Most of your commands will be in the Exchange Management Shell so open that up.  First command you will need to run is:

Get-WebServicesVirtualDirectory | Select name, *url* |fl

Which will output something like this:

Name                 : EWS (SBS Web Applications)

InternalNLBBypassUrl : https://site.domain.local/EWS/Exchange.asmx

InternalUrl          : https://mail.site.com/ews/exchange.asmx

ExternalUrl          : https://external.site.com/EWS/Exchange.asmx

In my case I registered mail.site.com and the mismatch was with external.site.com.  above is my final product as only InternalUrl needed to be changed.  I didn’t mess around with ExternalUrl as the issue is fixed now. One you run the above command you will need to take note of everything after Name (EWS (SBS Web Applications)).

You will then need to run some commands.  Please reference the following Microsoft article:

http://support.microsoft.com/kb/940726/en-us

CAS_Server_Name = your registered url or internal server name, I didn’t find that it mattered.

Note that the KB article is intended for regular exchange and not SBS 2008 so my commands have some modifications.  In a nutshell we need to substitute Default Web Site with SBS Web Applications.

below are the commands that I used based on this article:

Set-ClientAccessServer -Identity site.domain.local -AutodiscoverServiceInternalUri https://mail.contoso.com/autodiscover/autodiscover.xml

Set-WebServicesVirtualDirectory -Identity “EWS (SBS Web Applications)” -InternalUrl https://mail.site.com/ews/exchange.asmx

Set-OABVirtualDirectory -Identity “oab (SBS Web Applications)” -InternalUrl https://mail.site.com/oab

Set-UMVirtualDirectory -Identity “unifiedmessaging (SBS Web Applications)” -InternalUrl https://mail.site.com/unifiedmessaging/service.asmx

Once you run the above commands you can continue on step 6 of the referenced MS KB article.

After I completed this I noticed that a send and receive did not complete successfully.  I got to about 97% and received the following error:

task microsoft exchange reported error (0×8004010f) the operation failed. an object cannot be found

to fix this error you need to make sure you are managing a forward zone for your domain, in this case site.com.  for my internal users I needed mail.site.com to resolve to the internal IP address of my server.  I noticed the internal IP wasn’t set so I changed this value.  Once that was completed everything worked like a charm.

Hope this helps, please comment if you need anything else.

 Run a full backup on your MS 2003 standard server

1. Make sure your domain has been  promoted to domain functional level and forest function level of Windows Server 2003.
   1. To upgrade open up Active Directory Domains  and Trustes
   2. Right click Active Directory Domains and Trusts and click Raise Forest Functional Level

                                    i.      Upgrade to windows server 2003

                                    ii.      This will upgrade your forest

1. Now right click your domain and click raise domain functional level

                                     i.      Upgrade to windows server 2003

                                    ii.      This will upgrade your domain

1. To verify everything is setup properly open up Active Directory Users and Computers
2. Right click your domain and go to properties

                                     i.      Both domain and forest functional levels should have windows server 2003 underneath them

1. Check event viewer and make sure there are no errors, especially dns or replication errors
2. Stick in SBS 2008 disk 1 DVD into the Windows 2003 Standard server (source server)
   1. Open up a command prompt
   2. Change directories to cdrom drive\tools\adprep
   3. Run “adprep /forestprep”

                                      i.      Let this complete and make sure everything is successful

1. Run “adprep /domainprep”

                                        i.      Let this complete and make sure everything is successful

1. Run “adprep /domainprep gpprep”

                                        i.      Usually this wont run because the above commands did the trick

1. Now open execute cdrom drive \tools\sourcetool.msi (this is a gui)
   1. Install the migration program
   2. After you install it run the wizard
2. Now you will need to create an answer file
   1. You can now follow the SBS 2003 to SBS 2008 migration guide provided by Microsoft.
   2. This document is located here: http://www.microsoft.com/downloads/details.aspx?FamilyID=52b7ea63-78af-4a96-811e-284f5c1de13b&displaylang=en
   3. I started on page 17, but you are welcome to start at page 1

Social networking is spreading like wild fire.  People are replacing traditional communication with social networking sites like facebook.  While this is great for people to stay in touch it poses a big security risk.  We are noticing that many people are posting way too much information on facebook.  Did you know that once you upload a picture to facebook you no longer own the rights?  Facebook can use your photos on their site exclusively without any further notice to you. 

