I needed to login to a Windows Server 2003 and got the following error message:

“You exceeded the allowed connection count”

I found this post http://weblogs.asp.net/owscott/archive/2003/12/30/46776.aspx and tried the command line qwinsta and rwinsta commands but kept getting:

“No session exists for *”

So reading further down I found that I could login to a server that I had access to, open Terminal Service Manager and connect to the server from there.

I found this post which describes the process with screen shots: http://thebackroomtech.com/2008/04/09/howto-remotely-disconnect-a-terminal-services-session/

Hi,

zur Zeit gibt es Probleme mit dem WSUS Server und dem Update KB931125 Stammzertifikate.

Den Clients wird das Update immer und immer wieder angeboten.

Lösung: alle Stammzertifikate (inkl. Mai – September) verweigern und nur das Stammzertifikate (inkl. November) freigegeben.
Auf den Clients muss dann ggf. noch folgendes ausgeführt werden:

1. Stopp des Automatischen Update oder Windows Update Dienstes
2. den Inhalt des Verzeichnisses “C:\WINDOWS\SoftwareDistribution” löschen (“rd /s /q %windir%\SoftwareDistribution”)
3. Neustart des Automatischen Update oder Windows Update Dienstes oder Neustart der Clients

Quelle: Root Certificate update KB931125 keeps installing

Na dann, Viel Spass beim selber Testen!
CU

Hi,

heute hat Microsoft das Kumulatives Zeitzonenupdate Dezember 2009 KB976098 für alle Microsoft Windows Betriebssysteme zur Verfügung gestellt!

Wichtig Dieses Update ersetzt, und ersetzt aktualisieren 970653, die wurde im August 2009 freigegeben. Dieses Update enthält außerdem zusätzliche Zeitzonenänderungen, die in nach Update 970653 erstellt wurde.
Wenn Sie bereits bereitgestellt haben 970653, aktualisieren, lesen die Beschreibungen der bestimmten Zeitzonenänderungen, die in diesem Artikel, um zu überprüfen, ob Sie dieses Update sofort bereitstellen müssen behoben werden. Wenn Systeme nicht direkt betroffen sind, können Sie die Bereitstellung bei der nächsten Gelegenheit einplanen.
Es wird empfohlen, dass Sie das aktuelle kumulative Zeitzonenupdate für Windows zu garantieren die Konsistenz der Zeitzonendatenbank auf allen Systemen bereitstellen.

Wichtig Bevor Sie das Update, das in diesem Artikel beschrieben wird anwenden, achten Sie potenzielle Probleme, die auf Microsoft Outlook auswirken können.
Weitere Informationen zu diesen Problemen finden Sie die folgende KB-Artikelnummer:

931667 (http://support.microsoft.com/kb/931667/ ) Wie Sie die Sommerzeitänderungen in 2007 mithilfe des Zeitzone Data Update-Tools für Microsoft Office Outlook

Wichtig

• Wenn Sie Microsoft Exchange Server in einer IT-Umgebung ausführen, müssen Sie zusätzliche Maßnahmen gewährleisten Sie den ordnungsgemäßen Betrieb von Exchange Server ausführen.
  Weitere Informationen zum Exchange Sommerzeit (DST) Update klicken Sie auf die folgende KB-Artikelnummer:

  941018 (http://support.microsoft.com/kb/941018/ ) Gewusst wie: Sommerzeit adressieren, mithilfe des Exchange Kalender-Update-Tools

• Kumulative Zeitzonenupdates enthalten nur Daten, die für eine bestimmte Region geändert hat oder, wurde hinzugefügt, um die Parität mit anderen Betriebssystemversionen beizubehalten. Daher, wenn ein Zeitzonenschlüssel gelöscht wurde, möglicherweise einige ursprüngliche Werte nicht wiederhergestellt werden nach der Installation des kumulativen Zone Updates.
  Wird nicht empfohlen, dass Sie alle Registrierungsschlüssel zu löschen, die sich auf Zeitzonen beziehen. Auf einem Computer, auf dem unvollständige Zeitzone Schlüssel verfügt, zuerst wiederherstellen Sie die Zeitzone Schlüssel aus einer als funktionierend bekannten Sicherung. Wenden Sie dann das Update.

Na dann, Viel Spass beim selber Testen!
CU

The followig method shows how to install IIS on Windows Server 2003.
You will need the installation source available.

1.Click Start, point to Control Panel, and then click Add or Remove Programs.

2.In Add or Remove Programs, click Add/Remove Windows Components.

3.In the Windows Components Wizard, under Components, select Application Server.

4.Click Next.

5.After the wizard completes the installation, click Finish.

Все хотят видеть на компьютере точное время, кроме того, это очень важно для нормального функционирования домена Windows и AD. Казалось бы, чего проще, настраиваешь PDC эмулятор на синхронизацию с каким-нибудь ntp и все становится на места само собой … Но нет, уже несколько раз, наблюдалась рассинхронизация контроллеров домена между собой и жалобы пользователей на то, что наше время отличается от точного на пару минут.

