joeware - never stop exploring... :)

Information about joeware mixed with wild and crazy opinions...

2/1/2007

AdFind -ASQ and Unavailable Critical Extension

by @ 10:13 pm. Filed under tech

So one of my old MCS friends who is no longer with MCS and is now doing real admin work has admitted that he loves AdFind and depends on it daily. That makes me smile. What makes me smile even more is when he runs into things that I used to bitch about to him when he was with MSFT and he would just respond with “quit your bitchin!”. Who’s bitchin now??? I especially like hearing things like… Oh MSFT wouldn’t have done it that way, that would be stupid… Especially when I know for a fact, that is exactly how it was done because I have dealt with it…

Anyway, back on topic, my friend brought up an issue he encountered… Basically he was trying to use -ASQ (Attribute Scoped Queries) to retrieve the display names of the members of the Domain User’s group. When he did that he was getting Unavailable Critical Extension. Now this error can mean several things but the most obvious thing is that the functionality you are requesting isn’t built into the directory that you are querying. This was exactly the case here, he was querying a Windows 2000 Domain Controller which doesn’t have the ASQ capability. I had to ask what his specific query he was doing though because there are times where the capability is available but you have run into another issue. The most common other issue I tend to hear about is usually that you have overloaded tempDB with a query that has a sort involved. The way around that is through some special indexing or just not doing that. 🙂

Of course there is another issue with using Attribute Scoped Queries with the Domain User’s group… Do you know what it is?

There are actually quite a few caveats and issues that can pop with ASQ and the new K3 SP2 / Longhorn functionality which allows you to recursively query up through group memberships in a single call (see http://msdn2.microsoft.com/en-us/library/aa746475.aspx and look at LDAP_MATCHING_RULE_IN_CHAIN – AdFind exposes this with :INCHAIN: or :NEST:) that I need to write up to discuss with you folks. I will make a note of it. I have written about it in other forums but never brought it back here so people (including me) can always find it.

Rating 3.00 out of 5

Hey I don’t want quotes in AdFind’s CSV output….

by @ 10:13 pm. Filed under tech

I keep getting pinged on this so I will likely add a switch like -csvnoq or something like that… In the meanwhile if you don’t want quotes in your AdFind CSV output use -csvq “” which literally tells adfind to use null for the quoting character.

You need to be careful with this though, the quotes are there for good reasons. You need to validate your dataset to make sure that removing the quotes doesn’t obfuscate the output beyond your ability to use. Examples are fields that use commas or semicolons which are the default characters for the delimiter and multivalue delimiter.

  joe

Rating 3.00 out of 5

Using cheap I.T. labor doesn’t make I.T. cheaper…

by @ 10:12 pm. Filed under rants

In actuality cheap I.T. labor screws I.T. up and ends up costing more in quality, correction/redo work, and loss of customers sick to death of dealing with your shitty workers. You get what you pay for. If you want to use dirt cheap I.T. labor… when your data and everything else is ass backwards, you know why. When all of your good people are saying, “You are screwed, I’m sick of dealing with the morons you are hiring to do this work that force me to work two, three, or more times harder just to keep things afloat, I’m out of here…” You know why… If you get paid at best $20k USD for a year worth of I.T. work, you do not have that job because you know what you are doing, you have that job because you are cheap and you are the reason for this blog post.

In every case where you think cheap “run book” driven I.T. labor is a good idea it can almost certainly be automated and actually run properly versus being screwed up by the huge number of cheap labor workers you throw at the problem. Even the car industry realized that it was better to use robots than people pretending to be automatons because the robots are less likely to screw up so you get better quality with the robots. The problem here is that there is more up front cost which is more immediately visible than dealing with constant quality issues and the extra costs you pay to correct that year after year… So if you have a company struggling to show cost savings now it looks better at the executive level to do the work half ass but cheaply than do it correctly. That is the only reason I can see that execs can justify this stupid thinking that I can visualize.

