System Admin

use registry to retrive histories

11-Jul-04 23:24

Is this on IIS 5 or 6 (Windows 2000 Server or Windows Server 2003)?

Our Exchange Server 2003 installation on Windows Server 2003 is currently using a test certificate from Thawte. I can't find any options for enabling SSL in Exchange System Manager on this server - where are you looking?

If I try to create a new HTTP Virtual Server through ESM, and choose Advanced next to IP Addresses, that does offer an SSL port field. It's initially grayed out because you've not yet added a certificate to this new virtual server, I think.

Unless you want to expose a different set of mailboxes to users connecting to the server with different IP addresses or (HTTP 1.1) host headers (e.g. you're hosting two separate domains on the same server), I'd stick with enabling SSL on your default server.

In the Internet Information Services management console, expand Web Sites. Right-click Default Web Site and choose Properties. Go to the Directory Security tab. Click Server Certificate, then follow the wizard to add the certificate to this site.

Once you've done this, you can assign the SSL port to something other than the default using the Web Site tab. I don't recommend doing this because it's unexpected by the users, and doesn't offer much additional security.

If you want to ensure that OWA users can only connect using SSL, right-click the Exchange virtual directory under Default Web Site and go to the Directory Security tab. Here, click Edit under Secure Communications and check the Require Secure Channel option. Remember that SSL protects your users' passwords and data, but does not provide access control. Unless you open your Kerberos ports on the firewall, authentication data (username and password) is sent using HTTP Basic Authentication, i.e. in clear text, so I recommend requiring SSL.

Stability. What an interesting concept. -- Chris Maunder

Re: OWA with SSL

Hugo Hallman12-Jul-04 2:01

Hugo Hallman

12-Jul-04 2:01

Well, as I said, I do get SSL to work, but the SSL settings are deleted when the virtual directories are read from ESM when restarting the services, so I need to enter them there instead of in IISAdmin. I have several ips on the Exchange server to enable two companies to use the same one with different public folders and only port 443.

Thank you for your exchaustive answer though. Rose | [Rose]

Sopheak Lar10-Jul-04 22:48

Sopheak Lar

10-Jul-04 22:48

hi everyone Smile | :)

i got one problem,i want to retrive all the informations like opened files,vistited webpages ect with specific date,which was cleared/deleted, by just using regidit, is that possible?bcos i think windows has this option.

curious 2 hear the ideas from u D'Oh! | :doh:

------------------------------
Smile | :)

Lar Sopheak Smile | :)

Re: use registry to retrive histories

Mekong River7-Feb-06 22:28

Set the permission for folder from MS-DOS mode

7-Feb-06 22:28

Sopheak Lar wrote:
hi everyone

Hello baby Big Grin | :-D

Sopheak Lar wrote:
i got one problem,i want to retrive all the informations like opened files,vistited webpages ect with specific date,which was cleared/deleted, by just using regidit, is that possible?

No it isn't. Regedit just store an information of the specific folder which store the history file. It do not store the each link of open or visit webpage. Try to log on as any user account and navigate regedit to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders then you will find the path to each specific folder for the current user account. The folder that store the recent file that might offer your needs:

- %UserProfile%\Recent<br />
- %UserProfile%\Local Settings\Temporary Internet Files<br />
- %UserProfile%\Local Settings\History

Sopheak Lar wrote:
curious 2 hear the ideas from u

Curious to meet you but you never want to meet me Cry | :((

Mekong River10-Jul-04 18:26

Re: Set the permission for folder from MS-DOS mode

10-Jul-04 18:26

Hi, i have a question about set the permission for folder in MS-DOS mode. It mean that you stand on MS-DOS prompt then try to set the permission for folder by using the command line. Is it possible or not?

Roath Kanel
APO-CEDC
Save Children Norway-Cambodia Office

Roger Wright11-Jul-04 2:51

Roger Wright

11-Jul-04 2:51

Try cacls /? Wink | ;)

"My kid was Inmate of the Month at Adobe Mountain Juvenile Corrections Center" - Bumper Sticker in Bullhead City

Anti-Virus expire

Mekong River10-Jul-04 6:39

10-Jul-04 6:39

Hi, I have a problem when I send or receive an e-mail message. There is a webpage pop up and show me that my antivirus is expire. Do you know why it have this problem?

