Hard disks always go wrong eventually – they come with MTBF ratings, that’s Mean Time Before Failure Between Failures. The manufacturer just knows that one day all that data is going away and not coming back. They’re like lightbulbs, but less predicatable. That’s why it’s such a good idea to make backups, and preferably offsite. Then when your hard disk goes tits up, you’ll feel smug, rather than homicidal.
If you’ve worked with computers for any length of time, you’ll probably have had the task of recovering data from a ‘dead’ hard disk. Maybe your own, maybe a friends, maybe the business next door. I’ve had a few to deal with over the years and in all the situations, all the important data was recoverable without calling in professional services. Usually it’s just a question of loading up some file recovery software, scanning the disk for files that are intact and copying them to a new drive. But here’s something more involved – the electronics in this guy’s drive were totally fried but rather than give up on it, he got a drive of exactly the same model and used it for parts to get the old drive working again. That’s great geek heroics. The attitude with most electronics is that it’s easier and cheaper to replace rather than to repair and that’s pretty wasteful. But that attitude doesn’t work well with hard disks when there’s all that data resting on it.

If your like me and don’t need the hassel! Make Backups !

After setting up a small Exchange lab and successfully configuring Outlook Web Access (OWA) using a free SSL certificate, I thought it would be interesting to try enabling RPC over HTTPS.

In order to make use of all Exchange’s collaborative tools, Outlook must communicate with the Exchange server via the remote procedure call protocol (RPC). It’s not a good idea to open these ports to the Internet due to RPC’s rich history of exploitable vulnerabilities. RPC over HTTPS allows RPC traffic to be tunnelled inside secured HTTP packets. This enables roaming users to enjoy full Outlook/Exchange functionality without having to open any additional firewall ports or dial a VPN connection.

My test lab setup contains one Domain Controller and one Exchange 2003 server (SP2). The Domain Controller provides Domain, DNS, and DHCP services while the Exchange server hosts OWA, which has been configured to run over HTTPS. Although RPC can be tunnelled inside unencrypted HTTP packets, I think this is an unnecessary risk, so I won’t even tell you how to do it! If you really want to, then Google may be of some help. I’m using a standard DSL router setup to forward
ports 25 and 443 to the Exchange server.

Modify the Domain Controller

Let’s get down to business. We will start on the Domain Controller. It’s important to note that the Domain Controller must be a Global Catalogue. We only need to make one update to the registry and can then move on to Exchange.

Add the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters

Type REG_MULTI_SZ

Name: NSPI Interface protocol sequences

Value: ncacn_http:6004

There should be no need to reboot, but if things don’t seem to be working correctly later on, then give it a go.

Install RPC over HTTP proxy

Installing the RPC over HTTP proxy service is pretty simple.

1. On the Exchange server, open Control Panel. Launch add/remove programs and click on the Add/Remove Windows Components button.
2. Scroll down the available Windows components and highlight Networking Services.
3. Click on Details to open up a list of subcomponents and select RPC over HTTP Proxy.
4. Click on OK and then Next to install the service.

Configure ports for the RPC proxy

Now that we have the RPC proxy installed, we will need to configure the ports that it uses. To do this, we update a registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\RpcProxy

The ValidPorts key will likely already include an entry for ports 100-5000; we need to add a few more. Below is a copy of my key; you will need to change the hostnames and domains to match your own environment. To make this easier to read, I have split the data string into multiple lines. This should be entered as a single line with no spaces after the semicolons.

Exchange1:100-5000;

Exchange1:6001-6002;

Exchange1.internaldomain.local:6001-6002;

PDC:6001-6002;

PDC.internaldomain.local:6001-6002;

mail.externaldomain.com:6001-6002;

Exchange1:6004;

Exchange1.internaldomain.local;

PDC:6004;

PDC.internaldomain.local:6004;

mail.externaldomain.com:6004;

Exchange1:593;

Exchange1.internaldomain.local:593;

PDC:593;

PDC.internaldomain.local:593;

mail.externaldomain.com:593;

If the Domain Controller and Exchange server are on the same box then entries for the Domain Controller (in my case, this is PDC) and also port 593 should be excluded.

