Shift-Command-3

Windows Time Synchronization Made Easier

2011-09-26T15:15:00.001-05:00

I love it when commercial developers release a bare-bones free edition or provide a genuinely useful free utility as a way of advertising their main product[s].

One such gem I found recently is Greyware Automation Products' Windows Time Agent. This is a GUI front end to NET TIME commands and related settings for managing Network Time Protocol. That's pretty much it, and all I wanted anyway! (It doubles as an agent for Grayware's commercial software.)

Note: after installation, the icon is called Windows Time Service and is located in Control Panel.

Exchange 2010 Rollup Notes

2011-09-07T10:48:00.000-05:00

* Best place to find current rollup levels and download links: http://social.technet.microsoft.com/wiki/contents/articles/exchange-server-and-update-rollups-builds-numbers.aspx

* Uninstall any current rollups before updating to a new one.

* Run the rollup from an elevated command prompt. Otherwise, there may be errors without any notification.

* If Outlook Web Access comes up blank with script errors after a rollup, open an elevated Exchange Management Shell and run: C:\Program Files\Microsoft\Exchange Server\V14\Bin\UpdateCas.ps1

Offline Address Book Not Updating

2011-09-02T13:13:00.006-05:00

If Global Address List isn't updating in Outlook (particularly in cached mode) but does look right in Outlook Web Access, the cause may have to do with Offline Address Book generation on the Exchange server.

Run:

> Get-OfflineAddressBook | Update-OfflineAddressBook

in Exchange Management Shell to force an update of all offline address books. (This is normally run as a daily task.) Did an error like this appear?

Failed to generate the content of the offline address book '\Default Offline Address List'. Two possible reasons for the failure are that the System Attendant Service is not running or you do not have permission to perform this operation.
Error message : 'Error 0x6d9 (There are no more endpoints available from the endpoint mapper) fromRpcEpResolveBinding'
+ CategoryInfo: InvalidResult: (Default Offline Address List:OfflineAddressBookIdParameter) [Update-OfflineAddressBook], LocalizedException
+ FullyQualifiedErrorId : 2E7E7298,Microsoft.Exchange.Management.SystemConfigurationTasks.UpdateOfflineAddressBook

Check the service 'Microsoft Exchange System Attendant.' It may be set to Automatic but stopped. Change it to Automatic (Delayed Start), then go into its Properties->Recovery tab and encourage it to restart on failure. Make sure it's able to stay running, then try the Exchange shell command again. If that's clean, force an Outlook client to download offline address books.

Calendar Sharing in Exchange 2010

2011-08-11T10:37:00.000-05:00

Exchange Management Console doesn't have any GUI controls for sharing just calendars, as opposed to full mailbox access. A good way to share all calendars with everyone in an organization is to use Jan Egil Ring's neat little powershell script described here and available here. Ring also mentions a way to set up automatic modifiers during new user creation.

The script has two lines you should check and possibly edit before running it:

#Custom variables 

$mailboxes = Get-Mailbox -Database "Mailbox Database A" 

$AccessRights = "Reviewer"

To find the name of the mailbox database in EMC, look in Server Configuration -> Mailbox -> Database Copies. On the SBS 2011 server I'm working with, it was simply named "Mailbox Database."

AccessRights options are listed here: http://technet.microsoft.com/en-us/library/ff522363.aspx

Mac Mini Gaming Benchmarks - Late 2009 vs. Mid 2011

2011-07-24T01:14:00.006-05:00

At first glance, the stats for the new Mac Mini released this week might not sound like a huge leap from two releases back, but the obvious numbers don't tell the whole story. The type of CPU, a discrete video card, and the type of video RAM really make a difference.

OLDER Mini — Late 2009 (MacMini3,1)

2.53 GHz Intel Core 2 Duo
4 GB 1067 MHz DDR3
NVIDIA GeForce 9400 256MB (shared)

NEW Mini — Mid 2011 (MacMini5,2)

2.5 GHz Intel Core i5
4 GB 1333 MHz DDR3
AMD Radeon HD 6630M 256MB GDDR5 (discrete)

Tests were run on Windows 7 Professional since FRAPS is so nice for benchmarking.

Magicka

Let's start with everyone's favorite terribly-optimized fantasy game! This was done with a 60 seconds benchmark during 'The Glade' challenge map, starting when the first enemies appear.

1) Config I was using to play on the OLD mini:

Windowed — On
Resolution — 1024x768
Shadows — Low
Decal Limit — Low

Min, max, and average frames per second (FPS). I ran two tests on each mini. As you can see, results are pretty consistent on the same hardware.

The new mini triples the FPS.

2) A somewhat better config:

Same as before, but Resolution — 1280x800

Don't have to squint as much to see the action. New mini still tripling the FPS to ~35. Still playable, by my standards anyway!

3) 'This would be nice' config

Changes to the settings are...

Windowed — Off
Resolution — 1920x1200
Shadows — Medium
Decal Limit — Medium

Ok, back to low-ish FPS. This will probably get tweaked to return to around 30 FPS.

Alien Swarm

This free game from Valve is just sliiightly more optimized.

The 60 second benchmarks were done in offline practice mode with three bots; timer began as soon as the techie bot finished opening the first door.

1) Config similar to what I used when playing this game around release. (Solo'd the whole campaign without bots on Normal difficulty!)

Resolution — 1280x800
Full Screen
Anti-Aliasing — None
Filtering Mode — Trilinear
Wait for Vertical Sync — Disabled (to let FPS go as high as it can)
Multicore Rendering — Enabled
Shader Detail — Low
Effect Detail — Medium
Model / Texture Detail — Medium
Paged Pool Memory Available — High

More than a tripling of FPS.

2) Nicer looking config!

Resolution — 1920x1200
Shader Detail — High
Effect Detail — High
Model / Texture Detail — High

About five times the old mini's FPS and looking great.

Killing Floor

This one is available for OS X, but I compared it in Windows anyway. 60 second benchmark done in single player in Mountain Pass, starting one second after the first wave begins. I just stuck around the initial crash location.

1) Config that worked on the old mini.

Render Device — Direct 3D 9.0

Resolution — 1600x1200

Color Depth — 16-bit

Game Details — Lowest

Fullscreen — Yes

Widescreen — Yes

Vertical Sync — No

Triple Buffering — No

Over 3x the FPS, yet again. I think we have a pattern here.

2) Config that doesn't look awful

Resolution — 1920x1200

Game Details — High

Yeah, the new $800 minis are quite a jump up. Not maximum PC gaming, but quite decent...and they run OS X.

***

By Request: Starcraft 2

Another one available for OS X, but tested in Windows. This time I ran a 10 minute benchmark between the 10:00 and 20:00 marks in a Terran vs. Zerg replay, with the camera on the Zerg player.

1) Config I used for the campaign last year.

Resolution — 1920x1080

Texture Quality — Medium

Vertical Sync — Off

Graphics Quality — Low ...but then raised the following:

Terrain — Medium

Effects — Medium

Post-Processing — Medium

Models — High

2) The enormous visual impact of having a medium shader.

Graphics Quality — Medium

Oh hey, creep moves around now. Who knew?

Windows Update Error 8024402C

2011-04-27T11:55:00.000-05:00

Official fixes that didn't work.

Unofficial fix that did work: Turn off Windows Firewall.

Power Saving Mode on Seagate GoFlex Drives

2011-03-07T10:34:00.000-06:00

Symptom

Seagate FreeAgent GoFlex external drives are frequently disconnecting and reconnecting when not in use (possibly kicking off AutoPlay). Also, this error appears in Event Viewer:

Event ID: 57
Source: Ftdisk
Description: "The system failed to flush data to the translation log. Corruption may occur."

Cause

By default, GoFlex drives go into power saving mode after 15 minutes of inactivity.

Disabling Power Saving Mode on the Drive

You'll need to install the Seagate Dashboard software which comes on the drive. The good news is that this isn't something that needs to stay running or installed. I actually installed Dashboard on my own notebook and changed the setting on three drives for other people. The setting persists when the drives are powered down.

If you erased the software that came with the drive, see this article for options.

In the installer, you can uncheck all other options and Dashboard itself will still install. Once Dashboard is running and a GoFlex Drive is attached, click next to the drive to change Drive Settings. (It's fun to play with the LED Settings too!)

Disabling Power Save Mode in Windows

This may not be necessary, but just in case...

Go into Device Manager and expand Universal Serial Bus Controllers. Check the Properties for each USB Root Hub.

Within USB Root Hub Properties, check the Power tab to figure out which hub the external drive is using (or just follow the next step on all root hubs).

Finally, click the Power Management tab and uncheck "Allow the computer to turn off this device to save power."

Allowing CUPS web interface access to a local network

2011-03-06T19:01:00.000-06:00

The easiest way to install a printer in Linux (or perhaps the ONLY way...) is using the Common Unix Printing System (CUPS), which comes pre-installed most of the time for many Linux flavors.

CUPS comes with a nifty web interface that allows for fairly painless addition of new printers, however if you're running Linux headless, navigating this interface through 'links' or some other CLI browser may not be your idea of a good time.

In order to access the interface from another machine, you'll have to change a few things in your /etc/cups/cupsd.conf file.

Find the line:
Listen localhost:631

and change this to:
Listen 0.0.0.0:631

In order to have CUPS listening on all available IPs. (If you have a specific IP you want CUPS to listen from, go ahead and use that instead of the quad zero rule.)

Then find this block:


<Location />
Order allow,deny
</Location>

And insert a rule to allow yourself access:


<Location />
Order allow,deny
Allow 192.168.1.12
</Location>

The above will allow the 192.168.1.12 computer access to the machine. If you'd like to add all machines in a local subnet, for example, you could use Allow 192.168.0.0/16 instead. This has the benefit of allowing you to access it from any client in your domain without opening the interface up to the big scary outside.