Roath Kanel
APO-CEDC
Save Children Norway-Cambodia Office

Remote Installation

Monty²9-Jul-04 20:50

Monty²

9-Jul-04 20:50

Suppose i have a Server or a domain controller and lots of clients (98,ME,XP..)
and i want to install a piece of software on all of the clients
is there any way by which i can automate this installation
from the Server and go physically to every client and install

Thanks

C makes it easy to shoot yourself in the foot; C++ makes it harder, but when you do, it blows away your whole leg

http://www.mastishk.com

Re: Remote Installation

Mekong River10-Jul-04 6:11

Problem with accessing share resource

10-Jul-04 6:11

In my opinion, it might be depend on the type of the software that you install. If you have a client/server networking and you install norton antivirus corporate edition 8.0 it will contain an option for you to choose the computer name (client name) from the network and it will proceed the installation process for each client. For the tool or utilities you need to use remote desktop to access the client or use the terminal service to access the remote client. This just my opinion, if the other people find a mistake in this paragraph please correct it and give the right one. Smile | :)

Roath Kanel
APO-CEDC
Save Children Norway-Cambodia Office

Mekong River9-Jul-04 4:52

9-Jul-04 4:52

Hi, I have a problem when I share a resource on the network. My computer use windows 2000 professional. I share a folder that contain a picture call "rt04" set the full permission to Everyone user. When I access from windows xp client it prompt me for user name and password. I supply "administrator" as the user name and the password of adminstrator account on my computer then it could access my share files. But when I start to access the file from windows 98 it display a dialog box with only one textbox for password. The "Resource:" labeled stand for "\\[ComputerName]\IPC$" and a check box labeld "Save this password in your password list". From here I type the password of the administrator account on my computer but it is not work, it just display the dialog box again and said that the password is incorrect. I have two question in here:

1. Why I could not access the share file from on my computer from the computer running windows 98 (windows xp is working fine Wink | ;)

)

2. The check box labeled "Save this password in your password list". What does the password list mean, where is the list that it store the password in my computer.

Please help me Cry | :((

Roath Kanel
APO-CEDC
Save Children Norway-Cambodia Office

Windows 2003 problem

Mekong River8-Jul-04 12:11

8-Jul-04 12:11

Hi, a problem when I configure win3k to server and make domain to clients and user access to the server .

I try to do but user can't access to the server,

Could anyone tell me the way to solve the problem.

Roath Kanel
APO-CEDC
Save Children Norway-Cambodia Office

Re: Windows 2003 problem

Mike Dimmick10-Jul-04 7:27

Win XP Single user question

10-Jul-04 7:27

Do you mean that you've set up Active Directory?

If so, you need to ensure that DNS is set up correctly, that the users' computers are configured to use the internal DNS servers as their primary DNS servers, that the users' computers are members of the domain, that the users have accounts on the domain and that they're logging on with those accounts.

Then, assuming you're talking about using file and printer sharing, the users will need to have permissions both to the share, and in the case of file sharing on NTFS drives, also to the files themselves.

If you've only got a few users, AD may be overkill. The company I work for is about eight years old and we've only just started using any form of domain, largely because we're starting to migrate to Exchange before merging with another company - we currently have six users but are getting another six right now with the expectation of hiring more in the near future. If you want to avoid having a domain, your users either need to supply alternate credentials when connecting to the server, or they need to have user accounts on the server itself. To make things seamless, their local passwords and the passwords on the server must be identical.

You can migrate from the duplicate accounts scheme to a domain later on - our file server is not yet a member of the domain, so it has a duplicate set of user accounts. The database server currently uses SQL Server authentication, so doesn't need the duplicated accounts. For security I'd prefer to be using Windows authentication, but my boss doesn't want the downtime.

