Trigger Altiris Software Update Cycle on Remote a Computer

 When using Altiris you often find that some computers have a bunch of updates pending, but the users are always putting them off. The script below is what I have used to force an Altiris update cycle on a remote system:

#Update with a list of computers / IPs you want to update
$Computers = "computer1","computer2"
foreach($c in $Computers){
    # check if the computer is on before trying to install updates
    if(Test-Connection -ComputerName $c -Quiet){
        # execute remote update cycle
        psexec \\$c powershell.exe -Command "cd 'C:\Program Files\Altiris\Altiris Agent\Agents\PatchMgmtAgent'; ./aexpatchutil.exe /Xa /q"
    }
}

Note:

You will need to run the script as an administrator that has access to the remote system
You need to have pstools installed: https://learn.microsoft.com/en-us/sysinternals/downloads/pstools

You can also update the script above to run an inventory by using the /I flag. 
Check out the AexPatchUtil.exe command line switches here:
https://knowledge.broadcom.com/external/article/181828/aexpatchutilexe-command-line-options-and.html

Monitoring APC UPS via TheDude and SNMP

We have had some issues with our UPS systems recently and found that our monitoring and alerting systems were not working too well. After some tinkering I found that you can remotely monitor the UPS via The Dude. This method uses SNMP to monitor the UPS variables.

Examples of live UPS data including a UPS with a faulty battery.

Adding Probes for alerts:

Example of adding a specific probe.

I used the following Oid's:

iso.org.dod.internet.private.enterprises.318.1.1.1.2.2.1.0  - Battery % >= 90

iso.org.dod.internet.private.enterprises.318.1.1.1.7.2.3.0 - Battery Self Test != 0

iso.org.dod.internet.private.enterprises.318.1.1.1.2.2.2.0 - Battery Temp < 40

iso.org.dod.internet.private.enterprises.318.1.1.1.4.2.3.0 - Output Load < 90

iso.org.dod.internet.private.enterprises.318.1.1.1.2.2.4.0 - Replace Battery != 2

iso.org.dod.internet.private.enterprises.318.1.1.1.2.2.3.0 - Time Remaining > 10:00

You can use the code below to view the UPS status by adding it to the Label.

[Device.Name]

Serial: [oid("iso.org.dod.internet.private.enterprises.318.1.1.1.1.2.3.0")]

Remaining: [oid("iso.org.dod.internet.private.enterprises.318.1.1.1.2.2.3.0")]

Battery Cap: [oid("iso.org.dod.internet.private.enterprises.318.1.1.1.2.2.1.0")]%

Battery Temp: [oid("iso.org.dod.internet.private.enterprises.318.1.1.1.2.2.2.0")] C

Output Load: [oid("iso.org.dod.internet.private.enterprises.318.1.1.1.4.2.3.0")]% 

Output V: [oid("iso.org.dod.internet.private.enterprises.318.1.1.1.4.2.1.0")]V

Output A: [oid("iso.org.dod.internet.private.enterprises.318.1.1.1.4.2.4.0")]A

Last Test: [oid("iso.org.dod.internet.private.enterprises.318.1.1.1.7.2.4.0")]

Result: [if(oid("iso.org.dod.internet.private.enterprises.318.1.1.1.7.2.3.0")=1,"Success","Failed")]