Using privacy features on facebook does not always work.  There have been mistakes on facebook which cause people’s profile to be publically available.  This means that Google could cache your information which will remain on the internet forever.  Google and many other companies store everything indefinitely and have no delete options.

Whenever you post something on facebook keep in mind that everyone is watching.  Do not put anything up you don’t want your mom to see.  Also do not put anything that could cause current or future harm.  Criminals are getting very tech savvy and use various web sites to plan their attack.  That means that you should not advertise to the whole world you are leaving for a vacation for a week (you could come home to an empty house). 

Being the top computer security company in Denver NOYNIM is here to help.  Please visit our website for more security information or call us at 720.524.8616 if you want to get secure.

PhotoRec is file data recovery software designed to recover lost files including video, documents and archives from Hard Disks and CDRom and lost pictures (thus, its ‘Photo Recovery’ name) from digital camera memory. PhotoRec ignores the filesystem and goes after the underlying data, so it will still work even if your media’s filesystem has been severely damaged or re-formatted.

PhotoRec is free, this open source multi-platform application is distributed under GNU Public License. PhotoRec is a companion program to TestDisk, an app for recovering lost partitions on a wide variety of filesystems and making non-bootable disks bootable again.

http://www.cgsecurity.org/wiki/PhotoRec

Partedmagic

Parted Magic is a Linux LiveCD/USB/PXE with its elemental purpose being to partition hard drives and is not designed to be a “Rescue CD” nor is it based on another Distribution.

Optimized at approximately 45MB, the Parted Magic OS employs core programs of GParted and Parted to handle partitioning tasks with ease, while featuring other useful programs (e.g. Partition Image, TestDisk, fdisk, sfdisk, dd, ddrescue, etc.) and an excellent set of documentation to benefit the user. An extensive collection of fileystem tools are also included, as Parted Magic supports the following: ext2, ext3, ext4, fat16, fat32, hfs, hfs+, jfs, linux-swap, ntfs, reiserfs, reiser4, and xfs.

The latest version is updated with: Linux 2.6.24.3, Parted 1.8.8, ntfsprogs-2.0.0, ntfs-3g-1.2506, and GParted-0.3.7.

Parted Magic uses Busybox for basic Unix commands and networking, the Dropbear SSH server and client, and Firefox to surf the web.

The current Xserver is xorg-server-1.4.0.90 with the following drivers: apm, ark, ati, chips, cirrus, cyrix, glint, i128, i740, i810, mga, neomagic, nv, r128, riva128, radeon, rendition, s3, s3virge, savage, siliconmotion, sis, tdfx, tga, trident, tseng, vesa, vmware, and voodoo.

The mini Xserver, Xvesa, is also available.

TestDisk

TestDisk is a powerful free data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table). Partition table recovery using TestDisk is really easy.

Foremost

Foremost is a console program to recover files based on their headers, footers, and internal data structures. This process is commonly referred to as data carving. Foremost can work on image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive. The headers and footers can be specified by a configuration file or you can use command line switches to specify built-in file types. These built-in types look at the data structures of a given file format allowing for a more reliable and faster recovery.

Scalpel

Scalpel is a fast file carver that reads a database of header and footer definitions and extracts matching files from a set of image files or raw device files. Scalpel is filesystem-independent and will carve files from FATx, NTFS, ext2/3, or raw partitions. It is useful for both digital forensics investigation and file recovery. Scalpel resulted from a complete rewrite of foremost 0.69, a popular open source file carver, to enhance performance and decrease memory usage.

The Sleuth Kit

The Sleuth Kit (previously known as TASK) is a collection of UNIX-based command line file and volume system forensic analysis tools. The file system tools allow you to examine file systems of a suspect computer in a non-intrusive fashion. Because the tools do not rely on the operating system to process the file systems, deleted and hidden content is shown.

The volume system (media management) tools allow you to examine the layout of disks and other media. The Sleuth Kit supports DOS partitions, BSD partitions (disk labels), Mac partitions, Sun slices (Volume Table of Contents), and GPT disks. With these tools, you can identify where partitions are located and extract them so that they can be analyzed with file system analysis tools.

