Ben’s Tech Blog

This year daylight savings in NSW, Victoria, ACT, Tasmania and SA has been extended to allow for the Commonwealth Games that will be held in Melbourne. Gary forwarded a message to me that he received from Office Watch reporting that there is a hotfix available to prepare machines for the adjusted daylight savings period.

There’s information regarding the issue and the hotfix here:

http://www.microsoft.com/australia/timezone/2005.aspx

The idea is to get the patch applied as soon as possible as Outlook calendar appointments that are created before the patch is installed will be 1 hour out of wack during the extended period. Appointments that are created after the patch is installed will show the correct time. Apparently Outlook does the time zone calculation when the appointment is created which explains why this is the case.

During the Olympic Games in Sydney daylight savings actually started earlier, and I don’t recall having any issues with screwed up calendar appointments. In any case we’ll get this hotfix out to all of our machines in Australia.

Some colleagues of mine (Ant and Gary) have been using Mind Manager as a way to brainstorm or map out projects into a logical format. I recently read a blog entry from Gary where he mentioned that he’d used Mind Manager to document the ITIL Service Management principles. I’m planning to do the ITIL foundation certificate so I thought it would be a nice study reference. With that thought in my mind, I realised that mind mapping could be a great way to compile study notes.

I’m currently studying for the Microsoft 70-291 exam, so I installed Mind Manger on Thursday night and started to play around with it. So far I have mapped out all of the DNS objectives and some of the IP Addressing/DHCP and Security topics. I’ve taken the approach of mapping out the exam objectives first (I’ve formatted the actual objectives with a different colour for clarity) and then branching out from each main topic with individual notes. It’s proved to be an extremely effective way to compile study notes and here is why:

• At any time you can see exactly where your notes fit into the overall objectives
• The map is easy to navigate through so it’s really easy to come back to a topic at a later stage and add some notes.
• You can add hyperlinks to each topic or sub-topic. I’ve added hyperlinks to a lot of topics that refer to articles that I’ve read in relation to the topic.

The mind mapping process feels organic. By that I mean that the way you map out topics in Mind Manager is similar to how you do it in your head (well in my mind anyway). I guess this is the reason why I like it so much.

Here are some pics of my study notes so far (still very much a work-in-progress).

How reliable is email? I get that question alot from users, and in recent times I’ve had to tell them that it’s not very reliable at all. There’s no doubt that spam is to blame; several years ago I beleived that email was reliable - you could realistly expect that if you addressed a message properly that the recipient would receive it, if not you’d receive a mail failure.

In Fred Langa’s experiement he found a 40% failure rate for valid, non-spam emails. Based on his findings, Fred concludes that spam filters are often to blame. Over-sensitive spam filters are definitely the main cause for most lost mail, and the problem is that if a message is blocked as spam, the sender won’t receive a mail failure and therefore is unaware that the message never got to the intended recipient.

The other problem however is that spam has bred a culture of ‘delete key happy’ users; if an email looks like spam then it’s probably going to get deleted, and in alot of cases it will be deleted without being opened at all. Although spam filters appear to be the main cause for lost email, the human element is starting to play a large role too. I’ve come across cases where users have asked me to track down an email that “they never received”; after checking the mail gateway where our filtering takes place, and performing an Exchange message tracking center search, I’ve discovered that the message was in fact delivered to their mailbox. Take a quick look in either their deleted items or the items that have been permantely deleted from their mailbox (retreivable by using the DumpsterAlwaysOn reg key) and its not rare to find the message that was “never received”. Usually in these cases the user was not actually expecting the message and the subject looked like spam so they deleted it. Afterwards, the sender has told them that they sent them a message but the user doesn’t make the connection between the message that they deleted and the message that they are now expecting to have received.

While there are efforts by various vendors and groups to improve SMTP (like Microsoft’s Sender ID for example) I think it will be a while yet before internet mail will be reliable and trustworthy.

I’ve been doing some work for a lady who owns two retail stores. One of the tasks on my list is to implement a decent backup solution for the point of sales systems.

Whenever I plan backups I like to consider the following scenarios:

• Accidental deletion of data or file corruption (’my documents’)
• A complete system failure like a failed HDD or severe OS issue that renders the system unable to boot
• A disaster that destroys the equipment along with the whole site

When I was looking for the right solution for her businesses I wanted to make sure that I covered those scenarios.

