Mitch Tulloch - Windows Server Hacks

We'll begin with a catchall chapter of tips andtools that cover a wide range of general Windows systemadministration topics. Think of this chapter as the removable topdrawer of your toolboxusually cluttered, but containing yourfavorite, indispensable tools. The topics in this chapter includeways of hacking the Run As command, collecting event log information,running commands, extending your environment, shutting downprocesses, renaming mapped drives, and more. You'llalso learn how to disable file encryption if youdon't need or want it, collect configurationsettings from remote machines, use automatic logon whereit's safe to do so, and make it easier for users toaccess Remote Assistance when they need it. We'llalso list some of our favorite third-party tools and a terrificonline resource for Microsoft management technologies.

A number of the hacks in this chapter include scripts. To ensurethese scripts run properly on your systems, make sure you downloadthe latest scripting engines on the workstation from which you runthe scripts. You can get these scripting engines from the MicrosoftScripting home page at http://msdn.microsoft.com/scripting/. Also,when working with the Active Directory Services Interface (ADSI), youmust have the same applicable rights you need to use the built-inadministrative tools, which basically means that you needadministrator credentials to run the scripts.

[]

[]

accountsdomainsOUsusersadministratorASR (Automated System Recover)automatic log onconfiguration

[]

Backup utilitybackupsconfiguration

[]

CAs (certificate authorities)code listingscommand linecomputersautomatic logon enabledconfigurationbackupsCSV files

[]

databasesDHCPDDNS (Dynamic DNS)databasesserversdomainsActive Directorydownloadingdrive mapping

[]

EFS (Encrypted File System)keysencryptionenvironment variablesER (Emergency Repair)filesEvent logsexpiration

[]

FAQsfilesfolders

[]

group membershipGroup PolicyGUI

[]

[]

IIS (Internet Information Services)IIS 5IIS 6metabaseinactive accountsinstallationIP (Internet Protocol)IP addresses

[]

[]

log onautomaticlogon scripts

[]

mapped drivesmapping drivesmetabaseMicrosoft

[]

Netshnetwork adaptersnetworksNICs (network interface cards)

[]

orphaned NICsusers

[]

passwordspatch managementpatchesprinters

[]

[]

recoveryremote computersbackupsrestores

[]

scanningscripts[See Run As]securityadministratorvirus protectionshadow copiesshortcutsdisabling

[]

tools

[]

updatesusersActive Directoryutilities

[]

variablesenvironmentvirus protectionvirus-free networksVSS (Volume Shadow Copy Service)

[]

web sitesWindowsWindows UpdateWMI (Windows Management Instrumentation)

[]

Reviews

Reader Reviews

Errata

Academic

Environment variables can easily be added,removed, or retrieved using the script in this hack .

Using VBScript to work with theWindows system environment can be pretty simple. This hack shows howto use a script to read variables, add new variables, removevariables, and recurse through all of them. Just take a look throughthe script and read the comments to see how to perform each task.Note that there are four types of values in the Windows Script Host(WSH) environmentSystem, User, Volatile, and Processandthe script uses all of them.

By the way, this script is provided by Dudeworks (http://www.dudeworks.net). For additionalresources on Windows scripting and working with the environment, seehttp://msdn.microsoft.com/library/default.asp?url=/library/en-us/script56/html/wsProEnvironment.asp.

Type the following script into Notepad (with Word Wrap disabled) andsave it with a .vbs extension as GetEnvVars.vbs :

