Tech Tips for Network Administrators

Terminal Server Session in Multi-Monitor Setups (3/08)

Remote Desktop Connection supports high-resolution displays that can be spanned across multiple monitors. However, the total resolution on all monitors must be under 4096 x 2048 pixels. The monitors must have the same resolution and be aligned side-by-side.

To have the desktop of the remote computer span multiple monitors, type mstsc /span at a command prompt or the run box. The remote desktop address window will then pop up as usual, but once you connect the session it will span both monitors.

Dell Server Naming Conventions (2/08)

It breaks down like this:

1. First character is a letter: T, R, or M. T=Tower, R=Rack, M=Modular (blade)
2. Second character is the family of server and will be a number.
3. Third character is the generation. 0=10th generation
4. Last character is Intel or AMD. 0=Intel, 5=AMD

So for example, a R200 means that it’s a rack configured server, family type 2, 10th generation, with Intel processor.

Follow the Bouncing Email (1/08)

More often than not, you’ll get a very un-user friendly message, such as the one below:

Sometimes the format is a little friendlier, but still hard to interpret:

(Note: The bounce above - both examples - is caused by sending to an email address that does not exist.)

Whatever the tone of the notice, there are two major issues to consider:

Hard vs. Soft Errors

Another common non-delivery message is one that implies a delay in delivery rather than the email not delivered. Email servers have built in functionality to be somewhat self-correcting. A general rule of thumb if a user gets a message of this nature is to have them try to resend in an hour. If it does not get through, and it is possible to wait, try again the next day. If they still cannot get the message through, and it is still possible to wait, try again in one week. If it delays at that point, then the user should look at a different way to get the information to the recipient.

A hard bounce means the sender’s mail server could not send the email. An email falls into the hard bounce category when there is no such recipient, an inactive email address, or an invalid domain. The most common example of a hard bounce is when the recipient simply doesn’t exist. When a hard bounce occurs the sender needs to try something else since the mail system will not perform any re-sends as it will with a soft bounce.

Sender’s Problem or Recipient’s Problem?

Other non-delivery messages are a bit more vague. A very common message is “Unable to relay”. Even though there are multiple possible reasons for this type of message, we are seeing more and more of these due to anti-spam methodology being implemented by ISPs. These algorithms will perform “reverse lookups” of the address sending the email (that is, the mail system looks up the name attached to the sender’s IP address, and the checks the IP address if that name, and they must match or the email is rejected) or check to make sure the “From” address matches an account on the email server or require you to authenticate before sending the email (authentication requires that the sender submit to some sort of query or test before they are allowed to send email) . Some ISP’s will even require that emails come from a specific connection provided by that ISP. Generally, for this type of error, you would want to check your SMTP and relay settings if this is happening on more than one email. If everything checks out, you would need input from the recipient’s email provider on the reason for the relay error.

One final note is to be on the lookout for bounce messages that are not really bounced emails. This is when a user will report a non-delivery message for either a) an email they are sure they did not send or b) to an email address they know nothing about. These non-delivery messages are caused by a virus that has infected the PC of someone that has your user’s email address in their address book. The virus propagates itself by sending emails from the infected PC with the “From” address “spoofed” or disguised by substituting email addresses from the infected PC’s email address book. There will be an attachment with this type of message that contains the virus. This is when it is important to educate your users to NOT open attachments from any unknown source. If they get a non-delivery for an email they did not send or to someone they do not know they should immediately delete the message and NOT open any attachments.

Password Construction Schemes (12/07)

Password construction schemes are formulas that let you easily remember and change a password. For example, this could be the year you graduated from college (1985), your weight at that time (175), your then-girlfriend’s initials (CJD) and the current month and year (1207). Using this scheme your password would be:

1985175CJD1207 – this monthly rotation would be good for years.

Another example would be using the first letters of a sentence such as “I had a blast in Florida in 1992” followed by your age (35) and the current month (12):

IhabiFi19923512 - this monthly rotation would be good for years, also.

Note: depending on rules in place, you may also substitute special characters for letters (for example, @ for a) or encase the sentence in a special character such as “&” - yielding:

&Ih@biFi19923512&

Passwords are important and if you can get your staff using them in a responsible (and reliable) manner your overall network security will be much improved!

