RE: Exchange 5.5 and folder structure

[Bunting, Jeff]

Also, if you're still short on space you can run the Optimizer program to
move the log directories to another drive that has more room to grow.

Jeff

-Original Message-
From: Tim VanDeWalle [mailto:[EMAIL PROTECTED]]
Sent: Friday, September 28, 2001 12:25 PM
To: NT System Admin Issues
Subject: RE: Exchange 5.5 and folder structure


Though it does not exactly apply in this case, there is a trick I picked up
that can sometimes help in drive full situations. If it is a logfile, or in
the cases I've used it for, the transaction logs for Exchange, compress the
folder they are in. This allows you to start the services again, run a
backup, clean/clear the logs, and then uncompress the folder again. The
performance hit from compression is tremendous in a production environment,
but it can get some free space to work in for recovering the server or at
least getting a current backup made before rebuilding. 

-Tim VanDeWalle
Information Systems/Product Testing
Evergreen Technologies, Inc
[EMAIL PROTECTED]



-Original Message-
From: Matthew Oppermann [mailto:[EMAIL PROTECTED]]
Sent: Friday, September 28, 2001 8:15 AM
To: NT System Admin Issues
Subject: RE: Exchange 5.5 and folder structure


I gave a shout the MS Newsgroups and got an answer, not very explicit but an
answer.

Thanks for the followup.

Matt Oppermann

-Original Message-
From: Lefkovics, William [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 27, 2001 2:37 PM
To: NT System Admin Issues
Subject: RE: Exchange 5.5 and folder structure


Did you get an answer for this, Matthew?

Section 3.27-3.29:
http://www.swinc.com/resource/exch_faq_sec3.htm

William Lefkovics, WLKMMAS, MCSE, A+

-Original Message-
From: Matthew Oppermann [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 27, 2001 9:49 AM
To: NT System Admin Issues
Subject: Exchange 5.5 and folder structure


Hi all,

I came in to find our primary partition on our exchange server full.  There
are 3 folders in c:\exchsrvr\imcdata named 'in', 'log', and 'out'.  The 'in'
and 'out' folders each contain 1.30 GB of data in some type of log file
form.  The 'log' folder contains 760 MB of data.  I do not know the
structure of exchange very well, and I am wondering if I can delete the
files in these folders.  Will they re-replicate?  Will this kill the
exchnage server?

These seem to be the individual transactions that have been processed
through the exchange server, but they do not remove themselves.  They are
not my users mailboxes because I have them setup on another larger
partition.  Does anyone know what these files are for sure?

Thanks in Advance,

Matt Oppermann
Systems Administrator
Symbiotics, Inc.

Want to unsub? Do that here:
http://www.w2knews.com/rd/rd.cfm?id=unsub
Need a good FAQ? Try this one first:
http://www.ultratech-llc.com/KB/

Want to unsub? Do that here:
http://www.w2knews.com/rd/rd.cfm?id=unsub
Need a good FAQ? Try this one first:
http://www.ultratech-llc.com/KB/

Want to unsub? Do that here:
http://www.w2knews.com/rd/rd.cfm?id=unsub
Need a good FAQ? Try this one first:
http://www.ultratech-llc.com/KB/

Want to unsub? Do that here:
http://www.w2knews.com/rd/rd.cfm?id=unsub
Need a good FAQ? Try this one first:
http://www.ultratech-llc.com/KB/

RE: Netshield & Dr.Watson: together again!

[Bunting, Jeff]

Title: Out of Buffer Error



Would 
you happen to have a link to a download page handy?  I searched for updates 
on the McAfee site prior to posting my message and didn't find anything.  
Someone told me of a hotfix that fixes the problem I mentioned, but I wonder is 
SP2 supercedes the hotfix.
 
Jeff

  -Original Message-From: Terry Dickson 
  [mailto:[EMAIL PROTECTED]]Sent: Friday, September 28, 
  2001 7:11 AMTo: NT System Admin IssuesSubject: Re: 
  Netshield & Dr.Watson: together again!
  Yes I have had that problem.  In my case it 
  was related to the particular version of McAfee running and the Version of 
  Dats.  I finally found and downloaded the latest Service Pack from McAfee 
  for the Corporate Version 4.5 it is actually Service Pack 2.  This 
  resolved the problems we were having.  I believe that if you are using 
  dats above 4130 this will happen without this Service Pack.
   
   
  Terry Dickson
  Network ManagerKansas State Treasurer900 SW JacksonSuite 
  201NTopeka KS 66612-1235Phone 
  785.296.6200Fax 
  785.296.7068Email [EMAIL PROTECTED]
  
- Original Message - 
From: 
    Bunting, 
Jeff 
To: NT System Admin Issues 

Sent: Thursday, September 27, 2001 8:20 
PM
Subject: Netshield & Dr.Watson: 
together again!

Has anyone else had any problems with recent DAT updates?  I 
have a couple of servers that have MCSHIELD crashing a few times a 
day.   
 
JeffWant to unsub? Do that here:http://www.w2knews.com/rd/rd.cfm?id=unsubNeed 
a good FAQ? Try this one first:http://www.ultratech-llc.com/KB/Want 
  to unsub? Do that here:http://www.w2knews.com/rd/rd.cfm?id=unsubNeed a 
  good FAQ? Try this one 
first:http://www.ultratech-llc.com/KB/
Want to unsub? Do that here:
http://www.w2knews.com/rd/rd.cfm?id=unsub
Need a good FAQ? Try this one first:
http://www.ultratech-llc.com/KB/

Net outage??

[Bunting, Jeff]

Anyone else noticing routing problems tonight (10pm EDT)?  I'm wondering if
there's some sort of major outage going on somewhere.  I'm haing traceroutes
fail theough several different networks (AT&T, Bell Atlantic, Sprint,
others)

Jeff

Want to unsub? Do that here:
http://www.w2knews.com/rd/rd.cfm?id=unsub
Need a good FAQ? Try this one first:
http://www.ultratech-llc.com/KB/

Netshield & Dr.Watson: together again!

[Bunting, Jeff]

Title: Out of Buffer Error



Has 
anyone else had any problems with recent DAT updates?  I have a couple of 
servers that have MCSHIELD crashing a few times a day.   

 
Jeff
Want to unsub? Do that here:
http://www.w2knews.com/rd/rd.cfm?id=unsub
Need a good FAQ? Try this one first:
http://www.ultratech-llc.com/KB/

RE: Nimda

[Bunting, Jeff]

404 is a page not found error, which is a good thing.  It indicates the
server couldn't find the requested file.  As long as these URLs aren't
showing up anywhere in your good page requests reports you shouldn't have to
worry.

-Original Message-
From: Willis Olivo [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, September 25, 2001 5:56 PM
To: NT System Admin Issues
Subject: Nimda


Hi,

I am evaluating Webtrends Log Analyzer and found this in the reports.

Is this indicative of infection or failed attemps to infect?

Page Not Found (404) Errors  
 
Target URL and Referrer Hits% of 404 Hits 
/winnt/system32/cmd.exe
(no referrer)   74  22.42% 
/MSADC/root.exe
(no referrer)   45  13.63% 
/scripts/root.exe
(no referrer)   45  13.63% 
/c/winnt/system32/cmd.exe
(no referrer)   43  13.03% 
/d/winnt/system32/cmd.exe
(no referrer)   42  12.72% 
/_mem_bin/..\../..\../..\../ winnt/system32/cmd.exe
(no referrer)   41  12.42% 
/scripts/winnt/system32/ cmd.exe
(no referrer)   38  11.51% 
/images/Default3_r3_c5_f2.gif
(no referrer)   2   0.6% 
Total for Pages Above   330 100%  


Thanks
Willis
Want to unsub? Do that here:
http://lyris.sunbelt-software.com/scripts/lyris.pl?enter=ntsysadmin&text_mod
e=0&lang=english


Want to unsub? Do that here:
http://www.w2knews.com/rd/rd.cfm?id=unsub
Need a good FAQ? Try this one first:
http://www.ultratech-llc.com/KB/

RE: howto Stop NT DNS Inverse Queries?

[Bunting, Jeff]

That should do it.  You may need to keep a reverse lookup entry for your
mail server though.  Some mail servers will not accept mail from a server it
cannot reverse resolve.

Jeff

-Original Message-
From: Nguyen, Ken [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 27, 2001 11:28 AM
To: NT System Admin Issues
Subject: RE: howto Stop NT DNS Inverse Queries?


I think you have to delete all your in-addr zones on your DNS server.

-Original Message-
From: Osama S. [mailto:[EMAIL PROTECTED]] 
Sent: Thursday, September 27, 2001 6:52 AM
To: NT System Admin Issues
Subject: howto Stop NT DNS Inverse Queries?

Hi,

anyone knows how to stop "Invers Query iquery" on an NT 4.0 DNS server?
My vulnarability software was recommending that, but didn't tell how to do
that.

regards

Uso

Want to unsub? Do that here:
http://www.w2knews.com/rd/rd.cfm?id=unsub
Need a good FAQ? Try this one first:
http://www.ultratech-llc.com/KB/

Want to unsub? Do that here:
http://www.w2knews.com/rd/rd.cfm?id=unsub
Need a good FAQ? Try this one first:
http://www.ultratech-llc.com/KB/

Want to unsub? Do that here:
http://www.w2knews.com/rd/rd.cfm?id=unsub
Need a good FAQ? Try this one first:
http://www.ultratech-llc.com/KB/

RE: ASP's anonymously?

[Bunting, Jeff]

Check the IIS properties for the web site.  On the directory security tab,
check the anonymous access and authentication control and make sure
anonymous access is selected there and that the username/password are
correct.

Jeff

-Original Message-
From: Eric P [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 27, 2001 12:15 PM
To: NT System Admin Issues
Subject: ASP's anonymously?


I recently installed Win2K server, w/IIS, and all the latest MS patches
including the Lockdown tool. During the lockdown, I deselected the option
to lockdown ASP's as I needed this functionality. Normal pages load fine
for the anonymous user but ASP's always prompt for authentication. After
authenticating, the ASP loads fine. So my ASP's are working, just not as
an anonymous user. Other HTM, HTML's work fine as an anonymous user. Both
IUSR_username and IUSR_machinename have RX permissions to these ASP's. Any
suggestions?


Want to unsub? Do that here:
http://www.w2knews.com/rd/rd.cfm?id=unsub
Need a good FAQ? Try this one first:
http://www.ultratech-llc.com/KB/

Want to unsub? Do that here:
http://www.w2knews.com/rd/rd.cfm?id=unsub
Need a good FAQ? Try this one first:
http://www.ultratech-llc.com/KB/

RE: Sending 0ut 0f 0ffice replies w/ Outlook

[Bunting, Jeff]

The problem is that the Outlook rules only run while the client is open.
The change Server processes the OOO rule when your mail arrives there.  If
you left Outlook running and set a rule to auto reply to all messages
(excepting your mailing lists) with an OOO message I think it would work.
You'd also have to have it periodically connect to the mail server.  

The weak side to this arrangement is if your computer crashes, someone else
closes Outlook, you have a power outage, etc. then the auto reply stops
working.

Jeff

-Original Message-
From: John Hornbuckle [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, September 26, 2001 10:14 AM
To: NT System Admin Issues
Subject: RE: Sending 0ut 0f 0ffice replies w/ Outlook


That was my impression, too, but I was hoping that there was another
way. It seems like rules should be powerful enough to accomplish this
somehow without requiring any special functionality on the part of the
SMTP server...



John Hornbuckle
Network Manager
Taylor County School District
318 North Clark Street
Perry, FL 32347 



-Original Message-
From: Ian Kelly [mailto:[EMAIL PROTECTED]] 
Sent: Wednesday, September 26, 2001 9:49 AM
To: NT System Admin Issues
Subject: RE: Sending 0ut 0f 0ffice replies w/ Outlook


Exeverything in OL2002 points to needing Exchange for this...I could be
wrong though...!

Ian

-
[EMAIL PROTECTED]
-
 


-Original Message-
From: John Hornbuckle [mailto:[EMAIL PROTECTED]] 
Sent: September 26, 2001 09:33 AM
To: NT System Admin Issues
Subject: OT: Sending 0ut 0f 0ffice replies w/ Outlook


I really ate to post OT like this, but I can't seem to find the answer
to this one.

How do I configure Outlook (XP/2002) to automatically send out-of-office
replies if I'm NOT using Exchange as my e-mail server? Is this even
possible? I've found lots of info on how to do it with Exchange, but not
without.

And if it's possible to do without Exchange, how do I go about making
sure that I don't send them to mailing lists? I've been so critical of
others who do this that I would be terribly embarrassed to do it myself!



John Hornbuckle
Network Manager
Taylor County School District
318 North Clark Street
Perry, FL 32347 


Want to unsub? Do that here: http://www.w2knews.com/rd/rd.cfm?id=unsub
Need a good FAQ? Try this one first: http://www.ultratech-llc.com/KB/


Want to unsub? Do that here: http://www.w2knews.com/rd/rd.cfm?id=unsub
Need a good FAQ? Try this one first: http://www.ultratech-llc.com/KB/



Want to unsub? Do that here:
http://www.w2knews.com/rd/rd.cfm?id=unsub
Need a good FAQ? Try this one first:
http://www.ultratech-llc.com/KB/

Want to unsub? Do that here:
http://www.w2knews.com/rd/rd.cfm?id=unsub
Need a good FAQ? Try this one first:
http://www.ultratech-llc.com/KB/

RE: Create a Registry File

[Bunting, Jeff]

An easy way to see the proper format is to export a key from regedit and
then open it in notepad.

Jeff

-Original Message-
From: Khurram Chaudhary [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, September 25, 2001 5:07 PM
To: NT System Admin Issues
Subject: Create a Registry File


Does anyone know how to create a registry file that will modify certain
keys and values?

Khurram Chaudhary
Astley-Gilbert Reproductions
[EMAIL PROTECTED]

Want to unsub? Do that here:
http://lyris.sunbelt-software.com/scripts/lyris.pl?enter=ntsysadmin&text_mod
e=0&lang=english

Want to unsub? Do that here:
http://lyris.sunbelt-software.com/scripts/lyris.pl?enter=ntsysadmin&text_mode=0&lang=english

RE: Exchange 5.5 and GroupShield

[Bunting, Jeff]

The 
latest engine is 4.1.40 which I think is required to detect some of the more 
recent viruses.  I'd upgrade it ASAP.
 
Jeff

  -Original Message-From: Dianne 
  [mailto:[EMAIL PROTECTED]]Sent: Monday, September 24, 2001 9:21 
  PMTo: NT System Admin IssuesSubject: Re: Exchange 5.5 
  and GroupShield
  Version is 4.5.572.128 Engine 4.0.70
  
- Original Message - 
From: 
Clark, 
Steve 
To: NT System Admin Issues 

Sent: Monday, September 24, 2001 7:41 
PM
Subject: RE: Exchange 5.5 and 
GroupShield


Groupshield 
4.5 SP1 will allow you to block extensions as well as filenames. Are you 
using 4.5.1?
 
Steve 
Clark
Clark 
Systems Support, LLC
AVIEN 
Charter Member
“Who's 
watching your network?”
www.clarksupport.com
  
301-610-9584 voice
  
240-465-0323 Efax
 
-Original 
Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]Sent: Monday, September 24, 2001 6:58 
PMTo: NT System Admin 
IssuesSubject: Exchange 
5.5 and GroupShield
 
Anyone know how to 
block BOTH specific file extensions and file names in GroupShield?  
Looks like it's an "either or" configuration so for example, I can't block 
all .vbs and wtc.exe without blocking all .exe files.
 
