I had a support call this morning, the guys were unable to connect to a remote 2003 server via 'Remote Desktop' anymore ever though it worked the night before. The message was something like "You can to be a member of the Remote Desktop users group to access this machine remotely".

We had no choice to to cab over to the data center and look at this on the console. Terminal Services were running and the users in questions were still part of the Administrators group which also gives them remote desktop access.

The clue was in the event log. A warning was stating somethine like 'No licensing server found'. I asked the guy how long ago this machine was set up and it was only a few months ago.

Microsoft changed the terminal server set up with Windows 2003 server, the previous 'Administrator mode' a maximum of two users who have to be administrators at the same time, is now enabled by default even without installing 'Terminal Services' in the Windows components setup. However if you install them there you get the old 'user mode' which requires a 'Terminal Server Licensing' service and licenses which costs money. The tricky thing it that you can use 'user mode' for 2 or 3 months without the service but then it seems to stop working completely. This had happened last night.

So uninstall 'Terminal Services', reboot and enable 'Remote Desktop' via the System properties dialog. Works fine again.

In Windows 2000 you had to set up the service even for admin access, that's why people still do it in 2003.

 

I spent several hours on this small problem. atlasglob.axd is a virtual page in Atlas, Microsoft's AJAX framework. It is used by several Atlas components and is created by the GlobalizationHandler class in the Atlas assembly. To get it to work you need to have the following line in your web.config:

<add verb="*" path="atlasglob.axd" type="Microsoft.Web.Globalization.GlobalizationHandler" validate="false"/>

this all worked fine on my dev box but when I first deployed my Atlas enabled web site to the live server it didn't work anymore. atlasglob.axd resulted in a 404. I triple-checked my web.config but it was okay, I looked online but no one had the same problem. I didn't install the Atlas framework on the live-server, I just copied the Atlas assembly into my bin directory, I was under the impression that should be enough.
In the end it struck me, as a security concious guy I always kept the script mappings on IIS to a minimum. So I opened IIS and checked the Application Mappings, axd was not among them. This means IIS never passes control over any *.axd files over to the asp.net runtime and the registered handler can never kick it. Adding the mapping fixed the problem. It also proved that you don't need to install the Atlas framework to use it on a machine, just put Microsoft.Web.Atlas.dll into your bin directory.

 

In his podcast 'Start-Run-Replacements' Scott Hanselman obmitted 4NT, which is what I use to start my applications since NT 3.5 when we still had non-hierarchical program groups in Program Manager to manage our apps. With NT4 (Luckily I never had to use any Win9x OS on my own workstation.) and the start menu it got a bit better but it was still very slow to start applications, so I kept using the command line.

Besides being an excellent replacement for the built-in cmd.exe with many advanced and improved features, 4NT supports aliases (just like Microsoft's Powershell does now) you can define simple shortcuts to more complicated commands, in most cases I use this to start an applications.

Simple examples:

alias iis  = `start %_WINSYSDIR\inetsrv\iis.msc` (Internet Information Services console)
alias apps = `start
%_WINSYSDIR\control.exe appwiz.cpl` (Add or remove programs)
alias term = `start %_WINSYSDIR\mstsc.exe` (Terminal server client)

To make sure the aliases work on any machine, I sometimes use variable for locations

set tnOfficeDir=%@SEARCH[winword.exe]
iff %@LEN[%tnOfficeDir] != 0 THEN
    set tnOfficeDir=%@SFN[%@REPLACE[\winword.exe,,%@LOWER[%tnOfficeDir]]]
    alias word = `start %tnofficedir\winword.exe /n`
    alias excel = `start %tnofficedir\excel.exe`
    alias access = `start %tnofficedir\msaccess.exe`
endiff

I first find the Office directory and then use the variable for the that directory in my aliases, this works for all Office versions, but you may need a different approach if you have several different versions of Office installed.

In other cases I use a variable for the drive letter of my USB drive

set tnUsbDrive=%@LEFT[1,%comspec]
alias ff = `start %tnUsbDrive:\apps\PortableFirefox\PortableFirefox.exe`

I have various variables for often used directories and even application like a text editor

alias sucmd = `runas /user:%tnAdminUser %tnBinDir\4nt.exe`
alias hosts = `start %tnTextEditor %_WINSYSDIR\drivers\etc\hosts`
alias pdf = %tnToolsDir\FoxitReader.exe

The possibilities are endless.

