joeware - never stop exploring... :)

Information about joeware mixed with wild and crazy opinions...

5/26/2007

It’s very green today…

by @ 12:14 pm. Filed under general

Today is a very green day. Not like the band you numpty, but like the color. Though come to think of it, some Green Day music turned way down would be nice…

Err, back to point… I am sitting upstairs in my palatial mansion (LOL – if 1800 sq ft is palatial) sitting at my laptop which is sitting on a table I keep here in my master bedroom in front of two really big windows looking out over my back yard. It is a nice back yard, I only have about 3/4 acre of property (32670 sq ft) but it is my 3/4 acre[1], well a big nod to the bank there too… but the bank rarely comes over and mows so I will call it my property for the time being…

Err again back to point… I have some nice big green trees in the back yard and I tend to keep the grass on the longer rather than the shorter side. You walk in it, you know you are walking on grass versus say, Astroturf or that cheap looking green patio carpeting. So that means the grass is very green too.

We also have sort of a gray and rainy out as well so that just enhances the general greenness and means I will likely be mowing again in two days because this is the kind of weather that the grass really likes to grow in.

I am basking in this greenness, I really like the color green. No clue why, don’t care why, I just like it. I also like blue a lot, the darker the better. I am also a fan of the various purples and combinations of all three of those colors.

I am also basking in the sounds of the rain falling and birds chirping and my keyboard keys clicking and the occasional vocalization from Trouble the black cat from the suburbs of Hell (about 13.4 miles from downtown Hell she assures me).

I am relaxing today because the last few days of this week at work were trying. Trying, I think, to make me go insane or burst a blood vessel. I was having fun in that I was learning stuff I didn’t know technically, but there were some things that MSFT did in some implementations that were just pissing me off to no end which I may write about later when I am more sedate and have less emotional attachment to the stupidity.

Also, there was a ton of pain being experienced due to management morons. Briefly one or more managers made stupid decisions last December which I and others told them was stupid then and every month we had the opportunity since. The problems that I and others forecast were all coming true and things were getting worse and worse. Management chose to ignore the problems until this week where things escalated into VP levels, etc and then all of a sudden it was all hands on deck oh my god we have to fix this with managers on con calls everywhere discussing how critical it all was but no one mentioning how the techies said months ago we were on a stupid path.

Of course, had we done things properly in the first place (as defined by what I and others said we should have done in the first place), this wouldn’t have become an issue ever let alone a 5 alarm fire issue. To be honest, it really wasn’t my issue and I very likely could have said and gotten away with… “Go away, you made your bed, now try to sleep on the spikes”. But that isn’t me, unfortunately. So this last week had me writing lots of scripts and figuring out various command line tools to make sure we fixed things properly instead of writing up documentation to hand over to a bunch of button pushers who could then inconsistently do the work so we had other issues to deal with. This resulted in little sleep and lots of time working. The fire is still going on but I gave thrown enough water in the air that it should be able to be controllable by the others involved now.

On the one side it was pretty fun, I am an adrenaline junky at heart and enjoy trying to pull off miracles to see how far I can push myself and still deliver.  Also my mind comes up with interesting solutions to problems in cases like that, stuff I may not have come up with previously under normal circumstances. It felt very much like I was back in the fire doing operations (prior to the last operations job that was done properly because I got to help define what we did) because honestly, it was an operational fire drill based on management stupidity. Not my closest direct report to management, but other higher up management.

Unfortunately, I don’t get nothing near to what I got paid when I really did operations support which means I really shouldn’t be doing anything involved with OPs that I don’t like. You don’t want to hire me for an ops guy unless you are very serious about ops and you have the money to spend on it. Ops is hard to do right and I won’t do it wrong which means you need to pay me. šŸ™‚ There are much easier ways to make the money (at least for me) that most people make doing ops so it makes no sense for me to do ops – unless I am paid properly.

So the good side was the adrenaline and fun. The bad side was the same issue that tended to occur to me when I did ops… I become single focused, everything else in life stops… I wake up at 6:45AM on a Friday (after going to bed at 3-3:30AM) and I sit down at my laptop and besides grabbing occasional peanut M&Ms and sips of Coca Cola sprinkled with restroom visits I don’t really stop until after 10PM and then I pass out. The house could collapse around me at any point in that cycle and I likely wouldn’t notice it. I don’t spend time looking out the window, I don’t spend time appreciating the singing of the birds, I don’t even get to appreciate my cat whapping at my leg because if she is, I don’t notice it. If someone asked me to summarize everything I did yesterday including phone/con calls, emails, and other stuff I couldn’t even begin. I just know this morning that just one of the scripts I put together quickly in the afternoon yesterday is just under 500 lines of code because it was sitting on my desktop when I sat down at my laptop. That is one of several scripts I put together and doesn’t include any of the testing and working out of other things which were simply me indicating how to get a command line tool to do something for us versus having to write a script. Hmm I just looked at email, I sent something like 53 emails as well. And many aren’t short, they are detailed technical brain dumps with opinion about where we are and how we got there and where we need to go sprinkled generously throughout and I wasn’t being gentle… LOL.

