a message. Same NDR.

I've usually experienced 80004005 (in relationship to Outlook) being a security or permissions problem of sorts. I was able to track the issue down to the way I had configured the temporary I was using for troubleshooting. After entering the server name and mailbox name, you are presented with a dialog box for credentials. I entered the credentials for which I had granted service account permissions, and had inadvertantly selected the "Save Password" button.

In whatever crazy universe I'm operating in, that seemed to be somehow affecting my logons with other profiles. To rectify the situation, I went to Control Panel > Mail > E-Mail Accounts > Change E-Mail Account > More Settings > Security and selected the "Always Prompt for Logon Credentials" checkbox. OK all the way out, launch Outlook, put in my new credentials, and then try to send/receive.

Problem solved.

Everybody is Somebody

2009-01-30T00:26:00.004-05:00

Tonight on the way home from work, I heard an interview on the radio. The lead-in was talking about a reporter investigating some strange circumstances surrounding a death.

Apparently, someone had called and told him that while in an abandoned building, they had discovered a body encased in a block of ice at the bottom of an elevator shaft. As the interview went on and the reporter described the case, he expressed how he wanted to bring some dignity to the deceased by burying the body properly.

His quote has been replaying in my head for the past couple of hours. "This was somebody's boy. Everybody is somebody's baby."

The interviewer repeated those words, faltering herself.

A small wave of emotion swept over me. If you're a parent, repeat those words out loud for yourself and you'll understand instantly.

Sit back and think for a minute.

There are wars raging on several continents this very minute. Genocides. Ethnic cleansings. Wholesale exterminations of millions of people because of their skin color, ethnicity, or religious beliefs. We're sending all our nation's kids to fight in places where we're not wanted for reasons that are unclear at best, and all we've got to show for it is a spiraling deficit and a wake of thousands of bodies--somebody's babies.

Hundreds of people in the Guantanamo Bay military prison. Political prisoners in China. Militia kidnapping victims in Columbia.

AIDS babies in Ethiopia. A cholera epidemic whipping through Zimbabwe. Children and farmers crippled by undiscovered mines in Cambodia and Vietnam, leftover from another generation's unrest.

So many Christians are passionate about the pro-life arguments. "50 million abortions since Roe V. Wade." "Life begins at conception."

I'm all for protecting the unborn innocents. But what about the ones that make it out of the womb? Why do we care so disproportionately for those in utero? If we are so damned concerned about life and how it begins at conception, why don't we care about when and where it ends?

We'll rally against the rescinding of the Mexico City policy, but we won't lift a finger for the kids in the Gaza strip being killed by Israeli tanks. We'll hold marches on the Hill on the anniversary of Roe V. Wade, but won't organize a canned food drive for crack babies in Baltimore. We'll chant witty slogans like "be a hero--save a whale; save a baby, go to jail," but won't serve chili at a homeless shelter or make goodie baskets for our troops in Afghanistan.

We'll pray that God will send help for hurricane or tsunami victims. Where's that help going to come from? Someone has to go. Praying that God will comfort those who've lost loved ones is great, but as a pastor friend of mine once said, sometimes the world needs God with some skin on 'em.

When's the last time you volunteered at an orphanage or senior center? Taken in a family who lost their home to foreclosure? Those lives are valuable, too. All those forgotten kids, all those abandoned elderly, all those dirty, smelly, homeless people.

Everybody is somebody's baby.

Filed from my Windows Mobile® phone.

How do you spell Evil? C-H-A-S-E

2009-01-26T11:12:00.006-05:00

Like most households, we have a couple of credit cards. We don't really use them, though, being believers in the Dave Ramsey way of life. To a point--I use a credit card when I travel and submit expense reports for reimbursement.

Our expense reporting cycle is typically 3-4 weeks, which is a long time to be out of pocket. On some business trips, I might spend $500-$1,000 or more (on my last trip to the UK, I spent well over $5,000). Our budget is pretty close as it is, so loaning my company an extra couple thousand dollars directly out of my checking account is out of the question.

Around the Thanksgiving holiday, we missed our credit card bil due date by a few days. Not that we didn't have the money--we were celebrating with family and friends from out of town, and the last thing on our mind was feeding the Chase beast.

Until the bill showed up. Finance charges of several hundred dollars in addition to a late fee. I promptly called and complained. They waived the fees, and I thought all was good, right?

Well, December's bill came, which is due on January 31. Much to our surprise, there was a finance charge of nearly $82. There was no previous balance; only about $1,800 worth of charges. Upon calling Chase, they informed us that because we were late, they are going to be charging us a finance charge on each bill's current balance for the next two months (December and January's billing periods). When did that become fair play?

What an asinine penalty. Credit card companies are evil; the more of us that can stop using them, the better off our economy will be.

Cognac Mint Frappe

2009-01-22T23:57:00.003-05:00

Cognac is distilled from grapes from the Cognac region of France. It bears properties of both wine and liquor. Chances are, if you have a taste for wine, you'll appreciate cognac.

The idea for this drink came from the pages of Esquire; I Googled and found a similar recipe from which I drew the name. It's disarming and delicious; it's a good dessert drink.

Cognac Mint Frappe
2 1/2 oz cognac
1/4 oz white creme de menthe

Shake with ice and strain into a double old-fashioned with ice. Add a splash of water, and serve with a mint sprig if desired.

Why Do We Hate?

2009-01-22T00:51:00.005-05:00

Seriously, why do we? What is the anatomy of hate?

We hate what we fear, and we fear what we don't know or understand.

The collective Right has been flooding the media with President Obama's "homosexual" agenda. As a Christian, I have a strong distate for some of Obama's policy stances, but affording equal rights to all Americans is not one of them.

Filed under "Civil Rights" on the White House web site is a section entitled Support for the LGBT Community. A quote from then-Senator Obama introduces the section:

"While we have come a long way since the Stonewall riots in 1969, we still have a lot of work to do. Too often, the issue of LGBT rights is exploited by those seeking to divide us. But at its core, this issue is about who we are as Americans. It's about whether this nation is going to live up to its founding promise of equality by treating all its citizens with dignity and respect."
-- Barack Obama, June 1, 2007

There are a couple of items on the list that I think are striking fear in the hearts of conservative folks, namely the areas of civil unions/same-sex marriage and adoption rights for the LGBT community.

Civil Unions are "non-marriage" agreements (recognized by most municipalities) between couples. For some reason, heterosexual couples get the same equal protection rights (employer health care and other employer benefits, property rights, emergency medical caretaker rights, etc.) as married couples, but this is denied to same-sex couples. Christians seem fine with this one-sided agreement because it doesn't appear to throw off their moral compass too much.

However, if one really wants to get nit-picky, how is supporting rights for a non-married same-sex couple living together any less "sinful" than supporting rights for non-married opposite-sex couples? According to Biblical standards, they're both wrong, since neither is "married." As Christians, we're taught "don't live together unless you're married," so Christians should be anti-civil unions across the board, regardless of the gender make-up of the couples, right? That makes us seem like religious radicals, so we cop out and say, "well, I guess it's tolerable as long as it's a man and a woman."

The next one on the list is the Constitutional Amendment to ban same-sex marriage. The Constitution has a long history of being used to grant rights, not take them away. The only time in our history that a Constitutional Amendment has been implemented to remove rights was in 1919, when the 18th Amendment was ratified to prohibit the manufacture, sale, or transportation of liquor in the United States. 14 years later, it was abolished with the 21st Amendment.

Then-Senator Obama had an interesting perspectve on this in the Saddleback Presidential Forum, held by Pastor Rick Warren at his church:

I am not somebody who promotes same-sex marriage, but I do believe in civil unions...I think my faith is strong enough and my marriage is strong enough that I can afford those civil rights to others, even if I have a different perspective or different view.

