joeware - never stop exploring... :)

Information about joeware mixed with wild and crazy opinions...

1/22/2010

Cloning Forests for Divestitures / Acquisitions

by @ 10:40 pm. Filed under tech

Just don’t do it.

See http://technet.microsoft.com/en-us/library/ee424329(WS.10).aspx

From the article

When a company acquires another company, business unit, or product line, the purchasing company may also want to acquire corresponding IT assets from the seller. Specifically, the buyer may want to acquire some or all of the domain controllers that host the user accounts, computer accounts, or security groups that correspond to the business assets that are to be purchased. The only supported methods for the buyer to acquire the IT assets that are stored in the seller’s Active Directory forest are as follows:

  1. Acquire the only instance of the forest, including all domain controllers and directory data in the seller’s entire forest.
  2. Migrate the needed directory data from the seller’s forest or domains to one or more of the buyer’s domains. The target for such a migration may be an entirely new forest or one or more existing domains that are already deployed in the buyer’s forest. We recommend that you migrate the directory data without security identifier (SID) history. If you migrate the directory data with SID history, information about the seller’s forest will be retained in the new forest of the buyer. For more information about migrating directory data without SID history, see Migrating Accounts Without Using SID History (http://go.microsoft.com/fwlink/?LinkId=113694).

This isn’t just a so-so recommendation that may or may not be right for your specific circumstance (sort of like the disk configuration guidelines), this is a hard and fast rule. Seriously bad things can happen and likely will if you mess around with it. If you do it and run into issues, the DS Team at Microsoft will walk away shaking their head[1].

 

    joe

 

[1] They didn’t tell me this, I am just guessing based on my conversations with them.

DON’T CLONE

Rating 3.00 out of 5

Seriously?

by @ 6:35 am. Filed under rants

I really really hope this new Michigan State University logo isn’t for real. Why? Because it sucks.

http://blogs.suntimes.com/sportsprose/2010/01/michigan_state_to_unveil_new_l.html

http://blog.mlive.com/ganggreen/2010/01/michigan_state_spartans_to_unv.html

http://blog.mlive.com/ganggreen/2010/01/new_michigan_state_logo_may_no.html

 

image 

Current

 

 

image

Alleged New

 

 

If this is the new logo, besides the thought that it sucks I think… Why? Why waste money right now on something like this. We hear educational establishments complaining because money is tight because of reduced attendance and reduced state funding due to the economy so someone decided to spend money working on changing the logo and all of the branding so that everything would have to be replaced???

 

      joe

Rating 3.00 out of 5

1/20/2010

Ooops… or should I say… You mean it isn’t ok to leave admin IDs unchanged for years?

by @ 7:36 pm. Filed under tech

http://www.pcworld.com/businesscenter/article/187009/financial_firm_notifies_12m_after_password_mistake.html

A Concord, New Hampshire, financial services company is sending data breach notification letters to customers after discovering that shared passwords, set up to simplify administrative functions nearly 10 years ago, could have exposed the private data of 1.2 million customers.

Off the top of my head, every company I have ever seen does this in some shape or form. I am always the one saying don’t do it, but usually I don’t have a big enough hammer to get person X to be forced to NOT do this.

I have written this topic before… http://blog.joeware.net/2005/05/08/10/

I wonder how many other companies around the world are in the same bad spot as the company mentioned above and they just don’t realize it.

These bad IDs are easy to find… Download oldcmp and run a report with the following command

oldcmp -report -users -age 365 -sh -realage -h test.loc -format csv

Then chop the non-CSV portion from the top of the file and pull into excel and look at what you have out there. Very likely you will find service/app/generic IDs that have been out there set as non-expiring and haven’t had a password change in years…

 

   joe

Rating 4.00 out of 5

1/18/2010

Decreasing Number of Geeks a National Security Risk

by @ 10:29 pm. Filed under general

This is an interesting article…

http://www.wired.com/dangerroom/2010/01/darpa-us-geek-shortage-is-a-national-security-risk/

Sure, we’re all plugged in and online 24/7. But fewer American kids are growing up to be bona fide computer geeks. And that poses a serious security risk for the country, according to the Defense Department.

I think a another big part of this problem is around the outsourcing of the computer geek type jobs, specifically IT, database, and developer jobs. I am where I am because I worked my way up the ranks. I didn’t start out knowing what I know now, I slowly learned and moved forward and learned more and got better. Challenges in lower level jobs taught me how to solve harder and more complex issues. It taught me to think through the problem, it taught me to think long term. It allowed me to move up and take on more complicated, higher level jobs. If I hadn’t been in those jobs and worked my way up, I very likely would never have written the tools I have written, never have authored the content that I have written. Before I found computers I was gung ho about being a Dr. I would practice writing a sloppy signature and everything. Even today my handwriting would make any physician or surgeon jealous.

Anyway, these starter and medium level jobs are all being pushed to offshore (or best shore) locations and so there are fewer and fewer jobs available for people to start in and move up the chain. People aren’t going to move straight into high level developer and architect positions, or if they do… watch out. We outsource our low level stuff now and continue doing so, we will be outsourcing our high level jobs later and then what will the security risk be?

    joe

Rating 3.00 out of 5

AdFind’s objectClass output is correct, it is CSVDE that is incorrect…

by @ 1:44 pm. Filed under tech

I promise myself that any time I hit about five emails for the same issue, I will try to write a blog entry about it so people can find it during their Google search phase before attempting to bother the developers/support folks…

Well I hit the limit this morning with an issue that has annoyed me for a long time with CSVDE but didn’t otherwise care about because quite simply I don’t use it and honestly not many people even realize to even ask about…

CSVDE gives incorrect output for objectClass. It gives you a single value for objectClass although objectClass is a multi-valued attribute.