Finally, running a domain is a commitment to a certain level of service and maintenance. You must back up your domain database (using System State in the Windows Backup tool, or another method) regularly. Ours is currently backed up weekly; this probably isn't often enough. If you don't back it up and all your domain controllers fail, you won't be able to recreate it in the same state, you'll have to recreate all the user accounts and your users will all lose their profiles.

I strongly recommend reading the appropriate chapters of the resource kits, reading Microsoft Certified Professional course material, and the Active Directory material on Microsoft Technet[^].

Stability. What an interesting concept. -- Chris Maunder

Chris Meech8-Jul-04 5:15

Chris Meech

8-Jul-04 5:15

When I first installed XP, I never created any user accounts as the machine is functional specific and not user specific. One of the 'features' I got from doing this, is that when the machine booted, it always booted to the desktop immediately. Unfortunately I had a hardware problem and took the machine to a shop where they not only fixed the hardware problem, they changed something else so that the welcome screen shows up and you have to click on the single user account "Chris", no passowrd required, in order to get to a desktop. What do I have to do, so that the PC boots to the desktop, instead of prompting for a click on "Chris"? Thanks. Smile | :)

Chris Meech

I am Canadian. [heard in a local bar]

I think people should be required to have an operator's permit to use the internet. John Simmons

Re: Win XP Single user question

Mekong River6-Feb-06 22:51

http://support.microsoft.com/?kbid=315231[^]

6-Feb-06 22:51

Re: Win XP Single user question

Chris Meech7-Feb-06 2:55

Chris Meech

7-Feb-06 2:55

Thanks! I did get the XP machine to auto login as the article explains.

Chris Meech

I am Canadian. [heard in a local bar]

When I want privacy, I'll close the bathroom door. [Stan Shannon]

BAD DAY FOR: Friendly competition, as Ford Motor Co. declared the employee parking lot at its truck plant in Dearborn, Mich., off limits to vehicles built by rival companies. Workers have to drive a Ford to work, or park across the street. [CNNMoney.com]

Nice sig! [Tim Deveaux on Matt Newman's sig with a quote from me]

Can you read this MiniDump?

Anonymous7-Jul-04 23:58

Anonymous

7-Jul-04 23:58

Hello,

I have a win2000 installation has began to crash a few times daily and I don't know why. This is a pretty recent install w/ current ServicePacks and major windows update security patches. Nothing out of the ordinary.

It will just lock up, then shut down and reboot. Here is one of the dump's ran through windbg.exe. I struggled with windbg.exe trying to load the symbol files, but I finally got it. I just don't know how to interpit this log and figure out what the problem is.

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINNT\Minidump\Mini070404-06.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINNT\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 2
Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible
Kernel base = 0x80400000 PsLoadedModuleList = 0x8046e8f0
Debug session time: Sun Jul 04 21:35:23 2004
System Uptime: not available
Unable to load image ntoskrnl.exe, Win32 error 2
Loading Kernel Symbols
.......................................................................................................
Loading unloaded module list
.........
Loading User Symbols
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {c0000005, 80450ea6, 0, 5e494e26}

Probably caused by : ntoskrnl.exe ( nt!NtWaitForMultipleObjects+275 )

Followup: MachineOwner
---------

kd> !analyze -v
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80450ea6, The address that the exception occurred at
Arg3: 00000000, Parameter 0 of the exception
Arg4: 5e494e26, Parameter 1 of the exception

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!NtWaitForMultipleObjects+275
80450ea6 ?? ???

EXCEPTION_PARAMETER1: 00000000

EXCEPTION_PARAMETER2: 5e494e26

READ_ADDRESS: unable to read from 80483450
unable to read from 80482ea8
unable to read from 80482d78
unable to read from 80475234
unable to read from 80482d90
unable to read from 80482ea4
unable to read from 80475238
unable to read from 80482f64
unable to read from 80483420
5e494e26

CUSTOMER_CRASH_COUNT: 6

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x1E

LAST_CONTROL_TRANSFER: from 0000001e to 80430999

STACK_TEXT:
bd038500 0000001e c0000005 80450ea6 00000000 nt!KiDispatchException+0x30e

STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!NtWaitForMultipleObjects+275
80450ea6 ?? ???