The final one is around expanded adoption rights. Personally, I've gone back and forth on this one. I don't really know what the Bible would say on it, so if anyone has any insight, please feel free to share. Basically, the premise is that President Obama wants to ensure that same-sex couples are able to adopt children.

As a Christian who doesn't approve of that lifestyle, I would be tempted to say that same-sex adoption may place the child in a confusing and complicated situation where they would see things that I find morally wrong.

However, as a pragmatist, I think it's important to look at the other side of foster care and adoption and really look at what's best for the children. About 35% of children are removed from foster care scenarios because of physical or sexual abuse or denial of health services. In adoption cases, statistics for abuse and mistreatment are frighteningly high. What's the benefit of placing a child in an adoptive situation with abusive opposite-sex persons versus loving same-sex persons? I don't really know any statistics either way, but I would tend to think that a loving environment wins every time.

If a child is in an adoption scenario, chances are they've already undergone circumstances beyond the comprehension of most people reading this--death of caretakers, abusive parents or foster parents, or some form of neglect or child endangerment.

Most foster kids never get adopted; they grow up in orphanages without ever experiencing the love of a family. Children that aren't adopted have higher rates of suicide and violence. Why wouldn't we do anything possible to avoid those negative outcomes?

There aren't easy answers to any of these questions, but I think we should all ask, what would Jesus do, and what would He want us to do?

With the woman who was accused of adultery, Jesus didn't say, "Let her have it!" He said, "Let he who is without sin cast the first stone." Jesus hung around the tax collectors and sinners of the day. He didn't approve of their lifestyles, but didn't fear and hate them, either. He hung around the holier-than-thous and chastised them for being so legalistic and missing the big picture. He didn't discriminate against theives or adulterous women; he treated them all with a level of respect due any human.

I'm not necessarily pro-gay rights or pro-LGBT community rights. But I am pro-equal human rights, because I think Jesus is, too.

Dear Mr. President - A Letter to Barack Obama

2009-01-20T22:31:00.007-05:00

Dear Mr. President,

First and foremost, I want to offer my congratulations on your new job.

Gathered among such a great crowd of witnesses, you have committed yourself to your country--to our country--in a remarkable capacity. Only 43 other men have served in this highest civilian calling; some of them are remembered with great admiration, some with disdain, and others forgotten, save for a few pages in the history books.

Like you, they had repeated the oath and accepted the honor and responsibility of ensuring our freedom, promoting our prosperity, and protecting our shores. Some have transitioned in peaceful and prosperous times, some during great turmoil.

This is a time that tries all of our souls.

Every man and woman who voted, whether for you or your opponent, was speaking out to preserve a way of life. We spoke to ensure not just any future for our children, but a better one. Millions have come to our great nation to start over, and at this time of economic crisis, millions are starting again.

You have promised to unite us, to bridge partisan and racial divides and to bring out the best in us. We are not a collection of casual lines on a map. We may look different, we may speak different languages, but we are these united states, a quilt whose material is dreams and whose stitching is hard work.

We want fiscal responsibility at all levels of government. You take your cut of our paycheck off the top. We expect that you handle our money with respect.

We voted for change in our energy policies. Green energy isn't a Democratic talking point, nor is it a Republican curse word. It's the air our children breathe and the water they drink.

We voted for better security and more equality in our health care.

We all either have aging parents or are aging parents. The shattered economy is driving their hopes of secure retirement away. We want to go back to the financial principles that made our nation prosperous before.

We want you to listen to us. We don't want you to govern solely by consensus or poll data, but we do want you to listen to the will of the people.

You will make mistakes. We don't want excuses or finger-pointing. We want you to acknowledge them and take corrective action. We're a very forgiving nation if you tell us the truth.

We voted to bring in a new era of responsibility. You have told us to hold you accountable.

We will.

We will commit to supporting you so long as you commit to supporting the American dreams for freedom, prosperity, opportunity, and equality.

It's a tall order, but you have told us to believe that you can do it. We understand that it may take time, but we're willing to wait so long as you lead us down the right path.

Leaders give us a vision. Good leaders instill the vision in us. Great leaders inspire us to accomplish the vision.

We want you to be a great leader.

If there's anything I can do to help, just let me know.

-ag

The Toughest Job

2009-01-18T23:02:00.008-05:00

So, I'm sick of seeing a lot of chatter from my uber-conservative friends about being Obamanized and needing to wash their hands after talking about him. Seriously? Aren't we past the high school comments?

I'm going to go out on a limb and say that a good chunk of my uber-conservative friends are single-issue voters (read: abortion). In descending order of importance: abortion, taxes, guns. That prettymuch defines conservatism as far as a lot of people I know are concerned. Not that there's anything wrong with having strong views on those topics--I certainly do--but like to think I have a much more nuanced approach to expressing them and determining whose policies and agenda will be most congruent with my own.

As I expressed in my voting post, I went through a lot to really try to figure out which candidate best aligned to my views. It's not all about guns and gays.

So why are Christians so reluctant to look around? While I understand that most non-Republican candidates and officials fail the abortion litmus test, are there so many other things that make them any more despicable human beings? I don't think liberals have a monopoly on deplorable behavior--lest we forget, in the last couple of years, we've had to endure a number of scandals coming from the Right. So, before we get on our conservative high horse, I think it's important to note that we all have problems and shortcomings, regardless of our race, religion, gender, or political party:

- Republican Senator Larry Craig propositioned an undercover cop in airport bathroom
- Republic Representative Mark Foley (Chairman of the House Caucus on Missing and Exploited Children) sent underage Congressional staff pages sexually explicit messages for past 10 years
- Ted Haggard, Leader of the National Association of Evangelicals and Adviser to George Bush publicly admitted to crystal meth use and paying for male prostitutes (which got turned into a Law and Order episode)
- Bob Allen, Florida state representative and Chairman for John McCain's presidential campaign, paid an undercover cop $20 to allow him to perform oral sex on the officer
- Glenn Murphy, Jr., National Chairman of the Young Republicans who advised Republican candidates to use homosexuality as a wedge issue, spent the night at a young man's house; the host woke up to find Murphy giving him oral sex
- Republican Senator David Vitter linked to prostitution ring
- 10 years of Catholic priest molestation trials and tribulations

Bush has had an extraordinarily hard time as President. He inherited a bubble economy propped up by unrealistic housing growth and within 9 months of assuming office, had to deal with a terrorist attack on our soil.

However, reluctance to make decisions himself and instead leaning on his war-hawking, super-secretive Vice President led us to unpopular, unending wars in two countries, a boatload of legislation that strips away American freedoms (Patriot Act), executive orders for secret CIA prisons and interrogations, and a detainment facility where people are held indefinitely without trials. Not exactly the hallmarks of good Christian leadership. What an odd double-standard we Christians have--as long as he's not aborting babies or accepting oral gratuities in the White House, he's a good President?

Not that I want to use this as an anti-Bush soapbox. On the positive side, Bush been a leader in humanitarian aid to other countries and has protected more natural resources than any other President in history (despite his very pro-energy politics). He's lowered taxes for a lot of folks I know (myself included), too.

Christians seem eager to quote that "the heart of the king is in the hand of the Lord" when they get a President that they didn't want, but collectively, we sure are a complaining bunch. When the Israelites grumbled in the wilderness, God sent snakes. It may seem like overkill to us, but it drives at the heart of the matter--trust in God's way. While we say "the heart of the king is in the hand of the Lord," we complain that God's hand isn't holding the heart that we wanted.

Regardless of who was elected, it's our duty to pray for them. We're all on the same team here. I can't believe that Christians are so hung up on the litmus issues that they'd rather see the right person for the office fail and feel personally vindicated than see that person succeed and be shown incorrect. What good is vindication when you can't pay your bills or feed your family or your president is seen as incompetent by the rest of the world? It's a pretty hollow victory.

