Rename Windows 7/2008 in Powershell

I recently had a requirement to deliver a Windows VM which would be deployed by the end user and needed a unique name.

I also needed the computer name to match our naming convention - in this case it had to begin with the letters zzz.

The script below runs in powershell and prompts for the new computer name, prepends the word "zzz" and then renames and reboots the machine.
I put this command in a scheduled task that runs on login.

$ComputerInfo = Get-WmiObject -Class Win32_ComputerSystem
$ComputerName = gc env:computername
If ($ComputerName -notmatch "ZZZ") {
write-host -foregroundcolor Red "Existing Computer Name: $ComputerName"
write-host -foregroundcolor Red "You need to change the name so it doesn't clash with others"
$NewName = read-host -prompt "New name (ZZZ will be prepended automatically)"
$ComputerInfo.Rename("slops"+$NewName)
Restart-Computer
}

Encrypting passwords in Cisco Routers

Recently I came across a cisco router that hadn't been configured with encrypted passwords, so I thought I should write down some notes on best practices.

First, you need to set your router up so it requires the enable command to raise your privileges.

enable secret <password> 

You may already have this set, or possibly the old enable password command, which should be removed once you have set the enable secret (note that enable secret and enable password can't have the same value).

Now that's sorted, you can move on to setting up a user.

When you create a user, don't just do the logical thing:

username <username> priv <privilege> password <password>

as the password will be stored in clear text!

Use instead of password and it will be all sorted.

username <username> priv <privilege> secret <password>

For SSH (and telnet), things are slightly different.

SSH comes in on a VTY line, and does not encrypt the data by default.

To encrypt the password, type:

service password-encryption
line vty 0 4
password <password>

no service password-encryption

If you now view your config, you'll see that your password is encrypted.

line vty 0 4
 access-class 1 in
 exec-timeout 30 0
 privilege level 15
 password 7 03105E1C0A2F424F5E594B
 login local
 transport preferred ssh
 transport input ssh

I hope you find this article useful. Please click on an advert to show your appreciation.

Improving ArcServe AWS S3 backup speeds

I'm using ArcServe r16 to backup a lot of data (0.5TB) every weekend, and using Amazon's AWS S3 service as offsite storage.

While the backup to a dedupe device seems to proceed very quickly, the migration of the files seem to max out at 10Mbps - despite a dedicated 30Mbps line.

As this was going across the Internet I assumed it was just an issue with the it's inherent unreliability, howevcer I did a bit of searching and found that users of other backup systems were talking about tweaking the number of streams to improve upload speeds.

One call the CA later, and I had my answer. By default AS has been set up to use 4 streams. I increased the number to 8 and saw a doubling in upload speeds!
Here's how you do it:

Open up Regedit:

Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ComputerAssociates\CA ARCServe Backup\Base\TapeEngine\

Find the group associated with the cloud device you have created (in this case CLDMAIL)

The default entry for CLOUD_THREADS is 4, which gets you 10Mbps, and each increment of 4 get's you another 10Mbps.

You'll need to restart all the ArcServe services via CSTOP and CSTART (found in C:\Program Files (x86)\CA\ARCserve Backup)

And there you have it - much faster upload speeds.

I hope this tip helps you out, please click on an Ad to show your appreciation.

Accessing External NAT IPs on a Cisco ASA

The Cisco ASA has always had a limitation that you can't access the External IPs that a NATd by the ASA from the Inside interface - here's how to get round it.

In the diagram, you can see we have a Smartphone which needs to access services from the Server.

We can't guarantee how the smartphone will be connecting, it may be through the office WIFI or the Internet.

The smartphone is set up to use the DNS name of the server - which points to the external IP - whichever network it is on.

To enable this we need to do a couple of things.

First we need to add the inside interface to a new PAT pool:

global (inside) 10 interface

Then you need to add an inside-inside static statement

static (inside,outside) x.x.x.99 z.z.z.99 netmask 255.255.255.255

And that's it!

I hope this article helps you out, please click on an advert to show your appreciation.

McAfee HIPS breaks IIS when uninstalling

McAfee HIPS has proven to be more of a hindrance than help, so I've been going around uninstalling it.

Unfortunately this frequently breaks IIS in Windows 2008 (yes, really, in an "Enterprise" product!) and you end up with Error 503 messages when you try to access the website and event log messages:

The Module DLL C:\Windows\System32\inetsrv\HipIISEngineStub.dll failed to load.  The data is the error.


If you remove Host Intrusion Prevention (Host IPS) 8.0 from a Microsoft Server 2008 running with IIS 7.0, the ISAPI filter references are not removed from the IIS applicationHost.config file.

