Don’t know about you, but I have a few programs that I use through the day that require administrator access.

This means every time I launch, I get the annoying UAC prompt:

There is a simple trick to create a shortuct that will launch with no prompts.

You can do it by creating a task that is never scheduled to run, but it is started by your shortcut.

To get started, go into the control panel, then administrative tools, and finally task scheduler.

On the right, pick the option to create a new task:

Give it a name (Take note of this, you will need this later) and make sure you select the option that will run the program with the highest privileges.

Go to the actions tab, and add a new action:

Point it at the program you want to launch with your shortcut.

Before closing it all out, take a peek at the conditions tab and uncheck any power options that are selected:

Now that we have our task, we just need to create our shortcut.

Right click on the desktop and select the option to create a new shortcut.

In the path put:

schtasks.exe /run /tn "[NAME]"

Where [NAME] is the name of your task

Now when you launch your app, you don’t get the annoying prompt.

We have a fax server here that drops all of its incoming faxes to a shared folder. Unfortunately, because of the way it was designed it cannot be joined to our local domain.

This means it has its own local account, and every time I reboot a username and password has to be entered to access it.

I wanted to find a way to allow me to access the drive without having to enter a username and password.

After some searching, I found a command line tool built into Windows that will do this:

cmdkey

This will allow you to store multiple username and password combinations for different network resources, while keeping them encrypted in the registry.

So, in my case I have a fax server on 10.10.27.231, and its username is fax, the password is fax.

To add it to Windows simply type this at the command line:

cmdkey /add:10.10.27.231 /user:fax /pass:fax


If you wanted to remove it from the cache, you would call it like this:

cmdkey /delete:10.10.27.231


Also, you can get a list of the currently remembered ones like this:

cmdkey /list


A simple command line tool, but saves you the aggravation of typing that in every time you reboot – Nice.

I got a question from one of our customers this week,

“Is there a way to run profile generator based on its workstation name? We want cached mode activated for laptops but not desktops. Or can you advise how this can be determined with the batch file?”

Actually we have had a tool internally that we have used for a long time. I decided to clean it up, and add it to our free tools.

It is called “IsComputer.exe” and you can get it from our downloads page

Here is how it works. You can give it two conditions – The version of Windows, or the name of the computer.

Lets say I want part of my script to only run on computers that are not Vista and above (Windows 2003, XP, and 2000) and start with the name LAPTOP:

IsComputer /name:LAPTOP* /os:CLASSIC

Or, I want it to only run on Windows 2003 computers:

IsComputer /OS:Windows2003

Or, maybe just computers that have ‘server’ in their name:

IsComputer /Name:*server*

Those are just a few options – a complete list of options can be viewed by running it from the command line.

How do we get it to work with our batch file?

If a condition matches, the program will return 1. If it does not match it will return 0. Here is how we can create a simple script that will output ‘hello’ if we have a match:

@echo off
IsComputer /OS:Classic /quiet /name:rack*
if ERRORLEVEL 1 goto RUN_SCRIPT
if ERRORLEVEL 0 goto EXIT_SCRIPT

:EXIT_SCRIPT


This example script will output ‘hello’ if the computer is running Windows 2003, and the name of the computer starts with ‘rack’.

You could put the batch file commands you want to execute right where the “echo hello” statement is.

Got a question, or an idea for a free tool? Let me know by mailing support@intelliadmin.com

Trying something new this week – got a video version of this weeks tip:

Got a question from Linda this week,

“Steve. We have quite a few IIS based web servers and each of them has their own custom configuration. I know how to backup all the files, but is there any way to backup and restore IIS settings from the command line? ”

Great question. When using IIS, you eventually get lots of custom settings hiding in there:

IIS Stores all of these settings in what as known as the metabase. It keeps track of the home directory, ISAPI filters, what type of files it will process, etc. How to we back this up?

You can back it up manually from the IIS manager:

But this has a major flaw. It just backs it up to a hidden file on your hard drive. Sure you can find this, and pull it off – but that takes some digging. That won’t help you much when the server is smoking and you want to get another one in its place right away.

How can we automate this process, and be able to grab the file and do what we want with it?

