Publish NTBackup log to Internal Web server

Creating a web based backup log for your NTBackup

NTBackup is a backup tools from microsoft, it's usually already installed on your windows
machine. After the backup finish NTBackup create a backupog, but the sucks thing is, that
we can not change the directory where NTBackup log reside. The backup log locate at
"C:\Documents and Settings\%USER%\Local Settings\Application Data\Microsoft\Windows NT\NTBackup\data"


At my office we use NTBackup to perform the system state backup, and the backup result need to be checked every morning.
Because the NTBackup run with administrator priveledges, So i need to create a way so other people can review the backup
file without login to that server. And the answer is to publish the backuplog to our internal web server.

To do that I use rsync to syncronize the backup log our Linux based web server. But there's a problem with the logfile,
after it was syncronized using rsync, the problem related with character encoding. If we open that backup log on firefox It will show funny characters (see image bellow)


To handle this problem I use python script to change the encoding.
This script also will run the rsync command and generate HTML file.
I will post this python script on my next blog.

To Configure rsync on windows see Brent Noris Homepage about installing rsync on windows
Here the part of my rsync configuration to point to the NTBackup Log directory
[backuplog]
path = C:/Documents and Settings/Administrator/Local Settings/Application Data/Microsoft/Windows NT/NTBackup/data
read only = yes

After you finish configure the rsync on your windows machine, edit your crontab, then add the python script to your crontab entry.

Enabling Cirix client Access at ISA 2004

Few days ago i need to enable Citrix access at my client to their Citrix server at Singapore.
They use ISA 2004 as their firewall.
At ISA 2004 there already a template for ICA protocol, but the
problem is this template useless, i already try to use that, but internal network still can't access
the citrix server.
So as solution I create a "Custom ICA" protocol. Just use the ICA template from ISA 2004
as your reffences to create the Custom protocol, the only different is put the Port 1604/UDP at
Primary connection, rather then at secondary connection like at the template.

Here the different between the ISA template and the Custom

ICA Template from ISA 2004


Custom ICA Protocol



After you create that "Custom ICA" protocol, then create a new firewall policy, see the bellow picture asyour refference.

WinDbg and BSOD

- Downloads Windows debugger from Microsoft Web, after that install that Application at your Computer
- Find where your Windows store your debugging information.
- To find out where your windows hide your Debugging info Right Click the "My Computer" Icon.
- Select Property then go to Advanced Tab.

- At the Startup and recovery Section click the Settings button.

- Now you can see where your Windows store it's Dump file.


- For the start menu Start -> All Programs -> Debugging Tools for Windows -> WinDbg

- Now Open the dump file, go to File -> Open Crash Dump, then navigate to directory where the dump file stored.


- After you Open that file you will see lot of info. You can find the cause of BSOD, see at the bottom.


- As you can see the cause of the BSOD on my server is a file called mfehidk.sys, which a processes belongin to McAffe AV ( and that sucks)
- For detailed debugging info you can use command !analize -v , at the commad field

How to Update to Win XP Sp3 with registry hack

Yesterday I found an article how to hack Win Xp registry so I can update to SP 3 rc1 . I found that article at this link "http://dailyapps.net/2007/11/hack-attack-get-windows-xp-sp3-through-windows-update/"
here the script

@echo off
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\XPSP3 /f 2> NUL
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\XPSP3 /v RCPreview /t REG_SZ /d 1c667073-b87f-4f52-a479-98c85711d869 /f
echo XPSP3 registry key has been set. Please check for updates in Windows Update - Kudos to dailyapps.net
pause

copy paste that script to notepad, then save as winxpsp3hack.cmd.
Double click that file, just follow the instruction.
After that update your windows via automatic update.

Don't move Exchange Security Related Groups

Few day ago, I got call from the Office, they told me that one of our client exchange server got problem.
The exchange services can not start. It took hours to start the server, and sometime they must unlpug the network cable, from server NIC (Yeah good idea). After I came, I see that their try to install the Exchange SP2,but the installation procceses always end up with error.
The person who in charge, told me that there are problem with connection to Domain Controller. After I see the Event viewer I see there are lot of event with Id 9157 with source MSExchangeSA. Here the details of the event

Event Type: Warning Event
Source: MSExchangeSA
Event Category: General
Event ID: 9157
Date: 10/27/2007
Time: 11:57:32 AM
User: N/A
Computer: [Server Name]
Description: Microsoft Exchange System Attendant does not have sufficient rights to read Exchange configuration objects in Active Directory. Wait for replication to complete and then check to make sure the computer account is a member of the "Exchange Domain Servers" security group.

For more information, click http://www.microsoft.com/contentredirect.asp.

Apparently the Microsoft Exchange System Attendant service failed to start. This service is the most important service used by Exchange Server.
Because this service perform the important task, such as DS Lookup and other important task. If this service failed to start at least 3 other services will failed to start


Here the Description for Microsoft Exchange System Attendant service:
Provides monitoring, maintenance, and Active Directory lookup services, for example, monitoring of services and connectors,defragmenting the Exchange store, and forwarding Active Directory lookups to a Global Catalog server.
If this service is stopped, monitoring, maintenance, and lookup services are unavailable.
If this service is disabled, any services that explicitly depend on it will fail to start.

After some search from eventid.net and Google, apparently the main cause of this event because two security that related to Exchange
(Exchange Enterprise Servers and Exchange Domain Servers) moved to other OU. Looks like MS hard coded the Exchange to search both Security Group at User container. After I move back both Exchange and Start the Microsoft Exchange System Attendant, the problem
solved.