Казалось бы, смешная проблема – пару минут, но для некоторой работы и пара минут важно. Особенно, если это редактора новостной ленты www.korrespondent.net. Правда были еще и шуточные жалобы, что они из-за этой проблемы целых 2, 3 или 5 минут перерабатывают

Стандартные “танцы с бубнами”, которые делал я, а потом и наш сетевой инженер, по руководству от Microsoft помогали, но не долго. Т.е. время сходится, ошибки из лога исчезают, а через пару часов, или, через сутки все начинается заново. А потом, через пару-тройку недель, или месяц-другой, ошибка снова достигает размера более 2-х минут и все заново.

Итак, хочешь что-то сделать хорошо – сделай это сам. Что мы имеем, три контроллера домена, работающих под Windows 2003 Server R2, кучу рабочих станций под Windows XP Professional SP3. В качестве ntp сервера в компании служит Cisco 2821

Признаками проблемы на DC, являющемся еще и PDC эмулятором является наличие следующих ошибок в Event log:

1.

Event Type:    Warning
Event Source:    W32Time
Event Category:    None
Event ID:    47
Date:        17.11.2009
Time:        13:21:45
User:        N/A
Computer:    DC04
Description:
Time Provider NtpClient: No valid response has been received from  manually configured peer ntp.mydomain.ua,0×1 after 8 attempts to contact it. This peer will be discarded as a time source and NtpClient will attempt to discover a new peer  with this DNS name. 

2.

Event Type:    Error
Event Source:    W32Time
Event Category:    None
Event ID:    29
Date:        17.11.2009
Time:        13:21:45
User:        N/A
Computer:    DC04
Description:
The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible.  No attempt to contact a source will be made for 15 minutes. NtpClient has no source of accurate time.

3.

Event Type:    Information
Event Source:    W32Time
Event Category:    None
Event ID:    38
Date:        17.11.2009
Time:        14:06:45
User:        N/A
Computer:    DC04
Description:
The time provider NtpClient cannot reach or is currently receiving invalid time data from ntp.mydomain.ua
(ntp.m|0×1|192.168.0.50:123->10.10.72.17:123).

На остальных контроллерах домена, вместо Event ID 47, присутствует Event ID:    24

Event Type:    Warning
Event Source:    W32Time
Event Category:    None
Event ID:    24
Date:        18.11.2009
Time:        6:46:56
User:        N/A
Computer:    DC03
Description:
Time Provider NtpClient: No valid response has been received from domain controller pdacemul.addomain after 8 attempts to contact it. This domain controller will be discarded as a time source and NtpClient will attempt to discover a  new domain controller from which to synchronize.

Итак, вот процедура по восстановлению работоспособности сервиса w32tm

1. 1.  Если кто не знает этого наизусть, то так вот находим все DC и того, кто из них PDC эмуляторnetdom query fsmo
2. Теперь проверяю доступность с PDC эмулятора сервера времени.portqry –n ntp.mydomain.ua –e 123 –p UDP

   Querying target system called:
   ntp.mydomain.ua
   Attempting to resolve name to IP address…
   Name resolved to 10.10.72.17

UDP port 123 (ntp service): LISTENING or FILTERED

Должно быть именно так “LISTENING or FILTERED”

3. Затем, с помощью regedit открываю параметры ntp сервераHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\NtpServer

   Там должен быть записан ip адрес или полной имя нашего ntp сервера и запись должна обязательно заканчиваться строкой “,0×1”. Кавычки, понятное дело, нужно убрать. Кстати, к этому суффиксу я вернусь позже. Для уверенности в том, что тут нету ошибки, неплохо бы попингать скопированный оттуда адрес или имя.

4. Там же, следует перейти к параметруHKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\Type

   и убедиться, что там прописано  NTP, а неNT5DS

5. Теперь следует проверить еще одно значениеHKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config\AnnounceFlags

   тут должна быть 5

6. Перезапускаем сервис времениnet stop w32time && net start w32time
7. Теперь перезапускаю синхронизацию:w32tm /resync /rediscover
8. На остальных контроллерах домена рекомендуется сделатьw32tm /unregister
   w32tm /register

   Эта операция удаляет службу времени, а затем снова ее устанавливает, причем, что важно, удаляется, а затем создается заново вся ветка параметров в реестре.

9. Очень рекомендуется перезапустить контроллер домена, являющийся pdc эмулятором, да и все остальные тоже.
10. Если на pdc эмуляторе ошибки появляются заново, как в моем случае, то стоит попробовать заменить значение 0×1 на 0×08 в параметреHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\NtpServer

    чтобы стали посылаться стандартные клиентские запросы.

11. Перезапускаем сервис времениnet stop w32time && net start w32time
12. Очень рекомендуется проверить все политики, имеющие отношение к настройкам сервиса времени, а именно:
    Default Domain Controllers group policy
    Default Domain group policy
    ну и все другие, которые имеют отношение к домен контроллерам, серверам и рабочим станциям и в которых изменены любые значения в разделе
    Computer configuration/Administrative Templates /System/Windows Time service/Time Providers

    Убедитесь, что все значения там в состоянии “not configured”. При необходимости, играть с параметрами следует позже.

