Friday, March 3, 2017

Raspberry PI - ADS-B

I have been working on a few Raspberry PI projects and seem to be a consistently drawn to an ADS-B project.
The context is that I was planning a Flight Data Recorder (GPS, Gyro, and G-meter) for recording an Aerobatic flight, and find that there are several initiatives that use very similar components to build an ADS-B device.

My thoughts are that the Data logging and the ADS-B projects could be combined to create a "black box" recorder that could used for 3 target markets:
  1. ADS-B out as per the original project.
  2. Data Logging for Aerobatic flight analysis as well as Schools and shared planes.
  3. "Black Box" information in the event of an accident or crash.  

The projects of interest are:



Monday, May 30, 2016

Use Splatting, Proxy, and Metadata in Powershell

Use Splatting, Proxy, and Metadata in Powershell

  • Splatting is the ability to use a dictionary or a list to supply parameters to a command.

    Example:
    $MailMessage = @{
        To = “me@mycompany.com
        From = “me@mycompany.com
        Subject = “Hi”
        Body = “Hello”
        Smtpserver = “smtphost”
        ErrorAction = “SilentlyContinue”
    }
    Send-MailMessage @MailMessage
  • Proxy commands are wrappers of existing commands in Windows PowerShell, and to make this possible, a number of different things had to be enabled in the language that can have interesting other uses.
  • Metadata provides information about the command and parameters of different commands, and provides a structure that you can use to “write” a command without typing out the whole script.

https://blogs.technet.microsoft.com/heyscriptingguy/2010/10/18/use-splatting-to-simplify-your-powershell-scripts/

Tuesday, April 19, 2016

Running Windows Explorer with different "RUNAS" credentials



As part of securing access to Active Directory, and following the Least Privileges Principle, it has been a goal of mine to be able to run all Administrative Tasks on a Management workstation while only logging in to the workstation using a generic, minimum Privileges user account.


While most management consoles can be launched in a "RUNAS" mode, it has been an Achilles Heel that it has always been thought that you could not run Windows Explorer in a RUNAS.   This prevents you from doing File System Permission management.


Well, my genius friend (who is an absolute wizard at Google Searches) has found an answer.


Follow the step below to do it. 
  1. Start the Registry Editor as an Administrative User.
  2. Navigate to, take ownership of, and grant yourself Full Control permission to the key HKEY_CLASSES_ROOT\AppID\{CDCBCFCA-3CDC-436f-A4E2-0E02075250C2}
    (This is "Elevated-Unelevated Explorer Factory")
  3. Rename the value RunAs to _RunAs.
  4. Close Regedit.
  5. runas /user:domain\username "c:\windows\explorer.exe /separate"
     
OR another description:

  1. Start -> Run -> regedit
  2. Navigate to the registry key: HKEY_CLASSES_ROOT\AppID{CDCBCFCA-3CDC-436f-A4E2-0E02075250C2}
  3. Right click on the registry key and click Permissions…
  4. Give Full Control permissions to the user logged in.
  5. Start -> Run -> dcomcnfg.exe -> Expand DCOM Config
  6. Right click and select properties of “Elevated-Unelevated Explorer Factory”, click the Identity tab and select “The launching user”

Friday, April 15, 2016

Active Directory Last Logon. Lots of confusion

I am sure that everyone who administrates AD runs into this problem at some point.

Here is an article that thoroughly lays it all out.

http://social.technet.microsoft.com/wiki/contents/articles/22461.understanding-the-ad-account-attributes-lastlogon-lastlogontimestamp-and-lastlogondate.aspx

The summary of this article is, that if you want to find out the TRUE last logon activity for a user, it is best to use the command

Search-ADAccount -AccountInactive -DateTime ((get-date).adddays(-90)) -UsersOnly

If you are ONLY interested in dates that are more than 14 days ago, then you can safely use the "LASTLOGONDATE" attribute.  

Less than 14 days of viewing and you cannot rust this attribute.  You must get fancy and query all of the DC's individually. 

Sunday, February 21, 2016

6 Tips for troublsheooting Active Directory (Link)

I found this article quite helpful.  It contains some excellent detailed information.

https://redmondmag.com/articles/2009/07/01/6-tips-for-troubleshooting-active-directory.aspx

Especially detailed is the AD Diagnostics Registry settings:




Tuesday, December 29, 2015

Fix Trust Relationship if a simple Computer password reset is required

Fix Trust Relationship if a simple Computer password reset is required

http://blog.blksthl.com/2013/03/18/fix-the-trust-relationship-between-this-workstation-and-the-primary-domain-failed/

This is dead simple, but if you were not aware, you do not necessarily need to rejoin the domain if the trust relationship is broken with AD.  Just resetting the password is all .

