Group Policy Concept

สรุปได้ดี
http://www.petri.co.il/working_with_group_policy.htm

Free update Server for NOD32

http://www.nod32.vareza.net/

http://nod32.multindopromotion.com/

http://antivirus.agri.cmu.ac.th:8081/

Remote Desktop User Group

โดย Default แล้ว user ที่มีสิทธิในการใช้ Remote Desktop เข้าไปที่เครื่อง Server ได้ก็คือ Administrators Group แต่บางทีเราต้องการให้ user ทั่วไปสามารถ remote เข้าไปได้ด้วย สามารถทำได้อย่างง่ายๆแค่ไป add user นั้นให้เข้าไปอยู่ใน Remote Desktop User Group แค่นั้นเอง

แต่จริงๆแล้วสิทธิของ RDP Group จะมาจาก Group Polocy ที่ชื่อว่า Allow log on through Terminal Services ที่อยู่ใน Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\ นั่นเอง

ซื่งการ แก้ไข Policy นี้สำหรับเครื่องที่เป็น Domain Controller มีอยู่หลายวิธีเช่นใช้ Domain Controller Group Policy จะมีผลกับ DC ทุกตัวใน Domain หรือจะสามารถแก้ไขจาก Local Group Policy (เรียกจากคำสั่ง gpedit.msc) ซึงจะมีผลกับ Server ที่เราแก้ Policy นี้เท่านั้น

วิธีการเรียก Local System Account ขึ้นมาใช้งาน

1. เปิด Command Prompt
2. ตั้งเวลาเรียก task manager ขึ้นมา
EX: at 3:11pm /interactive taskmgr.exe
3. Kill task explorer.exe
4. New task explorer.exe คราวนี้ explorer จะ run โดย Local System Account แล้ว
5. ทดสอบโดยการสั่งเปิด program อะไรก็ได้ขึ้นมาแล้วดูจาก task manager จะเห็นว่า run โดย System

Reboot Router from wget command line

ทดสอบใช้ได้กับ router Zyxel ส่วนยี่ห้ออื่นก็ไม่ต่างกัน

http://gnuwin32.sourceforge.net/packages/wget.htm
http://www.ieinspector.com/httpanalyzer/download.html
download version standalone มาจะดีกว่าเพราะสามารถดูผลได้จากการสั่งผ่าน IE หรือ Command line ก็ได้

วิธีที่ 1
wget --user=username --password=password --post-data IsReset=1 http://192.168.15.2/Forms/DiagGeneral_2
ข้อดีของการใช้ option --user ,--passwd ก็คือจะไม่มีปัญหากับ user หรือ password ที่มีตัวอักษรแปลกๆ

หรือ
wget --post-data IsReset=1 http://username:password@192.168.15.2/Forms/DiagGeneral_2

วิธีที่ 2 กรณีที่ไม่ต้องการให้รู้ว่า user/pass คืออะไรโดยทำการ encode user/pass ก่อน (แต่ก็มีวิธีการ decode ได้)
wget -E --header="Authorization: Basic ZnJlZDp0aGF0cyBtZQ==" --post-data IsReset=1 http://192.168.15.2/Forms/DiagGeneral_2

วิธีที่ 3 ใช้ autoit script

AutoItSetOption("WinTitleMatchMode",2)
AutoItSetOption("SendKeyDownDelay",50)

Run("cmd.exe","",@SW_MAXIMIZE)
sleep(1000)

WinActivate("cmd.exe")
WinWaitActive("cmd.exe")

Send("telnet 192.168.1.1{ENTER}")
Sleep(500)
Send("password{ENTER}")
Sleep(500)

Send("24{ENTER}")
Sleep(500)
Send("8{ENTER}")
Sleep(500)
Send("sys reboot{ENTER}")

ประโยชน์ของ IP Alias หรือ Secondary IP ของ Router

Example 1 Bypass Firewall (Basic) Example 2 Bypass Firewall + Separate Network (Complex)