Outlook 2007 and SharePoint Services 3.0 – Sync Document Libraries (11/07)

Synching Document Libraries lets you access your SharePoint documents from Outlook and synchronize the version on your SharePoint site with your changes automatically. From Outlook, you can:

• Preview documents, along with information such as author, size, changed date, etc.
• Use Outlook to find information in your Document Libraries
• Access and edit your documents offline when necessary

To sync a Document Library:

• Navigate to the Document Library you’d like to sync
• Select Actions > Connect to Outlook
• Click “Yes” to add the library to Outlook.
• Check Outlook under “SharePoint Lists” – you will now see the Document Library!

If you’d like to upgrade to Outlook 2007 or start using SharePoint Services just let us know – email Sales@BEInetworks.com or call 703-528-8300 x2.

Daylight Savings Time, Fall Edition! (10/07)

We do suggest, however, that prior to November 4th, you have your end users complete two steps that will help ease any potential issues:

• Print copies of their calendars for November, December, and January. If a lot of calendar appointments were made beyond those months, you may want those printed out too.
• For calendar items, especially recurring appointments, change the subject line to include the date and time of the meeting. That way, if it is incorrect on the calendar, the users will know the subject information is the correct information.

Microsoft has two tools published which will help with the process of performing the upgrades if they were not done in February/March. The first is a wizard that helps guide you through which updates are needed. It can be found at http://support.microsoft.com/gp/cp_dst.

The second tool is a Knowledge Base Article on the DST changes, including recommendations which will help maximize the accuracy of the updates. This section alone is crucial to read. This article can be found at: http://support.microsoft.com/gp/dst_topissues.

If you have any questions or concerns about this process, please do not hesitate to contact our Service desk at 703-528-8300 x1 or service@beinetworks.com.

Compatibility with Office 2007 Documents (9/07)

We love Office 2007 but many of the people we communicate with (client, partners and vendors) are not using it yet. Additionally, remembering to save documents in the “old” format (.doc for 2003) doesn’t always happen or if it does we find that Office 2007 dramatically inflates the file size making it hard to email to others!

Another way to accommodate exchanging Office 2007 documents with users of Office 2000, XP or 2003 is to utilize the Office Compatibility Pack for Office 2007. This enables Office 2000, XP and 2003 users to open, edit, and save documents, workbooks, and presentations that have been saved in the file formats new to Microsoft Office Word, Excel, and PowerPoint 2007.

To download the Compatibility Pack:
http://www.microsoft.com/downloads/details.aspx?familyid=941b3470-3ae9-4aee-8f43-c6bb74cd1466

For more information about installing the Compatibility Pack go to http://support.microsoft.com/kb/924074.

Using Mailbox Manager (7/07)

There is no default policy that enforces age or size limits for messages. However, when you create the first policy, there are default limits of 30 days and 1,024 kilobytes (KB) applied to every folder in a mailbox. A message must exceed both limits before Mailbox Manager processes it. Under the default settings, a 500 Kb message will never be processed, regardless of how old it is.

Before running Mailbox Manager, start the mailbox management process on the server object in Exchange System Manager using the Mailbox Management tab of the Properties dialog box for the server object.



The action that occurs when Mailbox Manager processes a message depends on the setting that you select when creating the policy. By default, only a report is generated. No additional action is taken. In addition to the default setting, however, there are three other options for how Mailbox Manager processes messages that exceed the specified limits. The following table describes all four of these options.

You can use the same limits for every folder that the mailbox recipient policy applies to, or set custom limits on a folder-by-folder basis. Each folder must be configured individually if its limits differ from the default limits. For example, you may set a policy on the Deleted Items folder to remove everything older than 90 days regardless of size while at the same time removing every item from the Sent Items folder older than 180 days and larger than 50Kb.

Manage Printers - New Group Policy Features in Windows Server 2003 R2 (6/07)

• Update your Windows Server 2003 schema (Active Directory Definitions) to match the Windows Server 2003 R2 schema.
• Load the Print Management Component by going to Add/Remove Programs > Windows Components > Management and Monitoring tools and selecting Print Management Component.
• Deploy printers using Group Policies (based on Active Directory Groups, Organization Units (OU's) and/or Physical Sites)

For details on this process go to:
http://www.microsoft.com/technet/technetmag/issues/2006/08/ManagePrinters

Address List and EAP Filter Upgrades with Exchange Server 2007 (5/07)

Upgrading default, built-in objects (i.e. All Users) is much more straightforward than custom objects (i.e. InHouseSales.) This article addresses default, built-in objects.