13. Если что-то меняли в политике, то перезапускаем сервис времени:net stop w32time && net start w32time
14. Если и после этого ничего не помогло, то нужно обнулить параметры сервиса времени и на pdc эмулятореw32tm /unregister
    w32tm /register

    после чего нужно будет настраивать все параметры заново, начина с п.3

У меня этот алгоритм сработал и, наконец-то, вопрос с временем был закрыт.

Кстати, проверить что со временем все в порядке можно так:

w32tm /monitor

dc01.addomain [192.168.0.60]:
    ICMP: 0ms delay.
    NTP: +0.0009899s offset from pdcemul.addomain
        RefID: pdcemul.addomain [192.168.0.50]
dc03.addomain [192.168.0.20]:
    ICMP: 0ms delay.
    NTP: -0.0014416s offset from dc04.addomain
        RefID: pdcemul.addomain [192.168.0.50]
pdcemul.addomain *** PDC *** [192.168.0.50]:
    ICMP: 0ms delay.
    NTP: +0.0000000s offset from pdcemul.addomain
        RefID: ntp.mydomain.ua [10.10.72.17]

The MS support article http://support.microsoft.com/kb/932578 recommends a hotfix, but does not have a good example showing the problem.

Should CHKDSK be run first?
As errors are reported I will have to run it and let it fix the disk before I can see what it reports the allocation unit size is

Active Directory (AD) merupakan layanan yang dibanggakan oleh windows server, dengan tugas dari seorang administrator akan dipermudah, sebagai analoginya AD adalah sebuah buku telepon, yang didalamnya terdapat berbagai informasi nama dan buku telepon yang sangat mudah untuk ditemukan jika kita ingin mencari sebuah informasi.

mungkin ini sekedar teori yang sudah banyak beredar..

langsung ada deh proses konfigurasinya, gambar2 dibawah ini sudah mewakili urutan yang dilakukan pada saat awal hingga akhir dari proses instalasi. knapa gambar ? karena 1 gambar mewakili seribu kata..huehuehue

dan akhirnya selesai… , next dilanjutin join domain n administrasi antivirus server kaspersky…

Nome: Windows Server 2003 R2 Enterprise Edition x64SP2
Fabricante: Microsoft
Estilo: Sistema Operacional
Ano de Lançamento: 2009
Tamanho: 572 MB CD-1 / 119 MB CD-2
Serial: H8GPX-2GH6Y-J97P2-MHTH8-QX2FJ

Configuração:
PROCESSADOR:
• Intel® Pentium® III ou superior com no mínimo 800 MHz

MEMÓRIA RAM:
• 512 MB RAM

DISCO RÍGIDO:
• 8 GB de espaço livre em disco

DESCRIÇÃO/SINOPSE”

As edições x64 do Windows Server 2003 estão mudando o cenário da computação geral. Esta nova plataforma de 64 bits fornece operações de alto desempenho em aplicativos 64 bits enquanto melhoram aplicativos de 32 bits. Otimize suas operações de TI e desenvolva aplicações mais rapidamente.

Windows Server 2003 x64 edições proporcionar alto desempenho, tanto para 32-bit e 64-bit aplicativos no mesmo sistema. A arquitetura subjacente baseia-se em extensões de 64 bits para o padrão da indústria conjunto de instruções x86, permitindo que hoje, 32-bit aplicativos para rodar nativamente em processadores x64. Ao mesmo tempo, novas aplicações de 64 bits são executados no modo de 64 bits, que processa mais dados por ciclo de relógio, permite o acesso directo a mais de memória física (RAM), e acelera os cálculos numéricos. O resultado final é uma plataforma que alavanca as riquezas existentes de 32-bit aplicativos ao mesmo tempo proporcionar um caminho de migração suave para a computação de 64-bit.

As edições x64 do Windows Server são compilados a partir da mesma base de código como o 32-bit versão. Isso torna o 64 edições uma plataforma madura e confiável, naturalmente adaptados para herdar a maioria de seus 32-bits como soluções de substituir os servidores antigos com hardware de hoje, 64. Além disso, as edições x64 do Windows Server fornecem a energia e a instabilidade necessárias para virtualizar ou consolidar cargas de trabalho do servidor.

A melhor maneira de tirar o máximo partido do hardware de servidor x64 de hoje é com uma solução baseada no Windows Server x64 Edition.