Thanks
http://www.sunbelt-software.com/ntsysadmin_list_charter.htmhttp://www.sunbelt-software.com/ntsysadmin_list_charter.htmhttp://www.sunbelt-software.com/ntsysadmin_list_charter.htm
Want to unsub? Do that here:
http://lyris.sunbelt-software.com/scripts/lyris.pl?enter=ntsysadmin&text_mode=0&lang=english

RE: Is that a fake or what, can anyone help?

[Bunting, Jeff]

And the hoaxes never have a link to a virus site to corroborate their
claims.  If CNN was really reporting about this wouldn't it be on their web
site???

-Original Message-
From: Peter Adriaanse [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, September 25, 2001 6:51 AM
To: NT System Admin Issues
Subject: RE: Is that a fake or what, can anyone help?


What's also a dead giveaway is the use of CAPITALS, and the "SEND TO
EVERYONE" bit..


Kind regards,
Peter Adriaanse


Offer your condolences to the US of A - http://dutchee.d2g.com

Help fight cancer - Download the agent from http://members.ud.com/download/,
then go to
http://members.ud.com/services/teams/team.htm?id=9882803B-9A10-47CD-A9B8-678
2985E00F5 to join Dutchee's team.


-Original Message-
From: Les Bessant [mailto:[EMAIL PROTECTED]]
Sent: 25 September 2001 11:38
To: NT System Admin Issues
Subject: RE: Is that a fake or what, can anyone help?


Old, old hoax.

See: http://www.vmyths.com/hoax.cfm?id=222&page=3

Always worth checking at Vmyths, or the site of your preferred AV software
supplier before posting on the list.

Les Bessant mailto:[EMAIL PROTECTED]
IT Manager, Sanderson Townend & Gilbert
Acting in a personal capacity
http://www.tiggercam.co.uk - Tiggers don't like hoaxes


-Original Message-
From: Pavel Pronin [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, September 25, 2001 7:10 AM
To: NT System Admin Issues
Subject: Is that a fake or what, can anyone help?


Please see the email below is that fake or what?


Heads up.
>
> WORST EVER VIRUS (CNN announced)
>
> PLEASE SEND THIS TO EVERYONE ON YOUR CONTACT LIST !!
>
> A new virus has just been discovered that has been classified by Microsoft
as
> the most destructive ever!
>
> This virus was Discovered yesterday afternoon by McAfee and no vaccine
has
> yet been developed.
>
> This virus simply destroys Sector Zero from the hard disk, where vital
> information for its functioning are stored.
>
> This virus acts in the following manner: It sends itself automatically to
all
> contacts on your list with the title "A Virtual Card for You."
>
> As soon as the supposed virtual card is opened, the computer freezes so
that
> the user has to reboot.
>
> When the ctrl+alt+del keys or the reset button are pressed, the virus
> destroys Sector Zero, thus permanently destroying the hard disk.
>
> Yesterday in just a few hours this virus caused panic in New York,
according
> to news broadcast by CNN.
>
> This alert was received by an employee of Microsoft. So don't open any
mails
> with subject: "A Virtual Card for You." As soon as you get the mail,
delete it.
>
> Please pass this mail to all of your friends. Forward this to everyone in
> your address book.
>
> I would rather receive this 25 times than not at all.
>
> Also: Intel announced that a new and very destructive virus was discovered
> recently.
>
> If you receive an email called "An Internet Flower For You," do not open
it.
>
> Delete it right away! This virus removes all dynamic link libraries (.dll
> files) from your computer. Your computer will not be able to boot up !!

Thanks in advance,
Pronin Pavel
IT Manager
CAR SMED Project
Ph: (312) 66-59-12
Fax: 66-58-82
[EMAIL PROTECTED]
www.casme.net



_
This message has been checked for all known viruses by Star Internet
delivered through the MessageLabs Virus Scanning Service. For further
information visit http://www.star.net.uk/stats.asp or alternatively call
Star Internet for details on the Virus Scanning Service.


The information in this communication and any attachments is confidential
and may be legally privileged. It is intended solely for the addressee. If
you are not the intended recipient any use, review, dissemination,
distribution or copying of this information is strictly prohibited. If you
have received this communication in error please notify us immediately on
0191 261 2681 and delete the original message and any copies of it.

Any opinions, conclusions or other information in this message that do not
relate to the official business of Sanderson Townend & Gilbert are neither
given nor endorsed by the firm.


_
This message has been checked for all known viruses by Star Internet
delivered through the MessageLabs Virus Scanning Service. For further
information visit http://www.star.net.uk/stats.asp or alternatively call
Star Internet for details on the Virus Scanning Service.

Want to unsub? Do that here:
http://lyris.sunbelt-software.com/scripts/lyris.pl?enter=ntsysadmin&text_mod
e=0&lang=english




Want to unsub? Do that here:
http://lyris.sunbelt-software.com/scripts/lyris.pl?enter=ntsysadmin&text_mod
e=0&lang=english

Want to unsub? Do that here:
http://lyris.sunbelt-software.com/scripts/lyris.pl?enter=ntsysadmin&text_mode=0&lang=english

RE: OT : Code name for Win98

[Bunting, Jeff]

yep, it was Memphis

-Original Message-
From: Andrew Baker [mailto:[EMAIL PROTECTED]]
Sent: Monday, September 24, 2001 3:53 PM
To: NT System Admin Issues
Subject: RE: OT : Code name for Win98


Memphis, IIRC.

 
- ASB
 


-Original Message-
From: David N. Precht [mailto:[EMAIL PROTECTED]]
Sent: Monday, September 24, 2001 3:41 PM
To: NT System Admin Issues
Subject: OT : Code name for Win98


Guys and Gals-
Do you guys remember the code name for Win98 ?

Regards
Dave


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: How do you enable attachments in Win 2k and Outlook 2k?

[Bunting, Jeff]

Title: How do you enable attachments in Win 2k and Outlook 2k?



see
http://www.microsoft.com/Office/ORK/2000/journ/outsecupdate.htm

  -Original Message-From: Daniel Kim 
  [mailto:[EMAIL PROTECTED]]Sent: Monday, September 24, 
  2001 3:23 PMTo: NT System Admin IssuesSubject: How do 
  you enable attachments in Win 2k and Outlook 2k?
  Quick question.  Is there an easy way to 
  enable attachments in Outlook 2000/Exchange 5.5 in Win 2k Pro?  The 
  attachments are viewable under NT 4 and Outlook 2k/Exchange 5.5.
  I know Win 2k disables the ability to view 
  attachments such as *.mdb, *.exe, etc.  It simplifies our lives 
  considerably to email things from client sites back to the office via email 
  and its getting to be a pain because the Win 2k Pro WS won't allow us to view 
  the attachments.
  Thanks for any help. 
  Daniel C. Kim, MCP SoftSolutions 540.345.1045 
  X209 540.345.0942 Fax www.SoftSolutionsIT.com www.FactoryAnalyzer.com 
  http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Looking for a discussion on IM

[Bunting, Jeff]

Is 
this what you were talking about?
http://icat.nist.gov/icat.cfm?cvename=CVE-2000-1094

  -Original Message-From: Kevin Lundy 
  [mailto:[EMAIL PROTECTED]]Sent: Monday, September 24, 2001 
  9:35 AMTo: NT System Admin IssuesSubject: RE: Looking 
  for a discussion on IM
  You 
  know, I violated a cardinal rule of mine - don't post something if you can't 
  back it up.  I did have a reference and now can't find it.  I did 
  find a similar exploit in the Yahoo messenger.  I'm still pretty 
  confident I did read about either a real attack via the icon, or at least a 
  proof of concept, and I will keep looking for it.  Anyway, the below is 
  an exploit against an IM, so it shows it is vulnerable.  
  
   
  From 
  http://www.ca.com/virusinfo/encyclopedia/
   
  
  Yahoo Pager/Messanger Buffer OverflowThere is a buffer overflow 
  problem with Yahoo Messenger that leaves the user vulnerable to remote attack. 
  The problem arises due to a lack of appropriate bounds checking on the length 
  of a URL that is received from another user inside a message. Unfortunately, 
  due to this oversight, it is possible for unprivileged and possibly hostile 
  remote users to execute arbitrary commands by overwriting the EIP (return 
  address) and filling the URL with malevolent code. The hostile code could then 
  be actioned when the unsuspecting target host clicks on the URL. 
  
  
-Original Message-From: Gordon W. Smith 
[mailto:[EMAIL PROTECTED]]Sent: Monday, September 24, 2001 9:07 
AMTo: NT System Admin IssuesSubject: RE: Looking for a 
discussion on IM
OUCH!  A virus in a smiley?  Tell me more!  I couldn't 
find anything about it.

  -Original Message-From: Kevin Lundy 
  [mailto:[EMAIL PROTECTED]]Sent: Monday, September 24, 2001 
  7:50 AMTo: NT System Admin IssuesSubject: RE: 
  Looking for a discussion on IM
  Two things come to immediate mind:
   
  1) Many IM clients allow for file transfer.  Depending on your 
  overall security policy this in itself can be an issue.  Even if you 
  allow people to transfer files, the IM client then becomes a point of 
  security control.  For example, with AIM, it is supposed to ask the 
  user if it is ok if their chat partner sends them a file.  How long 
  do you think it will be before hackers manage to bypass that 
  "confirmation"?  Further, then they bad-guys could then just send a 
  backdoor program to the hard disk.  Or just pick up sensitive data 
  from the computer.
   
  2) There has already been at least one IM based virus - done by 
  embedding malicious code in an icon smiley face.  This becomes 
  another area where the anti-virus vendors have to keep 
  up. 
   
  I'm sure there are other reasons as well, those are just the 2 that 
  come to my mind before finishing my first cup of 
  coffee.
  
-Original Message-From: Clark, Steve 
[mailto:[EMAIL PROTECTED]]Sent: Sunday, September 23, 
2001 11:17 PMTo: NT System Admin IssuesSubject: 
Looking for a discussion on IM

Hello,
 
I 
have been asked to research and potentially implement IM for a company 
to communicate internally as well as externally. However, I have always 
heard that IM was evil and to close it down ASAP. I would like to hear 
real world implementation concerns/ tips as well as the security issues 
associated.
 
Thanks 
in advance for your input.
 
Steve 
Clark
Clark 
Systems Support, LLC
AVIEN 
Charter Member
"Who's 
watching your network?"
www.clarksupport.com
  
301-610-9584 voice
  
240-465-0323 Efax
 http://www.sunbelt-software.com/ntsysadmin_list_charter.htmhttp://www.sunbelt-software.com/ntsysadmin_list_charter.htmhttp://www.sunbelt-software.com/ntsysadmin_list_charter.htmhttp://www.sunbelt-software.com/ntsysadmin_list_charter.htm
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Nimda and HTML Files

[Bunting, Jeff]

Good thinking!  
I did try the url several times and wasn't getting a response from the
server, which is why I included the code.

-Original Message-
From: Randal, Phil [mailto:[EMAIL PROTECTED]]
Sent: Friday, September 21, 2001 12:52 PM
To: NT System Admin Issues
Subject: RE: Nimda and HTML Files


That's why I posted a url to the info :-)

-
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK 

> -Original Message-
> From: Bunting, Jeff [mailto:[EMAIL PROTECTED]]
> Sent: 21 September 2001 17:15
> To: NT System Admin Issues
> Subject: RE: Nimda and HTML Files
> 
> 
> Yikes!!  I got a bunch of antigen messages after including 
> that code in the
> email.  Looks like a lot of people are scanning for it.
> 
> -----Original Message-
> From: Bunting, Jeff [mailto:[EMAIL PROTECTED]]
> Sent: Friday, September 21, 2001 12:13 PM
> To: NT System Admin Issues
> Subject: RE: Nimda and HTML Files
> 
> 
> This is what it adds at the end of .htm, .html, and .asp files:
> 
> 
> 
> It is only one line; I haven't seen anything else.
> 
> Jeff
> 
> -Original Message-
> From: Mark Kelsay [mailto:[EMAIL PROTECTED]]
> Sent: Friday, September 21, 2001 11:35 AM
> To: NT System Admin Issues
> Subject: Nimda and HTML Files
> 
> 
> I have read that nimda appends two lines of code to htm, html 
> and asp files.
> Does anyone know what those two lines of code are or where I 
> can find out?  
> 
> TIA,
> 
> Mark Kelsay
> 
> http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
> 
> http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
> 
> http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
> 

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: OT on Windows ME

[Bunting, Jeff]

Is Fastfind (comes with MS Office) running?  It will index the hard drive
every couple of hours and can really put a hit on slower machines.

Jeff

-Original Message-
From: John Cesta - Lists [mailto:[EMAIL PROTECTED]]
Sent: Saturday, September 22, 2001 2:08 AM
To: NT System Admin Issues
Subject: OT on Windows ME




I have been a member of this list for about a month. We are a small company
and I don't have the benefit of a large IT dept so I thought I'd throw this
question to you guys. My personal PC is a Windows ME PC. Today it started
doing something really weird. About every two hours it just kind of stops. I
mean, it still works and all ( although there is no more Internet access)
but it is very, very slow. Can't hardly move the mouse and I have to
shutdown too get it back. It's weird because it goes south almost like clock
work every 1.5 to 2 hours. I don't have a virus, I am fairly certain of
that. It actually happens all of a sudden, yea, I sat here and waited for it
to happen. It doesn't seem to be a gradual thing, I mean, it doesn't get
progressively slow, it happens all at once all of a sudden. It is a royal
PITA.

Any ideas? :

Thanks,

John Cesta


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Nimda and HTML Files

[Bunting, Jeff]

Yikes!!  I got a bunch of antigen messages after including that code in the
email.  Looks like a lot of people are scanning for it.

-Original Message-
From: Bunting, Jeff [mailto:[EMAIL PROTECTED]]
Sent: Friday, September 21, 2001 12:13 PM
To: NT System Admin Issues
Subject: RE: Nimda and HTML Files


This is what it adds at the end of .htm, .html, and .asp files:



It is only one line; I haven't seen anything else.

Jeff

-Original Message-
From: Mark Kelsay [mailto:[EMAIL PROTECTED]]
Sent: Friday, September 21, 2001 11:35 AM
To: NT System Admin Issues
Subject: Nimda and HTML Files


I have read that nimda appends two lines of code to htm, html and asp files.
Does anyone know what those two lines of code are or where I can find out?  

TIA,

Mark Kelsay

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Nimda and HTML Files

[Bunting, Jeff]

This is what it adds at the end of .htm, .html, and .asp files:

window.open("readme.eml", null,
"resizable=no,top=6000,left=6000")

It is only one line; I haven't seen anything else.

Jeff

-Original Message-
From: Mark Kelsay [mailto:[EMAIL PROTECTED]]
Sent: Friday, September 21, 2001 11:35 AM
To: NT System Admin Issues
Subject: Nimda and HTML Files


I have read that nimda appends two lines of code to htm, html and asp files.
Does anyone know what those two lines of code are or where I can find out?  

TIA,

Mark Kelsay

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: NIMDA cleanup questions...

[Bunting, Jeff]

can you take ownership of the files?

