I’m looking at one of the higher end HP or Dell’s running Vista Ultimate with a dual monitor setup for home.  I have dual monitors at work and it gets pretty hard to get all the work I want to get done at home when I only have a single 17″ flat panel.  Pretty low tech if you ask me.

For those of you who do donate, thank you very much.  I appreciate it.  For those of you who don’t, I won’t hold any grudges.

Well, this computer took up more than a few hours of my time as well as another associate of mine.  The computer no matter what we did would not syncronize files during the logon process even thought the little checkbox was checked to do so.  As it turns out, Dell has some sort of security suite that they are deploying with all the laptops now with the name of WavXDocMgr.  This was the culprit of the syncronization issue.  We took this out of MSCONFIG as a startup process and the problem was solved.  As this was not the answer but rather a workaround, we have started talking with Dell but as of yet have not found a fix for the issue so I thought I would share.

So lets use the command to find more about our Exchange queues (Exchange 2007 Server).

Get-Command *queue*

Which will return a list of commands that you can run from PowerShell like Get-Queue, Retry-Queue, and Suspend-Queue.

Now lets try something to do with Active Directory.  Try this command.

Get-Command *User*

It’ll return a boatload of commands but you can see a few that might be useful like New-ADUser and New-ADGroup.

Hopefully this will shine some light on the still fairly new (feeling) command line power of Microsoft’s Operating Systems.

Open regedit and find the key

HKLM\SYSTEM|CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols

Now for SSL 2.0 you will want to create a new DWORD value named Enabled with a data value of 0 in Hex in both the client and server subkeys.  This will disable the ability for the server to use or allow the use of SSLv2 during the use of SSL.  You can also create a registry import like the following.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client]
“Enabled”=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server]
“Enabled”=dword:00000000

Again with this one, Nessus will find the vulnerability fairly easy so their is almost no reason to have it running. Nessus’ vulnerability will be displayed as “Synopsis : The remote service encrypts traffic using a protocol with known weaknesses.”

NOTE: This change may break clients/servers/applications so I take no responsibility for YOUR actions.

This piece is on restricting weak ciphers within your SSL certificates.  Nessus and some other security auditing tools will detect this one with ease so there’s really no good excuse not to lock it down.  Basically what we are going to do is remove the ability for web clients (IE, Firefox, Safari, Opera, etc) connect to the web server with anything but 128 bit or greater SSL encryption.  This just sounds like a good deal anyway if you as me.

An example of a weak cipher is like I mentioned above, anything less that 128 bit encryption.  There are about a dozen methods of encryption from SSL_RSA_EXPORT1024_WITH_RC4_56_SHA to SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5.  Yes I know that sounds cryptic and it really is (pun intended).  So what we need to do is scan the host first.  You can use Tenable Nessus or your choice of scanning utility but we want to see what it comes up with.  Chances are if you were diligent during the setup of the server, you may not have to do this but if your the other 95% out there, then you will need to do the following.

Open "regedit" and find the key
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers.

This will have a number of other subkeys below it.  Next we will want to disable anything that has a number less than 128 in it.  I.E. RC2 40/128 we will disable but RC2 128/128 we will not.  Clear as mud?  To disable the cipher click on the subkey that you want to disable and create a new DWORD value named Enabled.  In the value data keep it 0 in Hex.  This will disable the cipher from being able to run.  You could also create a registry import like the following.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128]
“Enabled”=dword:00000000

I would do this for RC2 40/128.  RC4 40/128 and RC4 56/128.  I feel better already.  Hopefully you will too after you get this done on your website.

NOTE: This may break some clients/servers/applications so I take no responsibility for YOUR actions.

Exchange 2003 has 6 total virtual directories. They are as follows:

Exchange | Exchweb | Exadmin | OMA | Public | Microsoft-Server-ActiveSync

For more information on the function of each virtual directory please visit this Daniel Petri’s website which is where I normally go to get the how-to for this function.

Now that we have identified the virtual directories associated with OWA, we need to backup the configuration and then delete them. I know, this seems like a really huge step, it was for me the first time I did it but now I do it on a regular basis. You will need to backup the configuration from IIS Manager by right clicking on the Default Web Site and going to “Save Configuration to a File”. I don’t think I need to walk you through the rest of the dialog boxes, you’ll figure it out.

Now that the configuration is backed up, delete the 6 virtual directories mentioned above. You may also, depending on OS version, have a virtual directory “exchange-oma”. Leave it alone for right now, we will get to it in a bit. Before we recreate the virtual directories, we need to delete a key out of the IIS Metabase. For this you will need to download the IIS 6.0 Resource Kit from here. Go ahead and install the package and navigate to “Metabase Explorer” which is part of the resource kit you just installed. In Metabase Explorer you will have some keys on the left hand side, LM being one of them. Expand the LM key and you will find the first one (ususally) to be DS2MB. Delete it the key DS2MB. DS2MB stands for Directory Service to Metabase. It’s purpose is to transfer configuration information from AD to IIS. It’ll get recreated during the next process.

Now that the virtual directories and the DS2MB keys are deleted, you can restart the “Microsoft Exchange System Attendant” service. That will recreate what we have deleted.

