RE: Clean & Pristine or Swing Migrations?

No need to seize anything. They can be transferred using GUI management tools or ntdsutil.exe http://www.google.com.sg/#&q=Transfer+FSMO+roles Cheers Ken From: James Rankin [mailto:kz2...@googlemail.com] Sent: Tuesday, 19 July 2011 9:19 PM To: NT System Admin Issues Subject: Re: Clean & Pristin

Security IT to employee ratio

Is there a document anywhere that can give me an idea of something along the lines of a general "recommended active IT security staff per employee ratio"? By "active IT security" I mean in-the-trenches people doing the legwork to get the last 3-5% of systems (at 400+ systems nothing is ever 100%

Re: non-local admin revisited

On Tue, Jul 19, 2011 at 9:36 PM, Kennedy, Jim wrote: > Hmmm, I like this. With UAC on there is validity to running as > an admin all the time, IF you only have admin on your own > machine. I'd still much rather be required to enter a password for privileged operations. Being one click away fro

Re: non-local admin revisited

+1. This is what we do. On Tue, Jul 19, 2011 at 9:36 PM, Kennedy, Jim wrote: > > Hmmm, I like this. With UAC on there is validity to running as an admin all > the time, IF you only have admin on your own machine. Less hassle for them > with minimal risk. Very cool twist Andrew. > > > ___

RE: non-local admin revisited

Hmmm, I like this. With UAC on there is validity to running as an admin all the time, IF you only have admin on your own machine. Less hassle for them with minimal risk. Very cool twist Andrew. From: Andrew S. Baker [asbz...@gmail.com] Sent: Tuesday, Ju

Re: non-local admin revisited

Each person will have a separate account for administrative functions, and whenever they need to perform those functions, they'll use RUNAS with the admin-level account... We do it differently (at my current location). IT members have Win7 and have local admin access of their own machines, but w

Re: non-local admin revisited

Reduce risks related to system infection... * * *ASB* *http://about.me/Andrew.S.Baker* *Harnessing the Advantages of Technology for the SMB market… * On Tue, Jul 19, 2011 at 4:15 PM, Paul Hutchings wrote: > What's your reason for wanting to do it? > -- > *From:*

Re: Clean & Pristine or Swing Migrations?

You will have to give it time and you will need to move the FSMO roles to the new DC. Jon On Tue, Jul 19, 2011 at 7:03 AM, Pierre Camilleri < pierre.camill...@fosterclark.com> wrote: > Thanks for your advice. Then if I go ahead by demoting the old domain > controller, switch it off and have only

Re: Windows Sysinternals Administrator's Reference

Yes, much thanks! Jon On Tue, Jul 19, 2011 at 5:49 PM, Andrew S. Baker wrote: > Cool! Thanks > > * * > > *ASB* *http://about.me/Andrew.S.Baker* *Harnessing the Advantages of > Technology for the SMB market… > > * > > > > On Tue, Jul 19, 2011 at 5:37 PM, Free, Bob wrote: > >> I think some folk

RE: non-local admin revisited

That's my preference. From: Kennedy, Jim [mailto:kennedy...@elyriaschools.org] Sent: Wednesday, 20 July 2011 3:54 AM To: NT System Admin Issues Subject: RE: non-local admin revisited Create a domain group called IT Local Admins and add the domain IT Admin accounts you create to it. Then add tha

Re: Windows Sysinternals Administrator's Reference

Cool! Thanks * * *ASB* *http://about.me/Andrew.S.Baker* *Harnessing the Advantages of Technology for the SMB market… * On Tue, Jul 19, 2011 at 5:37 PM, Free, Bob wrote: > I think some folks have been waiting for this for a while > > http://technet.microsoft.com/en-us/sysinternals/hh290

Re: Thought on malware cleaning

Don’t hold back ( MMF From: Micheal Espinola Jr Sent: Tuesday, July 19, 2011 3:15 PM To: NT System Admin Issues Subject: Re: Thought on malware cleaning On that note, I'm going to go on my lunch break now. Here's what I'll do: I'm going to close my eyes and walk in the direction of my c

