Everyday IT issues Archives - Creative People | Quality IT services

Not the password we want, but the password we need

Konstantinos Koptis — Thu, 05 Nov 2020 11:55:14 +0000

Could someone, who intentionally uses malware to commit punishable actions get away, nowadays?!
Well… Sure he could!

The idea and the purpose are to avoid getting robbed, not to trap and punish the robber!
Always prefer the “better prevent than cure” approach when it comes to security.

The background behind anyone using or intent to use malware is not that different to a criminal act. The majority of people use Laptops, computers, smartphones to ease their otherwise time-costly activities, in daily basis. Could that be a bank transfer, an online order, or an email that someone will manage to exploit and benefit on your expense? Yes, it could and to be realistic- it already has happened to many of us!

What we hardly realize today is that all the complex electronic devices we use -not necessarily own- and for the time being used by us, are becoming our assets’ “manager”. Thereby, for these few moments they are becoming vulnerable, and target for the cyber-vultures!

Not differing from common thieves, cyber-criminals will disguise their identity and purpose to steal from you. Their loot could be money, personal files or valuable to them information to keep them going.

The intention of someone who uses malicious software will always be masqueraded. Sometimes is easy and straight forward to identify the scam served to you in a goofy way, but on the other hand there are scams well-planed and highly sophisticated that could easily deceive anyone, even experts!

To protect our privacy and assets, we need to consider cyber-criminals as common thieves! Their true identity will be masqueraded, their purposes will appear to be pure and innocent and the fuel to feed their success is mostly the Human error!

We need to realize that the highest value “currency” in this post-modern era, undoubtably is information! That is what they go for and therefore what we need to fortify and keep safe!

A noble idea, in theory, but in practice, a western luxury.
How could we counter sophisticated malware, well-planned attacks and disguised intruders from stealing us?
At first, we should not hand the keys over and if we did, we should change the lock at once! Do not share your password and do not either write it down on a post-it hanging proudly like “Free Entrance” label on your PC monitor.
Change your credentials often, create a linked habit for it, do it every month along with your bills payments so you don’t forget it.

Use passwords with high complexity!
I know you don’t want to forget the marvelous summer holidays you had on this exotic Greek island, that apart from relaxation and some salt on your skin, gave you a nice password idea “naxos2020”. But don’t be humble about your feelings, add up some enthusiasm and turn it into “naxos2020!”. Try to avoid Grammar and Spelling Police also by turning it into “Naxos2020!”. Get some stars decorating its sky “*Naxos2020!*” and maybe a few extra dollars “*Naxos2020!$$*” just in case! By the way, why not mentioning this new funny friend you made there…. “*Naxos2020!$$*peter”. And I know everyone is counting down to next summer holidays… so keep counting and adjust it accordingly every month so you don’t lose track… “*Naxos2020!$$*peter10” . Don’t forget about Spelling Police and use capitals, they love them even when not necessary!
And there you go… “*Naxos2020!$$*PeteR10”.
Remember that if you get targeted by someone who really wants to break your password, complexity and short time rotation (15-30days) are your allies!

Do not stick to a patronized schedule and change your credentials as soon as possible if you suspect someone might have them, and fully utilize your imagination when creating a password. It is a routine that after a while gets exhausting for many people, but you must keep doing it for your safety! Better safe than sorry.

Be social but do not get dragged into social engineering traps! Socializing with friends and colleagues is more than necessary for most of us, but walls have ears and doors have eyes. You can never know who lays hands on simple information you exchange during the innocent chatting you have with your friends. For example, talking loud with your friends about your vacation this year, the great friend you made and the months you count until next summer are valuable hints that someone could maliciously use to build a library of potential password combinations!
Information mostly extorted for this purpose are names, birthplaces, birthdays, pet names and anniversaries.

Don’t let your devices unattended and unlocked. Doesn’t matter if you are on a coffee shop with friends or in the University’s library, always lock your device if you are intending to leave them unattended! It takes seconds for a successful malware deployment on a mobile or a laptop!

Be skeptical and doubtful when communicating with someone over emails or any other web platform in general. Someone’s claiming to be the Pope, or more commonly a Nigerian Prince, doesn’t mean it’s true!!
Always try to verify the identity of the person on the other end of the network-line! Check the full sender’s mail when you receive something in your mailbox and be suspicious if something doesn’t seem normal. Think and corelate sender’s name, sender’s email, subject of the email, attached files, purpose of the email. If something doesn’t feel right double check its validity! Could be a weird front used, a mail signature out of position, expressions used not matching the sender’s personality, generic or vague references or even (too) personal details requested.

Majority of people use the same credentials for several applications, emails, bank accounts etc.
As prompted before, I suggest you use your imagination to weaponize your credentials’ library.
Use the password “*Naxos2020!$$*peter10” for your email, but use a variation you can easily remember for laptop e.g. “*Naxos2020!$$*peter10Lap” or “*Naxos2020!$$*peter10ScroogeMcDuck” for your bank account. This way you get a strong complexity password, with irrelevant elements and easy to remember at same time.
Keep in mind that any password that is easy for you to remember and type, is 10x times easier for the attacker to obtain!

