Windows Tips: Advice from Windows experts
Systems administrators can never have enough short cuts or creative troubleshooting ideas. In this series, Mitch Tulloch, a well-known industry expert specializing in Windows server operating systems, provides advice for every day administration as well as more challenging problems.
Windows Tip: Specifying the current directory for an admin-level command prompt in Vista (04/08/2008)
Vista takes some getting used to, doesn't it? Especially User Account Control(UAC) and the effects it has on doing things like running simple tasks. Here's how to open an admin-level command prompt for a specific directory. Read more.
Windows Tip: Customizing Vista's Instant Search (04/01/2008)
Here's how you can add a "Search Wikipedia" option to the Instant Search box on your Start menu.
Windows Tip: Sizing your event logs (03/18/2008)
The Windows Event Logs are a good thing -- they're a primary source you can mine when troubleshooting server problems or monitoring server security. Because of this, it's a good idea to collect as much information as possible in these logs in order to provide you with a historical baseline of your server's operations to help you troubleshoot difficult issues, and also to create an audit trail for security purposes. The trouble is, can you have too much of a good thing? Read more.
Windows Tip: Copying email messages using Outlook rules (03/11/2008)
I was messing around with my Outlook rules the other day and discovered something interesting, namely that if you don't watch what you're doing, you might end up with multiple copies of some of your emails! Here's a simple example of how this can happen: Create two rules where the first rule takes messages received from a certain recipient and moves them to Folder 1 and the second rule takes messages received that have a certain word in their subject and moves them to Folder 2. Now ask the recipient to send you a message that has that word in its subject, and when you receive the message you'll find two copies of it, one in Folder 1 and another in Folder 2! Read more.
Windows Tip: Getting RunAs Back in Vista (03/04/2008)
For the last while I've been on the Service Pack 1 beta for Windows Vista and in my opinion SP1 has fixed most of the issues the original RTM release had, especially performance issues. So I'm confident that enterprises will begin accelerating their deployment plans for Vista now that SP1 is about to be released. One thing is still missing from Vista however, and that's the capability you had in XP to right-click on a program or shortcut on your desktop or in Windows Explorer, select RunAs, and run the program with any credentials you want to specify. Instead, Vista replaced this feature with Run As Administrator, which lets you run a program as an administrator (if you know the credentials for an admin account) while logged on to your computer as a standard user. Read more.
Windows Tip: Outlook 2007 formatting (02/25/2008)
Recently, I pointed out how to retrieve misplaced email in Outlook 2007. I said that if you wanted to issue a query against all your mail items and not just the currently selected folder, you had to click the fiddly little dropdown arrow to the right of the Instant Search box and select Search All Mail Items. This is fiddly because that dropdown arrow is indeed little, and if you're mouse-challenged like I am it's a pain to to do this. Readers Matt Metz and Floris van der Zwaard independently pointed out to me that there's an easier way to search all mail items, and I appreciate their feedback. Read more.
Windows Tip: Retrieve misplaced email in Outlook 2007 (02/19/2008)
The other day I dragged an important folder into the RSS Feeds folder, one of the default folders in Outlook 2007. No problem, I'll just drag the message from there into the folder it was intended for, right? Not so simple-when you select the RSS Feeds folder in the Folder List pane, Outlook displays a page showing various RSS feeds you can subscribe to and not the messages in the folder. Yikes, how do I retrieve my misplaced message? Here's how.
Windows Tip: Enabling remote desktop using WMIC (02/12/2008)
Have you ever been in a situation where you need to use Remote Desktop Connection to connect to a remote machine but unfortunately the Remote Desktop feature hasn't been enabled on the remote machine? Well, you can enable Remote Desktop remotely using-you guessed it-WMIC. Here's how.
Windows Tip: Keep Outlook 2007 messages in outbox before sending (02/04/2008)
Here's a nifty way of keeping sent messages in your outbox for a few minutes before they are sent - It's a good way to cover yourself in the unfortunate event that you forgot to attach a file, or catch a typo.
Read more.
Windows Tip: WMIC and non-admins (01/28/2008)
More on Windows Management Instrumentation Command-line (WMIC), a powerful tool that lets you query Windows Management Instrumentation (WMI) providers directly from the command line or using batch files, and if you're an administrator then it's well worth your while exploring its capabilities.
Read more.
Windows Tip: Using WMIC for customer support (01/22/2008)
A detailed explanation of how one reader uses WMIC to support his company's customers.
Read more.
Windows Tip: Use WMIC to track down all services running on a Windows server (01/09/2008)
How can you get detailed information concerning all the services currently running on a Windows server? For security professionals, this is important as it defines the attack surface of your server, and after reviewing such a service inventory you may decide to disable unused services on your server in order to reduce its footprint.
Read more.