Food for thought.

You know what they say about High Fructose Corn Syrup...

2009-01-18T13:11:00.005-05:00

Last night, while watching SNL, I saw back-to-back ads attempting to cast high fructose corn syrup in a better light. I can understand propaganda ads about milk, beef, pork, chicken, broccoli, green tea, or things that least in some way have a potential health benefit.

But corn syrup? In one ad, two women are talking at what appears to be a birthday party. One is pouring a juice drink from a gallon jug into cups, and the other tells her that the juice drink has high fructose corn syrup. The pourer offers a non-chalant "And?" The protagonist says, "You know what they say about high fructose corn syrup...," to which the pourer responds, "That it's made from corn, doesn't have artificial ingredients, and like sugar, is fine in moderation?"

Wow.

At first, I thought it was just a spoof commercial, since I witnessed it during Saturday night live. But then right after that, I saw another. A couple is laying on a blanket in a park, presumably having a picnic. The woman offers the man a popsicle, to which the man turns up his nose, "You know what they say about high fructose corn syrup." Echoing the "pourer's" comments from the previous ad, she further defends high fructose corn syrup by letting the viewer know "it has the same calories as sugar." Like that's a good thing.

Seriously?

How Window Autotuning breaks with Check Point SmartDefense

2009-01-10T23:09:00.020-05:00

All that's unholy with Check Point SmartDefense

A few months ago, I ran into a problem when copying large files between two tiers of a network in one of our datacenters. I was doing a hardware upgrade on some Hyper-V hosts in a DMZ and was copying the images to a backup server while I swapped out hardware components in the Hyper-V hosts.

I was using robocopy to move the files between the servers, but ran into problems. The error manifested itself as "The specified network name is no longer available." Robocopy reports it as "ERROR 64 (0x00000040)."

So, basically, the copy gets aborted, and since I had the /R switch, it would attempt to retry. Eventually, I was able to make it through the copies, but not without many hours of trials and tribulations.

It's worth noting that none of the hosts on peer networks would experience this error--only hosts going between tiers, which meant they had to traverse a firewall. While the source of the problem (the firewall) may seem obvious, finding the exact problem proved to be more troublesome.

Windows 2008 has a number of new features, including the Next-generation IP stack with the much lauded (and probably equally cursed) RSS and window scaling, as well as SMBv2.

In a very controlled series of tests, we were able to narrow down the source of the problem. The steps we took were:

1. Disable RSS.
2. Enable RFC 1323 timestamps.
3. Set windowautotuninglevel=restricted.
4. Set windowautotuninglevel=highlyrestricted.
5. Set windowautotuninglevel=disabled.
6. Set congestionprovider=disabled.

During this whole time, I was capturing data with Wireshark on both the client and server machines. Something that I thought was interesting was that Wireshark was reporting the SMBv2 packets as "malformed." While Wireshark is definitely a great program for diagnosing network problems, it's not without fault. I thought that the malformed packets might be an indication that Wireshark didn't know enough about the SMBv2 protocol to interpret it correctly.

In the end, we determined that traffic was passing fine when we set the windowautotuninglevel to highly restricted. This setting sets the maximum TCP window size to 64k.

SYN showing window size of 8192 from source

Successful transfer, notice window sized only scaled to 64k

However, with window autotuning set to anything except highlyrestricted or disabled, problems occur randomly during large file transfers.

SYN showing window size of 8192 and scaling factor of 8

Scaled Window size up to 1889024.

Result--failed transfer

I decided to try protocols besides SMBv2. I disabled SMBv2 on both systems via the following commands (rebooting afterwards):

Client

sc config lanmanworkstation depend= bowser/mrxsmb10/nsi
sc config mrxsmb20 start= disabled

Server:

reg add HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters /v Smb2 /t REG_DWORD /d 1 /f

Unfortunately, with the window autotuning level setting set to default, I still had problems transferring data between network tiers.

Armed with this information, the network guy and I started investigating all of the settings on the firewall. We already know that the port for SMB was open, since I could transfer data via 445. Upon investigating the "SmartDefense" console and drilling down into the CIFS configuration, I noticed that there was a checkbox indicating that "CIFS Strict Compliance" was checked. The network guy disabled it and re-pushed the policies. Our transfers went more smoothly, but still not 100% successful.

At that point, we started trying transfers via other protocols, such as FTP. I installed the Windows 2008 FTP server and, using the new Windows 2008 FTP client, was able to successfully send data with TCP windows scaled over 3MB. So, we determined that the firewall was capable of passing some scaled packets.

Like so many things, what makes this issue frustrating and difficult to troubleshoot is the inconsistency and intermittent behaviors. Some times, I could successfully transfer files via SMB that were over 100MB. Other times, I would experience failed transfers after 20 or 30MB. This may be related to the buffers on the either the firewall or server; we weren't able to reliably determine a set of conditions that would predictably produce failures with files under 50mb. But it would happen 100% of the time with our larger test files. Infuriating to troubleshoot.

We disabled SmartDefense altogether, reset all network settings on the servers back to default, and all of the problems vanished.

Check Point is at R62 in this particular datacenter. I don't know if it's a problem with any other versions, but disabling SmartDefense was the only way to get reliable transfers via SMB to happen between hosts separated by the firewall.

Rusty Nail

2009-01-04T18:59:00.003-05:00

This is one of my new favorites. The Rusty Nail is the quintessential two-ingredient drink of the American recreation room.

Not much to say here, except drink it responsibly. It's a kicker of a drink and goes down smooth, so it's easy to over-consume.

Rusty Nail
3 oz quality Scotch (I currently have Glenlivet 15 Year French Oak Reserve in my cabinet, so that's what I'm using)
1 oz Drambuie

Shake together with ice, and pour into a double old-fashioned glass with ice. If it's too strong, you may want to either add a splash of water or wait for some of the ice to melt.

Some folks make it 2:1, some folks swear by 1:1. You could start out 1:1 and keep adding Scotch until it's just right for you. I'm partial to the 3:1 mix, since it Drambuie has a good bit of sweetness to it. Whatever you do, enjoy.

What's It All About, Anyway?

2008-12-25T23:27:00.004-05:00

I'm sure by this time of year, you've most likely heard about the "reason for the season." This now-trite phrase is used to remind us that we're not supposed to be wrapped up in the consumerism that masquerades as Christmas.

I heard an interesting bit on NPR about "personalized" Christmas cards--you know, the ones where you take the photo of your kids or your dog down to Costco and get it made into a card to show your friends and family how well everything is going for you.

Not that I'm against them. I've sent them myself--taken the picture of our kids in their festive red outfits in front of the tree nearly eclipsed by presents, rushed down to the local big-box store eight days before Christmas in the hopes that we could get new cards minted and mailed to show up on time. We've all done it, and we will all probably continue to do it.

But the next time you prepare to do it, think about this:

On your next birthday, how would you like to get a picture of me, my house, my kids, my kids' pets, my family on vacation, or my deck?

Gin Rickey

2008-12-20T22:31:00.006-05:00

After bustling around a bit today, I was tired and needed a cool, refreshing drink. Yes, I said cool, refreshing drink in December.

The Gin Rickey is that drink. It is the most refreshing drink on the planet, next to water. Its a very simple drink, and one that can be made in just a few moments.

Gin Rickey
1 1/2 oz Gin
1/2 Lime
1 tsp suguar
Club Soda

In a highball glass, drop in a few ice cubes. Squeeze in one half a lime, and drop the squeezed lime rind in. Add the sugar and Gin, and fill the glass to the top with club soda. Umbrellas optional.

