PiqueABoo

This is a command line util I just wrote to find domain boxes: -- With users logged-on e.g. check before remote reboot/shutdowns of boxes. -- That are "up" on the network e.g. what might need switching off before you leave. -- As a by-product, with potential problems e.g. no DNS, broken RPC/WMI access. Works on vanilla domains and has a couple of extra bits for RM CC3. Throw it on a box with dotNet 2 and run "WhoIsOn /?" for info on usage. It's a first release that's had limited testing. I'm not sure how it will cope on a large congested network with users logged on everywhere because there aren't many of those about in the holidays. Please let me know if you think you've caught it telling fibs about the status of a box. Do not let me know if you're confused by any of the Windows/AD concepts involved - ask google or read a book instead ;b Edit just 8 hours later New v0.9.0.1 - had inadvertently broken the bit that lets you run it on a non-domain box to a) view the help, b) be told you need to run it on a domain box.

An Article @27th July says: "Contrary to prior reports, Windows 7, previously codenamed Vienna, will be a major Windows release and will ship in both 32-bit and 64-bit variants for both consumers and businesses. This suggests that Microsoft's intention to move entirely to the 64-bit x64 codebase is proceeding slower than hoped." Anything else your read about it right now is probably just as likely to change, including the release date... last claim I saw was 2010.

I'm simultaneously a) miffed they didn't do something like this a long time ago, and b) pleased they've done it. Add this link to your bookmarks: https://support.microsoft.com/contactus2/emailcontact.aspx?scid=sw;en;1410&WS=hotfix

Remember that being said about 10 years ago (and repeated every six months since). I'm on the list where this was announced last week and is still being discussed. It's a *draft*, a debate starter, 2011 is "for discussion purposes only" and from that proposed date "Organizations MAY continue to use IPv4-based Internet connectivity" i.e. it doesn't have to go away. Don't miss the comment in one of the linked articles: "Reactions to the proposal on the NANOG list have been varied, but most were skeptical". Edit: I've just gotten around to reading it and this is a good summary: http://rip.psg.com/~randy/070722.v6-op-reality.pdf

It will run the command as nt authority\system so security shouldn't be an issue. If I'd done this I'd have: * Added the script to the existing 'Script Actions' GPO and left the permissions alone (has Authenticated Users read, apply). * Made the path \\schooldomain.internal\netlogon\somescript.bat * Used commands like this: echo Running my script > c:\logss.txt del /f /q "c:\windows\system32\drivers\etc\lmhosts" >>c:\logss.txt 2>&1 This is no more advanced than anywhere else - CC3 has management apps, a lot of preconfiguration and uhh.. one or two bugs.. but it's still Windows!

Ok there's LDAP Browser and ADSIEdit but this new util from sysinternals is teensy (160K after UPX), runs from a penstick, doesn't need you to fiddle with scary things in order to view the entire schema, presents many of the types in human readable form, you can edit things and it *takes and compares AD snapshots*. Can't see me using the latter very often but when/if I do it will be incredibly useful. http://www.microsoft.com/technet/sysinternals/utilities/adexplorer.mspx Hmm.. on second thoughts I'm too hung up on comparing. "Send me a snapshot of your AD & I'll take a look" will be handy.

Was going to put this script somewhere and kid myself hoards of folk would find it useful, but stupidly ignored and hit my very own appropriate technology problem. If machine's are switched of the best you can do is use something like check first with Win32_PingStatus.. and wait for the ARP request to timeout.. in about 2 secs.. which makes a large scan slooooow. It needs to be real multithreaded code not a quickie script, so something for the hols.

Mmm.. but couldn't you have put the kettle on again and used NGs (recursive) one-liner? Maybe you needed script, otherwise the latter definitely looks like uhh.. appropriate technology.

Routinely backing up just the system state to a **file** is a good thing too. Depends on the disaster. Here's a couple that can and sometimes do happen when there's an abrupt loss of power or hardware reset, or someone held the power button down etc. 1) Broken registry (won't boot or can't logon). Boot system with bartPE CD, replace broken registry files with recent copies from repair folder, reboot in AD restore mode and restore system state from file backup. 2) Broken AD (can logon). Boot in AD restore mode and restore system state from from file backup.

Why...?? What's wrong with a system where domain admins are local admins and can Manage local users (remotely )?

