ChrisP

!! remember that if delprof runs on a laptop your gonna wipe the local accounts !!

username: sysman password: password YES, password is: password quote from KB72296 "the System Manager must log into SIMS .net (using sysman as the login name and password as the password) and then open the System Manager module. Select Focus | Users, make a note of all of the new passwords then inform all users of their new password."

log in as sysman and password a) reset all the passwords by hand b) explain to staff on the most chaotic day of the year they have new passwords and they have to change them when they log in with the temp one you gave them. GOD BLESS SIMS

looks great, sent my email (fingers crossed)

cheeky

Sorry for posting here, i did in the securiy forum first but the security forum posts dont show on the front-page.... ergo: no help! ______________________________________________________ Hi, i'm having a nightmare solving this one. Basically a fake recycle bin called RECYCLED keeps showing up in shares and the root of drives with compamised PC's running an evil instance of CTFMON.exe. Staff are reporting it at home and it keeps cropping up on my network, sophos says it's healed the file but it keeps coming back, Different AV programs identify it under different names. Is there a way of preventing it in the first place? creative workarounds? Anyone else having problems with this... ---[ SNIP : from McAfee website ]------------------------------------- Characteristics - This trojan purports to be a legitimate file ctfmon.exe by its name and icon. It copies itself in a fake Recycle Bin folder that it creates. It also tries to configure the system to execute the trojan when a remote machine tries to access a drive on infected machine via network share. On execution this malware adds the following files and folders on each drive %Drive%:\autorun.inf %Drive%:\Recycled\desktop.ini %Drive%:\Recycled\INFO2 %Drive%:\Recycled\Recycled\ctfmon.exe Where %Drive% represents the Drive Letters. The contents of desktop.ini file are: [.ShellClassInfo] CLSID={645FF040-5081-101B-9F08-00AA002F954E} This causes windows to think that this folder contains recycle bin data. Desktop.ini is created as a hidden system file. The contents of the autorun.inf file are: [autorun] shellexecute=Recycled\Recycled\ctfmon.exe shell\Open(&O)\command=Recycled\Recycled\ctfmon.exe shell=Open(&0) Now if the folder in which this autorun.inf resides is shared and set for autoplay, then any remote computer accessing this share will end up executing the trojan file and getting infected too in a similar manner. This autorun.inf file also overrides the "open" command of the context menu (displayed on right click) to run the trojan when a user right-clicks and selects open.

Still picking myself up off the floor for this one... KB72296 - Important Notes Regarding the Use of dbAttach from August 2007 Created 08/08/2007 Last Updated 16/08/2007 Affected Products SIMS .net System Maintenance & Utilities Notes Important advice regarding the use of DBAttach from August 2007 DBAttach.exe Advice From the SIMS 2007 August Main release onwards, we would like to remind System Managers that the only application that we support to attach and detach a database for SIMS .net and FMS 6.91 is dbAttach. Using any other application to detach and detach databases may cause errors when a user logs into a SIMS application. From the SIMS 2007 August Main release onwards if, having detached a SIMS database, you wish to re-attach it to a different SQL Instance and do not use dbAttach, all user passwords will be reset automatically, including the ‘Sysman’ user. This will affect any users who do not use Windows Authentication to log into SIMS .net. If you do not use Windows Authentication, the System Manager must log into SIMS .net (using sysman as the login name and password as the password) and then open the System Manager module. Select Focus | Users, make a note of all of the new passwords then inform all users of their new password. Those users who use Windows Authentication to log into SIMS .net will remain unaffected by this change in functionality, as their school network login credentials are used to log into SIMS .net. 8O :?

yes thats how it's set up... All our printers are std tcp ports, i was having a brain-fart on my last post or I would have mentioned it, thank god friday night beer get's me thinking straight again Hic We have about 20 HP printers from 1010's to 4650's.. the 3800's are the only ones that do this

mmm. Interesting, I will try that monday. @meastaugh1 Is that a known solution or just somthing to try? TA!

Hi all. Just put 4 HP3800 colour lasers on my printserver. When one of them gets turned off I get this message on the printserver screen, then the printer wont print again untill i click OK. Message reads: The print spooler was unable to connect to your printer. This can be caused by your printer being turned off, the cable being unplugged, or being connected to a VPN, which will block access to your network. Your documents will print then the printer becomes available. Any suggestions ?

err, I thought that was a helpdesk ? In the winsuite logs you can see a timeline of exactly what the little buggers were up to. 9:01 - log on 9:02 - Open Excel ( to fake the teacher ) 9:02 - Open Explorer 9:02 - Open Word Document "z:\dont delete me\secret-list-of-games-sites.doc" 9:02 - Surf for "games" 9:02 - Surf for "mebo" 9:03 - Surf for "bebo" 9:03 - Surf for "proxy" 9:03 - Surf for "50 cent" 9:03 - Surf for "lolball" 9:04 - Surf for "bypass scool filter" 9:05 - Surf for "kill network manager" 9:06 - Pick keys off keyboard. 9:06 - Pull powercord from PC. 9:06 - Chew through mouse cable. ETC, till the end of a lesson.