การแก้ Dependency ของ php กับ php-pear ใน CentOS 4.4

จะทำให้ yum update ไม่ผ่าน แก้โดย
yum remove php
หรือ rpm -e php
rm -rf /var/cache/yum/

enable centosplus ใน repo

download php 5 จาก http://www.mirror.in.th/centos/4.4/centosplus/x86_64/RPMS
wget http://www.mirror.in.th/centos/4.4/centosplus/x86_64/RPMS/php-5.1.6-1.2.1.centos.x86_64.rpm

ถ้า install โดยใช้คำสั่ง rpm -ivh php-5.1.6-1.2.1.centos.x86_64.rpm มันจะ error เราต้อง install php-pear พร้อมๆกันเลย โดยเอา php-pear มาเก็บไว้ก่อน
wget http://www.mirror.in.th/centos/4.4/centosplus/x86_64/RPMS/php-pear-1.4.9-1.2.centos.noarch.rpm

แล้วสั่งใหม่ rpm -ivh rpm -ivh php-5.1.6-1.2.1.centos.x86_64.rpm php-pear-1.4.9-1.2.centos.noarch.rpm

เสร็จแล้วสั่ง yum update -y

อีกวิธีสั่ง rpm -Uvh
http://www.mirror.in.th/centos/4.4/centosplus/x86_64/RPMS/php-5.1.6-1.2.1.centos.x86_64.rpm http://www.mirror.in.th/centos/4.4/centosplus/x86_64/RPMS/php-pear-1.4.9-1.2.centos.noarch.rpm

Public DNS Server

Google DNS
8.8.8.8
8.8.4.4

OpenDNS
208.67.222.222
208.67.220.220

Level 3
4.2.2.2

True Intenet
203.144.207.29
203.144.207.49

Cat Telecom
61.19.245.245
61.19.245.246
202.129.27.133

KSC
203.155.33.1

Yum Yum

ก่อนที่จะใช้ yum ได้จะต้อง import GPG ก่อน
rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5
สำหรับ CentOS4 ใช้
rpm --import /usr/share/rhn/RPM-GPG-KEY-centos4

เสร็จแล้วก่อนอื่นสั่ง
yum update -y ก่อนเลย

วิธีการเพิ่ม Repository ให้กับ yum

import gpg key เพื่อตรวจสอบว่าข้อมูลของ package ไม่ได้ถูกแก้ไข
wget http://dag.wieers.com/packages/RPM-GPG-KEY.dag.txt
rpm --import RPM-GPG-KEY.dag.txt

cd /etc/yum.repos.d
สร้างไฟล์ชื่อ dag.repo แล้วเพิ่มข้อมูลดังนี้เข้าไป

[dag]
name=Dag RPM Repository for CentOS
baseurl=http://apt.sw.be/redhat/el$releasever/en/$basearch/dag
gpgcheck=1
enabled=1

ลองสั่ง yum install pine lynx -y ดู

ถ้าต้องการเอา package ออกให้สั่ง yum remove pine
ถ้าต้องการค้นหา package สั่ง yum search perl*
yum list available
yum list installed <- ดูว่า install อะไรอยู่บ้าง หรือ rpm -q
yum clean all <- clear disk space yum info lynx สั่ง schedule update โดยให้ yum ตอนกลางคืน
chkconfig yum on <- สั่งให้ yum ทำงานที่ run level ไหนบ้าง แต่ยังไม่ได้สั่งให้ทำงานจริงๆ service yum start <- สั่งให้ yum ทำงานNote
ส่วนใหญ่แล้ว Package ของ 3rd party จะใหม่กว่าของ Official แต่เราต้องการความ stable ของ Package จาก official จึงไม่แนะนำให้ update ทับ package ของ Official วิธีการทำแบบนี้ได้ต้องอาศัย pluginyum install yum-plugin-protectbaseแก้ไขไฟล์ /etc/yum.conf เพิ่มบันทัด plugins=1 เข้าไปแก้ไขทุกๆไฟล์ .repo ที่อยู่ใน /etc/yum.repos.d โดยเพิ่ม
protect=1 ให้กับ Official Repository
protect=0 ให้กับ 3rd party Repositaryเพราะว่า protect=0 จะไม่สามารถ update protect=1 ได้ถึงแม้ว่ามันจะใหม่กว่าก็ตามถ้าใน .repo มีการใส่ repository อยู่หลายแห่ง น่าจะต้องใส่เพิ่ม protect=0 ให้กับทุกๆที่Yum 3rd part: List of other repositorieshttp://www.ducea.com/2006/10/22/yum-3rd-part-list-of-other-repositories/