File Name: en_win_srv_2003_r2_enterprise_x64_with_s p2_cd1_X13-06188.iso Date Posted SHA1: D04C8F304047397BE486C38A6B769F16993D4B39 ISO/CRC: N/A

File Name: en_win_srv_2003_r2_enterprise_x64_with_s p2_cd2_X13-68588.iso Date Posted SHA1: 54B845F1E4C27C9C96AACEF59B9AB19CEFE1C8BC ISO/CRC: BADD5028

CONFIGURAÇÕES MINIMA”

PROCESSADOR:
• Intel® Pentium® III ou superior com no mínimo 800 MHz

MEMÓRIA RAM:
• 512 MB RAM

DISCO RÍGIDO:
• 8 GB de espaço livre em disco

INFORMAÇÕES DO SISTEMA”

Tamanho:572 MB CD-1 / 119 MB CD-2

Formato:Rar

Indioma:Inglês

Download abaixo pelo MegaUpload”

CD – 01

CD – 02

Hi Everybody!

I’ve recently noticed following entries in my Event Viewer Applications Log:

Event Type:    Warning
Event Source:    MSExchangeSA
Event Category:    OAL Generator
Event ID:    9320
Date:        2009-11-13
Time:        04:08:35
User:        N/A
Computer:    XXXXXXXX
Description:
OALGen could not generate full details for some entries in the offline address list for address list ‘\Global Address List’.  To see which entries are affected, event logging for the offline address list generator must be set to at least medium.
- Default Offline Address List

For more information, click http://www.microsoft.com/contentredirect.asp.

Event Type:    Warning
Event Source:    MSExchangeSA
Event Category:    OAL Generator
Event ID:    9323
Date:        2009-11-13
Time:        04:08:30
User:        N/A
Computer:    XXXXXXXX
Description:
Entry ‘Administrator’ has invalid or expired e-mail certificates.  These certificates will not be included in the offline address list for ‘\Global Address List’.
- Default Offline Address List

For more information, click http://www.microsoft.com/contentredirect.asp.

So I started to google for an explanation of the above and found some unsatisfying answers. Most people advised to remove expired administrator certificate from ADUC , but I didn’t want to loose it. I rather wanted to renew it (or get a new certificate for that user). You never know when it could be needed.

So finally I’ve found, that it is possible through a CERTSRV service.

Here is how to do that:

1. Login as Administrator into your Domain Controller where you have CERTIFICATION SERVICE with IIS installed.
2. Start the IE Browser and point to: https://localhost/CertSrv (if you have SSL installed:) otherwise use http)
3. Request a New User certificate for the logged in user (in this case Administrator)
4. Install the newly generated Certificate

Now – remove your expired certificate using ADUC:

1. Open ADUC
2. Select View – Advanced Features
3. Select Administrator User and chose “Published Certificates” Tab
4. Remove the expired certificate

Now rebuild your Offline Address Book using Exchange System Manager

Attention: The Author takes no responsibility for the given advise. Use it on your own risk!

• Operations Master Roles (also known as Flexible Single Master Operations, or FSMO) are special roles assigned to one or more domain controllers in an active directory domain.
• The domain controllers assigned these roles perform single-master replication.
• Some roles must appear in every forest. Others must appear in every domain in the forest.

Forest-Wide Operations Master Roles

Every active directory forest must have the following roles:

• Schema Master
• Domain Naming Master

These roles must be unique in the forest. This means that throughout the entire forest there can only be one Schema Master and one Domain Naming Master.

Schema Master Role

The domain controller assigned the schema master role controls all updates and modifications to the schema. To update the schema of a forest, you must have access to the schema master.

Domain Naming Master Role

The domain controller holding the domain naming master role controls the addition or removal of domains in the forest.

Domain-Wide Operations Master Roles

Every domain in the forest must have the following roles:

• Relative Identifier (RID), or Relative ID, Master
• Primary Domain Controller (PDC) Emulator
• Infrastructure Master

These roles must be unique in each domain. This means that each domain in the forest can have only one RID Master, PDC Emulator Master, and Infrastructure Master .

Viewing FSMO Roles

Viewing Domain-Wide FSMO Roles

• Open Active Directory Users and Computers Snap-in
• Right-Click the Domain and Choose Operations Masters

Viewing Domain-Wide FSMO Roles

• Operations Master dialog box opens. You can view all the Domain-Wide FSMO Roles using this dialog box as shown in the snapshot below:

Viewing Domain-Wide FSMO Roles

Viewing Forest-Wide FSMO Roles

Viewing Forest-Wide FSMO Roles

Viewing Forest-Wide FSMO Roles

Registering Schema Snap-in

Registering Schema Snap-in

Viewing Forest-Wide FSMO Roles

Viewing Forest-Wide FSMO Roles

Viewing Forest-Wide FSMO Roles

Viewing Forest-Wide FSMO Roles

Viewing Forest-Wide FSMO Roles

I found this article online it’s a nice summarization of Active Directory that may be useful in helping you understand AD and LDAPs in general. http://bit.ly/3cZkps

• Operations Master Roles (also known as Flexible Single Master Operations, or FSMO) are special roles assigned to one or more domain controllers in an active directory domain.
• The domain controllers assigned these roles perform single-master replication.
• Some roles must appear in every forest. Others must appear in every domain in the forest.

Forest-Wide Operations Master Roles

Every active directory forest must have the following roles:

• Schema Master
• Domain Naming Master

These roles must be unique in the forest. This means that throughout the entire forest there can only be one Schema Master and one Domain Naming Master.