Windows Tip: Migrating documents to Office 2007 (01/04/2008)
Microsoft Office Migration Planning Manager, which you can get from the Microsoft Download Center, is a good place to start when you're planning an Office 2007 migration. Read more.
Windows Tip: Five tips from Santa (12/6/2007)
Troubleshoot Group Policy issues using this cool tool. Find out more about the hardware of your box than Device Manager or Msinfo32.exe can display. Print labels or do a mail merge from Excel. And so on...
Read more.
Windows Tip: System restores made easy (11/30/2007)
Restore a backup to a different hardware platform using virtualization.
Read more.
Windows Tip: Optimizing virtual machine performance (11/21/2007)
Virtualization is popular in the enterprise today, but getting the best performance from a virtualized operating system can be challenging. One issue you may not have considered has to do with the different types of virtual hard disks (VHDs) supported by Microsoft virtualization products such as Virtual PC and Virtual Server. For instance, one choice you can make is to choose between fixed-size or dynamically-expanding VHDs. Which performs best?
Read more.
Windows Tip: Configuring ALT+TAB in Vista (11/20/2007)
The behavior of ALT+TAB has changed subtly in Vista. What other changes do you like in Vista? What changes don't you like? Have you found ways of reverting such changes so that Vista behaves like previous versions of Windows? Do you think doing that is a good idea?
Read more.
Windows Tip: When no password can be best (11/13/2007)
Best and worst approaches for securing built-in Administrator accounts.
Windows Tip: Page files, system volumes, and large memory 64-bit systems (11/02/2007)
Conventional wisdom is that your page file should be 1.5 times the size of your system's RAM. But since 64-bit Windows servers often have huge amounts of memory, do you really need to allocate a whopping 48 GB of hard drive space just to your page file on a system that has 32 GB of RAM? Don't skimp on sizing your system volume.
Windows Tip: OneNote OCR (10/30/2007)
Occasionally I need to extract some text from an image, and typically you need some form of Optical Character Recognition (OCR) software to do this. Since I spend a lot of my time in the 2007 Office System family of products however, it would be nice if there was some built-in functionality that could serve this purpose. Well, it turns out that there is -- I just discovered that Microsoft OneNote 2007 includes an OCR feature called Copy Text From Picture, and you can use this method to copy text from all kinds of images including scanned documents like the kind you typically find on a site like The Smoking Gun.
Windows Tip: Fixing Group Policy Gobbledygook (10/12/2007)
A reader posed this question: "When I opened my Default Domain Policy in Group Policy Object Editor, some of the nodes under Administrative Templates were in different languages -- German, Italian, Arabic, and some stuff that didn't even display and ended up as a series of "open square" characters. Do you know how to reverse this so that the outcome will be english only?" Here's one solution.
Windows Tip: Enumerating local admin group membership (10/12/2007)
Here's one way to list any local administrator accounts on a remote machine. Read more.
Windows Tip: Running scripts using alternate credentials (10/10/2007)
On Windows XP and Windows Server 2003, you can run a program using different credentials than those of the currently logged-on user. Administrators often use this Secondary Logon feature to increase the security of their workstations by running as an ordinary domain user for most purposes such as browsing the Web and checking email. Then, when you need to open an administrative tool like dsa.msc, you either open a command prompt and use runas mmc.exe to launch the .msc file or you right-click on the .msc file itself and select Run As from the shortcut menu. But what if you want to run a VBScript script using alternate credentials? You can use the runas command from a command prompt, but unfortunately right-clicking on a .vbs file doesn't bring up a Run As option in the shortcut menu. It sure would be nice if you could add this menu option, but how? Well, where there's a script, there's a way. Read more.
Peer Tips (10/02/2007)
I appreciate hearing from readers with cool tips. Here are three recent submissions. Please note that I haven't had a chance to test any of these tools, so they are presented "as is".
Annotating web content with JumpKnowledge
Pushing out Group Policy changes across a domain
Web filter blocks unwanted sites
Windows Tip: When the Clipboard Dies (09/24/2007)
Windows Terminal Services is generally a solid platform to use in enterprise environments but occasionally during a Remote Desktop Connection session, my clipboard has gone wonky. Here's a quick work around to the problem.
Read more.
Windows Tip: Defragmenting large volumes (09/10/2007)
Defragmenting disk volumes regularly is important for ensuring optimal performance of your storage subsystem, but what if your volumes are really large? Today, it's common for even desktop systems to have volumes that are hundreds of gigabytes in size, and volumes on servers can often run into the terabyte range. And if you have a storage area network (SAN), you may be dealing with even large volumes. Can the built-in Windows defragmenter handle such large volumes? In theory, probably, but in practice, maybe not.
Read more.
Windows Tip: Rebuilding the Outlook search index (09/04/2007)
If you're using Outlook 2007, searching for a contact in the Outlook Contacts list, and coming up empty, try rebuilding the index on your machine. It worked for me. Here's how.