Reason Switch: [if(oid("iso.org.dod.internet.private.enterprises.318.1.1.1.3.2.5.0")=1,"No Events","")][if(oid("iso.org.dod.internet.private.enterprises.318.1.1.1.3.2.5.0")=2,"High line Voltage","")][if(oid("iso.org.dod.internet.private.enterprises.318.1.1.1.3.2.5.0")=3,"Brownout","")][if(oid("iso.org.dod.internet.private.enterprises.318.1.1.1.3.2.5.0")=4,"Loss of mains power","")][if(oid("iso.org.dod.internet.private.enterprises.318.1.1.1.3.2.5.0")=5,"Small temp power drop","")][if(oid("iso.org.dod.internet.private.enterprises.318.1.1.1.3.2.5.0")=6,"Large temp power drop","")][if(oid("iso.org.dod.internet.private.enterprises.318.1.1.1.3.2.5.0")=7,"Small spike","")][if(oid("iso.org.dod.internet.private.enterprises.318.1.1.1.3.2.5.0")=8,"Large spike","")][if(oid("iso.org.dod.internet.private.enterprises.318.1.1.1.3.2.5.0")=9,"UPS Selft Test","")][if(oid("iso.org.dod.internet.private.enterprises.318.1.1.1.3.2.5.0")=10,"Excessive input voltage fluctuation","")]

Batt Fault: [if(oid("iso.org.dod.internet.private.enterprises.318.1.1.1.2.2.4.0")=2,"Yes","No")]

How to run an application as a different user

I often have the need to run applications with different credentials. For instance I may need to connect to a website that users Windows integrated authentication, but I need to use my admin account, not my normal logon to access this. Instead of logging off or switching users I simply created a batch script which launches IE with a different set of credentials.

runas /user:[domain]\[user account] "C:\Program Files (x86)\Internet Explorer\iexplore.exe \"[URL]\""

You can use the runas command to run any application you like, just substitute the values above.
Also note that doing as above will prompt you for your password when you run it, so it is best for interactive use. You can store your password in the batch script, but I would not recommend this.

Restarting Windows XP Mode Virtual Machine via script

Let me give you some background into the problem that I had. I have several users who use an application that does not work on Windows 7, so I had to load Windows XP mode on their machines to allow them to access the software. The software in question uses a trusted connection to connect to a database server so the users have to logon to the Windows XP mode VM with their Active Directory credentials. This works pretty well up until the point that the user has to change their AD password. The Windows XP Mode VM never actually shuts down after the application is used, it goes into hibernate / suspended mode and therefore the users old credentials are still cached on the VM and the connection to the DB server fails.

The way to resolve this is to reboot the VM, but this is a huge pain in the butt when you have to get VNC access to a machine and run through the whole process of launching the VM and restarting it, so I made some scripts to make my life a bit easier.

Please note that you require administrator privileges on the remote system in order to execute these scripts. You could modify them to include username and password if required. The Virtual machine also needs to be running, so ask the user to open the app that is giving them issues and execute the deploy script. The user can then goto C:\scripts and run the resart-vm.bat file to restart the VM on their machine. This saves me a ton of time and I hope you find it useful.


Scripts list:

restart-vm.ps1	Powershell script that restarts the Virtual machine.
restart-vm.bat	Batch script to execute the powershell script.
deploy-restart-vm.bat	Script copies the files to the remote system C:\Scripts directory. Allows input of host name.

restart-vm.ps1
$vpc = New-Object -ComObject "virtualpc.application" 
$vm = $vpc.FindVirtualMachine("Windows XP Mode") 
$vm.GuestOS.ShutDown("true")

restart-vm.bat:
powershell -ExecutionPolicy ByPass -File C:\Scripts\restart-vm.ps1

deploy-restart-vm.bat:
@echo off
cls
echo.
echo Deploy shutdown-vm script to remote host.
echo -----------------------------------------
echo.
set /p host="Please enter host name: "
cls

echo.
echo Deploy shutdown-vm script to remote host.
echo -----------------------------------------
echo remote host: %host%
echo.
echo.
echo Making directory on remote machine
echo.
md \\%host%\c$\scripts
echo.
echo Copying files to remote host
echo.
xcopy /Y C:\Scripts\Deploy\restart-vm\restart-vm.* \\%host%\c$\scripts
echo.
pause

Backup and Compress SQL Server Express Backup

I have multiple MS SQL express servers that I need to manage and backup and I have found that the backups can get quite large, so I looked into methods of compressing the backups. I found that there is a builtin method in SQL server, but this is only for a licensed copy of SQL server, not for the express edition. So being the hacker that I am I decided to do it myself with some scripting and 7zip.

