RANTS: Apple Migration Assistant

Just had (luckily) only my second user data loss in my IT career. The first experience helps guide how I operate with other people's data today. I can't have too many backups or can't be too careful.

Fortunately, this second experience was not a complete repeat of my first experience, though I definitely could have used extra backups here. I had a user who had a disk corruption on his MacBook Pro. Nothing I could to to recover, except reload the entire machine. I loaded a clean copy of OS X on an external hard drive. From there, I booted off the external hard drive off the disabled MacBook Pro. Then I ran Migration Assistant from the external hard drive and pointed it to the internal hard drive on the MacBook Pro. At this point, I assumed that the external hard drive had all the files from the internal hard drive. I wiped the internal hard drive. I reloaded the internal hard drive with a fresh copy of OS X. I connected up the external hard drive again and ran Migration Assistant from the internal hard drive to copy over all the files.

At this point, I figured I was just about done. I tested logging into a user account and reconfigured a few things on the new reload. User even logged in and found his files on the desktop he needed. A day or two later, he discovered that his mail was no where to found. Long story short, Migration Assistant did not copy over the contents of Mail at all. I checked the external hard drive and found nothing. All his mail inside of Mail was lost. I felt terrible, even if this user was quite understanding.

Now that I think of it, the hard drive corruption could have caused Migration Assistant to fail to copy over the contents of Mail. I, then, have to wonder how many other files were lost.

Yet another hard lesson learned. Don't rely on one process. Even the method/solution should be backed up, not just the data.

(Not so) Happy Computing.

Update: 10/28/2010, revisiting this machine, I figured it that it wasn't my fault that the data did not come over. Migration Assistant failed due to the drive corruption. Granted, I should have checked it before wiping the drive and reinstalling. The way I found out was that the user did a search on the freshly rebuilt OS with migrated data and found some of the messages he needed. Turned out the messages were moved over to a folder at the root of the drive probably because the messages were sitting in an area that was affected by the corruption. The folder was actually created by DiskWarrior when it attempted to recover the original build. Whew!

TIPS & TRICKS: Changing Power Settings for Non-Administrative User via Registry

Okay, so this is more of a note to myself. Actually, this whole blog is a giant note to myself. But, I hope someone else finds it useful too.

I have a user who insists on purchasing using a notebook with a docking solution, just so she can leave the notebook in the dock about 95% of the time and remote into it. I'm not even going to get into how much sense that makes. The problem here is that the notebook goes to sleep as it should. But, that doesn't work well for someone who needs to remote in (Wake On LAN is disabled). She's also a standard user with not administrative access. The registry setting to control power settings is located here:

HKEY_CURRENT_USER\Control Panel\PowerCfg\PowerPolicies

I'm going to try adjusting this at a later time. I'm hoping that temporarily giving her administrative rights and making the change at this setting will make the desired power settings stick permanently.

If anyone else tries, this please let me know how it works for you.

Happy Computing.

TIPS & TRICKS: Use for grep

I'm not going to remember this one, so here it is:

grep username /var/aliases

It's a tool I could have used in the office awhile back, but glad that I have it now.

Update 4/9/2012:

another one:

grep searchterm /var/home/role/hostmast/new-raddb/vpn-users

RANTS / TIPS: Vulnerable Home Routers

Home routers have been vulnerable in the past and will likely be vulnerable in the future, especially when most people don't know how to secure them right out of the box. This article:

http://www.notebooks.com/2010/07/15/how-to-secure-your-router-against-a-hack-compromising-many-popular-routers/

talks about how a vulnerability in many home routers makes them susceptible to a potential attack. The interesting thing about this particular method is that it can affect so many different routers, rather than target a particular make or model.

The gist:
1. Make sure your router has a very strong password. Remember this password is the one used to access the controls of the router and not necessarily your wifi password.
2. Make sure firmware on the router is the latest from the manufacturer.

Happy Computing.

RANTS & RAVES: Latest MacBook Pro (with i7 Core Processor) and Snow Leopard

First, Apple has made yet another decision to make life harder for Sysadmins. In reloading a brand new MacBook Pro with i7 Core processor, I discovered that my Snow Leopard (OS X 10.6) images would not work. I further realized that none of my Snow Leopard media (DVDs) worked either. In fact, as of this moment, no retail copy of Snow Leopard sitting on store shelves will work with these newly released MacBook Pros. The only bootable Snow Leopard disk that works right now is the one that came with the machine. As such, I had to build a new image using this media.

