PiqueABoo

But the reduced.. oh how I'm starting to hate this term.. attack surface, is also a feature of the normal version. Ironically most of the CLI utils you can't do without on core are essentially the ones people like me used to strip out of net-exposed NT because so many attacks depended on them (if you wanted a command prompt, net.exe and the like, you had to throw in the CD you'd made with them on). Install size we've covered and I just don't see that mattering much on any system with a HD (real or virtual). A bit like NT 3.1. then i.e. before they added everything but the kitchen sink.

Has anyone compared normal vs. core 2K8 properly? If you have then how come you're not running around saying: "It's too much faffing around for not enough benefit"? Or did you see a significant benefit? I haven't done this seriously but right now I'm looking at normal 2K8 + DC + TS (doing nothing much) using 295MB RAM and a core member server (doing nothing much) using ~215MB RAM. Take away the TS and add the AD role to the core and the memory gap will obviously narrow. OK that's just one measurement and not necessarily the most relevant for performance, but it doesn't quite fit my expectations for "stripped down". That core has fewer files sitting around doing nothing isn't something I really care about. I like core because it raises the barrier for nitwits who treat Server like their home PC (install lots of tat that breaks things etc.), but if you're in a position where you know that won't/can't happen then what is the compelling motive for core?

Haven't ever done a rename so take the wisdom of doing this in your scenario with a pinch of salt: If everything is basically fine and only DNS is being stubborn, I would be very tempted to try turning it into old-school DNS with zone files, quickly edit a copy of the old zone file into a the new zone file, then manually create the new primary zone importing that new zone file.

This is a CL util I wrote (in C) a long time ago, but update with the latest OUI every year or so. It scans a subnet via ARP WhoHas and spits out the IP address, MAC address, name (DNS falling back to NetBIOS if it can) and MAC Vendor. Ouputs in CSV. It's dual-use technology of the mild kind e.g. a nix/bsd equivalent might get run as part of the initial information gathering phase of a on-site pen-test. That's because ARP tends to get responses when ping is firewalled and the vendor name can sometimes be be enough to tell you exactly what kind of device is sitting at some IP address. I use it now and again when I'm in a hurry to legitimately understand what's kicking about on someone else's network. YMMV, but it *might* be helpful if you want to track down the odd rogue machine or IP address conflict. Just run without a command line argument for the usage. Remember this uses ARP so don't bother scanning any IP addresses that are not part of the host machine's subnet(s). arpscan.zip

I configure printers, WAPs, switches etc. with static IPs and keep a record of them by manually creating DNS entries in zones created for such devices. Alternatively just give them DHCP reservations. PS: Given a choice of private IP address space I'd use something from 10/8. You can get (and I've seen some annoying) conflicts with factory-default addresses in 192.168/16.

LEA = Local Education Authority RBC = Regional Broadband Consortium Don't know/think it's universal in the UK, but in this context one of the above is running what is typically a big private intranet and school networks are connected to that. There will likely be serious firewalls between the intranet and Internet, central web caches, DNS, time services etc. Because managing that intranet takes effort a school may well have to pay for getting new blocks of IP addresses, which is just the same getting IP addresses when you have a public connection from an ISP (in either case that cost may be hidden in some annual charge rather than explicit). LEAs tend to be a school tech's psychological "out-group", the common enemy they can get together and whine about. Sometime's that is justified, sometimes it's just whining. You often see the same effect further down the food-chain i.e. teachers/staff vs. school techs. Anyway... I think having ranges for statically configured devices is sensible (printers, servers, WAPs, switches etc.) but I wouldn't bother trying to distinguish between laptops and PCs via their IP address - you can do that with their computer name/DNS e.g. LAPTOP-27, SCIENCE-03, OFFICE-01. If you must have different IP addresses for Laptops then I'd be thinking about putting the wireless infrastructure on a separate (routed) subnet.

Sorry no answer, but you're up against typical f/w behaviour for authenticated policy rules e.g. I had to do this with a serious f/w appliance a while back and it took some effort. Eventually found out how and it was an obscure command line hidden in a dark recess of the small-print, not something you can do in the wizz-bang GUI. I subsequently gave unauthenticated users much more limited access to the net than authenticated users which made my scenario a Reasonable Thing To Do[tm]. If you can do your scenario by tweaking ISA it will probably take a fight and I'm doubtful you'll succeed. Does WebSense have any other way of grabbing usernames? For instance I've installed a 3rd-party web filter on an ISA 2K6 that had a s/w agent you could put on DCs to monitor logons and map them to IP addresses. The filter could then be configured to settle for logging IP addresses in the absence of an associated domain account name.

The charge for PUBLIC IPs out in the real-world is supposed to cover administration costs. LEAs are probably (no guarantee) doing exactly the same thing when "selling" private IPs. There is work involved in handing out addresses, sorting out routing etc... and if that is sub-contracted to commercial orgs, that'll be who you're ultimately paying. It's a trade off between that cost and the cost (+ other potential benefits) of how much time it will take to throw in your own NAT box and configure everything you need to run across it properly. I suspect difficulties with the latter is one reason why county/LEA might hate schools with NAT boxes.

