Alex Scoble's IT Notes - An Information Technology Blog

Using Fastpush to install VNC flavors to multiple systems

Over at my Computerworld blog, I've just posted about using FastPush to deploy many of the available VNC flavors to multiple systems on your network automatically.

Worth a read if you use VNC for remote desktop support in your organization and need a way to push out updates or different flavors to your organization.

Remote Desktop/Terminal Services Client RDP File Settings

Click here to go to my ComputerWorld.com blog posting on where to go to find settings information for RDP files used for connecting to Remote Desktop or Terminal Services on Windows systems.

WORLDOX Integration With eCopy ScanStation Or Lack Thereof

We just leased a new Canon Image Runner C6800 "business" color copier. Along with it we got the eCopy ScanStation, which is basically a separate PC with a 12" touch screen that allows you to quickly scan documents and send them to where they need to go, direct from the copier.

We chose that particular copier and scanning solution because it's one of the few copiers out there that does fast (68 pages per minute (ppm)) black and white and also does color (16 ppm). Most color copiers do both at 35 ppm and are not recommended if you mostly do black and white prints.

The copier also has a very simplified paper path with something like 5 or 6 areas to check for jams. By comparison, our older Ricohs have like something like 15-20 places you need to check for jams.

Anyhow, the purpose of this post is that while the Scanstation is great for scanning direct to email or to a pre-designated network share, it cannot scan directly to WORLDOX, which is our Document Management System. Yes, we were told that the product integrated with WORLDOX, but what they meant was that the eCopy Desktop software which sits on individual machines integrates with WORLDOX.

Another example of misscommunications caused by asking either the wrong question or too general of a question. Also would help to restate the question after it is answered to make sure that the salespeople are giving you the answer you need as opposed to the answer you want to hear.

Oh, and doing some research on your own through the vendor knowledgebases is a great idea as well.

User Name Length Limits in Active Directory

I was asked today by one of my readers what the character limits are of user names in Active Directory

Found a link to the answer in Microsoft's KB. Click here to go to it.

But the quick answer is 64 characters for display names and 104 characters for user logon names, however Microsoft recommends that user logon names be kept to 64 characters as well.

Oh, and the Pre-2000 logon name is limited to 20 characters.

Slow SSL Certificate Warning

So now I have two sites available externally through our firewall, one for OWA and one for WORLDOX. Both require SSL to connect.

Problem was it was taking about 20-30 seconds for the certificate warning to appear telling users that the certificate was unknown or didn't match the address entered.

The fact that the warning appears is fine because this is an in-house generated certificate and that warning will appear until you put the server's certificate in the Trusted Known Root Certificates in IE.

Anyhow, I found out that the initial response is much quicker if you turn off Certificate Revocation List (CRL) checking.

How do you do this? Here's the easy GUI way (can also be done through scripting, but I prefer GUI admin methods, but that's just me):

Be sure you have a good current backup of your server before messing with the IIS metabase. Like working with the registry, you can seriously screw things up if you aren't careful.

Make sure you turn on Enable Direct Metabase Edit before you do this by right clicking on the server name in IIS Admin, selecting Properties and then clicking in the checkbox labeled Enable Direct Metabase Edit.

Download the IIS Resource Kit.

Install the Metabase Explorer tool.

Open it up and go to \LM\W3SVC.

Create a new DWORD record named CertCheckMode (if it doesn't already exist). Set the data field to something other than 0.

Alternatively, you can add the DWORD record to one of the server instances as opposed to the global service by going to \LM\W3SVC\# where # is the number of the server instance you want to configure.

Active Directory Design - Part 1 - Domain Design

I'm breaking out how I designed our AD structure into smaller parts, this is part 1.

When I first arrived here at Tomlinson Zisko, we were using a hybrid network of Novell and NT. I got rid of Novell as soon as I could (and there was much rejoicing...yay) and am now in the process of updating our domain security model from NT to Active Directory (AD).

Here's just a rundown of how the structure has been designed based primarily on best practices as laid out by Microsoft, past experiences and my own feelings as to the best way to go about it.

So first thing I did was figured out the domain structure, which since I'm at a relatively small firm, this was pretty easy. Now most people will go and make their AD domain have the same namespace as their external DNS namespace. In my opinion, this is not the best way to go. I have found that having a separate namespace for internal networks is much better, as you do not need to duplicate nearly as many DNS records on your external and internal DNS servers and there is a much clearer delineation between what is external and what is internal. It just makes administration of your DNS system much more foolproof.

For example, let's say that you are using smallfirm.com for both internal and external DNS. There is a firewall separating your internal and external DNS servers and no one from outside the firm without VPN access can see the internal DNS servers (how else are you going to keep your server/PC names secure?). You add a new webservice outside the firewall. This means that you now must make entries in your external DNS and internal DNS servers. What happens if you forget to make an entry or make a typo in the entries for the internal DNS server? The service will be unreachable by DNS name from inside the firewall. Why? Because your internal DNS servers have to think that they are authoritive for the domain smallfirm.com and so do not talk to the external DNS servers at all.