By using a little known VBS file that is included with Windows

It is called IISCnfg.vbs

Before we can use it, get to a command line and type IISCnfg and then enter.

It will give you an error, and then ask if you want to default to use CScript.exe instead of VBScript.exe for your VB Scripts.

Once you say yes, you can start calling it from your batch files or the command line.

There are many options to iiscnfg, but there are a few things that we will require:

-We want to export the settings
-We want all the settings, so we will start at the root and include the children
-We need to set a password on the exported file, or it won’t work on another server (Feature or bug – you decide)
-We want to export the file to a specific location, not the metabase storage area

So here are those requirements translated into arguments:

iiscnfg /export /sp /lm /children /inherited /d [password] /f c:\backup\IISMetabase.bak

The [password] is the password the file will be encrypted with. You will need this to restore it, so don’t forget it!

/sp (Source Path) indicates where in the IIS structure you want to start the backup /lm is at the top of this (I believe lm stands for local machine…someone please write a comment below if I am wrong)

So the above code will take our entire structure and back it up to c:\backup\IISMetabase.bak and then encrypt that file with the password [password]

Put that in your batch file used for backups and you can pull that config any time you want. Keep in mind this only backs up your configuration. Not the files that make up your website or ftp sites.

Later, a new VP of IT walks in and starts plunking around on your web servers

After he “improved” the system, how do you restore the settings?

You get that metabase file from your backups, and import it using a very similar command line:

iiscnfg /import /dp /lm /sp /lm /children /inherited /d [password] /f c:\backup\IISMetabase.bak

Note the /dp (Destination Path) and /sp (Source path). In my example they point to the same place – the top of the IIS settings tree.

Notice the password – it must be the same as the one used to back it up. If you forgot it your hosed. If you forgot to even set a password you might be OK…as long as it is the same system. Otherwise again, your hosed.

That is all there is to it. One line to backup, and one line to restore.

I have been getting lots of questions from everyone, and that is great

This week I got a question from Charles,

“Hello Steve,

I have a problem, I need to run a VB Script that will tell users that their password needs to be changed in x days. The Windows 7 balloon is not effective, and users miss it. Also, I do not want it to slow down the login. So what options do I have left?”

This is an excellent question. Other versions of windows might not even tell you.

For example: A user could leave their system on for days and days, and then cross the threshold of the password expiration date – suddenly nothing works for them.

You know what that means – another call to the help desk!

I have a good trick to filling all of your requirements. I have translated them to:

1. Make sure the users logon is swift, and not interrupted by a password expiration notice (Especially because windows just told them about it!)

2. While they are using windows, make it clear that their password expired. Don’t depend on Windows to properly notify them.

3. Do all of this from a script, no extra programs required

I think we can make that happen. First, we need a script to see if and when the users password expires. I found one that Microsoft has provided, and I have modified it to suit our needs.

The script has one function – PasswordDaysLeft. You call it, and it returns the number of days left before the password expires. If the function returns 99999 then the password never expires.

For example, if we wanted to know that in 10 days or less the password would expire, we would call it like this:

if (PasswordDaysLeft() <= 10) then
 MsgBox("Your password will expire in " & PasswordDaysLeft() & " days!")
end if


So now we have the ability to check for password expiration. But what about the original request? We don't want it to pop up at startup, but later.

Here is how we can get our script to do that:

We will loop in our script, and only check every 5 minutes. In addition, we will only start checking 20 minutes after the user logs in:

'Sleep for 20 minutes
WScript.Sleep(20 * 1000 * 60)

bRunning = TRUE
'20 minutes is up, check every 5 min to see if password is too old
while (bRunning)
 if (PasswordDaysLeft() <= 10) then
 MsgBox("Your password is about to expire. Please log off right now and change it")
 bRunning = FALSE
 end if
 WScript.Sleep(5 * 1000 * 60)
wend


This will stay running until the password expires, or the user shuts down or logs off. Once the user is notified, it will exit and not bother them again.

Now we have most of what we need:

-A function that tells us how many days before a password expires
-A script to check it.

How do we get it to run in the background?