Good to go.

A New Beer

2008-12-15T21:55:00.004-05:00

For the ritual beer tasting Thursday this past week, I purchased a six-pack of Budweiser American Ale. After a refund program left me with 108 bottles of various Budweiser beers, I was pretty sure I'd never touch another Budweiser product for the rest of my life. Granted, Budweiser Select isn't too bad, but it's not usually in my top five choices when drinking out.

My opinion of Budweiser has changed after tasing Budweiser American Ale. I'll admit it--maybe I was marketed upon. The label is very rugged-looking, definitely a throw-back to more classic styling. It immediately resurrected feelings of nostalgia, and for some reason, with a bald eagle on the label, I felt almost patriotic purchasing it.

But, what's inside is even more important. It's very rich tasting, definitely a full-bodied flavor. Just hoppy enough, not a bitter aftertaste. It's like a microbrew. It smells like beer should, and dammit, I think it tastes like beer should.

Why Does Our Economy Suck Right Now?

2008-12-11T13:00:00.004-05:00

Unless you've had your head in the sand or been under a rock for the last year, you know our economy has been in a downward spiral. The release of the official word on December 1 by the National Bureau of Economic Research confirmed what we've all known--we're in a recession.

So, how did we get here? Listening to all of the talk of securitized loans and collatoralized debt obligations (CDOs), it may be easy to think that the repeal of the Glass-Steagall Act of 1933 and subsequent beginning of deregulation of the banks by Clinton with the Gramm-Leach-Bliley Act is to blame. Maybe partially so. Allowing investment banks to act as commercial banks (and vice-versa) definitely opened the door to these "complex financial instruments," as they've been called.

Some of these "complex financial instruments" include the securitizing of mortgages. What that means is mortgagors divide up their mortgages into tradeable securities and then sell them on the market. The idea is supposed to be that they're less risky because slices of so many different mortgages go into each security. Maybe they are--as long as the mortgagees are paying.

If you're a pro-business kind of person, then you'll probably see the hobbling of businesses (particularly auto makers) by unions as the cause. Yes, American car makers sell vehicles that cost more to produce, acquire, and maintain, and which also suffer quicker depreciation than their foreign counterparts. Union officials claim that they only account for about 10% of the cost of a vehicle; other sources say that number is as high as 25-30%. The truth is probably somewhere in the middle.

If you're more populist, you might think that the relaxed lending guidlelines from banks and the high-pressure tactics employed by mortgagors is to blame. Traditional guidelines said that you shouldn't buy a house that cost more than three times your annual income. With the takeoff of the CDOs, we quickly reached a point where everyone who wanted a home and qualified for a conforming loan had a mortgage.

To feed the beast, banks started offering "no verification" loans of all sorts, including "no document" and "stated income." These "creative" financing options allowed borrowers to merely tell the mortgagor how much money they made and the mortgagor would take it at face value. The inevitable happened--banks started lending money to people who had no way to pay the debt.

Adding insult to injury, a whole host of new loan options became popular, including interest-only and ARMs with ridiculous terms, designed to draw borrowers in on the promise of a low rate. The idea is that with a housing market rising at double-digit rates every year, you could continue to bank on your "investment" and just refinance (with cash out, of course) every so often to make sure you took advantage of your home's fake equity.

For example, a friend of mine recently related a story of when he was purchasing a home about 18 months ago. He makes a pretty good salary--about $70,0000 a year. He filled out the loan paperwork, and his mortgage broker told him that he qualified for a $600,000 mortgage. That's $3,000 a month for only the interest. Not to mention the taxes (most places in Michigan, that would be about $8-12,000 yearly) and insurnace (around $1,000 yearly). All of the sudden, you end up with a $4,000 per month commitment to your house; not too good when your take home is only about $4,100 after taxes and health care. Fortunately, he heeded Dirty Harry's advice, and knew his limitations.

But, for someone who wasn't as aware of what that would do to their finances (aka, no business getting a mortgage) or who was overpowered by the allure of an envy-causing house, it's the path to financial ruin.

People watching this happening from the outside would have called this "abso-f'ing ridiculous."

While all of these are definitely contributors, I'm going throw in the last piece of the perfect storm. Folks teetering on the edge of their financial demise were OK until the incredible rise in oil prices. All of the sudden, something that used to cost $2.00 per gallon doubled in the space of a few months.

The oil industry holds some blame, I think--they claim that percentage-wise, their margins never changed. That may be true, but it was obvious what the effect on the consumer was. 7% of $4bn per month is a lot different that 7% of $1bn per month or whatever it was. While they were recording month-over-month record profits, they were also setting the stage for the collapse of the entire world economy.

Suddenly, people had to choose between paying on their massive credit card bills, paying on their overpriced mortgage, paying on their gas-guzzling SUV, putting gas in their gas-guzzing SUV, or putting food on the table. Most people chose food. Food prices rose somewhat (mainly due to fuel surcharges), but stayed relatively flat when compared to the precipitous fall of home and car prices.

As people spent more that the pump, they started defaulting on their mortgages. People defaulting on their mortgages led to companies like AIG collapsing, due to having to pay unprecedented insurance claims to banks (AIG was one of the biggest players in the mortgage private insurance market--the folks you pay your PMI to when your house is at more than 80% LTV). With defaults and foreclosures flooding the housing market, prices plummeted. With all of the collatoralized debt obligations based on the fact that people pay their mortgages, securities started falling apart, leading to financial institution bailouts (Bear-Stearns, AIG), takeovers (Wachovia) or collapses (Lehman Brothers).

Demand for oil plummeted as well--since you no longer have a job or a house, you certainly can't afford to be driving anywhere. While oil is still almost double the 2004 OPEC target price of $29/barrel, pump prices are the lowest they've been in almost a decade.

With the impending passage of the bailout for the Big 3 and subsequent appointment of a Car Czar, one can't help but wonder if it's going to do any good. After all, we have also had government oversight in banking (Senate Banking Committee) and financial trading (Security and Exchange Commission), and that hasn't helped out a whole lot.

All I can really say is that there's no time like the present to analyze your spending and debts and figure out how to live within your means instead of leveraging assets with declining values (such as your home) to fund your future.

Sangria

2008-12-05T22:56:00.012-05:00

This is a very tasty treat, great for summer evenings out on the deck.

Sangria
1 bottle Cabernet Sauvignon
2 oz Hennessey VS Cognac
1 oz Cointreau orange liqueur
1 12-oz can of frozen orange juice concentrate and 6-10 oz water -or-
24 oz orange juice
1 1/2 C sugar
2 apples (I use Gala), peeled, cored, and sliced into wheels
2 oranges, sliced into wheels
1 lemon, sliced into wheels
1 C sliced strawberries

The Pampered Chef Apple Peeler/Corer/Slicer is great for taking care of the apples. My good friend Becky Zale can hook you up if you need one.

Combine all ingredients in a pitcher or punch bowl and refrigerate overnight, stirring occassionally. If you're like me, you'll find an excuse to sample it every time you stir. :-)

Ladle into red wine glasses, including fruit. Serve with spoon.

Hot Buttered Rum

2008-12-05T22:39:00.008-05:00

As the cold sets in here in Michigan, it's increasingly important to stay warm. How better to do it than with a great hot drink? This is great to share among your Euchre-playing friends on a cold night.

Hot Buttered Rum
1 Stick of Butter
2 C Brown Sugar
16oz dark rum
8 Cinnamon sticks
Boiling water
Cream or milk
8 mugs
Whole cloves (optional)

Place 1 Tbsp of butter and 1/4C (4 Tbsp) of brown sugar in each mug. Pour in a little boiling water to melt the butter and dissolve the sugar. Pour 2oz of dark rum into each mug, and fill each mug with boiling water, leaving a little room at the top. Top each drink with a splash of cream or milk and drop in a cinnamon stick and and a single clove (optional).

