Archive files with Robocopy

I have a few customers who keep all their data from the first server they ever had so we are looking at data from the 1990s onward! It always strikes me that if you don't need to keep data for legal reasons then if it hasn't been accessed for 6 months its ready to be archived off the server to NAS and then to offsite storage.

Robocopy is a tool that can help with this process, it can perform all sorts of file copy operations and in this case can move files that have not been accessed since a date to a new location and keep the file structure.

robocopy c:\share d:\archive\share /S /SEC /MOV /MINLAD:20081231 /L

This command will use the switches

/S - copy all subdirectories that contain files
/MOV - move the files and folders from the source
/MINLAD:YYYYMMDD - find files that have not been accessed before this date
/L - test the operation before you copy for real, very handy!

Non admin users cannot logon to Citrix PS4.5 with RDP

I had an issue where we had to logon some users to a Citrix Presentation Server 4.5 via RDP as the VPN tunnel from their remote site was down, it was a temporary workaround but when we connected via RDP we had this error displayed.

"Connection Error : The desktop you are trying to open is currently available only to administrators"

This is related to the Terminal Server Configuration and the RDP Listener, under the Citrix Settings is a check box that says "Non published applications for Administrators only". This means the Desktop as this is a non published application and in my case my users needed the Full Desktop.

I removed this check box and they could logon as normal with RDP.

SSH to Cisco 1841 using route-map statements for PAT

I had a problem when using the Cisco 1841 router, I could not get access to the router from a remote location using ssh to the routers WAN IP.

I had been able to do this on the Cisco 877 but could not make it work on the 1841 router, after some head scratching and forum posting I was given a clue when I looked at the firewall logs. The logs showed that the packets were going to the router ok but on the return they were coming back from the wrong ports and this caused the packets to be dropped.

The firewall log is displayed here

%FW-6-DROP_PKT: Dropping tcp session 78.xx.xx.xx:3 86.xx.xxxx:45369 on zone-pair ccp-zp-self-out class ccp-icmp-access due to  Invalid Flags with ip ident 0

The log shows that the return packet has a source port of 3 but I know the connection entered on port 22 for ssh, so this means something has changed the packet source port before its return.

The answer is that NAT/PAT is involved and this is changing the packets on the return by PAT the packets back out of the ATM interface. The 8141 routers all use a route map so I can have two PAT statements and use the failover for the two ATM interfaces. So when the connection is made with ssh on port 22 the PAT statements are translating the traffic back out and this violates the ZBF rules and the packets get dropped.

To resolve this you have to use an ACL to allow the traffic you want PAT and deny everything else.

The current PAT statement and route maps are

ip nat inside source route-map O2 interface ATM0/0/0.1 overload

Route-map O2 permit 10
Match interface ATM0/0/0.1

So this route map needs to have an ACL added to only allow the traffic from my internal networks to be PAT. So I created a new ACL rule below

Access-list 120 ip permit 192.168.110.0 0.0.0.255 any
Access-list 120 ip deny any any

Route-map O2 permit 10
Match interface ATM0/0/0.1
Match ip address 120

Now that this ACL is added to the route map when the connection is made on port 22 the return traffic is matched against the route map ACL and this can see that the source IP is not in the 192.168.110./24 subnet so it is denied from being PAT and returns out of the ZBF with the correct source port and meets the ZBF inspection.

GFI Mail Essentials Debug Logs and disk fragmentation

I often find that the disk which has GFI Mail Essentials installed has fragmentation issues and the files that are fragmented are the Debug log files. These files are not needed unless you need to debug, but the setting is on by default and causes your disk to become fragmented.

I switch these off unless I need to debug and keep my drive from fragmenting. You can switch the debug logs off in the registry here

GFI MailEssentials version 2010(x86): - [HKEY_LOCAL_MACHINE\SOFTWARE\GFI\ME15\Config]
GFI MailEssentials version 2010(x64): - [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\GFI\ME15\Config]
GFI MailEssentials version 14(x86): - [HKEY_LOCAL_MACHINE\SOFTWARE\GFI\ME14\Config]
GFI MailEssentials version 14(x64): - [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\GFI\ME14\Config]
GFI MailEssentials version 12(x86): - [HKEY_LOCAL_MACHINE\SOFTWARE\GFI\ME12\Config]
GFI MailEssentials version 12(x64): -[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\GFI\ME12\Config]
GFI MailEssentials version 11: - [HKEY_LOCAL_MACHINE\SOFTWARE\GFI\ME11\Config]
GFI MailEssentials version 10: - [HKEY_LOCAL_MACHINE\SOFTWARE\GFI\ME10\Config]
GFI MailEssentials version 9: - [HKEY_LOCAL_MACHINE\SOFTWARE\GFI Fax & Voice\ME9\Config]

A dword value named ‘debug’ should be found in this location. If the value does not exist a new DWORD value called ‘debug’ should be created manually.

Change the ‘debug’ dword value as follows:
To disable debug logging, change the ‘debug’ dword value to ‘0’
To enable debug logging, change the ‘debug’ dword value to ‘1’

Once complete restart the IISAdmin Services and GFI Mail Essentials Services. Then you can delete the actual log files.

ISAlog.bak and ISALog.bin

If you have a server with ISA Server 2004 installed you will find in the C: partition the files ISAlog.bak and ISALog.bin

These files will be approx 400MB in size and often taking up valuable disk space on an older system.

The files are not necessary and are for Microsoft PSS to use if you have a case open with them. You can remove these files by editing the registry key

HKLM\software\microsoft\isaTrace\BootTracing

Set this value to 0 and reboot the server, you can then delete the files manually and reclaim the disk space.

How to monitor for when an application terminates

I have had an application that needs to run on a SBS 2008 Server as an interactive user, the application runs from a mapped network drive and then runs from the system tray.

If the application is running it works fine, but it will on occasion terminate with no error, this means that emails do not get sent from the clients workstations and it can be hours before it is noted that the application is not running.

So I decided I needed to know if this application closes or terminates, I could then restart the application automatically and know that my users can still send emails.

I started by looking to see if I could run the application as a service so I did not need the server logged on with an interactive user, I used the SRVANY.EXE application from the Windows 2003 Resource Kit and then created a service using SC.EXE and set this to run my application as local system and interactive with the desktop.

This did run the service but the application did not load into the desktop and as a result did not work so I decided this was not the solution.

Next I looked for an application that would monitor a process and then alert when this occurred, I found Application Monitor here



This allows you to specify the application you want to monitor, how often it checks to see if it is running and then will restart the application if it detects that it is not running. I quickly setup the EXE as a check and tested by closing the application manually and the Application Monitor restarted the application!

There is no event log monitoring which would have been nice for our Managed Services application that could have notified our helpdesk, but it does work for a quick fix!

Snap shot delete stops at 95% on ESXi Server

I had taken a snapshot of a server pre Windows Updates and had not deleted this snapshot for four days, when I came to delete the snapshot I could see that the process had jumped to 95% and then stayed at this level for some considerable time.

This is by design, the snapshot is a differencing file and has to write the changes back to the VMDK file and so this takes some time to complete. Don't worry in this situation, just wait for the process to complete and this may take several hours!