Now let's take the same example, but instead, use smallfirm.org for internal. Now, you don't need to make any entries at all for that new external webservice on the internal DNS servers, since they are not authoritative at all for the external domain and will look to their forwarders when queried about the external domain.

OK, so now you know why our external domainspace is tzllp.com and our internal (with some overlap of course) is tzllp.org.

OK, so now that I have the toplevel domain figured out, the next question becomes how many domains and subdomains do I need in the forest? The answer for most companies smaller than 1000 people will be one. There are reasons for having multiple domains, even in small organizations, like if there is a legal requirement for it, or if you have a need to have separate domain policies for different systems in the same site. Unlike in NT Domain design, you no longer need to break up domains into geographical areas and since the limit on the number of objects in a domain is HUGE, you no longer need to do it for that reason either.

BTW Microsoft specifies that the best practice is to leave the top level "root forest" domain unpopulated. This is so that changes to the schema for the forest can be better secured and also done without bringing down the domain that the users are in.

I did not do this here, mainly to save on costs and also because in a small network it can be a real administrative pain in the neck. I actually did it at my last job and it greatly complicated the DNS structure and caused some issues.

I should also note, that for most cases, you do not need to break up networks in separate geographical areas into separate domains. This is because AD uses Sites in order to control replication between servers in same domain but separated by slower communication links. Separate domains should be avoided if possible, because if it isn't needed it greatly increases costs as each separate domain needs to have two domain controllers, whereas if the network is just broken down into sites, you just need one DC per site (if that DC fails, user systems can still authenticate to the central DCs over the slow link).

Well, that's about it for domain design for a small to medium size business. Eventually, I'll get into policies and such, which are much more complicated, as well as Exchange and how it affects AD, plus hardware design. Oh and let's not forget any issues that I have run into and what gotchas to watch out for.

System Comments Character Limit And Browsing

I'm currently in the process of setting up all of our new servers in a Win 2003 Active Directory Domain.

Currently working on getting all of the servers set up for backups. Noticed during this that I could not see most of the new servers in the "browse list" in Windows Explorer.

After doing some poking around found Knowledge Base Article 231312 on Microsoft's web site. Basically it says that a system's description (usually set up through the Computer Name tab in System Properties, but can also be set up through "net config server /srvcomment:"commenttext"" from command prompt) cannot be longer than 48 characters, or the system will not show up on the browse list.

So I checked and lo and behold, that was exactly the issue that I was having. Problem solved and lesson learned.

BTW as I go through my AD migration and Exchange 2003 migration I will be posting more tidbits like this, so stay tuned.

*Update* Working With Large Text Files

I forgot to mention that you can use the software for free for 60 days and then it's $20 a license for 1-9 licenses.

Click here to see the full license structure: http://www.fileviewer.com/Order.html

Working With Large Text Files

For those of you who work with Exchange 5.5 on a regular basis and have logging on the Internet Mail Service turned on enough so that you can see what is going on in order to troubleshoot problems when they arise, you probably have run into the situation where the log files get very large.

I haven't yet found a way to have Exchange 5.5 automatically start new logs in a certain time period and if you forget to do it manually every week, the log files can get to be larger than 1 gig. This presents a problem when you have to go into the log to figure out why a message didn't get through or why an attachment didn't get decoded properly.

Notepad can't open text files that large and Wordpad chokes on them as well, even if your system has the resources to open a file that large.

Well thanks to a link on Joel Spolsky's web page I found this sweet little file viewer called V.

It breaks the text file up into small chunks that are instantly accessible on your system. I'm currently viewing a log file that got to the seriously obese size of 1.8GB without problems on a system with only 512MB of memory.

Way cool.

System Naming Conventions

Since I'm starting to deploy new systems, I'm having to come up with names that fit into our naming convention. Our convention is supposed to be cartoon characters. Not all systems follow this convention, but most now do.

I am however, beginning to wonder if such a naming convention is even useful or warranted.

Some people say that you shouldn't name systems after who uses it or what the system does like Ascoble1, ExchangeBridgehead1, etc. This is so that someone can't simply look at system names after gaining entry into your network in order to crack the most important systems. After all if you are a hacker you are much less likely to attack a system named "JoeShmoe1" than "FileServer1".

Balancing the security concerns are always the concerns about usability. How easy is it for a user to remember the name of the server they need to access when they need to access it and does it make sense?

I think that for most companies, the issue of convenience outweighs the issue of security to some degree. If it isn't useful, then what is the point of having it after all. Which is why SSL websites are better than VPNs for applications that can be directly served off of a website. VPNs are more secure, but they are also much harder to set up, maintain and get users to use.

Would be interesting to hear what other IT professionals typically use for their naming conventions, but my guess is that it's usually driven by politics more than anything else. Then again that doesn't explain why a law firm is using cartoon characters as opposed to precedents (how about a system named RoeVWade) or law schools (Stanford, Michigan).

Then again I'm too busy to really start changing everything midstream, so instead I'm trying to be creative about coming up with new cartoon characters...Good thing I watch a lot of Anime, eh?

Then again, when I leave people are going to be saying "Why did he name these computers with Japanese names?"