Toot Toot! MSP Mentor Awards 2013

Sometimes you have to blow your own horn and today is one of them.  Toot Toot!  We have been awarded position 362 of 501 top MSP Mentors Worldwide today.

So for once I do not have to write much on this blog, below is the comment from MSP Mentor on our award and recognition.

Nine Lives Media Names CSCM IT Solutions

to the MSPmentor 501 Global Edition

Sixth-Annual Report, Formerly the MSPmentor 100, Lists
The World’s Top 501 Managed Service Providers (MSPs)

February XX, 2013: CSCM IT Solutions has landed on Nine Lives Media’s sixth-annual MSPmentor 501 Global Edition (http://www.mspmentor.net/top501), a distinguished list and report identifying the world’s top 501 managed service providers (MSPs). This year’s report has been expanded extensively to include:

• New: MSPmentor 501 Global Edition
• New: MSPmentor 100 Small Business Edition (top MSPs with 10 or fewer employees)
• MSPmentor 200 North America Edition
• MSPmentor 50 EMEA (Europe, Middle East, Africa) Edition
• MSPmentor 25 AANZ (Asia, Australia, New Zealand) Edition
• New: In-depth data tracking mobile device management (MDM), managed cloud services and other recurring revenue opportunities for MSPs.

"Everyone in the team is buzzing from this news, to be recognized among your peers is fantastic!" said Kyle Heath, one of the Business Leaders.

The MSPmentor 501 report is based on data from MSPmentor’s global online survey conducted October-December 2012. The MSPmentor 501 report recognizes top managed service providers based on a range of metrics, including annual managed services revenue growth, revenue per employee, managed services offered and customer devices managed.

“MSPmentor congratulates CSCM IT Solutions on this honor,” said Amy Katz, president of Nine Lives Media, a division of Penton Media. “Qualifying for our MSPmentor 501 Global Edition puts CSCM IT Solutions in rare company.”

MSPs on this year’s global 501 list lifted their combined annual recurring revenues 24.5 percent to $2.54 billion. Together, those MSPs now manage more than 5.6 million PCs and servers, and nearly 400,000 smartphones and tablets, according to Joe Panettieri, editorial director, Nine Lives Media.

MSPmentor, produced by Nine Lives Media, is the ultimate guide to managed services. MSPmentor features the industry’s top-ranked blog, research, Channel Expert Hour Webcasts and FastChat videos. It is the number one online media destination for managed service providers in the world.


About Nine Lives Media
Nine Lives Media, a division of Penton Media (http://www.penton.com), defines emerging IT media markets and disrupts established IT media markets. The company’s IT channel-centric online communities include MSPmentor (http://www.MSPmentor.net), The VAR Guy (http://www.TheVARguy.com) and Talkin’ Cloud (http://www.TalkinCloud.com).

Contact:
Nine Lives Media, a division of Penton Media
Joe Panettieri, Editorial Director
212-204-4206 or joe.panettieri@penton.com

Windows 2008 R2 changes to Public Firewall Profile

If like us sometimes something just goes wrong and you get that call that "all our applications have stopped working" but your Managed Services application says all is good.  It could be this.

The Network Awareness Location Service.  This server is what determines which Windows Firewall Policy you get on a workstation or server and sometimes it goes wrong and sets a server on a Public Firewall profile.  When this happens applications just stop as all incoming ports are pretty much shut down.  So when everything looks great but no one can work check this one out.

Have a read of this Blog from Microsoft on the NLA Service.  http://bit.ly/12okl54

It could just save your bacon.

Put Die Hard to sleep

Die Hard 5 is the most ridiculous film I have ever seen. I suspended disbelief as it started and quit after 5 minutes when Bruce takes an Aeroflot flight to Moscow with no Visa.

What follows is a Mercedes sponsored car chase gun fight window smashing chase through Russia featuring beards, oligarchs, hired goons in Italian suits and a sexy daughter with red lips.

More bullets are fired than in Saving Private Ryan and no one really gets shot, it's a 12A so kids note, people don't die until you are 18, then they die. OK.

Skip to Ruski with Uranium, Chernobyl rubbish and a helicopter with truck in it for no reason. Boom boom bang bang explosion end.

Back to USA for sunshine and a milkshake.

They made films like this years ago, Commando was a fine example, but when Bruce does his one liners even Roger Moore couldn't save them. They stink.

There is only one moment that worked, a homage to Alan Rickman falling in slow mo from Die Hard. That's it for in gags.

I wanted to leave after 10 minutes because I knew what was coming. Just do not bother, go watch Die Hard or Die Hard 2 for the real McClaine. Better still go see Django Unchained for a real movie experience.

How to - Automatically Delete Old Backup Files from a USB Disk

This guide explains how to use the forfiles and at commands to delete any file type from a USB disk that is over a certain age in days.