Configure Exchange server as an RCP-HTTP back-end server

Telling the Exchange server to act as a target for the RPC proxy is very simple.

1. Open up Exchange System Manager, browse to your target server, right-click, and select Properties.
2. Just above the General tab you will find the RPC-HTTP tab. Select this tab and ensure that the option ‘RPC-HTTP back-end server’ is checked.
3. Click on OK to exit.

Modify IIS virtual directories

Installing the RPC proxy will create two new virtual directories under your Default Web Site. We need to modify these slightly in order to allow proper authentication and encryption of RPC over HTTP connections.

1. Open up the IIS Manager.
2. Navigate to Web Sites | Default Web Site.
3. Right click on the RPC directory and select Properties from the drop-down menu.
4. Select the Directory Security tab.
5. Click on the Edit button within ‘Authentication and access control’.
6. Make sure that the option ‘Enable anonymous access’ is deselected.
7. Check ‘Integrated Windows authentication’ and ‘Basic authentication’ and click on OK. You may be prompted with a warning dialogue; click on Yes and ignore this as it does not apply while using SSL.
8. Click on the Edit button within ‘Secure communications’.
9. Check ‘Require secure channel (SSL)’ and ‘Require 128-bit encryption’ and click on OK.
10. Click on OK to apply the changes.

Repeat these steps for the RPCWithCert directory.

Configure Outlook 2003 for RPC over HTTPS

I won’t go over adding a new Exchange account to Outlook as it’s a pretty standard affair and there are a myriad of support sites covering this. I already have Outlook configured to connect to my Exchange server. I’m using cached mode as I want to emulate a configuration which would be used by a roaming laptop user. Cached mode keeps a local copy of e-mails and attachments so that the data can be accessed offline.

To configure RPC over HTTPS:

1. Go to the Open The Account settings, select your Exchange account, and click on More Settings.
2. Go to the Connection tab and tick the checkbox next to ‘Connect to my Exchange mailbox using HTTP’.
3. Now open up the ‘Exchange Proxy Settings’ and use the options below.

Use this URL to connect to my proxy server for Exchange:

https://mail.externaldomain.com

• Check ‘Connect using SSL only’.
• Check ‘Mutually authenticate the session when connection with SSL’.
• ‘Principal name for proxy server:’ msstd:mail.externaldomain.com
• If you want to use RPC over HTTPS even while on the internal network, then check ‘On fast networks, connect using HTTP first, then connect using TCP/IP’ (I don’t use this).
• Make sure ‘On slow networks, connect using HTTP first, then connect using TCP/IP’ is checked.
• For the ‘Proxy authentication settings’ we can use either NTLM or Basic authentication. I prefer NTLM as it doesn’t constantly prompt for a username and password to be entered.

Apply the changes and you’re ready to start testing. Don’t forget to forward port 443 to the Exchange Server on your external firewall.

Testing RCP over HTTPS

There are two ways to test whether or not RCP over HTTPS is working. The first is to try connecting from outside of your internal network. The second is to filter all ports but 443 while on the internal network to make sure that Outlook can’t connect via the standard TCP/IP protocols. To apply such a filter, go to the advanced TCP/IP properties of your network connection, select filtering, and deny all but port 443.

One important thing to note is that if you’re connecting Outlook to the Exchange server for the first time, then you must be on the internal network using TCP/IP. I’m not sure why this is but found out using trial and error.

To check whether Outlook has connected via HTTPS you must hold down [Ctrl] and click on Outlook’s taskbar icon. Select ‘Connection status’ and you will see a list of all connections between Outlook and the Exchange server. These should all be of the type HTTPS.

I hope this has been a useful guide for those looking to try out RPC over HTTPS with Exchange 2003. I haven’t covered every angle in detail as there is plenty of information available on the Web; rather I have tried to cover the areas where I had difficulty in finding solid information while researching this topic for myself.

If you’ve ever wondered how to change the name of the person that Windows is registered to, this is the quick tip for you. It’s not all that useful, but it might come in handy if you got a computer from somebody else.