Using a single password for all your electronic “assets” gives you zero fault tolerance!
Therefore, compromising one of them gets the gate open and the king killed!

The post Not the password we want, but the password we need appeared first on Creative People | Quality IT services.

Data Security and the off-kilter binomial a memeful review

Apostolos Drakakis — Thu, 29 Oct 2020 10:28:23 +0000

Computer technology is the, unfathomably evolving, assisting prosthesis to societies, economies, and individuals, attempting to persevere in a world stricken by the pandemic.

And yet sometimes…it – the prosthesis – does not fit all that well. Sometimes the grafts get rejected… Or the amputee rehabilitation fails – since he/she/they never lost the limb – they must learn to use. Or even – and here is where all immersion in medical similes fails spectacularly – someone gets control of that extra *insert appendage of choice* and gives you a thorough thrashing with it.

Avoiding said thrashing is the job of data security. But how do we go about implementing it? More is more right? Is the weak point the manufactured one, the interface, or the user-patient?

In the yesteryears, everyday tools got away with laconic big WARNING signs. Using a bandsaw for example, one did not have to be a master-luthier to associate mistakes with delimbing one’s self. That is not the case today though, when the tool evolves constantly, along with its associated risks, but the user and his ability to understand it remains the same. We keep stacking new technologies and implementations one upon the other, but leave the user to his own devices? The “binomial” will keep getting more and more precariously balanced.

So, what does the IT-doctor prescribe?

Complete automation?

I mean yes…we could fully restrict and monitor each and every user’s activity to the point where they work on a fully sterilized environment. Will this promote productivity though? And more importantly are we certain we can maintain such condition permanently? Finally, can we persuade our clients that they need to keep paying for such an implementation?

Well, we always come back to the adage (sic) “Τhe user needs the expert and vice versa”.

The users need to be educated and appreciative of the dangers lurking in their work environment. A pop-up warning is not something to be ignored or even scared of.

Simplified and concise knowledge of what the various paraphernalia, installed by the IT department, do is key. Such training will allow the user to better understand and notice irregularities, to trust and inform the IT Department timely and point them in the right direction. Mind you “this icon should be green” should not be considered simplified but rather dumbed down.

“This is my AntiVirus | Firewall | VPN client | OS Updates | […], it does […]” should be something taught and familiar for all users requiring a workstation to function. Such education becoming the norm, will fortify against social engineered attacks/phishing attempts as well.

Starting from the fundamentals makes more “convoluted” necessities & requirements easier to understand and not “just something the IT claims we must do”. Security should never interrelate with inconvenience in the users’ minds.

Clients’ Management & HR understanding and approving the above, will certainly be more amenable to go further down the rabbit hole with triple A controls, backups & recovery, encryption, masking, erasure police etc.

See you all safe and sound in the next installment!

Various tidbits and rumblings by Apostolis Drakakis

Any meme resemblance to actual persons and work conditions is purely coincidental.

The post Data Security and the off-kilter binomial a memeful review appeared first on Creative People | Quality IT services.

When Protocols outpace Chipsets, the Ricoh MPC 2050 case

Apostolos Drakakis Chrysostomos Psaroudakis — Mon, 29 Jun 2020 05:22:19 +0000

It is a recurring phenomenon, in the IoT era, for network devices to be required to send emails and have access to SMTP functionality.

Thus, most device manufacturers attempt to follow through and implement the contemporary security protocols while designing and when firmware patching is possible.

However, only so much can be done by firmware updates on aged chipsets, whereas communications security protocols keep evolving, have their vulnerabilities exposed, depreciating, and getting replaced.

So how do you proceed when such a device finally shows its age?

We were called to resolve such a case when a domestic ISP finally decided it was time to upgrade its mailing services to TLS 1.2. This caused a broad range of all-in-one network printer/scanner/copier devices, used in corporate environments, to be unable to use any of their “mail to…” services as the TLS protocol was not possible to be implemented.

The Work-around.

The client employs a Windows-Server-based infrastructure.

A Windows Server VM was setup and IIS Services, SMTP Server and Telnet client features were installed.

TCP 25 (RFC5321) port was opened.

Minor nitpick: As IIS 8 cannot manage SMTP services, for the rest of the tasks we used the IIS 6 embedded console.

We proceeded with configuring the allowed hosts that can connect to this SMTP server:

Loopback IP and the address of the afflicted network device (in our case a printer/scanner/copier)

Smarthost must be configured next. We used the corresponding mail server of our domestic ISP and the available corporate mail account with enabled TLS.

For the last step we returned to the management interface of the All-in-one device and on the SMTP configuration page we replaced the SMTP server from the IP of our ISP to the IP of the newly-setup Virtual Machine.

The story’s log

Ricoh MPC 2050 incorporates a scan to email functionality many years now, but does not support sending out emails over SSL, therefore we introduced the idea of putting a local smtp server in the network that could handle “unauthenticated” open relay and submit on behalf of the sender through the ISP, in our case Cosmote.