-Original Message-
From: Eric Brouwer [mailto:[EMAIL PROTECTED]]
Sent: Friday, September 21, 2001 10:33 AM
To: NT System Admin Issues
Subject: NIMDA cleanup questions...


I know half the camp says the only way to recover from NIMDA is to do a
fresh install, but I can't right now.  I will soon though.

In the mean time...

I am 90% done with cleaning my IIS server.  I have it back on the network,
but I am blocking all traffic to and from it at the firewall.  As I check
the logs, the IIS server is not trying to port scan other IP's.  When I do
my virus scan however, there are 60 .htm files that say they are infected,
but can not be cleaned or deleted.  When I try to manually delete them, it
says access denied.  I do have full admin rights on the machine, and I am
doing it locally.  I can not set the security to full access for the admin
on these files either.

Is there another "brute force" method I can try to get rid of them?

When I edit the files, they look fine.  I did not see the text referring to
readme.eml.

Eric


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

Is IE4 vulnerable to nimda?

[Bunting, Jeff]

I haven't seen any mention of it one way or the other.  Anyone know?

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: cannot ping by name

[Bunting, Jeff]

do you have WINS running too?  Is it an issue between pinging with a netbios
name vs. a fully qualified name?

-Original Message-
From: Mal Sasalu [mailto:[EMAIL PROTECTED]]
Sent: Monday, September 10, 2001 3:58 PM
To: NT System Admin Issues
Subject: cannot ping by name




Hi guys,

>From one particular server, I cannot ping "some" servers by name. I can ping
the same servers by IP address or I can do nslookup. I am sure it is not
name
servers issue because all other machines can ping any machine by name or IP
address on the network. I also checked the DNS entry on that particular
server, everything looks right. Any thought on this? You can be sarcastic!!
I
don't mind. By the way, this is the only 2000 server on an NT network, if
that
makes any difference!.

Mal



http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Mouse Drifting in 2000 Pro (Inspiron 4000)

[Bunting, Jeff]

Those touchpads are sometimes pretty sensitive to heat, like if you rest
your hands around it.  You might want to try temporarily disabling it to see
if that is the problem (assuming you have a mouse or one of those stick-type
controllers).

Jeff

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
Sent: Friday, September 07, 2001 10:02 AM
To: NT System Admin Issues
Subject: Mouse Drifting in 2000 Pro (Inspiron 4000)


Have a strange problem.  The cursor on one of our laptops is drifting
Left=>Right 
for a while, then when I mess with the drivers, it will stop for a bit, and
then
starts to drift Right=>Left.  

Anyone ever seen this before?

New one on me!

Jim Slattery
Network Guy
[EMAIL PROTECTED]

I should have no objection to a repetition of the same life from its
beginning, only asking the advantages authors have in a second edition to
correct some faults of the first.

... Benjamin Franklin (1706-1790) 


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: URGENT!!! KVM Recommendations needed

[Bunting, Jeff]

Yeah, those ascii arrows are pretty derogatory :-P

-Original Message-
From: Nail, Larry [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 06, 2001 6:07 PM
To: NT System Admin Issues
Subject: RE: URGENT!!! KVM Recommendations needed


Please ban this guy, we don't need this on the list.

Ref:  http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
Inflammatory
All messages to the list must use a professional business tone. The list is
not a playground for children to shout derogatory statements back and forth.
.


-Original Message-
From: Benjamin Scott [mailto:[EMAIL PROTECTED]] 
Sent: Thursday, September 06, 2001 4:30 PM
To: NT System Admin Issues
Subject: RE: URGENT!!! KVM Recommendations needed


On Thu, 6 Sep 2001, Velez, Tony wrote:
> How do we unsubscribe from this list, very good info but I do not have 
> time to read them all.  Thanks.

  Please see the following.  ;-)


   ###
   ###
   ###
   ###
   ###
   ###
   ###
   ### ### ###
#########
 ###   ###   ###
  ###  ###  ###
   ### ### ###
#
 ###
   ###


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Exchange Server Directory Export

[Bunting, Jeff]

I've used gawk (Gnu AWK) scripts to manipulate directory exports.  It's
fairly simple to pick up and is pretty handy for these types of things.  

here's an awk script that will do this:


-
#extract Display Name and email addresses from Exchange directory dump

BEGIN {FS="\t"}
{
print $4 "\t" $9
}


--

I use the tab character as the separator in the directory export because
there are sometimes commas in the other fields which makes parsing the file
more difficult.  This script expects Display Name to be in the 4th field
position and Email address to be the 9th field (which is what my Exchange
export defaults to).  You could make the script more robust by searching for
the field headers so it would work if the exports aren't all in the same
format.

Jeff
-Original Message-
From: Ryan McBride [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, September 04, 2001 8:14 PM
To: NT System Admin Issues
Subject: Exchange Server Directory Export


Hey All 
Just wondering if anyone has written a little script or something that will
go and sort the CSV file that exchange dumps it directoy export into. I want
to grab all the names and SMTP addresses, problem is same field also
contains CC Mail, X400, MS Mail, Etc
Any help woudl be great 
Thanx all 
- - 
Ryan McBride (MCSE) 
Network & Comms Administrator 
Strategic Management Works 
http://www.smw.com.au 
+612-9906-9611 





--- 
The content of this email is intended only for the ordinary user of the
email address to which it is addressed. This email may contain copyright,
privileged and/or confidential information. Persons other than the intended
recipient may not read, retransmit, disseminate, store, copy or take any
action in reliance upon this information. If you have received this
information in error, please delete the information from any computer and
contact the sender.

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: NSLOOKUP

[Bunting, Jeff]

To answer #1, in nslookup, "set timeout=X" to number of seconds you want.

However, the timeout you're getting is most likely because you don't have a
reverse lookup zone.  Two seconds is generally plenty of time for a
response.

for #3, is that server your secondary DNS?

-Original Message-
From: Mier, Juan [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, September 04, 2001 2:34 PM
To: NT System Admin Issues
Subject: RE: NSLOOKUP


To answer question #2: You need to setup a reverse lookup zone.

-Original Message-
From: Alston, Steve [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, September 04, 2001 11:23 AM
To: NT System Admin Issues
Subject: NSLOOKUP


The following is the output from a NSLOOKUP query.  

X:\>nslookup 198.133.219.25
DNS request timed out.
timeout was 2 seconds.
*** Can't find server name for address 192.168.2.12: Timed out
Server:  res1.ns.digex.net
Address:  206.205.242.132

Name:www.cisco.com
Address:  198.133.219.25

My questions are:

1.  Why is DNS timing out after 2 seconds & where is the timeout value
configured
2.  What do I need to do so I don't get the "Can't find server name for
address 192.168.2.12?"  (Note 192.168.2.12 is my primary DNS server)
3.  Why is my system using res1.ns.digex.net as the name server?  I
don't
see where I have that configured in my system?


Thanks much,
Steve

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Windows 98 network error message

[Bunting, Jeff]

I've 
never seen that one before, I'd bet it's the application that is talking about 
offline mode.

  -Original Message-From: Brenden C. Bryan 
  [mailto:[EMAIL PROTECTED]]Sent: Friday, August 31, 2001 
  3:57 PMTo: NT System Admin IssuesSubject: Windows 98 
  network error message
  
  Is the following error message 
  generated by Windows 98? I have some POS Win98 machines that are giving this 
  error, and I'm trying to determine if it is an error message created by 
  Windows 98 or if it is an error message created by the 3rd party 
  POS application.
   
  ERROR: Check your network 
  connections. If the network is still unavailable when you press okay there 
  will be a small delay and the system will be re-enabled in offline 
  mode.
   
   
  _
  Brenden C. 
  Bryan
  Network 
  Manager
  Organized 
  Living, Inc.
  913.894.4844x264
  [EMAIL PROTECTED]
   
   http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Process monitor for ME

[Bunting, Jeff]

You could try Wintop.  It's in the Win95 Kernel toys package from MS.  I
haven't tried it out on ME but it does work under Win98.


-Original Message-
From: Ryan Farnsworth [mailto:[EMAIL PROTECTED]]
Sent: Monday, August 27, 2001 5:11 PM
To: NT System Admin Issues
Subject: Process monitor for ME


Anyone know of a utility that will show the active processes and the memory
usage for each on a Windows ME machine?  Trying to track down a memory leak.



http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: SMS 2.0 & SQL 2K

[Bunting, Jeff]

http://www.swynk.com/sms/
has some good SMS info.  I recall reading that you have to install things in
a specific order to get SMS to work with SQL 2000.

Jeff

-Original Message-
From: Paul Armstrong [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 31, 2001 1:27 PM
To: NT System Admin Issues
Subject: SMS 2.0 & SQL 2K


Hello All,

I am doing some research on working with SMS 2.0. I know I can work with
it on Windows 2000 using the latest SMS service packs but what about
using SQL 2000 instead of SQL 7? I am searching M$'s site right now and
have yet to find an answer? Can someone confirm if this would work and
where I can find more info on this setup? TIA!!

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Lotus Admin Driving Me Crazy!

[Bunting, Jeff]

Instead of "mail to:" I think you'll need to use "RCPT 
to:"
 
(unless AOL understands this syntax maybe?  AFAIK 
it isn't standard smtp though)
 

  -Original Message-From: Kelly Borndale 
  [mailto:[EMAIL PROTECTED]]Sent: Thursday, August 30, 2001 12:26 
  PMTo: NT System Admin IssuesSubject: Re: Lotus Admin 
  Driving Me Crazy!
  Open a command prompt on the Notes server.
  Type telnet mailin-01.mx.aol.com 25
  When connected type:
  >helo
  
  >mail from:  (note... those 
  lieele <> characters are needed!)
  
  >mail to:
  
  >data
  
  (Now, hit return a few times, and then type a message.  
  When the message is done, hit return, then a . then return again)
   
  See if that gets through.
   
  K.Borndale
   
  [EMAIL PROTECTED] -home 
  email
  
- Original Message - 
From: 
[EMAIL PROTECTED] 

To: NT System Admin Issues 

Sent: Thursday, August 30, 2001 11:50 
AM
Subject: Lotus Admin Driving Me 
Crazy!
Greetings all,Our Lotus Notes Admin is trying to track 
down some mail issues with one ofour applications. It seems that when 
the app sends out mail to some AOL andHotmail accounts it gets bounced. 
We have received no other complaints fromusers of various other ISPs not 
getting the same type mail. AOL recommendsthe following:"The 
second way to test your server is to telnet to the IP address inquestion 
through port 25 from a different internet service provider andmanually 
initiate an SMTP transaction. If you can send mail from yourselfon the 
different ISP to yourself on the different ISP, your server isavailable 
for free relaying. (Make sure the email actually arrives in 
yourmailbox.)"Does anyone know of any KB articles that might 
help me with this? I'venever tried to telnet via a specific port or 
initiatea manual SMTP transaction.Regards,Harry 
CampbellTechnical CoordinatorCity of Savannah, 
GA912.651.6913[EMAIL PROTECTED]http://www.sunbelt-software.com/ntsysadmin_list_charter.htmhttp://www.sunbelt-software.com/ntsysadmin_list_charter.htm
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: User List

[Bunting, Jeff]

Different Jeff here, but that was the exact syntax he gave you...

Jeff

-Original Message-
From: Bartolini [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, August 28, 2001 3:36 PM
To: NT System Admin Issues
Subject: Re: User List


ok Jeff what is the exact syntax

thanks,
David
- Original Message -
From: "Jeff Wilcox" <[EMAIL PROTECTED]>
To: "NT System Admin Issues" <[EMAIL PROTECTED]>
Sent: Tuesday, August 28, 2001 3:25 PM
Subject: RE: User List


> net user /domain
>
> -Original Message-
> From: Joe Heaton [mailto:[EMAIL PROTECTED]]
> Sent: Tuesday, August 28, 2001 3:24 PM
> To: NT System Admin Issues
> Subject: User List
>
>
> Is there any easy way to print out a current list of all NT user accounts?
> I did print screens, but there has to be an easier way.
>
> Joseph L. Heaton, MCSE
> NT Administrator
> FDI Consulting, Inc.
> 1610 Arden Way,  Suite 145
> Sacramento, CA  95815
> (916)921-4390 x.228
>
>
> http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
>
>
> **
> "This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the e-mail originator.
>
> This footnote also confirms that this email message has been swept by
> MIMEsweeper for the presence of computer viruses. However,
> please check this e-mail for virus infection for which
> CDG Management LLC accepts no responsibility"
> **
>
>
> http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
>
>


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

OT: Netscape messenger smtp authentication configuration

[Bunting, Jeff]

Anyone know if it is possible to configure SMTP authentication in Netscape
messenger?  Looking at the settings, all I can see is SSL or TLS settings.
This is version 4.78.

thanks,
Jeff

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: files marked as read only

[Bunting, Jeff]

I've experienced the same problem occasionally with NT4 server and Office
97.  I haven't seen multiple opens in Server Manager though.  I haven't
found a fix or workaround other than what you're doing.

Jeff

-Original Message-
From: Stephen-Paul [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, August 22, 2001 10:52 PM
To: NT System Admin Issues
Subject: files marked as read only


 
I have a win 2k server my clients are using local installed office 2k,
people are complaining that when they open their files on the server they
are marked as read only.. I have verified they are the only one that have
the file open but what I did notice when I got to the server AD and look at
open files I see the user has the files open twice. So I went to their
workstation which is a win98 client I verify they have only made one attempt
at opening the file. I then go to the server and check how much time the
file is open and sure enough it shows that user has the file open twice. So
I go and close the file to only find there was only one file open. What I
have had to do as a work around is have them save as a different name this
allowed them to save the file now this is not the preferred method of doing
business
Any suggestions will be greatly appreciated thanks
 
Stephen-Paul Yelland
Miami County ESC
 

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Active Directory Problem

[Bunting, Jeff]

It is in the Properties of File & Print sharing which is under Network,
listed along with the protocols and adapters.

Jeff

-Original Message-
From: Andrew J. Lund [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, August 21, 2001 12:02 PM
To: NT System Admin Issues
Subject: RE: Active Directory Problem


i haven't had a win 98 in my possession in so long so i'm just going to
guess where i think it might be...
Go to the property pages of TCP/IP on your LAN settings and there should
be a page where there is a pull down menu that shows browse functions.
"Act as master browser", or some related syntax, is chosen by default on
the machines i was working with.  choose "Never" for browsing functions.
that way the Win 98 machines will never win the browse election process.
reboot those machines that were changed.

sorry for the vagueness.  it's been a while.  contact me directly if you
need further help.  the actual screens escape me.
good luck.
andy


Andrew J. Lund, MCSE
Systems Manager
IEA - San Francisco



-Original Message-
From: Ibby El-Raheb [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, August 21, 2001 8:34 AM
To: NT System Admin Issues
Subject: RE: Active Directory Problem


Can you elaborate how to do this please.