Why this rant now? Well as I have mentioned before I see using cheap overseas labor for I.T. as a bad long term direction in general for the US/Canada/UK/Europe/Australia/Japan and other true first world countries but mostly because I am neck deep in correcting the crap work put out by these types of resources…

Just today I get asked to run some validation scripts against IPs listed in several thousands rows of an excel spreadsheet which is extract from a support database which is the authoritative database for someone. This is generally no problem, should take seconds to set up and then let the scripts run for how many hours it takes to contact every machine specified… Only the field labeled IP Address doesn’t appear to be standard… Right next to the field is a field indicating the date that someone validated the machine by logging into it, yet they didn’t take the time to make sure the IP address field was in some way shape or form standard… In this field that should be an IP address I found

  • IP addresses with octets separated by periods (YEAH!)
  • IP addresses with octets separated by commas (WTF? How stupid are we? Where would that ever be valid?)
  • IP addresses with octets separated by spaces (yet again… WTF?)
  • Multiple IP addresses separated by pipes (|)
  • Multiple IP addresses separated by tildas (~)
  • Multiple IP addresses separated by spaces ( )
  • Multiple IP addresses separated by commas (,)
  • Multiple IP addresses separated by semi-colons (;)
  • Multiple IP addresses separated by slashes (/\)
  • Multiple IP addresses separated by newline characters (/n)  – This is especially fun to see in Excel…
  • Multiple IP addresses separated by random parens use
  • Multiple IP addresses separated in some random way but with labels mixed in like Ext, Int, Cl, etc.
  • Multiple IP addresses separated by a random combination of all of the above
  • Multiple IP addresses separated by one or more of the combinations above but all of the IP addresses are the same
  • Multiple IP addresses separated by one or more of the combinations above only not all of the IP addresses are full 4 octet IP addresses
  • IP Addresses with unprintable characters embedded like 1.2.3.4áááááááááá
  • Random use of quote characters ” and ‘ – This is fun to see in Excel, it covers it up…

The data is just so bad off that trying to automate the cleanup of it is impossible, all I can do is have it report anything that doesn’t match a specific format so I can manually correct the spreadsheet. Had the formatting been locked down right off or proper logging was in place for the updates so you could find and beat the people responsible or you just used intelligent people in the first place this wouldn’t be an issue now…

I won’t even go into the column with the FQDNs other than it is immensely obvious not everyone knows what a Fully Qualified Domain Name is.

I realize that possibly someone wasn’t told they should clean this up but something you can often get out of more intelligent (read more expensive) workers is a thing called common sense… I could not have opened this DB and saw those fields and not commented to someone somewhere that it needed to be corrected the instant I laid my eyes on it. In this case, the database has been in use for literally months and now they realize they have an issue with some of the naming info so want me to validate it only the field you validate it from itself is completely hosed. I wish I could get the names of the people who populated the IP Address field in the various random ways and just sit down with them and ask… Why? Why did you choose to populate that field the way you did? Did you not look at the other fields to see the formatting? Did you not think to ask someone? Does what you did actually make sense to you or do you make so little that you just don’t give a shit and figure any old crap will suffice?

You want to reduce the cost of your I.T…. Hire intelligent people who know how to automate things and pay them enough to give a shit. You want people who are constantly thinking and *want* things to run well. People thinking “how can this be automated and then never require a human to put their hands on it again?” A lot of companies have a lot of computer people who aren’t actually very good at using computers to help them do their jobs. They seem to think that they are there to make the computers run well so that means humans must do manual work versus making the computers take care of themselves and each other.

   joe

Rating 3.00 out of 5

1/31/2007

What’s an hour between friends (or replication partners)?

by @ 1:27 am. Filed under tech

There is lots of chatter lately about the whole Daylight Savings Time “blah” where “blah” is whatever it is you want to call it – hubbub, scare, whatever. I don’t know what to call it other than blah but it certainly is causing far more trouble than its worth. I am getting pinged with quite a few questions about it in email to me personally, email to me at work, newsgroups, listservs, everywhere.

Let me start off with the three biggest questions…

1. Will AD replication break if

a. No DCs are updated?

b. All of the DCs are updated?

c. Some portion of the DCs are updated?

