Category: How-to

Cleaning Up the Exchange 2003 Server’s SMTP Queues after NDR attacks

Warning: This process will delete all email that is due to go to external recipients. Internal messages are not affected, neither are new inbound messages from the Internet unless they are from the spammer continuing to try and abuse your server.

Capturing the Messages Into a Single Queue

This process requires an SMTP connector for all addresses. If you don’t already have one (with a * on the

Warning: This process will delete all email that is due to go to external recipients. Internal messages are not affected, neither are new inbound messages from the Internet unless they are from the spammer continuing to try and abuse your server.

Capturing the Messages Into a Single Queue

This process requires an SMTP connector for all addresses. If you don’t already have one (with a * on the namespace tab) then you need to create one using the instructions below. 
If you already have an SMTP Connector with a * on the namespace tab, then you can use it for this process. You will need to adjust the settings as appropriate. You may wish to just make a note of the settings, delete the connector and create a new one for this process. When complete recreate your live connector.

  1. In ESM, Connectors.
  2. Find default SMTP connector, select properties and then select “Address Space” Edit the SMTP entry and make it a cost of 2.
  3. Right click on connectors and choose New, SMTP Connector.
  4. On the “General Tab” type a name for the connector. “Spam Cleanup” or similar.
  5. Click the “Add” button under “Local Bridgeheads” and choose your Exchange server.
  6. Click on the “Address Space” tab.
  7. Click “Add” and choose SMTP. Leave each setting (* and cost of 1) and press ok.
    If all the spam is to one domain, then you could remove the * and enter the domain that the messages are being sent to. This should leave legitimate messages in the queue.
  8. Click on the General tab again. Change the option in the centre from DNS to “Forward all mail through this connector to the following smart hosts”.
  9. Enter an invalid IP address in square brackets:  [99.99.99.99].
  10. Click on the “Delivery Options” tab and ensure that “Specify when messages are sent through this connector” is selected.
  11. Change the option to 11pm. (If it is close to 11pm when you are doing this, use a much earlier time – 6am or similar. The time doesn’t matter as long as it is not close).
  12. Press Apply/OK to close the SMTP Connector dialogue.
  13. Restart SMTP Virtual Server.
    1. Expand Servers, <your server>, Protocols, SMTP.
    2. Right click on the “Default SMTP Virtual Server”
    3. Choose “Stop”. This may take a few minutes.
    4. Once it has stopped, right click again and choose “Start”.

The Exchange SMTP virtual server is now processing all the messages and placing them in to a single queue for your SMTP connector. This can take some time. You may want to wait until the number of messages in the queue stays constant before attempting the next stage.

Exchange 2000: The queues can be found in Servers, <your server>, Protocols, SMTP.

Exchange 2003: The queues can be found in Servers, <your server>, Queues.

Deleting the Messages

Now that the messages are in one queue, it is quite easy to delete them

Exchange 2003

  1. Right click on this connector and choose “Find Messages”.
  2. In the drop down box select the number of messages to be listed in the search.
  3. Click “Find Now”.
  4. Once the search is complete, select all of the messages (use the shift-page down key combination)
  5. Then click “Delete all Messages (No NDR).

Exchange 2000

  1. Right click on this connector and choose “Delete All Message (No NDR)”
  2. Select Yes when asked if you want to delete all the messages in the queue.

Once the messages have been deleted, which could take some time, refresh the queues to ensure that they don’t continue to build. If they do then Exchange is still processing the messages. You will need to repeat the procedure to delete more messages until the queues are completely clear and stay at zero.

Once you have flushed out the messages, undo the changes that you have made.

If it was a new SMTP connector, delete it.
If you adjusted an existing connector, put the settings back how they were. Don’t forget the time on the “Delivery Options” tab. it should be “Always Run”.

Finally restart SMTP virtual server to get Exchange to start using the new settings.

Event ID number 2003, “TermService” service does not match the trusted performance library information stored in the registry.

The configuration information of the performance library “C:\WINDOWS\system32\perfts.dll” for the “TermService” service does not match the trusted performance library information stored in the registry. The functions in this library will not be treated as trusted.

This problem occurs when the size and the date of the Perfts.dll file in Windows Server 2003 SP2 dose not match the size and the date of the entry stored earlier in the registry

The configuration information of the performance library “C:\WINDOWS\system32\perfts.dll” for the “TermService” service does not match the trusted performance library information stored in the registry. The functions in this library will not be treated as trusted.

This problem occurs when the size and the date of the Perfts.dll file in Windows Server 2003 SP2 dose not match the size and the date of the entry stored earlier in the registry for the Perfts.dll file .

Event Source: Perflib
Event Type: Warning
Event ID: 2003
Description: The configuration information of the performance library “C:\WINDOWS\system32\perfts.dll” for the “TermService” service does not match the trusted performance library information stored in the registry. The functions in this library will not be treated as trusted.