One last change: to actually access the administrative panel, you must insert the same "allow" line into the following blocks:


# Restrict access to the admin pages...
<Location /admin>
Order allow,deny
Allow 192.168.0.0/16
</Location>

# Restrict access to configuration files...
<Location /admin/conf>
AuthType Default
Require user @SYSTEM
Order allow,deny
Allow 192.168.0.0/16
</Location>

And that should do it! As for actually getting your printer working in Linux, however... Good luck!

PS3 Repair-It-Yourself

2011-02-27T23:30:00.000-06:00

My Playstation 3 suddenly refused to turn on besides beeping at me (with the YLOD or "yellow light of death" symptom). I followed this video walk-through which involves taking just about everything apart and using a heat gun on the CPU and GPU.

It actually worked!

Outlook Certificate Warning With Exchange 2007 or 2010

2011-01-10T15:01:00.002-06:00

After installing a third party certificate in Exchange 2007 or Exchange 2010 (for Outlook Web Access and similar services), some Outlook clients may suddenly start complaining:

"The name of the security certificate is invalid or does not match the name of the site."

Here's the relevant Microsoft article. If you have trouble understanding it on the first read, I'll paraphrase!

The Problem

Exchange '07 and '10 automatically generate a self-signed certificate with the fully qualified internal name of the mail server. Outlook 2007 (and possibly Outlook 2010) clients connect to Exchange using — by default — the server's internal name. When the name the client uses and the certificate match, no problem! There's also no problem for Outlook 2003 clients because they don't bother with the certificate.

But what if you replace the Exchange certificate with one that references the external name of the server? 'mail.contoso.com' instead of 'mail-srv.contoso.local', for example? Well, you get the error above!

Expensive Fix

If the new certificate includes Subject Alternate Names, you could include the internal name as one of the alternates. This internal name will be externally viewable to anyone who likes to read certificate details, if you care about that.

The Usual Fix...

The other way to make the warning go away is to instruct internal Outlook clients to look for the mail server under its external name (e.g. 'mail.contoso.com') and make sure internal DNS resolves to the internal IP of the mail server.

...And Its Downside

You'll need to run "split DNS." Create a forward lookup zone on the internal DNS server for the external domain name. LAN clients which try to reach anything that ends in '.contoso.com' will receive their answers from the internal DNS server. Be careful! If you forget to add, for example, 'www.contoso.com' to the internal version, LAN clients may lose access to the company website.

Check Current Values

To be on the safe side, make a record of the relevant Exchange settings before changing them. This process will also help familiarize you with what's going on in the next step. Open Exchange Management Shell. Type the following queries, then note the information on the lines specified:

> get-clientaccessserver | fl

Note the value for 'AutoDiscoverServiceInternalUri'

> get-webservicesvirtualdirectory | fl

Note the value for 'InternalURL'

> get-oabvirtualdirectory | fl

Note the value for 'InternalURL'

(Exchange 2007 only)
> get-umvirtualdirectory | fl

Note the value for 'InternalURL'

Hopefully, the values are all the same for these!

Change To the External Name

Assuming...
Internal name is 'mail-srv.contoso.local' and
External name is 'mail.contoso.com'.

> Set-ClientAccessServer -Identity mail-srv.contoso.local -AutodiscoverServiceInternalUri https://mail.contoso.com/autodiscover/autodiscover.xml

> Set-WebServicesVirtualDirectory -Identity "mail-srv.contoso.local\EWS (Default Web Site)" -InternalUrl https://mail.contoso.com/ews/exchange.asmx

> Set-OABVirtualDirectory -Identity "mail-srv.contoso.local\oab (Default Web Site)" -InternalUrl https://mail.contoso.com/oab

(Exchange 2007 only)
> Set-UMVirtualDirectory -Identity "mail-srv.contoso.local\unifiedmessaging (Default Web Site)" -InternalUrl https://mail.contoso.com/unifiedmessaging/service.asmx

Then either reboot the server, or open IIS, browse to application pools, and recycle 'MSExchangeAutodiscoverAppPool'.

Introduction to LAMP for Windows Admins — Pt. 4 PHP and MySQL

2010-12-13T01:25:00.005-06:00

Both PHP and MySQL are already enabled, but I'd like to go over a couple of simple tests. These are optional, but will increase your familiarity and these are good troubleshooting steps for the future. I will also cover the use of phpMyAdmin.

1. Getting Started
2. Remote Access
3. Apache
4. PHP and MySQL

Testing PHP

Go to /var/www/default and type "sudo nano info.php". Add the following lines to the new file:

Save and browse to "http://192.168.1.50/test.php". You should see a colorful page with lots of detailed information on PHP's configuration and environment.

Testing MySQL

From any directory, type "mysql -u root -p". Enter the MySQL root password you created during Ubuntu setup (remember, this is different from the system root password). Type "show tables;" (note the semi-colon) to display the two administrative databases included by default. Type "quit" to quit.

phpMyAdmin Install

phpMyAdmin is a PHP based web application which is used to administer MySQL databases. It's a convenience option to use in place of the MySQL command line client, as tested above.

To start the phpMyAdmin install, type "sudo apt-get install phpmyadmin". You'll be asked if you want the installer to automatically configure a web server. Push the spacebar to mark "apache2", push Tab to move to "Ok," then Enter.

At the next prompt, select "Yes." Then enter the MySQL root password and confirm. The "MySQL application password for phpmyadmin" blank can be left blank; a password will be randomly generated that you won't need to know in the future.

Browse to "http://192.168.1.50/phpmyadmin" and use "root" with the MySQL root password to log in. Feel free to poke around, make a test database, and become familiar with what options are available in this utility.

Side note: Where is the phpMyAdmin website?

Since nothing was added to the /var/www/ directory, where are the phpMyAdmin site files? Let's track them down starting from the main Apache configuration file: /etc/apache2/apache2.conf. While I do recommend browsing through apache2.conf, a quicker way to find what we're looking for is:

cat apache2.conf | grep Include

Note the capital 'I' in "Include". The "cat" command is short for concatenate and was intended as a way to combine multiple plaintext files, but when used on just one file it simply prints the contents of the file all at once. Try typing "cat apache2.conf" to see the text fly by. The "|" command (aka "pipe") sends the result of the first command to be the input of the second command. The "grep" command searches for a string of text in the input file and prints out all lines which include the string. Overall result is that any lines in apache2.conf with "Include" get printed out.

One of the included lines is "/etc/apache2/sites-enabled/" which means the contents of all the files in "sites-enabled" are parsed as if they were were written directly into apache2.conf. They're in separate files for the sake of organization and maintenance. Another directory with all files included is "/etc/apache2/conf.d/". If you look there, you'll see the phpmyadmin.conf file added during phpMyAdmin's install. (Technically, it's a link to a file stored elsewhere. Type "ls -l" to see security attributes, timestamps, and link locations.)

View phpmyadmin.conf to see that the Directory for this site is at "/usr/share/phpmyadmin".

...

I plan to come back to this at some point and explain how to make sure Internet users can't reach /phpmyadmin. For now, I just want to make readers aware of the issue.

I also intend to write a post or two which showcase LAMP applications like Joomla! or WordPress. This series has covered the pre-reqs for either. (But further LAMP posts (hah) will need to wait until I've passed the GRE; study is eating up my time!)

Introduction to LAMP for Windows Admins — Pt. 3 Apache

2010-12-07T01:55:00.006-06:00

This section covers the essentials of Apache configuration.

1. Getting Started
2. Remote Access
3. Apache
4. PHP and MySql

Content Location

Point a web browser to http://192.168.1.50/index.html (or whichever address "ifconfig" is showing). You should see an "It works!" page by default.

This file is located at /var/www/index.html. You could remove index.html and put a new website directly in /var/www/, but that's not very forward looking! Instead, create subdirectories like so:

/var/www/lemurs.com
/var/www/catmania.org
/var/www/mars.gov

Subdirectory names don't need to be in any particular format. For this tutorial, I'll go with catmania.org.

cd /var/www
sudo mkdir catmania.org
sudo cp index.html catmania.org
cd catmania.org
sudo nano index.html

Edit index.html to make it obvious this is the catmania.org version. Now, the trick is going to be to make Apache serve up this index.html when http://www.catmania.org is the requested URL.

Apache Configuration

Go to /etc/apache2. Even though it doesn't need to be adjusted quite yet, make a backup copy of the original apache2.conf file in this directory. (This is the main Apache configuration file.)

Notice the "sites-available" and "sites-enabled" subfolders? The first contains a settings file for each individual site, enabled or not. The second contains links to currently enabled sites. So we need to create a settings file for catmania.org then run a command to enable it.

cd sites-available
sudo cp default catmania.org
sudo nano catmania.org

It's easier to modify a working file than start from scratch! Add a new line just above the "ServerAdmin" line:

ServerName www.catmania.org

Add to the "DocumentRoot" line so that it reads:

DocumentRoot /var/www/catmania.org

Make the same addition to the line "<Directory var/www/>". Then save and exit. Type "sudo a2ensite catmania.org" to enable the site. "sudo service apache2 reload" to restart Apache.

Add www.catmania.org to your local "hosts" file (Windows / OS X), then browse to the URL. You should see the modified version of the "It works!" page.

The official documentation is very readable for Apache configuration in general and specifically for name-based virtual hosts.