Edit the IIS 7.0 applicationHost.config file and remove the following configuration lines:

1. Click Start, Run, type explorer and click OK.
2. Navigate to: %windir%\system32\inetsrv\config
3. Open the file applicationHost.config as Administrator for editing in Notepad.
4. Edit the <globalModules> section and remove the following line:
   
   <add name="MfeEngine" image="%windir%\System32\inetsrv\HipIISEngineStub.dll" /> 
5. Edit the <modules> section and remove the following line:
   
   <add name="MfeEngine" /> 
6. After you have finished editing the applicationHost.config file, save the file, then restart the IIS server using iisreset or by restarting the system.

Default Calendar Permissions for Resources

By default, when you use the wizard to set up a room resource mailbox, you can only see the availability in when actually making a booking.
Often, users like to get an overview of the mailbox by opening the Calendar for that mailbox, but Exchange 2010 doesn't set that up.

To assign the permission of "Reviewer" to Everyone (aka Default), just enter this command in Powershell

Set-MailboxFolderPermission <alias>:\Calendar -User Default -AccessRights Reviewer

You can check that the change has taken effect with

[PS] C:\>Get-MailboxFolderPermission <alias>:\Calendar

RunspaceId   : 8123cde4-1ca5-3459-9b36-a46fcc01a22a
FolderName   : Calendar
User         : Default
AccessRights : {Reviewer}
Identity     : Default
IsValid      : True

RunspaceId   : 8123cde4-1ca5-3459-9b36-a46fcc01a22a
FolderName   : Calendar
User         : Anonymous
AccessRights : {None}
Identity     : Anonymous
IsValid      : True

I hope this helps you out, please click on one of the ads to show your appreciation.

Dell MD3200i + VMware ESX hanging issues

The Dell MD3200i SAN is a cheap(ish) effective storage device certified for VMware ESX.
I had no issues using it with a single ESX host, but when trying to use it with more than one host I was seeing hangs of the ESX servers, loss of connectivity from hosts to the VirtualCenter and strange logs saying that it couldn't communicate with the LUN.

Mar 24 19:56:11 virt08 vobd: Mar 24 19:56:11.295: 797333253337us: [esx.problem.vmfs.heartbeat.timedout] 4eb93a45-ea456b83-4c0a-0010189da888 disk03-1.

Mar 24 19:57:36 virt08 vobd: Mar 24 19:57:36.699: 797418651679us: [esx.problem.vmfs.heartbeat.recovered] 4eb93a45-ea456b83-4c0a-0010189da888 disk03-1.

After much going back and forth with Dell ensuring that I had the network configured with their latest recommendations (they keep changing it), they took al look at the stats on the network card of the MD3200i


========================================================================
                          TCP PORT STATISTICS - PORT 0                
========================================================================
  TCP Received Segments          0xf6f28bd
  TCP Tx Segments                0xd773310
  TCP Rx Segments In Error       0x0
  TCP Tx Byte Count              0x1a167dd174
  TCP Rx Byte Count              0x2683bbc3
  TCP reTx Timer Expired Count   0x584
  TCP Rx Dup ACK Count           0xa7890
  TCP RX ACK Count               0xee2915
  TCP Rx Delayed Ack Count       0x5a4256
  TCP Tx Ack Count               0x65098dc
  TCP Rx Seg Out Of Order Count  0x3242c
  TCP Rx Window Probe Count      0x0
  TCP Rx Window Update Count     0x49c


Here they saw high numbers of ACK issues (approximately 10% of all network transactions).

This prompted them to ask that I set up the IO queue depth and a delayed ACK workaround from VMware.

This immediately fixed my issue!

To change IO queue depth

esxcli nmp roundrobin setconfig --type "iops" --iops 1 --device <device UID>

Delayed ACK Workaround

Disabling Delayed ACK in ESX/ESXi 4.x and ESXi 5.0.x

1. Log in to the vSphere Client and select the host.
2. Navigate to the Configuration tab.
3. Select Storage Adapters.
4. Select the iSCSI vmhba to be modified.
5. Click Properties.
6. Modify the delayed ACK setting, using the option that best matches your site's needs:
   • Modify the delayed ACK setting on a discovery address (recommended):
     1. On a discovery address, select the Dynamic Discovery tab.
     2. Select the Server Address tab.
     3. Click Settings.
     4. Click Advanced.
   • Modify the delayed ACK setting on a specific target:
     1. Static Discovery tab.
     2. Select the target.
     3. Click Settings.
     4. Click Advanced.
   • Modify the delayed ACK setting globally:
     1. Select the General tab.
     2. Click Advanced.
7. In the Advanced Settings dialog box, scroll down to the delayed ACK setting.
8. Uncheck Inherit From parent.
9. Uncheck DelayedAck.
10. Reboot the host

This change should be safe to apply to all MD3xxx SANs, so you could just do the global change.

You should now have a fully working system

I hope this page helps you fix your problems, please click on an advert to show your appreciation.