RE: Thought on malware cleaning

Good luck with that …. And really, good luck on your *stated* quest. Please keep me in the loop on your findings. Layered security usually proves better, and you seem to be hunting for that as of yet ignored layer. Erik Goldoff IT Consultant Systems, Networks, & Security ' Security is a

Re: Thought on malware cleaning

On Tue, Jul 19, 2011 at 4:01 PM, Micheal Espinola Jr wrote: >>> While I agree with your sentiment whole-heartedly, I still wonder why >>> antimalware software isnt performing the most basic of checks for common >>> infection breadcrumbs. >> >> Hammer myopia. > > Well that's f'ing helpful. You

Windows Sysinternals Administrator's Reference

I think some folks have been waiting for this for a while http://technet.microsoft.com/en-us/sysinternals/hh290819 I've also been waiting for an update to Process Explorer and I think a couple of folks here mentioned they were as well. http://blogs.technet.com/b/sysinternals/archive/2011/07

Re: Thought on malware cleaning

Just be glad that I am not the person to come and help you when you run into a wall. I'll just point you into another wall, or worse, a hallway plant of some sort, and watch you fall down, hoping that the floor will 'give way to your will' and watch you either fall flat on your face, or go through

RE: Clean & Pristine or Swing Migrations?

Same here transitioned from Netware 4.11 to NT4 and then to 2000, 2003 and 2008. Never had a problem. From: Steve Ens [mailto:stevey...@gmail.com] Sent: Tuesday, July 19, 2011 3:54 PM To: NT System Admin Issues Subject: Re: Clean & Pristine or Swing Migrations? Mine was NT4 to 2000 to 20

Re: Thought on malware cleaning

On that note, I'm going to go on my lunch break now. Here's what I'll do: I'm going to close my eyes and walk in the direction of my car. Screw anything I walk into, because logically there should be doors that automatically open in the direction I need to go. Screw how things currently exist,

RE: non-local admin revisited

What's your reason for wanting to do it? From: David Lum [david@nwea.org] Sent: 19 July 2011 6:10 PM To: NT System Admin Issues Subject: non-local admin revisited How do you bigger org’s handle IT staff (DBA’s and the like) not being local admins on their syst

Re: Thought on malware cleaning

Well that's f'ing helpful. Good luck on educating the planet with a more logical course of action. Let us know how that works-out for you! -- Espi On Tue, Jul 19, 2011 at 12:44 PM, Ben Scott wrote: > On Tue, Jul 19, 2011 at 3:02 PM, Micheal Espinola Jr > wrote: > > While I agree with you

RE: non-local admin revisited

You're going to create user/id passwords they'll all know anyway to do "runas"? From: Kennedy, Jim [mailto:kennedy...@elyriaschools.org] Sent: Tuesday, July 19, 2011 10:54 AM To: NT System Admin Issues Subject: RE: non-local admin revisited Create a domain group called IT Local Admins an

Re: Clean & Pristine or Swing Migrations?

Mine was NT4 to 2000 to 2003 to 2008 and now 2008R2...and then Windows Server 8, soon to come. On Tue, Jul 19, 2011 at 2:39 PM, Jacob wrote: > +1… I have never done a clean install of AD.. always been a migration (from > 2000 to 2003 to now 2008). I do not want to go through that headache. >

Re: Thought on malware cleaning

On Tue, Jul 19, 2011 at 3:02 PM, Micheal Espinola Jr wrote: > While I agree with your sentiment whole-heartedly, I still wonder why > antimalware software isnt performing the most basic of checks for common > infection breadcrumbs. Hammer myopia. ("When all you have is a hammer, everything s

RE: Clean & Pristine or Swing Migrations?

