joeware - never stop exploring...

Information about joeware mixed with wild and crazy opinions...

6/17/2013

Please Vote!!!

by @ 1:17 pm. Filed under general

I have a personal request of everyone that reads this blog or knows someone who reads this blog or if you even just have a computer! My girlfriend Tracy Stefanides has been nominated for a customer service award called the ROSE award here in the Detroit Metro area. She is really good at what she does and really deserves this recognition. If you could go to this link

http://theroseawards.com/component/events/?view=vote&layout=listing&cid%5B0%5D=13&action=list_nominees&categories_id=4&category_name=Restaurants

and vote for her  that would be great! If you can, vote from multiple devices and/or browsers. :)

Please vote by June 22nd!

 

    thanks, joe

Rating 4.33 out of 5

6/9/2013

Utility Downloads Working Again

by @ 9:57 pm. Filed under general

I want to apologize to anyone who tried to download any utilities the last few days and were unable to.

I finally have the download CGI script working properly. The script has worked solid since 2010 for literally tens of thousands of downloads and suddenly, with no edits to it, no change in the time stamp, no change in permissions, no nothing, stops working. The hosting provider POWWEB (powweb.com) dragged their feet "troubleshooting" for a couple of days and finally came back to me and said everything is fine and the script is broke. They couldn’t explain to me why a script that has worked flawlessly for three years should suddenly break when no one has touched it.

So I spent 15 minutes and debugged the script line by line (yes the old print "I am here – 1!… print "I am here – 2!" game)  and found that the redirect line at the very end was failing and causing the web daemon to throw a 500 Internal Server error. When I pulled the line out all by itself in its own CGI script it failed again with the same error.

The redirect lines outputs a pair of lines, a line with a 302 status message and a line that specifies the new location for the file which forces the redirect. Removing the status line completely caused the script to start working properly again.

<rant>

So once again I have been reminded of how bad the POWWEB support team is and when I have an issue just try to sort it out myself. <sarcasm> Go team. </sarcasm>

If you are going to tell me that my issue is a script problem, I am not sure why it takes two days to get to that point – how fast can you test the web daemon and CGI module to validate that your server is functioning properly? And I say that as a high level escalation engineer for a very large IT service company, not as someone without a clue. I, someone who doesn’t deal with web scripts but once in a while, sorts out the issue in 15 minutes that the "professionals" couldn’t sort out in 2 days?

</rant>

So anyway, once again you can download utilities, my deepest apologies for the delay.

 

    joe

Rating 4.33 out of 5

6/7/2013

Website Issues

by @ 2:13 pm. Filed under general

Folks trying to download joeware utilities may be encountering issues right now. I am working with the Hosting Provider to get it fixed.

 

  joe

Rating 3.00 out of 5

5/28/2013

Role Based Access Control Products for Active Directory

by @ 9:33 pm. Filed under tech

This is an open call out to the AD Community asking for folks to comment (or email me) with a list of the Role Based Access Control Products that they are aware of. Specifically tools that do NOT use native AD ACLing but instead perform all access via proxy like can be done with Quest Active Roles Server.

 

      joe

Rating 4.33 out of 5

5/16/2013

Everything you need to get started with Active Directory

by @ 2:45 pm. Filed under tech

I saw this link on my friend Bob’s blog (http://www.bobbobel.com/the-everything-active-directory-page) today…

Everything you need to get started with Active Directory

http://blogs.technet.com/b/ashleymcglone/archive/2012/01/03/everything-you-need-to-get-started-with-active-directory.aspx

 

I see a glaring omission but I will let it slide. ;)

 

   joe

Rating 4.00 out of 5

5/13/2013

Virtual DC Poll Results

by @ 10:29 pm. Filed under tech

Once again, apologies for the slow turnaround time on this. It was a combination of being really busy with my real job along with the poor questions I asked and the way the poll plugin worked. I had to work out how to extract the raw data from the MySQL DB to make some real sense out of it. Also as mentioned, I am pretty sure we had some ballot box stuffing going on so I did some filter based on IP addresses. I am looking around for some better polling software. I likely will have to use something outside of WordPress based on what I have seen so far but hope to put together a better poll that is well suited to multi-question polling.

So this is NOT a scientific poll. I need better software, better questions, and a bigger sample set as well as a method to guarantee unique responses to get something I would call scientific. However it is still very interesting and enlightening, at least to me.

Overall I was pretty surprised to see the penetration of the virtual DCs in production environments. This is not even close to what I have been experiencing out in the field with the hundreds of customers I work with. 