This is the process:

• backup SQL server DB.
• compress backup file with 7zip. (7zip website)
• rename the file and copy it to a backup location.
• send an email notification that the backup completed using blat.

It sounds simple right? Well it can be a bit difficult to tie it all together so here are some scripts that I have used to achieve this.

1. Create backup device
• Open SQL server management studio
• Expand Server Objects
• Right Click Backup Devices
• Click new backup device
  
• Give the device a name (you need this for the batch script so try excluding spaces) and give it a backup path. I prefer using another disk and a simple path, something like D:\backups\db-backup.bak
  
  
2. Backup Database Script
• The backup batch script should look something like below, just substitute the databasename to the name of the database you are backing up and backup-location to the name of the backup device you specified above.
  
  sqlcmd -S localhost\databasename -E -Q "BACKUP DATABASE [databasename] TO [backup-location]"
  
  IF NOT EXIST "D:\backup\db-backup.bak"
      set subject=Backup error : SQL Backup failed
      set body=SQL Backup failed. %date% %time%
      GOTO SENDMSG
3. Compress the backup file using 7zip and rename file
• Again update the script below accordingly. Remember the 7zip directory needs to have no spaces otherwise the script does not work.
  
  set zipdir=C:\progra~1\7-Zip
  %zipdir%\7z.exe a "D:\backup\db-backup.bak" "D:\backup\db-backup-%date:~0,4%%date:~5,2%%date:~8,2%.7z"
  
  IF NOT EXIST "D:\backup\db-backup-%date:~0,4%%date:~5,2%%date:~8,2%.7z"
      set subject=Backup error : 7zip failed
      set body=7zip operation failed. %date% %time% 
      GOTO SENDMSG
4. Copy the file to a remote location
• This is pretty simple again just update the script as per you needs
  
  xcopy "D:\backup\db-backup-%date:~0,4%%date:~5,2%%date:~8,2%.7z" "\\backupserver\folder" /s /d
  
  IF EXIST "\\backupserver\folder\db-backup-%date:~0,4%%date:~5,2%%date:~8,2%.7z"
      set subject=Backup successful
      set body=Backup successful. %date% %time%
      GOTO SENDMSG
5. Send email message
• This function requires BLAT, just download blat and copy it to a directory something like C:\blat. It s a great command line app that I have used before for sending mails from some PHP scripts.
  
  set blatlocation=C:\blat
  set smtpserver=mail.myserver.com
  REM add addresses separated by commas
  set toaddress=address@myserver.com
  set fromaddress=address@myserver.com
  set appname=SQL Backup App
  
  :SENDMSG
  %blatlocation%\blat.exe -to %toaddress% -i "%appname%" -server %smtpserver% -f %fromaddress% -subject "%appname% : %subject%" -body "%body%"
  GOTO END

Remote Administration Using PSTools

PSTools is one of the most useful suites of applications out there for a network administrator. The toolkit consists of several command line applications that allow you to perform remote administrative functions such as interrogate processes and services. Below is a list of my favorite tools and how I use them on a daily basis. Please note that you require administrative privileges on the remote system to be able to use these tools.

pslist 

pslist allows you to get a list of the running processes on a remote system. I use this to see if users are running a particular process that I want to kill on their machine or not. It can be useful to troubleshoot certain issues or just determine if a user is running a specific application on their machine.

pslist examples

get a list of all the process on the machine:

pslist \\computername

get a list of all the processes starting with i

pslist \\computername i

pskill 

pskill allows you to kill a process on a remote machine. This is particularly useful if you have a user who is running an application that they shouldn't and you want to shut it down remotely without them noticing it was you or if there is a non-responsive app on a remote computer for instance I have found that adobe acrobat reader often leaves instances running in the background and consumes user resources.