To resolve this problem, follow these steps after you install Windows Server 2003 SP2:

Click Start, click Run, type cmd, and then click OK.
At the command prompt, type the following command, and then press ENTER.

lodctr /T:TermService

Note This command will modify the size and the date that are stored in the registry for the Perfts.dll file.

Type exit, and then press ENTER to close the Command Prompt window.

Windows Vista Remote Desktop to Terminal Server Shows Black Screen

If your having an issue getting RDP client on Vist to connect to a 2003/2008 TS server you may be having issues with Vista TCP auto tuning.

To disable Vista Auto Tunning

run as an admin from cmd prompt:
netsh interface tcp set global autotuning=disabled

Then try your session again

If your having an issue getting RDP client on Vist to connect to a 2003/2008 TS server you may be having issues with Vista TCP auto tuning.

To disable Vista Auto Tunning

run as an admin from cmd prompt:
netsh interface tcp set global autotuning=disabled

Then try your session again..

LDIFDE and CSVDE in Windows 2003

CSVDE Imports user accounts into Active Directory

  

CSVDE is the type of program that you learn for a specific task and then forget about.  Therefore, what you need are a few tried and tested examples to get started.  The classic job for CSVDE is to import user accounts into a Windows domain.  We often use CSVDE to create users on a test network, our main use for CSVDE is to research

CSVDE Imports user accounts into Active Directory

  

CSVDE is the type of program that you learn for a specific task and then forget about.  Therefore, what you need are a few tried and tested examples to get started.  The classic job for CSVDE is to import user accounts into a Windows domain.  We often use CSVDE to create users on a test network, our main use for CSVDE is to research LDAP names.  What we do is a quick export of Active Directory into a .csv file.  Then open that .csv export file with Excel and study the LDAP fields in the first row of the spreadsheet. 

Comma – Delimit data with a comma, not tab. 
Separated – Split a string of data.
Value -Values, rather than properties.
Data – Deal with data, and don’t worry about the objects.
Exchange – Move data from the spreadsheet into Active Directory (or vica versa). 

Think of CSVDE as the engine that drives data into or out of Active Directory. This CSVDE engine has two directions, export and import. The data consists of Active Directory accounts in CSV format. Excel, or a similar spreadsheet, is marvelous at dropping the comma-separated data into columns. 

 To actually export from Active Directory, all you need is CSVDE -f filename.csv. As export is the default mode, there is no -e switch, so just issue CSVDE, the -f switch and a suitable name. 

Whenever you transfer data in the other direction, from the file into Active Directory, you must actively switch CSVDE into import mode. This is why you need the extra the -i parameter. 

For example CSVDE -i -f filename.csv. 

 

LDIFDE

 

So you want to use LDIFDE to import users into Active Directory, I suggest that you start with LDIFDE export.  My reasoning is this, LDIFDE is a difficult command to master, however, the export switch is far easier to learn than the import.  In addition there is less scope for damaging Active Directory when you are exporting. 

The key switch is (-i) without this tiny -i switch (Lower case I), LDIFDE will just export information or raise an error message.  To master importing user accounts, you must understand the LDAP attributes.  Also you need ‘Active Directory Users and Computer’ available for inspecting the users’ properties.  Once you have written all the data in your ” .ldf”  file then just import the data with a command like this: 

ldifde -i -f accounts.ldf -s MyServer 

   

In this example, you use LDIFDE to add a new user named Bill Gates to the Developers organizational unit. 

  1. Start Notepad, and create a new file called Newuser.ldf. (Save the file as with an .ldf extension.)
    (Note you will need to substitute the information for your domain!) 
  2. Edit the LDIF file Newuser.ldf, and add the following text :
    dn: CN=BillGates, OU=Developers, DC=squidworks, DC=net
    changetype: add
    cn: Bill Gates 
    objectClass: user
    samAccountName: Bill
    givenName: Bill
    sn: Gates 
  3. Save the LDIF file. 
  4. Run LDIFDE to import the new user into Active Directory.  Open a ‘dos box’, start run, CMD, then type the following command, and then press Enter.
    ldifde –i -f newuser.ldf -s MyServer  
  5. To confirm that the new user has been created, check your Active Directory users and computers snap-in. 

  

When you need to delete objects, firsly you need their dn: attributes.  Secondly, on the next line, write a statement for changetype: delete. 

Example: If you saved these entries into a file called leavers.ldf 

dn: CN=BillGates,CN=Users,DC=cp
changetype: delete
 

You may needed to add a null value when you have to clear the login script field and have it controlled by a GPO. The following worked for us.

dn: CN=Example User,OU=Example OU,DC=example,DC=network,DC=com

changetype: modify delete: scriptPath-The absence of scriptpath: on the subsequent line after replace: causes an empty/null field to be inserted.