Thanks
Ibby

-Original Message-
From: Andrew J. Lund [mailto:[EMAIL PROTECTED]]
Sent: Monday, August 20, 2001 5:11 PM
To: NT System Admin Issues
Subject: RE: Active Directory Problem


since you have Win 98 machines floating around, i would check to make
sure they are not acting as master browsers when the server is rebooted
or down.
i'm telling you this from the exact same experience i had.
good luck.
andy


Andrew J. Lund, MCSE
Systems Manager
IEA - San Francisco



-Original Message-
From: Ibby El-Raheb [mailto:[EMAIL PROTECTED]]
Sent: Monday, August 20, 2001 11:00 AM
To: NT System Admin Issues
Subject: Active Directory Problem


I have a small network: W2K Server SP2 with 2 NICs one for internal and
one
for cable modem that is shared. A bunch of WIN98 clients. Things have
been
running smooth for a while and all of a sudden none of the clients can
be
authenticated through the server. When I try to go into manage user
accounts
I get the following message: "Naming information cannot be located
because:
The specified domain either does not exist or cannot be contacted.
Contact
your system administrator to verify that your domain is properly
configured
and is currently online." Well ladies and gentlemen I am the so called
system administrator and I have no clue what to do. Please help me.

Thanks
Ibby
wannabe sys admin.

You can tell whether a man is clever by his answers. You can tell
whether a
man is wise by his questions.   Naguib Mahfouz



http://www.sunbelt-software.com/ntsysadmin_list_charter.htm


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Setting IP Gateway in DHCP

[Bunting, Jeff]

Title: Setting IP Gateway in DHCP



In the 
DHCP scope set the router option (003) to your gateway.

  -Original Message-From: [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED]]Sent: Tuesday, August 21, 2001 
  11:47 AMTo: NT System Admin IssuesSubject: Setting IP 
  Gateway in DHCP
  How does one go about setting the gateway on a DHCP server. By 
  running ROUTE PRINT I can see that it's assigning 10.0.0.15. I need to change 
  that. Anyone know how to go about this?
  Ptl. Bob Couchman Unit 57 
  Network Administrator Madisonville 
  Police Department 99 East Center Street 
  Madisonville, KY 42431 (270) 
  821-1720 (270) 824-2115 (fax) [EMAIL PROTECTED]   
  
  Visit the Madisonville Police Department on the internet 
  at  http://www.madisonvillepd.com  
  http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: IIS question

[Bunting, Jeff]

IIS will cache ASP pages, but I don't think it caches HTML.  IE will cache
pages and not necessarily refresh them when you ask it to.  IIRC,
SHIFT-clicking the refresh button will force a reload of the page.

Jeff

-Original Message-
From: Eric Brouwer [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, August 21, 2001 9:03 AM
To: NT System Admin Issues
Subject: IIS question


Hello!

We are running IIS 4.0 on an NT 4.0 SP6a server.  Our web person has a
strange problem from time to time.  She edits her pages with Front Page
2000.  Sometimes when she edits a page, the changes do not show up on the
site.  Even if you refresh your screen.  Usually, everything works fine.
The problem does not seem to affect any particular page.  It can happen to
one one day, and a totally different page the next time.  It has been a
while since the problem occurred last.  The way I have gotten the pages to
display correctly is by rebooting the server.  This seems a little extreme
for some simple editing.  Am I missing something?  Are these "wrong" pages
being pulled from a cache some where???

Eric

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: IIS stopping without reason

[Bunting, Jeff]

Title: IIS stopping without reason



Not 
related to your current problem, but you need to have a higher level Exchange SP 
(SP3 plus hotfix, or Sp4 should include this)  for the latest version of 
GroupShield.
 
Jeff

  -Original Message-From: Eric Peeters 
  [mailto:[EMAIL PROTECTED]]Sent: Monday, August 20, 2001 4:24 
  PMTo: NT System Admin IssuesSubject: RE: IIS stopping 
  without reason
  It can't be Code 
  Red... Until that machine actually goes live, port 80 is blocked to outside 
  traffic (and I am toying with the idea of not using port 80 when it goes live 
  anyways), besides the Index Server service is disabled. Not patched (not my 
  choice, people higher up make decisions I can't argue with) doesn't mean 
  totally abandonned. I update the McAfee virus scan definition list whenever a 
  new comes out, I have GroupShield running on Exchange (updated just as 
  lovingly), I ran three all-files virus checks, on top of the on-access scan, 
  since having this problem, I've rebooted twice (which should have taken care 
  of Code Red if it had been an issue) and I've also ran the Code Red scanner, 
  all to no avail.
  Eric Peeters Network Administrator TexLoc 
  Ltd 
  
-Original Message-From: Kevin Lundy 
[mailto:[EMAIL PROTECTED]]Sent: Monday, August 20, 2001 3:06 
PMTo: NT System Admin IssuesSubject: RE: IIS stopping 
without reason
The "no patch" is the clue.  My betting money is on Code Red - 
you have heard the news the past month?

  -Original Message-From: Eric Peeters 
  [mailto:[EMAIL PROTECTED]]Sent: Monday, August 20, 2001 4:09 
  PMTo: NT System Admin IssuesSubject: IIS stopping 
  without reason
  Hello, 
  My IIS4 server has been behaving strangely for 
  the past four days. It is not a mission-critical unit (yet) as it runs 
  only the users' default home page when they start IE though it was 
  supposed to go live in a week as the IIS for OWA. On to the 
  problem...
  All IIS services (NNTP, FTP, HTTP) are stopped. 
  I click on one of them at random and hit Start. Nothing happens. I click 
  Start again after a few seconds. The service in question will start and 
  function normally, however anywhere from 5 to 15 minutes later, it'll stop 
  again. There is no message in the log file other than a notice in the 
  Security log that the IIS account logged in and out at 
  start/stop.
  Besides IIS, that box is running Win NT 4 SP6a 
  Server (no patch) and Exchange 5.5 SP1 (no patch) and it acts as the 
  BDC.
  I've roamed through the Microsoft KB (not easy, 
  what keywords do you use to describe this when there's no message in the 
  log) to no avail. Anyone out there with a suggestion ?
  Eric Peeters Network Administrator TexLoc 
  Ltd 
  http://www.sunbelt-software.com/ntsysadmin_list_charter.htmhttp://www.sunbelt-software.com/ntsysadmin_list_charter.htmhttp://www.sunbelt-software.com/ntsysadmin_list_charter.htm
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Scheduled Tasks

[Bunting, Jeff]

The /interactive switch is only necessary if your job needs to interact with
the desktop.  If your batch file is only copying files then you do not need
this.

-Original Message-
From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 6:16 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


Great, now we're getting somewhere... where do I find docs to the
/interactive switch?  And what command does that switch go with?  Or better
yet, what syntax do I use?  I'm starting off the batch file with CD
\xxx\x to get to the correct directory... what goes before this?  Thanks
you all again

Stephen


-Original Message-----
From: Bunting, Jeff [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 3:08 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


you do still need to invoke cmd.exe for a batch file like I mentioned
previously.

-Original Message-
From: Don Ely [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 5:39 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


Ooops, you would be correct.

Stephen, you put the /interactive in your script and then you setup task
scheduler to run the script with a valid username and password to logon
with.

Technically, that should work without any trouble at all.

D

-Original Message-----
From: Bunting, Jeff [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 2:26 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


No, the /interactive switch lets the job interact with the desktop.

-Original Message-
From: Don Ely [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 5:23 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


The /interactive switch means you can run a scheduled task without being
logged on to the system.

-Original Message-
From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 2:23 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


It doesn't work.  Meaning, if I run it, I get the status code 0x1 and
the files that I am renaming and copying onto a mapped networked drive
are not moved.  If, however, I am logged in then the files are copied
off fine.

What's the /interactive switch?

Thanks.

Stephen



-Original Message-
From: Webb, Brian (Telecom) [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 12:28 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


What do you mean by "doesn't work in Terminal services"?  What is it
this batch file is trying to do?  The scheduled job will run the job on
the server in the context of the user specified.  If you use the
/interactive switch it will be just like the specified user was sitting
at the console running the command.  It won't open a terminal server
session and do something in that session.

Disclaimer: This is the current user's personal opinion and is not made
on behalf of my employer.


-Original Message-
From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 12:19 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


that doesn't work...

Remember, the batch file works fine as long as I am logged into the
computer at the workstation or remotely from Timbuktu... it just doesn't
work in Terminal services if a user is not logged in.

Stephen



-Original Message-
From: Spencer Kent [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 12:09 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


.. rename the job to .CMD and try it.

Kent

--- "Dowling, Glenn" <[EMAIL PROTECTED]> wrote:
> Do you have the full path to the batch job listed in
> the task (e.g.
> C:\Program Files\wirename.bat) or just the batch job
> name?  The computer
> might not know where the file is located.
>
>
> -Original Message-
> From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 14:51
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
>
>
>   Started 8/17/2001 12:07:00 AM
> "w1rename.job" (w1rename.bat)
>   Finished 8/17/2001 12:07:00 AM
>   Result: The task completed with an exit code of
> (1).
>
> exit code of 1 means it didnt complete the job.
>
>
>
> -Original Message-
> From: Dowling, Glenn [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 11:36 AM
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
>
>
> What does the Task Scheduler log say?
>
>
> -Original Message-
> From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 14:33
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
>
>
> Yes, if I log on physically or via remote control
> software and run the task,
> it completes fine, if I do it via terminal services
> while that I'm still
> logged

RE: Scheduled Tasks

[Bunting, Jeff]

you do still need to invoke cmd.exe for a batch file like I mentioned
previously.

-Original Message-
From: Don Ely [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 5:39 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


Ooops, you would be correct.

Stephen, you put the /interactive in your script and then you setup task
scheduler to run the script with a valid username and password to logon
with.

Technically, that should work without any trouble at all.

D

-Original Message-
From: Bunting, Jeff [mailto:[EMAIL PROTECTED]] 
Sent: Friday, August 17, 2001 2:26 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


No, the /interactive switch lets the job interact with the desktop.

-Original Message-
From: Don Ely [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 5:23 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


The /interactive switch means you can run a scheduled task without being
logged on to the system.

-Original Message-
From: Stephen Chiang [mailto:[EMAIL PROTECTED]] 
Sent: Friday, August 17, 2001 2:23 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


It doesn't work.  Meaning, if I run it, I get the status code 0x1 and
the files that I am renaming and copying onto a mapped networked drive
are not moved.  If, however, I am logged in then the files are copied
off fine.

What's the /interactive switch?

Thanks.

Stephen



-Original Message-
From: Webb, Brian (Telecom) [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 12:28 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


What do you mean by "doesn't work in Terminal services"?  What is it
this batch file is trying to do?  The scheduled job will run the job on
the server in the context of the user specified.  If you use the
/interactive switch it will be just like the specified user was sitting
at the console running the command.  It won't open a terminal server
session and do something in that session.

Disclaimer: This is the current user's personal opinion and is not made
on behalf of my employer.


-Original Message-
From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 12:19 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


that doesn't work...

Remember, the batch file works fine as long as I am logged into the
computer at the workstation or remotely from Timbuktu... it just doesn't
work in Terminal services if a user is not logged in.

Stephen



-Original Message-
From: Spencer Kent [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 12:09 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


.. rename the job to .CMD and try it.

Kent

--- "Dowling, Glenn" <[EMAIL PROTECTED]> wrote:
> Do you have the full path to the batch job listed in
> the task (e.g.
> C:\Program Files\wirename.bat) or just the batch job
> name?  The computer
> might not know where the file is located.
>
>
> -Original Message-
> From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 14:51
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
>
>
>   Started 8/17/2001 12:07:00 AM
> "w1rename.job" (w1rename.bat)
>   Finished 8/17/2001 12:07:00 AM
>   Result: The task completed with an exit code of
> (1).
>
> exit code of 1 means it didnt complete the job.
>
>
>
> -Original Message-
> From: Dowling, Glenn [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 11:36 AM
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
>
>
> What does the Task Scheduler log say?
>
>
> -Original Message-
> From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 14:33
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
>
>
> Yes, if I log on physically or via remote control
> software and run the task,
> it completes fine, if I do it via terminal services
> while that I'm still
> logged in via the remote control software, it also
> runs fine, if I am logged
> out, and I try it via terminal services, it fails.
> I have the accounted on
> the particular task itself- the Task Scheduler
> service will only run off the
> local system.
>
> Stephen
>
>
> -Original Message-
> From: Dowling, Glenn [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 10:49 AM
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
>
>
> Can you run the task from the server logged in as
> that particular account?
> Where do you have the account listed -- in the Task
> Scheduler service or the
> particular task itself?
>
> > Glenn M. Dowling
> > IBM Global Services @ Lucent Technologies
> > Work: 732.949.6456
> &g

RE: Scheduled Tasks

[Bunting, Jeff]

No, the /interactive switch lets the job interact with the desktop.

-Original Message-
From: Don Ely [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 5:23 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


The /interactive switch means you can run a scheduled task without being
logged on to the system.

-Original Message-
From: Stephen Chiang [mailto:[EMAIL PROTECTED]] 
Sent: Friday, August 17, 2001 2:23 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


It doesn't work.  Meaning, if I run it, I get the status code 0x1 and
the files that I am renaming and copying onto a mapped networked drive
are not moved.  If, however, I am logged in then the files are copied
off fine.

What's the /interactive switch?

Thanks.

Stephen



-Original Message-
From: Webb, Brian (Telecom) [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 12:28 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


What do you mean by "doesn't work in Terminal services"?  What is it
this batch file is trying to do?  The scheduled job will run the job on
the server in the context of the user specified.  If you use the
/interactive switch it will be just like the specified user was sitting
at the console running the command.  It won't open a terminal server
session and do something in that session.

Disclaimer: This is the current user's personal opinion and is not made
on behalf of my employer.


-Original Message-
From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 12:19 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


that doesn't work...

Remember, the batch file works fine as long as I am logged into the
computer at the workstation or remotely from Timbuktu... it just doesn't
work in Terminal services if a user is not logged in.

Stephen



-Original Message-
From: Spencer Kent [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 12:09 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


.. rename the job to .CMD and try it.

Kent

--- "Dowling, Glenn" <[EMAIL PROTECTED]> wrote:
> Do you have the full path to the batch job listed in
> the task (e.g.
> C:\Program Files\wirename.bat) or just the batch job
> name?  The computer
> might not know where the file is located.
>
>
> -Original Message-
> From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 14:51
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
>
>
>   Started 8/17/2001 12:07:00 AM
> "w1rename.job" (w1rename.bat)
>   Finished 8/17/2001 12:07:00 AM
>   Result: The task completed with an exit code of
> (1).
>
> exit code of 1 means it didnt complete the job.
>
>
>
> -Original Message-
> From: Dowling, Glenn [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 11:36 AM
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
>
>
> What does the Task Scheduler log say?
>
>
> -Original Message-
> From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 14:33
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
>
>
> Yes, if I log on physically or via remote control
> software and run the task,
> it completes fine, if I do it via terminal services
> while that I'm still
> logged in via the remote control software, it also
> runs fine, if I am logged
> out, and I try it via terminal services, it fails.
> I have the accounted on
> the particular task itself- the Task Scheduler
> service will only run off the
> local system.
>
> Stephen
>
>
> -Original Message-
> From: Dowling, Glenn [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 10:49 AM
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
>
>
> Can you run the task from the server logged in as
> that particular account?
> Where do you have the account listed -- in the Task
> Scheduler service or the
> particular task itself?
>
> > Glenn M. Dowling
> > IBM Global Services @ Lucent Technologies
> > Work: 732.949.6456
> > Fax: 732.834.6413
> > Email: [EMAIL PROTECTED]
>
>
> -Original Message-
> From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 13:27
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
>
>
> I am running it with a domain administrator account.
>
> -Original Message-
> From: Dowling, Glenn [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 10:20 AM
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
>
>
> Stephen:
>
> In the properties of the specific task, set the "Run
> As" section to run as
> the particular user (e.g. yourself or a service
> account) and type in that
> login's password.
>
> Glenn M. Dowling
> NT System Administrator
> IBM Global Services @ Lucent Technologies
>
>
> -Original Message-
> From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 11:57
> To: NT System Admin Issues
> Subject: Scheduled Tasks
>
>
> THis may have been covered before, 

RE: Scheduled Tasks

[Bunting, Jeff]

I don't think my last post was very clear.  What I meant to say was that
your job needs to open a command shell in order to run the batch file.  When
you run a batch file by double-clicking it, Windows will start cmd.exe first
and then run the batch.  Otherwise you have to manually start one.  When it
runs as a scheduled job cmd.exe is not automatically started.

try changing the job to this:

cmd /c "C:\Program Files\wirename.bat"

Jeff

-Original Message-
From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 3:19 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


that doesn't work...