System / Apache Logs

If something does go wrong, use the "tail" command to check the most recent lines in the system or Apache logs like so:

tail /var/log/syslog
tail /var/log/apache2/error.log
tail /var/log/apache2/access.log

Moving the Default Site

Apache's default site is much more lightweight than its IIS cousin tends to be. Besides serving as an already-working example, it's really only used when an incoming web request doesn't match any of the ServerName lines like "www.catmania.org".

Mechanics Note: If you look in /etc/apache2/sites-enabled, you'll see the link to /etc/apache2/sites-available/default is "000-default". The first site alphabetically in "sites-available" is used as the default, so disabling the original default site would cause www.catmania.org to be used for lookup failures until another site with an earlier letter is enabled. For the sake of predictability, it's best to leave the default site enabled and customize it as needed.

I'm not sure it's necessary for security, but I consider it better practice to move the default site to be a sibling to any other sites. This results in a cleaner /var/www/ directory which contains nothing but subdirectories.

cd /var/www
sudo mkdir default
sudo mv index.html default
sudo nano /etc/apache2/sites-available/default

Then modify the two lines with "/var/www " to "/var/www/default ". Restart Apache and test.

Introduction to LAMP for Windows Admins — Pt. 2 Remote Access

2010-12-02T10:41:00.007-06:00

This section covers remote command line access plus some ways to move files to and from the Linux system. No need to learn them all right away.

1. Getting Started
2. Remote Access
3. Apache
4. PHP and MySQL

Enable SSH

Download and install the SSH service in one step by typing "sudo apt-get install openssh-server". More information here. If you haven't used SSH but you are familiar with Telnet, it's like that but encrypted. PuTTY is the most common choice of SSH client for Windows. OS X has a built-in terminal client which works like this: "ssh -l lampadmin 192.168.1.50".

Once you're able to connect from the comfort of your own desktop/notebook, consider making a virtual machine snapshot. You may also want to skip the rest of this post and come back to it when you actually need to transfer a file.

Transferring Files — Secure Copy

The SSH server also enable Secure Copy (aka SCP) file transfers. WinSCP and Fugu are popular graphical clients for Windows and OS X, respectively. Works a lot like FTP.

OS X also has a built-in Secure Copy command. Easiest way to use it is to open Terminal, navigate to the local directory you want to copy from and type:

scp ./website.zip lampadmin@192.168.1.50:~/

Or navigate to the local directory you want to copy to and type:

scp lampadmin@192.168.1.50:~/website.zip .

This will move the file "website.zip" from the current OS X directory to lampadmin's home folder on the Ubuntu server, or the other way around. (While logged on as lampadmin, you can reach "/home/lampadmin" at any time by either typing "cd" without arguments or "cd ~").

To recursively copy a whole folder tree between hosts, add a -r flag like this:

scp -r ./website lampadmin@192.168.1.50:~/

Transferring Files — HTTP

Easy, if you know the URL:

wget http://www.[somesite].com/data.zip

Can also do some text-mode web browsing with "sudo apt-get install lynx" then "lynx".

Transferring Files — Samba

Samba is an implementation of SMB protocol, meaning Windows-style shares. The Linux server will even show up in Network Neighborhood (and newfangled versions of that). While Active Directory integration and fine-grain permissions are possible, I'll be covering the quick and dirty method that's sure to send any Linux guru into fits.

The plaintext config file for Samba is smb.conf in /etc/samba. Navigate there, then type "sudo cp smb.conf smb.conf.orig" to make a backup of the original. Get in the habit of doing this for any configuration file. "sudo nano smb.conf" to open the file. (Tip: Control-Y and Control-V scroll a whole page at a time and Control-W searches, if you hadn't already noticed.)

Search for, then uncomment the line: "security = user".

Search for "Share Definitions". Just after this line, clear some space to type in the following block:

[root]
path = /
browseable = yes
writeable = yes
valid users = lampadmin
admin users = lampadmin

If you will be using a Windows client to access the share, save and exit. OS X clients need to add an extra line to work around a write-access bug. Search for "[global]" and just below that, add the line:

unix extensions = no

Now, everyone needs to type "sudo service smbd restart" so the new settings are read into the Samba service. "\\Lamp-srv\root" should be accessible.

Warning: Both Windows and OS X clients have a history of making messes on remote shares with the (not so) hidden files thumbs.db and .DS_Store, respectively. Disable this behavior if you haven't already.

(continued...)

Introduction to LAMP for Windows Admins — Pt 1. Getting Started

2010-11-28T21:13:00.013-06:00

LAMP — Linux, Apache, MySQL, and PHP — is a very popular web hosting platform. If a complex site is designed for the LAMP environment, it might not even work with Microsoft's IIS server. My goal here is walk experienced Windows administrators through the process of setting up a LAMP server, without assuming any prior familiarity with Linux.

1. Getting Started
2. Remote Access
3. Apache
4. PHP and MySQL

Distributions

Unlike Windows and OS X, there is no official, centrally-managed version of the Linux operating system. While breaking free of the one-size-fits-all philosophy is part of the attraction, it also means details can change a lot among the different "flavors" of Linux.

This guide uses Ubuntu Server Edition (ver. 10.04 LTS). Why Ubuntu? It is currently very popular which means web searches for information on niche issues are more likely to turn up useful guides and discussions. Server edition has no GUI by default and I recommend leaving it that way. Most configuration tasks in Linux are a matter of editing plaintext files.

Virtualization

I highly recommend running Ubuntu as a virtual machine. A command line only web server doesn't require much in the way of system resources. It's also very nice to be able to roll back to an earlier snapshot if something goes wrong, or you learn a cleaner way to accomplish a task. Plus, I won't be discussing drivers at all.

The use of virtual machines falls under the "experienced Windows admin" category of things I shouldn't need to cover. I will point out that you'll likely want to change the virtual machine's networking to Bridge (or Bridged) mode. Both VMware and Virtual PC default to NAT mode last I checked.

Install CD

Plain "Install Ubuntu Server" is the way to go here. I went with "lamp-srv" for the hostname. Once you reach the screen about partitioning, select "Guided - use entire disk and set up LVM." Take a moment to appreciate how easy this step is compared to the traditional Linux partitioning headache you would be experiencing right now.

Note: On Linux systems, the only account which has full access to all files and commands is "root". You won't actually log in as root. Instead, admin accounts are those which have the ability to invoke root's powers as needed with the sudo command ("switch user [to root] then do"). It's similar to UAC.

Time to create an admin account. I went with "Lamp Admin" for the full name and "lampadmin" for the username. Don't bother encrypting the home directory. Opt out of automatic updates. On the software selection screen, pick:

LAMP server
Samba file server

Continue on. Enter (and make a note of) the MySQL root user's password. This is the root account within the MySQL database server, which is completely different from Ubuntu's system root account. Go ahead and accept the default of "install the GRUB boot loader to the master boot record." The system will reboot and you should get a login prompt. "lampadmin" or whichever account you created works here.

Getting Around & Network Configuration

Type "pwd" (present working directory) to see the current directory's full path. Linux doesn't use drive letters. Instead, everything is under the "/" root directory. Removable drives typically get mounted under "/mnt/" but none of that will be needed in this guide. Also, everything uses forward slashes, which are easier to type anyway! Type "cd /etc" then "ls" (to list [files]). Most system configuration plaintext files are located here or in subdirectories. Type "cd network" and "ls" to see the "interfaces" file. Type "less interfaces" to display the contents of this file. By default it should include:

# The primary network interface
auto eth0
iface eth0 inet dhcp

The "auto" line means the eth0 interface will be brought up automatically on system startup. The next line sets it to use DHCP for all settings. If you prefer to leave it this way and use a DHCP reservation to set the IP, that's fine. Type "ifconfig" (one letter different from "ipconfig") to see information like eth0's current ip, netmask, and MAC address.

To configure static addressing, type "sudo nano interfaces". This elevates privileges then opens the interfaces config file in the nano editor. Use arrow keys to move around and Control+[some letter] to use the commands along the bottom (nano reference here). Comment out the DHCP line and add static lines like so:

# The primary network interface
auto eth0
# iface eth0 inet dhcp
iface eth0 inet static
address 192.168.1.50
netmask 255.255.255.0
gateway 192.168.1.1

Control+O (the letter) to save the file, then Control+X to exit nano. Type "sudo /etc/init.d/networking restart" to restart networking services. (The proper way to do this is "sudo service networking restart", but it's bugged in this particular release.) Type "ifconfig" to see the new settings. Ping works the same as in Windows, except it defaults to unending pings; use Control-C to abort.

You may have noticed DNS isn't configured in "/etc/network/interfaces". If DHCP is not used, you can just edit "/etc/resolv.conf" and replace everything with a "nameserver 192.168.1.1" or similar line. Otherwise, DHCP will overwrite this file periodically. Workaround here. Either way, "less /etc/resolv.conf" should always display current DNS servers. nslookup works as it does in Windows.

Here's a good starting reference on CLI commands. "sudo shutdown -r now" and "sudo shutdown -h now" reboot and shut down (halt) the system, respectively.

(continued...)

SMTP TempTables

2010-09-27T15:10:00.002-05:00

Twice in as many months I've noticed very high outgoing mail traffic from an Exchange server with nothing going on according to Exchange System Manager. I turned on SMTP logging and found a single, hidden message was being sent out repeatedly. Took a while to figure out how to delete the troublemaker since it was stuck in a "TempTable."

Method 1 did the trick.

Shrew Soft VPN Client with Juniper/Netscreen IPSEC

2010-07-30T10:52:00.034-05:00

Shrew Soft's VPN client is free and remarkably cross-platform. I needed it for Windows 7 notebooks. While there's already a nice write-up on how to configure a preshared key with XAuth scheme, my particular situation called for separate preshared keys for each user and no XAuth. So that's the (relatively!) simple setup I'll be documenting here.