For example:

C:\temp\delete>csvde -s test-dc1 -r name=joe  -f CON:  -l objectclass
Connecting to "test-dc1"
Logging in as current user using SSPI
Exporting directory to file CON:
Searching for entries…
Writing out entries
.
Export Completed. Post-processing in progress…
DN,objectClass
"CN=joe,OU=Users,OU=My,DC=test,DC=loc",user
1 entries exported

The command has completed successfully

C:\temp\delete>adfind -e -default -f name=joe  objectclass

AdFind V01.41.00cpp ##BETA## Joe Richards (joe@joeware.net) January 2010

Using server: TEST-DC1.test.loc:389
Directory: Windows Server 2003
Base DN: DC=test,DC=loc

dn:CN=joe,OU=Users,OU=My,DC=test,DC=loc
>objectClass: top
>objectClass: joeware-DottedLine
>objectClass: person
>objectClass: organizationalPerson
>objectClass: user

1 Objects returned

 

You will note that in the CSVDE export it doesn’t mention joeware-DottedLine at all… The generic issue here is that from the CSVDE output you have no understanding that there is a dynamic aux class bound to the object. Dynamic auxiliary classes make additional attributes available on objects. In this case, the ability to specify an additional dotted line manager or managers.  This could be troublesome if you are exporting objects and then re-importing them later.

 

   joe

Rating 3.00 out of 5

1/17/2010

And another AdMod beta… Fix for a CSV multi-value expansion mode bug.

by @ 2:24 am. Filed under tech

I have updated the AdMod Beta again. My good friend Princess (Jorge) was very nice to ping me with an issue he was hitting in AdMod (both previous stable versions and beta) this last week and low and behold after testing I realized it was a bug. A bug in a very nasty portion of the CSV code.  Those of you who recall, CSV functionality was never intended to be in AdMod (and AdFind). One night after a particularly awesome Summit and Directory Experts Conference I figured out how to hack CSV into the tools. However it was akin to how most companies used to build convertibles. They built a normal car, welded a couple of extra braces on and cut the top off. Slowly but surely I am slowly cleaning up this really bad code and unfortunately the bug Jorge hit was deep in the middle of some of the worst of it. Once I knew it was a bug, it took me another 4 hours to actually trace down WHERE the bug was. And I didn’t even figure it out while sitting in front of the computer. It was one of those things where you are off doing something completely disconnected and your mind wanders and the answers pops into your head. I love it when that happens. 🙂

Once the bug was found the fix was simple, obvious and solid and I was able to plug it in but there was a good period of time there that I was thinking I didn’t like Jorge very much. ;o)

Anyway, the upshot is that there is a new AdMod beta up on the website if you would like to download it. 🙂

Thanks to Jorge and everyone else that is testing the apps and sending me feedback, it is always appreciated and helps me make a better product for all of us.

 

http://www.joeware.net/downloads/beta/adfindmod_beta.zip

 

   joe

Rating 3.00 out of 5

1/15/2010

Blog Spam

by @ 7:00 pm. Filed under general

http://blogsearch.google.com/blogsearch?hl=en&ie=UTF-8&filter=0&q=%22The+tool+is+called+Gold+Finger%22&sa=N&start=0

Rating 3.00 out of 5

1/14/2010

Watch out, some personalized phishing going on…

by @ 7:00 pm. Filed under general

This email came in from one of my former work managers… It wasn’t him. I knew it by the writing style and word choice and well, that it happened at all to be honest, as soon as I saw it but others may not figure it out so fast…

 

Hi, I really don’t mean to inconvenience you right now but I made a quick
trip to London UK this past weekend and had my bag stolen from me in
which contains my passport and credit cards. I know this may sound odd,
but it happened very fast. I’ve been to the US embassy and they’re
willing to help me fly without my passport but I just have to pay for my
ticket and settle some bills. Right now I’m out of cash plus i can’t
access my bank without my credit card here, I’ve made contact with them
but they need more verification. I was  thinking of asking you to lend me
some funds now and I’ll pay back as soon as I get home. I need to get on
the next available flight.
Please reply as soon as you can if you are ok with this so i can forward
the details as to where to send the funds. You can reach me via May field
hotel’s desk phone if you can, the numbers are, 011447024051771 or
011447024043668

 

See http://www.sodahead.com/other/i-got-hacked-early-this-morning-see-letter-below/blog-224049/

    joe

Rating 3.00 out of 5

1/12/2010

ADAM (aka ADLDS) is available for Windows 7 now!!!

by @ 9:00 pm. Filed under tech

http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=a45059af-47a8-4c96-afe3-93dab7b5b658

 

The same for Windows Vista is on the horizon…

Rating 3.00 out of 5

AdFind/AdMod Beta update

by @ 6:00 am. Filed under tech

I incorrectly linked AdMod when I posted it (http://blog.joeware.net/2010/01/07/1862/) previously. So if you ran it you probably saw an error about a missing DLL unless you had already installed the Borland/Codegear DLLs for some other app. I have recompiled and relinked with static linkages so everyone should be fine now. Let me know if there are any other issues.

http://www.joeware.net/downloads/beta/adfindmod_beta.zip

 

My sincere apologies for the inconvenience! 🙂

 

  joe

Rating 3.00 out of 5

[joeware – never stop exploring… :) is proudly powered by WordPress.]