 

So we start off with Lab environments. Good to see so many lab environments, it seems to be the first thing cut in many orgs when they don’t want to spend money thereby turning their production environment into their lab. I shouldn’t have to point out that that can be a bit dangerous. I was surprised there was a response of "No, we don’t need one."; I put that response in as sort of a trick response. The "No, we have a lab domain in the production forest" also kind of surprised me. That being said, I regularly see environments that have no lab environment. It sucks and I usually find out after something has hurt their production environment and I ask how the testing went in the lab and I am fed all sorts of excuses of why they don’t have one and why they don’t need one in the face of an actual outage that would have been exposed had it been tested in a lab environment.

image

 

 

 

Next up, RODCs. RODCs don’t seem very popular. This aligns with what I generally see out in the world. A lot of folks start with plans for RODCs but then run into the implementation details and decide they don’t want to do it or, for some reason, usually apps, can’t do it.

image

 

 

Of the folks using RODCs, a lot of them are being virtualized. I am absolutely behind that. In fact I have long thought Server Core Virtual RODCs was a really good branch office design.

image

 

 

This is the breakdown of the size of environments of folks that responded. Again I was surprised, this time I was surprised by the number of responses for folks with what I generally consider smaller environments. I am really glad to see it though because it isn’t just the customers with 100,000 users that need to use efficient command line methods to effectively support their environment with minimal costs.

image

 

 

For environments under 25,000 users, virtualization is very heavy in the poll. If you are in this space I could see how people think "everyone" is virtualizing. I just recommend that you really follow the guidelines from MSFT. In smaller environments that I have run into outside of work that have virtualized DCs they usually aren’t following one or more of the guidelines, usually completely or nearly completely compromising their redundancy.

image

 

image

 

 

And for the biggest surprise for me was the 25,000 or more users space. This is completely outside of what I see in my real work. It hasn’t penetrated as much as it has in the smaller environments but still, there is a lot of it out there.

 

image

 

image

Rating 4.33 out of 5

5/10/2013

The Cloud…

by @ 8:08 pm. Filed under quotes

Rating 4.60 out of 5

5/8/2013

Correction on USENET AD Group Posting from March 2007…

by @ 6:58 pm. Filed under tech

I responded to a USENET AD Group post back in March 2007 and unfortunately someone pinged me on it and said the command line I specified didn’t work. I looked at it and immediately saw that I had made a mistake.

The post can be found here: http://help.lockergnome.com/windows2/enforce-password-required–ftopict483580.html

The AdFind query is supposed to find all user objects that are set such that the password is not required. The query I wrote won’t find anything like that unless you happen to have a user with a sAMAccountName of 805306368 and it has the flag set. Highly unlikely I expect… ;)

 

This is the incorrect command string:

adfind -gcb -bit -f "&(samaccountname=805306368)(useraccountcontrol:AND:=32)" useraccountcontrol -adcsv | admod useraccountcontrol::{{.:CLR:32}} -unsafe

 

The is what the command string should have been

adfind -gcb -bit -f "&(samaccounttype=805306368)(useraccountcontrol:AND:=32)" useraccountcontrol -adcsv | admod useraccountcontrol::{{.:CLR:32}} -unsafe

Rating 3.00 out of 5

5/2/2013

Best Practices for Securing Active Directory – Published April 26, 2013

by @ 12:57 pm. Filed under tech

http://www.microsoft.com/en-us/download/details.aspx?id=38785

(I am only a little miffed I wasn’t invited to review this… thanks Laura…)

Protecting Domain Controllers

Domain controllers should be treated as critical infrastructure components, secured more stringently and configured more rigidly than file, print, and application servers. Domain controllers should not run any software that is not required for the domain controller to function or doesn’t protect the domain controller against attacks. Domain controllers should not be permitted to access the Internet, and security settings should be configured and enforced by Group Policy Objects (GPOs). Detailed recommendations for the secure installation, configuration, and management of domain controllers are provided in the Securing Domain Controllers Against Attack section of this document.

Rating 3.00 out of 5

4/26/2013

Where the <bleep> is the virtual DC Poll info?

by @ 6:01 pm. Filed under tech

I am working on it. I learned a things with that poll…

1. That software wasn’t designed to host a poll with multiple questions

2. I need to write better questions, some people seemed confused with the answers they gave.

3. Some people like to stuff the ballot box (didn’t think I would look at the IP addresses did ya!)

 

Very quickly though, I was overwhelming wrong in the 25,000 users or less space[1] about how much virtualization of DCs is going on. Most (~93%) of that space, according to the folks (or person) who voted, is using virtual DCs in some way shape or form. I am still processing the numbers for >25000 users. I hope they are all following the guidelines… :)

There were four responses that they didn’t have money for a lab yet in every one they were all using virtual DCs (at least one said all of their DCs were virtual) so I don’t quite understand that.

RODCs do not seem to be all that popular with the respondents. Of the responses, only 25% had at least one RODC. Though I find that number even a bit surprising based on what I have seen and heard about professionally and through joeware assistance.

Anyway, I hope to have some nice pretty graphs up here in the next week or so. The real job has been challenging lately with masses of FRS/SYSVOL issues and a real PITA ADI DNS[2] issue. All I can say is that so many people are running around thinking AD is a commodity and there is nothing to running it and then they hit an issue and I get called in and start looking and have to show them just how poorly things have been done and that contrary to popular belief, AD doesn’t just run itself….. forever anyway.

    joe

 

 

[1] That accounted for about ~60% of the overall respondents. I was a little surprised by that as well. I am glad that my utilities and blog are useful to more than just the largish enterprise customers. Actually ~8% of the respondents were from orgs with less than 500 users, that really shocked me.

[2] Anyone that has spoken with me knows I much prefer DNS outside of AD. If they set it up to run on ADAM/ADLDS I would probably be ok with that though I would still prefer BIND based DNS. If anyone from a MSFT DNS team is reading this… How long ago did I ask for VIEW functionality? How long? Seriously.

Rating 4.00 out of 5

[joeware – never stop exploring… is proudly powered by WordPress.]