A bit of history: Juniper Networks purchased Netscreen in '04. The Netscreen brand continued to be used on Firewall/VPN devices for several years following that (which is when I earned technical certification on them), but these are now simply Juniper "Secure Services Gateway[s]." I'll call the device the "firewall" to stay neutral. Screenshots are from a NS5GT; details may vary slightly.

Sample Parameters

Obviously, these won't actually work. The 'X's stand for unspecified numerical values.

192.168.1.0 /24 — Business LAN
10.X.X.X — Firewall public IP
roadwarrior — User name
corporation.inc — Business URL
1234567895 — roadwarrior's preshared key

Routing

Routing on the Netscreen should already be set up unless this is the first VPN configured on the firewall. Something along these lines should work:

untrust-vr entry
IP/Netmask — 192.168.1.0 /24
Gateway — trust-vr
Interface — -

trust-vr entry
IP/Netmask — 192.168.1.0 /24
Gateway — 0.0.0.0
Interface — ethernet1

And if there isn't already a name for the LAN subnet, add it to Objects->Addresses->List->Trust->New.

Address Name — corporation.inc LAN
IP/Netmask — 192.168.1.0 /24
Zone — Trust

User Setup

Objects->Users->Local->New

User Name — roadwarrior
Status — Enable
IKE User — Checked
IKE ID Type — Auto
IKE Identity — roadwarrior@corporation.inc

Phase 1 Setup

VPNs->AutoKey Advanced->Gateway->New

Gateway Name — roadwarrior P1
Security Level — Standard
Remote Gateway Type — Dialup User
User — roadwarrior
Preshared Key — 1234567895
Use As Seed — Unchecked
Outgoing Interface — ethernet3

Click Advanced.

Mode (Initiator) — Aggressive
Enable NAT Traversal — Checked
UDP Checksum — Unchecked
Keepalive Frequency — 20
[Authentication Section] — None

Click Return, then Ok.

Phase 2 Setup

VPNs->AutoKey IKE->New

VPN Name — roadwarrior P2
Security Level — Custom
Remote Gateway — roadwarrior P1

Click Advanced.

Security Level — Custom
Phase 2 Proposals:
* nopfs-esp-3des-md5
* nopfs-esp-3des-sha
* nopfs-esp-aes128-md5
* nopfs-esp-aes128-sha
Replay Protection — Checked
...the rest of the settings on this page shouldn't need changing from default:
Transport Mode — Unchecked
Bind to — None
Proxy-ID — Unchecked
Local (and Remote) IP/Netmask — 0.0.0.0 / [blank]
Service — Any
VPN Group — None
VPN Monitor — Unchecked
Source Interface — Default
Destination IP — 0.0.0.0
Optimized — Unchecked
Rekey — Unchecked

Click Return, then Ok.

Policy Setup

Policies.

From: Untrust
To: Trust
Click New.

Source Address — Dial-Up VPN
Destination Address — corporation.inc LAN
Service — Any
Action — Tunnel
Tunnel [VPN] — roadwarrior P2
Tunnel [L2TP] — None

Click Ok.

Shrew Soft Access Manager — General Tab

Host Name or IP Address — 10.X.X.X (True value at Network->Interfaces->edit[ethernet3]->IP Address)
Port — 500
Auto Configuration — disabled
Address Method — Use an existing adapter and current address

Shrew Soft Access Manager — Client Tab

NAT Traversal — enable
NAT Traversal Port — 4500
Keep-alive Packet rate — 15
IKE Fragmentation — enable
Maximum Packet size — 540

Enable Dead Peer Detection — Checked
Enable ISAKMP Failure Notifications — Checked

Shrew Soft Access Manager — Name Resolution Tab

All unchecked. Of course this sort of thing can be set up if you prefer. I'm using it for a simple case which does not need DNS.

Shrew Soft Access Manager — Authentication Tab

Authentication — Mutual PSK

Local Identity subtab
Identification Type — User Fully Qualified Domain Name
UFQDN String — roadwarrior@corporation.inc

Remote Identity subtab
Identification Type — IP Address
Address String — [blank]
Use a discovered remote host address — Checked

Credentials subtab
Preshared Key — 1234567895

Shrew Soft Access Manager — Phase 1 Tab

Exchange Type — aggressive
DH Exchange — group 2
Cipher Algorithm — auto
Hash Algorithm — auto
Key Life Time limit — 86400
Key Life Data limit — 0
Enable Check Point Compatible Vender ID — Unchecked

Shrew Soft Access Manager — Phase 2 Tab

Transform Algorithm — auto
HMAC Algorithm — auto
PFS Exchange — disabled
Compress Algorithm — disabled
Key Life Time limit — 3600
Key Life Data limit — 0

Shrew Soft Access Manager — Policy Tab

Maintain Persistent Security Associations — Unchecked
Obtain Topology Automatically or Tunnel All — Unchecked

Click Add.
Type — Include
Address — 192.168.1.0
Netmask — 255.255.255.0

Click Ok, then Save.

...now try connecting. When it fails the first time, check the log entries on the firewall. When those are unclear, see the blog post immediate prior to this one on detailed VPN troubleshooting.

Netscreen IPSEC Detailed Troubleshooting

2010-07-19T10:49:00.004-05:00

Something I use just rarely enough to forget every time...

Telnet to the Netscreen IPSEC VPN firewall.
> debug ike detail
> clear db
[attempt to connect from VPN client]
> get db str
> undebug all

Grab From Pop3; Send to SMTP

2010-07-01T11:48:00.004-05:00

I've found a simple, free solution to the general problem of fetching mail from a POP3 server (commonly used by home ISPs) and forwarding it to an SMTP server (such as Exchange). P3SS or 'Pop3 to SMTP Server' is an aptly named Windows service. The author considers it alpha software, but it already works great for its niche task. User configuration looks like this:

For convenience, you can put common values in a 'default' account and choose to start new users with those fields populated. Set the interval to check the POP3 server, and that's about it.

Allworx IP phone system admins should take note of this as a more elegant solution than fetching voice mail attachments directly from desktop mail clients. I have this going into Blackberry Enterprise Server with the upshot of office voicemail being available for playback on handhelds.

Pingstorm

2010-06-30T10:42:00.002-05:00

If I were a little more pro, I'd be comfortable working with nmap when I need to scan a network. Meanwhile I like Angry IP Scanner. Runs cross-platform and has a nice GUI for pinging everything on a range of addresses and trying to resolve host names. Fast, free, and doesn't require installation.

Double Subnet Trick

2010-06-25T09:03:00.005-05:00

I sometimes have reason to connect a network device (firewall, wireless access point, or general purpose server) to my own physical network while setting it up for use on another network with its own subnet. Or I may need to connect initially to a device's factory default subnet. In this past this has meant reconfiguring my notebook for the alternate subnet, meanwhile losing access to Internet and LAN services.

It seems obvious in retrospect, but I finally realized I could leave my main network settings the same and just change the IP and subnet of my VMWare virtual machine. Virtual network adapters run in "bridged mode" by default, which under normal circumstances means they will pull a separate IP from the DHCP server. Instead, I set a static IP for a different subnet. It worked!

The upshot is the ability to communicate with the alternate subnet in VMWare while accessing Internet services in the host operating system. Since VMWare supports drag and drop copying between the two, it's much more convenient to download something like a firmware update, copy it to the virtual machine, then apply it to the target device. Another common scenario is finding reference material or troubleshooting information on the web while managing the device.

Caution: Use a separate physical network when appropriate. It may be handy to put a device on the office network, but there may be unintended consequences if it runs its own DHCP server (for example). In this case, it's often handiest to connect the device directly to your notebook or desktop. My Macbook figures it out either way, but you may need a crossover cable to accomplish this. Or there's always the option of using a spare switch or VLAN.

Professional Web Security

2010-06-21T13:01:00.003-05:00

No comment.

Webpage to Epub

2010-06-16T10:20:00.005-05:00

Web2FB2 is my favorite Nook companion site. Feed it a web address with substantial text content. Optionally, specify the author, title, etc. Presto: a free mini-book for any Epub or FictionBook reader.

Just Plain Copy

2010-05-20T20:02:00.002-05:00

I frequently found myself pasting formatted text into a plain text field (e.g. a browser search field or a plain text editor) only to re-copy the text to paste in the intended destination document without bringing along all manner of format oddities. A finger-twisting but generally effective shortcut in OS X is the following key combo:

Option-Shift-Command-V

rather than the usual paste combo:

Command-V

Unfortunately, some individual applications do override the unformatted text paste combo.

Trade in PDF Margins For Larger Fonts

2010-05-20T18:57:00.012-05:00

When trying to read a PDF on my Nook, I noticed two things: the font was tiny and the margins were taking up a lot of space. Wouldn't it be nice to ditch the margins and let the fonts scale up to fill that space? The fix turns out to be quite easy using the built-in Preview application in OS X.

Open the PDF in Preview. Better yet, make a copy first to eliminate risk to the original.
Start with any typical page. Press the Select button on the top (or Command-3), then make a rectangle around the main text, excluding margin and possibly page number and title from around the edges.
Navigate to another page using the Sidebar. Notice how the selection rectangle is in the same position. It's likely that the new page's text will stick out slightly from the rectangle. Make the rectangle just large enough to fit, but don't reduce any of its dimensions.
Repeat step 3 on other pages until you are confident the selection rectangle will not snip vital text from any of the pages.
Use Edit->Select All in the menu (or Command-A). Then Tools->Crop (or Command-K).
You'll be warned that Crop does not actually destroy data. The PDF file is, however, altered to only show the cropped portion by default. Click Save to commit this change to the file.

