Virus Buster engine for Forefront Protection retired

Microsoft has announced that is retiring one of the engines that are used in Forefront Protection. 30 of September 2012 is the last date for receiving updates for this malware engine. Forefront Security for Exchange 2010 is generating event log with event id 2109 from source GetEngineFiles:The

VBuster scan engine is no longer supported. Updates are no longer available for this engine, and therefore the update check for this engine has been disabled. Please review the scan engines chosen for your scan jobs and make another selection to ensure up-to-date protection.

It is recommended to disable this engine for updating and scanning, more on how this can be achieved on http://support.microsoft.com/kb/2758276 .

KMS activation of Windows 8 and Windows Server 2012

Microsoft has published hotfix for Key Management Service (KMS) for Windows 7 and Windows Server 2008 R2 to allow enterprise activation of Windows 8 and Windows Server 2012. This update is publish under article id 2691586 or http://support.microsoft.com/kb/2691586/en-us .
After installation of this hotfix, and rebooting when prompted you can install new KMS host key for Windows 8 or Windows Server 2012 using slmgr :

cscript slmgr.vbs /ipk <KMS Host key>
 

and activate :

cscript slmgr.vbs /ato
 

After successful activation of KMS host key, you can activate machines with installed Windows 8 or Windows Server 2012.
 

How to request SAN web server certificate from windows server 2003 CA ?

By default, Windows Server 2003 CA does not issue certificates with SAN extension. To enable CA to accept certificate requests with SAN attribute, type in the following command:

certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2

and restart the certificate services service.

Use the following procedure for submitting certificate request for web server certificate, using web enrollment page http://CAservername/certsrv . After filling up the identifying information, in attribute box, type the needed SAN attributes in following form :

san:dns=dns.name&dns=dns.name2&dns=dnn.name3&dns=....

For example: if web server is responding on its name (https://server.name) and alias name (https://aliasserver.name), resulting attribute string looks like:

san:dns=server.name&dns=aliasserver.name.

Quickly archive log files on daily basis

In this case server was creating log files few in a second and by the end of the day there were tons of logs in the folder, and manipulations with those files was painful. So, I decided to make a scheduled task which will archive log files older then one day, and delete them after they were added to the archive. I was using rar as archiving solution, and here is the command for the task:

"C:\Program Files\winrar\rar.exe" a -ag -df -to1d -x*.rar  destinationfolder\archivename- sourcefolder\*.*

• a will add files to archive
• -ag will stamp archive name with current date
• -df will delete files after archiving
• -to1d will process files older than 1 day
• -x*.rar will exclude rar files in archive if any

Archive name will look like: archivename-YYYYMMddhhmmss.rar .

How to find disabled user accounts in AD with attributes for proxy address, phones or sip set

Here are simple ldap queries for finding user accounts using active directory user and computers, which are disabled and have following attributes set:

• Proxy address

(&(&(objectCategory=person)(objectClass=user)(useraccountcontrol:1.2.840.113556.1.4.803:=2)(proxyAddresses=*)))

• SIP

(&(&(objectCategory=person)(objectClass=user)(useraccountcontrol:1.2.840.113556.1.4.803:=2)(msRTCSIP-PrimaryUserAddress=*)))

• Phone numbers

(&(&(objectCategory=person)(objectClass=user)(useraccountcontrol:1.2.840.113556.1.4.803:=2)(|(mobile=*)(telephoneNumber=*))))