pskill examples

Kill iTunes on the remote computer

pskill \\computername itunes.exe

psexec 

psexec allows you to remotely execute an application on a machine. This is useful to run remote scripted installs.

psexec examples

Open notepad on the remote computer (may not be visible to logged on user)

psexec \\computername notepad.exe

Copy the batch file to the remote computer and execute it. Batch file will map a network drive and call an installer.

psexec \\computername -C remote_install.bat

psloggedon

psloggedon gives you a list of all the users logged onto a remote computer. This is a great way to tell who is loggedon to a machine so you can phone them up and ask them why they are running a game you just noticed using pslist.

psloggedon exampled

Get a list of users logged on to a remote computer

psloggedon \\computername

Download PSTools Here

SPAM fighting with RBL’s

Our companies email server had been taking a bit of strain from SPAM recently and it seemed as though thousands of spam mails where getting through to my end users.

Scanmail for Exchange was picking up about 57000 SPAM mails a month, but I would still get about 200 spam mails a day in my own inbox!

I did some research and eventually found RBL (Real Time Blacklists). A RBL is a list of known spam email servers IP addresses. There are several RBL providers out there and it is very simple and in most cases free to setup.

Check out the following link to get your Exchange 2003 server setup with a RBL:

• http://www.spamblogging.com/archives/000138.html

I am currently using the the following RBL’s

• spamcop.net
• spamhaus.org

Since implementing the RBL I have seen spam on my own inbox drop from 200 a day to about 2 a day. I also noted that since the beginning of the month the number of SPAM is down from 57000 detected to 6500! And I should see an even greater drop next month as I implemented the RBL on about the 10th of the month!

South African Bank Phishing

It seems as though some of our local South African banks are starting to fall foul of the phishers of late. It is a good time to keep your users informed and keep your proxy servers block list up to date with any new evil domains.

Here ore some examples of phishing emails I got from a user.

ABSA PHISHING EMAIL 1:

Url at the bottom takes user to a spoofed website that looks like an absa logon page:

Dear Customer,

We,upgrades its internet security on a continuing basis to ensure that our customers are protected. Protecting information is a shared responsibility and we request you to exercise caution at all times when using online services or accessing your emails.

Due to the open nature of the internet, Absa cannot guarantee the complete security of your transactions from hacking, unauthorized access, virus attacks, and /or other 3rd party attempts to breach our latest security features that we have used. All Online banking users are required to adhere strictly to this warning and follow up the process of this adjustments. Absa will not be responsible for loss of funds to online phishers as a result of failure to comply with this important new directives

Register your online banking access, click continue below and follow the instructions so you don't stand a chance of lossing your details to a third party.

http://www.absa.co.za/ib.jsp/Administrator
Administrator
Absa Bank Limited

Please do not reply to this e-mail. Mail sent to this address cannot be answered.
For assistance, log in to your absa Online account and choose the "Help" link on any page.
absa bank Email ID # 1009

ABSA PHISHING 2:

The link from this mail seemed to be broken at the time of publishing.

Dear Customer,

The internet has become widely accepted for banking online. While we have taken all the possible measures to ensure security and confidentiality of our online banking systems, you play an important role in protecting your personal information and Passwords. You have to protect your information at all times, be it over the internet or during your normal banking activities.

Due to the open nature of the internet, Absa cannot guarantee the complete security of your transactions from hacking, unauthorized access, virus attacks, and /or other 3rd party attempts to breach our latest security features that we have used.

To Upgrade for this comprehensive security features,click below and follow the instructions

http://www.absa.co.za/security/features
Management
Absa Bank Group

Please do not reply to this e-mail. Mail sent to this address cannot be answered.
For assistance, log in to your absa Online account and choose the "Help" link on any page.
absa bank Email ID # 1009

FNB PHISHING 1

At the time of publishing the domain name that the link in the email takes the user to seems to have been disabled or broken.