The change in apparent font size will go something like this, to this:

Ask The Internet

2010-05-14T12:57:00.007-05:00

http://www.whatismyip.com/
Quick way to find your current external IP address.

http://www.canyouseeme.org/
And a way to find out whether your ports are showing.

http://www.downforeveryoneorjustme.com/
If a particular website looks down, get a second opinion before bugging friends to check for you.

http://www.hasthelhcdestroyedtheearth.com/
Less useful, but extremely reliable.

http://doihaveswineflu.org/
Confirm with a licensed physician.

http://isobamapresident.com/
Now that's a progress bar.

How To Change The Blogspot Login Address To Gmail

2010-05-14T12:21:00.005-05:00

When I created this blog, I used a non-Gmail address. Last week I finally got around to making a Gmail address, but found I couldn't simply change my Blogger account to match. Trying to do so causes this error:

"Sorry, a Gmail address is not allowed to be the primary address of this account."

Weird. There is a roundabout fix, with a significant downside or two:

Log into Blogger with the original account. Go to Dashboard->Settings->Permissions->Add Authors. Send an invite to your Gmail account.
Log into Gmail (use a different browser entirely to cut down on login/logout steps). Follow the invitation link and log in with Gmail settings.
Go back to Blogger with the original account. In the Permissions area, click "grant admin privileges" next to the Gmail account.
Go back to Blogger under the Gmail account. Remove the original account.
(Optional) Go back to the original account for the last time. My Account->My Products-Edit->Delete Account.
Do everything under the Gmail account from now on.

Step 4 will still allow you to edit old posts under the new account, but you can't change the display name of the original account. Step 5 will mess up any images uploaded to Blogger under the original account. In my case, the thumbnails survived but clicking on them to see the original images failed. I had saved copies of all the original images as a precaution but decided the thumbnails are sufficient.

EDIT - The thumbnails only survived temporarily. I was too quick to ditch the backup.

Taking Out Everyone's Trash

2010-04-20T09:51:00.000-05:00

Sometimes when disk space is low and you've already emptied the Recycle Bin, the disk usage tool (I like JDiskReport) will still reveal a large C:\RECYCLER folder. This just means other accounts on the system have yet to empty their Recycle Bins. The quickest way to do this for everyone:

rd /S C:\RECYCLER

You'll be prompted for confirmation. Upon approval, the entire \RECYCLER folder will be immediately removed from the system and all space reclaimed. Windows will automatically recreate the \RECYCLER folder the next time a file is deleted.

NOTE - I've only tried the above on Windows XP / Server 2003. I hear it has changed slightly for Windows 7 and Vista:

rd /S /Q C:\$Recycle.bin

Global Address List Viewing

2010-03-31T11:23:00.000-05:00

A short, niche tip I somehow missed for years: it is possible to view an Exchange global address list from a Windows 2003 server. Until recently I thought the only option was to pull this up through someone's Outlook client.

In Exchange System Manager...Recipients->All Global Address Lists->Right click on Default Global Address List->Properties->General tab->Preview.

Mapped Drives Woes

2010-03-26T10:23:00.004-05:00

The switch from XP to Vista was so opposed in the local small business community that I'm just now deploying post-XP desktops for regular users (Windows 7 in both cases). And so I finally discovered a "new" gotcha: network drives mapped on login may vanish mysteriously.

Under the new security model, Admin users get logged in twice behind the scenes. Once as full administrators; a second time as regular users. By default, Explorer and general applications are run under the regular user login. Installers and programs elevated by UAC prompts will run under the full administrator login.

Drive mappings are not shared between the two behind-the-scenes logins.

The best way to determine whether your two logins have separate ideas about drive mappings is to open a regular command prompt and and administrative command prompt. Type "Z:", for example, in both windows and look for a mismatch.

I ran into a problem with a crummy application which requires mapped drives and admin access (for no good reason). Since Active Directory scripts map drives under the regular login — but not the admin login — I could see the mapped drives in Explorer, but not inside this elevated app.

The fix I'm using follows KB937624. It involves adding a registry value and rebooting. The effect of the new value is to share drive mappings between the behind-the-scenes logins. Why isn't this enabled by default? The questionable excuse from Microsoft is that non-admin processes could maliciously redefine drive mappings for admin context processes. That makes sense...for Vista. I thought Windows 7 was about easing up on the security defaults to keep us from being frustrated by things like this.

Here's the registry location:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

then add a new DWORD:

EnableLinkedConnections

and set the value to 1.

Basic Setup for Wyse ThinOS + Windows Terminal Server

2010-02-23T15:20:00.009-06:00

Consider this a quick start guide for a particular scenario: you want multiple Wyse ThinOS terminals to automatically log into a Windows Terminal Server with terminal-specific user accounts.

In this example, the user accounts "Front Desk" and "Utilities Console" are already configured on the Terminal Server (or its domain). Here's what needs to happen when one of the thin clients is powered on:

Client looks for DHCP services and configures basic network parameters. (Client IP can be dynamic.)
Client checks DHCP option 161 and finds the static IP address of the FTP server.
Client logs into the FTP server anonymously and runs /wyse/wnos/wnos.ini which contains the settings for all Wyse ThinOS clients.
wnos.ini includes a line which causes the client to look for /wyse/wnos/inc/[MAC].ini where "MAC" is its own MAC address. This contains client specific settings, e.g. "Front Desk" credentials. Either wnos.ini or [MAC].ini will instruct the client to connect to the Terminal Server.

Note: The Terminal Server, DHCP server, and FTP server may all be the same host or three separate hosts. Or a 2 / 1 split. It just doesn't matter.

Terminal Server Setup

Make sure the user profiles are set up correctly on the Terminal Server by using any RDP client.

DHCP Setup

Check the scope options on the DHCP server. For Windows 2003 Server, this will be under [Server]->Scope->Scope Options->Configure Options->General tab->Available options. Option 161 is not defined by default, so it will probably not be on this list.

To define a new DHCP option in Windows 2003 Server, right click on [Server] and select Set Predefined Options. Click Add.

Name: Wyse FTP Server
Data Type: String
Code: 161
Description: FTP Server for Wyse ThinOS Clients

(Only the Code value is vital.)

DHCP services may need a restart. Go back to the scope options, enable the newly defined option, and enter the IP address of the FTP server.

FTP Setup

Use any familiar FTP server. The following just needs to work:

> ftp [FTP server]
> Name: anonymous
> Password: anonymous
> cd wyse
> cd wnos
> ascii
> get wnos.ini
> cd ini
> get [MAC].ini

Both wnos.ini and [MAC].ini are going to be plaintext configs. Feel free to make test versions with any content to make sure the FTP is working right.

Example Network Values

User: Front Desk
Pass: easyPass8
MAC: 0123456789AB

User: Utilities Console
Pass: easyPass4
MAC: 1023456789CC

Domain: toasterco.local

FTP IP: 192.168.1.40 (not used in the configs below, to avoid paradox)

Terminal Server IP: 192.168.1.50
Terminal Server Name: Legion-srv

Example wnos.ini

AutoLoad=0
AutoPower=yes
SignOn=no

include=$mac.ini

connect=rdp \
icon=default \
description= "Legion-srv" \
host=192.168.1.50 \
Fullscreen=yes \
Reconnect=yes \
Autoconnect=yes

Example 0123456789AB.ini

connect=rdp \
description= "Legion-srv" \
host=192.168.1.50 \
icon=default \
username="Front Desk" \
password=easyPass8 \
domainname=toasterco.local \
Fullscreen=yes \
Reconnect=yes \
Autoconnect=yes

Exit=all

Example 1023456789CC.ini

connect=rdp \
description= "Legion-srv" \
host=192.168.1.50 \
icon=default \
username="Utilities Console" \
password=easyPass4 \
domainname=toasterco.local \
Fullscreen=yes \
Reconnect=yes \
Autoconnect=yes

Exit=all

Final Comments

The line "include=$mac.ini" in wnos.ini will cause execution to jump to the individual config file if the MAC match is successful. The line "Exit=all" at the end of an individual config will stop execution. Otherwise, it would return to the general config file and individual settings would be overwritten.

Wyse Support has plenty of reference documentation covering these config file options and many more. Don't even have to log into the support site to access this material. Yay for that.

Lost in Translation

2010-02-15T02:26:00.002-06:00

Windows drives are usually formatted as NTFS. OS X drives as HFS+. Those little USB thumb drives are usually in FAT32 format which serves as an "it just works" common ground.

But FAT32 doesn't always "just work" because it has a 4 GB limit on on individual files. Full DVD images, backups, encrypted containers, and other types of files already routinely exceed this limit. Plus, it's inconvenient to copy files to an intermediary drive when Windows has direct access to a HFS+ drive or OS X has direct access to an NTFS drive. I run into this at work quite often when I connect Windows drives to my Macbook through a USB adapter. Or at home when I want to transfer a file between my OS X partition and the Windows "Bootcamp" gaming partition on the same physical drive. I've been forced to learn about how both OS X and Windows handle the other operating system's preferred format. The answer: not always so well!

Windows

Can't read or write to HFS+ drives by default.
Third party products add such support. Two examples. I haven't tried them.
Bootcamp includes a driver to access HFS+ drives, free if your Windows is installed on Apple hardware. WARNING: this driver can corrupt data as of Bootcamp v3.0 and 3.1.