There is only one default EAP – usually called “Default Policy” and it can be identified because it has the lowest priority. Any easy way to confirm that you need to upgrade this policy is to try and edit it using the Exchange 2007 GUI- you will get an error message if it is not compatible. This Exchange 2007 of this default EAP is:

Set-EmailAddressPolicy "Default Policy" –IncludedRecipients AllRecipients

For more details on Address List and EAP filter upgrades with Exchange Server 2007 refer to http://msexchangeteam.com/archive/2007/01/11/432158.aspx.

File Server Resource Management (FSRM) – Restrict File Types (4/07)

One interesting feature of FSRM is file screening. File screening checks the file extension and the policies that are in place and takes action based on the type of file and the pre-defined policies. With this you can you can perform the following tasks:

• Create file screens to control the types of files that users can save and send notifications when users attempt to save blocked files.
• Define file screening templates that can be easily applied to new volumes or folders and that can be used across an organization.
• Create file screening exceptions that extend the flexibility of the file screening rules.

An active file screen actually stops the banned file—in real time—from being written; a passive screen allows the writing of the file but will perform a particular action that has been defined. For a given file screen, the Network Administrator can define a comprehensive set of actions to be performed in the event of an offense. These actions include sending an email message to the user or administrator, creating an event log, creating a report that shows how a certain user is using disk space, or a custom action.

Sending an email is a big addition to the "Access Denied" message that a user receives when they try to store a file and permission is denied. Without an explanatory email, users often think there is an error and their next step is calling the Help Desk!

Templates can be created making it much easier to develop and implement File Screens. File Screens can also include exceptions – for example, perhaps a user cannot store music files unless they are in a specific folder (i.e. My Music.)

For more details: Get Control of File System Resources with Windows Server 2003 R2 http://www.microsoft.com/technet/technetmag/issues/2006/05/GetControl/default.aspx.

Note: if a user tries to get around the system by renaming a file with a different extension (for example, changing the file extension from .mp3 to .doc) they will be allowed to store the file. The purpose is to stop the accidental offender, not the serious infringer!

Security and Group Policies with Terminal Server or Citrix (3/07)

A common issue for network administrators is creating security policies that apply to users only when those users are in Terminal Server or Citrix sessions. Different security policies often apply when users are at their desktop in the office. Microsoft has created a Loopback Processing Policy that allows you to create individual GPO's (Group Policy Object) for Terminal Server or Citrix Server and assign the GPO's to security groups.

• Create an OU (Organizational Unit) and move all of your Terminal Servers to the OU
• Create a new GPO at the OU level
• Remove Authenticated Users from the Security Filter and add the Terminal servers to this GPO
• Edit the Policy with only one setting: Computer Configuration>Administrative Templates>System >Group Policy>User Group Policy loopback processing mode
• Enable this policy and select MODE - Replace
• Create additional GPO's at the OU level and assign them to the proper security groups (user security groups or individual users)

Note: Remember if you keep Authenticated Users in the security filter, the policy will apply to the administrator account as well.

Daylight Savings Time – Watch out for 2007! (2/07)

As you may already know, starting in 2007 Daylight Saving Time (DST) was extended by approximately four weeks. In compliance with this provision, Daylight Savings Time dates in the United States and Canada will start three weeks earlier (2:00 A.M. on the second Sunday in March) and will end one week later (2:00 A.M. on the first Sunday in November).

(Just as a note, in 2008, Daylight Savings Time begins on March 9 and ends on November 2. In 2009, Daylight Savings Time begins on March 8 and ends on November 1.)

Unfortunately, existing Microsoft server and workstation operating systems and calendaring applications only know about the former DST dates. Therefore, without updates and corrections to your servers and workstations/laptops, any calendar items that fall within the new portion of the DST window will be off by 1 hour. In order to update your computers and servers to accommodate this change, Microsoft has released a series of patches and tools to make these adjustments.

The process involves:

• Updating the Windows Operating System on the server fully
• Updating Exchange fully
• Updating the Windows Operating System on all workstations and laptops
• Correcting existing calendar items in the affected date range

It would be to everyone's benefit if the first three steps of the process happen as soon as possible. Any Outlook calendar items entered after the workstations/laptops are updated will correctly adjust for the new DST. The amount of time these updates will take will depend on the number of workstations/laptops involved and the number of servers involved. In addition, the server and Exchange must be FULLY updated, which includes Service Packs. If you need Service Packs installed first, this could increase the time to perform these actions by several hours (for instance, the Exchange updates to go to Service Pack 2 could take around two full hours alone.)