Open up regedit.exe through the start menu search box, and then locate the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion

Now you can find the RegisteredOwner and RegisteredOrganization keys in the right-hand pane. Change them to whatever values you want.

Setting Up The SyncToy Automation Script

The VB Script that I’m going to show you will check the current time of day, and will run the appropriate command to launch the Microsoft SyncToy program and back up the right directory.

It does this by using the name of the paired directory that you set up in the tool above. Copy the script into notepad and save it as something like “databackup.wsf”.

<job>

<script language="VBScript">

Option Explicit

On Error Resume Next

Dim HourNow

Dim strHour

Dim WshShell

Dim strProgFiles

HourNow = Hour(Now())

set WshShell=CreateObject("WScript.Shell")

strProgFiles = WshShell.ExpandEnvironmentStrings("%PROGRAMFILES%")

Select Case HourNow

 case HourNow >= 0 and HourNow < 7

 WshShell.exec strProgFiles & "\SyncToy 2.1\SyncToyCmd.exe -R MorningFiles"

 case HourNow >= 7 and HourNow < 13

 WshShell.exec strProgFiles & "\SyncToy 2.1\SyncToyCmd.exe -R NoonFiles"

 case HourNow >= 13 and HourNow < 19

 WshShell.exec strProgFiles & "\SyncToy 2.1\SyncToyCmd.exe -R MailArchives"

 case else

 WshShell.exec strProgFiles & "\SyncToy 2.1\SyncToyCmd.exe -R EveningFiles"

End Select

WScript.Quit

</script>

</job>

The script above simply checks the hour right now (based on the PC clock where the script runs), and if it is between midnight and 6:59 a.m., it will sync the “MorningFiles” pair that you set up. Between 7 a.m. and 12:59, the “NoonFiles” pair, and so on.

All you have to do now is set up a Windows scheduled task that will launch the script above four times a day within the four time spans. This is also pretty easy, just go to the Control Panel, Administrative Tools, and open up the Task Scheduler. Click on “Create Task”.

Name the task, and then click on the trigger tab. Make sure to select “On a schedule“, Daily, recur every day, start at 3 a.m., and then at the bottom click to repeat the task every 6 hours. This will trigger the task at 0300, 0900, 1500 and 2100 hours.

Those are all within one of the four time spans that you scheduled into your script. Now click on the Actions tab, and select “Start a program” from the dropdown list and browse to where you stored the script.

That’s all there is to it! Now, the task scheduler will launch your single script four times a day (no need to mess with multiple tasks). Your script will handle launching SyncToy in command mode by launching “SyncToyCmd.exe -R EveningFiles” – with whatever file pair you named after “-R”.

You can monitor whether your script is running by checking the SyncToy log file at “C:\Users\Owner\AppData\Local\Microsoft\SyncToy\2.0\SyncToyLog.log”

The log updates every time SyncToy is run, and it’ll show you what directory was backed up, when it was done, the file count and the size of the backup.

Does this data backup solution work for you? Do you have any other ways you like to automatically back up important data files and folders? Share your thoughts in the comments section below.

As this backup job is going to be run by the user, we want to make the process as simple as possible. SyncToy has nice feature that allows it to run in batch mode by using -R switch. Open notepad and add the follow line “C:\Documents and Settings\<your username>\Local Settings\Application Data\SyncToy\SyncToy.exe” -R.

You might need to double check the location of the SyncToy.exe as this varies depending on the version of Windows. Save the file with a .bat extension to the desktop. Now the user can simply double click on the batch file and SyncToy will complete backup jobs that have been defined.

Alternatively you can have Windows Task Schedule (Found in the control panel) run the batch so the whole process becomes automated.

Schedule SyncToy to Run Automatically With Task Scheduler in Windows 7

SyncToy is a great tool to help you keep your files and folders synced between drives and devices.  Here’s how you can make it do sync automatically so your files will stay synced even if you forget to sync them.