Steps using Powershell:
  1. Login locally to the server
  2. Run the PowerShell command:
Reset-ComputerMachinePassword -Server -Credential

Restart-Computer


Thursday, December 24, 2015

Migrating Public Folders Exchang 2007 to 2013

There are lots of great blogs out there on how to do the overall migration of Public folders from previous versions of Exchange to 2013, but few of them detailed how to deal with a few choice issues that I encountered in a recent migration that I performed.


For a good, detailed, checklist of how to do the migration, see any of the following:






My migration was for 50,000 folders, and about 130GB of data.


The issues that I ran into were (but not limited to):

  •     Needing a System Attendant mailbox on each server hosting Public Folders
  •     Spaces at the end of the names of folders
  •     Invalid characters in the Alias attribute, and
  •     Invalid SMTP email addresses in Mail-Enabled Public Folders

Each of these had to be fixed before I could start the migration.


System Attendant Mailbox required

This is actually fairly well documented, but I had missed it and the symptoms in no way pointed me to the root cause of the problem.

Basically, each server that hosts a Public Folder requires this System Attendant mailbox.  In my case I had no Mailbox Databases on the PF servers.

The symptom is that in the detailed log of the PublicFolderMigrationRequest indicated "

Transient Error: MapiExceptionUnknownUser: Unable to make connection to the server. (hr=0x80004005, ec=1003)


This was resolved by creating a mailbox database on each server, and then also restarting the "Microsoft Exchange System Attendant" service.  That created the system attendant ID automatically.


Spaces at the end of a folder name


The first problem was identified when I ran the command


Get-PublicFolder -Recurse | Export-CSV C:\PFs\2010_PFStructure.csv -NoTypeInformation

  This was easy to fix following this article:


The issue with this simple script is that the script in this article runs against all folders.


Get-PublicFolder -Identity "\" -Recurse -ResultSize Unlimited | Foreach { Set-PublicFolder -Identity $_.Identity -Name $_.Name.Trim() }


To improve this, I modified the command to skip folders that did not need to be updated.  Speeds up the command significantly. I also added a log file entry for each folder being processed.

$Logfile = "Fix-Trimmed-Names-001.log"
Get-PublicFolder -Identity "\" -recurse -ResultSize Unlimited | %{
  write-host "Scanning $($_.identity)";
  add-content $logfile -value "Scanning $($_.identity)";
  if ($_.name -ne $_.name.trim() ) {
    write-host "fixing [$($_.name)]" -foregroundcolor yellow;
    add-content $logfile -value "fixing [$($_.name)]"
    Set-PublicFolder -Identity $_.Identity -name $_.name.trim()
  }
}


 Invalid characters in the Alias attribute

 The Alias property of a Public Folder cannot contain Spaces, Periods, Commas, @, and even an Apostrophe.   The following script removed these characters.  (Note that the script is a little rough, but you can figure it out).


[PS] >type .\Fix-Alias-001.ps1
$Names = get-mailpublicfolder -resultsize unlimited |?{$_.Alias -like "* *"}
#$Names = get-mailpublicfolder -resultsize unlimited |?{$_.Alias -like "*.*"}

foreach ($name in $Names) {
  $newAlias = $name.alias
  $newAlias = $newAlias.replace(" ","_")
  $newAlias = $newAlias.replace("@","&")
  $newAlias = $newAlias.replace("(","{")
  $newAlias = $newAlias.replace(")","}")
  $newAlias = $newAlias.replace(",","~")
  $newAlias = $newAlias.replace(".","~")
  $newAlias = $newAlias.replace("'","~")
  set-mailpublicfolder -identity $name.identity -alias "$newalias"
}


Invalid SMTP email addresses in Mail-Enabled Public Folders

 This seems to have occurred for reasons similar to the Alias issue.  I was told that the users did not intentionally create Public Folders as Email-Enabled, therefore, rather than dig into fixing each of the mailboxes to change teh SMTP name, we elected to simply run a "Disable-MailPublicFolder" against each of the mail-enabled public folders.   End of issue.