Second, I attempted to save some time by partitioning the HD before reloading the OS. I planned to use Bootcamp to install Windows 7 64-bit onto the MacBook Pro. I also found that this step doesn't work. When launching Bootcamp from the application located in Utilities, Bootcamp does not recognize the partition I setup for the Windows partition prior to loading OS X. Luckily, I had already imaged the OS X load and could easily wipe the drive again and just reimage. The raves of this post is, of course, the ability to image without having to start all over. How frustrating would it be have to start over? I don't want to find out.

Hope this helps you save some time.

Happy Computing.

TIPS & TRICKS: Software Licensing Manager

Learned to how to obtain more detailed information about Windows 7 activation. There's a tool built into Windows 7 called Software Licensing Manager. Running it in a Windows 7 command prompt with admin rights will yield information like:

- Activation ID
- Installation ID
- Partial Product Key
- License status
- Remaining Windows rearm count

This last piece of information is important to Windows 7 imaging. I've found that if this rearm count gets to zero (start with 3 on a fresh install), then Windows will no longer boot properly.

The command to use at the command prompt to retrieve this information is slmgr /dlv. There are other parameters that can be applied, but /dlv is the most detailed. After running the command, a Windows Script Host window will be displayed with the information.

Hope this helps you. Happy Computing.

RANT: Got hacked.

Not me, thankfully. But, I did feel the effects of someone else getting hacked. Does the name Fred Cabasa ring a bell for anyone? I have no recollection about how I know this person. I even have this person in my contacts, but it was before I started noting down how I met people. Thus, this person had his information (i.e. email account(s), phone, computer, etc.) compromised in some way and I received some of the consequences.

How do I know that this person was compromised? I've got a fairly good idea of how spammers work and an email that seems like it's coming from someone I know is no real indicator. In this case, however, I received additional information leading me to believe that this person should really be careful about his personal information from here on out. Here's the message:



First, the email message only contained a link and no other text in the body of the message. The sender was Fred Cabasa using an email address I had on file for him, separately. The message also looked like it was sent to a small number of people at the beginning of the alphabet. Finally, the real tell-tale-sign about this message was that it included another email address of mine that I no longer use.

There's one other way that indicated Fred got hacked. I received a junk text message on my cell phone. This was no ordinary text message. This text message contained the same link as in the email I described earlier.

There are a million ways people could have obtained this information: from hacking his computer, to something as simple as finding his old cell phone or other device that contains this information Fred might have disposed of without properly wiping the data.

Moral of the story? Don't give your personal contact information out to anyone, ever. Wait, check that comment. Some times my paranoia gets the best of me. Seriously though, I think the moral of the story here is to make sure you protect your data and your devices. It's too easy to obtain information these days. If we all do our part (even if we don't care about our own information), we'll also protect those people who could be affected by information theft.

Hope this helps you. Happy Computing.

TIPS & TRICKS: Blackberry Enterprise Activation Duplicates

A user with a Blackberry connecting up to our Blackberry Enterprise Server was having trouble with syncing between Exchange and her mobile device. The device was originally configured over the wireless without ever plugging in to a machine and/or any desktop software. Everything had been functioning normally until recently. The Blackberry was not syncing over new appointments or contacts, though email was flowing normally. One other aspect was that there was an assistant to the user who also helped enter in contacts and appointments to the user's Exchange account. The appointments and contacts entered by the assistant were also not syncing onto the Blackberry. However, the information was showing up fine in the Exchange account through both Outlook Web Access and Outlook on a Windows machine.

One possible reason was that Exchange accounts were recently migrated from one store to another. A possible fix for this problem was to rerun an Blackberry Enterprise Activation to see if the Blackberry would reestablish the sync for contacts and calendar items. This did not work. The problem persisted.

The most drastic solution would be to wipe the Blackberry and rerun the Blackberry Enterprise Activation as if the Blackberry just came from the factory. However, I wanted to avoid this as the user had data residing on the Blackberry that was not backed up, especially since we did not create a connection between the Blackberry and any desktop software.

I finally figured out that there were duplicate contact lists and calendar lists. Somehow the Blackberry lost connection to the BES and when it did reestablish itself, it did not recognize that there was an existing list of contact items and calendar items. This is why there were only duplicates on the Blackberry, but not inside of Exchange. After some testing, I figured out which one of the calendar and contact lists were the actively synced lists and which were the ones with the lost connection. I configured the contact and calendar lists that lost the sync connection to no longer display (I may have even found a way to delete those lists after further investigation). This removed the duplicates. it's likely that a wipe and running of Enterprise Activation would have solved this problem. But, since we needed to find a more manual method, configuring the broken lists of contacts and calendars did the trick this time around.

Here's where I got my inspiration this time around:

http://www.blackberryforums.com/bes-admin-corner/122095-duplicate-contacts-after-new-enterprise-activation.html

Hope this helps you. Happy Computing.