By default, SyncToy only synchronizes your files when your fun the program and directly tell it to sync.  This might work fine for syncing files to a flash drive before heading out on a trip, but makes it difficult if you’re using it to synchronize files regularly between folders or drives on your computer or with Dropbox.  Windows includes an often overlooked scheduling tool that can automatically run many applications without any action on your part.  Let’s see how you can setup SyncToy to automatically sync with the Task Scheduler.

Automatically Run SyncToy

First, make sure you have SyncToy installed and have some syncs setup.

Now open Task Scheduler to get SyncToy automatically syncing.  Type Task Scheduler in the Search box in the Start Menu and hit Enter.

Once Task Scheduler opens, click Create Basic Task on the right sidebar.

Enter a name and a description for your task in the dialog that opens so you’ll be able to easily recognize your task.

Choose how often you want to run the task.  Note that Daily is the most frequent you can select in the dialog, but we can tweak this later in the settings.  Click Next to continue.

You’ll be asked to add additional settings depending on the trigger you selected previously.  If you chose Daily, then the default settings should work fine.  Note that it will automatically run daily at the current time; if you’d rather it run at a different time, enter the time you’d like in the box.

Now, you’ll be asked what you want the action to do…Click Start a program.

In the Program/script box, enter the following including the quotes:

“C:\Program Files\SyncToy 2.1\SyncToyCmd.exe”

Then, in the Add arguments box, enter –R to run all of your syncs each time.

Alternately, if you’d only like to run one of your syncs, enter –R “your sync name”.  Make sure to enter the sync name inside quotes if it contains any spaces.  Once you’re finished, click Next to continue.

If you left out the quotes in the program’s field, Task Scheduler will ask if you want to run C:\Program with the remainder as an argument.  Click No to keep it like you entered, and Task Scheduler will add the quotes correctly for you.

You’re finally finished.  The Wizard will show you a summary of the sync settings; click Finish to save the changes.

Now your sync will automatically run as you set, and you’ll never have to worry about running it manually again!

Edit Your Sync Schedule

If you’d like to make your files sync more often or change other things about your task, you can easily do so from the Task Schedule interface.  Click on the Task Scheduler Library on the left side to find your task.

Scroll through the tasks listed, and find the one you created previously.  You’ll see an overview of its settings in the preview underneath.

On the right sidebar, click Properties to change its settings.

To change how frequently it syncs, click the Triggers tab and double-click on your time listed.

Now you can select to have it repeat the task every hour or any other time you want, for as long as you want.  This dialog is much more flexible than the previous one used when creating the task.

Back in the Properties dialog, the Conditions tab lets you choose whether or not to run this task when your computer is running on battery power if you’re using a laptop/netbook.  By default it will only run when on AC power, but you can uncheck the box if you’d rather it sync even if you’re on battery.

You can also go ahead and run the task manually from the Task Scheduler if you’d like.  You may notice a command prompt window open while the sync is running, but it won’t require any input from you.

Conclusion

No matter what you need to sync, SyncToy is a handy tool to make sure all of your files are kept in different locations.  You can run as many syncs as you want automatically with the Task Scheduler, freeing you up for more important tasks.

While supplies last !

D-Link EBR-2310 Cable/DSL Ethernet Router Create a wired network in your home using the D-Link Ethernet Broadband Router (EBR-2310). Connect this Wired Router to a broadband modem and share your high-speed Internet access, check email, share files, and enjoy online gaming. This Wired Router provides four 10/100 Ethernet ports to connect up to four Ethernet-enabled PCs or network devices. Switching capabilities have been integrated into this device to efficiently manage your network traffic. Security Protection This Wired Router includes a built-in firewall for safeguarding your network from hackers and malicious attacks. Parental control features are also included to monitor Internet usage and block inappropriate content. Easy to Install and Use The Quick Router Setup Wizard is provided to help you set up your network in minutes. A built-in Cable Tester Utility is also included to help you diagnose and troubleshoot physical cable problems. For creating a simple wired network for your home, the easy-to-use D-Link Ethernet Broadband Router (EBR-2310) gets the job done. Price: $11.99

“Fix My Network” wizard.

