Zone Assignments and GPO settings

Let's say you have a handful of websites that you want to assign to particular zones. You have an internal site you want everyone's browser to handle in the Intranet zone. You have a few external sites/vendors that your users need to interact with and those must be in the Trusted zone. Or even if you set your drive mappings in your login scripts to use the FQDN of the file server, and Windows/Office automatically treats every file on those drive mappings as "Internet" files and won't trust them (you need to set your domain in the Intranet zone).

 There are a couple of ways to handle this type of situation. First, you could just teach all the users how to do their own zone assignments, which is never a fun task. You could script the changes, adding the sites directly to the ZoneMap in the HKCU in the registry.  Or you could push it all out via Group Policy.

 There are two ways to push these settings via Group Policy; the strict way and the flexible way, depending on what you're trying to accomplish.

 If you want to set the Zone Assignments and not allow the user to modify them in any way, create a new policy and navigate to User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page.  Locate the "Site to Zone Assignment List" setting. If you disable this setting, no user will be able to set any zone assignments. If you Enable the setting, you can set the zone assignments for the user.

 HOWEVER, THEY WILL NOT BE ABLE TO MODIFY (ADD) ANY ZONE ASSIGNMENTS. 

Also, their existing zone assignments will be lost.  This is important. The user will not be able to add that one-off site that they need and will have to wait on you to add it to the GPO. However, sometimes it is necessary to do this. If you are ok with this, enable the setting and click the "Show" button next to "Enter the zone assignments here". I tend to enter my domain assignments using a wildcard, so any child/sub domains are covered. Of course, you can enter specifics here as well.

For the "Value", you must enter a number from 1-4 that designates what zone to put the domain in. They are:
1 = Intranet Zone
2 = Trusted Sites Zone
3 = Internet Zone
4 = Restricted Sites Zone

After you are finished, assign the GPO to the OU's you want to apply it to.

Let's say you want to be flexible.  You know there are a few users out there that might need to use another vendor's site for whatever reason and they don't want to wait for you to add it to the GPO.  Or an existing vendor made a change to their website and requires it to be in the Trusted Zone suddenly.  Or your helpdesk wants to troubleshoot an issue by moving site assignments around.  We want to assign sites and still allow the user to add their own.

TO ALLOW USERS TO ADD THEIR OWN SITES, DO NOT SET THE "SITE TO ZONE ASSIGNMENT LIST" SETTING.

Leave that setting to Not Configured.  I learned this the hard way.  Instead, navigate to User Configuration\Preferences\Windows Settings\Registry.  Right-click and choose New - Registry Item.

1. For Action, choose Update.
2. For Hive, choose HKEY_CURRENT_USER
3. For Key Path, enter Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\blogger.com  
1. Replace blogger.com with the domain you want to add.
2. If you want to cover the entire domain, just put the domain name.
3. If you want to cover only a sub domain, put it instead (example: client.blogger.com)
4. If you want to cover only www, put that as well (example: www.blogger.com)
4. For Value Name, you have a few options.
1. You can use a wildcard to cover anything .blogger.com (*.blogger.com)
2. You can specify a protocol (http, https).  This will only cover that one protocol (example: www.blogger.com, with Value http = http://www.blogger.com)
5. Value type: REG_DWORD
6. Value Data: Enter the value of the zone you want to assign.
1. 1 = Intranet Zone
2. 2 = Trusted Sites Zone
3. 3 = Internet Zone
4. 4 = Restricted Sites Zone
7. Base: Decimal.

Let's say you want to add an IP address or an IP range.  This is a bit trickier but it is possible.  First, your Key Path will be different.  Instead of "Domains" under ZoneMap, you will be placing the registry setting in Ranges.  Also, for each "Range" you will have to create a sub-key and it will require two settings instead of one.

If you run into an issue or need to know how to add a specific setting, you can always add the Zone Assignment on your computer and look in the registry to see how it works.   You can also do this to verify that the GPO is applying correctly.

Open Regedit and go to:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap

Your domain will each be a subkey under "Domains".  Your IP addresses will be under "Ranges".

iSCSI, Windows 2003, SANSurfer, and VDS

So I have a site with two servers having identical problems, a iSCSI volume will not initialize in Window's Disk Management utility (or create a partition in DiskPart).

In the GUI Disk Management, I get the error "Logical Disk Manager: The operation did not complete. Check the System Event Log for more information on the error." In DiskPart, I get the error "The disk management services could not complete the operation." The event log doesn't have an error directly explaining these errors, but sometimes I'll get an Application Error 1004, mentioning vds.exe (Virtual Disk Service) faulted. Google and multiple forum searches don't yield much result.