Picked up a vm with low resource consumption footprint and Installed the IIS 8 role and SMTP server feature.

IIS 8 cannot manage smtp service, so we used the IIS 6 embedded console.

Configuring hosts that can connect to this smtp server: 127.0.0.1 and the MFP MPC2050 IP address.

Configured as smarthost the mailgate.cosmotemail.gr using the customer’s email account XXXXXXX@otenet.gr and enabled TLS.

Opened up port 25 TCP incoming on the VM’s windows firewall.

Changed the smtp server on MPC 2050 from the resolved ip of mailgate.cosmotemail.gr to the VM ip address 192.168.2.26.

Unless an IP spoofing is made, the VM’s SMTP will never send out emails of this kind.

Now how to test the setup? We are not there, and we cannot scan.

Testing with the Pickup directory: You can compose a simple e-mail text file (with no extension!!!) based on the SMTP specifications (RFC 822).

Here is the content of a sample text file typed in Notepad:

From: xxxxxxxxx@otenet.gr

To: yyyyyy@creativepeople.gr

Subject: testing

This is the test message body.

Simply copy or move the text file into the Pickup directory where SMTP was installed.

With the above configuration the SMTP service will periodically check the Pickup Directory (%systemdrive%\Inetpub\mailroot\Pickup and %programfiles%\ Exchsrvr\Mailroot\Vsi 1\Pickup if you have Exchange installed.) and will attempt to deliver any messages found in the directory.

The post When Protocols outpace Chipsets, the Ricoh MPC 2050 case appeared first on Creative People | Quality IT services.

Query “query name” is corrupt in MS Access

Chrysostomos Psaroudakis — Fri, 22 Nov 2019 07:10:51 +0000

A MS Office update posted on the 12th of November 2019 has caused several queries to fail with no reason.

If you are running on Office 365, then proceed with the latest Office 365 update.

If you are running other versions of MS Office then:

If you have installed any of the following (according to your Office version) remove it.

- Office 2010: KB4484127
- Office 2013: KB4484119
- Office 2016(x64): KB4484113
- Office 2016(x86): KB3085368

2.Disable MS Office updates for a while

Microsoft has promised a fix in December 2019.

The post Query “query name” is corrupt in MS Access appeared first on Creative People | Quality IT services.

iSCSI disconnects after KB4525243 installation

Chrysostomos Psaroudakis — Thu, 21 Nov 2019 05:38:58 +0000

iSCSI disconnects after KB4525243 installation.

Message: c:\windows\system32\iscsicpl.exe The stub received bad data.

iSCSI to fiber enabled storage is disconnected and iSCSI initiator tries to connect.

VMs are off-Critical as they are stored on the external storage.

Even after restart, the iSCSI initiator can’t connect.

Storage seems to work, but Hyper-V cannot connect to it and mount the drive needed.

Services starting and stopping:

-IP helper

-iSCSI initiator

-Themes and a few more.

Check latest updates installed:

Removed the KB4525243 and rebooted server.

Crashed the profile, because the Event Notification Service could not start.

Services keep start and stop:

-IP helper

-iSCSI initiator

-Themes and a few more.

Entered with the local administrator account

Started services -> Sign out -> Sign in with the Domain Administrator account. Profile is still in an erroneous state. Services stopping unexpectedly.

Initiated Restore of System State from last night’s backup. Note that currently the KB4525243 is removed.

After system restore finished and many restarts took place, the KB4525243 is installed and iSCSI can start with no problem.

Remounted the problematic iSCSI from the storage, only after power cycling the storage.

Remounted using the exact same configuration as in the installation, featuring MPIO and CHAP authentication.

Everything works fine.

Potential causes: We installed the Bitlocker feature while a restart was pending after the KB4525243 installation.

The KB4525243, as described on here, refers to Security updates to Microsoft Scripting Engine, Internet Explorer, Microsoft Graphics Component, Windows Input and Composition, Windows Cryptography, Windows Virtualization, Windows Kernel, Windows Datacenter Networking, and the Microsoft JET Database Engine.

We will examine further.

The post iSCSI disconnects after KB4525243 installation appeared first on Creative People | Quality IT services.

Windows 10 roaming profiles cause Edge and other packaged applications to fail loading

Chrysostomos Psaroudakis — Wed, 06 Sep 2017 17:19:50 +0000

The cause of this seems to be that when a user logs out from Windows 10 sets some essential registry keys to read only. When they logon again these keys are in the wrong state and packaged applications including Edge fail to load. But this seems to be on of the causes, while MS has no fix released since version 1511.

The below is a walkthrough for working this out.

Step1

Make sure your WKS has all latest updates.

Connect to your DC and open the group policy editor

Create a WMI filter for Windows 10 and put the following

Namespace (should be already there): root\CIMv2

Query: select * from WIN32_OperatingSystem WHERE Version LIKE ‘10.0.%’

You may get the following message, ignore it.

Step2

CREATE A GROUP POLICY TO APPLY THIS AS A LOGON SCRIPT

Create a group policy for your domain users called “User-Windows10RoamingProfileFix”. This will be targeted to Windows 10 computers using the WMI filter we created in the previous step.

