Configuring ASP.NET to use Integrated Security

Below are the steps for configuring Integrated Security for a ASP.NET application. These instructions are for Windows 2003 systems, one running IIS and the other SQL Server 2005.

1. On the Web Server, Right Click My Computer and select Manage


2. On the Computer Management Window, expand the Local Users and Groups menu item


3. Right Click the Users folder and select New User


4. On the New User window, enter the information for the local account. (Remember to uncheck the “User must change password at next logon” checkbox). Click
   Create


5. Back on the Computer Management window, right click the local account and select
   Properties. On the Member of tab, click Add


6. On the Select Groups window, ensure that the From this Location field is the name of the Web Server then click the
   Advanced button


7. On the next window, click Find Now. Select the IIS_WPG group and then click
   OK. Click OK again to save the settings


8. Grant the newly created local account Modify access to the C:\WINDOWS\Temp folder


9. In IIS, expand the Application Pools menu. Either create a new application pool or right click an existing one. Select
   Properties and then the Identity tab


10. Select Configurable then Browse for the newly created account and enter the password twice for the account. Click
    Apply and then OK


11. On the Directory tab of the Properties for the Website, in the Application Pool field select it to run using the application pool identified with the local account


12. Repeat steps 1 through 4 to create a local account with the same User ID,Name, and Password on the SQL Server. This local account doesn’t need to a be a member of any groups


13. Open SQL Server Management Studio


14. Expand the Security menu for the server


15. Right Click the Logins folder and select New Login


16. Click the Search button and find the local account on the SQL server


17. Map that account to the required database


18. Grant the local account access to any tables or stored procedures

Bare Metal Restore of Windows 2008 Server from Remote WBADMIN Backups

As most users of Windows 2008 Server know you can easily use the WBADMIN command as a backup solution. WBADMIN allows to use remote shares as storage locations for backup sets. Below are the steps to perform a bare metal restore using a backup sets located on a remote share. In order for this to work you will need to have a DHCP server running on your network that will give out an IP address to the host being recovered.

1. Boot from the Windows 2008 CD. Click Next


2. On the Install Now Window, Click the Repair Your Computer link


3. Click Next again to move to the next window


4. Choose Windows Complete PC Restore
   


5. When the error message about not finding a valid backup comes up, click Cancel


6. On the Restore Your Entire Computer for a Backup window, select Restore a Different Backup and click Next


7. On the Select the Location of the Backup window, click the Advanced button


8. Click Search for a Backup on the Network


9. Click Yes when prompted


10. Type in the network location of the backup and click OK


11. Enter in your AD Admin account credentials (domain\userid) when connecting to server hosting the backup sets and click
    OK


12. Highlight the backup set location for the computer you want restored and clickNext



13. Highlight the backup point you want to recover and click Next
    


14. Click Next. Depending upon the type of restore you might have to check the "Format and repartition disks" checkbox
    
    


15. On the Summary page, click Finish
    
    


16. Check the I confirm that I want to format the disks and restore the backup checkbox. Then click
    OK to start the recovery process
    
    

VBScript: Preventing Logon After Hours

Last week I received a request asking if I could prevent a certain user from logging into a system after normal business hours.

I thought it would be easy using AD and just setting the login hours for her account; however, since the user's email is routed to my Exchange server, it caused her to be locked out of her email after hours. The solution I came up with is a simple VBScript.

The script checks the day and time. If they are out of the acceptable range then using the shutdown command I reboot the box in 60 seconds. Both the system and the script will present a popup window notifying the user of the situation. I configured a group policy to run the script at logon and only for a specific AD group (which the user is a member of).

So that covers logging in but what if the user is already logged onto the system. Another group policy, with a preference setting for a scheduled task running the shutdown /r /t 60 command at 6 PM everyday does the trick.


'************************************************************************

on error resume next

dim vday, vhour

vday = weekday(now)
vhour = hour(now)

set wshshell = wscript.createobject("wscript.shell")

if vday >= 2 and vday <= 6 then

if vhour < 8 or vhour > 17 then

wshshell.run "C:\WINDOWS\system32\shutdown.exe /r /t 60"
wshshell.popup "Your Account is Only Permitted to Login Between 8AM" _
& " and 6PM" & vbCrLf & "Monday through Friday", 20, "Account Logoff"

end if

else

wshshell.run "C:\WINDOWS\system32\shutdown.exe /r /t 60"
wshshell.popup "Your Account is Only Permitted to Login Between 8AM" _
& " and 6PM" & vbCrLf & "Monday through Friday", 20, "Account Logoff"

end if

wscript.quit

'**************************************************************************************************************

Perl Script to Update Recommended IP Block Ranges

Yesterday, I started down the road of learning to develop in Perl. Came up with the idea of updating my OpenBSD firewall badhosts table with the DShields recommended IP block range list.

In order to get it to run I had to install the p5-LWP-UserAgent-Determined-1.03.tgz package on the OpenBSD system.