A little about the setup. I have an IBM DS3300 iSCSI SAN attaching LUNs to two Dell PowerEdge 1950s via a Qlogic QLE4062c cards, using SANSurfer software. (They're not sharing a LUN, each server gets a different one).

So I won't bore you too much, I'll leave out the majority of my troubleshooting and homicidal hatred towards these two systems and just give you the answer (or at least the answer that worked for me).

Turns out that the issue lies in the Virtual Disk Service, which Microsoft has a hotfix for here: Article ID: 948699. Once I installed the fix and rebooted I was able to initialize the disk, format, label, and use.

iSCSI File Shares Disappear

A quick tip for those new to iSCSI, the Microsoft iSCSI Initiator, and using the two for file sharing.

Setting up the LUN, mapping it as a disk, and putting your file shares on it is great, but there are a few configuration steps you need to take if you experience your share settings disappear every time you reboot (even thought the files remain).

First, ensure that the Server service is dependent on the Microsoft iSCSI Initiator Service. To do this, go into the Services MMC, open the Server service properties, and check under the Dependencies tab. No Microsoft iSCSI Initiator? Open Regedit (Run - regedit.exe) and navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\lanmanserver. Find the key "DependOnService" and set it's value to MSiSCSI. The Server service is responsible for creating the shares; if this service starts up before the iSCSI LUNs are ready on the server, then the shares will not appear.

Second, make sure you set up the Microsoft iSCSI Initiator to automatically restore the connection and drive letters. Under the Targets tab, when you highlighted the target and clicked "Log On", did you check "Automatically restore this connection when the system boots"? If not, remove the connection and log it back on, this time selecting the correct option.

Third, after the drive has been set up and you assigned it a drive letter, go back into the Microsoft iSCSI Initiator software and click on the Bound Volumes/Devices tab. You'll see some funky volume path that looks like gibberish. Highlight it and click Add. Put in the drive letter you assigned and click Ok. This will cause the iSCSI Initiator service to not completely start until the volume has been mapped to the drive letter. Since the Server service now depends on the iSCSI service starting up, it'll have to wait until the volume is available before it can assign share settings.

Software Review: The Hobbit Monitor

When looking for server and network device monitoring, there are quite a few options, ranging from very expensive to free. Today I focus on a free solution that I use, The Hobbit Monitor.

Hobbit is a system based on a plug-in for the Big Brother Monitoring software. Big Brother has been around for quite some time and was bought by Quest Software a few years ago. Hobbit is very comparable the Big Brother system, keeping most of the same general interface and functionality but adding many new features and overall speed improvements.

Hobbit is a monitoring solution for servers and network devices and allows you to write or use extensions to monitor just about anything that responds over a network connection. A central server controls and collects the monitoring and displays the results via a fairly easy to use web interface. It will track history and trends (via rrd) and provides a built-in reporting tool. If there is an issue (that you've defined), such as a down host, the interface will turn red and will performs any alerting actions that you've defined, such as sending an email or sms message.

A member of the Hobbit team provides a live demo here: http://www.hswn.dk/hobbit/

The alerting function has some great features and is very customizable, but is less than straight forward in its setup. An example the configuration file:

$PHONE=MAIL mycell@acme.com SERVICE=conn REPEAT=2h FORMAT=sms DURATION>10m
$SYSADMIN=MAIL admin@acme.com REPEAT=2h DURATION>10m TIME=*:0600:2300

PAGE=servers/siteone TIME=*:0700:2100
MAIL a_sysadmin@acme.com SERVICE=conn REPEAT=50h FORMAT=plain

HOST=%^win.*
$PHONE
$SYSADMIN

Breaking it down a bit, the configuration is in two parts, the definition and rules of the targets and definitions of the monitoring rules.

The $PHONE definition will email mycell@acme.com only if the conn test (ping test) fails, will repeat the alert every two hours, send the alert in sms format. It will also only trigger if the system has been in alert status for more than ten minutes. The $SYSADMIN definition will email admin@acme.com every two hours on ANY failed test lasting over ten minutes and only between the hours of 6am and 11pm. Those two lines define the targets (whom to email) and the conditions at which to email those addresses.