2. Will Kerberos authentication break under any of the conditions listed in 1 but for machines, not just DCs?

3. If I update a DC will that fix the time on all of the other machines or do I have to update every machine?

 

The answers are

1. No, not for any of those subitems.

2. No, not for any of those subitems.

3. No, you need to touch every machine that you want the time to be displayed “properly” on.

 

So what does this last sentence above mean? The main thing to keep in mind is that computers are not people. They don’t need to see time in a local offset, they use what is called Coordinated Universal Time, this is also known as Zulu time. Zulu time does not have a DST offset and is equivalent to GMT (but not BST – British Summer Time). All computers use UTC so a DC in Detroit has the same internal time value as a DC in Canberra, although they can both be set to display a different local time to user based on the DST and TZ settings of the machine. Again to restate the main point, TZ and DST are for humans, not for computers.

The only time having incorrect TZ and DST settings can hurt you at a system level is when trying to set a new time manually… The time will be input in local time and then the incorrect TZ and/or DST values will be used to convert to the internally used UTC value… Microsoft could have easily gotten around this by having people input the time in UTC because the API call that sets the time actually requires UTC… however, doing so would just show most people don’t have a clue what UTC is.

Oh… Something that confuses some folks… The Event Log and the File System and AD all log times in UTC, not local time. AD doesn’t surprise folks so much because there are mechanisms to easily see the time stamps in UTC, the Event Log and File System are a little more surprising because people never see those items displayed in anything but local time.

With all of this being said, there actually is a good reason to make sure that DST and TZ settings are correct. Poorly written applications that use local time for calculations instead of UTC. I won’t name any specific apps but if you google you will likely read about several very popular apps that have issues here.

Gary Olsen is one of the folks with whom I previously discussed this topic at length, he took the time to write up the results and published them in a Tech Target article. You can read the article here.

 

   joe

Rating 3.00 out of 5

By Height….

by @ 12:48 am. Filed under quotes

Judge Smails: Ty, what did you shoot today?
Ty Webb: Oh, Judge, I don’t keep score.
Judge Smails: Then how do you measure yourself with other golfers?
Ty Webb: By height.

Rating 3.00 out of 5

Gunga galunga…

by @ 12:47 am. Filed under quotes

So I jump ship in Hong Kong…
and I make my way over to Tibet…
and I get on as a looper at a course over in the Himalayas.
A looper… You know, a caddy, a looper, a jock.
So, I tell them I’m a pro jock, and who do you think they give me?
The Dalai Lama, himself.
The twelfth son of the Lama.
The flowing robes, the grace, bald… striking.

So, I’m on the first tee with him. I give him the driver. He hauls off and whacks one – big hitter, the Lama
Long, into a ten-thousand foot crevasse, right at the base of this glacier.
Do you know what the Lama says?
Gunga galunga… gunga, gunga-galunga.
So we finish the eighteenth and he’s gonna stiff me.
And I say, “Hey, Lama, hey, how about a little something, you know, for the effort, you know.”
And he says, “Oh, uh, there won’t be any money, but when you die, on your deathbed, you will receive total consciousness.”
So I got that goin’ for me, which is nice.
– Carl

Rating 3.00 out of 5

Is this Russia?

by @ 12:45 am. Filed under quotes

Danny: Did you have to take that Cooter Preference Test when you were a senior in high school?
Ty: Oh yeah, I took it. They said I should be a fire-watcher. What are you supposed to be?
Danny: An underachiever.
Ty: Hahahaha
Danny: I gotta go to college, I gotta.
Ty: Ahhhh Danny this isn’t Russia… Is this Russia? This isn’t Russia is it?
Danny: Nah
Ty: I didn’t think so. The thing is… Do you want to go to college?

Rating 3.00 out of 5

1/28/2007

The Dilbert you never saw…

by @ 2:08 pm. Filed under humour

A previous manager of mine sent this to me…

Rating 3.00 out of 5

1/22/2007

Think Aloud…

by @ 12:51 am. Filed under quotes

A friend is a person with whom I may be sincere. Before him, I may think aloud.

   – Ralph Waldo Emerson

Rating 3.00 out of 5

Kind Act…

by @ 12:45 am. Filed under quotes

To give pleasure to a single heart by a single kind act is better than a thousand head-bowings in prayer.

  – Saadi

Rating 3.00 out of 5

[joeware – never stop exploring… :) is proudly powered by WordPress.]