Dear FNB Customer,

In the last fews weeks, our Online Banking Security team has observed multiple logon attempts on your internet banking account from different blacklisted IP's.

For your safety we have decided to suspend your access. You will need to verify your identity.

Click Here to continue

Security Management
First National Bank

Please do not reply to this e-mail. Mail sent to this address cannot be answered.
For assistance, log in to your fnb Online account and choose the "Help" link on any page.
fnb bank Email ID # 1009

SPAM: Server Upgrade

I have been alerted to a couple of users who are receiving spam that contains links to external websites. the message is as follows:

Attention!

On October 16, 2009 server upgrade will take place. Due to this the system may be offline for approximately half an hour.

The changes will concern security, reliability and performance of mail service and the system as a whole.

For compatibility of your browsers and mail clients with upgraded server software you should run SSl certificates update procedure.

This procedure is quite simple. All you have to do is just to click the link provided, to save the patch file and then to run it from your computer location. That's all.

http://updates.<your domain>.<various>/ssl/id=73616375-<email>-patch2844683.aspx

Thank you in advance for your attention to this matter and sorry for possible inconveniences.

System Administrator

I have noticed the following domain names being used so far which I have blocked on my proxy server:

*.admin-db.net
*.1ssl-certs.com

According to: http://www.dshield.org/diary.html?storyid=7333

The link leads the user to a download which disables AV and has Trojan / key logger characteristics.

Once again the URL contains the users email address so the site will probably log the entry to a db for future spamming.

I would suggest that you add all the domain names that you encounter in these messages to your proxy blocked list to prevent users from giving their email addresses away for future attacks.

tax-statement-taxpayer_id*.exe

There are some fake IRS spam mails circulating at the moment that go to a page and try to get you to download a virus file which trend micro office scan picks up as TROJ_ZBOT.CBY.

I am particularly worried about this email as it seems as though the URL contains the email address of the user it was sent to. This will then allow the owner of the site to log valid email addresses when someone clicks on the link in the email. They don't even need to download the file to now be a bigger target for spam.

Solution: I also noticed that there are multiple domains that users are being redirected to so I decided to block *.irs.gov.*.com on our Proxy server to prevent users getting themselves on a spam list.

I found the following domain names in this type of attack so far:

*.irs.gov.y11dera.com

*.irs.gov.fedas1am.com

*.irs.gov.fedasaz.com

*.irs.gov.y11derq.com

Screenshot of the website you get redirected to when you click on the link in the emails.

AutoRuns

Ever wondered why your computer is taking forever to start up? Well then AutoRuns is for you! This is the most comprehensive application that I have seen for killing automatic processes. I think I am going to be using AutoRuns a lot in future! I love sysinternals!

Sending Emails From CMD

I was recently asked to write a script to check if a file exists and then email someone if the file is found. I found this program called Blat. Blat is a command line email client. basically all I did to get it working was download and copy blat.exe and blat.dll to %SystemRoot%\System32.

Check the code below:

@ECHO OFF
REM ### CONFiGuRE SETTINGS HERE ################
set SMTPServer=127.0.0.1
set ToAddress=email@mydoamin.com
set fromAddress=email@mydomain.com
set Servername=My Server Name
set find="C:\myfile.txt"
REM #####################################
IF EXIST %find% (goto senderror)
goto end

:senderror
set Subject=File Found
set MessageBody=%ServerName% -File Found. (%Date%)
%SystemRoot%\System32\blat.exe -server %SMTPServer% -f %fromAddress% -to %ToAddress% -subject "%ServerName% - %Subject%" -body "%MessageBody%"
goto end

:end
@ECHO ON

Google Chrome OS

Google announced Google Chrome OS recently. It seems as though Google is again pushing cloud computing. The net-book revolution is the next thing in computers with all the major players starting to take notice. Ever since the Asus EEPC was launched a while back people have begun to sit up and notice. Intel is currently also in the race as they have started developing an operating system specifically for net-books.