You define your aliases in a file called 4start.cmd in the same folder as 4nt.exe, I added several other startup files which I call from 4start.cmd, here' my flow.

4start.cmd

• set initial settings, set to pre-phase

• call 4user.cmd pre-phase

• call 4stick.cmd pre-phase

• call 4machine.cmd pre-phase

• set common settings

• call 4apps.cmd

• call 4windows.cmd

• call 4tools.cmd

• set to post phase

• call 4machine.cmd post-phase

• call 4stick.cmd post-phase

• call 4user.cmd post-phase

• call 4project.cmd

The idea here is that I have common commands that work for every user on every machine.

4start.cmd (the main startup file), 4app.cmd (for third party apps that may be installed), 4windows.cmd (for Windows interal apps that are always there) and 4tools.cmd (for third party tools that likely to be present). Then I have three specific files 4user.cmd (for specific user settings), 4machine.cmd (for machine specific settings) and 4stick.cmd (for settings specific to the USB drive 4NT runs from). Each file can set variables or can override variables set by previous files. The two phases allow me to be very flexible with these overrides. Finally I also run a 4project.cmd which changes frequently and has locations of project folders, compiler calls or aliases to load the specific solution into Visual Studio.

During presentations, you sometimes have to start programs from the command line, mostly with many parameters, I've seen many people struggling getting it all right. You could use a batch file to prepare these commands but then the command is not visible to the audience, instead use 4NT, assign the command to an alias, then during the presentation type the alias and the Ctrl+F, which expands the alias command so the audience can see it and then hit Return to execute it.

I normally have to 4NT windows open, one runs under my normal user context and another one as a local administrator, if I need to do some work on the system or install software I can use the second command line.

You can have download all my start up files below.

4startup.zip (8.95 KB)
 

The other day I installed Windows Vista Beta 2 and plugged in my IPOD to see whether my 'on the road' set up still works. The first shock was that my beloved File Manager (winfile.exe) does no longer run. The procedure entry point SheConvertPathW is longer in shell32.dll. Dependency Walker shows that some other functions are missing as well SheConvertDirW, SheGetDirW, SheShortenPathW and that there are also functions missing in SHLWAPI.DLL and IEFRAME.DLL. The first lot has most likely to do with the handling of 8+3 DOS file names. The really interesting thing here is though that as far as I know Microsoft breaks NT for the first time ever. I have a command line unzipper from 1992 and it still works fine for me and works in Vista. We have to wait and see how many other older application are not running anymore. Turns out those functions above are undocumented and should have not been used by third party software, so I guess Microsoft had every right to finally remove them.

Gosh, the IIS administration looks totally different, I have to get used to that.

The name game

To me it's always NT 6 or if you count properly it's NT Release 4, (3.1=1, 4.0=2, 2000=3, Vista=4). XP was just a point release (5.1) It's also funny that they started the whole drop the version and use the year in the name with Windows (2000) and now use it with most other applications except they don't use it with the Windows anymore (XP, Vista).

File Manager update: Dave Schneider wrote some Wrapper DLLs for Winfile.exe which avoid calling the removed functions. With his help my beloved File Manager works again, even under Windows Server 2008 64 Bit. Check Dave's page at people.ee.ethz.ch.
 

For a recent .net project I had to work with several MS Access (Jet) databases with the possibility on an upgrade to SQL Server later on. All access to tables is done with QueryDefs (Access' stored procedures). When moving to SQL Server I only have to switch to a different database access layer from OLEDB to SQL Server and port the jet databases to SQL Server. All stored procedure names and parameters would stay the same. The MS Access Upsizing Wizard is fine for tables but it ports QueryDefs to User Defined functions and not stored procedures. I was looking for a tool that scripts all queries and tables just as I do in SQL Enterprise Manager or even more like scptxfr.exe a command line tools in the SQL resource kit that I'm using to regulary script all my SQL databases. After searching the web for a while I couldn't find one and decided to write my own. This wsf script scripts all tables and QueryDefs in either one mdb files or all mdb files in a folder. It is currently in its first Beta version and I haven't done anything with the resulting scripts yet but I think its a good start.

