The Network Technician » Windows

Delegating Password Resets – Windows Server 2008

The Network Technician — Wed, 04 Aug 2010 17:45:53 +0000

Is your IT staff dwindling? You must be used to the fact that you have many tasks to fulfill throughout the work day. Some of the most common tasks that should not take up our precious time are associated with account lockouts and passwords in Active Directory. Luckily, you can delegate user account resets/lockouts to help desk users. Doing so will allow us, systems administrators, to perform the more crucial day-to-day workload.

In Windows Server 2008, this is done through the Active Directory Users and Computers console. It’s quite an easy task. Before we begin, I recommend you have a group with your help desk users in it. It can be easily named “Help Desk”. Best practices are to manage permissions to groups rather to individual users. You’ll thank me later.

Open Active Directory Users & Computers, expand your domain
Right click on the OU you want to delegate and select “Delegate Control”
In the Users & Groups window Add the group you want to give delegation to and click next
In the Tasks to Delegate window check the box for “Reset user passwords and force password change at next logon” and click Next
Review changes and click Finish
Review the OU permissions to ensure that the delegation process has completed. Right click on the OU you changed for delegation, and select Properties.
In the Properties window click on the Security tab. **If Security tab does not show you must enable Advanced Features in the View Menu**. From the Security tab click on the Advanced button.
In the Advanced Security Settings window ensure that the delegated group shows in the list
Click on the first entry for the group and click Edit. View the permissions entry to ensure the correct permissions are there.
Close the window and select a user or computer within the OU. Right click on the object and click on Properties and click on the Security tab. Check to see if the delegated group is in the list. This confirms Inheritance is enabled for the OU.

That is all you have to do to delegate user password resets for an individual OU. You can also apply that for the whole domain if needed.

Are you delegating password control to your help desk users?

Windows Police Pro – How To Remove From Windows

The Network Technician — Fri, 25 Sep 2009 08:41:12 +0000

There’s nothing like frustrating over removing malware from a Windows PC. This blog post will give you directions, although time consuming, on how to remove Windows Police Pro. Below are four different thumbnails of what Windows Police Pro looks like.

Windows Police Pro masks itself as an anti-virus or malware remover application. It’s neither and it’s quite the opposite. It’s a malicious rootkit that will install itself to Windows and will take over your screen and resources. Windows Police Pro makes your computer inoperable. So how do you remove Windows Police Pro if your computer is inoperable?

I recommend:

Using another PC to download removal tools
A thumb drive
Back up your documents

The one question I get from a lot of people is “How did it get on there in the first place?” and I can’t answer that question. You can get it from malicious websites or from plugging someone elses infected thumb drive into your pc.

All these steps should be done while disconnected from the Internet. Disable your LAN and Wireless connections.

This is only a guide to removing malware from a computer. I am in no way responsible for any hardware/software complications or loss of data.

First Step

First things first. You need to purchase an anti-virus program. You either did not have one before, were using a free one, or your current one expired/out-dated. Either way, it slipped passed your defenses. Here are some recommendations for anti-virus:

Choose only one and download the installer to your thumb drive. Download the current updates as well to your thumb drive.

Second Step

This is where it can get difficult. When you plug your thumb drive into your computer, Windows Police Pro will deny the anti-virus installer to run. IT’S THAT SMART. What I did was right click on the task bar and select Task Manager. Windows Police Pro will show up under the Processes tab. With the quickness, right click the Windows Police Pro process and end the process. Now quickly run your anti-virus installer.

If you had success stopping the Windows Police Pro process from automatically starting please provide your input. My attempts in Safe Mode did not completely remove Windows Police Pro.

The anti-virus installer will continue to run as Windows Police Pro process keeps running. I recommend keeping the task manager open and regularly ending the process because it will continue to eat up computer resources.

Third Step

Like the second step, we will do the same thing but install the updates.

Fourth Step

Once you have successfully installed your anti-virus program, end the Windows Police Pro process and run your anti-virus program. It will catch any trojans, worms, viruses, etc. The first scan will catch most of the malware but this process will usually require more scans and more anti-malware programs.

Fifth Step

Now that your anti-virus program has removed some malware, let’s download another useful tool:

Combofix

Combofix will search for known malware and attempt to remove it. This is not a child’s toy so I’d be cautious using this. Follow the directions and if you have any questions please comment below. Combofix will also generate a report which you should save on your thumb drive.

Sixth Step

If combofix found more malware and removed it then awesome! It’s very likely that you may have rootkits on your computer and if the above tools weren’t enough and you’re still experiencing some weirdness then I recommend using:

Sophos Anti-Rootkit

Rootkits are very bad and hard to remove. Sophos is a small business to enterprise level anti-virus solution. The anti-rootkit is easy to use and all you have to do is follow the instructions.