Remember, the batch file works fine as long as I am logged into the computer
at the workstation or remotely from Timbuktu... it just doesn't work in
Terminal services if a user is not logged in.

Stephen



-Original Message-
From: Spencer Kent [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 12:09 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


.. rename the job to .CMD and try it.

Kent

--- "Dowling, Glenn" <[EMAIL PROTECTED]> wrote:
> Do you have the full path to the batch job listed in
> the task (e.g.
> C:\Program Files\wirename.bat) or just the batch job
> name?  The computer
> might not know where the file is located.
>
>
> -Original Message-
> From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 14:51
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
>
>
>   Started 8/17/2001 12:07:00 AM
> "w1rename.job" (w1rename.bat)
>   Finished 8/17/2001 12:07:00 AM
>   Result: The task completed with an exit code of
> (1).
>
> exit code of 1 means it didnt complete the job.
>
>
>
> -Original Message-
> From: Dowling, Glenn [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 11:36 AM
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
>
>
> What does the Task Scheduler log say?
>
>
> -Original Message-
> From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 14:33
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
>
>
> Yes, if I log on physically or via remote control
> software and run the task,
> it completes fine, if I do it via terminal services
> while that I'm still
> logged in via the remote control software, it also
> runs fine, if I am logged
> out, and I try it via terminal services, it fails.
> I have the accounted on
> the particular task itself- the Task Scheduler
> service will only run off the
> local system.
>
> Stephen
>
>
> -Original Message-
> From: Dowling, Glenn [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 10:49 AM
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
>
>
> Can you run the task from the server logged in as
> that particular account?
> Where do you have the account listed -- in the Task
> Scheduler service or the
> particular task itself?
>
> > Glenn M. Dowling
> > IBM Global Services @ Lucent Technologies
> > Work: 732.949.6456
> > Fax: 732.834.6413
> > Email: [EMAIL PROTECTED]
>
>
> -Original Message-
> From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 13:27
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
>
>
> I am running it with a domain administrator account.
>
> -Original Message-
> From: Dowling, Glenn [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 10:20 AM
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
>
>
> Stephen:
>
> In the properties of the specific task, set the "Run
> As" section to run as
> the particular user (e.g. yourself or a service
> account) and type in that
> login's password.
>
> Glenn M. Dowling
> NT System Administrator
> IBM Global Services @ Lucent Technologies
>
>
> -Original Message-
> From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 11:57
> To: NT System Admin Issues
> Subject: Scheduled Tasks
>
>
> THis may have been covered before, but I think I
> missed it.  Anyway, anyone
> know how to make a scheduled task win windows 2000
> server run an item
> without being logged into a user at the physical
> machine?  I figured out
> that that was what was happening with my tasks, I
> was getting the 0X1 error
> because I was running from terminal services, but no
> one had physically
> logged onto the computer.
>
> Stephen
>
>
>
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
>
>
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
>
>
>
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
>
>
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
>
>
>
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
>
>
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
>
>
>
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
>
>
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
>


__
Do You Yahoo!?
Make international calls f

RE: Scheduled Tasks

[Bunting, Jeff]

Your batch file needs to open a command shell in order to execute its
commands:

cmd /c "C:\Program Files\wirename.bat"

Jeff

-Original Message-
From: Spencer Kent [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 3:09 PM
To: NT System Admin Issues
Subject: RE: Scheduled Tasks


.. rename the job to .CMD and try it.

Kent

--- "Dowling, Glenn" <[EMAIL PROTECTED]> wrote:
> Do you have the full path to the batch job listed in
> the task (e.g.
> C:\Program Files\wirename.bat) or just the batch job
> name?  The computer
> might not know where the file is located.
> 
> 
> -Original Message-
> From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 14:51
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
> 
> 
>   Started 8/17/2001 12:07:00 AM
> "w1rename.job" (w1rename.bat)
>   Finished 8/17/2001 12:07:00 AM
>   Result: The task completed with an exit code of
> (1).
> 
> exit code of 1 means it didnt complete the job.
> 
> 
> 
> -Original Message-
> From: Dowling, Glenn [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 11:36 AM
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
> 
> 
> What does the Task Scheduler log say?
> 
> 
> -Original Message-
> From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 14:33
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
> 
> 
> Yes, if I log on physically or via remote control
> software and run the task,
> it completes fine, if I do it via terminal services
> while that I'm still
> logged in via the remote control software, it also
> runs fine, if I am logged
> out, and I try it via terminal services, it fails. 
> I have the accounted on
> the particular task itself- the Task Scheduler
> service will only run off the
> local system.
> 
> Stephen
> 
> 
> -Original Message-
> From: Dowling, Glenn [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 10:49 AM
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
> 
> 
> Can you run the task from the server logged in as
> that particular account?
> Where do you have the account listed -- in the Task
> Scheduler service or the
> particular task itself?
> 
> > Glenn M. Dowling
> > IBM Global Services @ Lucent Technologies
> > Work: 732.949.6456
> > Fax: 732.834.6413
> > Email: [EMAIL PROTECTED]
> 
> 
> -Original Message-
> From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 13:27
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
> 
> 
> I am running it with a domain administrator account.
> 
> -Original Message-
> From: Dowling, Glenn [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 10:20 AM
> To: NT System Admin Issues
> Subject: RE: Scheduled Tasks
> 
> 
> Stephen:
> 
> In the properties of the specific task, set the "Run
> As" section to run as
> the particular user (e.g. yourself or a service
> account) and type in that
> login's password.
> 
> Glenn M. Dowling
> NT System Administrator
> IBM Global Services @ Lucent Technologies
> 
> 
> -Original Message-
> From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 17, 2001 11:57
> To: NT System Admin Issues
> Subject: Scheduled Tasks
> 
> 
> THis may have been covered before, but I think I
> missed it.  Anyway, anyone
> know how to make a scheduled task win windows 2000
> server run an item
> without being logged into a user at the physical
> machine?  I figured out
> that that was what was happening with my tasks, I
> was getting the 0X1 error
> because I was running from terminal services, but no
> one had physically
> logged onto the computer.
> 
> Stephen
> 
> 
>
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
> 
>
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
> 
> 
>
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
> 
>
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
> 
> 
>
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
> 
>
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
> 
> 
>
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
> 
>
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
> 


__
Do You Yahoo!?
Make international calls for as low as $.04/minute with Yahoo! Messenger
http://phonecard.yahoo.com/

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Search Help

[Bunting, Jeff]

Title: Message



It is 
a very handy program to have.  Good for searching through big log files 
too; it's very fast.

  -Original Message-From: Kelly Borndale 
  [mailto:[EMAIL PROTECTED]]Sent: Friday, August 17, 2001 2:32 
  PMTo: NT System Admin IssuesSubject: Re: Search 
  Help
  You can get a free albeit restricted copy of search & 
  replace.  It's a cheap piece of software, I would say just buy 
  it.
  http://www.funduc.com/
  K.Borndale
   
  [EMAIL PROTECTED] -home 
  email
  
- Original Message - 
From: 
Martin Blackstone 
To: NT System Admin Issues 

Sent: Friday, August 17, 2001 2:17 
PM
Subject: Search Help

I need to do a 
search on files and search for specific text inside the file. I know Windows 
search will do this, but then I want to be able to save to a text file so I 
can ream some people. What simple, free tool can do 
that?
 

Martin Blackstone
Director, Information Technologies
Superior Access Insurance Services
949.470.2111 x279
 http://www.sunbelt-software.com/ntsysadmin_list_charter.htmhttp://www.sunbelt-software.com/ntsysadmin_list_charter.htm
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: STRANGE undeletable directory

[Bunting, Jeff]

No, you misunderstood; I'm not trying to remove a directory.  I was trying
to figure out *how* they are created.  If you look at the log xylog posted:

07:55:14 217.128.73.112 [11]MKD com1.scanned.by.zog+++/+++/ 257

it appears an anonymous FTP user created this directory.  I was
experimenting on a couple of machines here but couldn't get them to create a
directory that starts with "com1".  Jason showed me how to do it from a
command line, but that doesn't work via FTP.  I tried some variations on it
but haven't hit on anything yet.

Jeff

-Original Message-
From: Kevin Lundy [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 10:20 AM
To: NT System Admin Issues
Subject: RE: STRANGE undeletable directory


Did you try the POSIX utility rm.exe from the resource kit?

If you don't solve it soon, I've got a coworker who has solved it in the
past with an old utility.  I'll ask him when he gets in later.

-Original Message-
From: Bunting, Jeff [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 10:10 AM
To: NT System Admin Issues
Subject: RE: STRANGE undeletable directory


Thanks!  I'd tried several variations but hadn't come up with that one yet.
Have you got a trick to do it via FTP?

Jeff

-Original Message-
From: Hodson, Jason [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 9:58 AM
To: NT System Admin Issues
Subject: RE: STRANGE undeletable directory


md \\.\c:\com1
 
to remove:
 
rd \\.\c:\com1

-Original Message-
From: Bunting, Jeff [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 9:36 AM
To: NT System Admin Issues
Subject: RE: STRANGE undeletable directory


That is interesting; I can't seem to be able to create a directory that
starts with "com1" by any normal means.
-Original Message-
From: xylog [mailto:[EMAIL PROTECTED]]
Sent: Thursday, August 16, 2001 5:16 PM
To: NT System Admin Issues
Subject: Re: STRANGE undeletable directory


Just FYI these log entries are from a Windows 2KS running IIS 5.0

xylog
- Original Message - 
From: Bunting, Jeff 
To: NT System Admin Issues 
Sent: Thursday, August 16, 2001 4:34 PM
Subject: RE: STRANGE undeletable directory


This is what I was talking about earlier when it was suggested the server
was hacked because of the funny directory names.  I was speculating there
might be a way to create those directories with the normal permissions given
to the anonymous account in a write enabled directory.  The original post
about the server with the "aux" directory could very well have been hacked,
I just wasn't sure if the presence of those directories in a public FTP
folder was enough evidence to jump to that conclusion without looking at the
logs.

I did some experimenting and found I can't create the
"com1.scanned.by.zog+++/+++/" directory under IIS5.  Perhaps it can be done
in IIS4?  I'm running Serv-U FTP on all of the IIS4 machines so I can't test
it there.  The "+++COM2" and "null.upload" are legal though and can be
deleted by normal means.

On a related note, I've been getting some of the same people connecting to
my server, some warez guys from France.  I was watching their activity
closely for awhile because they don't have download permissions from the
uploads directory yet they continued to upload files which didn't make a lot
of sense to me.  I saw attempts at downloading, but nothing to indicate they
were successful or coming in by other means, so I've just started banning
their ip ranges because I'm tired of cleaning up all of the garbage on the
ftp site.

Jeff
-Original Message-
From: xylog [mailto:[EMAIL PROTECTED]]
Sent: Thursday, August 16, 2001 3:08 PM
To: NT System Admin Issues
Subject: Fw: STRANGE undeletable directory


OK here is one with the "undeletable" directory. The last one was just plain
dirs:

#Fields: time c-ip cs-method cs-uri-stem sc-status 
07:53:08 217.128.73.112 [10]USER anonymous 331
07:53:08 217.128.73.112 [10]PASS [EMAIL PROTECTED] 230
07:53:32 217.128.73.112 [11]USER anonymous 331
07:53:32 217.128.73.112 [11]PASS [EMAIL PROTECTED] 230
07:54:29 217.128.73.112 [11]MKD Tagged+By+Gru+++/+++/ 257
07:54:42 217.128.73.112 [11]MKD Tagged+By+Gru+++/+++Board/ 257
07:55:14 217.128.73.112 [11]MKD com1.scanned.by.zog+++/+++/ 257
<mailto:[EMAIL PROTECTED]]
Sent: Thursday, August 16, 2001 1:10 PM
To: NT System Admin Issues
Subject: Re: STRANGE undeletable directory


Look in your FTP logs you will see exactly the command used to create those
dirs.

xylog
- Original Message - 
From: Bunting, Jeff 
To: NT System Admin Issues 
Sent: Thursday, August 16, 2001 12:15 PM
Subject: RE: STRANGE undeletable directory


Because anonymous users have permission to create directories and this
fellow created directories.  

I wasn't trying to imply the machine definitely wasn't hacked, but

RE: STRANGE undeletable directory

[Bunting, Jeff]

Thanks!  I'd tried several variations but hadn't come up with that one yet.
Have you got a trick to do it via FTP?

Jeff

-Original Message-
From: Hodson, Jason [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 9:58 AM
To: NT System Admin Issues
Subject: RE: STRANGE undeletable directory


md \\.\c:\com1
 
to remove:
 
rd \\.\c:\com1

-Original Message-----
From: Bunting, Jeff [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 17, 2001 9:36 AM
To: NT System Admin Issues
Subject: RE: STRANGE undeletable directory


That is interesting; I can't seem to be able to create a directory that
starts with "com1" by any normal means.
-Original Message-
From: xylog [mailto:[EMAIL PROTECTED]]
Sent: Thursday, August 16, 2001 5:16 PM
To: NT System Admin Issues
Subject: Re: STRANGE undeletable directory


Just FYI these log entries are from a Windows 2KS running IIS 5.0

xylog
- Original Message - 
From: Bunting, Jeff 
To: NT System Admin Issues 
Sent: Thursday, August 16, 2001 4:34 PM
Subject: RE: STRANGE undeletable directory


This is what I was talking about earlier when it was suggested the server
was hacked because of the funny directory names.  I was speculating there
might be a way to create those directories with the normal permissions given
to the anonymous account in a write enabled directory.  The original post
about the server with the "aux" directory could very well have been hacked,
I just wasn't sure if the presence of those directories in a public FTP
folder was enough evidence to jump to that conclusion without looking at the
logs.

I did some experimenting and found I can't create the
"com1.scanned.by.zog+++/+++/" directory under IIS5.  Perhaps it can be done
in IIS4?  I'm running Serv-U FTP on all of the IIS4 machines so I can't test
it there.  The "+++COM2" and "null.upload" are legal though and can be
deleted by normal means.

On a related note, I've been getting some of the same people connecting to
my server, some warez guys from France.  I was watching their activity
closely for awhile because they don't have download permissions from the
uploads directory yet they continued to upload files which didn't make a lot
of sense to me.  I saw attempts at downloading, but nothing to indicate they
were successful or coming in by other means, so I've just started banning
their ip ranges because I'm tired of cleaning up all of the garbage on the
ftp site.