+1. I have never done a clean install of AD.. always been a migration (from 2000 to 2003 to now 2008). I do not want to go through that headache. From: Andrew S. Baker [mailto:asbz...@gmail.com] Sent: Monday, July 18, 2011 8:33 AM To: NT System Admin Issues Subject: Re: Clean & Pristine or Swi

RE: Weird Duplicate IP address problem

Thank you Michael, that seems to have fixed it for me. Rebooted the server 3 times and no errors. It's great to be able to get a suggestion from someone else when you're overlooking something. The help is much appreciated. Ralph Smith From: Michael B. Smith [mailto:mich...@smithc

Re: Thought on malware cleaning

While I agree with your sentiment whole-heartedly, I still wonder why antimalware software isnt performing the most basic of checks for common infection breadcrumbs. I think we are all painfully aware that malware detection must go beyond the basic signature match. Malware and exploits follow a lo

RE: Weird Duplicate IP address problem

I think maybe I'll take that hammer to my own head - but I'll definitely use the virtual one. Michael's suggestion to remove the NIC from the VM and let it reinstall appears to have resolved the problem. From: Kennedy, Jim [mailto:kennedy...@elyriaschools.org] Sent: Tuesday, July 19, 2011 2:

RE: Weird Duplicate IP address problem

I was thinking the projector. But redo the mac spoofing as Michael suggested first. From: Ralph Smith [mailto:m...@gatewayindustries.org] Sent: Tuesday, July 19, 2011 2:22 PM To: NT System Admin Issues Subject: RE: Weird Duplicate IP address problem The server? I could beat it with my virtual h

RE: Weird Duplicate IP address problem

The server? I could beat it with my virtual hammer but it just wouldn't be as satisfying. From: Kennedy, Jim [mailto:kennedy...@elyriaschools.org] Sent: Tuesday, July 19, 2011 2:05 PM To: NT System Admin Issues Subject: RE: Weird Duplicate IP address problem Take it out back and beat it w

RE: Weird Duplicate IP address problem

I recommend you put dynamic MAC addresses back, leave spoofing turned off, remove the hyper-v NIC from the device manager in the VM, let the hyper-v NIC reinstall on reboot of the VM, and then reconfigure the NIC properly inside the VM. Regards, Michael B. Smith Consultant and Exchange MVP htt

RE: Weird Duplicate IP address problem

I have seen this happen with dual nics in a server. Solution is to use the nics in a cluster. Make sure that you have updated NIC drivers as well. Also make sure that the DHCP server isn't giving out the server address via dhcp. Make sure no one (you know how NO one is) did a custom mac address

RE: non-local admin revisited

+1 for Yanking Local Administrator. Z Edward E. Ziots CISSP, Network +, Security + Security Engineer Lifespan Organization Email:ezi...@lifespan.org Cell:401-639-3505 From: David Lum [mailto:david@nwea.org] Sent: Tuesday, July 19, 2011 1:10 PM To: NT System Admin Issues Su

RE: Weird Duplicate IP address problem

Mac spoofing is not checked. At one time the VM was set for dynamic MAC addresses, but it is now set to static. From: Michael B. Smith [mailto:mich...@smithcons.com] Sent: Tuesday, July 19, 2011 2:08 PM To: NT System Admin Issues Subject: RE: Weird Duplicate IP address problem Is mac spoo

RE: Weird Duplicate IP address problem

The server has a standard hyper-v NIC, the host NIC to which it is attached is an Intel Pro/1000, and going by the MAC address on the projector it is a D-Link. There are Broadcom NICs on the host machine, but I wouldn't think they would be a factor somehow, would they? From: richardmccl...@asp

RE: Weird Duplicate IP address problem

I asked about the Broadcom NICs because we have a couple of servers here that spew out gratuitous ARP packets... The servers with the Broadcom NICs are on one subnet, and our VoIP phones are on another. Still, these two (so far) servers spew out gratuitious ARP packets. SO, when a phone boots

RE: Weird Duplicate IP address problem

Is mac spoofing turned on for the VM? Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com From: Ralph Smith [mailto:m...@gatewayindustries.org] Sent: Tuesday, July 19, 2011 12:56 PM To: NT System Admin Issues Subject: Weird Duplicate IP address problem I have