I do think that Google once again has the advantage as they are the ones who have all the cloud applications already. With Gmail, Google Docs, Calendar and more already pretty stable they are more than ready to give the world a taste of cloud computing. And now with the announcement of their own net-book OS that comes with Google Chrome they will be able to run all of their applications in a browser specifically designed to run those applications as fast as possible.

I can’t wait to see what they come up with.

Windows Vista SP2

Today I accidentally found out that Windows Vista SP2 has been released! I was going through my WSUS server and noticed that my machine had a lot of updates outstanding. I then say an entry that said: "Windows Vista Serivce Pack 2 Standalone (KB948465)- English, French, German, Japanse, Spanish"

Well it looks like SP2 was released about 2 weeks ago according to this KB Article.

http://support.microsoft.com/kb/948465

Anyway I am waiting for my WSUS server to download it so I can install!

Microsoft Doing it Again with Windows 7?

It looks as though our dear friends at Microsoft are not learning from thier mistakes.

http://www.engadget.com/2009/02/03/windows-7-skus-announced-yes-your-worst-nightmare-has-come-to/2

According to this article Windows 7 is expected to come in 7 different flavours! ARG !

I wish these guys would catch a wakeup and stick to the good old days of single desktop and server OS releases instead of making life so confusing with 7 versions!

Come on Microsoft catch the hint, no-one wants 7 choices for something as boring as an operating system. Why do you think Linux has been struggeling for so many years?

Recession to fuel Open Source?

With the world economies in a bit of a downward spiral, the demand for Open Source techologies should increase dramatically. Business should soon start to see the value in migrating certain systems to opensource. I have a hard tim justifying Microsoft Office licences when there are freely available alternatives. The only cost a business may incure is some training costs to migrate the users over to the new package. This however should quite easily be justified as it means a lifetime of free and open source as opposed to the pain of being forced to upgrade systems at huge expense every couple of years.

I still think that most businesses will however need to stick with Windows as an OS, but office applications and others can be migrated to Open Office.

Bulk Modify Active Directory Users Accounts

Basically my friend upgraded his old server and migrated active directory to the new server. Active directory pointed their profile paths to the server name or IP address of the old server. So he needed to be able to modify all his users profile paths so that they pointed to the new server. He could do it one at a time, but after doing a couple of hundred I am sure he would have gone insane!

I found this tool: ADModify.net

Snippet from their website:

"ADModify.NET is a tool primarily utilized by Exchange and Active Directory administrators to facilitate bulk user attribute modifications."

This tool is awesome! It does exactly what is says it does! It allows you to bulk edit active directory user accounts. You can bulk modify almost any setting in an AD user account using this tool! I am definitely going to keep this one for future, it makes life so much easier!

Google Forms

I recently noticed that Google Docs has a new feature called Google Forms. It seems to be a pretty cool feature that allows you to create online forms that can be emended in just about any blog, web page or emailed. When a person fills out the form the information gets saved into your Google Docs account. This lets you go through the results in a nice simple spreadsheet.

This is a very useful tool. Give it a try.

A Brief History of the Internet

I found this cool video on digg. It is a nice introduction to the history of the Internet.

History of the Internet from PICOL on Vimeo.

Welcome to the Cloud

It looks like cloud computing is going to be the next best thing!

There is a new OS called gOS (No it is not made by Google) that boots into a stripped down linux distro presenting the user with a browser. Effectivly with the massive increase in online apps users can now transfer all the processing and storage onto the "cloud" (web servers and web services on the internet). I think that we are going to see a lot more of this in future as it will reduce the cost of the end user device and increase online activity for service providers who will benefit from increased ad-revenue. I predict that this form of computing will slowly, but surely start taking over.

Anyway check out the slideshow below of gOS:

http://www.thinkgos.com/

http://en.wikipedia.org/wiki/Cloud_computing