Schema Master Role

Domain Naming Master Role

Domain-Wide Operations Master Roles

Every domain in the forest must have the following roles:

• Relative Identifier (RID), or Relative ID, Master
• Primary Domain Controller (PDC) Emulator
• Infrastructure Master

These roles must be unique in each domain. This means that each domain in the forest can have only one RID Master, PDC Emulator Master, and Infrastructure Master .

RID Master Role

Whenever a domain controller creates a user, group, or computer object, it assigns the object a unique security ID. The security ID consists of a domain security ID (that is the same for all security IDs created in the domain) and a relative ID that is unique for each security ID created in the domain.

PDC Emulator Role

Infrastructure Master Role

The domain controller assigned the infrastructure master role is responsible for updating the group-to-user references whenever the members of groups are renamed or changed. At any time, there can be only one domain controller acting as the infrastructure master in each domain.

When you rename or move a member of a group (and the member resides in a different domain from the group), the group might temporarily appear not to contain that member. The infrastructure master of the group’s domain is responsible for updating the group so it knows the new name or location of the member. The infrastructure master distributes the update via multimaster replication.

Viewing Operations Master Role

To view the RID Master, the PDC Emulator, or the Infrastructure Master role assignments, complete the following steps:

1. Open the Active Directory Users And Computers console
2. In the console tree, right-click the  Active Directory Users And Computers node
3. Point to All Tasks, and then click Operations Masters

Domain-Wide Roles

In the Operations Masters dialog box, select one of the following choices:

Click the RID tab, and the name of the RID master appears in the Operations Masters dialog box.

Click the PDC tab, and the name of the PDC emulator appears in the Operations Master box.

Click the Infrastructure tab, and the name of the infrastructure master appears in the Operations Master box.

Domain-Wide Roles

Click Close to close the Operations Master dialog box.

Security experts generally agree that certificate-based authentication and encryption is far superior to password-based security. Windows operating systems have used certificates of various kinds to secure data communications for years. It was with the introduction of Windows XP and Windows Server 2003 that Microsoft began to support many types of smart card certificates.  A Windows Server 2003 Certificate Authority could deliver smart card certificates through the use of Enrollment Agents—individuals who have been empowered by an enrollment agent certificate to obtain smartcard certificates for users. A user would meet an enrollment agent in person and submit identification in order to receive a smart card.

Certificate templates on a Certificate Server determine the validity period, encryption strength, and other properties of certificates issued from the template. Windows 2000 used version 1 certificates, Windows XP and Server 2003 used version 2 certificates and Windows Server 2008 and Vista/Windows 7 can use version 3 certificates. Version 3 certificates support stronger encryption by using Suite B algorithms including ECC (elliptic curve cryptography). Server 2008 Certificate Authorities support OCSP (online certificate status protocol), a new way for clients to check to see if a certificate is revoked. Instead of parsing a CRL (certificate revocation list) a client can use OCSP to contact an Online Responder, a webserver-based agent to quickly obtain a certificate’s revocation status. This method is more efficient, and busy environments can be serviced by responder arrays for high capacity and high availability. Online Responders must be authorized by a new Version 3 certificate that attests to the Responders accuracy.

Windows Server 2008 R2 Certification Authority Servers have additional new capabilities such as the ability to do cross-forest enrollments, even cross-forest autoenrollements using Group Policy. Enrollment is the process of requesting and receiving digital certificates from a Certificate Authority. Autoenrollment automates the certificate request using a group policy. Other improvements include a Kerberos certificate that identifies the Domain Controller to the client during Kerberos based authentication. Check out some of the new features at:

http://technet.microsoft.com/en-us/magazine/2009.05.pki.aspx?pr=blog

-Mark

This was a helpful book when I was studying for my MCSA.  Click here to read its Amazon reviews.

Hi,

heute war wieder Microsoft Patchday! 6 Updates schließen damit die 15 Sicherheitslücken. Betroffen sind folgende Applikationen:

• Windows 2000 Service Pack 4
• Windows XP Service Pack 2 & 3 *
• Windows Vista Service Pack 1 & 2 *
• Windows Server 2003 Service Pack 2 *
• Windows Server 2008 Service Pack 2 *
• Microsoft Office XP
• Microsoft Office 2003
• Microsoft Office 2007
• Microsoft Office 2004 (Mac)
• Microsoft Office 2008 (Mac)
  * 32bit and 64bit Architektur

Windows 7 & Server 2008 R2 sind nicht betroffen!

Microsoft Security Bulletin Summary für November 2009

KB973565: Vulnerability in Web Services on Devices API Could Allow Remote Code Execution
This security update resolves a privately reported vulnerability in the Web Services on Devices Application Programming Interface (WSDAPI) on the Windows operating system. The vulnerability could allow remote code execution if an affected Windows system receives a specially crafted packet. Only attackers on the local subnet would be able to exploit this vulnerability.