OS X

Can read NTFS drives by default.
Can't write to NTFS drives by default.
Here's the major third party commercial product from Tuxera to add NTFS writing support. Haven't tried it or installed the open source NTFS-3G driver it's based on. See question 3.2 here. It turns out the Startup Disk app in System Preferences would stop showing the Bootcamp partition. Since I don't have an official Apple keyboard, pressing Option on boot to manually select Windows does not work.
If you don't mind command line tinkering on a per drive basis, Snow Leopard has a built-in NTFS driver. Manual instructions. I couldn't get it to work right, though I didn't mess with it for long.
A free GUI utility with kitten art makes the built-in Snow Leopard driver...actually work with little effort! And doesn't appear to corrupt data as "reliably" as the Bootcamp driver does.

What's all this talk about corrupting data? On two separate occasions I transferred DVD images from OS X to Windows using the Bootcamp drivers and ended up with changed files. I verified this with MD5 hashes. Retested after upgrading to Bootcamp v3.1 hoping Apple had fixed the drivers, but no such luck. The NTFS Mounter utility actually does appear to maintain integrity, also tested with MD5 hashes.

So, what are the lessons here? Microsoft and Apple are complacent about making their stuff work together for the good of consumers (and technicians) who work with both kinds of formatting. If you need to move a file, try using a FAT32 formatted thumb drive. If that won't work...

Windows -> OS X partition. Boot into OS X and read from NTFS.
OS X -> Windows partition. Use the network; it's more reliable. Or boot into OS X and try the NTFS Mounter utility. Do not boot into Windows and try using the Boot Camp drivers until this gets fixed.

Either way, it's a good idea to learn how to use an MD5 or SHA-1 hashing utility. Make sure the output is the same on the file both before and after the copy.

Resize Of Last Resort

2010-01-28T16:04:00.002-06:00

OS X only allows window resizing by dragging the lower-right corner. If that corner isn't visible, dragging the whole window up and to the left usually does the trick. But what if the entire window is off the screen, or what if the window is too large to bring the corner into view?

First, try the Zoom function. In the case of a large window, just click the green circle on the top left corner. For an off-screen window, select it with Exposé, then use Window->Zoom in the menu bar.

Still no good? Change resolution in System Preferences->Displays. The operating system will try resizing all windows to fit. You may need to lower then raise the resolution to maximum.

Firefox 3.6 Tab Order

2010-01-23T19:01:00.003-06:00

After updating Firefox to 3.6, I noticed new tabs were inconsistently opening either right next to the current tab or to the right of all tabs. Previously, all new tabs opened at the far right. If you're opposed to things changing in life:

Type "about:config" without quotes in the address bar. You may need to confirm if you haven't played around with these settings before.
Type the word "related" without quotes in the filter field.
Double click browser.tabs.insertRelatedAfterCurrent so the value toggles to false.

The "Related" part of the setting explains the inconsistency. Firefox tries to place tabs from the same domain next to each other, but right now it doesn't even do this right every time. Nor do I see an option to open all tabs right next to the current one, which I actually might prefer.

EDIT - I've since come to prefer the new default. Go figure.

Global Address List Not Updating

2010-01-21T09:48:00.000-06:00

Symptom

After adding a new global distribution group to Exchange 2003, Outlook clients fail to list the new group in Address Book->Global Address List. The group does, however, appear in Address Book->All Address Lists->All Groups.

Cause

Outlook clients are caching address book information in *.OAB (offline address book) files. These should be updated over the next 24 hour automatically. Not exactly convenient.

Manual Fix

Close Outlook and any other MAPI profile applications on the affected desktops. In the user's home folder, browse to AppData\Local\Microsoft\Outlook. (Note: you may need to enable hidden file viewing & the path will differ slightly for pre-Vista versions of Windows.) Delete any *.OAB files and restart Outlook. New *.OAB files should be generated from current data.

VLC Short Freeze Fix

2010-01-19T15:18:00.002-06:00

VLC follows the "it just works" philosophy much better than QuickTime player. However, I've been plagued by a consistent short freeze a few seconds into playing any video file. After reading through several threads about other people having this problem on their Macs, I found a solution.

VLC -> Preferences.
Click 'All' instead of 'Basic' button on the lower left.
Input / Codecs -> Access modules -> File -> Caching value in ms.
Set this caching value to a higher number. 4000 works for me. I assume this means cache ahead four seconds. Now everything runs smoothly!

Symbolic Links & Junctions in NTFS [or] 'How do I move my Sims 3 Save?'

2010-01-17T00:03:00.000-06:00

A Big Mess / The History of the Problem

Vista and Windows 7 have made a lot of advances over the older systems— The system is almost entirely different from Windows 95 now. The benefit of course is that it's now a decent system; the downside is that a lot of the applications we have come to rely on may not always be up to snuff with the Windows developer guidelines, and like a lot of Windows users, are still trying to do things the "old way" on the new system.

One of the biggest changes in Vista/W7 was the removal of the "Documents and Settings" Directory: You remember, when all of your stuff was kept in "C:\Documents and Settings\John Snow\My Documents". Everything was there, downloads, pictures, documents and non-documents, all in a horribly long and redundant filepath.

Vista introduced a more UNIX-like concept of file organization along with UAC: "C:\Users\". It seems like they just renamed the folder, but one of the key differences here is that user's files are now kept in meaningfully named subdirectories of that folder: ultimately meaning that now the "My Documents" folder is meant for— Surprise— Just documents, and not absolutely everything.

So what's the problem? Older Windows programs are still hard-coded to use "My Documents" as the root-level for all of a user's personal files, but this is no longer the expected or desired behavior in W7. Most of the time, you should be able to change these paths, but some programs refuse to let you. One of these programs is EA games' "The Sims 3", which stubbornly chooses "C:\Users\John Snow\Documents\Electronic Arts\The Sims 3" as its sole directory for savegames.

But what if you have a backup script that is set to backup your Documents directory to some external drive, and is only expecting a few gigs of easily compressible documents, and not the monolithic savegame of "The Sims 3"? Shouldn't EA be saving your saved games to "C:\Users\John Snow\Saved Games\Electronic Arts\The Sims 3" instead? How can we fix this?

The Fix

The answer is a special type of shortcut that is well-known to Linux/UNIX users called a 'Symbolic Link'. In NTFS there are two kinds; Junctions or Symbolic Links, and they work by making hidden links from one location to another, like some kind of hyperspace wormhole, but much less exciting. Unlike regular Shortcuts, these links work on a low level to help your data be accessible from multiple points. Default installs of Vista/W7 use these links to link the "old" directories, such as "Documents and Settings", to the new ones, "Users". The benefit is that old programs that haven't been updated to the new standards of Vista/W7 will work: The downside is that your files get rather cluttered.

System Administrators will find the CLI tools 'Junction' and the Vista/W7 standard 'mklink' very useful. "Power Users" may find the shell extension program 'Link Shell Extension' better to use. I'll explain how to use mklink and junction first.

Using mklink:

Open up an administrative CLI session, and using our Sims 3 Example, we'd type:


CD %userprofile%\Documents\
move "Electronic Arts" "%userprofile%\Saved Games\"
mklink /D "Electronic Arts" "%userprofile%\Saved Games\Electronic Arts\"

Or if we wanted a Junction instead of a Symbolic Link;


mklink /J "Electronic Arts" "%userprofile%\Saved Games\Electronic Arts\"

Then to hide our new link, we can type:


attrib +S +H "Electronic Arts" /L

Using Junction: Download and extract the executable into your "C:\Windows\System32" folder, then open up a CLI session. Let's continue with the Sims 3 example:

CD %userprofile%\Documents\
move "Electronic Arts" "%userprofile%\Saved Games\"
junction "Electronic Arts" "%userprofile%\Saved Games\Electronic Arts"
attrib +S +H "Electronic Arts" /L

The last line sets the link as Hidden and a System File so it is out of sight, out of mind.

Using Link Shell Extension: This is a slightly less involved way of doing it, and if you don't intend to script or batch-process some links, might make more sense to you. Download and Install LSE, following the on-screen prompts.

After installation, move the folder you want to relocate to where you want it to "really" be. Right-click the folder in its new location and select "Pick Link Source". There will be no confirmation.

Then go to where the folder "has to be", where the program (The Sims 3) expects the save to be. Right-click in a blank spot in the folder and select "Drop As ..." then choose "Junction." (2000/XP+) or "Symbolic Link" (Vista/W7+) You should now see a new folder with an icon that looks like the one on the right. If you want to hide the junction, you can right-click, choose properties, and hide it like a normal file. To make it a hidden system file, though, you'll have to use the CLI. (See above!)

Using any method, you can even create junctions across partitions or hard drives: Giving you the exciting ability to force a program to save onto a more spacious drive, for instance. Using Symbolic Links instead of Junctions gives you the ability to link to files on other Vista/W7 shares across the network, but the feature is only available on Vista/W7, and only to systems administrators. There are no functional differences in this context otherwise.

For more about the differences between Junctions and Symbolic Links, check out the Wikipedia articles; Junction Points & Symbolic Links.

Good luck!

iTunes & Music File Organization

2010-01-02T01:49:00.003-06:00

iTunes is designed to make playing and organizing music easy, assuming you stick with iTunes and iPod devices. If you want to try another music player (e.g. Songbird), or copy your music to a Windows desktop, or share music files with another account on the same computer, or just prefer direct control over file naming and organization, you need to know how iTunes works with music files.

Open your home folder in Finder, and look in Music->iTunes. This folder always contains your personal settings, playlists, etc. By default, any imported music files are copied to the iTunes Media subfolder and played from that location.

Advantages to playing music from iTunes Media:

If you import music files from a removable drive, then disconnect the drive, iTunes can still play the copies it made to ~/Music/iTunes/iTunes Media.
Moving, renaming, or deleting music files anywhere outside the iTunes Media folder will not affect your iTunes Library. No "file could not be found" error messages.
If "Keep iTunes Media folder organized" is enabled in Advanced preferences, any changes you make to a track's "Get Info" dialogue will automatically be used by iTunes to rename files and organize folders within the iTunes Media folder.