Jeff
-Original Message-
From: xylog [mailto:[EMAIL PROTECTED]]
Sent: Thursday, August 16, 2001 3:08 PM
To: NT System Admin Issues
Subject: Fw: STRANGE undeletable directory


OK here is one with the "undeletable" directory. The last one was just plain
dirs:

#Fields: time c-ip cs-method cs-uri-stem sc-status 
07:53:08 217.128.73.112 [10]USER anonymous 331
07:53:08 217.128.73.112 [10]PASS [EMAIL PROTECTED] 230
07:53:32 217.128.73.112 [11]USER anonymous 331
07:53:32 217.128.73.112 [11]PASS [EMAIL PROTECTED] 230
07:54:29 217.128.73.112 [11]MKD Tagged+By+Gru+++/+++/ 257
07:54:42 217.128.73.112 [11]MKD Tagged+By+Gru+++/+++Board/ 257
07:55:14 217.128.73.112 [11]MKD com1.scanned.by.zog+++/+++/ 257
<mailto:[EMAIL PROTECTED]]
Sent: Thursday, August 16, 2001 1:10 PM
To: NT System Admin Issues
Subject: Re: STRANGE undeletable directory


Look in your FTP logs you will see exactly the command used to create those
dirs.

xylog
- Original Message - 
From: Bunting, Jeff 
To: NT System Admin Issues 
Sent: Thursday, August 16, 2001 12:15 PM
Subject: RE: STRANGE undeletable directory


Because anonymous users have permission to create directories and this
fellow created directories.  

I wasn't trying to imply the machine definitely wasn't hacked, but I've seen
this question arise before and always in an FTP directory.  I was wondering
if there is some way to create these directories with reserved words via
normal FTP or HTTP commands.  If there is, then the anonymous user would
have permission to create those directories again.

Jeff
-Original Message-
From: Martin Blackstone [mailto:[EMAIL PROTECTED]]
Sent: Thursday, August 16, 2001 11:14 AM
To: NT System Admin Issues
Subject: RE: STRANGE undeletable directory


Better question:
What would make you assume he didn't?
-Original Message-
From: Bunting, Jeff [mailto:[EMAIL PROTECTED]] 
Sent: Thursday, August 16, 2001 8:02 AM
To: NT System Admin Issues
Subject: RE: STRANGE undeletable directory


Assuming the machine was configured for anonymous logins, what would make
you believe he did anything else he wasn't allowed to do?
-Original Message-
From: Martin Blackstone [mailto:[EMAIL PROTECTED]]
Sent: Thursday, August 16, 2001 10:54 AM
To: NT System Admin Issues
Subject: RE: STRANGE undeletable directory


Of course you still need to rebuild the box now. 
Who knows what else this guy did to it.
-Orig

RE: STRANGE undeletable directory

[Bunting, Jeff]

Title: Message



That 
is interesting; I can't seem to be able to create a directory that starts with 
"com1" by any normal means.

  -Original Message-From: xylog 
  [mailto:[EMAIL PROTECTED]]Sent: Thursday, August 16, 2001 5:16 
  PMTo: NT System Admin IssuesSubject: Re: STRANGE 
  undeletable directory
  Just FYI these log entries are from a Windows 2KS 
  running IIS 5.0
   
  xylog
  
- Original Message - 
From: 
    Bunting, 
Jeff 
To: NT System Admin Issues 

Sent: Thursday, August 16, 2001 4:34 
PM
Subject: RE: STRANGE undeletable 
directory

This is what I was talking about earlier when it 
was suggested the server was hacked because of the funny directory 
names.  I was speculating there might be a way to create those 
directories with the normal permissions given to the anonymous account in a 
write enabled directory.  The original post about the server with the 
"aux" directory could very well have been hacked, I just wasn't sure if the 
presence of those directories in a public FTP folder was enough evidence to 
jump to that conclusion without looking at the logs.
 
I 
did some experimenting and found I can't create the 
"com1.scanned.by.zog+++/+++/" directory under IIS5.  Perhaps it can be 
done in IIS4?  I'm running Serv-U FTP on all of the IIS4 machines so I 
can't test it there.  The "+++COM2" and "null.upload" are legal though 
and can be deleted by normal means.
 
On 
a related note, I've been getting some of the same people connecting to my 
server, some warez guys from France.  I was watching their activity 
closely for awhile because they don't have download permissions from the 
uploads directory yet they continued to upload files which didn't make a lot 
of sense to me.  I saw attempts at downloading, but nothing to indicate 
they were successful or coming in by other means, so I've just started 
banning their ip ranges because I'm tired of cleaning up all of the garbage 
on the ftp site.
 
Jeff

  -Original Message-From: xylog 
  [mailto:[EMAIL PROTECTED]]Sent: Thursday, August 16, 2001 3:08 
  PMTo: NT System Admin IssuesSubject: Fw: STRANGE 
  undeletable directory
  OK here is one with the "undeletable" 
  directory. The last one was just plain dirs:
   
  #Fields: time c-ip cs-method cs-uri-stem 
  sc-status 07:53:08 217.128.73.112 [10]USER anonymous 33107:53:08 
  217.128.73.112 [10]PASS [EMAIL PROTECTED] 
  23007:53:32 217.128.73.112 [11]USER anonymous 33107:53:32 
  217.128.73.112 [11]PASS [EMAIL PROTECTED] 
  23007:54:29 217.128.73.112 [11]MKD Tagged+By+Gru+++/+++/ 
  25707:54:42 217.128.73.112 [11]MKD Tagged+By+Gru+++/+++Board/ 
  25707:55:14 217.128.73.112 [11]MKD com1.scanned.by.zog+++/+++/ 
  257  
  <07:55:31 217.128.73.112 [11]MKD 
  com1.scanned.by.zog+++/+++COM2/ 
  257<07:55:54 
  217.128.73.112 [11]MKD null.upload.by.derfy+++/+++/ 257    
              
          <07:56:11 217.128.73.112 [11]MKD 
  null.upload.by.derfy+++/+++COM1/ 25707:56:29 217.128.73.112 [11]MKD 
  07.27.01Reel_Fishing_Wild_DC-ECHELON 257
   
  xylog
  
- Original Message - 
From: 
xylog 
To: NT System Admin Issues 

Sent: Thursday, August 16, 2001 
2:58 PM
Subject: Re: STRANGE undeletable 
directory

I had some bozo do this ^#@& to one of 
my boxes, here is the log entires:
 
12:35:46 193.253.37.219 [4]USER anonymous 
33112:35:46 193.253.37.219 [4]PASS [EMAIL PROTECTED] 23012:35:50 
193.253.37.219 [4]MKD 010626143627p 25712:35:50 193.253.37.219 
[4]RMD 010626143627p 25020:47:30 193.253.37.219 [5]USER anonymous 
33120:47:30 193.253.37.219 [5]PASS [EMAIL PROTECTED] 
23020:47:57 193.253.37.219 [5]MKD /.tmp 25720:47:59 
193.253.37.219 [5]MKD /.tmp/Tag+&+Scan 25720:48:02 
193.253.37.219 [5]MKD /.tmp/Tag+&+Scan/Genetic+SPECIE 
25720:48:04 193.253.37.219 [5]MKD 
/.tmp/Tag+&+Scan/Genetic+SPECIE/for+DZ 25720:48:23 
193.253.37.219 [5]QUIT - 257
 
You set the log settings from the IIS 
management console snap-in in the FTP site properties page.
 
xylog

  - Original Message - 
  From: 
  Bunting, Jeff 
  To: NT System Admin Issues 
  
  Sent: Thursday, August 16, 2001 
  1:19 PM
  Subject: RE: STRANGE undeletable 
  directory
  
  What options need to be ticked to record the 
  FTP commands in IIS?  The settings show the same 

RE: STRANGE undeletable directory

[Bunting, Jeff]

Title: Message



This 
is what I was talking about earlier when it was suggested the server was hacked 
because of the funny directory names.  I was speculating there might be a 
way to create those directories with the normal permissions given to the 
anonymous account in a write enabled directory.  The original post about 
the server with the "aux" directory could very well have been hacked, I just 
wasn't sure if the presence of those directories in a public FTP folder was 
enough evidence to jump to that conclusion without looking at the 
logs.
 
I did 
some experimenting and found I can't create the "com1.scanned.by.zog+++/+++/" 
directory under IIS5.  Perhaps it can be done in IIS4?  I'm running 
Serv-U FTP on all of the IIS4 machines so I can't test it there.  The 
"+++COM2" and "null.upload" are legal though and can be deleted by normal 
means.
 
On a 
related note, I've been getting some of the same people connecting to my server, 
some warez guys from France.  I was watching their activity closely for 
awhile because they don't have download permissions from the uploads directory 
yet they continued to upload files which didn't make a lot of sense to me.  
I saw attempts at downloading, but nothing to indicate they were successful or 
coming in by other means, so I've just started banning their ip ranges because 
I'm tired of cleaning up all of the garbage on the ftp site.
 
Jeff

  -Original Message-From: xylog 
  [mailto:[EMAIL PROTECTED]]Sent: Thursday, August 16, 2001 3:08 
  PMTo: NT System Admin IssuesSubject: Fw: STRANGE 
  undeletable directory
  OK here is one with the "undeletable" directory. 
  The last one was just plain dirs:
   
  #Fields: time c-ip cs-method cs-uri-stem 
  sc-status 07:53:08 217.128.73.112 [10]USER anonymous 33107:53:08 
  217.128.73.112 [10]PASS [EMAIL PROTECTED] 
  23007:53:32 217.128.73.112 [11]USER anonymous 33107:53:32 
  217.128.73.112 [11]PASS [EMAIL PROTECTED] 23007:54:29 
  217.128.73.112 [11]MKD Tagged+By+Gru+++/+++/ 25707:54:42 217.128.73.112 
  [11]MKD Tagged+By+Gru+++/+++Board/ 25707:55:14 217.128.73.112 [11]MKD 
  com1.scanned.by.zog+++/+++/ 
  257  
  <07:55:31 217.128.73.112 [11]MKD 
  com1.scanned.by.zog+++/+++COM2/ 
  257<07:55:54 
  217.128.73.112 [11]MKD null.upload.by.derfy+++/+++/ 257    
                  
      <07:56:11 
  217.128.73.112 [11]MKD null.upload.by.derfy+++/+++COM1/ 25707:56:29 
  217.128.73.112 [11]MKD 07.27.01Reel_Fishing_Wild_DC-ECHELON 257
   
  xylog
  
- Original Message - 
From: 
xylog 
To: NT System Admin Issues 

Sent: Thursday, August 16, 2001 2:58 
PM
Subject: Re: STRANGE undeletable 
directory

I had some bozo do this ^#@& to one of my 
boxes, here is the log entires:
 
12:35:46 193.253.37.219 [4]USER anonymous 
33112:35:46 193.253.37.219 [4]PASS [EMAIL PROTECTED] 23012:35:50 
193.253.37.219 [4]MKD 010626143627p 25712:35:50 193.253.37.219 [4]RMD 
010626143627p 25020:47:30 193.253.37.219 [5]USER anonymous 
33120:47:30 193.253.37.219 [5]PASS [EMAIL PROTECTED] 23020:47:57 
193.253.37.219 [5]MKD /.tmp 25720:47:59 193.253.37.219 [5]MKD 
/.tmp/Tag+&+Scan 25720:48:02 193.253.37.219 [5]MKD 
/.tmp/Tag+&+Scan/Genetic+SPECIE 25720:48:04 193.253.37.219 [5]MKD 
/.tmp/Tag+&+Scan/Genetic+SPECIE/for+DZ 25720:48:23 193.253.37.219 
[5]QUIT - 257
 
You set the log settings from the IIS 
management console snap-in in the FTP site properties page.
 
xylog

  - Original Message - 
  From: 
  Bunting, 
  Jeff 
  To: NT System Admin Issues 
  
  Sent: Thursday, August 16, 2001 1:19 
  PM
  Subject: RE: STRANGE undeletable 
  directory
  
  What options need to be ticked to record the FTP 
  commands in IIS?  The settings show the same categories as the WWW 
  logs which don't intuitively apply to FTP.  
   
  The deaults options just show the name of the 
  file created.
  
-Original Message-From: xylog [mailto:[EMAIL PROTECTED]]Sent: 
Thursday, August 16, 2001 1:10 PMTo: NT System Admin 
IssuesSubject: Re: STRANGE undeletable 
directory
Look in your FTP logs you will see exactly 
the command used to create those dirs.
 
xylog

  - Original Message - 
  From: 
  Bunting, Jeff 
  To: NT System Admin Issues 
  
  Sent: Thursday, August 16, 2001 
  12:15 PM
  Subject: RE: STRANGE undeletable 
  directory
  
  Because anonymous users have permission to 
  create directories and this fellow created directories.  
  
   
  I wasn't trying to imply the 
  machine definitely wasn

RE: STRANGE undeletable directory

[Bunting, Jeff]

Title: Message



I knew 
how to change the log settings, I wasn't sure which of the properties recorded 
the FTP commands such as MKD.  I just did a little experimenting and found 
it is the Method (cs-method) property.

  -Original Message-From: xylog 
  [mailto:[EMAIL PROTECTED]]Sent: Thursday, August 16, 2001 2:58 
  PMTo: NT System Admin IssuesSubject: Re: STRANGE 
  undeletable directory
  I had some bozo do this ^#@& to one of my 
  boxes, here is the log entires:
   
  12:35:46 193.253.37.219 [4]USER anonymous 
  33112:35:46 193.253.37.219 [4]PASS [EMAIL PROTECTED] 23012:35:50 193.253.37.219 
  [4]MKD 010626143627p 25712:35:50 193.253.37.219 [4]RMD 010626143627p 
  25020:47:30 193.253.37.219 [5]USER anonymous 33120:47:30 
  193.253.37.219 [5]PASS [EMAIL PROTECTED] 23020:47:57 
  193.253.37.219 [5]MKD /.tmp 25720:47:59 193.253.37.219 [5]MKD 
  /.tmp/Tag+&+Scan 25720:48:02 193.253.37.219 [5]MKD 
  /.tmp/Tag+&+Scan/Genetic+SPECIE 25720:48:04 193.253.37.219 [5]MKD 
  /.tmp/Tag+&+Scan/Genetic+SPECIE/for+DZ 25720:48:23 193.253.37.219 
  [5]QUIT - 257
   
  You set the log settings from the IIS management 
  console snap-in in the FTP site properties page.
   
  xylog
  
- Original Message - 
    From: 
    Bunting, 
Jeff 
To: NT System Admin Issues 

Sent: Thursday, August 16, 2001 1:19 
PM
Subject: RE: STRANGE undeletable 
directory

What options need to be ticked to record the FTP 
commands in IIS?  The settings show the same categories as the WWW logs 
which don't intuitively apply to FTP.  
 
The deaults options just show the name of the file 
created.

  -Original Message-From: xylog [mailto:[EMAIL PROTECTED]]Sent: 
  Thursday, August 16, 2001 1:10 PMTo: NT System Admin 
  IssuesSubject: Re: STRANGE undeletable 
  directory
  Look in your FTP logs you will see exactly 
  the command used to create those dirs.
   
  xylog
  
- Original Message - 
    From: 
Bunting, Jeff 
To: NT System Admin Issues 

Sent: Thursday, August 16, 2001 
12:15 PM
Subject: RE: STRANGE undeletable 
directory

Because anonymous users have permission to 
create directories and this fellow created directories.  