'~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 'Created by: Rob Olson - Dudeworks 'Created on: 10/17/2001 'Purpose: Get Environment Variables. '~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~wscript.echo "Working with the Environment: Provided by www.dudeworks.net"&vbcrlf&vbcrlf&strval '// Create an instance of the wshShell objectset WshShell = CreateObject("WScript.Shell")'Use the methods of the objectwscript.echo "Environment.item: "& WshShell.Environment.item("WINDIR")wscript.echo "ExpandEnvironmentStrings: "& WshShell.ExpandEnvironmentStrings("%windir%")'// add and remove environment variables'// Specify the environment type ( System, User, Volatile, or Process )set oEnv=WshShell.Environment("System")wscript.echo "Adding ( TestVar=Windows Script Host ) to the System " _& "type environment"' add a varoEnv("TestVar") = "Windows Script Host"wscript.echo "removing ( TestVar=Windows Script Host ) from the System " _& "type environment"' remove a varoEnv.Remove "TestVar"'// List all vars in all environment types'//System Typeset oEnv=WshShell.Environment("System")for each sitem in oEnv strval=strval & sItem &vbcrlf nextwscript.echo "System Environment:"&vbcrlf&vbcrlf&strval strval=""'//Process Typeset oEnv=WshShell.Environment("Process")for each sitem in oEnv strval=strval & sItem &vbcrlf nextwscript.echo "Process Environment:"&vbcrlf&vbcrlf&strval strval=""'//User Typeset oEnv=WshShell.Environment("User")for each sitem in oEnv strval=strval & sItem &vbcrlf nextwscript.echo "User Environment:"&vbcrlf&vbcrlf&strval strval=""'//Volatile Typeset oEnv=WshShell.Environment("Volatile")for each sitem in oEnv strval=strval & sItem &vbcrlf nextwscript.echo "Volatile Environment:"&vbcrlf&vbcrlf&strval strval=""

To run the script, open a command prompt, change to the directorywhere the script is saved, and type cscript.exeGetEnvVars.vbs . Here is an example of typical output fromthe script on a Windows 2000 machine:

Microsoft (R) Windows Script Host Version 5.6Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.Working with the Environment: Provided by www.dudeworks.netEnvironment.item: %SystemRoot%ExpandEnvironmentStrings: C:\WINNTAdding ( TestVar=Windows Script Host ) to the System type environmentremoving ( TestVar=Windows Script Host ) from the System type environmentSystem Environment:ComSpec=%SystemRoot%\system32\cmd.exeOs2LibPath=%SystemRoot%\system32\os2\dll;Path=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbemwindir=%SystemRoot%OS=Windows_NTPROCESSOR_ARCHITECTURE=x86PROCESSOR_LEVEL=6PROCESSOR_IDENTIFIER=x86 Family 6 Model 5 Stepping 2, GenuineIntelPROCESSOR_REVISION=0502NUMBER_OF_PROCESSORS=1PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSHTEMP=%SystemRoot%\TEMPTMP=%SystemRoot%\TEMPProcess Environment:=C:=C:\=ExitCode=00000000ALLUSERSPROFILE=C:\Documents and Settings\All UsersAPPDATA=C:\Documents and Settings\Administrator\Application DataCommonProgramFiles=C:\Program Files\Common FilesCOMPUTERNAME=SNOOPYComSpec=C:\WINNT\system32\cmd.exeHOMEDRIVE=C:HOMEPATH=\Documents and Settings\AdministratorLOGONSERVER=\\SNOOPYNUMBER_OF_PROCESSORS=1OS=Windows_NTOs2LibPath=C:\WINNT\system32\os2\dll;Path=C:\WINNT\system32;C:\WINNT;C:\WINNT\System32\WbemPATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSHPROCESSOR_ARCHITECTURE=x86PROCESSOR_IDENTIFIER=x86 Family 6 Model 5 Stepping 2, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=0502ProgramFiles=C:\Program FilesPROMPT=$P$GSystemDrive=C:SystemRoot=C:\WINNTTEMP=C:\DOCUME~1\ADMINI~1\LOCALS~1\TempTMP=C:\DOCUME~1\ADMINI~1\LOCALS~1\TempUSERDOMAIN=SNOOPYUSERNAME=AdministratorUSERPROFILE=C:\Documents and Settings\Administratorwindir=C:\WINNTUser Environment:TEMP=%USERPROFILE%\Local Settings\TempTMP=%USERPROFILE%\Local Settings\TempVolatile Environment:LOGONSERVER=\\SNOOPYAPPDATA=C:\Documents and Settings\Administrator\Application Data

Windows Server Hacks By Mitch Tulloch Publisher : O'Reilly Pub Date : March 2004 ISBN : 0-596-00647-0 Pages : 384 The tools, or hacks in this book reveal techniques that gowell beyond basic management tasks found in most handbooks.Hacks range from those that deal with general administrationto more esoteric hacks in the areas of network deployment,patch management, performance, security, and backup andrecovery. No matter which Windows Server you use--NT, IIS,2000, or 2003-- Windows Server Hacks will put the knowledge and expertise of veteran systemadministrators to work for you.