Some folks add a sprinkle of nutmeg to the top. For the proper pronunciation, ask the Target Lady.

Frozen Strawberry Margarita

2008-11-27T22:37:00.007-05:00

I am at long last sharing my famous strawberry margarita recipe. I've been perfecting it for almost two years, and am confident enough that I can share it freely.

Frozen Strawberry Margarita
6 oz 100 Años Blanco Tequila
4 oz Cointreau orange liqueur
10 oz frozen limeade
2 C crushed ice
2 1/2 C frozen strawberries
1 slice frozen peach
splash of DeKuyper Peachtree Schnapps

Combine all in a kickass blender. I use a VitaMix 5000, which does a bang-up job. Makes 4-6 servings.

Note: 100 Años is a relatively soft tequila. If you use a sharper tequila, you may need to adjust it with more strawberries or ice.

Let me know what you think!

"Real" Italian

2008-11-18T18:39:00.005-05:00

So for the past two nights, I've stayed at the quaint Ardmore House Hotel in lovely St. Albans, UK. The hotel is situated in a residential area along Lemsford Road in St. Albans, Hertfordshire, UK. I've got an "upgraded" room, complete with 13" color television and 4-poster bed. It looks nice, though the bed's comfort leaves something to be desired. My room has built-in wardrobes on one wall, bookending a large window with gold curtains, and a private bathroom.

Tonight, I dined for the second time at the Belvedere, the posh Italian restaurant attached to the Ardmore House Hotel.

While the atmosphere is beautiful--everything you'd expect from a fancy restaurant (see the picture of my table next to the piano)--the food isn't as good. Last night, I ordered an appetizer of Tricolore, which was supposed to be slices of avocado, tomato, and cheese drizzled with olive oil. The cheese ended up being an unfortunate clump of gooey goat's milk cheese--nasty to both look at and taste. I didn't fare much better with the rocket ensalada--it's a collection of spicy spring greens in an old-tasting olive oil dressing. My main course, Spezzatino di Pollo con Crema e Funghi, however, was very good. It was sliced chicken breast in a brandy cream sauce with fresh mushrooms and rice. Delicious. The house red wine that accompanied it burned like a cheap box wine, but there was nothing cheap about the price--$16 for a half glass.

I decided to go for a dessert, hoping I could depend on the classic Tiramisu; it was nothing more than dry white cake with layered with whipped cream, drizzed in Hershey's syrup and topped with Swiss Miss hot cocoa powder. Very disappointing. At least the Bailey's, Cointreau, and Cream I ordered was good.

Tonight's meal was equally unbalanced in quality. I started off with a delicious minestrone soup, followed by another cold appetizer. This time I tried Carpaccio of Beef. Never having had it before, I had no idea what to expect. The description on the menu is "Slices of Fillet Steak Marinated in Olive Oil & Lemon;" the word ommitted here is raw. I was starving, so I ate the entire thing--about 4 ounces in all. It tasted fine; the texture was a little unnerving, and the olive oil drizzled on it had the same old taste as the night before. My stomach is not entirely happy with me right now.

For dinner, I ordered something that I figured would be "safe"--Spaghetti v Napoli. It was okay; it had a meat sauce quite reminiscent of "Chef Boyardee." But, at least it was cooked. I finished it off with a Tia Maria-liquered coffee topped with cream, which at $12, cost as much as my main course and was twice as good.

All-in-all, the miss-and-occasionally-hit Belvedere restaurant gets an "A" for looks, but a solid "C" for food quality.

History of Active Directory

2008-11-16T19:05:00.003-05:00

Great little blurb, for those of you interested in how it all began.

http://blog.joeware.net/2008/08/11/1420/

This post features several snippets of email from a newsgroup. The best comments come from one of the integral parts of the DS team, Don Hacherl.

Funky Chips

2008-11-15T16:53:00.005-05:00

So, this week, I'm in the UK doing some work, and I stumble across an entire array of weirdly-flavored chips. On my travels over the last few years, I've endured curry fries, steak tar-tar, thick worchestershire sauce, bone-in-scale-on-ungutted-salmon, unsalted and runny ketchup, pickled ham, and fish jello--a wretched (supposedly epicurean) blend of fish bits in clarified lard. I've had oily Guiness, soupy cucumbers, way-too-heady Beck's, and extraordinarily bitter coffee.

But today, in a lonely datacenter just outside of Leeds, UK, I experienced potato chips. Not that I haven't had chips before--I rather love them. However, it seems that these crazy Brits will put any flavor on a chip. Take my two examples from today: Roast Chicken and Roast Ox.

Who would think that meat-flavored chips would take off?

Me: "Hi, honey, when's dinner?"
The Mrs.: "Well, the chicken isn't done yet. But we do have the green beans and potatoes."
Me: "No worries. [Pulls out bag of Walkers Roast Chicken Potato Chips] I've got it under control!"

Actually, they did taste pretty good. The aroma of Chicken smote me as I opened the bag of Roast Chicken chips, but the taste was more like a normal, unflavored potato chip. Still, pretty good.

The flavor of the Roast Ox chips was, well, not as oxeny as I imagined they would be. Of course, never having eaten an ox, I probably wouldn't be able to pick the flavor from among any other beef-like flavors. The taste of these chips could be, in my mind, be described as extra-smokey barbecue. Quite salty, quite good.

So there you have it. Two foods from the UK this week that don't suck. But they are weird.

Perception is Reality

2008-11-12T16:29:00.006-05:00

Though a lot of people disqualify it as a trite, modernist phrase, I think it's more true than not.

As Henry Ford said, "If you think you can do a thing or think you can't do a thing, you're right." If you hold the view that you can't accomplish anything, you'll rise to meet that.

Along that same vein, Henry Ford also said, "I am looking for a lot of men who have an infinite capacity to not know what can't be done."

Looking at the problems that plague our nation (the worst financial crisis since the Depression, rampant home foreclosures, radical climate change, a world that disdains just about everything we do), it's easy to succumb to the perception that it's not going to get better anytime soon.

And, while it will take a while to dig out of the messes (especially ones as big as ours), I think back to the day after the Election, hearing the reports of spontaneous cheering throughout the world (developed and undeveloped) about Obama's victory. While he certainly can't fix everything overnight, the perception that the rest of the world has is that we've elected someone willing to listen to the people and the international community. That shift in perception gives us a lot of goodwill from the international community and can definitely have a positive impact on Obama's honeymoon period as President. There's a decided difference in perception on the world stage between a country that's gone amok with a leader who is too stubborn to listen to any contrary opinions and a country that's gone amok with a leader who wants to implement the will of the people.

I was reading an interview with Obama in last week's Rolling Stone that had some very poignant thoughts. In talking about McCain's erratic behavior and response to crises:

RS: What makes you better prepared than John McCain to handle a crisis--whether it's a terrorist attack, a financial meltdown or a natural disaster?

BO: We've had two significant moments where the judgment of a commander in chief would have to be applied in a very deliberate fashion. One is the war in Iraq, and the other is what's happened just over the last three and a half weeks on Wall Street. In both instances, what you've seen is John McCain being impulsive, not getting all the information that he needs, surrounding himself with people who are predisposed to agreeing with him. And as a consequence, I think he's made bad judgments.

To me, it's a very similar M.O. to that of George Bush. GWB brought in the good ol' boys from his father's administration, who were the good ol' boys from Reagan, who were the good ol' boys from Nixon. Most of the advisers in the Bush White House have been around in Washington for 30 or 40 years.