OpenVZ VS Xen, Vmware

The operating system level architecture(OpenVZ) has low overhead that helps to maximize efficient use of server resources. Due to a single-kernel approach, this type of virtualization introduces only a negligible overhead and allows running hundreds of virtual private servers on a single physical server. In contrast, approaches such as emulation (like VMware) and paravirtualization (like Xen or UML) cannot achieve such level of density, due to overhead of running multiple kernels. On the other hand, operating system-level virtualization does not allow running different operating systems (i.e. different kernels), although different libraries, distributions etc. are possible

Since there is a single OS kernel which maintains all the partitions, isolation and resource management become very important. Without proper isolation security can be compromised, and without proper resource management an application from one partition can abuse resources and thus cause a denial of service for other partitions. Resources controlled and limited can include: CPU time, disk space, I/O bandwidth, network access, and all the other finite resources like RAM, shared memory, locked pages, number of processes, socket buffers etc. For example, OpenVZ provide a set of more than 20 finite resources that are accounted and limited on a per-partition basis.
Compared to the hardware-assisted virtualization solutions (like IBM's LPAR), OS-level virtualization has the benefit of running on inexpensive commodity hardware

OS level virtualization solutions initially gained popularly with service providers who needed a very low overhead, customizable, cost effective solution to provide hosting services to customers. The technology is now becoming more widely deployed as many different industries and customers are recognizing the benefits and differences between OS virtualization and hardware virtualization. The common uses and scenarios now include server and OS consolidation, business continuity (disaster recovery and high availability) and centralized desktop virtualization.

An owner (root) of OpenVZ physical server (also known as Hardware Node) can see all the VE processes and files. That makes mass management scenarios possible. Consider that VMware or Xen is used for server consolidation: in order to apply a security update to your 10 virtual servers you have to log in into each one and run an update procedure – the same you would do with the ten real physical servers.
In OpenVZ case, you can run a simple shell script which will update all (or just some selected) VEs at once.

http://wiki.openvz.org/Introduction_to_virtualization

http://en.wikipedia.org/wiki/Operating_system-level_virtualization

Removing Old Network Card

Create environmental variable:
DEVMGR_SHOW_NONPRESENT_DEVICES=1
Reboot, then go into device manager and VIEW\SHOW HIDDEN DEVICES.
You will then see all of the hardware ghosts. Right click and uninstall under network adapters.

วิธีแก้ปัญหาของ Arcserve Backup กับ IE7

Problem:
BAB GUI does not work correctly after installing Internet Explorer 7.

Error "failed to create or open document" is received when:
1. Accessing the BAB GUI using Remote Desktop Connection or Terminal services.
2. Accessing the BAB GUI from a machine that has IE 7.0 and Novell Client installed on it.

Solution:
1. Shut down BAB GUI.
2. Rename psapi.dll located in c:\Program Files\CA\BrightStor ARCserve Backup to psapi.dll.org.
3. Start up BAB GUI.