That is easy. From the users logon bat file we call our VB Script like this:

start wscript \\server\share\PasswordExpires.vbs

This tells the BAT file to fire up our script, but not to wait for it.

So here is what happens:

The user logs in, the script is launched into the background. It silently waits for 20 minutes, and then on 5 minute intervals it checks if the password expired. If it did, then the user gets a notification and it quits.

It think that covers everything. The logon is quick, since it launches our script in the background and lets the user get right to their business.

You can download the zip file with the VBS file, and an example BAT logon script here:

http://www.intelliadmin.com/PasswordExpires.zip

Jennifer, sent me a question last week:

Steve,

Jen

Yes, There is a way to do this. Now it is not foolproof, but it will work most of the time.

First, we need our script to close Outlook, that way the PST files will not be in use.

We will accomplish this with a little bit of VB Script:

Set Outlook = CreateObject("Outlook.Application")
Outlook.Quit
Set Outlook = Nothing


Save this as “CloseOutlook.vbs”

Now, we will use this script, in combination with a bat file. The bat file will run CloseOutlook.vbs, and then copy the PST files.

Most of the time PST files are located in the users AppData folder. We can use an environment variable to find this.

It is called %LOCALAPPDATA%. For our backup, we will copy it to a share named backup, and we will copy it to a folder matching the users name.

The copy command will look like this:

COPY %LOCALAPPDATA%\Microsoft\Outlook\*.pst \\server\backup\%USERNAME% /y

/y – This allows us to overwrite without being prompted.

So, we have both things that we need. The ability to close Outlook (So the user does not have to remember to do this), and a way to find and copy our PST files.

Here is what the final bat file would look like


cscript.exe CloseOutlook.vbs
COPY %LOCALAPPDATA%\Microsoft\Outlook\*.pst \\server\backup\%USERNAME% /y
@if errorlevel 1 goto ERROR_HANDLER
@goto SUCCESS
:ERROR_HANDLER
@echo "==================="
@echo "= Backup Failed =
@echo "==================="

:EXIT
pause

I added an error handler, so the user will be notified if the copy could not complete.

Save it as BackupOutlook.bat and throw it on their desktop.

Now your users can backup their PST files – If they remember to do it

I came across an interesting utility called UNetbootin. It allows you to create bootable USB drives for many flavors of linux – but the part that interested me was the additional utilities you could write to a flash drive:

Parted Magic – a partition manager that can resize, repair, backup, and restore partitions.

SystemRescueCD – a system repair, backup and recovery tool.
Super Grub Disk – a boot utility that can restore and repair overwritten and misconfigured GRUB installs or directly boot various operating systems

Dr.Web Antivirus, F-Secure Rescue CD, and Kaspersky Rescue Disk – which remove malware from Windows installs.
Backtrack, a utility used for network analysis and penetration testing.

Ophcrack – a utility which can recover Windows passwords.

NTPasswd – a utility which can reset Windows passwords and edit the registry.

Gujin – a graphical bootloader that can also be used to boot various operating systems and media.

Smart Boot Manager (SBM) – which can boot off CD-ROM and floppy drives on computers with a faulty BIOS.

FreeDOS – which can run BIOS flash and other legacy DOS utilities.

There are many utilities like this. This one stood out because it automatically downloads all the files needed – no need to dig around and find the ISO.

Simply download the app, and run it:

Make your selection:

Click OK, and it will build your flash drive:

Once it is complete, you can boot from it.

Awesome little utility – perfect for making a rescue flash drive that you can bring with you to family events…when you get that “Could you look at my computer…” question.

Check it out at:

http://unetbootin.sourceforge.net/

I was reading an article at PCMag about PatchMateXP. They have had all the patches for XP on one convenient CD.

Unfortunately for PatchMateXP, this breaks a license with Microsoft and they shut themselves down before they got into legal trouble.

This got me thinking – is there a way to get MS Updates on DVD or CD?

My findings were quite interesting.

After tons of digging, I found this Microsoft Knowledge base article: 913086

At that link, Microsoft provides ISO files that contain all of the security updates by month. They update it regularly.