I'd probably do this differently but that would take too long to explain and it won't necessarily work on your systems. I think the simplest approach is: 1) Restart server - if it stops immediately afterwards you *may* have a resource/memory leak problem. Otherwise.. 2) Figure out when this started (event logs are your friends), log on to server with a different admin account and restore a copy of the Curriculum\Administrator profile folder in D&S from a backup made before this issue started. [Hold back on step two until people have had a chance to wander past this thread and scream "Noooo.. don't do that because....!!"]

Key point is probably which VMware to compare against with my choice being ESX server (where you've long been able to script and carve up the CPUs, look at pretty realtime graphs of resource usage etc.)

WMI will get you what you want, but it's probably easier to do something like the folllowing which simply looks at what ipconfig says. It's JS coz I don't VBS either, but there will be a very similar VBS equivalent: var s = RunCommand("ipconfig"); if (s.indexOf("10.10.10.254")>0) {//Found work's default gateway - we're at work //do something } function RunCommand(cmdLine) { var so = new ActiveXObject("WScript.Shell"); var outStream = so.Exec(cmdLine); return outStream.StdOut.ReadAll(); }

Ok.. when you said the "internet dies" I had a momentary panic about how many bits were needed in the external NIC netmask. With that gateway address a 255.255.255.0 netmask seems correct i.e. will allow that side of the ISA box to find & talk to the gateway. I'd go check the internal NIC netmasks are ok and probably do the initial ISA 2K6 configuration again (haven't done that for ages but it's the bit with the pictures where you choose your topology), then start looking at making rules permitting some LAN->WAN traffic.

Before you do any rebooting what is the Gateway set to for the external NIC i.e. what's the address of the router?

Sorry, that's broken - you can't have 10.x.x.x addresses on the internal NICs when the external NIC has a 10.x.x.x address with a 255.0.0.0 netmask and expect it to work. That's telling the system that all addresses beginning with 10. live on the outside which is clearly not true in your case. I'd make the netmask on the external NIC 255.255.255.0. Make sure the netmasks on the internal NICs do not have the same problem - the netmasks there should be 255.255.x.y where x.y depends on the number of PCs you have on each internal subnet.

Four. Make an EXEFile package that calls one batch file on allocate and maybe another on deallocate and you can do lots of very useful things very easily e.g. -You have some app with an EXE installer that supports a variant of a /silent switch. -You want to run any XP CLI command on the workstations (once) -You want to run a script on the workstations (once). -You want to simply copy one or more files to the workstations. -You have a vendor MSI like JRE that won't uninstall with the routine msiexec switches (call msiexec from those batch files with the required switches)

If this is MS Network Monitor 3.1, look at the descriptions for SMB packets. Some of it might be a bit opaque, but the descriptions are the SMB commands/responses and you should be able to see the directory and file names involved. Look at the ones with "C; Nt Create Andx" and "C; Transact2".

SMB traffic is mostly file sharing. The number of packets depends on lots of things, how many drives are mapped, whether you have Explorer open, whether you're reading/writing/searching files etc.

1) Not. 2) There are several answers. What are you trying to achieve?

Mmm.. but you rebooted the server which by itself is enough to make some BE vs. VSS problems go away.. for a while at least. That said I think I'll double my chances by routinely putting that patch on next time I see VSS trouble.

Easiest thing to do is get BE to e-mail the report.

Just noticed this new version of their PPC/Smart Phone emulator. Not a core Windows thing, but it has been very handy for me when figuring out how to LAN/WAN connect different releases of WM to Exchange servers over SSL etc. If the emulated WM image works then a real PDA with the same WM version should (ditto when you run the emulated image's saved state 6 months later) http://www.microsoft.com/downloads/details.aspx?FamilyID=a6f6adaf-12e3-4b2f-a394-356e2c2fb114&displaylang=en

Maybe, but I'm not so sure and last time I looked that was still a proposed standard for SMTP on the Internet. RFCs are not Internet standards, but most Internet standards are pointers to one or more RFCs. Pragmatically RFC2821 is the de-facto standard, will be the fully fledged Internet standard for SMTP and I would be miffed by your scenario, but all we can really say is that their MTA behaviour is rather annoying and sometimes prevents mail delivery. Equally pragmatically, running serious MTAs in the face of things like current Spam levels has forced people to ignore occasional "rules" in RFCs and that is perfectly understandable. Then there's an RFC out there which is also an Internet standard which says I ought to be able to ping any host connected to the Internet and get a response, which I obviously can't because people often prevent that. If you wriggle a bit you can find an unintended loophole in the wording, but that's obviously going against the original author's intent, albeit for yet more understandable reasons.

I've done that on Exchange boxes, but have also encountered a somewhat plausible claim that alignment may do very little for disks nowadays because of all the magic they do behind the scenes to get those lovely big modern capacities i.e. the text-book disk geometry model is virtual, not what really happens on the disk. I'll let someone else figure out which story is correct.

outlook.exe /importprf \\someserver\someshare\someconfig.prf If you Google there are various docs about on using PRF files to config Outlook.

Get a copy of the file (assuming it's < 5MB) and throw it at this site for a variety of second opinions: scanner.virus.org It's not perect but it is useful.