1. USB Disk

Here we have a USB disk that has the common problem, there is not enough disk space left on the disk for the backup to be stored.

2. Age of Files

Here we can see that some of the files are of different ages and we would like this disk to be clear to allow room for tonights backup.

3. Command Prompt

Run the command cmd and then at the command prompt we will use the command called forfiles.

4. Forfiles Command

The forfiles command has multiple options but the main use we have is to delete all files with a certain extension from a certain location that are over a certain number of days old. So the syntax is explained below

forfiles /P G:\ - This is the path location and in our example the G: disk, but this could be any folder path.

/M *.TIB - This describes the file extension we want to find, so by using *.TIB we will find all Acronis Backup Ffiles, however this could be used for any file extension or *.* for any file.

/D -7 - This is the number of days that the file must be older than for the command to return an answer so we are only going to find files older than seven days.

/C "cmd /c del /q @path" - This is the more complex part of the command, this is the command that will be executed against the result we generated in the first part. In this example we will run cmd with /c to terminate the command once it is complete, next we use del to delete files with the /q for quiet mode so we do not have to confirm the delete and finally we add @path to take the folder path from the first part of the command!

So what we end up with is forfiles /P G:\ /M *.TIB /D -7 /C "cmd /c del /q @path"

5. Run Forfiles Command

If we now run this command we see that the one TIB file has been deleted as this was over 7 days old. NB The command has no confirmation so be 100% sure you know what you are going to delete and where before you execute.

6. Schedule this Everyday

OK so now we have the command to clean up our disks we want to run this everyday automatically and we can do this with the at command. The at command allow you to run a command at a specific time at reoccuring intervals.

at 18:00 - The first part of the command says run at 18:00 or anytime in the 24 hour clock you choose.
/every:m,t,w,th,f - The second part of the command schedules what days the command will run, in this case it is Mon - Fri. Saturday is S and Sunday is SU

You then follow the command with the forfiles command to create a scheduled task.

7. Confirm Scheduled Task

To confirm that the task is scheduled you can run the at command with no switches and you will see the output describing the task number, days to run, time to run and the command to run.

NB If you make an error entering the command you can delete the task with the command

at /1 delete - Where 1 is the number of the task ID.

8. Command Switch Options

Below are the full switch outputs for the forfiles and at commands.

9. ForFiles Command

FORFILES [/P pathname] [/M searchmask] [/S]
[/C command] [/D [+ | -] {dd/MM/yyyy | dd}]

Description:
Selects a file (or set of files) and executes a
command on that file. This is helpful for batch jobs.

Parameter List:
/P pathname Indicates the path to start searching.
The default folder is the current working
directory (.).

/M searchmask Searches files according to a searchmask.
The default searchmask is '*' .

/S Instructs forfiles to recurse into
subdirectories. Like "DIR /S".

/C command Indicates the command to execute for each file.
Command strings should be wrapped in double
quotes.

The default command is "cmd /c echo @file".

The following variables can be used in the
command string:
@file - returns the name of the file.
@fname - returns the file name without
extension.
@ext - returns only the extension of the
file.
@path - returns the full path of the file.
@relpath - returns the relative path of the
file.
@isdir - returns "TRUE" if a file type is
a directory, and "FALSE" for files.
@fsize - returns the size of the file in
bytes.
@fdate - returns the last modified date of the
file.
@ftime - returns the last modified time of the
file.

To include special characters in the command
line, use the hexadecimal code for the character
in 0xHH format (ex. 0x09 for tab). Internal
CMD.exe commands should be preceded with
"cmd /c".

/D date Selects files with a last modified date greater
than or equal to (+), or less than or equal to
(-), the specified date using the
"dd/MM/yyyy" format; or selects files with a
last modified date greater than or equal to (+)
the current date plus "dd" days, or less than or
equal to (-) the current date minus "dd" days. A
valid "dd" number of days can be any number in
the range of 0 - 32768.
"+" is taken as default sign if not specified.

/? Displays this help message.

Examples:
FORFILES /?
FORFILES
FORFILES /P C:\WINDOWS /S /M DNS*.*
FORFILES /S /M *.txt /C "cmd /c type @file | more"
FORFILES /P C:\ /S /M *.bat
FORFILES /D -30 /M *.exe
/C "cmd /c echo @path 0x09 was changed 30 days ago"
FORFILES /D 01/01/2001
/C "cmd /c echo @fname is new since Jan 1st 2001"
FORFILES /D +13/2/2013 /C "cmd /c echo @fname is new today"
FORFILES /M *.exe /D +1
FORFILES /S /M *.doc /C "cmd /c echo @fsize"
FORFILES /M *.txt /C "cmd /c if @isdir==FALSE notepad.exe @file"

10. At Command

The AT command schedules commands and programs to run on a computer at
a specified time and date. The Schedule service must be running to use
the AT command.