While Obama will most likely bring in many from the Clinton era, I think you're also going to see a raft of prestigious scholars and professors in diplomatic and fiscal advisory roles. There is a multitude of wisdom in many counselors, and knowing what you don't know is really one of the first steps to being successful. It's important to have opinions and principles, but it's also important to be willing to be wrong and listen people who have more knowledge and experience than you do.

The comment about listening to people predisposed to agreeing with you is of preeminent importance to me, both in this discussion and in general life discussions. Frequently (especially as Christians), we surround ourselves with so many people that are like-minded that we lock out other points of view. It's great to build a camaraderie based on people with a similar vision and purpose, but if you all share the exact same ideas, what happens when that one idea is wrong?

It's kind of like watching the news channels. Republicans tend to watch Fox News while Democrats tend to watch CNN. Not because the news is better on either station, but the slant is decidedly more conservative or liberal. People don't watch news stations like Fox or CNN for information on issues, they watch news stations like Fox or CNN for affirmation that their belief structure is correct or acceptable or right.

I think it shows great wisdom, integrity, and maturity if you're willing to take advice from wise people--not just people who agree with you. Because every now and then, you're wrong.

So, back to perception is reality. Can Obama change the world? Maybe, maybe not. But what he's already changed is the perception of America, which may give him (and us, collectively), time to change the reality.

VHDMount for Hyper-V

2008-11-09T22:37:00.006-05:00

Even though Microsoft has been my bread and butter for the last 12 years, I can't help but think so many of the things they do aren't fully thought through from the end user perspective.

Take this one, for example. In Virtual Server 2005 R2, Microsoft included an incredible tool called VHDMount.exe. The end result--you can mount a VHD as a volume, and read/write against it. A few quick reg edits (or the reg script provided by the Virtual PC guy) and you could get context mount/dismount from within Windows Explorer. Sweet, right?

One would think that such a useful utility would have followed on to Windows 2008 and Hyper-V, where the hypervisor is built into the OS, right? One would think so, but then they'd apparently be the only one. Yes, this feature is gone. How could it happen?

So, I stumbled upon a couple of scripts that invoke the Hyper-V tools to do just that. Please give some mad props to Ravi Chaganti, who figured it out.

http://www.ravichaganti.com/blog/?p=77 - Right click to Mount & Dismount Hyper-V VHD
http://www.ravichaganti.com/blog/?p=81 - Script Update: Right click to Mount & Dismount Hyper-V VHD

You'll want to visit both blog posts. The first post has a ZIP that includes a REG file for exposing a context menu in Windows Explorer for mounting/dismounting. The second post has an update to the script.

Cosmopolitans

2008-11-08T22:35:00.005-05:00

After a long day, a good drink is a great way to unwind. Traditional Cosmos are pretty stout drinks. I'm more of a lover of flavor over potency, so I make mine a smidgen different, but it results in a much more palatable drink that you can sip all night long.

Classy Cosmopolitan
1 oz Cointreau orange liqueur
1 oz Belvedere vodka
1/2 oz fresh-squeezed lime
2 oz cranberry juice

Combine all ingredients with ice. Shake and strain into a martini glass.

For those of you looking for a more "standard" or "traditional" cosmopolitian, here's a good recipe. A cosmopolitian is actually a pink-ish drink. Less red means more alcohol, so a real cosmopolitian will sit you down in a hurry.

Cosmopolitan
3 oz Absolut Citron
1 oz Cointreau orange liqueur
1 oz cranberry juice
Splash of lime juice

Combine all ingredients with ice. Shake and strain into a martini glass.

Make it "your own" by adding or subtracting ingredients. As always, let me know what you've tried and how it's worked.

Another long night ...

2008-11-08T22:30:00.003-05:00

So ... I've spent the last 24 hours shuffling VHDs around because we ran into a problem a few weeks ago where the VHD expanded larger than the physical drive. Ooops. That's what happens when you configure a dynamically expanding VHD to be 350GB and drop it onto a 300GB drive. No advanced math degree required here.

So, to fix the problem, I've had to move the data from one spot to another, replace the drives in the servers, and then move the data back. Fun times. It's about 1.2TB of data that I have to move twice.

Windows 2008 includes the demonic "Scalable Networking Pack" components that caused so much grief in Windows 2003 SP2. Word to the wise--if you haven't tested everything out, TURN OFF RECEIVE SIDE SCALING when trying to transfer files. If for some reason the RSS handshake doesnt' happen properly, you data barely goes anywhere.

To fix it, go to you Network Connections, click Manage connections, and then select an adapter. Right-click > Properties, and then click Configure next to the adapter. On the Advanced tab, select Receive Side Scaling and set it to "disabled." Do this on all servers. Reboot.

Watch everything go much faster.

Cheers everyone.

Creamsicle

2008-11-07T22:39:00.007-05:00

I posted this a while ago on FB, but I decided to repost it here--mainly so I have an easy place to find it when I want it.

I conjured this up while I was watching an SNL from a few weeks ago, and had a hankering for something orange. I came up with this mellow orange dessert cocktail:

1 part Bailey's Irish Cream
1 part Cointreau orange liquer
1 part cream or whole milk
2-3 ice cubes

Drop the ice cubes into an old-fashioned glass, and then add the Baileys and Cointreau. Add the milk or cream and stir gently.

Error c00706ba when adding an Exchange RUS for a child domain

2008-11-07T12:35:00.007-05:00

This is one of those problems that can leave you banging your head against the wall. Say you have a multiple domain forest and have Exchange 2003 installed in the parent domain. Then, say you want to give Exchange mailboxes to users in one of the child domains. Shoudl be as easy as running setup /domainprep in the child domain and then creating the new RUS through ESM?

If only.

There's an error that plagues every Exchange admin who tries this task. You go through the steps creating the RUS, choosing the Exchange Server you want to host the RUS and the domain controller in the child domain. You have everything selected, click Finish, and then, after what seems like an unusually long pause (the kind that lets you know it's not going to work), you get this message:

The RPC server is unavailable.
Facility: Win32
ID no: c00706ba

RPC errors. Great. You check firewalls on both sides--wide open. You ping the target DC's FQDN, which resolves. Retry the procedure, but it's really about as effective as slamming your hand in a car door repeatedly.

The solution is ridiculously simple, and makes sense in Exchange 2003 world. Exchange 2003 still has a lot of dependencies on NetBIOS name resolution. There are several alternatives:

1. Add a static WINS entry for the domain controller in the child domain.
2. Configure WINS replication between child and parent domains.
3. Add the hostname (not FQDN) to the hosts file in %windir%\system32\drivers\etc\hosts on the Exchange Server where you are trying to add the RUS.
4. On the network adapter properties of your Exchange server, add DNS and WINS servers for the child domain.

The problem is that the RUS wizard is looking for the NetBIOS name of the DC that's going to be used in the child domain. Unless you're replicating WINS between parent and child or pointing to a remote WINS/DNS server that has the target domain controller that you've specified for the RUS, you won't be able to resolve the short name of a domain controller in the child domain. Yes, it sucks. Even though the Exchange server is looking for a NetBIOS name, putting the short name of the DC the hosts file works due to the name resolution lookup process. If you had put the FQDN of the target DC in the hosts file, you'd still have the problem--remember, you can already ping the FQDN, so putting it in a local hosts file isn't going to fix your problem.

The real tricky part of figuring this out is that during the RUS creation process, the wizard tells you the FQDN of the target domain controller in the child domain, yet it attempts to contact only the NetBIOS name of the DC.

You may also want to check to make sure that the Exchange Domain Servers and Exchange Enterprise servers groups have been created (should have been done through the Exchange setup /domainprep command) and are in the default Users container.