ISA Publish PcAnywhere Host

1. ที่ Router ทำ Port Forward ให้ไปที่ external interface ของ ISA
2. สร้าง New Protocal ขึ้นมาเช่นให้ชื่อว่า PcEveryWhere แล้วกำหนด port ให้กับ protocal ดังนี้

Tomato Firmware

http://www.polarcloud.com/tomato
เป็น firmware ที่เสถียรดีมาก
สามารถสั่ง schedule reboot ได้จาก cron โดยใช้คำสั่ง ในหน้า Web Config/Administration/Scripts/Init
# cru a boot "0 0 * * * /sbin/reboot"
จะ reboot ตอนเที่ยงคืนของทุกๆวัน

Cron Utility
add: cru a <"min hour day month week command">
delete: cru d
list: cru l

Disable Remote Desktop/ Remote Assistance by GPO

Remote Desktop
Computer Configuration/ Administrative Templates/ Windows Components/ Terminal Services
Allow users to connect remotely using Terminal Services = Disable
Do not allow local administrators to customize permissions = Enable

Remote Assistance
Computer Configuration/ Administrative Templates/ System/Remote Assistance
Solicited Remote Assistance = Disable
Offer Remote Assistance = Disable

วิธีเปลี่ยน Port ของ Remote Desktop/ Terminal Server

ไปที่ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

ที่ subkey PortNumber ให้เปลี่ยนเป็น port ที่ต้องการ เช่น 3388 (default คือ port 3389)
เสร็จแล้ว reboot ก่อน 1 ครั้ง

การ connect จากเครื่อง Client ให้ใส่ port number หลังจากชื่อหรือ ip server เช่น

192.168.0.1:4000 หรือ myserver.com:8000

Configure RDP over SSL with SelfSSL

Windows 2003 Service Pack 1 included a new feature, RDP over SSL. This feature will allow you to use TLS authentication and encryption with your RDP connections using SelfSSL to create the SSL certificate. It still uses RDP and TCP port 3389 so your firewall rules should not need to be modified.

Before we get started there are a few pre-requisites on both the server side and client side that need to be met first.

Server-side

- The Terminal Server must run 2003 SP1
- The Terminal Server must have a certificate from a Windows CA or a 3rd Party CA
- The certificate must meet the following criteria
- Certificate is a computer certificate
- Certificate is for server authentication
- Certificate must have a private key
- Certificate is stored in the TS personal store
- Certificate has a Crytographic Service Provider that can be used for TLS/SSL

Client-side

- Must run Windows 2000, Windows XP, or Windows 2003
- Must use RDP Client 5.2, this can be found on the 2003 SP1 server under %systemroot%system32clientstsclientwin32msrdpcli.msi
- Must trust the root CA for the certificate

If you do not have a CA, don't wish to spend money on a "real" SSL cert, or just want to do some testing, you can use SelfSSL from the IIS 6.0 Resource Kit. Once you have downloaded and installed SelfSSL, run it with the following command

SelfSSL.exe /CN=domain.com /V:365



The command will create and install a certificate for domain.com that is valid for 365 days. If you do not have IIS installed, you may get an error message but you can ignore this message, the SSL certificate is still created and installed. The CN must be the name you will be accessing the TS with.

Next open up Administrative Tools, and launch the Terminal Server Configuration applet. Right-click RDP-Tcp and select properties.



Click Edit next to the Certificate, you will be shown the SSL certificate that SelfSSL created. Select it and click OK



Next, select SSL from the Security Layer drop down box and set the Encryption Level to High.



Now you will need to install the new RDP client on all workstations that will be accessing the Terminal Server. You will notice a new tab under the connection properties called Security. Select this tab and then choose Require Authentication from the drop down.



When you try to connect, you will be denied access because the SSL cert is not trusted. Click View Certificate, and then Install to install the certificate to the local machines certificate store.



Attempt to connect again and the connection will be allowed. You are now connected through RDP over SSL. If you are connected in full screen mode, you will see the SSL lock symbol next to the pushpin in the yellow toolbar.