Windows Tip: Building a supportable enterprise, part 4 (08/28/2007)
By now you've probably learned at least one important thing about
keeping your Windows infrastructure supportable, namely: leave well
enough alone. Last time I touched on this topic, I highlighted the
dangers of trying to "harden" your network by disabling so-
called "unneeded" services. The result of doing this without a proper
understanding of what Windows services actually do can lead to broken
applications and other mysterious problems. Let's look at another
common "hardening" technique that often has more downside than upside -
- changing the Access Control Lists (ACLs) on your boot/system volume.
Read more.
Windows Tip: Beyond the run box (08/21/2007)
I like to use the keyboard as much as possible and avoid using the
mouse, but if I use my Run box for so many different purposes, my
RunMRU key fills up with too many saved entries for me to make useful
use of this feature. My main priority is for frequently-used UNC paths
to be easily accessible from the Run box, so it would be nice if there
was an alternative way for me to easily open Web site URLs by simply
typing them. Well, where there's a script, there's usually a way.
Read more.
Windows Tip: Annotating web content (08/10/2007)
It's easy to annotate a Word doc with my Tablet PC's pen with Ink, but what if I need to
annotate a Web page? For example, say there's a long Microsoft
Knowledge Base article I need to read through and annotate -- how I
can I annotate a Web page? I've been doing it the hard way until I
discovered this trick.
Read more.
Windows Tip: Building a supportable enterprise, part 3 (07/31/2007)
It's called the law of unintended consequences -- you do "A" to take
care of "B", and then "C" unexpectedly happens. In a previous tip,
I talked about "leaving well enough alone" and gave the example that
when you uninstall Outlook Express from your domain controller (Why
not? Who needs an email client on a domain controller? What could go
wrong?), an unintended consequence can occur: it breaks your CDO
interfaces on your server. While this example might seem a bit obscure
to some, there are many more such "hidden dependencies" in Windows,
and casual tweaking (in the name of "hardening") can often cause you
to run up against these dependencies.
Read more.
Windows Tip: Two Outlook migration tips (07/24/2007)
Here are two Outlook migration tips I thought readers might want to know
about. The first tip has to do with upgrading ANSI .pst files to UNICODE
files. A user we'll call Bob was running Outlook 2003, but his PST file
was originally created with Outlook 2000 (he had previously upgraded his
computer from Windows 2000 to Windows XP and had upgraded Office 2000 to
Office 2003). The problem was that Outlook 2000 only supported ANSI .pst
files, which meant when his .pst file reached 2 GB, Outlook choked
(actually it choked long before that point was reached). Outlook 2003
had introduced UNICODE format for .pst files, but Bob hadn't tried to
upgrade his PST file from ANSI to UNICODE (Bob got scared off by some
Microsoft Knowledge Base articles he read but couldn't understand on the
subject.)
Read more.
Windows Tip: More fun with Outlook 2007 (07/18/2007)
Last week I started sharing some Outlook 2007 tips based on our recent
migration to the 2007 Microsoft Office System. Judging from reader
response, this is obviously a hot topic so let's continue along this
path for awhile. One of the difficulties users often have when their
applications are upgraded is finding new ways of performing old tasks.
For example, I have a lousy memory and so I often find myself
searching mail folders for a particular keyword or subject. In Outlook
2003 this was easy -- simply right-click on a mail folder and select
Advanced Find and then enter your search parameters.
So today I tried this in Outlook 2007 and guess what -- there's no
more Advanced Find menu option when you right-click on a mail folder!
Argh! How do I search a mail folder? OK so I can select Tools, then
Instant Search, then Advanced Find, but that's a drag -- TMC (too many
clicks). I want something quicker.
Read more.
Windows Tip: Fun with Outlook 2007 (07/10/2007)
So last week we took the plunge and migrated our workstations to
Office 2007, mainly so we could take advantage of the new Outlook and
the cool ribbon bar or ribbon or whatever you want to call it. Very
nice, but after only a few days, I found myself in trouble.
I was trying to do something, and accidentally deleted the Unread
Mail folder under my Favorite Folders. This raised the question of how
to get it back. It's easy to create a new favorite by dragging a
folder from the Mail Folders pane into the Favorite Folders pane, but
unfortunately there's no Unread Mail folder in the Mail Folders pane ...
or is there?
Read more.
Windows Tip: Another classic Active Directory mistake (07/03/2007)
Say you do regularly scheduled backups of the system state on your
domain controllers, but you still feel nervous and want to make sure
you can recover your forest should your schema somehow become corrupt.
You set up an additional domain controller on a separate subnet (that
is, a separate Active Directory site) and then scheduling inter-site
replication to occur only once a week with the rest of your forest.
This idea sounds reasonable af first blush, but it's not. Here's why.
Windows Tip: Building a supportable enterprise, part 2 (06/26/2007)
IT pros are by nature people who like to "mess around" with things.