The PAGE=servers/siteone definition will monitor all the hosts on a page on the server. If your server is http://hobbit.acme.com, then it will monitor all the hosts on http://hobbit.acme.com/servers/siteone. Continuing on that line, the section TIME=*:0700:2100 will only trigger the alert if a host is in alert status between the hours of 7am and 9pm. The next line specifies a target, in this case an email address with some extra rules. The HOST=%^win.* will monitor any hosts that has win. in the name. For example, if you name several servers inside Hobbit win.server, like win.mailserver, win.fileserver, win.appserver. No matter where in Hobbit you have these servers, they will be monitored under this rule. The next two lines, $PHONE and $SYSADMIN just call the predefined targets and use the rules defined there.

As you can see, the alerting functionality is very customizable and, even if the setup isn't point and click, not that hard to set up once you have a little understanding about it. Hobbit also features an easy way to pause or stop alerts via it's web interface. You can stop alerts by test type (like ping test, telnet test, etc), set a duration for the stopage (like no alerts for this host for the next two hours, or until the test turns ok), or even schedule a stopage when you are scheduling some downtime for a host.

As I mentioned before, Hobbit can be extended and customized for greater functionality. You can add more tests either by enabling those built in (refernce the help file for details), by writing your own port tests (also in the help), or by adding extensions. See deadcat.net for a lot of extensions and additional tests. Although the majority of these are geared towards Big Brother, with a little bit of code tweaking they can be easily adapted to Hobbit.

Although this system seems to be Linux/Unix oriented at a quick glance, it provides a lot of functionality for Windows systems utiliziing an agent called BBWin. With BBWin, you can monitor resources such as CPU usage, disk usage, memory usage, running processes and services, uptime, and netstat results. You can also add additional extensions (called externals in BBWin) to test for other things. Configuration is done in an XML file on each server and is very customizable.

You can customize the default warn and panic levels for the CPU usage:



Disk monitoring can be configured with a default warning and panic levels:



Or you can specify specific levels per drive based on a percentage or just an amout of space left:



Remote drives and optical drives can be monitored as well:



Services can be monitored wheter they are running or not. You can also automatically restart the service if you so configure it. You can specify any process running on the server just by adding another line with it's service name. Processes are configured similarily:



Example of the Hobbit overview of some Windows servers utilizing BBWin:



Example of the CPU usage monitoring:



Example of the OpenManage extension I use for my Dell servers:



As you can see, Hobbit is a very powerful and customizable alternative to the other server and network monitoring products out there. With a little bit of reading and some work, you can get this system up and monitoring your systems without too much hassle. Hobbit is definately worth a try if you need a solution and don't have the funds to drop for a commercial solution.

Using DSADD.exe to Bulk Create Users in Active Directory

So I had to add about 70 user accounts to Active Directory in preparation for a new call center. Sounds like boring, tedious work if you ask me. Well, it would be without the magic of dsadd.exe, a command in Windows 2003 command line that allows you to create Active Directory objects, such as users, computers, groups, contacts, and OUs. My focus here is on adding multiple user accounts.

Focusing on my needs, I wanted to add the user, set the display name, set a password, set a description, set the office, their title and department, and their logon script while forcing a password change and the ability to change the password. I also wanted these accounts to start disabled since it might be a week or two before the users are ready for them. Have the accounts created in the proper OU would also be nice. Also, my users would be logging with accounts based on their phone extension numbers, since high turnover is a concern.

So, I set up a user, called cc70215. Since I want him in his proper OU, I set him up as cn=cc70215,ou=Users,ou=CallCenter,dc=sysadminhell,dc=com. This was no big deal, I already had the list of users, just copy/paste and some text replacement set up the list of users. With all I wanted to do, I set up the command as such:

DSADD user cn=cc70215,ou=Users,ou=CallCenter,dc=sysadminhell,dc=com -display cc70215 -pwd mypassword -office "Call Center" -title "Customer Service Associate" -dept Collections -loscr cc_li.vbs -mustchpwd yes -canchpwd yes -disabled yes

A success message will return if successful and navigating to the CallCenter, Users OU will reveal my new account. But this is a pain to set up 70 times. And it was 30 minutes before time to go home. So, I got dirty a bit and cheated with the batch script FOR command. First, I got all my users in a comma-separated list. I also had to put quotes around each user. A quick text replacement in my favorite text editor (Notepad2) did the trick. Then I created a batch file, and put in the following:

FOR %%D in ("cn=cc70216,ou=Users,ou=CallCenter,dc=sysadminhell,dc=com", "cn=cc70217,ou=Users,ou=CallCenter,dc=sysadminhell,dc=com", "cn=cc70218,ou=Users,ou=CallCenter,dc=sysadminhell,dc=com", "cn=cc70219,ou=Users,ou=CallCenter,dc=sysadminhell,dc=com", "cn=cc70220,ou=Users,ou=CallCenter,dc=sysadminhell,dc=com") DO DSADD user %%D -display %%D -pwd mypassword -office "Call Center" -title "Customer Service Associate" -dept Collections -loscr cc_li.vbs -mustchpwd yes -canchpwd yes -disabled yes

For this example I only used 5 users, but you get the point.