The Day After

2008-11-05T10:30:00.005-05:00

It's still pretty amazing. From out out of obscurity, a dark horse candidate rose to become the most powerful man in the world. A lawyer who came from a humble background built his campaign on bridging divides and challenging Americans to dig deep and think about the promise of the future. A nation sharply polarized on key issues--racial equality, rights, taxation, education. He had incredibly well-written speeches that could turn a crowd silent.

You might think I was talking about the 2008 election. But I could just as easily have been talking about the election of 1860 that put Abraham Lincoln into office.

A backwoods boy who taught himself law, Lincoln struggled through failures and backbiting in his own party to become one of the most influential and greatest presidents in our history. Might we see the same from Barack Obama, whose dad left when he was two and was raised by his mother and grandmother?

As I said in a post yesterday, I've heard several historians talk about shifts that happen over time in party issues. They start off very polarized, work their way towards their middle, and gradually, switch sides. And on other issues, they start off polarized, and one party moves closer to the other party, so that there isn't really any distinction between them. "Climate change" is a good example of this phenomenon. 15 years ago, you'd never hear a Republican say anything about the environment, except that there were some tree-huggers getting in the way of business. Now, it seems like they're at least conscious of the issue. I expect that by the next election cycle, Democrats and Republicans will be trying to out-green each other.

Something that immediately impressed me was the language that Obama uses to talk about the country. He doesn't talk about "us and them," but just "us." Leaders give us a vision. Good leaders instill the vision in us. Great leaders inspire us to accomplish the vision.

I was working last night while watching his speech. At one point, I had to actually typing and pay attention:

This election had many firsts and many stories that will be told for generations. But one that's on my mind tonight's about a woman who cast her ballot in Atlanta. She's a lot like the millions of others who stood in line to make their voice heard in this election except for one thing: Ann Nixon Cooper is 106 years old.

She was born just a generation past slavery; a time when there were no cars on the road or planes in the sky; when someone like her couldn't vote for two reasons -- because she was a woman and because of the color of her skin.

And tonight, I think about all that she's seen throughout her century in America -- the heartache and the hope; the struggle and the progress; the times we were told that we can't, and the people who pressed on with that American creed: Yes we can.

At a time when women's voices were silenced and their hopes dismissed, she lived to see them stand up and speak out and reach for the ballot. Yes we can.

When there was despair in the dust bowl and depression across the land, she saw a nation conquer fear itself with a New Deal, new jobs, a new sense of common purpose. Yes we can.

When the bombs fell on our harbor and tyranny threatened the world, she was there to witness a generation rise to greatness and a democracy was saved. Yes we can.

She was there for the buses in Montgomery, the hoses in Birmingham, a bridge in Selma, and a preacher from Atlanta who told a people that "We Shall Overcome." Yes we can.

A man touched down on the moon, a wall came down in Berlin, a world was connected by our own science and imagination.

And this year, in this election, she touched her finger to a screen, and cast her vote, because after 106 years in America, through the best of times and the darkest of hours, she knows how America can change.

Yes we can.

A tear trickled down my face. If you are not moved by the magnitude of that thought, you might want to make sure you are alive.

I was reading the Facebook comments of a lot of my friends last night and this morning. People expressing disgust and fear, calling us foolish for believing a smooth talker, buying into this liberal idealism.

To those people, I ask:

What if it's not as bad as you think?
What if Obama is this generation's Abraham Lincoln?
What if everything you thought was wrong?
Are you willing to let down your wall and listen?

God gave us one mouth and two ears; besides being more aesthetically pleasing, I think there's something implied there: listen twice as much as you speak.

Not to get all Biblical on you, but James says:

My dear brothers, take note of this: Everyone should be quick to listen, slow to speak and slow to become angry, for man’s anger does not bring about the righteous life that God desires.

Give the man a chance. He has earned it. Whether you voted for him or not, he is your president. Lest you forget, the heart of the king is in the hand of the Lord.

Deal accordingly.

Maybe that's what we need--a little idealism. A little optimism that we can make a difference. That if we work together, we can build something great.

A journey of a thousand miles begins with a single step.

Yes we can.

America Made The Right Choice

2008-11-05T00:19:00.003-05:00

I just finished listening to Obama's acceptance speech. It was absolutely incredible. I'm sitting here in my cubicle tonight working on projects and have a CNN window up watching the election coverage.

As my wife will attest, I don't get emotional or riled up about much. While she says my even keel is something she loves, it also is something she hates because I don't get very emotional. Tonight, watching him and listening to him speak, I felt something different.

Like America has a chance.

I'm proud of my vote. Proud that as one out of 135 million registered voters, I made the choice to change the course of history.

So I Voted.

2008-11-04T15:28:00.006-05:00

I've been struggling with this for months, but this morning, a few minutes after 9:00, I colored in the last circle on my ballot. For Barack Obama.

I'm more than your typical political junkie. I've read everything about every presidential and vice presidential candidate. I know (or think I know) how each would vote in a particular situation. I know about John McCain's adopted children, Sarah Palin's pregnant-out-of-wedlock-daughter, Joe Biden's family tragedy when he was newly elected, and Barack Obama's grandmother who worked at a bank.

I know John McCain comes from a long line of those serving in the military, that Sarah Palin couldn't tell you a newspaper she reads, that Barack Obama taught at the University of Chicago, and that Joe Biden himself said he didn't want to be a candidate.

Sarah Palin is our generation's Dan Quayle. Joe Biden is an older, more refined, Dan Quayle.

I think on about 80% of the issues, you couldn't identify one presidential candidate from the other. Who supports putting the missle defense shield in Poland against Russia's grumbling? If you said John McCain, you'd be wrong. Who thinks that more offshore drilling is part of the short-term answer to our energy crisis? Barack Obama and John McCain both support it. The list goes on.

I've always thought of myself as a Republican. My mom tells a story about me when I was two years old, running around the Whitewater Armory polling location in 1980, shouting "Ronald Regan is a great man!" And he was. "The Great Communicator" is what they called him. But we're far and away from Reaganomics.

I got out my Social Security statement a while ago and was looking at the amount of income that was recorded for each of the last 11 years I've been working full time. The most interesting part? 1997, 1998, 1999, and 2000 were the years I've made the most money. Who was President? William Jefferson Clinton.

While I've always been a subscriber to the thought "the president doesn't have much to do with the economy" or "any changes a president makes aren't seen in his term," the tax returns show I made the most money during his second term in office. I've seen a steady increase in my taxes in the 2000s (one year, we jointly paid over $45,000 in taxes) and not a whole lot of benefit.

Historians say that political parties start out on the extremes, work their way towards the middle, and then after about 50 years of moving toward the middle, flip sides. I think that might explain part of where we are.

Traditional Democratic stronghold issues of global warming, green technology, and the like seem to find an audience on both sides, which I'm very happy to see. I don't understand why being a Republican meant that you had to be big-business and anti-environment. I heard a minister a while ago on the radio make a comment about this to the effect of, "God created the world and us; as Christians, we're entrusted with taking care of it--it shouldn't be the domain of tree huggers." I totally agree.

So last night, my wife and I sat down with the candidates and asked the tough questions. Well, I actually printed out a matrix of 75 questions from procon.org and the candidates' positions on them. I put a check mark under each column where we agreed. At the end, I tallied them up.

Out of 75 questions, both candidates had clear answers for 52, or about 70% of them. Offshore drilling. Abortion, gun control, stem cell research. Medicinal marijuana. Global warming. Russia, China, Korea, and Sudan. Israel. Fuel economy standards, fiscal policy, constitutional law. Iraq, Iran. Corporate taxes, illegal immigrants. On and on.

I learned something about myself. I don't think like my parents did. While both candidates play to the middle, I found that I had 40 check marks in the Obama column, and 35 in the John McCain column.

I was shocked.