Download the script...
 

I haven't had much to do with viruses in the last few years, working in a firewalled office being a very cautious user anyway. But when I travelled through South East Asia and used Internet cafés all to check my email and surf a bit I was hit by them. First time I recall this was in a Internet café in Saigon, Vietnam. I was using Windows Explorer and noticed a new folder on my IPOD when copying photos from my digital camera. I opened the folder but it doesn't open, odd. I also noticed the machine rebooted randomly when I try to do some work. I complained about the PC but the owners were clueless and said this had never happened before and they couldn't even reproduce it.

The next day I was less in a hurry and looked at this a bit closer. File Manager shows a new program in every directory of my Ipod with the same name as the directory and about 45 (or 83)k in size. In Explorer with hidden known extensions and the icon being the folder icon, you think it is a folder rather than an application. Of course it's actually a virus and every time a user tries to open that 'folder' the virus starts another instance. In task manager there is nothing odd to see, all well known process names here, but wait, why are there two services.exes and two lsass.exes? There should always be only a single one of those. Let's enable the username column and yes these processes are running under the currently logged on user account, they should always run as 'NT AUTHORITY\SYSTEM'. The treeview in Process Explorer makes the virus much easier to spot, they are not in the services.exe branch and their full file path isn't .../system32/ Very well hidden these guys I have to say, if you don't know a bit abouth the NT system processes, you won't spot them.

Lets kill these suckers. In task manager it doesn't work because it doesn't let you kill things like services.exe because it thinks it's a system process (they just do a name comparison). After a killed the first virus process in Process Explorer the box shuts down right away. I guess they other process monitor each other. After the reboot they are all back, so lets use Autoruns.exe to remove these programs from the autostart places in the registry. Even though this worked some time, newer versions or the virus know about autoruns.exe and msconfig.exe and reboot when your try to start them. They have a blacklist of program they consider dangerous to them and reboot as soon as any of these are starting. The list includes cmd.exe and regedit.exe, taskkill.exe which explains why my machine rebooted all the time when I first encountered this virus. Deleting the virus files doesn't work because they are in use. I wrote a small script to kill all viruses via WMI but as soon as it starts using cscript.exe, reboot.
Using a third party registry editor such as RegWorks may work but I didn't have one at the time, it's also a painful process to manually find all the places in the registry that have to do with startup applications. Other software such as Word or IE work fine, after all they want to keep the PC running and do their thing, and only reboot when someone is after them.
One idea I had was to use pskill.exe remotely from another machine to kill the viruses. This failed in most cases because the admin user had no password and pskill doesn't support empty passwords, also many machines had the SP2 firewall enabled and pskill or psexec don't work through it.

The solution that worked in the end is to write down the process Ids of all the viruses and create a batchfile with multiple pskill entries:

pskill 308
pskill 1196
pskill 1720
pskill 3072
pskill 3728
pskill 4056
pskill 552
pskill 1692
pskill 2208
pskill 2288
pskill 2296
pskill 2320

This kills them so fast that they can't initiate a reboot. Sometimes notepad.exe was in their blacklist (but never taskmgr.exe to get the process Ids). In these cases I wrote the batch file on another machine and then executed it from my USB drive.
There is a tool called DtaskManager which allows you to select multiple processes and kill them together, but it didn't work for me very well. In any case you need to know which processes are actually viruses to get their process Ids.

Finally I wrote a command (single line) to kill all user processes except explorer:

for /F "usebackq tokens=2 delims= " %%i IN (`tasklist /FI ^"USERNAME eq %USERNAME%^" /FI ^"Imagename ne explorer.exe^" /FI ^"Imagename ne tasklist.exe^" /FO LIST ^| find ^"PID^"`) DO c:\bin\pskill.exe %%i 

Make sure you have pskill.exe on the machine and copy the line into the Start-Run dialog, It first runs tasklist to get a list of all processes except explorer.exe and tasklist.exe and then pipes the list into find to get all the Process Ids, for each entry in that list it calls pskill.exe. After this you have a kill all the viruses and anything else for that matter but can now run autoruns.exe to clean the registry. You should also run a Virus scan to remove all the virus files or search for *.exe files with a size of 45 or 83k.