The wizard is designed to detect known problems on your network, and then give you the option to fix them or not. There are roughly 70-80 different checks and fixes that it does. Some important things to note:

1. The fixes may have dependencies. For example, if the wizard detects that the DHCP services are stopped, it will report that, but won’t be able to check the configuration inside the DHCP service, because it’s stopped. So, it’s important to run this wizard a few times, until you’re happy with the issues it’s finding/not finding.
2. If you replace your router on your network, or change your router IP address, you should consider running the Connect to the Internet Wizard first.
3. The wizard is designed to bring the network back to a “known good” working state. So any custom configuration will be un-done.

Now that you know how to use the wizard, what exactly are the things we keep an eye on? Well, to know exactly, you will have had to work on the wizard, but here is the high level.

1. Network Cards
   1. Disabled Network Cards
   2. Additional Network Cards
   3. Duplicate IP, Missing IP, Extra IP addresses
   4. Incorrect DNS, Gateway and subnet settings
   5. NIC unplugged from the network
2. DHCP Configuration
   1. DHCP Enabled and running
   2. DHCP scope settings
   3. DHCP IPv4 and IPv6 settings
3. Local DNS Configuration
   1. Missing Zones
   2. Invalid Names and domains
   3. Missing records
   4. Reverse Zones invalid or missing
4. Internet DNS (if with a domain name partner)
   1. Missing Records
   2. Missing or incorrect credentials
   3. Domain configured and in good standing with provider
   4. Dynamic DNS client is configured correctly (if running)
5. SSL Certificate Configuration
   1. Invalid Root and Leaf Certificates
   2. Invalid Certificate installation package
   3. Certificate installed on IIS
   4. Self-Issued certificates expiring or invalid
   5. Certificate authority is installed and running
   6. Trusted Certificate installed and valid
6. Router Configuration
   1. Gateway can be reached
   2. Internet can be reached
   3. UPnP (if available) port mappings
7. VPN (if enabled)
   1. Firewall configuration
   2. RRAS service enabled and running
   3. VPN default Policy is in place
8. E-Mail Configuration
   1. SMTP connectors configured correctly
9. IIS Configuration
   1. IIS is enabled and running
   2. Host headers are configured correctly

If you uncheck the IPv6 protocol from your network interface card on your Windows SBS 2008 server you may see the following issues after a reboot:

• Microsoft Exchange services fail to start
• Server hangs at “Applying Computer Settings…” (can eventually logon after 30 – 60 minutes)
• Network icons show as offline
• Some or all of the following events

Application Log Events

Source: MSExchange ADAccess
Event ID: 2114
Task Category: Topology
Level: Error

Description:
Process MAD.EXE (PID=2088). Topology discovery failed, error 0x80040a02 (DSC_E_NO_SUITABLE_CDC). Look up the Lightweight Directory Access Protocol (LDAP) error code specified in the event description. To do this, use Microsoft Knowledge Base article 218185, “Microsoft LDAP Error Codes.” Use the information in that article to learn more about the cause and resolution to this error. Use the Ping or PathPing command-line tools to test network connectivity to local domain controllers.

———————-

Source: MSExchange ADAccess
Event ID: 2601
Task Category: General
Level: Warning

Description:
Process MSEXCHANGEADTOPOLOGY (PID=952). When initializing a remote procedure call (RPC) to the Microsoft Exchange Active Directory Topology service, Exchange could not retrieve the SID for account <WKGUID=DC1301662F547445B9C490A52961F8FC,CN=Microsoft Exchange,CN=Services,CN=Configuration,…> – Error code=80040a01.

The Microsoft Exchange Active Directory Topology service will continue starting with limited permissions.

———————-

Source: MSExchange ADAccess
Event ID: 2102
Task Category: Topology
Level: Error

Description:
Process MAD.EXE (PID=2088). All Domain Controller Servers in use are not responding: SBS.sbs2008.local

———————-

Source: MSExchange ADAccess
Event ID: 2105
Task Category: Topology
Level: Warning

Description:
Process MAD.EXE (PID=2088). Exchange Active Directory Provider failed to obtain DNS records for domain sbs2008.local. DNS Priority and Weight for the Domain Controllers in this domain will be set to the default values 0 (priority) and 100 (weight).