AT [\\computername] [ [id] [/DELETE] | /DELETE [/YES]]
AT [\\computername] time [/INTERACTIVE]
[ /EVERY:date[,...] | /NEXT:date[,...]] "command"

\\computername Specifies a remote computer. Commands are scheduled on the
local computer if this parameter is omitted.
id Is an identification number assigned to a scheduled
command.
/delete Cancels a scheduled command. If id is omitted, all the
scheduled commands on the computer are canceled.
/yes Used with cancel all jobs command when no further
confirmation is desired.
time Specifies the time when command is to run.
/interactive Allows the job to interact with the desktop of the user
who is logged on at the time the job runs.
/every:date[,...] Runs the command on each specified day(s) of the week or
month. If date is omitted, the current day of the month
is assumed.
/next:date[,...] Runs the specified command on the next occurrence of the
day (for example, next Thursday). If date is omitted, the
current day of the month is assumed.
"command" Is the Windows NT command, or batch program to be run.

Active Directory - Problems with users at sites that have a Read Only Domain Controller

If you have problems with users at a Branch Office site that has a Read Only Domain Controller (RODC) such as no metwork drives, failed logons, no resources, then you may have a problem with replicating computer account passwords to the RODC.

Branch Office DC

I had been having issues with a Branch Site where users were stating that they could not access resources on the network, logins failed and generally it was hit and miss for them if they could access resources. I started by looking at the Domain Controller at the site, this was a Windows 2008 R2 RODC. In the event logs I found this error Event ID 5805 NETLOGON, the computer account was failin gto authenticate in the domain, the most likley cause the coomputer account password had not been replicated to the RODC and so the authentication attempt failed.

Client PC

Back on the Client PC I was getting the Event ID 5721 NETLOGON that the computer account failed to connect a session to the domain controller because no computer account could be found in the domain. I knew there was a computer account in the domain so this made me think, is it the Read Only aspect that is the issue here.

Client PC

On the Client PC again I had further event log errors that suggested authentication problems with the Domain Controller so I started to look at fixing these errors.

Read Only Domain Controllers and Replication of Passwords

Well it turns out that if you have a RODC then you need to allow replication of the computer account passwords from the Write Domain Controller to the Read Only Domain Controller and this is explained in this Technet Article here

What you need to do is create a Domain Local Security Group on your Write Domain Controller and then add to this Group the computer accounts for the RODC Site.

Security Group

Here you can see I have created a Domain Local Security Group called RODC and I have added to this the Computer Accounts for the workstations in my RODC Site. What I will do know is nest this Group into a fixed Domain Group that allows replication of account passwords to occur to a RODC.

Allowed RODC Password Replication Group

In Active Directory is a Security Group called Allowed RODC Password Replication Group, this is a Group specifically allowed the permissions to replicate account passwords to a RODC and update them on that DC. So in reality making it not Read Only for the Account Passwords butmaking sure that when you join a computer to the domain the password assigned to the computer account is replicated to the RODC.

Nest Groups

Now if we have all out RODC Site computers in the Security Group RODC then we now nest this group in the Allowed RODC Password Repication Group, this allows the permissions of this group to be inherited by all the computer accounts in our RODC group.

Replication

Once this is done you can use the CMD to force a replication of the Computer Account Passwords to the RODC Site, this is expained in the Tech Net article but consists of the following.

repadmin /rodcpwdrepl RODCName RWDCNAME CN=ComputerAccount, CN=Computers, DC=Domain, DC=com

When this completes the replication of the Computer Account password for the workstation in the RODC Site is replicated and when you start the computer you no longer have authentication issues with the RODC.

Instagram and that free lunch

There has been a lot of talk today about the decision of Facebook who own InstaGram to declare possible IP rights to any photos or images that you upload with the Instagram tool.

Now we still do not know for sure if this is an swoop to make Instagram the worlds largest stock photo supplier by default or just an over enthusiastic lawyer covering all the bases.

But lets say Facebook do want the IP on all those photos, they host them and you do not pay to host them with them. so what is the problem?

What I hear you say, they cannot sell my photos!  I took those!  They are my IP.

Well hang on, I bet a lot of people who host their photos or art work online do so using services like Instangram, Facebook, Flickr, etc.  If you then use these services as an online portfolio then you will likely benefit from this either financially or socially.  What recompense do the providers get from this?

Because these services are amazing and cost money, not your money, someone elses money.  So we place little value on them in real terms, we just complain when the people who provide these services try to recoup some of their investment and try to make them a profitable enterprise.