Some more points

• The command above doesn't work all the time (not sure why) but the manually created batch always worked.
• Some AntiVirus software didn't detect this virus, some were disabled. It seems the virus tries to disable any AntiVirus software.
• I never looked into what it actually does but sometimes the process used 100% CPU and pinged remote computers, other times it didn't do anything.
• I found this on at least a dozen machines in at least four different versions, some of them were SysInternals aware, but you can just rename the executables pslist and pskill. If you don't use 4NT as your command line, you need to rename cmd.exe before you can use it.
• Another approach is to change the registry remotely from another machine, this should work because it never executes anything on the machine itself. I just never had a network were remote access worked.
• At the moment I can still manage to get rid of there processes but I'm sure it will get even harder in the future.

Why did I save money? Because if they staff in the Internet Cafe were smart enough to see the thread of viruses and I cleansed their machines, I could use their PCs for free for the next few days.
 

Often Internet Cafes lock down their XP version to prevent user from doing any damage (and that's in general a good thing), but sometimes you want to do some things that they don't allow you to. Here are some workarounds, the tools mentioned here are describes in the Working from a USB drive entry.

Downloads are disabled in IE

• Use Firefox for downloads
• Use a command line tool

Some drives are hidden in Windows Explorer

• Use File Manager (winfile.exe)
• Use cmd.exe

Access to Task Manager or the registry is denied by policies

• Use Process Explorer or Regworks who don't care about the policies
• If you have admin rights and access to the run command, you can change the policies by copying the following code into a file named openup.vbs and the execute it using cscript.exe openup.vbs

      Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")

      Call SetValue("DisableRegistryTools",0)
      Call SetValue("DisableTaskMgr",0)

      Function SetValue(sKeyName,iValue)

         Const HIVE = &H80000001
         oReg.SetDWORDValue HIVE,"Software\Microsoft\Windows\CurrentVersion\Policies\System",sKeyName,iValue

      End Function

No run command in the Start Menu
Open to C:\windows\system32\cmd.exe or  4NT.exe from your USB drive via Windows Explorer.

 

For the first 9 months of my round the world trip I hardly touched a keyboard, except for the occassional email check. But after loosing my travel campanion and getting a bit tired of travelling all the time, I started spending more time in Internet cafes around South east Asia. Taking software and data with you on the road is easy these days, all you need is a USB memory device (USB drive) and an XP box somewhere. I'm a Microsoft guy, so please no comments about 'you should boot into your own Linux from your USB drive'. Taking a laptop with me was never an option. I travel around a lot and want to keep my bag light, it's heavy enough already. I started out with an old 64Meg memory stick which shows 'Microsoft .Net Server' in faded letters on its side and also a 5Gig Rio Carbon audio player which I used mostly for listing to music and DotNetRocks podcasts. The Rio became very unreliable when connected to a PC and the stick was getting too small. Luckily I won an 2Gig IPOD Nano at a lucky draw in Bangkok and that's what I use for all my software work. The other two I still use as backup devices.

Web Browsing

The most used application while on the road is certainly a web browser. Yes IE is on every box and why should I care about security issues on a machine in an internet cafe? Well I do care about it because I have my USB drive with my data attached to the box. Also I used Firefox since its Phoenix days and just prefer to browse the public internet with Firefox. If you install Firefox once, you can just copy the Application files over to your USB drive and use it on other machines without installing, however extensions may not work and your preferences are stored in 'Documents and Settings' on the hard drive. One day I discovered 'Portable Firefox', a standard Firefox with a startup wrapper around it that stores all extensions and user files in its Application folder on the USB drive. No data is left on the hard drive. This means you can even store some of your less important passwords for sites in cookies. The only issues I have about this are:

• I would like to store all my data under a single folder on the USB drive rather than within the Firefox folder.
• When a new version of Firefox is released it seems to take some weeks before an updated version of Portable Firefox becomes available. However if you install the new version locally and then copy all files from "C:\Program Files\Mozilla Firefox" to \PortableFirefox\App\firefox you get the latest version. No changes have to be made to the wrapper. This worked for me from 1.5.0.3 to 1.5.0.3, for bigger updates it may not work.
  

Email

I'm using email since 1991, way before the web and never made the switch to web based services. Even with the new Ajax features in the new versions of Yahoo mail or Windows Live mail, the web can never deliver the richness of a proper Windows application.