For some reason when the virtual directories are recreated you still have to fix a permissions issue to get it to function. Do this by going into IIS Manager and right clicking on the virtual directory “Exchweb” and select properties. Then go to the Directory Security tab and click Edit under Authentication and Access control. Ensure that Anonymous and Integrated Authentication are checked. An Inheritance Override dialog box will appear, make sure you click Select All. Click OK to finish. After you have completed that, go back into Authentication and Access control and uncheck Integrated Windows Authentication. (Yes I know, seems odd). Ok out and you are finished.

That pretty much sum’s the fix up. You will need to redo your SSL stuff but other than that you should have a fully functional OWA configuration.

Now, this is where the support code stuff and the exchange-oma virtual directory I mentioned earlier comes in. There are a number of mobile devices that are capable of connecting to Exchange to get email, contacts, calendar and tasks from their account. Some of them work with SSL / Forms Based Authentication and some don’t. To fix the ones that don’t support it, follow the steps below to get your non SSL Windows Mobile devices to connect to Exchange.

First delete the virtual directory (if you have it) exchange-oma. Now to finish this we will need to create a second virtual directory for OMA access. First, open IIS Manager and right click on the Exchange virtual directory and select “Save Configuration to File”.  Name is something like exchange-oma. Now, right click on “Default Website” and select new virtual directory from file.  Find the file you just saved (i.e. exchange-oma).  You will get a dialog box saying the virtual directory already exists.  In the alias box, type exchange-oma (or similar).

Lets, make it non SSL bound now.  Right click on the virtual directory you just created and go to the Directory Security Tab and then Authentication and Access control.  Make sure that Integrated and Basic authentications are enabled. Ok out and then under Secure communications click edit and uncheck “require SSL”.  Ok out and close IIS Manager.

To get IIS and Exchange to use the new virtual directory correctly we need to make a slight registry change.  Open the Registry Editor and find “HKLM\SYSTEM\CurrentControlSet\Services\MasSync\Parameters” If it does not exist, in the right pane right click and create a new String Value.  Name it ExchangeVDir and press Enter.  Modify the value of the key and put /exchange-oma in that field.

You are almost done now, quit the registry editor and restart the IIS Admin Service.  You can also use iisrestart from the run line or command prompt.

Here are some of the links I used to put this post together and have used in the past successfully.

Petri IT Knowledgebase | Dev IT Weblog | Microsoft

Windows vs. Linux (Ubuntu)

Internet Browsing
W – Internet Explorer
U – Firefox

Email Clients
W – Outlook, Outlook Express
U – Thunderbird, Evolution

Chat Clients
W – MSN, Yahoo, Google Talk, AIM, mIRC
U- Gaim / Pigdin, xChat, BitchX

Com Port Communications
W – Hyperterminal
U – MiniCom

FTP Client
W – Filezilla FTP Client
U – Filezilla FTP Client

Remote Access Servers
W – Terminal Server, RealVNC, TightVNC, WinVNC
U – FreeNX, RealVNC, TightVNC

P2P Filesharing
W – Limewire, Bearshare, Bittorrent
U – Limewire, Azureus

VoIP Clients
W – Skype, X-Lite
U – Skype, Linphone, Twinkle

Drawing / Photo Editing
W – Paint.net, Photoshop, MSPaint
U – GIMP
3D Annimation / Rendering
W – 3D Studio MAX, Blender
U – Blender, Maya

DVD Players
W – Windows Media Player, PowerDVD
U – MPlayer, Kaffine, VLC

MP3 / Music Players
W – Winamp, iTunes
U – RhymeBox, K3b

Office Productivity
W – Microsoft Office
U – OpenOffice.org

Network / Relation Mapping
W – Microsoft Visio
U – Dia

Accounting / Financial
W – Quicken, Microsoft Money
U – GnuCash

Desktop Publishing
W – Microsoft Publisher, Quark
U – Scribus

PDF Editing
W – Adobe Acrobat Professional
U – PDFEdit, pdftk

Imaging
W – Norton Ghost
U – G4u, dd

Partition Resizing
W – Norton Partition Magic
U – GParted

Backup Software
W – Symantec Backup Exec
U – BackupPC, Amanda

Web Servers
W – Microsoft IIS
U – Apache

File Servers
W – Microsoft File Services
U – Samba

Email Servers
W – Microsoft Exchange
U – Postfix, Sendmail

AntiVirus Software
W – Symantec AV, Mcafee
U – ClamAV, AVG

For more of these “like” software lists, please visit what I believe to be the most complete list on the internet, Table of Equivalents.

• Change the local administrator password
• Disjoin the system from the old domain
• Use the set command to determine what profile path the user is currently using
• Reboot the system
• Login as the local administrator
• Join the system to the new domain
• Reboot the system
• Login as the user on the new domain
• Logoff and logon as the domain administrator
• Open regedit and modify ProfileImagePath within “[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\]“
• Change the permissions on that profile path within explorer, give the user full control and propagate to the child directories and file.
• Reboot (Last Time)
• Login with the user on the domain and you should have the “old” working profile with the new domain user account.

This process took two fairly skilled individuals about 5 hours to complete on 18 systems and that included doing the first “test” machine and troubleshooting any problems that might have come up (missing mapped network drives, incorrect shortcut paths, etc.). Hope this helps you along the way as it did me when I learned it. If you have any suggestions, options, better methods, please let me know. I’m all ears.