KB974783: Vulnerability in License Logging Server Could Allow Remote Code Execution
This security update resolves a privately reported vulnerability in Microsoft Windows 2000. The vulnerability could allow remote code execution if an attacker sent a specially crafted network message to a computer running the License Logging Server. An attacker who successfully exploited this vulnerability could take complete control of the system. Firewall best practices and standard default firewall configurations can help protect networks from attacks that originate outside the enterprise perimeter.

KB969947: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution
This security update resolves several privately reported vulnerabilities in the Windows kernel. The most severe of the vulnerabilities could allow remote code execution if a user viewed content rendered in a specially crafted Embedded OpenType (EOT) font. In a Web-based attack scenario, an attacker would have to host a Web site that contains specially crafted embedded fonts that are used to attempt to exploit this vulnerability. In addition, compromised Web sites and Web sites that accept or host user-provided content could contain specially crafted content that could exploit this vulnerability. An attacker would have no way to force users to visit a specially crafted Web site. Instead, an attacker would have to convince the user to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes the user to the attacker’s site.

KB973309: Vulnerability in Active Directory Could Allow Denial of Service
This security update resolves a privately reported vulnerability in Active Directory directory service, Active Directory Application Mode (ADAM), and Active Directory Lightweight Directory Service (AD LDS). The vulnerability could allow denial of service if stack space was exhausted during execution of certain types of LDAP or LDAPS requests. This vulnerability only affects domain controllers and systems configured to run ADAM or AD LDS.

KB972652: Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution
This security update resolves several privately reported vulnerabilities in Microsoft Office Excel. The vulnerabilities could allow remote code execution if a user opens a specially crafted Excel file. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

KB976307: Vulnerability in Microsoft Office Word Could Allow Remote Code Execution
This security update resolves a privately reported vulnerability that could allow remote code execution if a user opens a specially crafted Word file. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Natürlich wurden auch die Junk-E-Mail-Filter von Outlook und Windows Mail und das Tool zum Entfernen bösartiger Software aktualisiert.

Na dann, Viel Spass beim selber Testen!
CU

Hello everyone,

Since I’m not aware of any tools that visually log print server information, I wrote a script that parses the log entries from the system event log of a Windows 2003 print server. Apparently I never got around to posting this online, but I hope that someone is able to benefit from it.

Basically, the process flow of the script looks like this:

1. Retrieve list of all print entries from server event log
2. Parses information from each log entry and creates an object in memory representing it
3. Builds a hash table from all objects
4. Iterates over the hash table and writes each print log entry to an Excel document

If you have any questions about it, please feel free to let me know.

FYI, I commented out the line near the bottom that does the Excel output, so that it could be executed on a server without Excel installed.

#################################################################################
#																				#
#	Author: Trevor Sullivan
#																				#
#	  Date: February 10th, 2009
#																				#
#  Purpose: This script is meant for running against a Windows 2003 event log.
#		The verbage for the print log entries has changed for Windows Vista.
# 																				#
#################################################################################

Function GetPrintEntriesFromTextFile($tFileName)
{
	Get-Content $tFileName
}

Function GetPrintEntriesFromLog()
{
	$PrintEntries = Get-EventLog -LogName System | Where-Object { $_.EventId -eq 10	-and $_.Source -eq "Print" -and $_.TimeGenerated.Month -eq (Get-Date).Month	-and $_.TimeGenerated.Year -eq (Get-Date).Year }
	return $PrintEntries
}

# Parses username from a Windows 2003 Print log message
Function GetUserName($PrintEntry)
{
	If ($PrintEntry -eq "" -or $PrintEntry -eq $null) { return $null }

	$rxUserName = [regex]"owned by ([0-9a-zA-Z]{7})"
	$rxUserName = [regex]"owned by ([0-9a-zA-Z]{1,}) was"
	$rxMatches = $rxUserName.Match($PrintEntry)
	return $rxMatches.Groups[1].Value
}

Function GetPrinterName($PrintEntry)
{
	If ($PrintEntry -eq "" -or $PrintEntry -eq $null) { return $null }

	#Write-Host "Parsing printer name"
	$rxPrinterName = [regex]"printed on ([0-9a-zA-Z-_\s]{5,}) via"
	$rxMatches = $rxPrinterName.Match($PrintEntry)
	return $rxMatches.Groups[1].Value
}

Function GetPrintSize($PrintEntry)
{
	If ($PrintEntry -eq "" -or $PrintEntry -eq $null) { return $null }

	#Write-Host "Getting print size"
	$rxPrintSize = [regex]"Size in bytes: ([0-9]+);"
	$rxMatches = $rxPrintSize.Match($PrintEntry)
	return $rxMatches.Groups[1].Value
}

Function GetPageCount($PrintEntry)
{
	If ($PrintEntry -eq "" -or $PrintEntry -eq $null) { return $null }

	#Write-Host "Getting page count"
	$rxPageCount = [regex]"pages printed\: ([0-9]+)"
	$rxMatches = $rxPageCount.Match($PrintEntry)
	return $rxMatches.Groups[1].Value
}