Yep, I am now missing 2-3 days but at least today is nice and green. šŸ™‚

   joe

 

[1] I have a leads on 13 acres (566280 sq ft) and 21 acres (914760 sq ft) nearby that I need to dig into though…

Rating 3.00 out of 5

5/20/2007

Argh, Perl let me down… Well at least one of the Win32 modules did…

by @ 5:33 pm. Filed under tech

I love perl, absolutely adore it. I love how I can take one small exe and one small DLL and take it anywhere and get just buttloads of functionality out of the core language. Well I needed a script to tear through and document ACLs on a file system. Now I didn’t expect the core perl functionality to handle this but figured one of the modules that come with it would do the trick… sure enough, it looks like Win32::FileSecurity will do what I need. Simple example…

Aww crap, it can’t get the Security Descriptor on a file that is opened by someone else… WTF… Not only that but the module blows you right out of the script, no chance of capturing the error… I look closer at the docs and sure enough down in Known Issues / Bugs – “Errors croak, don’t return via $! as documented.”. WTF people. If you write a module you should NEVER die or croak from out of that module… Return to the script and let it decide what it wants to do. What could have and should have been a nice simple task is now going to be a bit of a pain.

So I look at CACLS and XCACLS and seriously, they are pretty poor especially if you are trying to parse the info in a script. This means I am now stripping the Security Descriptor code out of AdFind so it can be standalone and added the one line needed to get the SD from a file/directory instead of from AD. Then add a couple of printf’s[1] to write the output the way I would like it for scripting…  

I have had this on the list of things to write for a long time, so good to be getting it done now. I am trying to make it as flexible as possible so I can use it for any ACL type, not just files/folders. Far handier that way.

   joe

 

[1] Well not really but that is the basic idea, I am actually using ConOut’s and ConOutNL’s but those are my special output functions.

Rating 3.00 out of 5

Good Movie: Man of the Year

by @ 2:04 am. Filed under general

I watched Man of the Year this evening, good movie, I laughed, I thought it made a lot of good political and state of the country points. Had to chuckle when Jeff Goldblum found out Eleanor didn’t lose her access to the systems when she was fired and commented something like, “Wasn’t that a bad idea?”. I have to say, that is more of a real situation than many people who don’t deal with that kind of stuff would like to think it is. 

I also found the fact that the company was willing to bury the problem and set Eleanor up to be the fall guy and then try to kill her to be believable. Some of the stuff I have seen in big business has leaned in that direction of badness, just not quite to that extreme but then, I have never been around the stuff that could embarrass a company out of existence. I have had more than one occurrence that occurred to me though of someone making up things about me or stuff I had done to try and get me and my judgement and character called into question. Both by big companies and small wannabe’s. Hasn’t worked in any case, its tough to bust someone and “turn them out” when they are already willing and in the process of telling the truth. If I screw up, I am one of the first to call attention to it. How can you trust me otherwise?

In general, I think Douglas Adams got it right… the President is the person who distracts you while the real people running the “universe” do so undisturbed. Certainly if Bush were truly running things, I think we would be much worse off (don’t get me wrong, I think there is a lot of screwed up stuff but it could be worse). I wouldn’t trust him to find his way from my house to my mom’s house (about 200 miles away) if he had a map and a GPS.

 

Lots of great one liners in the movie that will make you laugh out loud, here are just a few:

I did inhale because I thought ‘What the hell, it’s lit, it’s in my hand, I’ll inhale it.’

If you’re representing special interest groups, maybe we should be like NASCAR with the little patches on the back: ‘Enron: We take your money and run!’

I did not have sex with that woman. I wanted to…

HMOs will pay for your Viagra, but they won’t pay for your glasses. So you can have a hard-on, but you can’t see where to put it.

 

There was also a great bit about how in customs we interrogate 80 year old women who are citizens of the US but let entire “illegal” families fly across our border to the south with dinette sets. Basically saying it is tougher to get into the US as a legal citizen than otherwise.