There is also a portable version of Thunderbird available but as I'm using 'TheBat' as my email client at home, this option was not for me. I do actually have a web based email account as well but doesn't use it very much.

So I wrote two batch files that add and remove Registry entries needed for The Bat! before and after I use the program. Just after I started my trip RiT Labs, the makers of TheBat released a special version to be used on a USB drive called Voyager and it works perfect without any registry entries or any files of the hard drive. It even encrypts your mail data so if you loose your device, it's not accessible to others.

• It does cost money
• It also stores data within its application folder.

Office

When writing long entries for my travelog I rather use a proper word processor rather than a rich HTML input box, I also used Excel to manage my travel expenses in spreadsheet. On many PCs you can find pirated version of Microsoft Office but it's not always there. The solution comes from Portable Apps, they have a version of Open Office for the road which is perfectly sufficient for 95% of all non-coporate office work and is similar enough to MS office to get into it quickly. Of course it's free.

Photo editing

I have a map on my travel site which shows my current location and my previous route. I also sometime want to edit some photos I took before I upload them to Flickr. There is mspaint.exe in XP but it's very limited. I had a look at Paint.NET some years ago and as a .net application it runs within having to be installed. The latest version is very powerful and more than enough for what I need to do. You need .net 2.0 for the lastest version but I still found version 2.5 which is the last one that works with .Net 1.1 which is more common in Internet Cafes.

Instant Messengers

I don't really do messenging but just in case I need it, I set myself up with Portable Gaim again from Portable Apps, it supports all the major services in a single app.

Media Players

In most cases these builtin Windows Media Player is suffient but sometimes I want to watch a Quicktime video and don't want to install ITunes (you have to search hard to find a standalone version of the Quicktime played these days). So Portable VLC comes to the rescue. It plays Quicktime and most other formats and in at least one case even played Movie DVDs without installing any additional decoders.

Talking about ITunes, what a pain that software is! You have to install 40Meg just to add a song to your Music player. It also doesn't seems to be very traveller friendly. I put some photos onto the IPOD and changed all possible settings to manual. Still at the next Internet Cafe ITunes synced the photo folder with the MyPhotos on the hard drive which was empty, so ITunes deleted all the photos on the IPOD. Also even though an MP3 file is stored on the IPOD in MP3 format, I can't copy it back onto a hard disk. I can use Explorer and find the file in a hidden directory but the file name has been changed and I have a hard time finding the right file. But there are many third party tools out there that allow you to copy music files back and forth. I use Yamipod which comes as a single .exe and it doesn't require any setup. So much for user friendlyness Apple!. I also considered running NTFS on my IPOD because FAT32 looses sectors once in a while, much more frequent than on a normal hard drive. But Apple doesn't support this and music playback may not work anymore.

Console Tools

My central command line tools is 4NT, see my separate entry for it. The registered version reads the key from the registry but you can just download the latest version, put it on your USB drive and use it for up to 30 days, it's not likely you spend longer at the same computer in the same Internet Cafe in the same place. I have a whole bunch of command line apps and all of them run without setup or registry entries. I would even say that's the nature of command line apps. I may look closer at these later in details, most important is the PsTools Suite  from SysInternals.

GUI Tools

Just a short list of some tools I use and that work perfectly on a USB drive or without reinstalling on you next Windows setup for that matter.

File Manager (Winfile.exe), practically unchanged from the NT3.1 and comes in a single small file. You can get it from NT4 Service Pack 6. After 12 years with NT I never made the switch to Windows Explorer even for my day to day work. Old habits die hard. I know there are many powerful Explorer replacements out there but I never really got into any of them. I love the simplicity and practicality of the two window approach. It also it much faster displaying lists of files because it doesn't have to load any of the icons. Extensions like File Manager StepUP or 'FM Applic' (which I can't find online anymore) are helpful and when using them along with context.exe you can even get the Explorer Context menu for a file in File Manager. However these extensions don't work without setup. Try to find out what's really in your Font folder or the Global Assembly Cache, impossible in Windows Explorer which also may hides whole drives due to software policies. Use File Manager instead, it shows always the raw files. But don't get too excited, winfile.exe will no longer work under Windows Vista, read more.