Domain user log on to windows with fingerprints is disabled.

Although GPO can manage this setting, by default it is off.  To get your Windows 7 systems to allow domain user login using biometrics (fingerprint) support follow the directions below.

Adding Domain log on access for Biometrics

Goto -> Control Panel ->All Control Panel Items ->Biometric Devices

Select: Change Biometric Settings

Select both:
Allow users to log on to Windowsd using their fingerprints
and
Allow users to log on

Although GPO can manage this setting, by default it is off.  To get your Windows 7 systems to allow domain user login using biometrics (fingerprint) support follow the directions below.

Adding Domain log on access for Biometrics

Goto -> Control Panel ->All Control Panel Items ->Biometric Devices

Select: Change Biometric Settings

Select both:
Allow users to log on to Windowsd using their fingerprints
and
Allow users to log on to a domain using their fingerprints

Restart the computer.

Select: ‘Switch user’ at the log on screen and choose the fingerprint icon ( requires you to have first added a set of fingerprints to your account)

Swipe your finger. At this point nothing happens. The screen remained active with the fingerprint icon and a password field.

Now type your password and your’e logged on (this is the final security measure to validate the account against the AD).

Now restart your computer and Bingo! your fingerprint is accepted and password no longer required.

Enjoy the ease of biometrics with Windows 7

BBWIN VB script for MySQL externals testing

Use BBWin to Monitor Your MySql Server
This little script allows you to quickly test your MySql server using BBWin .

It connects to MySql and queries SHOW STATUS from your server and returns the Stats.

[caption id="attachment_286" align="alignright" width="80" caption="www.AlertOnFailure.com"][/caption]

The script will alert if connection fails or records not returned.

You will need

Use BBWin to Monitor Your MySql Server
This little script allows you to quickly test your MySql server using BBWin .

It connects to MySql and queries SHOW STATUS from your server and returns the Stats.

www.AlertOnFailure.com

The script will alert if connection fails or records not returned.

You will need to install mysql-connector-odbc-5.1.6-win32.msi From [url]dev.mysql.com/downloads/connector/odbc/5.1.html[/url]

You will also need to edit the script and change the server address, database name, user and password.

:arrow: Download file to BBwin\bin folder

MySQL.vbs
Grabs Global stats from MySql server any where on your network
(2.98 KiB) Not downloaded yet
You will need to edit the BBWin\etc\BBWin.cfg file and insert the line below

 


<load value="cscript MySQL.vbs" timer="15m" />

You will not need to reload BBwin. It should pickup the changes to the file and load the test. With in a minute or 2 you should have a new system “Dot” called “MySQL”

PHP preg_match hostname and domain from FQDN

How to get the hostname and the domain name from FQDN in PHP

This sound easy right? So easy that you would think it would be all over the internet as an example on how to parse host names from domain names. Wrong…. I spent a hour one day looking everywhere and all I found was parsing a URL. Well my needs go deeper I need to do a

How to get the hostname and the domain name from FQDN in PHP

This sound easy right? So easy that you would think it would be all over the internet as an example on how to parse host names from domain names. Wrong…. I spent a hour one day looking everywhere and all I found was parsing a URL. Well my needs go deeper I need to do a quick split of host name from domain name not matter how long or nested the domain names were.

There are a bunch of places that give you the same old PHP preg_match examples as found on www.php.net,   “How to parse the domain name from a URL.”

But lets say I want both the host name and the domain name? If you know anything about FQDN then you know that up to the first “.” is host name and everything else is sub domain, domain and root.

Sometimes your going to have a FQDN that = myname.mysub.mysecondsub.mydomain.root

You want to get “myname” & “mysub.mysecondsub.mydomain .root”

So here is how we do it…


//if host needs to be striped from a URL
preg_match('@^(?:http://)?([^/]+)@i', "http://barfly.beaners.bobbers.mybalistics.net/index.html", $matches);
$host = $matches[1];

//else make $host your FQDN and skip the above segment
preg_match("/^(.*?)\.(.*)/", $host, $rest);
echo "My name is" .$rest[1]. "
";
echo "My domain is" .$rest[2]. "
";

I hope this helps someone out there spending hours looking for the right expression.

More VBScript created for BBWin External testing for www.AlertOnFailure.com

AOF adds VBScript created for BBWin External testing to it’s library

[ipconfig]

Microsoft Networking Information Overload
What a name! The MOAB of network information this jewel of a script dumps out all sorts of good information to have at your finger tips.

In this version there is only one status of green so you

AOF adds VBScript created for BBWin External testing to it’s library

[ipconfig]

Microsoft Networking Information Overload
What a name! The MOAB of network information this jewel of a script dumps out all sorts of good information to have at your finger tips.

In this version there is only one status of green so you can’t place a notification on this test but it does provide some really good data to have at your finger tips.