They're basically creative people who are easily bored, who enjoy
challenges, and who usually prefer to tweak than to leave well enough
alone. At least, that's me in a nutshell -- maybe I'm just a
frustrated entrepreneur. Unfortunately, tweaking can easily get you in
trouble, even when the best of intentions are involved.
Windows Tip: Building a Supportable Enterprise, part 1 (06/19/2007)
There are lots of different ways you can approach building an
enterprise Windows network. Some of these ways are supportable though
while others aren't. A supportable network is one you can administer
easily and where you can get help from Microsoft Customer Support
Services (which was formerly called and still frequently referred to
as Product Support Services or PSS). An unsupportable network however
is one that has become difficult to administer, and if it gets really
bad then CSS may tell you that your only option is to flatten and
rebuild everything from scratch. Clearly it's better to keep your
Windows-based network supportable than let it become unsupportable.
How do you do that?
Windows Tip: Shrinking XP partitions using diskpart (06/12/2007)
The version of the diskpart command included in Windows Vista allows
you to shrink partitions to free up space on your hard drive so you
can create additional partitions. Unfortunately, the version of
diskpart included in Windows XP doesn't include this functionality, so
the usual way of shrinking XP partitions is to use a third-party tool
like Symantec's Norton PartitionMagic. If you have a Windows Vista product DVD around however, you can use
Vista's version of diskpart to shrink partitions on a computer that
has Windows XP installed. To accomplish this bit of magic, do the
following.
Read more.
Windows Tip: Installing WINS on domain controllers (06/05/2007)
So what's the best way to deploy WINS servers on your network? I can't
find an "official" (i.e. documented on TechNet somewhere) statement of
best practice for deploying WINS servers, but talking with many
enterprises and also consultants who work closely with Microsoft, the
usual recommendation is to install WINS right on your domain
controllers. Here's why.
Read more.
Windows Tip: Disabling system tasks (05/29/2007)
Ever had a scheduled task on your computer that you can't disable or
configure? This can happen if an application running under the built-
in SYSTEM account creates the task, and even if you are logged on as
the local administrator you may not be able to configure the task. If
you find yourself in this situation, you can try doing the following:
Windows Tip: Clustered DHCP Servers (05/22/2007)
DHCP servers are at the heart of network client availability, and I've
seen administrators bend over backwards trying to build some sort of
high-availability solution that can kick in when their main DHCP
server fails. And believe me, seeing your average administrator try to
bend over backwards isn't a pretty sight. One company I heard about recently apparently does the following: They
have two DHCP servers configured with identical scopes, but one of the
servers (we'll call it the fallback) has its scopes deactivated. The
administrator created a netsh script that is scheduled to run
periodically on the main server and which first backs up this server's
DHCP configuration and then restores the configuration onto the
fallback server. So is this a good idea? Probably not.
Windows Tip: A classic Active Directory mistake (05/15/2007)
If you're spinning off a part of your business into a separate unit,
migrate your Active Directory, don't split it. There's a risk you
could put your AD into an unsupportable state. Here's why.
Windows Tip: VBScript and security policies (05/08/2007)
You can't prevent VBScript from running on client computers in order to comply with a corporate security policy. Instead, replace the the policy with a more reasonable one that requires all scripts to be signed and that uses Group Policy to allow only signed scripts to run on client machines.
Read more.
Windows Tip: Kill hung applications more quickly (05/01/2007)
Ever been right in the middle of working on something and your
application hangs? I get that from time to time with Outlook when I
try to rush things, especially when accessing large mail folders over
a slow connection. Here's what to do next time that happens.
Read more.
Windows Tip: Drag and drop RunAs (04/24/2007)
I'm always on the lookout for new ways of doing LUA (least-privileged user account) so I can maintain
the security of my computer while still keeping things manageable.
Today I'll share a cool tip that was forwarded to me by someone inside
Microsoft.
Read more.
Windows Tip: Forcing a remote reboot (04/17/2007)
You've probably heard that old saying, "When in doubt, reboot."
Unfortunately sometimes when you try and reboot a remote system it may
not behave as expected. Here's how to make sure a server reboots when you tell it to.
Read more.
Windows Tip: Troubleshooting Group Policy processing on terminal (04/10/2007)
Here's a tip concerning troubleshooting Group Policy application when
you have Windows terminal servers on the back end of your Windows
clients. User Configuration policy settings will usually be applied
when a user logs on to a terminal server, with one main exception:
when the terminal server is configured to use loopback processing with
replace mode.
Read more.
Windows Tip: Using FR and RUP in mixed environments (03/27/2007)
Folder redirection (FR) and roaming user profiles (RUP) are two
separate but complementary methods for enabling users to roam between
different computers on your network and access their desktop
environments together with their personal data and settings. Here's a
tip that provides recommendations on how to implement FR and/or RUP in
mixed Vista/XP environments.