To correct existing calendar items or calendar items entered before steps 1-3 are performed, Microsoft has released two separate tools, one to run on your Exchange server and one to run on each workstation/laptop. The process involves running one or the other as there are pros and cons with each option. We can discuss these options with you further. Please contact the BEI office at mailto:service@beinetworks.com or 703-528-8300, option 1 if you would have any questions about the Daylight Savings Time issue.

Clear Outlook Name Cache - Part 2 (1/07)

• Type a couple of letters of the name you are looking for.
• When the list comes up use the down arrow key to get to the name you want to delete and press the delete key.
• Restart Outlook and check that the name is gone.

Clear Outlook Name Cache (12/06)

• To fix this, close Outlook and open up Windows Explorer.
• Select Tools > Folder Options and click on the View tab.
• Select Advanced View and select the boxes next to Show Hidden Files and Folders.
• Open up the Search applet by clicking Start > Search and select All files and folders then search for *.NK2 files. There will be a NK2 file for each Outlook profile on the computer and it will be named profilename.NK2.
• Rename the file to profilename.bak or delete the file.
• When you open up Outlook, it will create a new NK2 file and start a new nickname list.

Remotely Enable Remote Desktop (11/06)

• Attach to remote registry via regedit
• Browse to key HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server
• Modify the REG_DWORD value named fDenyTSConnection (1=enabled, 2=disabled)
• Reboot the remote machine with the shutdown command from a DOS prompt: shutdown -m \\machinename –r (the r switch will reboot the machine)
• Once the machine reboots, connect to it via RDP

"Old" Versions of Software (10/06)

MSCONFIG (9/06)

To run MS CONFIG:

• Start > Run
• Enter "MSCONFIG"
• OK

Process Explorer Utility (10/06)

SysInternals offers the Process Explorer utility, a great tool that provides detailed information about processes running on a system. The utility is available from http://www.sysinternals.com/Utilities/ProcessExplorer.html Once downloaded, extract SysInternals to a folder of your choice. Run the procexp.exe image and a default view will open showing all the processes running on the system. Selecting "Show Lower Pane" from the view menu lets you view detailed information about the selected process, such as open files, registry keys, or threads.

Is Your Hardware Ready for Microsoft Vista? (6/06)

Vista Premium includes additional features, including Windows Aero, the new user interface that includes glass-like elements so you can actually see through windows on the screen, live taskbar thumbnails, and the ability to quickly flip through a series of windows. The table below summarizes the hardware requirements. For more details see http://www.microsoft.com/windowsvista/getready/capable.mspx.

Note that a system meeting the minimum system requirements will be able to run just the core features of Windows Vista with the basic user experience. Higher-end features available in specific premium editions of Windows Vista, such as the Aero user interface and the ability to watch and record live TV, may require additional hardware such as is listed in the Vista Premium Requirements.

To determine whether or not your current PC will run Windows Vista, go to http://www.microsoft.com/windowsvista/getready/upgradeadvisor/default.mspx and run the Windows Vista Upgrade Advisor.

Some of us at BEI have been testing the Vista operating system and the soon-to-be-released 2007 Office (both of which are available as a Beta 2 programs.) In upcoming newsletters we'll give you some feedback about what we're finding in these two major product releases from Microsoft.

Enabling "Send As" Functionality for a User in Microsoft Exchange Server (5/06)

• Start the Exchange version of Active Directory Users and Computers (Start> Programs> Microsoft Exchange > Active Directory Users and Computers)
• From the View menu, select Advanced Features
• Right-click the user who wants to let other people send messages on his or her behalf and select Properties
• Select the Security tab
• Click Advanced
• Select the Permissions tab and click Add
• Enter the users who require the Send As permission, then click OK
• The list of permissions will be displayed, select the appropriate permissions
• Click OK to the Advanced security dialog box, and click OK to the User Properties window

Note: You can also grant users a "send on behalf of" ability so that the receiver of a message will see the message is from on behalf of the person who wanted the message sent.