Function GetDocumentName($PrintEntry)
{
	If ($PrintEntry -eq "" -or $PrintEntry -eq $null) { return $null }

	#Write-Host "Getting print size"
	$rxDocumentName = [regex]", ([a-zA-Z-_:/\[#\]\?\\\=\d\.\s\(\)&-,]{1,}) owned by"
	$rxMatches = $rxDocumentName.Match($PrintEntry)
	return $rxMatches.Groups[1].Value
}

# Retrieves user's full name from AD
Function GetUserFullName($UserId)
{
	if ($UserId -gt "")
	{
		$DirectorySearcher = New-Object System.DirectoryServices.DirectorySearcher
		$LdapFilter = "(&(objectClass=user)(samAccountName=${UserId}))"
		#Write-Host "Filter is: ${LdapFilter}"
		$DirectorySearcher.Filter = $LdapFilter
		$UserEntry = [adsi]"$($DirectorySearcher.FindOne().Path)"
		#Write-Host $UserEntry.displayName
		return $UserEntry.displayName
	}

	return
}

Function CreatePrintJob()
{
	$PrintJob = New-Object PsObject
	Add-Member -Force -InputObject $PrintJob -MemberType NoteProperty -Name PageCount -Value $null
	Add-Member -Force -InputObject $PrintJob -MemberType NoteProperty -Name UserName -Value $null
	Add-Member -Force -InputObject $PrintJob -MemberType NoteProperty -Name DocumentName -Value $null
	Add-Member -Force -InputObject $PrintJob -MemberType NoteProperty -Name Size -Value $null
	Add-Member -Force -InputObject $PrintJob -MemberType NoteProperty -Name Printer -Value $null
	Add-Member -Force -InputObject $PrintJob -MemberType NoteProperty -Name Time -Value $null
	Add-Member -Force -InputObject $PrintJob -MemberType NoteProperty -Name UserFullName -Value $null
	return $PrintJob
}

Function ParsePrintEntry($PrintEntry)
{
	$NewPrintJob = CreatePrintJob

	if ($PrintEntry.GetType() -eq [System.String])
	{
		$NewPrintJob.PageCount = GetPageCount $PrintEntry
		$NewPrintJob.UserName = GetUserName $PrintEntry
		$NewPrintJob.DocumentName = GetDocumentName $PrintEntry
		$NewPrintJob.Size = GetPrintSize $PrintEntry
		$NewPrintJob.Printer = GetPrinterName $PrintEntry
		$NewPrintJob.UserFullName = GetUserFullName $NewPrintJob.UserName
	}
	elseif ($PrintEntry.GetType() -eq [System.Diagnostics.EventLogEntry])
	{
		$NewPrintJob.PageCount = GetPageCount $PrintEntry.Message
		$NewPrintJob.UserName = GetUserName $PrintEntry.Message
		$NewPrintJob.DocumentName = GetDocumentName $PrintEntry.Message
		$NewPrintJob.Size = GetPrintSize $PrintEntry.Message
		$NewPrintJob.Printer = GetPrinterName $PrintEntry.Message
		$NewPrintJob.Time = $PrintEntry.TimeGenerated.ToString()
		$NewPrintJob.UserFullName = GetUserFullName $NewPrintJob.UserName
	}

	return $NewPrintJob
}

Function Main()
{
	$PrintEntries = GetPrintEntriesFromLog
	#$PrintEntries = GetPrintEntriesFromTextFile "${env:USERPROFILE}\Documents\Powershell Scripts\Print Log Parser\PrintLog.txt"
	$Global:ParsedEntries = @{}; $i = 0

	ForEach ($PrintEntry in $PrintEntries)
	{
		$ParsedEntries.Add($i, $(ParsePrintEntry $PrintEntry))
		#$ParsedEntries += (ParsePrintEntry $PrintEntry)
		$i++

		if ($i % 100 -eq 0)
		{ Write-Host "Processed $i records" }
	}

	# Export information to CSV or Excel document
	$ParsedEntries.Values | Export-Csv "c:\$((Get-Date).Month).csv" -NoTypeInformation
	#WriteToExcel $ParsedEntries
}

Function WriteToExcel($tEntries)
{
	# Load Excel interop assembly
	[Void] [Reflection.Assembly]::LoadWithPartialName("Microsoft.Office.Interop.Excel")

	# Create Excel application, workbook, and worksheet objects
	$Excel = New-Object Microsoft.Office.Interop.Excel.ApplicationClass
	$Workbook = $Excel.Workbooks.Add()
	$Worksheet = $Workbook.Worksheets.Add()

	# Write Excel worksheet headers
	$Worksheet.Cells.Item(1, 1).Value2 = "Username"
	$Worksheet.Cells.Item(1, 2).Value2 = "Full Name"
	$Worksheet.Cells.Item(1, 3).Value2 = "Time"
	$Worksheet.Cells.Item(1, 4).Value2 = "Page Count"
	$Worksheet.Cells.Item(1, 5).Value2 = "Printer"
	$Worksheet.Cells.Item(1, 6).Value2 = "Size (bytes)"
	$Worksheet.Cells.Item(1, 7).Value2 = "Document Name"
	# End writing Excel worksheet headers	