Read more.
Windows Tip: Determine bandwidth using WMI script (03/20/2007)
Did you know that you can use WMI to measure your machine's network
bandwidth using a script? To use this script, copy the text provided
in this article into Notepad (with Word Wrap turned off) and save it
as ReportBandwidth.vbs. To run this script on a Windows Vista machine,
open an elevated command prompt and type cscript
reportbandwidth.vbs /? to view a list of different arguments you can
use with this script. Here's the script, minus some comments at the
beginning.
Read more.
Windows Tip: Managing Windows Firewall in mixed environments (03/13/2007)
If you migrate all the desktops in a given organizational unit to
Windows Vista, you can simply manage the firewall on these computers
using the new Group Policy node found under Computer
Configuration\Windows Settings\Security Settings\Windows Firewall With
Advanced Security. But what if your OU will contain a combination of
Windows XP and Windows Vista computers? What's the best way to use
Group Policy to manage the Windows Firewall on these computers? Here's
a brief answer taken with permission from the soon-to-be-released
Windows Vista Resource Kit.
Read more.
Windows Tip: Enabling weak crypto in Vista (03/06/2007)
If you're planning on deploying Windows Vista on mobile computers that
remotely access your company network using a virtual private network
(VPN) connection, you must be aware that support for weak or non-
standard cryptographic algorithms has now been removed from Windows
Vista. This can result in compatibility issues with certain VPN
servers and the result is that some clients may not be able to connect
to your corporate network after upgrading them to Windows Vista.
Here's an explanation from the Windows Vista Resource Kit concerning
why this change was implemented, plus a workaround you can use if you
can't upgrade your VPN servers or don't have access to high-crypto for
regulatory reasons.
Read more.
Windows Tip: Two Vista tips and a story (02/23/2007)
This resource reviews which applications from third-party vendors have
been certified by the Windows Logo Program as working with Windows
Vista. What's really interesting is not which vendors' apps are on the
list but which vendors aren't listed.
Read more.
Windows Tip: Windows Vista and GPT disks (02/20/2007)
Windows Vista supports two types of disk partitioning: Master Boot
Record (MBR) and Globally Unique Identifier Partition Table (GPT). GPT
disks offer several advantages over MBR disks including more
partitions (128 instead of 4) and larger partition sizes
(theoretically up to 18 exabytes or about 18 million terabytes). But
before you run out and get a zillion terabyte drive for your Vista
workstation so you can store all your YouTube videos, you need to know
the following.
Read more.
Windows Tip: Troubleshooting a USB flash drive (02/13/2007)
Don't through away that USB Flash drive too quickly. If the drive
fails after connecting to the network, it could be an issue with the
network.
Read more.
Windows Tip: Restoring individual files from a CompletePC Backup (2/6/2007)
Windows Vista has a new backup feature called CompletePC Backup that
backs up everything on your computer in one easy step. And you can
back up everything either to another hard drive such as a removable
USB drive or DVD. Then later if you need to restore your computer due
to instability or corruption, you can boot from your Windows Vista
product DVD while holding down F8 to start the Windows Recovery
Environment, select the Windows CompletePC Backup option when it is
displayed, and follow the prompts to restore your system from your
previous backup to your external drive or DVD.
Read more.
Windows Tip: Daylight savings time fix (1/30/2007)
There are several ways for companies still running legacy Windows
platforms to address the impact of these Daylight Savings Time changes
on their products.
Read more.
Windows Tip: Preventing removal from a domain (01/22/2007)
By default, any authenticated users on an Active Directory-based
network can add a Windows XP workstation to a domain. In fact, they
can create up to ten computer accounts in the domain if they want to.
As an administrator, you can use Group Policy to manage who in your
organization has the right to join workstations to the domain by
configuring the Add Workstations To Domain policy setting, which is
found under Computer Configuration/Windows Settings/Security
Settings/Local Policies/User Rights Assignments. To configure this
setting, open the Default Domain Controllers Policy in Group Policy
Object Editor, double-click on the policy setting, remove
Authenticated Users and add only those specific users or groups whom
you want to be able to perform this action.
Read more.
Windows Tip: Troubleshooting group policy in Windows Vista (01/16/2007)
Group Policy is a key technology for managing computers on Windows-
based networks where Active Directory is deployed. But Group Policy
has been considerably enhanced in Windows Vista, and also in the soon-
to-come Windows Server Code-Name "Longhorn." And of course, changes
mean more learning for those who are going to administer these
platforms, so this tip deals with one of these changes, namely how to
troubleshooting Group Policy processing in Windows Vista.
Read more.
Windows Tip: VPN and domain authentication (01/02/2007)
If your enterprise has multiple small offices but only one domain
controller at each office, how will users at one of your sites log on
if their domain controller goes down? One common approach is to have
users make a VPN connection to one of the other offices using PPPoE
over DSL and authenticate with the domain controller there. Read more.