 
I wasn't trying to imply the 
machine definitely wasn't hacked, but I've seen this question arise 
before and always in an FTP directory.  I was wondering if there is 
some way to create these directories with reserved words via normal FTP 
or HTTP commands.  If there is, then the anonymous user would have 
permission to create those directories again.
 
Jeff

  -Original Message-From: Martin Blackstone 
  [mailto:[EMAIL PROTECTED]]Sent: Thursday, 
  August 16, 2001 11:14 AMTo: NT System Admin 
  IssuesSubject: RE: STRANGE undeletable 
  directory
  Better question:
  What would make you assume he didn't?
  

    -Original Message-From: 
Bunting, Jeff [mailto:[EMAIL PROTECTED]] Sent: 
Thursday, August 16, 2001 8:02 AMTo: NT System Admin 
IssuesSubject: RE: STRANGE undeletable 
directory
Assuming the machine was configured for 
anonymous logins, what would make you believe he did anything else 
he wasn't allowed to do?

  -Original Message-From: 
  Martin Blackstone 
  [mailto:[EMAIL PROTECTED]]Sent: Thursday, 
  August 16, 2001 10:54 AMTo: NT System Admin 
  IssuesSubject: RE: STRANGE undeletable 
  directory
  Of course you still need to rebuild the box now. 
  
  Who knows what else this guy did to it.
  

-Original 
Message-From: Martijn Eindhoven 
[mailto:[EMAIL PROTECTED]] Sent: Thursday, 
August 16, 2001 7:37 AMTo: NT System Admin 
IssuesSubject: RE: STRANGE undeletable 
directoryGood one didnt think of 
thatgoing to try it nowAt 09:36 AM 8/16/2001 -0500, 
you wrote:
can you change attributes from the command 
  line? 
  
-Original Message- 
From: Martijn Eindhoven [mailto:[EMAIL PROTECTED]] 
Sent: Thursday, August 16, 2001 09:17 
To: NT System Admin Issues 
Subject: RE: STRANGE undeletable 
directory
Jup deleting it from the command line gave the same 
error: The parameter is 

RE: STRANGE undeletable directory

[Bunting, Jeff]

Title: Message



What 
options need to be ticked to record the FTP commands in IIS?  The settings 
show the same categories as the WWW logs which don't intuitively apply to 
FTP.  
 
The 
deaults options just show the name of the file created.

  -Original Message-From: xylog 
  [mailto:[EMAIL PROTECTED]]Sent: Thursday, August 16, 2001 1:10 
  PMTo: NT System Admin IssuesSubject: Re: STRANGE 
  undeletable directory
  Look in your FTP logs you will see exactly the 
  command used to create those dirs.
   
  xylog
  
- Original Message - 
From: 
Bunting, 
    Jeff 
To: NT System Admin Issues 

Sent: Thursday, August 16, 2001 12:15 
PM
Subject: RE: STRANGE undeletable 
directory

Because anonymous users have permission to create 
directories and this fellow created directories.  
 
I 
wasn't trying to imply the machine definitely wasn't hacked, but I've 
seen this question arise before and always in an FTP directory.  I was 
wondering if there is some way to create these directories with reserved 
words via normal FTP or HTTP commands.  If there is, then the anonymous 
user would have permission to create those directories 
again.
 
Jeff

  -Original Message-From: Martin Blackstone 
  [mailto:[EMAIL PROTECTED]]Sent: Thursday, August 
  16, 2001 11:14 AMTo: NT System Admin IssuesSubject: 
  RE: STRANGE undeletable directory
  Better question:
  What would make you assume he didn't?
  

-Original Message-From: Bunting, 
Jeff [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 16, 
2001 8:02 AMTo: NT System Admin IssuesSubject: RE: 
STRANGE undeletable directory
Assuming the machine was configured for 
anonymous logins, what would make you believe he did anything else he 
wasn't allowed to do?

  -Original Message-From: Martin Blackstone 
  [mailto:[EMAIL PROTECTED]]Sent: Thursday, 
  August 16, 2001 10:54 AMTo: NT System Admin 
  IssuesSubject: RE: STRANGE undeletable 
  directory
  Of course you still need to rebuild the box now. 
  
  Who knows what else this guy did to it.
  

-Original Message-From: 
Martijn Eindhoven [mailto:[EMAIL PROTECTED]] Sent: 
Thursday, August 16, 2001 7:37 AMTo: NT System Admin 
IssuesSubject: RE: STRANGE undeletable 
directoryGood one didnt think of thatgoing 
to try it nowAt 09:36 AM 8/16/2001 -0500, you wrote:
can you change attributes from the command 
  line? 
  
-Original Message- 
From: Martijn Eindhoven [mailto:[EMAIL PROTECTED]] 
Sent: Thursday, August 16, 2001 09:17 
To: NT System Admin Issues 
Subject: RE: STRANGE undeletable 
directory
Jup deleting it from the command line gave the same error: 
The parameter is incorrect
At 10:19 AM 8/16/2001 -0400, you wrote: 

  Did you try deleting it from the command line? 
    
  -Original Message- 
  From: Martijn Eindhoven [mailto:[EMAIL PROTECTED]] 
  Sent: Thursday, August 16, 2001 10:13 AM 
  To: NT System Admin Issues 
  Subject: RE: STRANGE undeletable directory
  I dunno, cant rename cant move can do shit! 
  Very strange
  At 09:10 AM 8/16/2001 -0500, you wrote: 
  
Is it because "Com1"? 
-Original Message- 
From: Martijn Eindhoven [mailto:[EMAIL PROTECTED]] 
Sent: Thursday, August 16, 2001 09:03 
To: NT System Admin Issues 
Subject: STRANGE undeletable directory
Oke guys i have the following question.
A customer has his own w2ks box. Now he asked me to look 
at his machine because he had a problem 
I logged in and looked at the problem. The first thing i 
saw that here was an ftp abuser. So i kicked him out. 
But when i was going to delete the directories he made I 
stumbled upon the strangest problem i've ever seen since a 
long 
time.
He made a map in the login directory that looked like 
this:
pub--- 
    | 
    Com1-- 
    
| 
   

RE: STRANGE undeletable directory

[Bunting, Jeff]

Just 
curious, was this machine running the standard IIS FTP server or something 
else?

  -Original Message-From: Martijn Eindhoven 
  [mailto:[EMAIL PROTECTED]]Sent: Thursday, August 16, 2001 
  11:32 AMTo: NT System Admin IssuesSubject: RE: STRANGE 
  undeletable directoryWell i think i found it and the 
  customer isnt going to be happy.I think someone backdoored him. So 
  shutdown :)I'll give you an update status in a day or 2Thanks for 
  al the help guys.At 08:13 AM 8/16/2001 -0700, you wrote:
  Better question:What 
would make you assume he didn't? 

  -Original Message- 
  From: Bunting, Jeff [mailto:[EMAIL PROTECTED]] 
  Sent: Thursday, August 16, 2001 8:02 AM 
  To: NT System Admin Issues 
  Subject: RE: STRANGE undeletable directory
  Assuming the machine was configured for anonymous logins, what would 
  make you believe he did anything else he wasn't allowed to do? 
  -Original Message- 
  From: Martin Blackstone [mailto:[EMAIL PROTECTED]] 
  Sent: Thursday, August 16, 2001 10:54 AM 
  To: NT System Admin Issues 
  Subject: RE: STRANGE undeletable directory
  Of course you still need to rebuild the box now. 
  Who knows what else this guy did to it. 
  -Original Message- 
  From: Martijn Eindhoven [mailto:[EMAIL PROTECTED]] 
  Sent: Thursday, August 16, 2001 7:37 AM 
  To: NT System Admin Issues 
  Subject: RE: STRANGE undeletable directory
  Good one didnt think of that 
  going to try it now
  At 09:36 AM 8/16/2001 -0500, you wrote:
  
can you change attributes from the command line? 
-Original Message- 
From: Martijn Eindhoven [mailto:[EMAIL PROTECTED]] 
Sent: Thursday, August 16, 2001 09:17 
To: NT System Admin Issues 
Subject: RE: STRANGE undeletable directory
Jup deleting it from the command line gave the same error: The 
parameter is incorrect
At 10:19 AM 8/16/2001 -0400, you wrote: 

  Did you try deleting it from the command line? 
    
  -Original Message- 
  From: Martijn Eindhoven [mailto:[EMAIL PROTECTED]] 
  Sent: Thursday, August 16, 2001 10:13 AM 
  To: NT System Admin Issues 
  Subject: RE: STRANGE undeletable directory
  I dunno, cant rename cant move can do shit! 
  Very strange
  At 09:10 AM 8/16/2001 -0500, you wrote: 
  
Is it because "Com1"? 
-Original Message- 
From: Martijn Eindhoven [mailto:[EMAIL PROTECTED]] 
Sent: Thursday, August 16, 2001 09:03 
To: NT System Admin Issues 
Subject: STRANGE undeletable directory
Oke guys i have the following question.
A customer has his own w2ks box. Now he asked me to look at his 
machine because he had a problem 
I logged in and looked at the problem. The first thing i saw 
that here was an ftp abuser. So i kicked him out. 
But when i was going to delete the directories he made I 
stumbled upon the strangest problem i've ever seen since a long 
time.
He made a map in the login directory that looked like 
this:
pub--- 
    | 
    Com1-- 
    
| 
    
Pub 
  
| 
  
Aux 
  
Aux (yes two times an identical directory)
It says "The parameter is incorrect" when i try to delete it. 
Looked at the settings and everything. Still undeletable.
Any ideas 
guys.
Met vriendelijke 
groet,
M. Eindhoven 
NT System Administrator 
Bevelander Internet Services B.V. 
Folkstoneweg 10 
1118 LM SCHIPHOL Zuidoost 
Tel : 020 40 53 900 
Fax : 020 40 53 910 
http://www.bevelander.nl 
= 
This communication contains information which is confidential 
and 
may also be privileged. It is for the exclusive use of the 
intended recipient(s). If you are not the intended recipient(s), 

please note that any distribution, copying or use of this 
communication or the information in it is strictly prohibited. 
If you have received this communication in error, please notify 
the sender immediately and then destroy any copies of it. 
= 
http://www.sunbelt-software.com/ntsys

RE: STRANGE undeletable directory

[Bunting, Jeff]

Title: Message



Because anonymous users have permission to create 
directories and this fellow created directories.  
 
I 
wasn't trying to imply the machine definitely wasn't hacked, but I've seen 
this question arise before and always in an FTP directory.  I was wondering 
if there is some way to create these directories with reserved words via normal 
FTP or HTTP commands.  If there is, then the anonymous user would have 
permission to create those directories again.
 
Jeff

  -Original Message-From: Martin Blackstone 
  [mailto:[EMAIL PROTECTED]]Sent: Thursday, August 16, 
  2001 11:14 AMTo: NT System Admin IssuesSubject: RE: 
  STRANGE undeletable directory
  Better question:
  What 
  would make you assume he didn't?
  

-Original Message-From: Bunting, Jeff 
[mailto:[EMAIL PROTECTED]] Sent: Thursday, August 16, 2001 
8:02 AMTo: NT System Admin IssuesSubject: RE: STRANGE 
undeletable directory
Assuming the machine was configured for anonymous 
logins, what would make you believe he did anything else he wasn't allowed 
to do?

  -Original Message-From: Martin Blackstone 
  [mailto:[EMAIL PROTECTED]]Sent: Thursday, August 
  16, 2001 10:54 AMTo: NT System Admin IssuesSubject: 
  RE: STRANGE undeletable directory
  Of course you still need to rebuild the box now. 
  
  Who knows what else this guy did to it.
  

-Original Message-From: Martijn 
Eindhoven [mailto:[EMAIL PROTECTED]] Sent: Thursday, 
August 16, 2001 7:37 AMTo: NT System Admin 
IssuesSubject: RE: STRANGE undeletable 
directoryGood one didnt think of thatgoing to 
try it nowAt 09:36 AM 8/16/2001 -0500, you wrote:
can you change attributes from the command line? 
  
-Original Message- 
From: Martijn Eindhoven [mailto:[EMAIL PROTECTED]] 
Sent: Thursday, August 16, 2001 09:17 
To: NT System Admin Issues 
Subject: RE: STRANGE undeletable directory
Jup deleting it from the command line gave the same error: The 
parameter is incorrect
At 10:19 AM 8/16/2001 -0400, you wrote: 

  Did you try deleting it from the command line? 
    
  -Original Message- 
  From: Martijn Eindhoven [mailto:[EMAIL PROTECTED]] 
  Sent: Thursday, August 16, 2001 10:13 AM 
  To: NT System Admin Issues 
  Subject: RE: STRANGE undeletable directory
  I dunno, cant rename cant move can do shit! 
  Very strange
  At 09:10 AM 8/16/2001 -0500, you wrote: 
  
Is it because "Com1"? 
-Original Message- 
From: Martijn Eindhoven [mailto:[EMAIL PROTECTED]] 
Sent: Thursday, August 16, 2001 09:03 
To: NT System Admin Issues 
Subject: STRANGE undeletable directory
Oke guys i have the following question.
A customer has his own w2ks box. Now he asked me to look at 
his machine because he had a problem 
I logged in and looked at the problem. The first thing i saw 
that here was an ftp abuser. So i kicked him out. 
But when i was going to delete the directories he made I 
stumbled upon the strangest problem i've ever seen since a long 
time.
He made a map in the login directory that looked like 
this:
pub--- 
    | 
    Com1-- 
    
| 
    
Pub 
  
| 
  
Aux 
  
Aux (yes two times an identical directory)
It says "The parameter is incorrect" when i try to delete 
it. Looked at the settings and everything. Still 
undeletable.
Any ideas guys.
Met vriendelijke 
groet,
M. Eindhoven 
NT System Administrator 
Bevelander Internet Services B.V. 
Folkstoneweg 10 
1118 LM SCHIPHOL Zuidoost 
Tel : 020 40 53 900 
Fax : 020 40 53 910 
http://www.bevelander.nl 
= 
This communication contains information which is 
confidential and 
may also be privileged. It is for the exclusive use of the 
intended recipient(s). If you

RE: STRANGE undeletable directory

[Bunting, Jeff]

Title: Message



Assuming the machine was configured for anonymous 
logins, what would make you believe he did anything else he wasn't allowed to 
do?

  -Original Message-From: Martin Blackstone 
  [mailto:[EMAIL PROTECTED]]Sent: Thursday, August 16, 
  2001 10:54 AMTo: NT System Admin IssuesSubject: RE: 
  STRANGE undeletable directory
  Of 
  course you still need to rebuild the box now. 
  Who 
  knows what else this guy did to it.
  

-Original Message-From: Martijn 
Eindhoven [mailto:[EMAIL PROTECTED]] Sent: Thursday, 
August 16, 2001 7:37 AMTo: NT System Admin 
IssuesSubject: RE: STRANGE undeletable 
directoryGood one didnt think of thatgoing to try 
it nowAt 09:36 AM 8/16/2001 -0500, you wrote:
can you change attributes from the command line? 
  
-Original Message- 
From: Martijn Eindhoven [mailto:[EMAIL PROTECTED]] 
Sent: Thursday, August 16, 2001 09:17 
To: NT System Admin Issues 
Subject: RE: STRANGE undeletable directory
Jup deleting it from the command line gave the same error: The 
parameter is incorrect
At 10:19 AM 8/16/2001 -0400, you wrote: 

  Did you try deleting it from the command line? 
    