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!NtWaitForMultipleObjects+275

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4047db83

BUCKET_ID: 0x1E_nt!NtWaitForMultipleObjects+275

Followup: MachineOwner

What does this mean?

Thank you in advance for your help.

- Mike

Mike Dimmick8-Jul-04 9:00

8-Jul-04 9:00

An exception that occurred in kernel-mode code wasn't handled. The exception code was 0xC0000005, which almost any C programmer can tell you is an Access Violation exception. Parameter 1 of an access violation exception is the type of access (0 = read) and parameter 2 is the address that the code tried to access.

The code that faulted was somewhere near the implementation of the NtWaitForMultipleObjects function in the NTOSKRNL.EXE module - possibly in the function itself. I'd be surprised if it was a bug in NtWait[...] because this path is very regularly exercised.

I suspect that some component of this system is failing - probably the RAM. If you've overclocked the machine, set it to the correct speed. Check all cooling devices are working correctly. Ensure none of the boards are damaged.

Stability. What an interesting concept. -- Chris Maunder

Tim Deveaux8-Jul-04 9:51

Tim Deveaux

8-Jul-04 9:51

Mike has a good point - but if it is the RAM, CPU, or CPU fan that's failing, there's a good chance that each dump you analyze will show a different location and/or bugcheck codes.

If the dumps are consistent, I'd do some further digging and/or start speculating on drivers and such.

Again as Mike mentioned, it's unlikely that NtWaitForMultipleObjects is the real culprit. Looks like you're going to have to dig a little deeper into the dump to find the problem. This initial analysis isn't giving you the stack trace you need, which I think is a result of trapping into the exception dispatcher.

Here's a doc that might be helpful:

http://www.wd-3.com/archive/registercontext.htm[^]

You may need more than a mini dump to work with - not sure.

If you've got the time, you might try using WinDbg on a remote machine. I'm pretty sure that you would break into the debugger before the bugcheck call in response to a first chance exception, which might give you a better context to work with.

Anonymous8-Jul-04 11:01

Anonymous

8-Jul-04 11:01

Wow, thank you very much for the responses.

I've though about it more and here is some additional information to possibly filter out or confirm any theories.

Here is the reasons from other dumps from the series of crashes:

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: f000e2d9, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 8042d37c, address which referenced memory

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: e3522097, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: bcfb127c, If non-zero, the instruction address which referenced the bad memory address.
Arg4: 00000001, (reserved)

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000028, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: bd525f25, address which referenced memory

I doubt it is overheating. I don't overclock and I monitor my chipset, CPU, power, and case fans. I also keep the case open 24/7.

There's been no recent hardware or driver changes in the system.

I am actually on day 2 without a crash now. But it went down about 6 times earlier this week. This also happened about 2 months ago and then magically started working fine.

Is it possible for the ntorkrnl.exe to be corrupt? I dunno.

When it crashes, sometimes I'd be playing a game, sometimes web browsing. One time it crashed while I was trying to log off of windows the exact second I clicked "OK".

I would try debugging on a remote machine, my all my other computers are either some kind of unix or linux.

-Mike

Tim Deveaux8-Jul-04 13:08

Tim Deveaux

8-Jul-04 13:08

I would think that the dumps for these should reference some kind of .sys file, not ntoskrnl.exe - that would help.

Sure looks wonky though.

Anonymous wrote:
Is it possible for the ntorkrnl.exe to be corrupt?

Anythings possible - you can actually update your ntoskrnl.exe and HAL files directly from the install disk if you like - there are usually checked and free versions for single and multiple CPUs available (hmmm - actually, I think the checked one is multi cpu). Google for 'partially checked' etc for instructions.

It is possible for a reeely bad driver to produce seemingly random BSODs - I know - I've done it! Big Grin | :-D

But its hard to shake the hardware idea in this case - do these crashes repeat with the same data?

Will ponder till morning. Keep us posted!

Mike Dimmick9-Jul-04 5:26