Sysinternals tools - As Scott Hanselman says 'These guys are gods' and in addition to the command line tools their GUI stuff is just as good. Autoruns, FileMon, RegMon and Process Explorer and musts and all their stuff runs without setup consisting normally of just one file. Old versions of the monitor programs has separate driver files but these are now part of the executable and are installed temporarilty when the app starts.

Notepad2 or any other good notepad replacement, a decent text editor is just essentials for any type of work.

Foxit Reader is a free PDF reader that comes in a single file and works great from a USB drive, now you never have to use Acrobat Reader anymore. They just release a beta for version 2.0

.Net Tools

The two I use the most are Reflector and RegexDesigner.NET but most small .net tools work fine standalone. If there install something into the GAC, you may just copy the files into the Apps bin folder and it should work on the next machine, use File Manager or the command file to do this. I really don't like the fact the .Net is great for xcopy deployment and then most tools come with MSI installers and then just copy 5 files into a single directory (But you don't know that and this black box could do all kinds of things to your machine). A simple zip files with the files is much nicer and feels much safer. The MSI package also leaves an entry in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall which fills up the list of installed software.

Developer Tools

Dependency Walker used to come with the SDK and NT resource kits and even in these .NET days it is still are very valueable to to find out about broken application.

SharpDevelop is a free IDE for .Net languages C#, VB.NET and Boo and works great from a USB drive except that in my case it doesn't seems to remember the location of the code completion database and asked me again to create a new one on every new machine.

.Net Framework

Both the runtime and the SDK have to be installed (no surprise here) but having copies of the setup programs on your USB drive allows you to install them in a few minutes. Usually no reboots but you have to have admin rights. The SDK tools themselves work standalone, so you can copy them onto your USB drive once.

Web Development

Surprisingly many Internet Cafes use the administator user for their customers, so you have all control over the box and can even do web development by installing a web server. If you have XP Pro you can install IIS, I didn't have an XP CD with me and in some countries I couldn't find any Cafes that had one either. So I'm carrying the IIS files from SP2 with me, there are about 6Meg and I just have them on my USB drive. Below is a list with all the files you need.

If you only have an XP home edition you can use the Cassini web server, several different versions are available online.

If you have moved to 2.0 like me, you can use the ASP.Net development web server that comes with any Visual Studio version. It also comes with the 2.0 Framework SDK but that's also 400 MB and you don't want to install either the SDK or Visual Studio on a machine just for an hours work. You actually only need three files to get the web server to work: WebDev.WebServer.EXE, WebDev.WebServer.exe.manifest and WebDev.WebHost.dll. Just copy them into any directory on your USB drive and use them from there. You need to copy them from a box with Visual Studio or the SDK installed. The first two files are in \WINDOWS\Microsoft.NET\Framework\v2.0.50727 the last one is in \Windows\assembly\GAC_32\WebDev.WebHost\8.0.0.0__b03f5f7f11d50a3a\ To get to the last one use cmd.exe because Windows Explorer hides the real GAC content from you. I use a small batch file to start the web server:

start /B \apps\webserver\WebDev.WebServer.EXE /port:80 /path:\mywebsite\wwwroot\

The /B switch of the start command makes sure it doesn't start a new console windows, which would be useless because the server doesn't
output any status or debug messages.

Others

If your favourite apps require some registry settings to work, export them into a .reg file using Regedit.exe. Then create two batch files to add and remove the settings before and after you are using the app of a third party machine. A batch file for setup could look like this:

regedit.exe /i /s app1.reg
regedit.exe /i /s app2hklm.reg
regedit.exe /i /s app2hkcu.reg

and for clean up:

regedit.exe /u /s app1.reg
regedit.exe /u /s app2hklm.reg
regedit.exe /u /s app2hkcu.reg

Most apps use settings in both Local Machine and Current User hives so make sure you export both.

copyiisfiles.zip (.9 KB)
 

This is my little IT blog, I don't really think that what I'm doing is interesting enough to write about for other people to read but I see this more as a tool for myself to document what I'm doing and to refer back to it later on. Still there may be something on here which could be useful to other people.

After working five years in Germany and six in London I am currently on a trip around the workd, so I will about some issues I encounted while on the road doing some IT work. But these tips may also be helpful for IT support people who work at many different machines.