  -Original Message- 
  From: Martijn Eindhoven [mailto:[EMAIL PROTECTED]] 
  Sent: Thursday, August 16, 2001 10:13 AM 
  To: NT System Admin Issues 
  Subject: RE: STRANGE undeletable directory
  I dunno, cant rename cant move can do shit! 
  Very strange
  At 09:10 AM 8/16/2001 -0500, you wrote: 
  
Is it because "Com1"? 
-Original Message- 
From: Martijn Eindhoven [mailto:[EMAIL PROTECTED]] 
Sent: Thursday, August 16, 2001 09:03 
To: NT System Admin Issues 
Subject: STRANGE undeletable directory
Oke guys i have the following question.
A customer has his own w2ks box. Now he asked me to look at his 
machine because he had a problem 
I logged in and looked at the problem. The first thing i saw 
that here was an ftp abuser. So i kicked him out. 
But when i was going to delete the directories he made I 
stumbled upon the strangest problem i've ever seen since a long 
time.
He made a map in the login directory that looked like 
this:
pub--- 
    | 
    Com1-- 
    
| 
    
Pub 
  
| 
  
Aux 
  
Aux (yes two times an identical directory)
It says "The parameter is incorrect" when i try to delete it. 
Looked at the settings and everything. Still undeletable.
Any ideas guys.
Met vriendelijke groet,
M. Eindhoven 
NT System Administrator 
Bevelander Internet Services B.V. 
Folkstoneweg 10 
1118 LM SCHIPHOL Zuidoost 
Tel : 020 40 53 900 
Fax : 020 40 53 910 
http://www.bevelander.nl 
= 
This communication contains information which is confidential 
and 
may also be privileged. It is for the exclusive use of the 
intended recipient(s). If you are not the intended recipient(s), 

please note that any distribution, copying or use of this 
communication or the information in it is strictly prohibited. 
If you have received this communication in error, please notify 
the sender immediately and then destroy any copies of it. 
= 
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm 
http://www.sunbelt-software.com/ntsysadmin_list_charter.htmMet 
vriendelijke groet,M. EindhovenNT System 
AdministratorBevelander Internet Services B.V. Folkstoneweg 10 
1118 LM SCHIPHOL Zuidoost Tel : 020 40 53 900 Fax : 020 40 53 
910 http://www.bevelander.nl= 
This communication contains information which is confidential and 
may also be privileged. It is for the exclusive use of the intended 
recipient(s). If you are not the intended recipient(s), please note that 
any distribution, copying or use of this communication or the 
information in it is strictly prohibited. If you have received this 
communication in error, please notify the sender immediately and then 
destroy any copies of it. 
=http://www.sunbelt-software.com/ntsysadmin_list

RE: STRANGE undeletable directory

[Bunting, Jeff]

Check 
this KB out:
 
http://support.microsoft.com/support/kb/articles/Q120/7/16.asp
 
Jeff

  -Original Message-From: Martijn Eindhoven 
  [mailto:[EMAIL PROTECTED]]Sent: Thursday, August 16, 2001 
  10:03 AMTo: NT System Admin IssuesSubject: STRANGE 
  undeletable directoryOke guys i have the following 
  question.A customer has his own w2ks box. Now he asked me to look at 
  his machine because he had a problemI logged in and looked at the problem. 
  The first thing i saw that here was an ftp abuser. So i kicked him out.But 
  when i was going to delete the directories he made I stumbled upon the 
  strangest problem i've ever seen since a long time.He made a map 
  in the login directory that looked like 
  this:pub---    
  |    
  Com1--    
  |    
  Pub  
  |  
  Aux  
  Aux (yes two times an identical directory)It says "The parameter is 
  incorrect" when i try to delete it. Looked at the settings and everything. 
  Still undeletable.Any ideas guys.
  Met vriendelijke groet,M. EindhovenNT System 
  AdministratorBevelander Internet Services B.V. Folkstoneweg 10 
  1118 LM SCHIPHOL Zuidoost Tel : 020 40 53 900 Fax : 020 40 53 910 
  http://www.bevelander.nl= 
  This communication contains information which is confidential and may 
  also be privileged. It is for the exclusive use of the intended 
  recipient(s). If you are not the intended recipient(s), please note that 
  any distribution, copying or use of this communication or the information 
  in it is strictly prohibited. If you have received this communication in 
  error, please notify the sender immediately and then destroy any copies of 
  it. 
  =http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: chronic problems

[Bunting, Jeff]

I bet its the beer on the weekends that alleves the neck and shoulder
problems.  Try keeping a cooler by your desk and see if that helps :-)

-Original Message-
From: Paul Green [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, August 15, 2001 11:10 AM
To: NT System Admin Issues
Subject: OT: chronic problems


Anyone know how to shake the chronic neck discomfort?  It's my job to
sit here, write code and administer this network, yet the neck/shoulder
discomfort has been with me for 10 months, and seems to get better on
the weekends (when I'm not working), then Monday afternoon and Tuesday
it starts back up again.  I've changed everything from desks to chairs.
I even stretch all the time.  Doesn't help.  Been to chiropractic for
the last 4 months, message therapy, physical therapy for 3 months,
acupuncture for crying out loud, and nothing helps.  Yes,  I get plenty
of exercise, I'm on a summer league baseball team..  Even had an MRI and
they told me everything was fine.  Only way I can get it to feel better,
is if I'm not working.  But I have to make a living somehow eh?  College
students need all the bee.. money they can get =)   21 years old is
too young for this crap.  Am I just allergic to work?

Anyone?  Please?  For the love of god?  .. Figured I would ask here
since back/neck/shoulder problems are no stranger to people in the IT
industry :)


Paul 

  _  

Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (www.grisoft.com). 
Version: 6.0.268 / Virus Database: 140 - Release Date: 8/7/2001



http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Restoring DNS?

[Bunting, Jeff]

In the past, I've just re-added the domain I deleted and all of the records
will come back.

-Original Message-
From: Kevin Miller [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, August 14, 2001 8:39 PM
To: NT System Admin Issues
Subject: RE: Restoring DNS?


You are welcome.. It normally does not update the server files unless
you tell it to, or wait a good bit.

-Original Message-
From: Eric Brouwer [mailto:[EMAIL PROTECTED]] 
Sent: Tuesday, August 14, 2001 2:39 PM
To: NT System Admin Issues
Subject: RE: Restoring DNS?


Thanks Kevin!  Worked like a champ.

I thought I was going to be here for a loong time

-Original Message-
From: Kevin Miller [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, August 14, 2001 8:05 PM
To: NT System Admin Issues
Subject: RE: Restoring DNS?


Stop the service and restart it. The files should have not been updated
yet..

-Original Message-
From: Eric Brouwer [mailto:[EMAIL PROTECTED]] 
Sent: Tuesday, August 14, 2001 2:05 PM
To: NT System Admin Issues
Subject: Restoring DNS?


I accidentally deleted one of our DNS entries from our DNS manager.  Is
there an easy way to restore it?  Maybe from tape?  NT 4.0 server with
SP 6a.

Eric

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Message Tracking

[Bunting, Jeff]

I meant to say "a valid return address".  

-Original Message-----
From: Bunting, Jeff [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, August 14, 2001 2:20 PM
To: NT System Admin Issues
Subject: RE: Message Tracking


You can find out the originating mail server by looking in the message
headers, but there is no requirement to have a return address.

-Original Message-
From: Network Issues [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, August 14, 2001 2:13 PM
To: NT System Admin Issues
Subject: Message Tracking


I was wondering if anyone can tell me how I can find out the email address
of an individual that sent an email to one of our users.  The inbound email
address was incorrectly spelled and Exchange forwarded a NDR to the sender,
however there is no record of the senders address.

My user would like to know the sender's address.

TIA

Ron

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Message Tracking

[Bunting, Jeff]

You can find out the originating mail server by looking in the message
headers, but there is no requirement to have a return address.

-Original Message-
From: Network Issues [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, August 14, 2001 2:13 PM
To: NT System Admin Issues
Subject: Message Tracking


I was wondering if anyone can tell me how I can find out the email address
of an individual that sent an email to one of our users.  The inbound email
address was incorrectly spelled and Exchange forwarded a NDR to the sender,
however there is no record of the senders address.

My user would like to know the sender's address.

TIA

Ron

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: AT COMMAND PROBLEM

[Bunting, Jeff]

I should have clarified my original statement.
You can do that, but then you'll have a username & password in plain text in
the batch file which usually isn't a good idea.

Jeff

-Original Message-
From: Marc Neiger [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, August 14, 2001 4:04 AM
To: NT System Admin Issues
Subject: RE: AT COMMAND PROBLEM


NET USE shall work if you specify a user and password :

net use x: \\server\share /user:adomain\asuser apassword

However do not try to mix the same letters in the gui and AT batch, and
always disconnect at the end of the batch

net use x: /d

Cheers,

Marc Neiger
Groupe Synergie Informatique
14 rue Saint Papoul
31000 Toulouse
Tel 05 34 41 38 38 Fax: 05 34 41 38 39


> -Original Message-
> From: Bunting, Jeff [mailto:[EMAIL PROTECTED]]
> Sent: Monday, August 13, 2001 10:50 PM
> To: NT System Admin Issues
> Subject: RE: AT COMMAND PROBLEM
> 
> 
> NET USE won't work under the local system account.  You'll 
> need to run the
> job  under another security context (assuming you have the 
> new scheduler
> that lets you do this).  Alternatively, you could change the account
> scheduler runs under and create a share to use that has appropriate
> permissions.
> 
> jeff
> 
> -Original Message-
> From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 10, 2001 5:22 PM
> To: NT System Admin Issues
> Subject: RE: AT COMMAND PROBLEM
> 
> 
> Ahhh found out whats wrong.  I cant switch to the L: 
> (network drive
> mapped through GUI) through command even though its mapped Any way
> around this or do I have to use net use?
> 
> -Original Message-
> From: xylog [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 10, 2001 9:01 AM
> To: NT System Admin Issues
> Subject: Re: AT COMMAND PROBLEM
> 
> 
> OK the local system account has no network access, that is 
> why it has that
> name, Local means local not network. You need to either 
> assign the Scheduler
> Service a network account or use the GUI task scheduler that 
> lets you assign
> network permissions on a per job basis ( 
> start->run->\\[server-name] and u
> will see a scheduled tasks folder ...)
> 
> -xylog
> 
> - Original Message -
> From: "Stephen Chiang" <[EMAIL PROTECTED]>
> To: "NT System Admin Issues" <[EMAIL PROTECTED]>
> Sent: Friday, August 10, 2001 11:50 AM
> Subject: RE: AT COMMAND PROBLEM
> 
> 
> > I'm seeing the same thing.  My .bat file runs when I double 
> click it, it
> > even runs as scheduled on two other servers running Windows 
> 2000 server,
> but
> > on two other servers.  I've checked permissions on the 
> scheduler service,
> it
> > is set for the Local System account...  should work, it 
> works that way on
> > the other two servers that work. The status code says 0x1 
> in the scheduled
> > tasks screen whenever I try to run it from there.
> >
> >
> >
> >
> > -Original Message-
> > From: Bill Higgins [mailto:[EMAIL PROTECTED]]
> > Sent: Friday, August 10, 2001 7:59 AM
> > To: NT System Admin Issues
> > Subject: RE: AT COMMAND PROBLEM
> >
> >
> > Check permissions on the scheduler service
> >
> > -Original Message-
> > From: Murray Freeman [mailto:[EMAIL PROTECTED]]
> > Sent: Friday, August 10, 2001 07:58
> > To: NT System Admin Issues
> > Subject: AT COMMAND PROBLEM
> >
> >
> >
> > This is really weird. Our AT command works just fine for several bat
> files,
> > but we have one that just won't work. The bat file does 
> nothing more than
> > copy some files from one server to another. If we double 
> click on the bat
> > file, it works just fine. But when the AY command runs, 
> nothing happens.
> If
> > we try to run the AT using the bat file in question just 
> once, it deletes
> > the line from the AT list OK, but it does not copy the 
> files. Any ideas?
> >
> > Murray
> >
> > http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
> >
> > http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
> >
> >
> > http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
> >
> >
> 
> 
> http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
> 
> 
> http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
> 
> http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
> 
> 


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: Memory.dmp

[Bunting, Jeff]

http://support.microsoft.com/support/kb/articles/Q148/6/58.asp

-Original Message-
From: Networking Team [mailto:[EMAIL PROTECTED]]
Sent: Monday, August 13, 2001 5:14 PM
To: NT System Admin Issues
Subject: Memory.dmp


Hello all, what utility can I use to view the memory.dmp file.Word shows
all garbage and wordpad crashs when I try to open it up there...and help
would be appreciated

TIA

Dave Frazer

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

RE: AT COMMAND PROBLEM

[Bunting, Jeff]

NET USE won't work under the local system account.  You'll need to run the
job  under another security context (assuming you have the new scheduler
that lets you do this).  Alternatively, you could change the account
scheduler runs under and create a share to use that has appropriate
permissions.

jeff

-Original Message-
From: Stephen Chiang [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 10, 2001 5:22 PM
To: NT System Admin Issues
Subject: RE: AT COMMAND PROBLEM


Ahhh found out whats wrong.  I cant switch to the L: (network drive
mapped through GUI) through command even though its mapped Any way
around this or do I have to use net use?

-Original Message-
From: xylog [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 10, 2001 9:01 AM
To: NT System Admin Issues
Subject: Re: AT COMMAND PROBLEM


OK the local system account has no network access, that is why it has that
name, Local means local not network. You need to either assign the Scheduler
Service a network account or use the GUI task scheduler that lets you assign
network permissions on a per job basis ( start->run->\\[server-name] and u
will see a scheduled tasks folder ...)

-xylog

- Original Message -
From: "Stephen Chiang" <[EMAIL PROTECTED]>
To: "NT System Admin Issues" <[EMAIL PROTECTED]>
Sent: Friday, August 10, 2001 11:50 AM
Subject: RE: AT COMMAND PROBLEM


> I'm seeing the same thing.  My .bat file runs when I double click it, it
> even runs as scheduled on two other servers running Windows 2000 server,
but
> on two other servers.  I've checked permissions on the scheduler service,
it
> is set for the Local System account...  should work, it works that way on
> the other two servers that work. The status code says 0x1 in the scheduled
> tasks screen whenever I try to run it from there.
>
>
>
>
> -Original Message-
> From: Bill Higgins [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 10, 2001 7:59 AM
> To: NT System Admin Issues
> Subject: RE: AT COMMAND PROBLEM
>
>
> Check permissions on the scheduler service
>
> -Original Message-
> From: Murray Freeman [mailto:[EMAIL PROTECTED]]
> Sent: Friday, August 10, 2001 07:58
> To: NT System Admin Issues
> Subject: AT COMMAND PROBLEM
>
>
>
> This is really weird. Our AT command works just fine for several bat
files,
> but we have one that just won't work. The bat file does nothing more than
> copy some files from one server to another. If we double click on the bat
> file, it works just fine. But when the AY command runs, nothing happens.
If
> we try to run the AT using the bat file in question just once, it deletes
> the line from the AT list OK, but it does not copy the files. Any ideas?
>
> Murray
>
> http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
>
> http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
>
>
> http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
>
>


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm


http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm