joeware - never stop exploring... :)

It seems that my ISP made some sort of change somewhere and the downloads on my website broke for most of yesterday (September 15). I wanted to apologize to everyone for any inconvenience and say it should all be up and working fine now. 🙂

The story for anyone who cares…

Just before going to bed I wanted to check the relative volume of my personal email (right around 1200 unread messages without counting any of the email lists like activedir.org, etc) and saw a flood of “Hey you suck, I can’t download your free tools you wanker!”. I tried to download some stuff and sure enough, was getting a blank white page. Looking at the source it wasn’t anything that it should have been.

I then looked at the script controlling downloads and it wasn’t hacked or anything, hasn’t been touched since 2007. I played around for a little bit, cleaned up some data files tracking download stats that had gotten corrupted, that didn’t fix it. Then I changed the redirection aspect of the script for making your browser go to the zip files and that did it. Not sure what was happening on the ISP’s web servers but if I just used “Location: new url\n\n” it wouldn’t send that to the browser, it would send a page that would display a white screen, adding “Status: 302 Moved\n” to it made it work. Probably I should have had that there before, I don’t really know, at this point at 2:40AM I don’t really care. ;o)

I did want to say sorry though to anyone that may have tried to download the tools and failed. I know if I got 30 emails, I probably had 300 more that tried and just gave up figuring it would get fixed and they could come back later.

    joe

One of the problems with AD Permissions is that AD is sort of like a garage or attic. You start out with a solid plan for organization and how things will be positioned. However over time you put something[1] here, you stack something[1] there, you push something[1] back into the corner over there all with the intentions of straightening out soon but then down the road a few years later when for whatever reason, you are forced to sort it all out again[2], you have no clue where these “somethings” came from and often why you would even consider having/saving them in the first place[3].

Identifying where the “somethings” are is usually only a small,though often challenging, part of the battle. Understanding years down the road after life events, re-orgs, employee turnover, mergers, aquisitions, divestitures, and outsourcing/insourcing why they are there and the backgrounds behind all of those “somethings” can almost hit the levels of “impossible” to figure out because it depends on data that is not collected within the system itself, it is myth and tribal lore and very often misconceptions on what was needed now or in the future[4].

Having run into this type of scenerio in several companies over the last 10 years, I am starting to think that my recommendations from years ago that people keep logs/spreadsheets with this info wasn’t listened to or possibly just doesn’t work because that all gets lost too in the same churn of life and miscellaneous happenings around the office.

Maybe, I am just spitballing here, we need to maintain a little more meta data in the directory. And by that I mean data about the data, not literally AD metadata. Start creating instances of some custom objectclass in the NC (and specifically the OU) that has the one off permissions that has a description and info attributes fully populated with the info indicating the reasoning, etc for the permission. Do it for each special one off ACE granted/denied. That way we don’t have to worry where the documentation is at, it is right there with the product. When the OU is deleted, so is the object describing the deviations. Just have to remember to update the object if the ACE changes.

Now I hear the naysayers saying… hey hey that doesn’t belong in the directory… and to be perfectly fair, 10, 8 or even maybe 5 years ago I likely would be in that grouping… But in all reality, the amount of space this would take would be minimal compared to the value it could add.

   joe

[1] A permission…

[2] Say you are moving or trying to find that old DVD player or the ceiling is going to cave in or your can’t get the lawn mower out or you are outsourcing or have been reorged or are being audited, whatever…

[3] Really, when were you going to use those black nylon Michael Jackson inspired parachute pants again?

[4] Seriously, again… You saved black nylon parachute pants that you never really wore in the first place?

I just had to gather stats on how many utility downloads I have so I thought I would share. Sadly I don’t have stats going all the way back to 2001. In March 2007 I changed ISPs. When I did so, I neglected to take the data portion of the downloads with me so lost the stats from October 2004 – March 2007. I lost the stats from 2001 to October 2004 when I set up a new download system AND switched ISPs. The stats from Oct 2004 to July 2006 are at this post – http://blog.joeware.net/2006/07/21/469/

So the stats from March 2007 to now…

The totals for all thirty nine tools on the website as of today since March 2007 is 456,684 downloads.  The top five tools in terms of downloads are:

· AdFind – 99167 downloads

· OldCmp – 63392 downloads

· CPAU – 50249 downloads

· AdMod – 20757 downloads

· SIDToName – 19382 downloads

I had to work out a few things to do in a batch file the last couple of days so I thought I would share. Note: so this doesn’t become a huge powershell versus perl versus whatever discussion, I had no choice, I had batch available period and even that was possibly stretching it a little as the people involved seemed very concerned about scripts, etc. Also, yes I am aware of Tim–Toadie (TIMTOWTDI). So please feel free to comment with additional methods.

Getting date and time in a useful format

for /f "tokens=1-4 Delims=/ " %%i in (‘date /t’) do  set dt=%%l/%%j/%%k
for /f "tokens=1" %%i in (‘time /t’) do set tm=%%i
echo Date: %dt%-%tm%

Is this machine virtual or physical? It could be VMWare, HyperV or Virtual Server or Virtual PC. I don’t have the strings for other virtualization techs, if people are using them and can post the results of the command “wmic computersystem get model” then they can be added to the batch commands.

set VIRTUAL=NO
set VMWARE=NO
set HYPERV=NO
for /f "skip=2 tokens=1-2 delims=," %%i in (‘wmic computersystem get model /format:csv’) do set MODEL=%%j

: Microsoft Virtualization
if "%MODEL%"=="Virtual Machine" (
  set VIRTUAL=YES
  set HYPERV=YES
)

: VMWare Virtualization
if "%MODEL%"=="VMware Virtual Platform" (
  set VIRTUAL=YES
  set VMWARE=YES
)

Is this machine Vista or better?

SET VISTA+=NO
if exist %systemroot%\system32\bcdedit.exe set VISTA+=YES

Is this machine x64?

SET x64=NO
if exist "%systemdrive%\program files (x86)" set x64=YES

So I am forced to write some more .NET code, worse, some Windows Forms stuff. Couldn’t put me further away from my happy zone. I do have to say that Borland err, CodeGear Builder C++ still blows VS away for simple generation of GUI. If only CodeGear did x64…

So two things that I have found I am unhappy about in just the last hour.

1. RefreshCache() doesn’t appear to work for the LDAP provider in DirectoryEntry. WTF.
2. CTRL-A isn’t captured and used for SELECT ALL by default in a TextBox. I actually had to code a workaround for it with the following C# Code:

private void textBox1_KeyPress(object sender, KeyPressEventArgs e)
 {
  // CTRL_A Select All not handled by default
  if (Convert.ToInt(e.KeyChar) == 1) textBox1.SelectAll();
 }