Put a pause and exit in there and run it as a domain admin. With all luck, your accounts will show up in no time. Now, I did find one issue with this method. Here I'm telling it to set the -display (Display Name) with the variable %%D. What this does is set the Display Name for the account as "cn=cc70216,ou=Users,ou=CallCenter,dc=sysadminhell,dc=com", which is not ideal. Since I was under some time constraints, I just changed the Display Name for the new accounts manually (took me about 10 minutes to prep the script, 2 minutes to run it, then another 10 to fix the Display Name issue). Researching other ways to do this now that I have some free time, I could have done this via wscript (using arrays), used the built-in Windows command CSVDE.exe (see this Technet article for more info), or bought one of several different commercial applications. Even with the one flaw, it did all I wanted it to do for free and under 30 minutes.

A Few Print Server Tips (for Windows)

I was setting up an old server to act as a print server today and decided to share a tip or two.

Move your print spools to another disk.

Since spooling can take up a bit of I/O, moving this to a disk other than on your system disk can help speed things up a bit. This also helped me a few years ago when I had a 12 GB system partition (remember when vendors shipped drives like that) and needed to free up some space.

1. Open the Printers and Faxes applet.
2. Click on File and Server Properties.
3. Click the Advanced tab.
4. Change the directory of the Spool Folder to the other drive.
5. Click apply.
6. Restart the Print Spooler. Open a command line and run net stop spooler && net start spooler.

Install only the DRIVERS, not the software.

I've seen people do this before, especially with HP or Dell (Lexmark) printers. When setting up a printer on a server, don't run the printer's "install" utility, don't install their special "printer monitor", and don't run any "driver install packages". Always install only the drivers. This avoids all the unnecessary services and processes running on your server. I've found that most of these programs are bulky, eat memory, and will slow down your printing. I've seen a few from the vendors I mentioned already that have memory leaks.

Beware printers on a terminal server.

Actually, don't beware of them. Just don't put them on the terminal server in the first place. Set up all your printer queues on a different server. There are several reasons for this.

1. Disk I/O is an important resource in Terminal Server. When you have 60+ users hammering the same disk at the same time, you don't need 20 print jobs trying to do the same. If you HAVE to have printer queues on the Terminal Server, follow my first tip and move the spools to another disk.
2. Memory usage is another important resource. The print queues will take up memory, but some drivers will spawn a process for each and every user on the system. This adds up quick if you have two or three of these processes per user and a large number of users.
3. If you have a limited amount of hard drive space, periods where there is a high volume of printing will make things much worse (unless you move the spools to another drive).
4. All of your users will see all of the print queues on the system. This can provide some amount of confusion for your users, and you might find them printing to the wrong printer or changing printer settings.

Printer pools and other tips

I found the article Configure IT Quick: Configure print queue servers for efficient printing informative if it's applicable for your environment.

Also see the article Get IT Done: Boost printer performance by adjusting Windows' spool file settings.

Encrypt Your Scripts

Need a quick and easy way to encrypt the contents of a vbs script to keep its contents safe (well, decently safe)? Microsoft has a tool called Script Encoder that does such a thing. The operation is pretty easy, just install the tool on your workstation, create a working script, and drop to a command prompt.

C:\Program Files\Windows Script Encoder>screnc.exe "c:\scripts\original.vbs" "c:\scripts\encrypted.vbe"

Didn't have to install anything on the client side, script ran just fine on Windows 2003 SP2.

For more info, including examples and syntax, check out the MSDN Script Encoder Overview. They also have info on encrypting JScript.

Clear the Temporary Internet Files using the Windows XP Disk Cleanup utility

Clear the Temporary Internet Files using the Windows XP Disk Cleanup utility: This article explains you how to clear the Temporary Internet Files using the Disk Cleanup utility, Automate the cleanup task, and explains you how to add a cleanup button to the Internet Explorer standard toolbar for people who need to clear the Temporary Internet Files cache very frequently.

Why windows takes so long to start up.

Most of us have had a brand new computer at one time. It's a great feeling. You boot up windows and within 30 seconds you are surfing the net, checking your email, or playing your favorite game. 10 months down the road things aren't so nice anymore. You power up your computer and it seems to take forever to load.

read more | digg story