If we want a world where we can share without this fear of our IP being owned then we should all follow the philosophy of WikiPedia and contribute to a free and open platform for all the world.

I think Twitter is awesome, but someone is paying for this and one day they will get fed up paying for it because I cannot see how we can make Twitter pay.  If we do you will all leave anyway bleating on about adverts and how it ruined Twitter.

Well think about it, a free lunch has never existed and we all pay in one way or another.  If you want that ideological Utopian world online then remember who provides what you class as that now and look to who really is trying to make it happen.

Rant over.

Be There Routed IP addressing with a Cisco 1841 Router

Be There have started to change how they offer public IP addressing in 2012 and now offer correctly subnetted IP blocks. This does mean however that you have to change your configuration as the end user, this is how to change the configuration for a Cisco 1841 router.

DHCP on the ATM0/0/0.1 Interface

Be There have changed how you assign the IP address to the ATM interface, now this is assigned via DHCP and this IP address is not the IP that you will use for your site, this is the IP address that is used to provide the routed IP to you. So now you need to use the command

ip address dhcp

Zone Based Firewall and DHCP

Now the first issue you will run into is that the Zone Based Firewall is unlikely to be set to allow DHCP on the ATM interface. The ATM interface is going to be on your outside zone so we need to create two class maps to define the traffic as follows

1. ATM interface makes a DHCP request
2. ATM interface receives a DHCP reply

I have created two class maps for this, both contain a match for UDP ports 67 and 68

class-map type inspect match-any cmap-router-to-O2-dhcp
match protocol bootps
match protocol bootpc
exit

class-map type inspect match-any cmap-O2-dhcp-to-router
match protocol bootps
match protocol bootpc
exit

Policy Map

Once you have defined the class maps for DHCP you will need to allow the traffic into the router and out from the router, this involves the self zone and the outzone. DHCP traffic is a broadcast protocol so this is going to be sent over the PVC to the local Exchange and therefore we will not be inspecting this traffic, we need to pass this traffic in the Zone Based Firewall. Below I have my policy maps for Outzone to Self and Self to Outzone.

Outzone to Self

policy-map type inspect pmap-internet-to-router
class type inspect cmap-O2-dhcp-to-router
pass log
exit
class type inspect cmap-router-remote-access-protocols
inspect

This policy map inspects the traffic from Be There to the router and passes this and also logs this so I can see the traffic in the syslog to help in troubelshooting. The next inspection is my class map to allow SSH access to the router. You must here match the DHCP traffic first otherwise the ZBF will drop the traffic as not matching, ZBF rules are processed in order so you need to get your DHCP rule in first.

Self to Outzone

policy-map type inspect pmap-router-to-internet
class type inspect cmap-router-to-O2-dhcp
pass log
exit
class type inspect cmap-router-to-internet
inspect
exit

This policy map is the reverse and allows the router to send DHCP requests to Be There.

DHCP Process

Now when we shutdown the ATM0/0/0.1 Interface and the enable the interface a DHCP request will take place and this is shown above. You can see the ZBF passing the packets for DHCP in the log and that we have been assigned an IP addres on the ATM0/0/0.1 interface.

DHCP injected route

A new route is injected into the Cisco routing table for this circuit and this is shown in the config as a static route to the gwateway with a cost of 254. The cost of 254 is high so if you have another static router this will take precedence and this route will be used as the last resort.

Using your IP Block

Your real routed IP block can now be used, this is achieved by configuring the Cisco to PAT out of the ATM0/0/0.1 Interface and this will use the first IP address in the block. For other services you can now create static NAT translations as shown above with one of the public IPs you have. This example is based on a Dual DSL router so these NAT translations will only function when the router has the default route to our Be There circuit.

Accessing the Router

If you want to access the router via SSH for example you will need to know the DHCP IP address and this will change each time the ATM interface is enabled so it make sense to assign one of the public IP addresses to the router. This can be done by creating a sub interface on the Fast Ethernet interface and assigning this a new VLAN ID, this places this interface in its own VLAN and if we assign no ZBF zone then this will be seen as the SELF zone and the rules to and from this zone will apply.

Now you will be able to SSH to this IP address and the rules you have for Outzone to Self and Self to Outzone will apply.

Notification when a DSL Circuit does down

It is pretty handy to know if one of your DSL circuits is offline so you can use the IP SLA feature for this and track a ping to an IP out of one interface only, if the pring drops then you can then tell the router to clear the NAT translations and to inform you the circuit went down. I will not go into the full IP SLA here but for the notification you can use the event manager feature in Cisco Adavnced IOS.

Here you can see I have used event manager to note when my IP SLA Track 1 is down, when this occurs I can automatically clear the IP NAT translations and then send an email to our helpdesk to inform the team that the DSL circuit is offline.