Seventh Step

Lastly, I recommend downloading Spybot and Adaware. Download the updates individually and manually update each software on the infected computer if you are unable to run the updater. In my experience, Spybot was able to remove a lot of malicious software. I also use Adaware as a cleanup tool to catch anything Spybot didn’t. Do run each software separately and not at the same time.

Conclusion

At this point your computer should be clean of the Windows Police Pro infection. Removing it is a very lengthy process that takes time and patience. If you are still seeing some malware then I recommend disconnecting the infected computer from the Internet and running all scans from Safe Mode. It’s important that you keep the infected off the Internet because it will make a call out to it’s mothership notifying it’s master that it is being removed. It will then just replicate itself elsewhere, most likely on a file that the anti-virus already scanned.

If you have any questions, concerns, input or feedback please comment below.

How To Fix Event ID’s 1030 & 1058 [ALTERNATIVE]

The Network Technician — Mon, 27 Jul 2009 16:49:58 +0000

Our domain controller kept spitting out Event ID 1030 & 1058 in the event log. In our previous post I was able to solve this problem but only temporarily.

So another look a the two Event IDs shows:

Event Type:   Error
Event Source:   Userenv
Event Category:   None
Event ID:   1030
Date:       7/27/2009
Time:       9:12:15 AM
User:       NT AUTHORITY\SYSTEM
Computer:    domain controller
Description:
Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:   Error
Event Source:   Userenv
Event Category:   None
Event ID:   1058
Date:       7/27/2009
Time:       9:12:15 AM
User:       NT AUTHORITY\SYSTEM
Computer:    domain controller
Description:
Windows cannot access the file gpt.ini for GPO cn={A68A6FBD-86AC-4260-A81C-BF3AEF46ED16},cn=policies,cn=system,DC=domain,DC=org. The file must be present at the location <\\domain\SysVol\domain\Policies\{A68A6FBD-86AC-4260-A81C-BF3AEF46ED16}\gpt.ini>. (Access is denied. ). Group Policy processing aborted.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event ID 1030 & 1058 come together as a pair at the same time. It is with Event ID 1058 that gives us more information that shows there is a permission issue with the gpt.ini file in the SysVol folder of the particular domain controller.

Upon looking at the permissions everything looks fine.

To fix this problem:

Within the server causing the problem – Open the Command Prompt.
Type in dfsutil /PurgeMupCache (more info on dfsutil)
Monitor the event log

After completing the command, Event ID 1030 & 1058 stopped showing in the event log.

Windows Server 2003 Event ID 1030 & 1058

The Network Technician — Tue, 21 Jul 2009 17:52:07 +0000

Windows is really sometimes a mystery but it really comes down to documentation of what has been added or changed in the past. We’ve been getting two errors in the Application event viewer in Windows Server 2003, Event ID 1030 and Event ID 1058:

Event Type:    Error
Event Source:    Userenv
Event Category:    None
Event ID:    1030
Date:        7/21/2009
Time:        10:27:37 AM
User:        NT AUTHORITY\SYSTEM
Computer:    domain server
Description:
Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:   Error
Event Source:   Userenv
Event Category:   None
Event ID:   1058
Date:       7/21/2009
Time:       10:27:37 AM
User:       NT AUTHORITY\SYSTEM
Computer:   domain server
Description:
Windows cannot access the file gpt.ini for GPO cn={A68A6FBD-86AC-4260-A81C-BF3AEF46ED16},cn=policies,cn=system,DC=avidcenter,DC=org. The file must be present at the location <\\domain\SysVol\domain\Policies\{A68A6FBD-86AC-4260-A81C-BF3AEF46ED16}\gpt.ini>. (Access is denied. ). Group Policy processing aborted.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

We started getting these errors after we demoted one of our backup domain controllers. We did it properly, according to Microsoft, but got these errors afterward which occur every couple minutes.

To resolve this problem all we did was:

In the domain controller, Windows Server 2003, Open a Command Prompt
Type in ‘gpupdate /force’
Either restart if asked or log off and log back on

Doing this stopped the error messages in the event log. Disaster averted!

Disable Dell Wireless Lan Utility and Use Built-In Windows Utility

The Network Technician — Thu, 11 Jun 2009 21:38:18 +0000

Why does Dell have to ruin the built-in Windows Wireless Utility with their own bulky, unfriendly, Dell Wireless Lan Utility? For all those who want it removed, here’s how you do it:

Go to the Start Menu
Navigate to ‘Dell ControlPoint’
Click on ‘Dell ControlPoint’
Click on ‘Connection Manager’
Click on ‘Profiles’ at the left
Click on ‘Change Settings’ at the bottom
Click on ‘Program Settings’
Deselect ‘Wi-Fi’ and click OK
To ensure that the Built-in Windows utility works, click on Start Menu then Run and type
“services.msc” and click OK
Scroll down and right click on Wireless Zero Configuration and select Properties
For ‘Startup Type’ select ‘Automatic’
Start the service and click OK

You may now use the built-in Windows Wireless Utility to join wireless networks.