RE: Weird Duplicate IP address problem

Take it out back and beat it with a hammer. Tell the bean counters someone must have dropped it. From: Ralph Smith [mailto:m...@gatewayindustries.org] Sent: Tuesday, July 19, 2011 2:02 PM To: NT System Admin Issues Subject: RE: Weird Duplicate IP address problem Unfortunately I can't give the pr

Re: Weird Duplicate IP address problem

Can you telnet into the projector and change it via CLI? On Tue, Jul 19, 2011 at 2:01 PM, Ralph Smith wrote: > Unfortunately I can’t give the projector a static IP because I have a > classless subnet (255.255.252.0 mask) and the web interface on the projector > will only accept classful subnet m

RE: Weird Duplicate IP address problem

Unfortunately I can't give the projector a static IP because I have a classless subnet (255.255.252.0 mask) and the web interface on the projector will only accept classful subnet masks. Infocus tech support was zero help with this. It will accept a DHCP assigned address with this mask, at least.

RE: non-local admin revisited

Create a domain group called IT Local Admins and add the domain IT Admin accounts you create to it. Then add that group to the computers using restricted groups. Remember, restricted groups REPLACES everything in the local admin group when you apply that GPO. It does not add...it replaces. Fro

Re: Weird Duplicate IP address problem

Are Broadcom NICs involved anywhere? -- richard "Ralph Smith" wrote on 07/19/2011 11:56:28 AM: > I have a Windows 2008 Server with a statically assigned IP address > that seems to have an issue with another device on my network. > Whenever the server is rebooted, it displays an error that ther

Re: non-local admin revisited

+1000 On Tue, Jul 19, 2011 at 1:34 PM, Don Ely wrote: > Domain account with local admin privs > On Jul 19, 2011 10:32 AM, "David Lum" wrote: > > A local admin account? So 50 IT folks would have 50 different local admin > accounts? Other than the deny log on locally what keeps them from creating

Re: non-local admin revisited

What Don Ely said. A group that is in the local administrators group on each PC. And it can be managed via Group Policy Preferences. Easy, peasy, lemon squeezey. I run with three (in reality four) accounts, I'm a one man shop. User account, no admin access anywhere. Workstation admin group, I

Re: Weird Duplicate IP address problem

Have you tried giving the projector a static IP and rebooting the server? On Tue, Jul 19, 2011 at 12:56 PM, Ralph Smith wrote: > I have a Windows 2008 Server with a statically assigned IP address that > seems to have an issue with another device on my network. > > Whenever the server is reb

RE: non-local admin revisited

Domain account with local admin privs On Jul 19, 2011 10:32 AM, "David Lum" wrote: > A local admin account? So 50 IT folks would have 50 different local admin accounts? Other than the deny log on locally what keeps them from creating an admin account while logged in as admin? > > Win 7 makes alter

RE: non-local admin revisited

A local admin account? So 50 IT folks would have 50 different local admin accounts? Other than the deny log on locally what keeps them from creating an admin account while logged in as admin? Win 7 makes alternate credentials easy enough at least... Dave. From: Kennedy, Jim [mailto:kennedy...

Re: Clean & Pristine or Swing Migrations?

+1 -- Espi On Mon, Jul 18, 2011 at 9:02 AM, Jonathan Link wrote: > +1 DNS problems are usually easily solved, much less work than recreating a > domain from scratch... > > On Mon, Jul 18, 2011 at 11:44 AM, Steve Ens wrote: > >> That's how I did it...worked fine. Mind you we don't have too

RE: non-local admin revisited

+1 From: Don Ely [mailto:don@gmail.com] Sent: Tuesday, July 19, 2011 1:19 PM To: NT System Admin Issues Subject: Re: non-local admin revisited Provide them with an admin account and show them how to use "run-as"... I also disable logon locally where I can get away with it so they don't chea

Re: non-local admin revisited

Provide them with an admin account and show them how to use "run-as"... I also disable logon locally where I can get away with it so they don't cheat... On Tue, Jul 19, 2011 at 10:10 AM, David Lum wrote: > How do you bigger org’s handle IT staff (DBA’s and the like) not being > local admins on