It pays to be interested because I very recently ran into one of these. Wasn't room for trying all the permutations so did the RSS and offload disables in both NIC properties and the MS TCP/IP reg settings. Has anyone had the time & energy to pinpoint exactly what is needed e.g. is the DisableTaskOffLoad enough (unless you're doing NAT)?

You can run RDP over SSL and have that use mutual authentication (same as Terminal Service Gateway in W2K8, but right now you have to find your own SSL). I prefer that because VPNs are typically configured so the client nukes non-VPN network connectivity during the session.. can't download that big file from wherever in the background etc.

Much of a muchness, but if it's a script, I think it's slightly nicer to use a WMI Win32_PingStatus query

Just read the dozen-ish lines that are the comprehensive network install guide including this on the proxy: "where xxx.xxx.xxx.xxx is the IP address or URL to the proxy server" An URL huh?

Is that the NETGEAR ProSafe SSL312 SSL VPN Concentrator 25?

The difference is in how much you have to type without typos e.g. two alternatives: whoison "ou=ict suite,ou=curriculum,dc=my school,dc=local" whoison "ict suite" /ou

Yes psloggedon blah-blah.. but I wanted a few other features and knocked up a script. Current options below - are there any obvious ones missing e.g. it only outputs where someone is interactively logged on to a machine and I can't make my mind up about whether to have switches to display machines that are off or sitting at the logon screen. Usage: WhoIsOn Scan entire AD WhoIsOn /cc3 Scan RM CC3 'Main Site' only WhoIsOn Check specific computer e.g. library-03 WhoIsOn Path to scan e.g. 'ou=Office,DC=My School,DC=internal' WhoIsOn /ou Scan specific OU & any sub-OUs e.g. 'Admin Offices'

RM manage to make systems that work with the f/w on, so I guess you Vanilla's just can't hack it? ;b It's the defence in depth thing. I'm a bit sceptical about the advantages when you have to punch so many holes through the f/w, but I think you may have to start getting used to that e.g. try pinging a longhorn/2008 beta 3 server core.

Ohhh.. I geddit.. essentially the difference between the account name e.g. "Joe E Bloggs" and whatever you picked for the logon e.g. "jbloggs".

Fashion is really something for random bloggers and their peeing contests over who can write the world's smallest implementation of PGP on a pinhead etc. I was trying to say quite a lot of coding these days is mostly about gluing API calls together so maintaining a good working knowledge of those and gaining it for the updates they release next week is rather important. Will I hit that deadline because I knew about a class hidden away in system.diagnostics that I've used before, does exactly what I need and will save me days-weeks of frustration? Or because I know how to write "Hello World" in a really cute but cryptic way using NERD, an exciting new language that isn't the s/w house's mandatory C#?

This works for me. JS again - it happily prints sAMAccountName for the Administrator account. var oADroot = GetObject("LDAP://RootDSE") var oUser = GetObject("LDAP://CN=Administrator,CN=Users," + oADroot.Get("defaultNamingContext")); WScript.Echo("User logon: " + oUser.Get("sAMAccountName")); And if that's not what you meant, were you looking for the UPN i.e. the userPrincipalName attribute? What are you actually trying to do with whatever you're looking for in a user container?

I think you're overlooking some other problem. sAMAccountName is a text attribute and it is what works in a logon box. The following snippet is JS but this kind of thing definitely should work and it's basically the same calls in VBS: UserObj = GetObject("LDAP://cn=fred,cn=Users, ... UserAcc = UserObj.Get("sAMAccountName");

Does anyone factor in orphans i.e. D&S folders that aren't listed in the registry and in principle won't be touched by delprof? [Don't ask me how that happens, but I've definitely seen them around]

That would be Symantec Backup Exec (even the PF folder has changed to Symantec now). Deal with it a lot and don't like it much - have hit far too many bugs in not exactly exotic places and every new SP or version seems to replace one set of bugswith another.

That's not quite how it worked when I did a long stretch of professional software enginering. Languages were just a bunch of irksome new syntax you picked up when you needed a new one which was definitely not that often. It's the ever morphing APIs, techniques and platforms.. Being able to write "Hello World" in 27 languages is relatively useless compared with say, knowing how to write platform portable code, a thread-safe dll or having credible experience of a wide range of dotNet classes.