Using Distribution Lists in Outlook (5/06)

To use names in your address book to develop a distribution list:

• File > New > Distribution List
• In the Name box, type a name for the list
• Select Members (or Add New if they are not already in your Contacts)
• Select the address book that contains the e-mail addresses you want in your distribution list – you can use more than one if you need to
• In the Type Name or Select from List box, type a name you want to include. In the list below, select the name, and then select Members. Do this for each person you want to add to the distribution list, and then select OK

To take a distribution list from names in an email:

• In the e-mail message you want to copy the names from, select the names in the To or Cc
• Edit > Copy File > New > Distribution List
• In the Name box, type a name for the distribution list
• Select Select Members In Add to Distribution List, right-click, and then select Paste on the shortcut menu

To send to only part of a distribution list:

• You'll notice that after you have selected the distribution list the list will show up with a small "plus" sign just to the right of the name
• Selecting the plus sign will expand the list so that all the names are shown.
• Delete the names you don't want, and you are all set
• Note: once you have expanded a distribution list you can not undo this action

Use Flags to Organize Your Inbox (4/06)

To make the flag column visible:

• On the VIEW menu, select ARRANGE BY, the CURRENT VIEW, and then click CUSTOMIZE CURRENT VIEW.
• Select OTHER SETTINGS.
• Under OTHER OPTIONS, select the SHOW QUICK FLAG column check box.
• Once your emails are coded with flags, you can use search folders to easily view all the emails in a given category.

For details on search folders, see an article in our June '05 Newsletter http://www.beinetworks.com/pubs/beinetworks/Tech_Tips_for_End_.cfm#EU6.05.

Hiding Files and Folders: Access-Based Enumeration (4/06)

Until Windows Server SP1 and R2, it has not been possible to hide shared files/folders from users who do not have permission to view them. So, even though you might only be allowed to see your home folder and the Marketing folder, you'll still see all the other users' folders, and the Accounting folder, the Engineering folder, and so on. Some of us might say who cares! But – it is both a security issue (sometimes you really don't want people to know that certain information exists) and a usability issue (it can be just plain confusing to see all those folders.)

The code to hide the files/folders is in SP1 and R2 but must be turned on – you can download this tool from Microsoft.

For more details on this feature go to: http://www.microsoft.com/windowsserver2003/techinfo/overview/abe.mspx, or give us a call and we'd be glad help you to set it up.

Exchange Database Defrag When Local Space is an Issue (3/06)

If you are running out of space for your Exchange database and need to run a defragmentation, things get even tougher if you don't have enough local space to run the defrag (the defrag process requires some free space to store temporary files and such while it's working). You can use the /t switch with the Exchange Eseutil utility to specify a local or remote location as the temporary folder to be used for the database to be defragmented. Using a remote location might slow down the process, but still might be the best choice.

In the example below, the X drive is specified, which maps to a network path (or you can use a UNC path), and a temporary file name for the database.

C:\Program Files\Exchsrvr\bin>eseutil /d "c:\program files\exchsrvr\mdbdata\priv1.edb" /tx:\tempdfrg.edb

Windows Print Migrator (2/06)

Accessibility Options Can Tailor the End-User Experience (1/06)

Accessibility Options (Start > Control Panel > Accessibility Options) are intended to accommodate users with different levels of physical capabilities. Many of these options can be useful in a variety of situations. Some examples are given below:

• Typists who inadvertently turn caps lock or num lock on:
• Start > Control Panel > Accessibility Options > Keyboard> Select Use ToggleKeys.
• This will result in an audible tone each time Caps Lock, Num Lock or Scroll Lock are turned on.
• Anyone who needs visual reinforcement
• Start > Control Panel > Accessibility Options > Sound > Select Use Sound Sentry when you want a visual notification of sounds
• Start > Control Panel > Accessibility Options > Sound> Select Use ShowSounds when you want your computer to display captions for speech and sound
• Anyone who needs audible reinforcement
• Start > Control Panel > Accessibility Options > Display> Select Use High Contrast (clicking Settings will give you a wide range of contrast options)

Exploring the Accessibility Options will yield many other methods of customization that may be useful to your users.