On the new policy Right Click> Enforced

Right Click > Edit > User Configuration > Policies > Windows Settings > Scripts (Logon/Logoff) > Double Click on Logon > PowerShell Scripts > Add

Click on Browse

Inside the browse popup menu create a new txt file and rename it to

POWERSHELL-SCRIPT-TO-ALLOW-ROAMING-LOGINS.PS1

Make sure you have file extensions on and the file is a ps1 extension (powershell) and not a txt!

Copy paste the following inside the file:

#!PowerShell. De pilo pendet.

# https://social.technet.microsoft.com/Forums/en-US/fd436515-6423-4015-9afe-d7e6034909ab/windows-10-threshold-2-edgesearch-issues-for-domain-joined-pcs

#(c) Christian Ullrich

# copied by James Bayley 2016/01/25

function MakeACE() {

# S-1-15-2-1 is WELL_KNOWN_SID_TYPE::WinBuiltinAnyPackageSid, “APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES”.

# The self-documenting NTAccount type results in an object that “cannot be translated”.

$id = New-Object System.Security.Principal.SecurityIdentifier(“S-1-15-2-1”)

New-Object System.Security.AccessControl.RegistryAccessRule($id,

[System.Security.AccessControl.RegistryRights]::FullControl,

[System.Security.AccessControl.InheritanceFlags]::ContainerInherit,

[System.Security.AccessControl.PropagationFlags]::None,

[System.Security.AccessControl.AccessControlType]::Allow)

}

function GrantRequiredAccess($key) {

$acl = Get-Acl $key

$acl.AddAccessRule((MakeACE))

Set-Acl $key $acl

}

# All Windows 10, since Microsoft apparently managed to break build 10240 as well in December 2015, after having shipped 10586 broken from the start.

#New-EventLog –LogName Application –Source “LogonScript”

#Write-EventLog -LogName Application -Source LogonScript -EntryType Information -EventId 1 -Message “In LoginScript to fix roaming profiles”

if ([Environment]::OSVersion.Version.Major -eq 10) {

# Write-EventLog -LogName Application -Source LongScript -EntryType Information -EventId 1 -Message “Windows 10 detected”

GrantRequiredAccess “HKCU:\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe”

GrantRequiredAccess “HKCU:\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy”

Step3

“ExcludeProfileDirs” Registry Tweak

Continue Editing the above mentioned GPO.
Navigate to: User Configuration > Preferences->Windows Settings->Registry, new registry item. Put the following information

The key path is:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon (don’t copy-paste it, navigate yourself to it!!!!)

On the Value data field you should include the following to support Windows 10 version 1703.

AppData\LocalLow;$Recycle.Bin;OneDrive;WorkFolders;AppData\Local\Comms;AppData\Local\ConnectedDevicesPlatform;AppData\Local\Google;AppData\Local\GroupPolicy;AppData\Local\Mozilla;AppData\Local\Packages;AppData\Local\Publishers;AppData\Local\PeerDistRepub;AppData\Local\Temp;AppData\Local\VirtualStore;AppData\Local\Winternals;AppData\Local\Adobe;AppData\Local\Apple;AppData\Local\AppleComputer;AppData\Local\Autodesk;AppData\Local\Chromium;AppData\Local\CrashDumps;AppData\Local\NVIDIA;AppData\Local\NVIDIACorporation;AppData\Local\Skype;AppData\Local\WebEx;AppData\Local\Foxit Reader;AppData\Local\Macromedia;AppData\Local\Microsoft_Corporation;AppData\Local\Real;AppData\Local\DropBox;AppData\Local\Vmware;AppData\Local\Windows Live;AppData\Local\CrashDumps;AppData\Local\Citrix;AppData\Local\Microsoft\AppV;AppData\Local\Microsoft\Credentials;AppData\Local\Microsoft\Feeds;AppData\Local\Microsoft\Feeds Cache;AppData\Local\Microsoft\GameDVR;AppData\Local\Microsoft\Group Policy;AppData\Local\Microsoft\InputPersonalization;AppData\Local\Microsoft\InstallAgent;AppData\Local\Microsoft\Internet Explorer;AppData\Local\Microsoft\Media Player;AppData\Local\Microsoft\OneDrive;AppData\Local\Microsoft\PenWorkspace;AppData\Local\Microsoft\PlayReady;AppData\Local\Microsoft\Vault;AppData\Local\Microsoft\Windows Live;AppData\Local\Microsoft\Windows Sidebar;AppData\Local\Microsoft\WindowsApps;AppData\Local\Microsoft\Windows\UPPS;AppData\Local\Microsoft\Windows\1033;AppData\Local\Microsoft\Windows\ActionCenterCache;AppData\Local\Microsoft\Windows\Application Shortcuts;AppData\Local\Microsoft\Windows\Burn;AppData\Local\Microsoft\Windows\GameExplorer;AppData\Local\Microsoft\Windows\History;AppData\Local\Microsoft\Windows\IECompatCache;AppData\Local\Microsoft\Windows\IECompatUaCache;AppData\Local\Microsoft\Windows\INetCache;AppData\Local\Microsoft\Windows\INetCookies;AppData\Local\Microsoft\Windows\Notifications;AppData\Local\Microsoft\Windows\OfflineFiles;AppData\Local\Microsoft\Windows\PowerShell;AppData\Local\Microsoft\Windows\PRICache;AppData\Local\Microsoft\Windows\Ringtones;AppData\Local\Microsoft\Windows\RoamingTiles;AppData\Local\Microsoft\Windows\Safety;AppData\Local\Microsoft\Windows\SchCache;AppData\Local\Microsoft\Windows\SettingSync;AppData\Local\Microsoft\Windows\Shell;AppData\Local\Microsoft\Windows\WebCache;AppData\Local\Microsoft\Windows\WER;AppData\Local\Microsoft\Windows\Explorer;AppData\Local\Microsoft\CLR_v4.0;AppData\Local\Microsoft\CLR_v4.0_32