It provides:

All IP, Wins and DNS information
The System name, domain name and current logged in user
All Network Login Profiles
Dump of your routing table
All Network Clients Installed
Host Proxy Server Information
All Network Adapter Configuration Properties

[defrag]

defrag checks each fixed drive on the host and reports back a status of yellow if any drive needs defraging.

Else if all drives report no defrag needed the status is green.

The report shows up as a “System Dot” called “defrag” and you can assign alert notifications to this test. Currently the test only reports a status of yellow or green. there is no red status in this test.

[PWRmgt]

PWRmgt confirms the current power management setting and any power supply alarms and reports the information back to the AOF server.

This does include status changes, Green, Yellow and Red based on the nature of the issues.

This test creates a “System DOT” called “PWRmgt” on the AOF display and can be used to set alert notifications to.

Get Scripts Here

New VBScript created for BBWin External testing for www.AlertOnFailure.com

I’ve created 2 new VB scripts to use with AOF and BBWin’s External test functions. These scripts were tested on BBwin 0.12 and AOF Beta and work great!

[RePing] Ping multiple internal host addresses

Provides the ability to ping multiple host behind a firewall or other device, Great is you need to test to see if a Wireless AP is up or if a network printer is

I’ve created 2 new VB scripts to use with AOF and BBWin’s External test functions. These scripts were tested on BBwin 0.12 and AOF Beta and work great!

[RePing] Ping multiple internal host addresses

Provides the ability to ping multiple host behind a firewall or other device, Great is you need to test to see if a Wireless AP is up or if a network printer is available. There are many systems that do not run a agent that you can ping to see if they are up and running. This all gets reported back to the AOF servers and placed as a “System Dot” called “RePing”. If a host fails to will change status. You can use this to get remote notifications of failures by placing a alert notification rule to the test.

See Script file

[Wares] List All Installed Software on AOF server (BBDisplay)

Wares.vbs is a visual basics script used to upload a list of installed software on a windows host.  In version one we are sending just the data, no status changes are happening. Version 2 will have the ability to alert if apps are added or removed.

See VB Script

These were developed to be used with www.alertonfailures.com  free system monitoring and management services but the scripts will work just fine with any XYmon server or BBDisplay server.

PHP Pagination with timestamp / timeline display

Pagination with a timestamp as the center value

We provide a way to scroll page to page of data and show the time stamp of when the data was collected as part of the page navigations.

Here we setup the first query and findout how many pages we have.

$sql = “SELECT COUNT(*) FROM table where name = ‘” . $name . “‘ and type = ‘”

Pagination with a timestamp as the center value

We provide a way to scroll page to page of data and show the time stamp of when the data was collected as part of the page navigations.

Here we setup the first query and findout how many pages we have.


$sql = "SELECT COUNT(*) FROM table where name = '" . $name . "' and type = '" . $type . "'";
$result = mysql_query($sql, $conn) or trigger_error("SQL", E_USER_ERROR);
$r = mysql_fetch_row($result);
$numrows = $r[0];
$rowsperpage = 1;
$totalpages = ceil($numrows / $rowsperpage);
if (isset($_GET['currentpage']) && is_numeric($_GET['currentpage'])) {
$currentpage = (int) $_GET['currentpage'];
} else {
$currentpage = 1;
}
if ($currentpage > $totalpages) {
$currentpage = $totalpages;
}
if ($currentpage < 1) {
$currentpage = 1;
}
$offset = ($currentpage - 1) * $rowsperpage;

Now we need to make the second query for the actual data so we can place our scroll links and then display our data.


$sql = "SELECT * FROM table where name = '" . $name . "' and type = '" . $type . "' ORDER BY data_time DESC LIMIT $offset, $rowsperpage";
$result = mysql_query($sql, $conn) or trigger_error("SQL", E_USER_ERROR);
while($row = mysql_fetch_array($result)){
$data = $row['data'];
$data_time = $row['data_time']; // expected in epoch
}
$range = 8;
echo "Reported data";
if ($currentpage > 1) {
echo " << ";
$prevpage = $currentpage - 1;
echo " < ";
}

for ($x = ($currentpage - $range); $x < (($currentpage + $range) + 1); $x++) {
if (($x > 0) && ($x <= $totalpages)) {
if ($x == $currentpage) {
echo " [";
$rectime = date(DATE_RFC822, $data_time);
echo $rectime;
echo "] ";
} else {
echo " $x ";
}
}
}
if ($currentpage != $totalpages) {
$nextpage = $currentpage + 1;
echo " > ";
echo " >> ";
}

echo "

";
echo $data;
echo "";

 

You should have a database that use epoch time as its time field then set $data_time to that field. You will get a nice output with links to pages forward and previous and the time stamp in local time in the center as the current page you are on. Great for scrolling throught time dlimited data in a time line.