Where I’m @

20040429

Workstation Lookups
In our new role as sysadmin, we have had to get better acquainted with Windows event logs than ever before. One thing we are still having trouble with, though, is tracking down a workstation based on its name. In the security event log, we occasionally see unauthorized login attempts, some of which are clearly worms or other viruses trying to be rude and force their way in. But when the workstation listed is, to make one up, FREDDY, in a workgroup that we don’t recognize, we have a hard time finding it.

One tool that has helped has been Microsoft’s dsquery, an interface to the LDAP as implemented by Active Directory, but there are still times when we wonder whether the machine name wasn’t just spoofed. Apparently in 2K3, the IP is recorded, which will be 1000x better.

Lou Rocks
On a personal note, we’d just like to mention how much we like Lou Reed’s New York. There are some dated topicalities (or they would be dated to someone who wasn’t alive or was very young in 1989 — remember the flap about Kurt Waldheim, kids?), but otherwise it’s coherent, can be played at nearly any volume, and a very sincere discussion of a frustrating and wonderful place.

20040427

[Smacks Forehead]
Note to self: When replacing a hard disk in a Snap 4100 server, make sure that the jumper really is in the right place to make it a master. Since that’s what the documentation says to do, and since that seems to have cleared up the problems.

Windows XP Firewall and Browser Trouble
We’ve been seeing in our servers’ event logs a lot of warnings or errors surrounding the issue of the server not being able to retrieve a server list from certain computers.

• Type: warning
• Location: system log
• Event ID: 8021
• Source: Browser
• Message: The browser was unable to retrieve a list of servers from the browser master [computer name] on the network [NIC info]

• Type: error
• Location: system log
• Event ID: 8003
• Source: MRxSmb
• Message: The master browser has received a server announcement from the computer [computer name] that believes it is the master browser for the domain on transport [NIC info]. The master browser is stopping or an election is being forced.

What we’ve been able to determine, through newsgroups and web searching, is that the issue is the Windows XP Firewall (a/k/a the Internet Connection Firewall, a/k/a the Personal Firewall), which blocks by default all incoming traffic. The resolution seems to be one of two choices: Either disable the Computer Browser Service in the Services pane of Computer Management, or open up the computer to incoming echo requests (Local Area Connection —> Advanced —> Settings —> ICMP).

UPDATE: It looks like it’s also necessary to open up the computer to incoming mask requests.

20040420

Windows XP IE Strangeness
Just before we executed a Windows Update today (the third update with more than one “critical” patch in as many weeks, IIRC), we noticed something very strange in our IE settings, Advanced tab. Somehow an option with the descriptive text %FORCE_OFFSCREEN_TEXT% had crept in. It wasn’t selected, but it made us a little wary of why someone might be able to force rendering of text offscreen. Nothing came up in Googling that string, nothing in Usenet (now popularly known as Google Groups), nothing via searching AllTheWeb. OK, one post on some comp.fr newsgroup or something like that. A random frenchman’s registry dump. Eventually, after downloading and installing the five patches and rebooting, the option in the IE prefs Advanced tab became something about composing the screen in Terminal Services (we’re writing this from a Linux box, so no, we can not check). Just figured we would thank Microsoft for taking a few minutes off our life and we would try to get that string into the search engines in case anyone else was wondering.

UPDATE 2004.05.04: We got an email today from Joe who mentioned the same problem, which gave us the kick in the seat we needed to get back to this issue. So the pref that ends up being in the IE Internet Options popup, Advanced tab, is “Force offscreen compositing even under Terminal Server (requires restart)” and is connected to an issue discovered in late March of 2004, described at Microsoft KB article #271246. It’s still not clear why the update that contains the patch made the wierdness happen, but hey, that’s the GRB for you.

20040408

We’re excited to be a small part of (and perhaps some part of the impetus for) Ishbadiddle’s effort to create a good store for John Kerry–positive swag. Unfortunately, the site is still under design. There’s a lot of work going on in parallel, dontcha know. When it’s up, don't you worry — you'll be the first to know.