Step4

Continue editing the above group policy for the Applocker part.

Computer Configuration > Policies > Windows Settings > Security Settings > Application Control Policies > AppLocker > Packaged App Rules > Right Click and create Default rules.

Step5

You should now force the group policy update on the problematic WKS (using gpupdate /force via cmd), log off and log on a few times. We had cases that we had to remove the roaming profile and reissue it again for this to work.

The above workaround is a merge of various articles and blog outputs we found on the web, while trying to solve an issue like this. The solution came after applying all of the above, and not one or the other.

Credits and references go to:

The post Windows 10 roaming profiles cause Edge and other packaged applications to fail loading appeared first on Creative People | Quality IT services.

DNS publishing over COSMOTE, is not any more supported?

Chrysostomos Psaroudakis — Fri, 17 Feb 2017 07:40:31 +0000

The past few months COSMOTE, a Greek ISP started providing VDSL access in our country. Right after being very happy about it, we started noticing changes affecting many of our customer services, including proper Domain Name Services data exchange.

The Domain name Service, supports hosting of a domain name zone, servicing clients requesting host A or other records from this DNS, while DNS transfer is a process which enables the Domain Name Zone transfer in a set of prior selected and configured DNS servers.

Our tests, described below, involve both of the above functions.

Test Number	Test description	Request Initiator	Request Receiver	Test Outcome
1	Nslookup from a Cosmote Internet fed client to a zone hosted on Cosmote served server	Server A	Server B	Success
2	Nslookup from a Cyta Internet fed client to a zone hosted on Cosmote served server	Server C	Server B	Failure
3	Nslookup from a Cosmote Cell Internet fed server to a Cosmote served server	Server BC	Server B	Failure
4	Nslookup from a Wind Internet fed server to a Cosmote served server	Server W	Server B	Failure
5	Nslookup from a Forthnet Internet fed server to a Cosmote served server	Server F	Server B	Failure
6	Nslookup from a Vodafone Internet fed server to a Cosmote served server	Server V	Server B	Failure

As it appears on Test 3, the mobile network of Cosmote cannot access a zone hosted on a private server internet fed by the terrestrial Cosmote network. That’s weird, but understandable since the merging between the two is only a few months old.

Ok now let’s see what else is “weird” now. Suppose we have the following 4 servers:

SERVER A: is internet fed by Cosmote ADSL

SERVER B: is also internet fed by Cosmote ADSL

SERVER C: is internet fed by Cosmote VDSL

SERVER D: is also internet fed by Cosmote VDSL

A few more tests described below:

Test Number	Request Initiator	Request Receiver	Test Outcome
7	Server A	Server B	Success
8	Server A	Server C	Failure
9	Server A	Server D	Failure
10	Server D	Server A	Failure
11	Server C	Server A	Failure
12	Server B	Server A	Success
13	Server B	Server C	Failure
14	Server B	Server D	Failure
15	Server C	Server B	Failure
16	Server C	Server D	Success
17	Server D	Server C	Success
18	Server D	Server B	Failure

I will make it a bit less confusing for you. VDSL fed servers communicate with each other. ADSL cannot access the VDSLs and vice versa. The weird things is that both the ADSL and VDSLs are provided by the same ISP, which in all our cases is COSMOTE.

We should note, that all the above servers have Business accounts (connex @ Work).

As IT professional we can tolerate with:

VPN connections dropping every 3 minutes, with no reason.
Cosmote routers having their firmware updated, whenever the provider asks, using their CPL
SIP ports being occupied for Cosmote future VOIP usage.

What we cannot tolerate is the DNS protocol and especially when there is no previous notification regarding such a service ban.

I really do wonder, what is next? The SMTP?

Thank you Cosmote for protecting us, but I guess we will protect ourselves and change all our customers to non Cosmote ISPs.

We take as:

Failure: the timeout of DNS query (using nslookup) pointed on a working DNS server (server [ip]) and on an existing well shaped dns zone.

Success: a successful dns query (using nslookup) presenting back all dns records of the requested zone (set q=all/ set q=any)

17/2/17 UPDATE: The above started happening with port 25 (SMTP) randomly.