This works fine if you are already patched up, and just need a few months. What if you need all of the patches for Vista, XP, or 2003? That won’t really help.

I dug some more, and I came across a free utility called Offline Update. You can download it from here.

It allows you to create an ISO file with patches for a specific version of Windows. It gets around those pesky legal issues by having you download the patches to generate the ISO file.

To use it, download the package from the above website, and extract it into a folder. In the root directory you will find a program named UpdateGenerator.exe

Launch it, and you will see that it has a simple, but effective interface:

It even includes patches for Office – a nice bonus.

Select the patches you want, and click start.

A command line window will popup and it will download for hours or days, but eventually it will finish.

When it completes, you will find the completed ISO file in the folder named ISO under the root:

In my case it was the 64 bit version of 2003/XP patches.

Want to know the coolest part?

The ISO it builds is more than a collection of patches, it includes a custom program that will automatically install all of them in one shot.

Simply pop your burned DVD into the drive, and a window will show up:

Don’t be confused by the list of options, it is just giving you a choice on non-patch items included in the ISO.

If you just want the patches, simply select nothing and click start. It will only install the patches that have not been installed on your system:

That is all there is to it. The program will install all of the patches, reboot, and the system is up to date.

Now, I can burn that ISO, and give it to my friend Brett, since he lives in an Internet dead zone.

This little utility can be a huge time saver. I highly recommend it.

Last week I wrote about a free tool from Microsoft for synchronizing files. I asked you if you had any tools that made your life easier – my inbox was filled with suggestions.

One of the free tools that really caught my eye was Microsoft Network Monitor. I have been using Ethereal for a long time. It too is a great tool for monitoring network traffic.

Microsoft network Monitor 3.3 gives it a run for its money. Some quick points that make me like it:

It identifies processes that are generating the traffic:

It includes a ton of parsers that can pull out common protocols like HTTP, SMB, FTP, etc. These make it much easier to read what you are looking it:

Easy selection of network cards to monitor:

It has an extensive filtering system to weed out packets you are not interested in:

In addition, it has many command line options to automate it without any interaction.

Check it out at:

Microsoft Network Monitor 3.3

Since 2000 every version of Windows uses object reuse protection. When you create a file, the space on the hard drive for that file will be zeroed out.

Another way of looking at this is when a file is created, Windows will make it impossible to see what was there before.

But what about right after you delete a file? Nothing has been written to that space yet. What is on the physical hard drive? The entire file of course. Not good if the file is highly confidential.

What if you wanted to delete a file securely?

There are plenty of tools out there that can do this, and most of them cost quite a bit of money. But there is a free alternative.

It is called SDelete and it is from Microsoft:

http://download.sysinternals.com/Files/SDelete.zip

How does it work?

Simply download the program and run it from the command line. By default it will only complete 1 pass when erasing a file. I would suggest overriding that with a higher number – the higher the better, but it will be slower.

Lets delete a file with it, using 25 passes:

sdelete.exe -p 25 FileToDelete.zip

This will securely delete FileToDelete.zip

SDelete implements the Department of Defense clearing and sanitizing standard DOD 5220.22-M. This will give you confidence that once deleted with this tool, your file is gone forever. Note that it does delete the file, but the file name is still recoverable from the file system (Make sure the file name itself does not have any revealing information).

The full list of possible commands for SDelete are:

usage: sdelete [-p passes] [-s] [-q]
sdelete [-p passes] [-z|-c] [drive letter]
-c Zero free space (good for virtual disk optimization)
-p passes Specifies number of overwrite passes (default is 1)
-q Don’t print errors (Quiet)
-s Recurse subdirectories
-z Clean free space

It supports wildcards too. So if you wanted to securely delete an entire folder you can call it like this:

C:\>sdelete c:\temp\*.*

SDelete is set for 1 pass.
c:\temp\Eula.txt…deleted.
c:\temp\Import.csv…deleted.
c:\temp\readme.txt…deleted.
c:\temp\sdelete.exe…deleted.
c:\temp\VCdControlTool.exe…deleted.
c:\temp\VCdRom.sys…deleted.

If you have files that need to remain secure, SDelete is a great way to make sure they are removed from your hard drive.