Rating 3.00 out of 5

5/19/2007

Annoying…

by @ 8:24 pm. Filed under tech

Since I upgraded to the latest version of WordPress I can’t get LiveWriter to upload images; says the site doesn’t allow it. How annoying. Anyone else seeing that? I will have to get out WireShark and do a network trace when I get a chance.

   joe

Rating 3.00 out of 5

Halo 3 – The countdown begins…

by @ 7:55 pm. Filed under tech

Have you scheduled September 25th (and the week or two after) off from work yet? That is the release date for Halo 3. I will buy my XBOX 360 a month or so before that date so I know I have a good solid machine (yes, I don’t have the XBOX 360 yet and yes I would pay that much for it just to play Halo 3).

http://www.bungie.net/News/content.aspx?type=topnews&cid=12467

Rating 3.00 out of 5

The IT Crowd…. State side.

by @ 7:51 pm. Filed under humour

Hmm, not sure how I feel about this. Those who have read the blog for some time know I love The IT Crowd out of England. I would be perfectly happy for them to broadcast that version here but it looks like, similar to The Office, they are recasting it for the US.

http://www.nbc.com/Fall_Preview/The_IT_Crowd/cast_credits.shtml

Moss is the same actor which is great, but they changed Roy, Roy was absolutely hilarious in the British version. He reminded me of a couple of guys I know in IT right now. Jen looks like a cuter version of Jen and is Blonde which fits the States well. They changed the manager, I thought the last manager was pretty funny. Like Roy, this new guy has some big shoes he has to try and fill.

Rating 3.00 out of 5

5/17/2007

American Idol

by @ 12:57 am. Filed under general

So we are down to the final two… While Melinda was certainly a better singer than Blake, she really had no real personality and the one she had the “Oh who me? I am that good?” was really worn out, I was tired of that after the first 2-3 weeks of her being told she was really good and her responding… “No…. Really??”. It was sort of like when Pickler tried to really push the air-head angle. It seems some of the folks find some personality groove and try to stay in it even if it doesn’t make sense. She is a good singer though, but I expect her doing more studio stuff versus going out in front of people; she just doesn’t seem very comfortable up there.

Anyway, Blake… way better entertainer than Melinda, great personality. He is going to get spanked by Jordin though, she is a much better singer. Don’t get me wrong, I like Blake, I like when he keeps his special “sounds” to a minimum and actually sings. But him and Jordin are in different classes and that whole complaint from Simon of “Old lady in a 17 year old body…” just relax Simon. She isn’t old enough to have her own “feel” yet, IMO. She’ll get it, right now she is just showing off the fact that she has great talent and her singing skills are not necessarily shown off by the latest songs.

Rating 3.00 out of 5

Microsoft Take Heed – Virtual Server Management Through IIS Sucks.

by @ 12:35 am. Filed under tech

For some reason, I don’t care why to be quite honest, my virtual server management website isn’t working now on one of my Virtual Server 2005 R2 hosts. It works if I hit the website from another page but if I am sitting at the console it doesn’t work. I get a completely non-useful message from IE even when I turn off “friendly” messages and I’ll be damned if I can pull together the strength to wade through the IIS logs to try and decode them and figure it out….

Again, this complete and utter failure doesn’t bother me a whole lot other than the fact that it makes me think about how badly this management interface sucks. Who the hell thinks to make the management of their server installed app dependent on IIS working properly? Lazy people, that’s who. Offer a web interface but give an actual interface that doesn’t rely on IIS as well in the off chance that IIS isn’t working properly or some change to IE makes it so it doesn’t want to work either…

Some bright person at MSFT, apparently named Paul took it upon himself to write a tool called VMRCPlus. I got a hold of this quite a long while ago through unnamed sources (names withheld to protect the guilty) and I have to say, it isn’t as pretty as the website, but it sure works well. It even works with IIS completely turned off, imagine that… Oh not hard for me to imagine… Hey Virtual Server Developers, how about you imagine that…

I can honestly say, without VMRCPlus, I would have ripped Virtual Server off of my machines in a heartbeat and replaced with VMware Server. Actually one of two of my machines that has VS 2005 R2 loaded on it is getting some new hard drives this week and being reloaded, guess which virtualization software is going on it? I have had such a great experience with VMWare Server on SuperFastVirtualMofo (SFVM) that I am going to load that instead of reloading VS 2005 R2. I mean I totally hate the fact that they lost the stacking capability but I have so much better luck with the interface, and to me, it just seems so much more responsive that it really isn’t a choice.

I do have to say though that I am looking forward to playing with Viridian on Longhorn. Love the idea, Server Core Windows machine running as the host… Oh yeah. I really really hope that the management interfaces don’t all come down to IIS because I wouldn’t use it then… though I have heard that isn’t the case so phew.

  joe

Rating 3.00 out of 5

Finding protected ACLs just got that much easier…

by @ 12:02 am. Filed under tech

I am working on AdFind again, well, let me say that it is pulled up in the IDE again. I am almost always tweaking it and usually have a special version I run that has more fun stuff in it than the version you all get to run. For example I have been running V01.37.00 now for several months and adding to it right along. This evening I added a new shortcut switch that takes advantage of some other new switches. The new shortcut switch is an attempt to make finding protected ACLs (ACLs that are set not to inherit – you know like what happens to objects that have been dinged by AdminSDHolder…) much easier.