Windows Tip: Backup in Windows Vista (12/25/2006)
A lot of people have been asking lately why the new Backup and Restore
Center in Windows Vista can't back up files to tape drives the way the
Backup Utility (ntbackup.exe) can in Windows XP and Windows Server
2003. Yes it's true -- the Backup and Restore Center in Windows Vista
lets you back up to hard drives (including removable drives), DVD
media, even to shared folders on network file servers, but not to
tape. Why? Read more.
Windows Tip: Listen to your users, multi-select files in Explorer (12/11/2006)
I was manning the Ask The Experts booth at a 2007 Microsoft Launch
event the other day when I heard an interesting story from another
Microsoft MVP. He told me that his wife was really excited about a new
feature in Windows Vista that made it a lot easier for her to work on
her computer. So I asked what the new feature was, thinking BitLocker? Complete PC Backup? New Group Policy settings for Power Management? Delta sync for Offline Files? Outbound firewall filtering? Dual layer IPv4/v6 networking stack? I held my breath and waited for his reply. Read more.
Windows Tip: Do you LUA? (11/27/2006)
I've been running with a least-privileged user account (LUA) on my main
Windows XP workstation now for over a year. In other words, the user
account I use for checking email, browsing the web, writing reports and
so on is an ordinary domain user account and is not a member of the
local Administrators group on my computer. Why do I do this? Because
running with an admin account results in a lot more damage when your
machine gets compromised by some malware. Read more.
Windows Tip: Robocopy just got better (11/21/2006)
If you're an IT pro you probably have a few favorite tools that you
always rely on. One of my favorites is Robocopy, which has been around
at least since the Windows NT 4.0 Resource Kit and probably earlier
(except my brain is too shot right now to remember -- occupational
hazard of being in IT). Read more.
Windows Tip: Are cached credentials secure? (11/13/2006)
A reader recently contacted me concerning a previous tip
Troubleshooting Cached Logons where I shared a script that could be
used to query your event logs to determine whether your machine is
currently logged on using cached credentials. When you try to log onto
your domain and your Windows XP computer can't contact a domain
controller, your computer uses cached credentials to authenticate.
These credentials are cached locally on your machine from a previous
successful domain authentication, and are designed to enable you to
log onto domain members when domain controllers are unavailable.
The reader told me that he heard from "some security experts" that
storing domain credentials locally on client machines like this poses
a security vulnerability since anyone who can gain access to your
computer can run a password cracker against these stored credentials
and extract your domain username and password from them. But how
serious a vulnerability is this? To find the answer, I cracked open
one of my all-time favorite books, Protect Your Windows Network: From
Perimeter To Data by Jesper M. Johansson and Steve Riley. Read more.
Windows Tip: Outlook merge mail vs. DLs (11/06/2006)
Ever needed to send an email out to a lot of contacts in your
organization or customer base in a hurry? Here's a tip that may help
if your mail client is Outlook 2003. Read more.
Windows Tip: Managing local users and groups (10/23/2006)
Is being able to manage local users and groups using scripts useful to enterprise administrators? Here's what Ed Wilson, author of Microsoft VBScript Step by Step, and the Microsoft Windows Scripting with WMI: Self-Paced Learning Guide has to say on the topic. Read more.
Windows Tip: IPsec and Windows Vista (10/16/2006)
The biggest improvement with IPsec in Vista is that it's now easy to
work with! Think about trying to use IPsec to secure traffic between
your client computers and domain controllers. Have you ever tried that
with an existing Windows network? It takes dozens (more likely
hundreds) of IPsec filters and rules just to make it work -- if you
can ever get it working. Domain and server isolation are great in
theory but they're still difficult to implement and maintain on
today's Windows networks. Read more.
Windows Tip: Smart cards and duct tape (10/09/2006)
Although troubleshooting system and network problems are usually work,
not fun, I had a good laugh at myself recently over one situation that
initially left me stumped. To gain remote access to a secure corporate network, I had to install
a smart card reader on a machine so I could authenticate using the
smart card the company issued me. The smart card reader was a USB
type, and when I plugged it into the system Windows XP recognized the
reader and installed drivers for it. Unfortunately the smart card
reader I obtained didn't include a stand accessory, so rather than
having it sitting on the desk I decided to use duct tape to fix the
reader to the side of the PC beneath the desk. After all, Canadians
like myself can use duct tape for almost anything, eh? Read more.
Windows Tip: Locking a desktop at logon (10/02/2006)
Unfortunately you can't configure Windows autologon to log on into a locked state, but a short script may provide a workaround for this situation. Simply open Notepad and copy and paste the following lines into it.
Read more.