Weird Duplicate IP address problem

I have a Windows 2008 Server with a statically assigned IP address that seems to have an issue with another device on my network. Whenever the server is rebooted, it displays an error that there is a duplicate IP address on the network, and changes its own address to an auto-configured 169... add

RE: Separate OB Domain - Mail Routing (Exch 2003)

You should already have an SMTP connector specifying a smarthost. Change its default cost to 2. Create a new SMTP connector for that one domain specifying a different smarthost. Set its default cost to 1. Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com -

Separate OB Domain - Mail Routing (Exch 2003)

Right now we have all domains being pushed out bound to 1 smart host (postini) I have a need to move one of my domains to a separate postini account, but cannot find any good documentation On how to separate this domain out so mail will still flow appropriately... So I need to keep all domains ro

RE: Q about Cluster Migration Wizard

I assume it will just create the resources but they won't be able to come online. I've never tried, though so I have no idea. Thanks, Brian Desmond br...@briandesmond.com c   - 312.731.3132 -Original Message- From: Mike Leone [mailto:oozerd...@gmail.com] Sent: Tuesday, July 19, 2011

Q about Cluster Migration Wizard

We will be migrating a Win2003 cluster to a new Win2008 R2 cluster this weekend. My boss has decided that we will not be using the File Server Migration Toolkit to move the data from the old cluster to the new. And since he's on vacation this week, that decision won't change. So what we will be do

Re: Clean & Pristine or Swing Migrations?

You should really read about this before you do it. Just google DCpromo and you'll find plenty of information so you understand what you are doing. Pierre Camilleri wrote: Should I transfer RID, PDC and Infrastructure? ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~

RE: Vipre- possible false positive DAT??

I am currently on 9903 & the below indicated file is not being detected. (xl8galry.xls) If that does not resolve it - please upload a sample to the falsepositive site below. Regards, Tammy _ From: John Leto [mailto:jo...@colonialsavings.com] Sent: Tuesday, July 19, 2011 9:

Re: Clean & Pristine or Swing Migrations?

http://lmgtfy.com/?q=seize+fsmo+roles On Tue, Jul 19, 2011 at 8:14 AM, Pierre Camilleri < pierre.camill...@fosterclark.com> wrote: > How can I transfer the FSMO roles? > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > ~

RE: Net group command

Ahhh, sorry, read the original message before my 2nd cup of coffee. J Don Guyer Windows Systems Engineer RIM Operations Engineering Distributed – A Team, Tier 2 Enterprise Technology Group Fiserv don.gu...@fiserv.com Office: 1-800-523-7282 x 1673 Fax: 610-233-0404 www.fi

RE: Vipre- possible false positive DAT??

We have a machine with 9900 and it still has the issue, I do not belive this has been resolved. From: Tammy Stewart [mailto:copper...@personainternet.com] Sent: Tuesday, July 19, 2011 8:32 AM To: NT System Admin Issues Subject: RE: Vipre- possible false positive DAT?? For anyone seeing this fals

Re: Clean & Pristine or Swing Migrations?

Should I transfer RID, PDC and Infrastructure? ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana

RE: Vipre- possible false positive DAT??

For anyone seeing this false positive & not yet reported it to our site/support - Please make sure you have definition 9900 or higher which should be correcting the issue. If still seeing files detected (falsely) the below site can be used to upload samples. If assistance is needed to restore

RE: Net group command

The group I'm enumerating does not have spaces, one of the members of this group has spaces in the name. Chris Bodnar, MCSE, MCITP Technical Support III Distributed Systems Service Delivery - Intel Services Guardian Life Insurance Company of America Email: christopher_bod...@glic.com Phone: 610-

Re: Clean & Pristine or Swing Migrations?

Plus, they should be transfered properly when depromoting the old DC... * * *ASB* *http://about.me/Andrew.S.Baker* *Harnessing the Advantages of Technology for the SMB market… * On Tue, Jul 19, 2011 at 9:18 AM, James Rankin wrote: > You can seize certain roles through ADUC with the Operatio

Re: Clean & Pristine or Swing Migrations?