Using the Windows Key (11/05)

Using the “Whoami” Command (10/05)

Whoami can be used with various operators to determine what information is returned. For example,

Whoami      Identifies the user as well as their domain (BASEDOMAIN\Domain Users)

Whoami /groups      Identifies group membership for the current account such as:

[Group 1] = "BASEDOMAIN\Domain Users"
[Group 2] = "Everyone"
[Group 3] = "BUILTIN\Users"
[Group 4] = "BUILTIN\Administrators"
[Group 5] = "NT AUTHORITY\INTERACTIVE"
[Group 6] = "NT AUTHORITY\Authenticated Users"
[Group 7] = "LOCAL" [Group 8] = "BASEDOMAIN\Domain Admins"

Whoami /help Provides a list of available command options

Common Veritas Exec Backup Failures and their Solutions (9/05)

Directory not found

Backup - \\severname\Microsoft Exchange Mailboxes
Directory not found. Can not backup directory Username [user loginname] and its subdirectories.

This is often caused by a disabled user account.  When you disable a user the backup software is unable to access the user’s mailbox.  There are a few ways to clear this error:

Open Files

• Simply exclude these files from the backup job.  This should only be done if the loss of .pst files and their contents is not critical to the operation of your business. 
• Make sure all .pst files are closed during the backup window.  User education is the most basic way to accomplish this, e.g. “Please make sure Outlook is closed when you leave for the day.” 
• There are more advanced methods to close these files but their implementation and ramifications are outside the scope of this article. 

Corrupt Mail

There are two approaches to resolving this problem:

• Delete the corrupt mail from the Information Store. 
• Configure BackupExec so that it doesn’t consider corrupt mail to be a failure. 
  

Restore a Lost Show Desktop Icon (8/05)

ADVERTISEMENT [Shell]
Command=2
IconFile=explorer.exe,3
[Taskbar]
Command=ToggleDesktop

Save the file with the name Show Desktop.scf in the folder C:\Documents and Settings\username\Application Data\ Microsoft\Internet Explorer\Quick Launch, where username is replaced by your actual user account name. The desktop icon will reappear on your Quick Launch Toolbar.

Open a Command Prompt Window via Internet Explorer (7/05)

• Go to: http://www.microsoft.com/downloads/details.aspx?FamilyID=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en and select DOWNLOAD.
• Double click on rktools.exe to setup the Resource Kit.  Follow the setup wizard instructions.
• Go to Program Files>Windows Resource Kits>Tools and right click on cmdhere.inf.
• Select INSTALL
• Now you can right click on any folder while uising Internet Explorer and there will the an item on the shortcut menu called CMD Prompt Here.

Connecting Two Computers Using a Cross-over Cable (6/05)

• Find the computer name, administrator and password for each computer
• On each computer do the following:
• Right click on MY NETWORK PLACES and select PROPERTIES
• Right click on LOCAL AREA CONNECTION (On-Board network card NOT the Wireless NIC) and select PROPERTIES
• Highlight INTERNET PROTOCOL (TCP/IP) and click on PROPERTIES
• Select USE THE FOLLOWING IP ADDRESS
• Enter 192.168.1.1 as the IP address on Computer #1
• Enter 192.168.1.2as the IP address on Computer #2
• Both should have 255.255.255.0 as the SUBNET MASK (leave the default gateway blank)
• Select OK
• Select OK
• Close out the Network Connections window
• Using a cross-over Ethernet patch cable connect the RJ-45 jack on the network card of Computer #1 to the RJ-45 jack on the network card of Computer #2. A cross-over cable is a special Ethernet cable with one of its two RJ-45 connectors wired differently than normal just so that it can be used for this purpose. Make sure you have a cross-over patch cable and not just a standard patch cable.
• On Computer #1: Select START
• Select RUN
• Enter this string in the open dialog box: \\192.168.1.2\c$ (assuming you are attaching to the C drive on the computer)
• This will bring up the username and password dialog box. Enter the information in this format: Logon name – ComputerName\Administrator (*Administrator being the username that has admin rights)
• Password – password
• The Explorer Window will open with the C drive of the other computer
• You will now be able to copy files from one computer to the other

Adding a New User in Microsoft Small Business Server 2003 (5/05)

• Logon to the server as an Administrator
• Navigate to START, PROGRAMS, ADMINISTRATIVE TOOLS
• Select SERVER MANAGEMENT
• Select USERS
• Select ADD A USER, then NEXT
• Enter the required information (the logon name can be changed to the desired name), then NEXT
• Enter the password (remember to select whether or not the user can change the password), then NEXT
• Select the proper template (normal users will only require the USER TEMPLATE), then NEXT
• Select DO NOT SETUP A COMPUTER, then NEXT
• Select FINISH
• The new user can now logon

How to Synchronize Network Time with National Time Standard (4/05)

Windows Time Service uses the Network Time Protocol (NTP) to help synchronize time across a network. NTP is more accurate than the Simple Network Time Protocol (SNTP) that is used in older versions of Windows.  W32Time is the Windows Time Synchronization service that uses the internet to connect to a reliable time source.  W32Time continues to support SNTP to enable backward compatibility with computers running SNTP-based time services, such as Windows 2000.  A network can be synchronized with an internal or external time source – the National Institute of Science and Technology (NIST) maintains time servers that are available for synchronization.