Windows Tip: File sharing in Windows Vista (09/25/2006)
One of the biggest gripes over the years about file sharing on
Microsoft Windows platforms is that users can see files and folders on
a network share even if they don't have permission to open those
folders or read the files. The good news is that with Service Pack 1 for Windows Server 2003, a
new feature called Access-Based Enumeration (ABE) has been added to
how file sharing works on Windows platforms.
Read more.
Windows Tip: Resolving IP address conflicts (09/18/2006)
A basic but often hard to troubleshoot issue that can arise on a
TCP/IP network is an IP address conflict. This occurs when two
computers on a network are assigned the same IP address, and this
situation can arise in three different ways. First, you might
misconfigure your network by manually assigning two computers the same
static IP address. Second, a DHCP server on your network might assign an address to a client
computer that conflicts with a static IP address assigned to some
other network device such as a router or printer. And third, if you
have two DHCP servers on the same subnet that have overlapping scopes,
you're likely to get client computers with duplicate addresses. Read more.
Windows Tip: Remotely changing the default script host (09/11/2006)
If you're an enterprise admin who has started developing your logon scripts using VBScript (.vbs files) instead of the old batch language (.bat files) you must pay attention to which default script host is configured on your users' computers. Read more.
Windows Tip: Scripting multiple Outlook windows (08/28/2006)
One complaint I used to have about Outlook 2003 was that I could only
open one copy of the program at a time. This frustrated me
because I could manage my email more efficiently if I could have
multiple Outlook windows open. Here's a little script to help.
Read more.
Windows Tip: Disk quotas and the recycle bin (08/21/2006)
Here's a common scenario: A user has 25 MB of files on a quota-enabled
volume, tries to free up space by deleting 5 MB of old files, checks
the volume in My Computer and it still shows 25 MB of files, and calls
Support to complain that something doesn't work. The problem? When the
user deleted his files, they were simply moved to the Recycle Bin on
the quota-enabled volume. The solution: educate users to either empty
their Recycle Bin, hard-delete files using SHIFT+DELETE, or run Disk
Cleanup.
Read more.
Windows Tip: Launching a low priority process (08/14/2006)
A friend of mine who is a petroleum engineer recently told me about a problem he was having. He was launching a series of batch jobs (big simulation jobs) on his Windows XP workstation from the command line by running a batch file that contained a series of commands like job5.exe -i input.dat, and his problem was that these jobs were hogging so much of his machine's processing power that foreground tasks became unresponsive. Once these processes were running however, he could open Task Manager and change their priority to Low, and then he could work normally on the machine while the jobs ran in the background. He was wondering if there was a way to start an application with Low priority instead of Normal.
Read more.
Windows Tip: Protecting your default policies (08/07/2006)
Always leaving yourself an out is good advice when it comes to playing poker, and it's a good idea when it comes to managing Windows networks too. Group Policy is one place where it's easy to back yourself into a corner. There are literally thousands of policy settings you can configure, and if you accidentally configure the wrong setting in your Default Domain Policy, you might end up with hundreds of phone calls to your support desk asking for help. That's because any change you make to your Default Domain Policy automatically affects every user on your Windows network.
Read more.
Windows Tip: Using remote assistance in the enterprise (07/31/2006)
Have you ever been asked a computer question from a friend or family member who is located miles away? Wouldn't it be great if you could see what they were trying to describe to you and show them how to fix the problem remotely? Remote Assistance, a feature of Windows XP, is a great idea for troubleshooting issues that are hard to explain or which require a complicated series of steps to fix. Remote Assistance can be used to help users with simple problems like "How do I format this document?" and also more complicated ones like "I need to download and install a new driver and synchronize with my new handheld device, what do I do?"
Read more.
Windows Tip: Know your IPv6 address types (07/24/2006)
Is your enterprise planning or in the process of migrating your IPv4
network to IPv6? Did you know Windows Vista comes with IPv6 enabled
out-of-the-box? And were you aware that some Vista applications like
Windows Meeting Space use only IPv6 and not IPv4?
Read more.
Windows Tip: Keep an eye on solid state disk technology (07/17/2006)
IT departments have always known that the hard drive is the main performance bottleneck, and that's why the development of solid state disk technology (SSD) is exciting as it will push performance up significantly. Therefore, I suggest keeping your eyes on SSD technology as it makes inroads into the notebook, desktop, and eventually server arena. Read more.
Windows Tip: Three resources for regulatory sompliance (07/10/2006)
Ensuring your company's IT infrastructure is compliant is no easy job. For one thing, you must first be aware of the laws and regulations that apply to your industry. Next you must be aware of how these laws impact IT operations. And finally, you must develop a set of internal procedures and controls to ensure your enterprise complies with these laws and regulations and can stand the test of an external audit or even worse, a lawsuit. Here are three resources to check out. Read more.