TIPS & TRICKS: Login to Windows 7 Without Knowing Machine Name

When Windows 7 is joined to a domain, the default login prompt automatically allows a domain user to login to the machine with just username/password. However, a local account user would need to know the name of the machine to login to the machine (i.e. machinename\user).

At least that's what I thought, until now. I don't always remember the name of the computer that I'm working on. The workaround the login prompt and not knowing the machine name is to substitute a period for the computer name. For example, if my machine name is PC-1 and my username is bobama, then for the username field, I would enter:

.\bobama (instead of PC-1\bobama)

Hope this helps someone. Happy computing.

TIPS & TRICKS: Microsoft Outlook Unable to Open

PROBLEM:
Attempted to launch Outlook 2007. Received an error message of:

Cannot start Microsoft Office Outlook. Cannot open the Outlook window.

Here's a screen shot:



Outlook, like most other programs, can be run from a command line, albeit Microsoft's version. This usually means that there should be options in launching Outlook. Originally, I wanted to start Outlook in Safe Mode. This works by holding the CTRL key down while clicking on the Outlook icon, not a command line. However, this did not work and I received the same message.

THE FIX:
Still not quite a command line option, but close. With Outlook and the error message gone, click on Start > Run (or Start, and type run in the search field in Windows Vista and 7). Type outlook.exe /resetnavpane.

This solved my problem. If your problem is different, here's a site that has a list of different options:

http://www.howto-outlook.com/howto/commandlineswitches.htm

Be careful, though. I would find a way to backup your data in Outlook before attempting something you are not certain about. Most of the commands will not affect your data, but it's better to be safe.

TIPS & TRICKS: ARD, AppleScript and Logging into a Remote Mac

Received this handy tip:

This script example shows how to combine AppleScript with Apple Remote Desktop's "Send UNIX Command" to enter a username and password at the login window of a Mac you control.

osascript -e 'tell application "System Events" to keystroke "REPLACE_WITH_YOUR_USERNAME"';
osascript -e 'tell application "System Events" to keystroke tab';
osascript -e 'tell application "System Events" to delay 0.5';
osascript -e 'tell application "System Events" to keystroke "REPLACE_WITH_YOUR_PASSWORD"';
osascript -e 'tell application "System Events" to delay 0.5';
osascript -e 'tell application "System Events" to keystroke return';

Replace the two strings with your username and password. Note: there are some single and double quotes in the script above, so edit carefully.

Not that I would enter in a password into a script permanently. But, for a quick run of the script using a dedicated account for this purpose could be useful when combined with other routines.

Thanks Tony! Happy Computing.

RANTS: HTC Android Phone Comes with Malware Pre-Installed

Straight-from-the-factory, Android mobile device from HTC comes with a bot client, a worm, and a password stealing tool. How do we protect ourselves when we can't even trust a brand new device to be clean? I've always been an advocate of wiping anything and everything before using it. It takes a bit more time to setup, but you'll be sure that you'll have a clean device from the beginning. Here's the full story:

http://threatpost.com/en_us/blogs/htc-phones-pre-installed-mariposa-bot-client-030910

TIPS & TRICKS: Vista and Multiple Simultaneous Network Connections

I've been observing Windows connection problems via wireless for quite some time now. I'm hoping this might be a fix for many of those problems. Basically, there are multiple connections to the same wireless network. This could, potentially, cause some confusion by the OS.

Vista has a wireless profile manager. However, there is yet another place where wireless connections are stored. This is the network location manager. This stores the previously used wireless networks even if a profile was not created. You should be able to find this under Network and Sharing Center > Customize > Manage or delete network locations. This will allow for the deletion (or merging) of duplicate network locations.

Note: I have not yet had a chance to test this with Windows 7. However, I suspect the behavior is similar.

Here's where I originally found this solution and the complete steps:

http://www.annoyances.org/exec/show/article04-500

Happy Computing.

UPDATE: Found it in Windows 7. In Network and Sharing Center, under View your active networks, click on the icon (not the text). The next window will be the Network Properties, where you'll find Merge or delete network locations. The follow the same steps as previously noted.

RAVES: Apple to Replace HD in some MacBooks

Though not an official recall, this is the primary reason why Apple Support has rated so high in recent years. Don't get me wrong. Apple is far from perfect, but I think they are closer than some other manufacturers.

Here's the NY Times article:

http://gadgetwise.blogs.nytimes.com/2010/02/19/apple-to-replace-bad-hard-drives/?em

Hope this helps you. Happy Computing.

RANTS: Connecting to a Windows 7 machine from RDP on OS X

The basics:
- OS X.4.11
- PowerPC G5 machine
- Remote Desktop Connection Client for Mac v2.0.1
- Connecting to a Windows 7 64-bit machine with latest RDP client

The symptoms:
- Connection can be made to Windows 7 machine
- Mouse functions work normally
- As soon as a key is pressed on the keyboard of the G5, the RDP client on the G5 quits.
- Problem does not seem to be the Windows 7 machine, as I can connect to it from an Intel-based Mac.