Previously I discussed how to find objects with protected ACLs, I was never satisfied with that solution because, while it was easier, it was a long command to type and it required a second binary. I generally hate that unless I have absolutely no choice. So you will recall previously from http://blog.joeware.net/2007/01/06/756/ that you could use the command

adfind -h 2k3dc02 -gc -null -f * ntsecuritydescriptor -sddl -onlydaclflag -csv |grep “] PĆ¢ā‚¬Ā

could be used… well once V01.37.00 goes live, you can run the following command instead (well the search bases are different but you knew that):

F:\Dev\CPP\AdFind>adfind -sc aclnoinherit -default

AdFind V01.37.00cpp Joe Richards (joe@joeware.net) May 2007

Using server: r2dc1.test.loc:389
Directory: Windows Server 2003
Base DN: DC=test,DC=loc

dn:CN=VolumeTable,CN=FileLinks,CN=System,DC=test,DC=loc
>nTSecurityDescriptor: [DACL] (FLAGS:PROTECTED INHERIT)

dn:CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=test,DC=loc
>nTSecurityDescriptor: [DACL] (FLAGS:PROTECTED INHERIT)

dn:CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=Policies,CN=System,DC=test,DC=loc
>nTSecurityDescriptor: [DACL] (FLAGS:PROTECTED INHERIT)

dn:CN=AdminSDHolder,CN=System,DC=test,DC=loc
>nTSecurityDescriptor: [DACL] (FLAGS:PROTECTED INHERIT)

dn:CN=WMIPolicy,CN=System,DC=test,DC=loc
>nTSecurityDescriptor: [DACL] (FLAGS:PROTECTED INHERIT)

[SNIP]

dn:CN=user\, test,OU=Users,OU=TestOU,DC=test,DC=loc
>nTSecurityDescriptor: [DACL] (FLAGS:PROTECTED INHERIT)

dn:CN=HideMe,OU=HideTest,OU=TestOU,DC=test,DC=loc
>nTSecurityDescriptor: [DACL] (FLAGS:PROTECTED INHERIT)

dn:CN={FDC4F256-F4C3-4251-A439-49C43C5C4D02},CN=Policies,CN=System,DC=test,DC=loc
>nTSecurityDescriptor: [DACL] (FLAGS:PROTECTED INHERIT)

dn:CN={BC824D7B-4297-4B87-A07D-A4C8EC39E375},CN=Policies,CN=System,DC=test,DC=loc
>nTSecurityDescriptor: [DACL] (FLAGS:PROTECTED INHERIT)

26 Objects returned

oh, you need that in CSV format… Add -csv

F:\Dev\CPP\AdFind>adfind -sc aclnoinherit -default -csv
“dn”,”ntsecuritydescriptor”
“CN=VolumeTable,CN=FileLinks,CN=System,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=Policies,CN=System,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN=AdminSDHolder,CN=System,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN=WMIPolicy,CN=System,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN=SOM,CN=WMIPolicy,CN=System,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN=Administrator,CN=Users,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN=Administrators,CN=Builtin,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN=Print Operators,CN=Builtin,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN=Backup Operators,CN=Builtin,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN=Replicator,CN=Builtin,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN=krbtgt,CN=Users,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN=Domain Controllers,CN=Users,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN=Schema Admins,CN=Users,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN=Enterprise Admins,CN=Users,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN=Domain Admins,CN=Users,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN=Server Operators,CN=Builtin,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN=Account Operators,CN=Builtin,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN=$joe,OU=Users,OU=My,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN=testadmin,OU=Users,OU=TestOU,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN=TestAdminClone,OU=Users,OU=TestOU,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN=ADMINONLY,OU=Users,OU=TestOU,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN=user\, test,OU=Users,OU=TestOU,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN=HideMe,OU=HideTest,OU=TestOU,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN={FDC4F256-F4C3-4251-A439-49C43C5C4D02},CN=Policies,CN=System,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”
“CN={BC824D7B-4297-4B87-A07D-A4C8EC39E375},CN=Policies,CN=System,DC=test,DC=loc”,”[DACL] (FLAGS:PROTECTED INHERIT)”

Cool eh?

I am not sure when V01.37.00 will be available, I am adding Longhorn stuff to it as I figure out what needs to be added. I am thinking though that I am within a week or three of putting a fork in it unless something else comes up.

     joe

Rating 3.00 out of 5

5/16/2007

Event Tracing for Active Directory

by @ 2:14 am. Filed under tech

Is anyone out there really doing this? I recently started looking at the docs for it and the output from a trace and I can’t say that it is very friendly output nor is the documentation very friendly in general.

Rating 3.00 out of 5

[joeware – never stop exploring… :) is proudly powered by WordPress.]