Windows Tip: Revisiting group policy refresh (07/03/2006)
In a recent tip here in Windows in the Enterprise, I mentioned that administrators could remotely refresh Group Policy on desktop computers using a free tool from Sysinternals called psexec and that this can save them the labor of touching (visiting) desktops when Group Policy refresh needs to be forced for some reason. Several readers of this newsletter commented afterward that there are other tools that can be used to do this, and this week I'd like to thank these readers for their feedback and highlight their suggestions.Read more.
Windows Tip: Troubleshooting cached logons (06/26/2006)
How can you determine whether you've either successfully logged onto a domain or are merely logged onto your own computer using cached domain credentials? One way to do this is to use Event Viewer to check your System log for an occurrence of event 5719 around the time when you last tried to log on to the domain. An even easier way to do this is to use the following script I wrote to query the System log on my machine for the most recent occurrence of event 5719. Read more.
Windows Tip: Remotely forcing group policy refresh (06/16/2006)
One of the cardinal principles of managing enterprise networks is
avoiding having to touch desktop computers unless you really must. Of
course, by "touching" a desktop what I mean is having to walk over to
where that machine is located and log on interactively to perform some
administrative task. Read more.
Windows Tip: Old apps never die (06/12/2006)
In a previous tip titled Virtual Bliss, I extolled the virtues of
virtualization as a means of enabling you to test buggy prerelease
(beta) software in a safe environment without the need of dedicating
to use or possibly corrupting any of your production machines. But
virtualization is more than just a tool for testing software -- you
can actually run production software right within the guest operating
system running in a virtual machine on a box with Virtual Server or
Virtual PC installed. Why would you want to do that? To keep your
legacy apps running properly! Read more.
Windows Tip: Encourage users to behave themselves (06/02/2006)
Life would truly be easy for administrators if there were no users. And
if only your users would behave themselves and actually follow the
written policies you've laid out for them. We're talking network
nirvana here -- is such a state achievable? Yes it can be, if your
policies are effective. What makes a policy effective? Two things
really: enforcement and encouragement. Read more.
Windows Tip: Looking for help? Think global, but look local (05/18/2006)
I've been impressed over the last year or so by how much time and
energy Microsoft has committed to building up a thriving user group
community around the globe. If you're looking for an IT pro user group
in your area, a good place to start is Culminis, a not-for-profit,
member-owned association sponsored by Microsoft that has almost a
million user group members under its umbrella. Read more.
Windows Tip: Virtual bliss (05/15/2006)
I'm on the beta program for Windows Vista, and the other day I wanted to download and read through the Vista Product Guide, a pre-release guide to the features of Vista and how they benefit home and business users. This posed a bit of a problem however, because the Product Guide is in Microsoft's new XPS (XML Paper Specification) document format, which is designed to compete with Adobe's popular PDF format. Read more.
Windows Tip: Business-driven deployments (05/04/2006)
Deployments of new platforms and products should always be business-
driven, not technology-driven. If your enterprise has a business need
that can be realized by deploying a new version of Windows or Office,
then do it. But how do you identify possible areas of business need?
Vendors generally present you with a list of exciting new features for
new versions of their products -- how do you match these features to
the needs of your business? A good place to start is usually with your mobile workforce. Read more.
Windows Tip: Vista pro and con (05/01/2006)
Windows Vista is edging forward towards completion, and the big question facing enterprises is whether to deploy or wait once RTM arrives. I've been thinking about this a lot, and there are things I really like about Vista and things that still leave me concerned.
Read more.
Windows Tip: Laziness as a virtue (04/24/2006)
What would you do if you were a business owner and you walked into your sysadmin's office and saw him with his feet up on his desk reading a magazine? Fire him? Or offer him a raise? Laziness is defined as a disinclination to work or exert effort, and it's generally viewed as a negative character trait. But what appears on the surface to be laziness may actually be a sign of an energetic, vigorous personality who prefers to work hard and do what's needed and then later take a much-deserved break.
Read more.
Windows Tip: Romance compliance auditors with security templates (04/17/2006)
Are you prepared for an audit? Complying with SOX means enterprises need
external auditors to sign off on their financial controls, and large
companies have been getting socked in the wallet in their efforts to
comply. But SOX and similar legislation also means that IT staff need to
be ready at any time for having their own internal controls audited, and
that adds a lot of pressure to an already stressful job. There are lots of recommendations out there for how to get your IT
infrastructure ready for those pesky auditors, but here's one you may
not have heard before: use security templates.
Read more.
Windows Tip: Desktop refresh cycles return to front burner (04/10/2006)
I've heard from several quarters that desktop refresh cycles are
returning to the front burner for many enterprises
after being placed on hold during the recent economic downturn. Whether
you're organization is contemplating a three- or four-year refresh cycle
or a rolling replacement of a certain percentage of desktop computers
each year, there's one thing you need to remember if you want to make
the most of your IT hardware investment: buy only x64-capable machines
from now on.
Read more.