I considered hardware first. I decided that an external HDD or entry level NAS box would be the best way to go. The shops are next to each other, so a wireless link to a shared NAS box would work, or I could recommend external hard drives for both POS systems [The POS systems are Windows XP with MYOB Retail Manager]. Maxtor have a Shared Storage Drive that’s essentially a networked external HDD - It’s a single drive so it doesn’t offer RAID0 or RAID1 but the price fits well. The owner has a laptop that she keeps at home that has plenty of HDD space so the plan is to backup to the shared storage drive and then periodically copy the latest backups on to her laptop so that she has an offsite restore point.

Next I put some thought into the actual backup process. I wanted to keep the costs down so I considered the XP backup utility or robocopy to copy the MYOB data and my docs. I also considered using XP’s ASR feature as a complete system restore solution. I’ve tested ASR before and it seemed to work OK but there were several things I wasn’t comfortable with:

• It’s designed to backup Windows systems files and applications. I can’t be sure that it will backup up third-party software. It doesn’t actually backup data (documents).
• It can’t be scheduled.
• You need to create a floppy disk and burn a CD for each ASR image that you create.

Having used early versions of Ghost before (more for deployment than backup mind you), I considered using it take an image of the PC in case an OS rebuild was required in future. I didn’t think however that I would be able to schedule ghost images. In the old days you would have to boot into DOS to take a ghost image. I had heard though that later versions of Ghost can take images while windows is running and that was enough to persuade me to check out the latest version of Ghost - Ghost 10.

I downloaded and read through the ghost manual and was extremely impressed, so I downloaded the Ghost 10 trial and tried it out. It had me sold in an instant, and this is why:

• It can take images while windows is running
• The images (recovery points as they call them) can be scheduled
• A base recovery point can be taken, and then incremental recovery sets can be scheduled. On the machine I tested on I took an image of an 8GB partition and the initial image file was 6GB (using standard compression). That night, the scheduled image (system backup) ran and created a recovery storage point of around 2MB (MB not GB).
• You can browse the recovery points/sets and individual restore files from them directly. By default Ghost creates a recovery point each month and then a recovery set (the incremental backups) each day. This means that you have a complete history of backups that you can restore from. In this respect it’s similar to running VSS on your XP workstation.
• Ghost can delete older recovery points when you meet a threshold so that your destination does not run out of space
• If a complete system failure occurs, you simply boot from the ghost CD which loads NIC drivers and USB/Firewire drivers. You grab the recovery set from the backup destination (network or USB/Firewire drive) and tell it to restore.

Ghost 10 licenses are around $110(AUD) and in my opinion are well worth the investment. The solution that I’ve proposed for the shop owner is to purchase 2 copies of Ghost 10 and a Maxtor shared storage drive to backup each machine to. She can then copy the most recent recovery point to her laptop each week. Although she won’t have daily offsite backups, she will have a fallback if there is a complete disaster. For any other scenario she will have the ability to restore single files easily herself or a restore complete system (with my help - Symantec are still marketing Ghost 10 to more advanced users).

I just finished viewing this on-demand web cast where Mark Russinovich goes into great depth about how various malware works and how to effectively remove them. Mark also covers the use of rootkits which malware writers are starting to take advantage of these days. It’s worth the 1:12 minutes.

http://www.microsoft.com/events/EventDetails.aspx?CMTYSvcSource=MSCOMMedia&Params=%7ECMTYDataSvcParams%5E%7Earg+Name=%22ID%22+Value=%221032274950%22/%5E%7Earg+Name=%22ProviderID%22+Value=%22A6B43178-497C-4225-BA42-DF595171F04C%22/%5E%7Earg+Name=%22lang%22+Value=%22en%22/%5E%7Earg+Name=%22cr%22+Value=%22US%22/%5E%7EsParams%5E%7E/sParams%5E%7E/CMTYDataSvcParams%5E

I’ll certainly be adding the free sysinternals utilities that Mark demonstrated to my tool kit. The utilities include process explorer, sigcheck, autoruns and Rootkit Defender.

Using Sysinternals’ psexec it’s possible to open a command prompt on your local machine for a remote desktop or server. This can be a real time saver when you need to obtain information or issue a command on a remote machine but don’t want to connect to the machine using a remote desktop connection or remote connection software like VNC or Dameware. For example, if you wanted to check what DNS server a client computer is using you could start the psexec session and then issue the ipconfig /all command. This is much quicker than establishing a remote desktop connection and issuing the command within that session.
To open a remote command line, simply open a command prompt on your local machine and type:

psexec \\remotecomputer cmd.exe

Note that for the command above to work you’ll need psexec.exe in the current directory, or in a directory that is included in the path system environment variable. You’ll also need admin rights on the machine that you’re connecting to. You can specify a username and password by using the -u and -p switches

You can download the whole pstools kit, including psexec for free from www.sysinternals.com.