The post DNS publishing over COSMOTE, is not any more supported? appeared first on Creative People | Quality IT services.

Msg 8152, Level 16, State 10 String or binary data would be truncated. The statement has been terminated.

Chrysostomos Psaroudakis — Tue, 14 Feb 2017 13:54:56 +0000

It appears that when you want to “insert into” data from an nvarchar(max) field to another nvarchar(max) field, and the table has a lot of data the ms sql query is terminated giving you the error

Msg 8152, Level 16, State 10 String or binary data would be truncated The statement has been terminated.

After narrowing down data fields and understanding which field is the problematic one, and given that the source field is nvarchar(max) and so is the destination, you need to go on troubleshooting this.

Suppose I have the following query:

INSERT INTO ServiceJournal

(PriorityID, TechnicianID, ServiceTaskID, ClientID, ServiceDate, ProblemReportDateTime, EventTypeid, ReminderID, CustomerSiteID, DetailedProblemDescription)

SELECT 3 AS Expr1, Customers.EmployeeResponsibleID, 16 AS Expr2, Customers.CustomerID, GETDATE() AS Expr3, GETDATE() AS Expr4, 2 AS Expr5, 2 AS Expr6, 1 AS Expr7, Customer_Tasks.TaskDescription

FROM Customer_Tasks INNER JOIN

Customers ON Customer_Tasks.CustomerID = Customers.CustomerID

WHERE (Customer_Tasks.IsMaintenance = 1)

The field DetailedProblemDescription is the one producing the problem.

I tried creating a new field on the destination table ServiceJournal, called test as nvarchar(max) and changed my query to

INSERT INTO ServiceJournal

(PriorityID, TechnicianID, ServiceTaskID, ClientID, ServiceDate, ProblemReportDateTime, EventTypeid, ReminderID, CustomerSiteID, test)

SELECT 3 AS Expr1, Customers.EmployeeResponsibleID, 16 AS Expr2, Customers.CustomerID, GETDATE() AS Expr3, GETDATE() AS Expr4, 2 AS Expr5, 2 AS Expr6, 1 AS Expr7, Customer_Tasks.TaskDescription

FROM Customer_Tasks INNER JOIN

Customers ON Customer_Tasks.CustomerID = Customers.CustomerID

WHERE (Customer_Tasks.IsMaintenance = 1)

The script inserts a number of rows, as it should!

I tried to rename the problematic field to DetailedProblemDescription2 and retry. It does not work.

I backed up the field data to another field and deleted the field. This is where I started losing the table integrity. I had to take the data with an export script, drop and recreate the table (taken from a backup) and restore the data.

Need to mention that concatenating the DetailedProblemDescription field with cast (DetailedProblemDescription as nvarchar(4000)) or other data type, did not work as well.

To make a long story short, I overcame the insert into problem by putting

SET ANSI_WARNINGS OFF;

SET ANSI_WARNINGS ON;

As long as the “problematic” field characters don’t go over 4000 characters, no problem occurs. I will need to test it with more in the next months.

Have no time to investigate this further, but worth’s writing it down and sharing:)

Till next time!

The post Msg 8152, Level 16, State 10 String or binary data would be truncated. The statement has been terminated. appeared first on Creative People | Quality IT services.

How to Upgrade or Change OS of PCs with Preinstalled Windows 8.1 & Windows 10

Chrysostomos Psaroudakis — Wed, 09 Mar 2016 14:42:52 +0000

There are times that moving personal computers to corporate environments, without applying a BYOD policy, drive us to replace the preinstalled OS of our computer. For instance there is the need to upgrade our OS from Home to Professional edition in order the computer to join a domain.

For Windows Up to the 8 edition, that was done, by formatting the computer and reinstalling by using the purchased Retail or other license of the desired Windows OS version. The upgrade was a rather hectic process and the older the OS, the more problems you had.

Things are different now with Windows 8.1 and 10!

You purchase a new laptop with a Windows 10 Home OEM license from your local distributor and you get down to upgrade to Professional. Bad luck! You can’t! Even if you totally wipe your HDD and put your legitimate Windows 10 Pro media and install, after the installation you pc will still boot on Windows 10 Home!

Let’s ask the experts….we called Microsoft, as partners and asked! Here’s the story.

Microsoft’s new policy for OEM computers that come with preinstalled Windows 8.1 and Windows 10 is to hardcode the OS Version and License Key within the computer’s chipset! This policy is applied by all computer manufacturing companies, therefore there is no way even by formatting the hard drive to install a different OS or even an alternate Version of the same OS. Microsoft’s “safety” mechanism will come forth and will install the same OS Version as the OEM (e.g Home) even if you try to install another Version of the same OS (e.g. Pro) via DVD or USB. If you try to install a complete different OS (e.g Windows 10) than the OEM (e.g Windows 8.1) then hardcoded OS License Key conflicts with the OS License Key that you installed and renders your OS as not Genuine. The same applies even if you just swap the OEM HDD with a preinstalled HDD that has a different OS version than the OEM.

Fortunately there is a workaround regarding this matter. The following steps show the way.