The other option is to have iTunes play music files directly from where they were when you imported them. To enable this option go to iTunes Preferences, then Advanced, then uncheck "Copy files to iTunes Media folder when adding to library." (Note: iTunes will keep using files in iTunes Media if they were added to the Library before disabling the default.)

Advantages to playing music directly from the import location:

Only one copy of each song, whether it is being used with iTunes or another application. This cuts down on complexity and drive space usage.
iTunes is unable to delete, rename, or move music files outside of the iTunes Media folder. (It will, however, update tags and manually embedded album art.) You may prefer this as a safety measure, or to ensure iTunes does not reorganize files being used by other applications.
Different accounts on the same computer can reference music files in a folder like /Users/Shared/SharedMusic without the odd side effects of sharing iTunes Libraries.
You can organize music files and folders any way you like. I prefer having all tracks from the same artist in a single folder. I name files so that sorting by name still keeps the albums distinct, e.g. "PJ Harvey - White Chalk - 04 - When Under Ether.mp3".
If you want a fresh default iTunes library for any reason, simply delete ~/Music/iTunes, reopen iTunes (a new ~/Music/iTunes will appear), and reimport your music. Only things like playlists and play counts will be lost.

Playlists work the same either way. There's never behind-the-scenes file copying when you place a song in a playlist, and no file deletion when songs are removed from playlists. Think of them as shortcuts to Library songs, with no concern where the Library is getting the songs.

I keep my music in ~/Music/Archive and instruct iTunes to play directly from that location. Sometimes I use other applications to play, tag, and rename my music files to my liking. The only real hitch is letting iTunes know when I have renamed or moved a file. I have to go into iTunes, delete the track[s] from the Library, then reimport ~/Music/Archive. Any music files it didn't already know about will be added to the Library. If I've made many changes, I may clear out the entire Library before re-importing the folder tree. It doesn't take long.

Misc. iTunes Tips:

Drag tracks out of iTunes directly to the desktop or another folder to easily make copies of the files iTunes is using, whether they be in the iTunes Media folder or elsewhere.
To remove a song from a playlist and the iTunes Library, use the Option-Delete key combo.
Find out which on-disk file iTunes is using for any given song by right-clicking the song and selecting Show in Finder.
In "List" view, select View->Show Artwork Column to see all those nice covers without using Cover Flow.
Select all the tracks on an album, right-click, and select Get Info. Drag an image file into the Artwork field and click Ok. iTunes will resize and embed the art into every file, whether they be in the iTunes Media folder or elsewhere.
Use "Get Info" on a single track with embedded artwork, click on the Artwork tab, and drag the image out to a folder to easily extract it. Useful as a first step if only some tracks on an album have the right art. (Browse the folder containing the files in Finder to see which files have embedded art; you may need to log out of OS X and back in for Finder to notice newly embedded art.)
The "Grouping" field is not often used. I find it a handy place for tags like "single" or "archive" which I combine with Smart Playlist rules. One Smart Playlist only lists "archive"-marked tracks which aren't singles. Another only lists new music I haven't yet put into my neatly organized Archive folder. Another only lists singles. Unfortunately iTunes can't use rules based on file path. This is a decent workaround.

What's On Second?

2009-12-10T14:11:00.003-06:00

It can be a hassle finding out which Windows network ports are in use and by what process. Here's gem of a free utility with an obvious name: Active Ports.

The only important configuration step is Options -> Update Speed -> Paused. If you need an update, use Options -> Refresh Now and avoid the real time flickering jumble. Simple and effective. None of this "use one tool to find the PID then go look up the PID" runaround.

Syncbox, Backupbox, Magicbox

2009-11-24T09:39:00.005-06:00

Finally heard about Dropbox last week and I'm loving it. I write and take notes on my notebook and desktop computer, but it's been a real pain to copy revisions between the two. Sometimes I've had to merge two updated copies. Worst of all: I've avoided writing when I otherwise would have. Now my in-progress documents stay up to date on both systems. I keep them in the Dropbox folder, but put shortcuts ('aliases' in Mac speak) with the rest of my local documents.
Did the same thing with my plaintext List O' Passwords. Security risk? Hardly. The Dropbox wiki is cool enough to actually recommend uploading encrypted containers. I don't even have to trust Dropbox's claim that they won't let their employees read my stuff. OS X makes this extra convenient because I can just double click an alias to a file in the encrypted container and — since the password is on my keychain — the container auto-mounts and my password file opens.

ZyWall Next To The Firewall

2009-11-19T11:56:00.013-06:00

After years of messing around with the unstandardized IPSEC standard, I recently had the opportunity to set up a commercial implementation of an SSL based VPN. Beyond several other advantages, SSL connections are common and expected by practically all intermediary networking devices; if encrypted websites work from a given location, SSL VPNs will too.

OpenVPN is the open source community's offering in this area. When I messed around with OpenVPN a couple of years ago, it had great cross platform compatibility but was a little rough on end user setup. Plus I'm not experienced enough with troubleshooting and maintaining unix systems to feel comfortable supporting an OpenVPN server.

Enter the ZyWall SSL 10 appliance. My users just have to visit a web site, enter their Active Directory credentials, and the client will install. It isn't as cross-platform as OpenVPN and the web UI could use some trimming down. But the main issue had to do with Remote Desktop resolution. First I should explain the two modes of access:

SSL Applications. These are a restricted set of services like remote desktop, file server access, telnet etc. which are handled within the web browser. In fact, this kind of proxying is what most people think of when they hear "SSL VPN." The end user has no direct access to the hosts on the business network. Convenient if it's all you need.
Full Network Access. A true sister technology to IPSEC based VPNs. Regular host to host network traffic is multiplexed over an SSL tunnel. This is what OpenVPN does without using a web browser at all.

It turns out the SSL Application version of Remote Desktop has a low limit on screen resolution. End users could select "full screen" all they liked, but on any decent monitor black bars would surround the desktop. I knew Full Network Access combined with starting Remote Desktop Connection manually would work, but Full Network Access wasn't functioning at all.

ZyXEL assumes you will be using the ZyWall as your LAN's default gateway. I'm running it side-by-side with a Netscreen firewall which is the actual default gateway. Remote users must be assigned a "Remote User IP Address Pool" which can't be in the LAN subnet. So the remote host would initiate a connection with a LAN host (1-3), the LAN host would try to respond to the out-of-subnet private address via the firewall (4), and the firewall would shrug and drop it.

The fix is to add step (5). Configure the LAN gateway to route traffic destined for the .51 subnet (for example) to the ZyWall's .50 subnet IP. The ZyWall will know how to get it back to the remote user.

Tip - Full Network Access can be restricted to particular IPs on each policy if you define single host (/32) "networks".

Another Tip - Policies can only reference Active Directory groups, not individual users. A silly but effective workaround is to create a series of AD groups like "BobZyWallGroup" for each user if you want per user control.

Blackberry Wireless Contacts

2009-11-17T10:26:00.001-06:00

Ran into a problem of contacts no longer syncing wirelessly to a particular handheld even though wireless mail and calendar were fine. I noticed the following symptom:

Contacts -> Menu Key -> Options -> Contact Lists - Desktop -> Wireless Synchronization - Not Available

I resolved the problem by first checking the user's properties in Blackberry Manager (on Blackberry Enterprise Server). Properties -> PIM Sync -> Address Book -> Synchronization enabled -> True. If already set to True, it sometimes works to toggle it off, wait, then back on.

Second step is to delete the 'Desktop [SYNC]' service book in Options -> Advanced Options -> Service Book -> Desktop [SYNC]. Then resend service books from the server (or BIS if you're using that). SYNC takes care of the wireless sync items not covered by CMIME (mail) and CICAL (calendar).

Third step is to run through Enterprise Activation again. My most recent incident was fixed at this point, without having to fully wipe the device before reactivating.

Long Invisible Wire

2009-11-16T10:51:00.000-06:00

A client recently wanted to extend the LAN to a second building across the parking lot, but not badly enough to pay for a buried fiber line. Standard wireless wouldn't reach at all (didn't hurt to try). So I looked into directional wireless solutions. After rejecting several out of hand for not being much of a price advantage over fiber, I found this suspiciously inexpensive point to point kit from RadioLabs. No idea if it works at distances measured in miles, but it's working out surprisingly well for my client's situation. Ping is consistently showing 1, 2, and 3 ms responses. Bulk file copying to a Windows share is just over 2 megabytes of payload per second.

Setup was fairly easy. I received a wireless router and a wireless access point with very typical looking web management. They could be used as standalone gear. Configuration went like this:

Set my Macbook's wired interface for the 192.168.1.0/24 subnet. (The included instructions actually walk through doing this for Windows and OS X.)
Disabled DHCP and such on the router. This was simply a bridge. Ignored the WAN port entirely.
Followed instructions to put the router into Wireless Distribution System mode. Typed in the MAC address of the access point as the other end of the bridge. Did the same for the access point. Made sure I could ping one from the other.
Set up non-default passwords. Switched both devices to a pair of unused IPs in the client's subnet. Turned on WPA2 encryption.
Turned off both devices, unscrewed the small antennas typical of access points, and hooked up the directional ones. Made sure it all worked as a ten foot long wireless bridge.

Didn't need to mess with configuration at all once they were deployed. Simply eyeballing the alignment worked fine in this case. I'm happy with my first point to point experience and would recommend this kit for any similar situation.