For more information see:

Windows Time Services

เครื่องทุกเครื่องที่อยู่ใน Domain จะ Sync time มาจาก PDC Master แล้ว PDC Master ก็จะ Sync time มาจาก Time Server ภายนอกอีกทีปกติแล้วจะเป็น time.windows.com เราวิธีตรวจสอบว่า Sync time มาจากไหนได้จากคำสั่ง
net time /querysntp

For Windows XP
ถ้าต้องการเปลี่ยน time server ใช้คำสั่ง
net time /setsntp:pool.ntp.org
เสร็จแล้วสั่ง restart windows time service จากคำสั่ง
net stop w32time
net start w32time

For Windows Server 2003

net time /setsntp:pool.ntp.org
w32tm /config /update
w32tm /resync /rediscover /nowait

ถ้ายังไม่ได้ผลให้ลงโปรแกรม SP TimeSync ที่เครื่อง Domain Controller ที่เป็น PDC Master (หา PDC Master ได้จาก Active Directory User and Computer ตรง Operation Master) เลือก Version ที่เป็น Unicode สำหรับ Windows Server 2003

Terminal Server Performance Tweaks

The first thing to do is to override some desktop settings to reduce the amount of screen refreshes, which lowers bandwidth used, which makes the TS respond "faster". First we will remove Windows Resize Animation, when a user minimizes or maximizes a window it will be immediate, and not shrink slowly on its way down to the task bar. Open up the registry with regedit and browse to:

HKLMSYSTEMCurrentControlSetControlTerminalServerWinStationsRDP-TcpUserOverrideControl PanelDesktop

And change these values:

"AutoEndTasks" REG_SZ "1" (terminates programs that aren’t responding)
"CursorBlinkRate" REG_SZ "-1" (prevents the cursor from blinking, cutting down on screen redraws)
"DragFullWindows" REG_SZ "0" (disables "show contents" while dragging a window)
"MenuShowDelay" REG_SZ "10" (delay for showing submenus)
"WaitToKillAppTimeout" REG_SZ "20000" (number of milliseconds to wait before terminating an application that has stopped responding)
"SmoothScroll Dword" REG_DWORD "00000000" (disables smooth scrolling)
"Wallpaper" REG_SZ "(none)" (disables wallpaper)

Now browse over to:

HKLMSYSTEMCurrentControlSetControlTerminalServerWinStationsRDP-TcpUserOverrideControl PanelDesktopWindowMetrics

And change this value:

"MinAnimate" REG_SZ "0" (disables the animation when resizing a window)

If any of these keys, subkeys or values do not exist, create them. This will not really improve server performance but it will enhance the user experience and make it appear to be faster to end users, which hopefully cuts down on complaints. For your convenience I have written a REG file which you can get here. Save as tsperf.reg and run it on the terminal server.

Terminal Services Command Line Administration

Managing your Windows 2003 Terminal Server can be done faster and easier with a few simple command line tools. There are a lot of them so hang on!

Change User - When installing applications on a terminal server you must be in Install Mode. To toggle the system between Install and Execute Modes, you can use the Change User commands.

To switch to Install Mode:
CHANGE USER /install

To switch to Execute Mode:
CHANGE USER /execute

Change Logon - To quickly disable or enable the ability to logon to the terminal server you can use the Change Logon command. This will not affect currently logged on users.

To enable new logons:
CHANGE LOGON /enable

To disable new logons:
CHANGE LOGON /disable

Query TermServer - Lists all terminal servers in the current domain.

QUERY TERMSERVER [/domain:domain] [/address][/continue]

/domain:domain - specifies the domain (current logged on domain is default)
/address - lists the IP address of the terminal server
/continue - removes the pause between ouput screens

Query Session - Lists all current sessions running on a terminal server.