You can seize certain roles through ADUC with the Operations Masters menu item when you right-click the domain On 19 July 2011 14:14, Pierre Camilleri wrote: > How can I transfer the FSMO roles? > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > ~

Re: Clean & Pristine or Swing Migrations?

How can I transfer the FSMO roles? ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.su

RE: Vipre- possible false positive DAT??

Good morning everyone, I see a couple samples that have been sent in to our f/p report site so looks like they are aware. If someone wants to submit a suspect f/p file - here is where you can upload it to: http://www.sunbeltsecurity.com/falsepositive/ Regards, Tammy _

RE: Vipre- possible false positive DAT??

Is Sunbelt (GFI) aware of this? Nothing on their website yet... From: Mike Wiebke [mailto:m...@yahoo.com] Sent: Tuesday, July 19, 2011 8:52 AM To: NT System Admin Issues Subject: Re: Vipre- possible false positive DAT?? I'm seeing the same with threatdb version 9897 - 9900

Re: Clean & Pristine or Swing Migrations?

Remember to transfer fsmo roles to the new dc Sent from my FriPad On 2011-07-19, at 6:03 AM, "Pierre Camilleri" wrote: > Thanks for your advice. Then if I go ahead by demoting the old domain > controller, switch it off and have only the new domain controller up and > running then users s

Re: Vipre- possible false positive DAT??

I'm seeing the same with threatdb version 9897 - 9900 From: N Parr To: NT System Admin Issues Sent: Tue, July 19, 2011 7:07:22 AM Subject: RE: Vipre- possible false positive DAT?? ditto From: John Leto [mailto:jo...@col

RE: Vipre- possible false positive DAT??

What defs? From: John Leto [mailto:jo...@colonialsavings.com] Sent: Tuesday, July 19, 2011 7:43 AM To: NT System Admin Issues Subject: Vipre- possible false positive DAT?? This morning I came in and noticed that Vipre had flagged several machines in my organization with a possible virus

RE: Net group command

I'm assuming you're putting the name of the group in quotes. "If a group name has a space in it, for example Domain Admins, you need to specify the group name inside quotation marks ("Domain Admins")." Don Guyer Windows Systems Engineer RIM Operations Engineering Distributed - A Team, Tie

RE: .net framework 3.5 via WSUS

Yes-ours show up like below in the list. I think KB959209 is the one you are talking about? [cid:image001.png@01CC45D5.22DD70B0] From: Tres Coker [mailto:tlco...@gmail.com] Sent: Tuesday, July 12, 2011 8:51 AM To: NT System Admin Issues Subject: .net framework 3.5 via WSUS Has anyone pushed F

RE: Vipre- possible false positive DAT??

ditto From: John Leto [mailto:jo...@colonialsavings.com] Sent: Tuesday, July 19, 2011 6:43 AM To: NT System Admin Issues Subject: Vipre- possible false positive DAT?? This morning I came in and noticed that Vipre had flagged several machines in my organization

Net group command

I typically don't enumerate groups with this command, but an internal auditor is using it and found a discrepancy between what ADUC shows, and using NET GROUP or NET GROUPS. For example GROUP1 (a domain global group) has 3 members, one global group and 2 user accounts. When viewing this in ADU

Re: Clean & Pristine or Swing Migrations?

Thanks for your advice. Then if I go ahead by demoting the old domain controller, switch it off and have only the new domain controller up and running then users should be able to log in as per usual without any issues. The swing migration has migrated across everything including OUs, Machine an

Re: Clean & Pristine or Swing Migrations?

Why do you need to have the domain controller using the same name as before? I wouldn't do this at all. Bring up a new DC, and point whatever you need to (via logon scripts or group policy) to the new name. Much cleaner... If you insist on ending up with the same DC names, then build a temp DC,

Re: Clean & Pristine or Swing Migrations?

I re-ran DCpromo and then DNS worked well. Prefer the Swing migration. I have a further query if you don't mind. I now have two domain controllers, one is the current source domain controller and the other one is the target domain controller. I now wish to promote the target domain controller to