	# Iterate over each print entry
	$row = 2
	ForEach ($key in $tEntries.Keys)
	{
		$Worksheet.Cells.Item($row, 1).Value2 = $tEntries[$key].UserName
		$Worksheet.Cells.Item($row, 2).Value2 = $tEntries[$key].UserFullName
		$Worksheet.Cells.Item($row, 3).Value2 = $tEntries[$key].Time
		$Worksheet.Cells.Item($row, 4).Value2 = $tEntries[$key].PageCount
		$Worksheet.Cells.Item($row, 5).Value2 = $tEntries[$key].Printer
		$Worksheet.Cells.Item($row, 6).Value2 = $tEntries[$key].Size
		$Worksheet.Cells.Item($row, 7).Value2 = $tEntries[$key].DocumentName
		$row++
	}

	# Do some formatting
	# AutoFit the columns
	[Void] $Excel.ActiveCell.CurrentRegion.Columns.AutoFit()

	# Add table styling and auto-filtering
	[Void] $Excel.ActiveCell.CurrentRegion.Select()
	$ListObject = $Excel.ActiveSheet.ListObjects.Add([Microsoft.Office.Interop.Excel.XlListObjectSourceType]::xlSrcRange, $Excel.ActiveCell.CurrentRegion, $null ,[Microsoft.Office.Interop.Excel.XlYesNoGuess]::xlYes)
	$ListObject.Name = "TableData"
	$ListObject.TableStyle = "TableStyleLight9"

	# Show the Excel window after writing data to spreadsheet
	$Excel.Visible = $true
}

Main

Hi,

heute Nacht hat Microsoft für den Internet Explorer ein Update für die Versionen 5 bis 8 bereitgestellt!

KB976749: Ein Update steht für Internet Explorer, die Probleme, die auftreten behebt, nachdem Sie Sicherheitsupdate 974455 (MS09-054) anwenden

Microsoft hat ein Update zur Verfügung, das Probleme behebt, die in den folgenden Artikeln der Microsoft Knowledge Base behandelt werden:

Artikelnummer	Titel des Artikels
976948	Die Eigenschaften OffsetTop Berechnung für Elemente, die vorhanden sind, wie die untergeordneten Elemente des ein Bildlauf ausgeführt Elemente nicht ordnungsgemäß in Windows Internet Explorer 8 gemeldet werden können
976949	Sie erhalten eine Skript von VBScript “Typenkonflikt” Skript Fehlermeldung in Internet Explorer, nachdem Sie das kumulative Sicherheitsupdate 974455 aktualisieren

Diese Probleme können nur bestimmte Browsen Szenarien für Benutzer, die Kumulatives Sicherheitsupdate für Internet Explorer-974455 (beschrieben in Microsoft Security Bulletin MS09-054 (http://www.microsoft.com/technet/security/bulletin/MS09-054.mspx) ) installiert haben. Weitere Informationen zur Sicherheit aktualisieren Sie 974455, finden Sie im folgenden Artikel der Microsoft Knowledge Base:

974455 (http://support.microsoft.com/kb/974455/ ) MS09-054: Kumulatives Sicherheitsupdate für Internet Explorer

Wichtig Installieren Sie dieses Update nicht, wenn Sie Sicherheitsupdate 974455 nicht installiert haben. Wenn Sie dieses Update installieren, ohne die Sicherheit der ersten Installation von 974455, Internet Explorer eventuell nicht einwandfrei. Wenn dies der Fall ist, dieses Update zu deinstallieren, installieren Sie Sicherheitsupdate 974455, und installieren Sie dieses Update neu.

Gehen Sie folgendermaßen vor um dieses Update zu installieren:

1. Verwenden Sie die folgende Liste, um den entsprechenden Link für Ihre Version von Internet Explorer und Ihr Betriebssystem zu suchen.
2. Klicken Sie auf den Link, und in der Microsoft Download Center-Seite, die geöffnet wird, klicken Sie anschließend auf Download. Wenn die Schaltfläche Download nicht verfügbar ist, klicken Sie zunächst Überprüfen, um Ihre Kopie von Windows zu überprüfen.
3. Klicken Sie auf Ausführen, wenn Sie dazu aufgefordert werden.
4. Folgen Sie den Anweisungen, um das Update zu installieren.

Das Update ist entweder über Windows Update ladbar oder direkt von der Seite des KB976749 Artikels.

Na dann, Viel Spass beim selber Testen!
CU

On July 13th, 2010, Extended Support for Windows 2000 Server and Windows 2000 Professional will end. At the same time Windows XP and Windows Server 2003 will go from Mainstream Support to Extended Support. ‘Mainstream Support’, ‘Extended Support’ – what exactly does that mean? This  diagram lists the major differences:

more …