When performing a complete analysis of a system, we all know that command line tools can become tedious. The Autopsy Forensic Browser is a graphical interface to the tools in The Sleuth Kit, which allows you to more easily conduct an investigation. Autopsy provides case management, image integrity, keyword searching, and other automated operations.

PartitionSupport.com

Provides a host of functions for recovering data from damaged file systems of all kinds http://www.partitionsupport.com/utilities.htm

To uninstall windows internal database you will need to do the following:

1) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server
Edit the “InstalledInstances” value and remove “MICROSOFT##SSEE”

2) Remove the “MICROSOFT##SSEE” subkey under
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server

3) Remove the “MSSQL.2005″ subkey under
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server

4) Rename the following folder:
\%Windir%\SYSMSI\SSEE\MSSQL.2005\MSSQL\Data to \%Windir%\SYSMSI\SSEE\MSSQL.2005\MSSQL\Data.old

After you are done with this step, try to uninstall windows internal database, it should work.

Now that you have windows internal database uninstalled, we will need to uninstall wsus 3.0

You will need to do the following:

Go to:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Update Services\Server\Setup]

Change the value for “wYukonInstalled” from 1 to 0

After you do this you will need to uninstall wsus, this is done by clicking the same file you use to install wsus.

After you do this you should be able to install wsus 3.0

/etc/apache2/sites-available

Once you are in there, edit the default site (vi default):

Under virtualhost, you will see a <Directory /> and the next line should be Options followed by +FollowSymLinks

Next, -Indexes so it should look something like this:

DocumentRoot /var/www/
CustomLog /var/log/apache2/access.log common
ServerName 192.168.0.1

Options +FollowSymLinks -Indexes
AllowOverride none

After this, make sure to restart apache2:

/etc/init.d/apache2 restart

Filter out what you want to look for.  If you want to filter out anything coming and going into 192.168.0.1 you will need to do the following:

Snoop filter IP 192.168.0.1

Once you turn on the filter, you will need to enable snoop which is done by just typing in snoop.

After you generate the traffic you will use the get dbuf command to view it.

One dbuf command that i like is ‘get dbuf stream’. If you want to see other commands just issue a ? after the command. For example, you can issue ‘get dbuf ?’ which will show the following:

computer repair Denver-> get dbuf ?
info show debug buffer info
mem show debug buffer memory content
stream show debug buffer stream

So, to recap you can issue the following commands to sniff and view traffic for 192.168.0.1 (both incoming and outgoing)

snoop filter ip 192.168.0.1
snoop
get dbuf stream

Once you are done, you can issue ’snoop off’ to turn the sniffing off.

MessageBox: 12582960,”Failed to install.
For troubleshooting tips, please see http://www.adobe.com/go/tn_19166″

Do the following:

Download SubInACL by going to:

http://www.microsoft.com/downloads/details.aspx?FamilyID=E8BA3E56-D8FE-4A91-93CF-ED6985E3927B&displaylang=en

Once you have this installed create a file named “reset.cmd” You can use notepad to create this file, but make sure its not a text file.

In the file add the following:

cd “C:\Program Files\Windows Resource Kits\Tools”
subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f
subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f
subinacl /subdirectories %SystemDrive% /grant=administrators=f
subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=system=f
subinacl /subkeyreg HKEY_CURRENT_USER /grant=system=f
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=system=f
subinacl /subdirectories %SystemDrive% /grant=system=f

Execute reset.cmd and let this run; this should allow you to install adobe flash. You might notice some errors but ignore them as they do not really matter.

MessageBox: 12582960,”Failed to install.
For troubleshooting tips, please see http://www.adobe.com/go/tn_19166″

Do the following:

Download SubInACL by going to:

http://www.microsoft.com/downloads/details.aspx?FamilyID=E8BA3E56-D8FE-4A91-93CF-ED6985E3927B&displaylang=en

Once you have this installed create a file named “reset.cmd” You can use notepad to create this file, but make sure its not a text file.

In the file, add the following:

cd “C:\Program Files\Windows Resource Kits\Tools”
subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f
subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f
subinacl /subdirectories %SystemDrive% /grant=administrators=f
subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=system=f
subinacl /subkeyreg HKEY_CURRENT_USER /grant=system=f
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=system=f
subinacl /subdirectories %SystemDrive% /grant=system=f

Let this run and then it should allow you to install Adobe Flash. You may notice some errors but ignore them, as they don’t really matter.