To set the W32Time to use the NIST time service for synchronization on Windows Server 2000:

On the primary domain controller, stop W32Time:

• Open a command prompt
• Type "net stop w32time"
• Configure the server to sync with an outside time source:
• Type "net time /setsntp:time-a.nist.gov". This sets the machine to automatically sync with the time server listed after /setsntp:.

To confirm synchronization:

• Type "w32tm -once -test -v" This will test synchronization against the NIST time server and display extensive output.

To complete synchronization:

• Type "w32tm -s".
• Successful synchronization results in a response that looks something like "RPC to local server returned 0x6b5".
• A response of "RPC to local server returned 0x0" means that synchronization was NOT successful; this usually happens if you run the command while the w32time service is running.

To restart the W32time service:

• Type "net start w32time".
• Once you start the service, the clock should automatically sync with the time server you have selected. You should not have to worry about any other doing anything for any other servers or PC’s/workstations, as they should automatically sync their clocks with the primary domain controller.

To set the W32Time to use the NIST time service for synchronization on Windows Server 2003:

• Click Start, and then click Command Prompt
• In the Command Prompt window, type “w32tm /config /manualpeerlist: peers /syncfromflags:MANUAL”, where peers is a comma-separated list of IP addresses of the appropriate time sources, and press ENTER. 
• The time sources you choose depend on your time zone. For example, if your domain controller is located in the Pacific Time zone, this line might read: w32tm /config /manualpeerlist: 129.6.15.28 /syncfromflags:MANUAL
• In this example, the IP address of the timeserver is used instead of the fully qualified domain name for security purposes.
• Press ENTER. You should get a message that the command completed successfully.
• Type w32tm /config /update
• Press ENTER. You should get a message that the command completed successfully.
• W32time uses a variable poll interval based on the quality of timesync with the server. On Domain Controllers, this interval defaults to between 64 and 1024 seconds.
• To immediately synchronize with the external time server, type w32tm /resync and press ENTER. You should get a message that the command completed successfully.
• Type Exit and press ENTER.

For more information on Windows Time Service and Network Clock Synchronization, see:

- A List of the Simple Network Time Protocol Time Servers That Are Available on the Internet
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q262680

- Synchronizing Your Computer Clock
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/windows_date_it_overview.mspx

- Set Your Computer Clock Via the Internet - NIST Internet Time Service (ITS)
http://www.boulder.nist.gov/timefreq/service/its.htm

Upgrading to Windows XP - Conversion Table(3/05)

How to Mark USB Storage Devices as Read-Only (Windows XP only)

**Important! This procedure involves editing the registry.  Before you modify the registry, back up the registry and make sure that you understand how to restore the registry if a problem occurs. For additional information about backing up and restoring the registry, view the following article in the Microsoft Knowledge Base:

How to back up, edit, and restore the registry in Windows XP and Windows Server 2003: http://support.microsoft.com/kb/322756

Windows XP Service Pack 2 (SP2) introduces a new registry subkey which provides the ability to set a registry key that will prevent write operations to USB block storage devices, such as memory sticks and USB hard drives. When this registry key is enabled, the USB devices function only as read-only devices. You can implement this setting as part of a security strategy to prevent users from transporting data offsite using these devices.

To enable the USB write protection, perform the following steps on the machine you want to implement this on:

• Start the registry editor (regedit.exe).
• Navigate to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies subkey. (You must create the StorageDevicePolicies subkey if it does not exist.)
• From the Edit menu, select New-->DWORD Value.
• Type the name WriteProtect and press Enter.
• Double-click the new value and set it to 1 then click OK.
• Close the registry editor.
• Restart the computer

To disable this change, you can either set WriteProtect to 0 or delete the DWORD value you just created.