PiqueABoo

Not by a desktop app running in the users context.. and if you've found some magic to make that desktop app run as local system or admin you shouldn't need to add anyone anywhere. Personally, if that program couldn't be installed after repackaging as an MSI I'd be on to their support (probably asking for a refund). What is it BTW?

Yeah but you're posting from Reading ;b I've done a variety of mail system for 15+ years.. bottom line is probably that once your data is in a proprietory database you're a bit stuffed when that complex software decides not to play. Yes Exchange has become more bomb-proof this decade, but it's a masssive solution to what is often a simple requirement.

If you've got too much time on your hands.. http://www.microsoft.com/technet/prodtechnol/beta/lhs/default.mspx

You could read KB290762 and everything else you can find on "burflags". Doesn't sound entirely the same problem, but I successfully used that on a W2K SP4 forest root (all FSMOs) a little while ago that had some event log entry saying it wouldn't act as a DC because of journal wrap. Only took 5 minutes once I'd finally convinced myself I understood what I was doing (sorry don't have value I used to hand).

Latest is 9.0.45.0 - PK signed on 17th Mar 2007.

Oh good Soooo... assuming you can get away with it, disable recursion/forwarding on internal DNS.

You've got copies of pub.edb & pub.stm on a disk somewhere? The bad news is that you're supposed to make a "recovery server" for this. If you've got vmware, the disk space and the time that might not be so bad.. ..otherwise I expect someone somewhere will sell you something expensive that reads *.edb.

::cough::splutter:: DNS as covert channel is an idea you're supposed to scare folk with (someone did that to many years ago), but no one was supposed to write it!! Does this one do the tricky to stop stuff? IOW you give it a DNS domain/zone e.g. example.com, the NS for that zone is the tunnel endpoint and it all works via some nearby DNS box and whatever forwarders that might be using? AIUI RM paid some money and don't have you bouncing via logmein servers. Logmein is also blocked by my local LEA and it's perfectly obvious why.

Or randomly not getting them. It's mostly OK for me, but every release and SP for several years has had some irksome bug or other in what ought to be completely stable functionality given the £££ and the decade+ they've had to make it work.

I don't have a case or interest in trying it, but some folk claim to have VMWare Server 1.02 working on Vista.

..and talking of boot.ini, slap an "/sos" on the end of the relevant line so you get to see the drivers loading - might give you a clue about what's stalling.

Principle seven.. data should be secure.. which arguably it is not if you leave a list of passwords lying around nearby (paper or electronic). OTOH my long list of other people's admin passwords is kept lying around in an encrypted p/w storage utility db... and that db lives in a truecrypt volume together with misc. other sensitive docs... have hideously long non-dictionary passwords for both of them. I don't want user p/ws to avoid the (unlikely) possibility of being more caught up in the mess when a user does something naughty and tries to blame it on someone who knows their password.

IIRC you have to sit around until you're something like 55 before the state renews it's interest in giving you non-trivial sums of money for training.

Uh huh.. I've run that VBS BlockList script from [whatever KB it is] a few times and it has yet to find any of them.

Well ok, but group psychology is clearly part of one side's job and if they can't stop themselves from finding "out groups" to dump on... Industry Standard #27: If you want anything with a non-trivial cost in time and/or money you first have to put together a very convincing business case.. then using every trick in the book (The Prince) fight that case for several months and sometime years... and if you win it won't be implemented until Q2 2008 because everyone is rather busy working on some critical path decided a year or two ago.

Consider inventing some placeholders for the things you collect e.g. $u = user $p = password $i = ip address We type those wherever we want then in a "command to execute" field e.g. c:\utils\mykillerapp.exe /target:$i /user:$u /pword:$p You then expand them etc. prior to executing the command.

That has a home in my penstick toolbox.. routine trawls through normal ADs are fine, but the schema won't expand fully without fiddling with the DS search limit. I've only wanted that for obscure reasons on a couple of occasions and I'm not sure how advisable this is on serious production boxes, but increasing the search limit with ntdsutil from 1000=>1500 works for me.

Does it cache logon credentials? What happens if you disconnect the LAN cable, start it up, then try logging on as a domain admin?

Ughh..either I'm reading this the wrong way or that's a bit of a step change. Where's the MS statement on SP2 being a prerequisite for future sec-fixes? Or are you just saying the longer you leave off applying SP2 the more it is likely to regress later?

Con: They're throwing a lot of things they paid serious money for down the drain and then paying even more money to eventually get it back to roughly the same place with the label "vanilla". How can a PRIMARY afford that? Why do they want to do it ? What do they think vanilla will fix? And hands up all the Primary people - the context is very different.

That is a bit naive. RM claim to have 750,000 accounts on that system. Request denied ;b If you run a network you've definitely got the means to communicate with your users (easiest way for anyone with web filtering would have been to redirect the easymail URL to your own page saying "IT'S NOT OUR FAULT" etc. + a link to RMs status updates). I wouldn't assume that. Ultimately it's a cautionary tale about putting all your eggs in one big basket. But that's a lot cheaper (serious money) than distributing them between two or three more manageable & recoverable baskets. It's inconceivable that the pros and cons of various arrangements weren't presented to the company gods.

Since you're essentially dealing with an off-the-shelf standard config that doesn't need too much attention, one skill that gets more emphasis in CC3 world is app packinging i.e. making and/or transforming MSIs.

I prefer ConTEXT, but I get around a bit and Notepad++ runs from USB[1] which is good for hotfixing in the more traditional sense. [1] Saves the config to a file rather than the registry.

Yep but "virtual server" was an installation option and what you called SQL on a cluster. Note "was", I haven't done much with serious SQL for a while and 2005 says: "The previous terminology was known as a "virtual server," but the[sic] has been changed to avoid confusion with the Microsoft Virtual Server product." Ughh.. hard day (VMWare Server != MS Virtual Server).

Agreed.. the term "virtual server" applies to stuff besides the VMWare product.