Throw in application level activity logging; ala Winsuite and I would buy it!

Thanks rdhawkins, very helpfull indeed. Yes I know how to re-checksum NSS, It's all the rage here in Peru It's nice to have feedback from the companies involved in an open forum. It would be nice if we could somehow see the affiliations that users have to companies like the Location field show the company name. EG: REDSTOR, SOPHOS or NetSupport

Thanks a lot That sorts problem 1 and 2. Where is the multiple connection setting?

I like the NSS9, here in peru we use it a lot (joking). Now how about : 1: REMOVING or passwording the feature for ANYONE at the tutor PC having the ability to execute applications on the remote PC's (not just removing the toolbar icon). 2: REMOVING or passwording the feature for ANYONE at the tutor PC having the ability to do 'file manager' on the remote PC's (not just removing the toolbar icon). If you don’t think that this is a problem then you should come work in our inner-city secondary that’s in special measures, with half witted LSA'a and Teachers with no real IT knowledge. I frustrates the hell out of me that NSS9 has installed two of the biggest security holes in my network with no granular control given to me other than remove the icons from the toolbar (which does not disable the features) ALSO (without having to buy Net support manager) I’ve set up each room with its own security key, however I would like to connect to more than one room at a time in some circumstance as NSS is proving very useful for installing exe’s or running logon maintenance scripts but the profiles are tied to one security key. NSS is a very good product and still gets a thumbs up (plug the holes though)

just built myself a Quad core QX6800 and a EVGA8800gts based system for JUST under a grand. four cores clocked to 3.5ghz each and 13,500 on 3dmark06 = VERY BIG SMILE

fek, i'll wait for longhorn then...... UNLESS i take it I can just get a couple of licencess to use on the servers where i want the additional features.... WHAT ABOUT CALS? were licenced per device so I can have as many servers as I wish, does R2 require seperate CALS's than 2003 Standard? TA !!

As I have LOADS of servers including the VM's, im wondering... Is R2 somthing we have to pay for or is it FREE as in SP2? Can we just buy the CD media and upgrade or is that too easy? Thanks in advance for the help guys

I like the idea of file screening, can it be installed post sp2 ? AND I guess it two new media's then R2 32bit and R2 64bit

err. our servers are on SP2, what am i missing out on with this R2 you speak off? I thought sp2 was the latest ~ is R2 somthing different then? would SP2 rolled in any new features from R2? A little light please

If thats the same redstore as we have purchased server cases from in the past they are a bloody nightmare deal with.

Sorry for the barrage of questions. how many printers on your printserver? how often do you clear them? do the jobs dissapear from the print que when finished? (just leaving a file somewhere) how much space do you find this method takes up? ty Chris.

I Run GFS to tape on my servers but this is a last option as it's slow to restore and most of my problems are withs kids deleting their own work, deleting others work or overwiting files. 1st line of defence is shadow copy (when you show someone the 'restore previous version' it's usually soon followed by !! WOW !! ) 2nd line of defence is two VERY cheap backup servers built with NO RAID (JBOD) and NO REDUNDENT PSU (cant wait to be flamebait on this one, lol.) 3rd line of defence. the same DVD/RW nightly for the Sims database (automatic), and that DVD gets rotated out to the safe on friday for 6 months. 4th and last IMHO as i have not had to use it in the three years I have been with the school... Tape.... and yes i do check them.

I have two PC's with two tft's each to act as my all seeing eye. Monitor One showing the live filter log of my cackpilot (cachepilot) with a 5 second refresh (thanks Opera) Monitor Two views Splunk/Groundworks/OCS Monitor Three for VNC/Net Support Monitor four runs a custom admin setup based on ASP I have written to make my life easy(ish) it summerises loads of stuff for me; logons, dhcp search, winsuite logs, diskspace, user management, one click for my printers, AP's, Switches Web interface and one click to lock/logoff/shutdown the PC, VNC, deployVNC, remote command prompt, view audit logs, retrieve remote index.dat and parse it, remote file access, ping, delprof. and the bit that helps me everyday... I have a custom URL on my cackPilot that redirects to my EVIL error handling page.. to highlight kids (and staff) persistantly trying to get to proxy sites, bebo, porn sites and ilove50cent.co.whatever Needless to say I track the User, Computer, Site to a database. the error handler parses the url against a bad keyword list and a restricted TLD list, and acts upon them by showing the AUP, a custom warning message or (the best bit) changes there logon script to ban the internet and logs them off.

LMAO, so true! 50 cent, eminem and modified cars..... word documents with titles like 'gamesites' or 'proxy sites' and folders with names like 'please dont delete me'