Vista client VPN to an ISA 2004 server

New technologies, new woes. I was having problems getting access to resources over the VPN. I solved half of them by unchecking the IPv6 checkbox for the VPN connection and then restarting the laptop. I also went ahead and explicitly set the connection type to PPTP and made sure it was using the remote server as the Default Gateway under the Advanced tab of the IPv4 settings. For the old XP boxes we used to unset that to keep down crap traffic through our network from remote users. It's still a little flaky sometimes with mapping drives, etc but at least now I can get to internal web servers and RDP.

Netflix Instant Viewer and XP 64 bit fun

It all started out innocous enough, go to netflix's site, download the client, and roll film. Needless to say, murphy's law kicked in. Netflix's module tried to upgrade media player to 11 and by default tries to load the 32 bit version. After that failed, then my browsers started randomly crashing during use.

So I upgraded the box to WMP 11 64 bit edition, then ran the netflix DRM reset program. C:\Program Files (x86)\Netflix\Netflix Movie Viewer\ResetDRM.exe
Then went back to the site and ran the installer again. It's still a little flaky but it's running now and I can now watch vids on the box.

Virgin Mobile Phone Activation Hell

So I've been trying to activate my wife's virgin mobile phone for two weeks now. She's had the service for a few years now and every year we upgrade the phone to a newer model. This year they've made it so if you activate with a customer service representative you have to pay $10. But if you do it online, it's free. So we tried the online route and the POS web server kept rejecting the ESN number. Call number one which took over 45 minutes consisted of confirming that it was indeed the right ESN and that we did have enough IQ to use the web page. Yet the end result was that yes they understood it was their fault but for them to fix it would cost $10 as the computer would not let them override. Thus began the email rant to customer service. After a few volleys they said they'd fix it for us for free. Followed by a few more emails confirming information, then followed by a "We're sorry, you'll have to call us to fix this". Thus began Call number 2. Talked to friendly advisor who came to the same unfrigginbelievable response. I decided it was time to escalate and asked for a supervisor. After 15 minutes on hold I was beginning to wonder if Sir Richard Branson himself had been roused to come and defend his company's honor. Unfortunately no, just some low level supervisor who came up with pretty much the same rubbish and added - "it shows the computer has automatically launched an investigation." To which I asked well hasn't it been generating errors for two weeks now? What's the difference now?
Yeah, it's only $10 but at this point it's just the principle. Any good customer service company has to provide a way to fix issues that are caused by their own systems or they are worthless.

D630 wakes itself up - aka the haunted latitude

So I have a latitude D630 running Vista that works fine, falls asleep and wakes up okay, etc. But if you leave it sleeping for about 18 hours you can hear it try to wake itself up. So I checked the usual suspects in bios, wake on lan was off, system turn on timer off, etc. I finally found the culprit to be hibernate. The laptop is set for high performance power mode which by default sets hibernate to occur after the laptop has been 'sleeping' for 1080 minutes. And of course, there's no GUI option to turn off hibernate in Vista so back to the old trusty command line.

powercfg.exe /hibernate off

I don't use hybrid sleep mode or any of those fancy functions so turning this off saves me disk space and the peace of mind knowing that the laptop will not try to wake itself up at a bad time and choke to death in a laptop bag.

For more info on turning off hibernate and turning it back on -

Fixing the Automatic Updates Service

Sometimes I suspect that my users have maliciously found a way to avoid having to deal with Restart prompts by sabotaging the Automatic Updates service. On some of the machines I keep running into errors when trying to start the Automatic Updates service. The solution I found on Microsoft's site at:

Basically you can make a batch file to run on the client machine. I dump it on their c:\ drive and then use Dameware to open a remote command prompt on the client and run the batch file directly. Alternately you could tell the user to run it or put it into a logon script temporarily.

Symantec - Veritas backup exec 11 second impression

When backup exec 11 first came out I had been ready to upgrade to it right up until I read the message boards. The boards were full of hate and frustration due to bugs, lack of exchange 2007 support, the recent shift of tech support to somewhere in BFE, and the breaking of many features that used to work when it was still veritas. So a year and a service pack and a few hotfixes later, I'm taking the plunge. Their license management site gave some minor difficulties but overall wasn't as bad as my previous experiences with it.
Installation breezed through and the LiveUpdate window was a welcome change from the old patch system. Once I confirmed that all my backup jobs were still there I uncrossed my fingers and started upgrading the remote agents. They've added a new remote agent utility which adds a GUI to the remote agent and publishes current IP and port information back to the media servers at regular intervals. Hopefully this'll make it easier for it to keep track of servers outside the firewall or in the dmz.
All in all I'm cautiously optimistic about this upgrade.

** If you're upgrading exchange 2k7 to SP1, pay close attention to the readme when it talks about remote streaming support. I've seen this pop up on some of the boards with backup exec and exch 2k7 when doing individual mailbox restores.


**Update** Had some weirdness with the jobs that were scheduled from policies. I deleted the jobs from the policies menu and recreated them so we'll see if it works better tonight.

Minimizing the Word 2007 Ribbon

Seems basic enough I know but those are the features that we often can't find because they're so simple but still elusive at times. Some of our users who run lower resolutions weren't happy with the new super sized ribbon that comes with office 2007. Simple fix, set the ribbon to minimize.



Voila, you're done.

Finally got rid of those annoying SSL Security Prompts for outlook 2007/exchange 2007

So the new Exchange 2007 FE and BE system's been up and running fine for a few months now and I finally decided to fix that damn security prompt for the certificates. Essentially I needed a certificate that could handle the Back End server's FQDN and Netbios, the front end's FQDN and Netbios, the Autodiscover dns name, the smtp dns name, and the whole email domain name. Found few articles at the usual places (Tom Shinder's pages/forums, petro.co.il, etc) and started building out the syntax needed. There seem to be different priorities on what's included but my final one was: (and the one that worked mind you since Entrust barfed the first try back out at me)

New-ExchangeCertificate -GenerateRequest -SubjectName "c=US, O=MyCompanyNameHere, CN=FESERVER.YOURDOMAIN.com" -DomainName FESERVER.YOURDOMAIN.com, exchange.YOURDOMAIN.com, autodiscover.YOURDOMAIN.com, FESERVER.ADsubdomain.YOURDOMAIN.com, FESERVER, BEServer.ADsubdomain.YOURDOMAIN.com, BEServer -PrivateKeyExportable $true -keysize 1024 -path c:\certrequest_FESERVER.cer

(the subdomain was for the internal DNS names since Active Directory is a sub-DNS domain)

Also make sure the CN matches the first server name in the DomainName section if you want ISA to work with this.

Now take your .cer file and head over to Entrust and get a "Unified Communications Certificate". http://www.entrust.net/ssl-certificates/unified-communications.htm
Follow the instructions and keep in mind they require a separate contact for Technical and Authoritative for security.



Now you take the response certificate and import it into your back end server. (adjust services to match the roles of your boxes.)

Import-ExchangeCertificate -Path D:\entrustcert.crt ¦ Enable-ExchangeCertificate -Services SMTP,IMAP,POP,IIS

(The saves you the trouble of dealing with the thumbprint separately)

Do the same for your front-end server. You'll need to export the certificate with private key and full certification path to a file first. Then import it into the certificates MMC on the Front End server. Then do a get-certificates at the exchange shell and see if it shows up.

Then run Import-ExchangeCertificate and it'll prompt you Services, then the thumbprint.

The End