Configured Cron to run the script:
sudo crontab -e
* 23 * * * /usr/bin/perl /etc/bhupdate.pl >/dev/null 2>&1

----Part of pf.conf-------------

table <badhosts> persist file "/etc/badhosts"

block in log quick on $ext_if from <badhosts> \
label "Badhosts in"
block out log quick on $ext_if to <badhosts> \
label "Badhosts out"

--------------------------------------------------

Here is the Perl script:

#!/usr/local/bin/perl -w
use LWP::Simple;

#open the badhosts file and load it to an array
open(BH,"/etc/badhosts");
@badhosts = ;
close BH;

#create arrays and get recommended block data from site
@badips = ();
@dshield = split("\n",get('http://feeds.dshield.org/block.txt'));

foreach $newrange(@dshield)
{
#check to see if line starts with an ip. if so then
#pull only the first ip

if($newrange =~ m/^\d/i)
{
@ipinfo = split("\t",$newrange);
$ip = "$ipinfo[0]/24\n";

$counter = 0;

#check to see if ip range is already listed in badhosts file
#if not then load in into badips array

foreach $badrange(@badhosts)
{
if($badrange eq $ip)
{
$counter++;
}
}

if($counter == 0)
{
push(@badips,$ip);
}

}

}

#append badhosts file with newly recommended block ranges
open(BH,">>/etc/badhosts");
print BH @badips;
close BH;

system("pfctl -f /etc/pf.conf")

Quick Way to Change File Extensions in the Same Folder

I was given the task of searching a few hundred archived Eudora mailbox files today for a certain email address. Didn't want to install Eudora on a system so I just opened the files with Notepad. The problem I ran into was that Windows Search wouldn't search the .mbx files.

So I needed to quickly change all the .mbx files in the folder to .txt extension so that Windows Search could scan them. Thought VBScript would be a good way; however, found that it would take too much code to just do a simple task.

Instead I went back to the command line and used the following command on the folder:

ren *.mbx *.txt

This allowed me to quickly find the requested email data using Windows Search.

Installing DPM 2007 Agents on a Windows 2008 Server

Over the weekend I migrated over my DCs to Windows 2008 using completely new hardware for the new DCs. I ran into a problem with installing the DPM agents on Windows 2008 DCs. Here are some things I picked up along the way:

• My migration over to a Windows 2008 Domain blew out the DPMRADCOMTrustedMachines and DPMRADmTrustedMachines AD groups. DPM creates these groups when you install the agent on a DC. In addition, the DPM server’s computer account was removed from the Distributed COM Users builtin AD group. Recreating these groups and placing the DPM server back into the above groups didn’t solve all the remote agent install problems
  



• The current release of DPM does support Windows 2008
  
  However, I’m not the only one having trouble installing the agent
  
  I tried the QoS PS service fix but it didn’t work
  





• Finally was able to install the DPM agent on a Windows 2008 system (my test Windows 2008 box) by adding the Windows Backup Server feature and starting the Remote Procedure Call (RPC) Locator service.
  
  
  However, this didn’t allow me to backup the server’s system state. Only could backup regular files. Apparently, DPM is having problems with Windows 2008 System State
  



• Found the lovely command call wbadmin. This command allows you to backup the complete server to a remote file location. Stores the data in a .vhd and .xml files.
  
  Ran the following command from my new DC:
  wbadmin start backup -backuptarget:\\myserver\dcbackup$ -include:c: -quiet
  It completed in around 20 minutes.
  



• To recover a system you will need to know the version information of the backup.
  
  run wbadmin get versions -backuptarget: -machine:
  
  C:\Windows\system32>wbadmin get versions -backuptarget:\\myserver\dcbackup$ -machine:MYDC
  wbadmin 1.0 - Backup command-line tool
  (C) Copyright 2004 Microsoft Corp.
  
  Backup time: 8/24/2008 2:09 PM
  Backup target: Network Share labeled \\myserver\dcbackup$
  Version identifier: 08/24/2008-21:09
  Can Recover: Volume(s), File(s), Application(s), Bare Metal Recovery, System State
  
  Then run wbadmin start recovery -version: backuptarget: -machine:
  
  wbadmin recovery options
  
  


• I configured a task on my DC to run this command every night at 1 AM. Since the backup location is on a file server DPM will back it up.
  During testing the command seemed to overwrite the backup files each time…I will test some more to verify this statement.
  Either way you could simply create different folders on the file server for each day and then create different tasks that go to different locations
  

Well now I have at least some kind of backup solution till the DPM team gets their act together on Windows 2008. Considering how DPM is totally reliant on a DC I might stick with this solution. I would hate to lose my DCs (in different buildings) and then not be able to recover my data due to no DC being available. Simply copy the files off the file server (if that is still standing) to an external USB drive and then attach it the new DC..in theory it should work but I don’t’ want to test it out or ever have to do it.

Moving Windows 2003 DHCP Service

In order to prep for migrating over to a Windows 2008 domain, I had to move the DHCP service from one of my Windows 2003 domain controllers to another. Below are the steps I used to complete this easy task:

1. Installed DHCP service on the new DHCP server


2. Ran the following command on the old DHCP server:
   
   netsh dhcp server export C:\dhcp.txt all
   


3. Copied the dhcp.txt file over to the same location on the new DHCP server


4. Ran the following command on the new DHCP server:
   
   netsh dhcp server import C:\dhcp.txt all
   


5. On the old DHCP server, right-clicked the Scope and selected Deactivate


6. On the old DHCP server, right-clicked the Server -> All Tasks -> Stop


7. On the new DHCP server, right-clicked the Server -> All Tasks -> Start


8. On the new DHCP server, right-clicked the Scope and selected Activate