Let’s assume for this example that you purchased a laptop that came with preinstalled Windows 10 Home and you want to upgrade it to Windows 10 Pro.

By using your newly purchased laptop or a different computer you need to download the MediaCreationTool.exe from HERE .

This tool will guide you to download a Windows 10.iso file that is suitable for your computer.

After you download the ISO file, open it with an ISO editing application (Ultra ISO or a similar).

Then you need to create two files that will allow the new OS to be installed.

For the first file create a .txt file and copy in it the following:

[EditionID]

Professional

[Channel]

OEM

[VL]

Save it as EI.cfg .

P.S. In channel type RETAIL if the OS License Key is a retail acquired license.

For the second file create a .txt and copy in it the following:

[PID]

VALUE= type_in_your_windows_license_key

Save it twice, one as PID.txt and one as PID.cfg

Copy the three files (EI.cfg, PID.txt and PID.cfg) to the Sources folder of the iso file that you downloaded.

Recompile or save the .iso file and either burn it into a bootable DVD or create a bootable USB stick.

Restart the computer and boot either from your media.

Complete formatting the HDD and enjoy your new upgraded OS.

Cheers, till next time!

Written and tested by Creative People Team, Andreas Lavazos and Chrysostomos Psaroudakis

The post How to Upgrade or Change OS of PCs with Preinstalled Windows 8.1 & Windows 10 appeared first on Creative People | Quality IT services.

How to create Microsoft HyperV cluster

Chrysostomos Psaroudakis — Sun, 07 Feb 2016 14:46:50 +0000

Prerequisites

We will need:

An ISCSI enabled Network Attached storage, like QNAP.
2 PC/Server with equal number of NICs (4+ NICs needed) /RAM and CPU type
A working active directory domain on Windows 2012 R2

For proper HyperV operation you will need n+1 NICs where n is the number of vms hosted on the hypervisor.

For the cluster we are about to build we need 3 NICs on each node of the cluster, plus n NICs for the n number of VMs we are about to host.

Make a good sketch of your solution, in order to have nic ips/configuration handy at all times during the installation or troubleshooting.

On the sketch above you will identify that each of the nodes (node03/node04) have 3 nics configured (the rest NICs are virtual switched on the HyperV and therefore have no part on this sketch)

1x NIC for each node connected to network switch (that’s the interface we will use for joining the pc/server on our domain. On our scenario NODE03 has the ip 10.124.10.3 and NODE04 10.124.10.4.
1x NIC for each node connected to the RSO/NAS (directly or via switch). On our scenario NODE03 has the ip 172.16.0.1 and NODE04 172.16.0.2.
1x NIC for each node connected to each other (no need for a cross cable if auto mdix is applicable on your NICs-it’s a standard nowadays. We call this the heartbeat cable, where each cluster node gets the status of its partner node. On our scenario NODE03 has the ip 192.168.1.1 and NODE04 192.168.1.2.

Join all on the same domain

Ensure all nodes (hyper –V servers ) and Qnap are joined to the same Active Directory Domain.

Organise and name your nodes NICs

Configure Network cards NICs for Failover Cluster: Rename all Network cards and make names identical on both servers in order to save yourself from auto moving questions of resources. Be very cautious on identifying the physical location of each NIC.

a. Rename all Network cards

b. Rename the Domain Network NIC as Production and deselect unnecessary protocols and features

IPv6 is up to the installers hand to enable or disable. Proceed according to your internal network specs.

IPv6 should be unchecked.

Make sure Register this connection’s address in DNS is checked,

Check option “Register this connection’s addresses in DNS”.

At WINS tab Enable NetBIOS over TCP/IP option.

c. Configure the RSO NICs as RSO and deselect unnecessary protocols and features

IPv6 was deselected on our scenario in order to avoid IPv6 communication failures.

d. Configure the HeartbeatNICs as Heartbeat and deselect unnecessary protocols and features

Uncheck IPv6

Watch it now! Put the heartbeat ips with no Gateways, no DNS servers.

Make sure Register this connection’s address in DNS is NOT checked,

and make sure NetBIOS over TCP/IP is NOT checked!

Your Heartbeat NIC properties should look like this

e. Set the Network Priority (arrange binding order)

Navigate to Advanced Settings, though Network and Internet ->Network connections.

Open your network connections and click Advanced>Advanced Settings

Arrange the adapter binding order as follows:

Production
Storage
Heartbeat

This is very importart to how each node responds and reacts to network requests. If you ommit this step latencies in cluster behaviour related to network access or interoperability with other network resources may occur.

Configure NAS/RSO

We assume you have already configured your Raid. (Best results we have achieved on COTs systems are Raid 10 and Raid 6). On our scenario we used a QNAP with 5 HDD RAID6 array.

a. Configure Shared Storage (iSCSI Target)

Fire up your ISCSI configuration wizard and enable iSCSI target service on its 3260 default port.

Enable iSCSI Target Service at port 3260

Through iSCSI Storage’s Configuration Wizard,

Select to create iSCSI Target with a mapped LUN(Logical Unit Number).

Create a new iSCSI target with a mapped LUN

VERY IMPORTANT!