We discussed Michigan Proposals 1 and 2. Proposal one was to allow the use and cultivation of medicinal marijuana. My wife was instantly against it, because we're supposed to be anti-drug, right?

But what makes marijuana any less of a drug than Vicodin? The fact that Vicodin comes from your pharmacist in a bottle? I started talking out loud about the last few months of my father's life--he had some very odd blood disorder that caused clots in his muscles. Every time he stood up, the clots would move around and cut off blood flow or pinch other things, causing the physically and emotionally strongest person I knew to break down and cry because of the pain. While my dad was staunchly anti-drug, he was popping 30-40 Vicodin a day to deal with the pain. Can that be any better for you than marijuana?

Checkmark in the Yes column for Proposal 1.

Proposal 2 was about embryonic stem cell research. They look like they may have the best prospects for discovering cures for things like leukemia, parkinson's, and hodgkin's. Proposal 2 was to allow the use of embryos that were leftover from fertility treatments that were going to be thrown away. Of course, Christian advocates call it abortion; is it any more abortion than if the embryos get taken off ice and thrown in the trash can? If Christians were *really* concerned with what happened to embryos left over from fertility treatments, they wouldn't go through procedures like IVF so there wouldn't be the potential to create life that might not get a chance. How does IVF jive with the "God chooses" mentality? "God chooses" as long as you keep trying through every medical means available? Hmm. If we're going to destroy life either way, we might as well reap some potential benefit.

Put a check mark in the Yes column for Proposal 2.

So, at the end of it all, I learned that while I'm for generally lower taxes, I also want to help ensure that my aging mother working a minimum wage job has the opportunity for lower health care costs. I don't want us destroy our planet before my kids grow up by dumping chemicals in rivers or letting factories billow mercury into the air. I don't want to go bombing countries we don't agree with; I think that careful diplomacy should be exercised before a gun ever comes out of a holster. I don't think the United States' sole purpose is to "spread democracy." Some people don't want it. Deal accordingly.

I don't want the fox guarding the hen house in the financial sector. Banks should be responsible with their customers' money, You shouldn't be able to trade stocks you don't have (naked short selling), and you should verify that the people you lend money to have more than a snowballs' chance in hell of paying it back (sub-prime mortgage mess). The ability to leverage $1bn 100:1 only ends up in sadness for someone--to date, the taxpayer has been singing the blues.

I want accountability from my stockbroker. How did we end up paying for AIG and Lehman Brothers' executives to get lucrative pay packages while the entire global economy slipped into recession?

I want to reward business for doing the right thing. I don't want to bail them out for making bad choices.

I'm a little less country, a little more rock and roll. And maybe a little bit more Democrat.

Whisky or Whiskey?

2008-11-02T21:55:00.008-05:00

This evening, while I was settling down to write a document on our handoff of a WSUS 3.0 environment to the proud, new parents, I decided that I needed a little something to get past any possible writer's block. So, out came the Maker's Mark Bourbon Whisky and shaker.

If you're really interested in the Whiskey versus Whisky debate, I suggest further reading somewhere else. Perhaps the community-controlled source of half-truth known as Wikipedia?

As far as I understand it, the Scots supposedly have claim to "Whisky," and all other distilleries supposedly use "Whiskey." Perhaps it's the "copy" versus "Xerox" debate--with much fame, your brand name is bound to get diluted. Maker's Mark claims to have Scottish heritage in their Bourbon, hence the "whisky" spelling.

But I digress.

A typical whiskey sour is a pretty simple concoction of whiskey or bourbon, fresh squeezed lemon, and sugar, such as this:

Classic Whiskey Sour
2 oz bourbon or whiskey
2/3 oz fresh squeezed lemon
1 tsp fine granulated sugar

However, I am a perpetual tinkerer. While I enjoy the purist's point of view, I also enjoy seeing if there's a way to make a good thing even better. While the main flavors are intact, I have made some modifications as to the source of the flavors.

Now, before you laugh me off the internet, I know what you're going to say about Southern Comfort. Just trust me on this one.

Fancy Whiskey Sour
1 1/2 oz bourbon or whiskey (I like Maker's Mark)
1/2 oz Southern Comfort 100
1/2 oz Caravella Limoncello
1 fresh-squeezed Mexican lime
1/2 tsp fine granulated sugar
1 splash of water

Shake vigorously with ice, and then strain into an old-fashioned or rocks glass with ice.

The Southern Comfort is a bourbon liqueur, so it pulls double duty as a bourbon and sugar, which results in the smaller portion of sugar required. I've found this recipe garners excellent reviews from everyone who has tasted it. However, your palate and friends palates may differ.

Southern Comfort 100 is a 100-proof liqueur, so it's a little more potent than the 80-proof whiskey traditionally used. If it tastes a bit harsh, you can try the standard Southern Comfort (70 proof) instead or another splash of water. You can tinker as well with the ratio of Southern Comfort, whiskey/bourbon, and sugar.

And, if you're really into a more sweet and sour drink, you can try this:

New Orleans Sour, otherwise known as "Soco and Lime"
2 oz Southern Comfort
1 fresh-squeezed Mexican Lime
splash of water

While I do appreciate the classic recipes and know them by heart, I also appreciate a new take on an old favorite. Let me know if you like it.

y2k, where art thou?

2008-10-31T21:49:00.004-04:00

Almost 10 years ago, I was a consultant for a health care consulting company. This particular company was prettymuch feeding off the paranoia. I mean, what hospital would want machines double-injecting patients with morphine at midnight? Or not at all? What bank would want ATMs to stop working--or better yet, chucking out yuppie coupons like a drunk 50cent at da club? No one. No one in deed.

So many people at the church we were going to thought the world was going to end. That's the thing about Christians. Not only are we single-issue voters, but we're also looking for the doomsday in everything. y2k was the best thing to happen to churchgoers in ages--spread a bunch of fear that the end of the world was upon us.

As a computer guy, I knew it wasn't the case from the technological perspective. I mean, it wasn't going to be "Rise of the Machines" any more than it was going to be the end of electricity, but a lot of my friends got roped into it. But then again, how could you be exactly sure?

I digress. I'm kinda sad that I didn't party like it was 1999. I hadn't yet discovered the joy of the margarita, or the simple pleasure of a quality scotch.

But now I have.

A lot of people think this election cycle is going to be the next end of the world. I'm not exactly sure. Maybe soon I'll have a post on it. Hopefully soon, because it's in like 4 days or something.

I think I'm voting for Obama. While John McCain does have the oldness, I'm not exactly thrilled with the tone of his campaign. W campaigned on the "Compassionate Conservatism" theme; McCain is more of a "kill 'em all and let God sort them out--and oh, yeah, I'm pro-life" kind of guy.

Again with Christians and the single-issue voting. Yes, I know that a candidate's stance on this issue supposedly will color his decisions on everything; but seriously, what side of the fence does being Pro-Life put you on when it comes to welfare reform? Medicare/medicaid? 401K and IRA contribution limits? Tax abatements for businesses? Gun control? Illegal aliens and undocumented immigrants? Seriously.

According to Consumer Reports, I'll benefit more under Obama's tax plan, but McCain's health care plan works out better for me. Thanks for making it clear as mud. I'm sort of a pocketbook voter, like a lot of people. I look in there and see how full it is compared to this time 4 and 8 years ago. We're doing OK personally, but I see a lot of folks going jobless and the unemployment rate in Michigan is reaching 10%. Wow.

Anyway, it's time to flip off the puter and go watch The Office. I'm feeling old, tired, and maybe like I need another beer.

Too Early

2008-10-25T07:30:00.001-04:00

Got paged this morning. Someone ran out of disk space. They're manipulating a 30GB database file; how can you run out of space on a VM with 300GB of space? Infuriating to say the least. I'm called out of bed for THIS?