Right Click, Focus, and Frustration

2009-11-14T01:33:00.001-06:00

I've noticed right-clicking a non-focused window in OS X does not bring that window into focus. Two scenarios which have bitten me multiple times:

Right-click an icon while anything besides Finder has focus, click Get Info, wonder why nothing happened. Oh! The info window opened underneath other windows.
Copy an URL from the web browser. Right click on a chat window and left click Paste. Hit Enter. Enter goes to the web browser.

I'm sure more counter-intuitive shenanigans await. Clicking my mouse on a window should focus that window. The only reference to this behavior I've been able to find is this short article. Apparently it's a convenient feature! Great, where do I turn this wonderful feature off?

A Format That QuickTime Player Understands

2009-11-13T23:15:00.003-06:00

"You may need to install additional software to open this type of file."

Video files often fail to "just work" on Macs. Even worse: file extensions (like .avi) are little more than hints about the actual video format. Try running VideoSpec on such files.

Too much detail now? Click the Tools icon and a panel will appear with practical information, e.g:

This video will work in Quicktime if you add the Perian component. Just click Go to be taken to the Perian website for further instructions. Or, search for one of the "alternate movie players" listed. Any of those should have built-in support for this kind of video.

Feeling preemptive? Install these two components to cover most of what QuickTime can't handle by default:

New File Here

2009-11-11T12:44:00.007-06:00

When I switched from Windows to OS X, the lack of any way to create a new file in a given Finder folder was a prime annoyance. I've already navigated to this folder once, why must I open an app and navigate here again? Windows handles it neatly:

NuFile is a now-defunct OS X app which worked almost the same way. The project was apparently abandoned and NuFile stopped working entirely with Snow Leopard. Document Palette to the rescue. Once installed, all you have to do it hit Control-Option-Command-N —not as bad as it sounds!— and you will be presented with a Dashboard-esque overlay of new document templates. Click or arrow over to the appropriate template and an "untitled.[whatever]" will appear in the current folder.

Document Palette exceeds Windows functionality by allowing the user to easily add custom document templates. For example, I saved a fresh book/article document in LyX*, then dragged it into the Documents section in the Document Palette app to teach it how to make a new kind of file. Presto!

Portable Encryption Made Easy

2009-11-10T16:50:00.007-06:00

Scenarios:

Your USB thumb drive or notebook with confidential company data goes missing.
A snooping sibling figures out how to boot your desktop from a DVD which ignores file permissions.
Your spy cell needs to sneak information past border guards and you've never heard of the Internet.

Encryption can help! One option for Windows users is to encrypt the entire system drive with TrueCrypt. Mac users an encrypt their entire user profile with FileVault. These are good for securing everything at once; even things like web browsing history will be covered. However, any file you copy to a USB drive or send through email will lose its encryption when it leaves the local system. There is a lighter, more portable option if you're really only concerned about things like financial files, a personal journal, or passwords.

An encrypted container is a single file which looks like a bunch of random bits until the key is typed in. At that point the container is mounted and shows up like a CD or thumb drive. Any sort of files can go into it. When unmounted, the container file can be copied and moved around like any other file without losing encryption.

OS X has encrypted container support built in.

Open Applications->Utilities->Disk Utility.
Click New Image. "Save As" will be the name of the container file, e.g. "nothing to see here." "Name" will be the mounted drive, e.g. "Confidential." You'll also need to pick a size. Setting encryption to 128-bit should be fine. Leave the rest to defaults and click Create.
Create a strong password/key and write it down somewhere safe (not on the same computer). If you want OS X to remember the password for you on this computer, leave "Remember the password in my keychain" checked.

Any other Mac can open the container file if the key is provided.

Note - The Sparse Bundle Disk Image format is a useful alternative in Step 2. Both Sparse formats allow the container to grow as data is added, rather than start at the maximum size. Sparse Bundle lets Time Machine back up changed parts of the container instead of the whole thing every time. If you've removed files from a Sparse Bundle and want it to shrink back down, open Terminal and run: hdiutil compact [filename]

Windows needs help from TrueCrypt. Download and run through the setup.

Open TrueCrypt from the Start menu.
Click Create Volume. Leave it on "Create encrypted file container" and click Next. Leave it on Standard and click Next.
Click Select File, then pick where you want to save the encrypted container. It can be named anything, but I recommend putting ".tc" at the end, e.g. "nothing to see here.tc".
Default encryption options are fine. Size is up to you. Then create a strong password/key and write it down somewhere safe (not on the same computer). Unlike OS X, Windows has no option to remember this key for you.
On the Volume Format page, I recommend changing Filesystem to NTFS if the container is large. Leaving the format as FAT would be a good idea if you plan to open it on non-Windows systems. Move your mouse around in this window for a minute then click Format. Exit the Volume Creation Wizard once the format is complete.
(Recommended). In the main TrueCrypt window, click Settings->Preferences. Put a check next to "Open Explorer window for successfully mounted volume."

If you put a ".tc" extension on the container file, just double click it to open TrueCrypt. Select a different drive letter if you like, then click Mount. Enter the password/key, then the lettered drive will show everything inside the container.

TrueCrypt is also available on OS X and Linux platforms. Worth considering in place of the built-in OS X encryption if you plan on moving container files between the two platforms.

Transmission on OS X

2009-11-08T22:52:00.004-06:00

Transmission is my BitTorrent client of choice, with one big downside: downloading more than a couple of torrents at once can lock down the entire system. Can't even reboot without cutting the power. From what I gather, it has to do with a bad interaction between OS X and trying to limit network connections within an app. It's been going on for a while and neither Transmission nor OS X updates have fixed it (currently versions 1.76 and 10.6.1). However, there is a workaround.

I poked around long enough on the forums to find a megathread discussing the topic (the developers are too cool to put a frequently asked question in the FAQ). Apparently it just takes changing a few default kernel settings related to networking.

Open a Terminal window. Applications->Utilities->Terminal.
Back up the current sysctl.conf file, in case there is one:
cp /etc/sysctl.conf /etc/sysctl.conf.backup
Open your favorite text mode text editor, for example:
sudo pico /etc/sysctl.conf
Copy/Paste or just type in the following:
net.inet.tcp.rfc1323=0 net.inet.tcp.recvspace=32768 net.inet.tcp.sendspace=32768 net.inet.tcp.win_scale_factor=1 net.inet.tcp.sockthreshold=0
Save, exit, and reboot the system. To save in Pico, hit Control-X, then Y, then Enter.

If this doesn't work, or you want to reverse the change for any reason, just go back to Terminal and copy the backup to the original location. Hopefully a future update will remove the need for system alternations.

What are the default settings anyway?
net.inet.tcp.rfc1323
default 1; workaround 0

net.inet.tcp.recvspace
default 65536; workaround 32768

net.inet.tcp.sendspace
default 65536; workaround 32768

net.inet.tcp.win_scale_factor
default 3; workaround 1

net.inet.tcp.sockthreshold
default 64; workaround 0

I'm not curious enough to research the impact of these changes right now, but the best places to start would be RFC1323 and the classic TCP/IP Illustrated. If anything, I suspect it means slightly less optimal TCP connections in some other cases. Preventing a system freeze takes precedence.

Mounting FreeBSD7 (UFS2) Partitions in Fedora Linux

2009-11-08T15:32:00.006-06:00

Normally, this would seem like a no-brainer: to mount a FreeBSD partition in Linux you should be able to use the following command:

mount -t ufs -o ufstype=44bsd,ro <device> <mountpoint>

and from Fedora 11's manpage, it would seem like this is a solid choice:

Mount options for ufs
ufstype=value
UFS is a file system widely used in different operating systems. The problem are differences among implementations. Features of some implementations are undocumented, so its hard to recognize the type of ufs automatically. That's why the user must specify the type of ufs by mount option. Possible values are:

[...]

44bsd For filesystems created by a BSD-like system (NetBSD,FreeBSD,OpenBSD).

[...]

Unfortunately, executing this command won't produce the desired results. What you're actually after is the option:

ufstype=ufs2

Which appears to be undocumented. The command will fail if you do not also specify the ro option: Mounting UFS2 partitions in Fedora Linux is read only. The complete command, then, looks like this:

mount -t ufs -o ufstype=ufs2,ro <device> <mountpoint>

This will at the very least, come in handy if you are migrating from FreeBSD to Linux and would like to carry your precious stuff over with you with minimum hassle.

A Clear Desktop

2009-11-07T22:08:00.012-06:00

I won't try to explain why an icon-free Windows desktop is better. (Wrong thinking individuals will only resist harder.) Instead, I'd like help with that last icon. The most useful and annoying icon. You guessed it: Recycle Bin.

Before hiding the Bin, make sure it's still accessible somewhere. No one likes seeing a trash can in the kitchen, but there had better be one within reach.

* Right click on Recycle Bin and select Create Shortcut.

* Rename the shortcut to simply "Recycle Bin." The little shortcut graphic in the corner is hint enough for the truly curious.

* Important XP step (Win7 and probably Vista users can ignore it). Move this shortcut to some folder besides the Desktop. I like to put it in my Documents folder.

* Now, drag the shortcut down to Start (in XP) or the Windows logo orb (in Vista or Win7), then drop it in some handy spot on the Start menu. Right click to confirm it still allows Empty Recycle Bin.

Great, now it's time to hide the Bin on the desktop. Vista and Win7 make this easy: right click the desktop Bin and select Delete. To bring it back, right click on the desktop itself, click Personalize, then select Change Desktop Icons.

XP didn't make it easy to play Hide the Bin. The usual remedies involve either manual registry editing or group policy editing. I recommend another approach: TweakUI. This tiny program from Microsoft opens up a bunch of settings Control Panel left out. Download it from the Microsoft Powertoys page. Hide or unhide Recycle Bin here:

Now no clutter will remain between you and that perfect desktop.