———————-

Source: MSExchange ADAccess
Event ID: 2114
Task Category: Topology
Level: Error

Description:
Process MSEXCHANGEADTOPOLOGYSERVICE.EXE (PID=952). Topology discovery failed, error 0x80040a02 (DSC_E_NO_SUITABLE_CDC). Look up the Lightweight Directory Access Protocol (LDAP) error code specified in the event description. To do this, use Microsoft Knowledge Base article 218185, “Microsoft LDAP Error Codes.” Use the information in that article to learn more about the cause and resolution to this error. Use the Ping or PathPing command-line tools to test network connectivity to local domain controllers.

———————-
Source: MSExchangeFBPublish
Event ID: 8197
Task Category: General
Level: Error

Description:
Error initializing session for virtual machine SBS. The error number is 0x80040a01. Make sure Microsoft Exchange Store is running. Also, make sure that there is a valid public folder database on the Exchange server.

———————-

Source: MSExchangeTransportLogSearch
Event ID: 7005
Task Category: General
Level: Error

Description:
Microsoft Exchange couldn’t read the configuration from the Active Directory directory service because of error: Failed to load config due to exception: Microsoft.Exchange.Data.Directory.NoSuitableServerFoundException: The Exchange Topology service on server localhost did not return a suitable domain controller.

System Log Events

Source: Service Control Manager
Event ID: 7044
Task Category: None
Level: Warning

Description:
The following service is taking more than 16 minutes to start and may have stopped responding: Microsoft Exchange System Attendant

———————-

Source: Service Control Manager
Event ID: 7022
Task Category: None
Level: Error

Description:
The Microsoft Exchange Transport service hung on starting.

———————-

Source: Service Control Manager
Event ID: 7024
Task Category: None
Level: Error

Description:
The Microsoft Exchange Information Store service terminated with service-specific error 0 (0×0).

Resolution

To resolve this issue all you have to do is re-check IPv6 in the properties of you NIC and reboot.

NOTE: IPv4 must also be enabled.

Properly Disabling IPv6

SBS 2008 is designed to fully support IPv6 and has IPv6 enabled by default. Most users should never need to disable IPv6, however if you must disable IPv6 here is how to disable it properly:

Important: This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base: 322756 (http://support.microsoft.com/kb/322756/)

1. Uncheck Internet Protocol Version 6 (TCP/IPv6) on your Network Card.
2. In Registry Editor, locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\
3. Double-click DisabledComponents to modify the DisabledComponents entry.
   Note If the DisabledComponentsentry is unavailable, you must create it. To do this, follow these steps:
   1. In the Edit menu, point to New, and then click DWORD (32-bit) Value.
   2. Type DisabledComponents, and then press ENTER.
   3. Double-click DisabledComponents.
4. Enter “ffffffff” (eight f’s), and then click OK:

   

5. Reboot the SBS 2008 server.

RRAS (VPN) Note: If you plan to enable VPN on your SBS 2008 server, you MUST also Export and then Delete the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\RouterManagers\Ipv6

If you do not delete this key you will get an 20103 Event when trying to start RRAS with IPv6 disabled. You must reboot after removing this key.

Solution:
Verify that pop-up blocking settings of your browser are currently allowing pop-ups from bmo.com.

Block Pop-up Windows

What is a Pop-up Blocker?
A Pop-up Blocker is a browser feature that prevents pop-up ads from appearing. A pop-up window contains advertising and is usually generated by JavaScript code.

Internet Explorer
By default, Pop-up Blocker is turned on in Internet Explorer and set to the medium setting, which means it will block most automatic pop-ups.

Changing Pop-up Blocker settings

1. Open Internet Explorer.
2. In the Tools menu, select Pop-up Blocker, and then click Pop-up Blocker Settings.

Block Pop-up Windows with FireFox

Changing Pop-up Blocker settings

1. Open FireFox.
2. In the Tools menu, select Options, and then the ‘Content’ tab.
3. Put a tick in ‘Block Popup Windows’ option.

Note: Un-checking the Block Popup Windows option will disable pop-up blocking.