QUERY SESSION [sessionname username sessionid][/server:servername] [/mode] [/flow] [/connect] [/counter]

sessionname is the name of the session that you want to query
username is the name of the user you want to query
sessionid is the ID of the session you want to query
/server:servername is the name of the server you are querying
/mode outputs the current line settings
/flow outputs the current flow control settings
/connect outputs the current connection settings
/counter outputs the counter information for the server

Query User or Quser - Lists all current users on a terminal server

QUERY USER [username sessionname sessionid] [/server:servername]

sessionname is the name of a specific session that you want to query
username is the name of the specific user you want to query
sessionid is the ID of the specific session you want to query
/server:servername is the name of the server you are querying

Query Process - Lists all processes running on the terminal server.

QUERY PROCESS [ x processid username sessionname /id:nn programname] [/server:servername] [/system]

x lists information on all processes (note - replace x with an asterisk)
processid lists information about only the specific process ID
username lists processes running under the context of a specific user
sessionname lists processes running under the context of a specific session
/ID:nn lists processes running in the session with the specified session ID number
programname lists all processes started by the specified executable
/server:servername is the name of the server you are querying—the default is the server
you are logged on to
/system lists processes running under the system context

TSShutdn - Will shutdown/reboot the terminal server after a specified delay.

TSSHUTDN [wait_time] [/server:servername] [/reboot] [/powerdown] [/delay:logoffdelay] [/v]

wait_time is the number of seconds to wait after notifying the users that the terminal
server is about to shut down before forcibly logging them off (the default is 30 seconds)
/server:servername is the name of the server to reboot/shutdown (the default is the server
to which you are connected)
/reboot reboots the server
/powerdown powers down the server after Windows has shutdown; the server’s BIOS
must support this command
/delay:logoffdelay the number of seconds to wait after logging out all users before
shutting down the system (the default is 30 seconds)
/v displays verbose information about actions being performed

Logoff - Will logoff the specified user off the terminal server and close the session. Caution, if you don't specify a user it will log you off!

LOGOFF [sessionid sessionname] [/server:servername] [/v]

sessionid is the ID of the session you want to logoff
sessionname is the name of the session you want to logoff
/server:servername specifies the name of server on which the session you want to logoff is running /v displays verbose information about actions being performed

Reset Session - Will kill the specified users session without warning which can be useful when a users session is stuck. Caution, if you don't specify a user it will kill your session!

RESET SESSION [sessionname sessionid] [/server:servername] [/v]

sessionid is the ID of the session you want to logoff
sessionname is the name of the session you want to logoff
/server:servername specifies the name of server on which the session you want to logoff is running /v displays verbose information about actions being performed

MSG - Will popup a message on the specified user(s) terminal server session.

MSG [username sessionname sessionid @filename x ][/server:servername] [/time:seconds] [/v] [/w] message

username is the name of the user to whom you are sending the message
sessionname is the session name to which you want to send the message
sessionid is the ID number of the session to which you want to send the message
@filename is the name of a text file containing usernames, sessionnames, or session IDs
to which you want to send the message
x sends the message to all users on the current or specified server (note - replace x with an asterisk)
/server:servername specifies the server where recipients of the message are connected
/time:seconds the number of seconds to display the message before the popup closes itself
/v displays information about the message as it is sent
/w causes the popup window to wait for the user to click OK before closing
message is the text of the message to send

Shadow - Will allow you to shadow or take control of a users session.

SHADOW [sessionname sessionid] [/server:servername] [/v]

sessionid is the ID of the session you want to logoff
sessionname is the name of the session you want to logoff
/server:servername specifies the name of server on which the session you want to logoff is running /v displays verbose information about actions being performed

TSProf - Will update, copy or display the Terminal Server users profile path and/or data.

TSPROF /update [/domian:domainname /local] /profile:path username

TSPROF /copy [/domian:domainname /local] [/profile:path] src_user dest_user

TSPROF /q [/domian:domainname /local] username

/update populates the user domainnameusername’s Terminal Services profile path
/copy copies the Terminal Services profile from the source (src_user) to a different user (dest_user)
/q displays the Terminal Services Profile path for the specified user