Guess:
- Problem likely has to do with that the G5 is a PowerPC processor. Any guesses?

TIPS & TRICKS: Connecting to OS X Share from Windows 7

For some reason, I had not yet tried an AFP connection to an OS X server share from Windows 7 yet. So, I tried it today. Opened Computer, clicked on Map network drive and proceeded to map the drive. After providing the correct credentials, Windows 7 would not connect.

What do I do next? Search for an answer online (okay, I googled it). It took me a couple tries, but I finally found the following answer. Go to Administrative Tools > Local Security Policy > Local Policies - Security Options. Find the policy that's called:

Network security: LAN Manager authentication level

Then modify the setting to show Send LM & NTLM responses. Next, in the same location, find the policy that's called:

Network security: Minimum session security for NTLM SSP

Then modify the setting to disable Require 128-bit encryption. In my attempt, I only modified the first setting and was able to get in. The second setting was listed in the answer I found here:

http://www.tomshardware.com/forum/75-63-windows-samba-issue

Basically, regardless of the type of connection (i.e. Samba, AFP, etc.) Windows needs to be able to send the correct type of challenge/response authentication protocol. By default, Windows 7 is not allowed to send the right one/type to OS X. This change in the local policies worked for me.

Happy Computing.

TIPS & TRICKS: Installing Windows 7 on Dell Optiplex 755

Just ran through a clean installation of Windows 7 Enterprise 64-bit on a Dell Optiplex 755. Took a little more than 30 minutes. After the setup completed and I got to the Windows 7 desktop, I popped open Device Manager to see what drivers were missing. There were only 2 items needing drivers (PCI Serial Port & PCI Simple Communications Controller).


As I usually do, I went over to the Dell Support site to find the drivers. I put in the service tag of my machine and discovered that Dell, apparently, is not supporting Windows 7 running on an Optiplex 755. They had no drivers available for Windows 7, only XP and Vista. I thought for a moment and wondered if I should have backed up my previous Vista installation. Luckily, I found I was in better shape than I thought.

First, I realized that Windows 7 had drivers for the most crucial items in Device Manager (i.e. network connection, various controllers, audio/video, optical drives, etc.). Second, I searched and found others who had the same problem:

http://en.community.dell.com/forums/t/19299853.aspx

The 2 missing drivers were for components necessary for the Intel Management Engine, which can be disabled via the BIOS tool (CTRL-P). If the Intel Management Engine is disabled then the 2 components missing drivers will not appear in Device Manager.

Just in case, I decided to use the Vista drivers for the these two components, even though the Intel Management Engine will be disabled when I'm through with the setup. The installation worked fine.

Now, I'm off to check a whole bunch of other apps, including ADUC and Filemaker Pro, which had started to fail under Vista.

Happy Computing.

RANTS: iPhone WiFi Problem

A few months back, I was asked to troubleshoot a wifi problem on an iPhone 3G 8GB. The problem was that the wifi would be able to see the wireless networks in the area. However, when attempting to connect to a network, the iPhone would present a message saying that it was unable to connect to the network. This behavior exhibited itself when connecting to any wireless network, whether the network required authentication or not. After surveying the phone, duplicating the problem and asking the user what he had done just prior to this discovery, I briefly pondered what could cause this problem. I came to the possibility that some application installed on the iPhone caused the wifi problem. Based on what the user told me, I uninstalled a couple of apps he had installed an the problem vanished. It worked!

That was a few months ago. The user returned today and showed me the same problem. We think the problem returned this time because he restored his iPhone from an old backup, which could have restored the old app. Unfortunately, I don't remember which app was the problem. I've spent the afternoon trying to figure out which app while I was searching online for an answer. I came across the following:

http://discussions.apple.com/thread.jspa?threadID=2044754&start=0&tstart=0

http://www.everythingicafe.com/forum/archive/index.php/t-58045.html

The first link shows that it's a pretty widespread problem. In fact, this is the first time I've seen a discussion forum post with over 100 pages of posts. The second link has more advanced content about the potential problem, but still no real solution yet.

I'm still working on the app angle. Hopefully, I'll be able to figure out if it is indeed an app that is causing the problem. I didn't read through the 100+ pages of posts in the Apple Support page. But, in reading through many pages of posts, I don't see any indication that anyone has approached this problem from this angle. I frequently read that people restored their phones from backups after doing hard resets or getting a whole new phone. What if this restoration process just brought the problem back? I'll post more as I find out more.

Happy Computing.