“Target Name” and “Target Alias” should be Quorum.

Clustering access to iSCSI target from multiple initiators must be “Enabled”.

Name it Quorum. That’s the most important shared storage resource of the cluster since the cluster configuration is exchanged between nodes through it.

Make sure you check the Enable clustering access to the iSCSI target from multiple initiators in order to avoid data corruption, occuring on simitaneously iSCSI connections and prepare this part of the storage for CSVFS.

Don’t use chap authentication, unless needed.

Don’t use more than 1GB for the Quorum, since you will never exceed it.

Allocate space from your storage pool.

For performance purposes we select “Allocate space from a storage pool as an iSCSI LUN”. On the other hand the disk space is pre-allocated making it your Cluster storage more secure in cases of rapid data deployment in the rest of its free disk space.

Proceed making the above steps again 2 times. Each for the following names:

ClusterDisk1, with allocated space as prefered
ClusterDisk2, with allocated space as prefered

You need at least one Cluster Disk, in case you need more resources prepare more.

At the iSCSI target list you will see the iSCSI targets you just created.

Quorum and Cluster Disks should appear as “Ready” after the initialization of the iSCSI storage.

After finishing with our NAS configuration, we proceed with NODES.

b. Connect to iSCSI targets from both Nodes

Both Nodes must be connected to our Storage using iSCSI Initiator (though Server management Tools).

From your server manager, select tools iSCSI initiator. A message will come up informing you that the iSCSI initiator service will start automatically next time windows loads.

On the discovery tab hit Discover portal

Be rather cautious to put the ip of the RSO belong to the nodes RSO network, eg. on our example 172.16.0.xxx

Discovery should find the IP address and Port of your iSCSI target (make sure your cluster nodes RSO nics and iSCSI RSO are on the same switch or VLAN.

Following that, though Targets tab, you should be able to see your disks (including Quorum) as “Inactive”.

Proceed connecting them. Go back on the targets tab, hit refresh and when the list is populated hit connect.

Do the above on both nodes

c. Initialize disks

On the first node open Disk Management console. Right click on each of the new hard disks appearing and select online.

Initialize the disk

and create a new simple volume

Assign the drive letter Q for Quorum, we don’t care what you put on the rest.

Format it as NTFS and name it Quorum

Proceed with the same process for ClusterDisk1 and 2, put whatever drive letter you like. At the end of the process you will see the below.

Launch disk management on the second node and “online” the already made HDDs.

HYPER-V installation on both Nodes

Though Manage Tab, select ”Add Roles and Features”.

From Server Roles, select the Hyper-V role and proceed.

Include management tools and proceed adding the feature.

Create Virtual Switch (Production) on both Nodes

On your Hyper-V Manager console select the Virtual Switch Manager action on the right.

Create a New Virtual Network Switch. Type: EXTERNAL. Make sure you don’t select ANY of your RSO or Heartbeat NICS!

Name the Virtual switch, assign appropriate NIC and check the option “Allow management operating system to share this network adapter”.

Do the same on both nodes.

Install Failover Cluster Roles Features on both Nodes

Through the “Add Roles and Features” we proceed to “Features.

Select the “Failover Clustering” and proceed.

Do the same on both nodes.

Validate the cluster configuration

Pick up one of the two Nodes and run the Cluster Validation configuration tool.

Next steps shown below will be performed to validate cluster’s failover configuration.

Since all nodes are “Validated” we can proceed creating the Failover Cluster.

Create the Hyper-V Failover Cluster

We proceed to create cluster through Failover Cluster Manager.

Make sure all required servers have been selected (separated by a comma “,”).

Provide the cluster name, revise that addresses are correct for each network that is part of the Failover Cluster.

Your Cluster has completed, revise again summary.

Rename Cluster Networks for easy understanding and mapping to the physical node NICs.

Through Failover Cluster Manager, we configure networks’ names and communication permissions.

Specifically, at Heartbeat network we ONLY allow cluster network communication.

At production Network, we allow cluster network communication AND also allow clients to connect through.

At Storage network we DO NOT allow any cluster network communications.

Also through the above steps, we have the chance to check one again that subnets have been assigned correctly.

Enable Cluster Shared Volumes

Following cluster’s networks configuration, we are ready to ADD storage disks to our cluster.

Through Failover cluster manager -> Storage -> Disks, we should see our Cluster Disks marked as “AVAILABLE STORAGE”. Selecting one by one we proceed adding them to “Cluster Shared Volumes”.

WE DO NOT TAKE ANY ACTION ON QUORUM DISK!

At the end of process all added disks should be marked as “Assigned to Cluster Shared Volume”.

Create a VM and Configure for High Availability or make an Existing VM Highly Available

Test the Failover Cluster by shutting down the node having the VM resources. If you see VMs moving to other node you are ready to start serving clients. Further tests should be made regarding the VMs functionality.

Written and tested by Creative People Team, Costantinos Koptis, Andreas Lavazos and Chrysostomos Psaroudakis

The post How to create Microsoft HyperV cluster appeared first on Creative People | Quality IT services.