SkyByte Consulting

I recently ran into a situation that required me to get some information off of a Windows image backup. The file that Windows backup outputs is a .VHD file which is the same type that Hyper-V creates. I created a new virtual machine and attached the .VHD of the backup as the hard drive. When booting I received an error telling me "Boot Failure. Reboot and Select proper Boot device or Insert Boot Media in selected Boot device". After some digging around on the Internet I found some information explaining why it would not boot.

The .VHD file that Windows backup creates is just a data only file. These are not bootable and cannot be made bootable this is by design. There were some mentions of people getting this to work, but there were many who tried and failed. This .VHD file is intended to give you access to the file system on your old machine but not to be loaded into a virtual environment. To do this you would have to use the convert physical machine selection in Hyper-V or System Center Virtual Machine Manager to use the machine in a virtualization environment.

With the popularity of Server Virtualization Systems on the rise, maybe Microsoft will include an option on the backup and restore for Windows 8 that will allow for converting a physical to a virtual. This could even be just for Professional, Ultimate and Enterprise versions.

Recently a client of SkyByte Consulting had an issue opening hyperlinks embedded within emails. The error seemed to occur when Outlook 2003/2007/2010 was opened and a hyperlink was clicked from within an email. The cause was that Firefox had been installed onto the system and was made the default browser. It seems like Outlook only wanted to look to Internet Explorer for opening the link. 

There two solutions I found for this, which I've provided below.

Solution 1 -
1. Open Internet Explorer
2. Goto Tools->Internet Options->Security Tab
3. Click "Reset all zones to default level"
4. Close Internet Explorer and Outlook.
5. Re-open Outlook and click again on the hyperlink

Solution 2 -
Setup Internet Explorer as your default browser. Make sure to tell Firefox not to be the default and to never ask again

How many times have you not had sufficient space on your virtual server due to growing exchange data stores, SQL databases, or Data Protection Manager backups?  It can be a daunting task, in smaller networks, to have sufficient drive space on VM hosts. Using Microsoft Hyper V server 2008, I've setup test and dev machines and just hosted the VM files off on an external hard drive. 

In the past external hard drives running USB 1.1 and 2.0 were too slow to host a file such as a .VHD effectively. Within the last couple of years technologies like e-Sata and USB 3.0 have emerged as great choice's for an external interface. These newer external ports offer superior read and write throughput performance for hard drives. You can purchase expansion cards that give your server the ability to have these ports. In the case of e-Sata, you can also employ Raid setups using external drive housings that support raid 0,1,5,10 and others.

I've found that, depending on your virtualization hosts configuration, you can setup or relocate .VHD files onto an external drive. Also you could add an external drive to house all of your machine backups and images on drives up to 3TB in size. With the performance of both USB 3.0 and e-Sata you can create, deploy, and restore in a fairly quick amount of time. Non-essential or lightly used VM's could be hosted on a single external drive with higher use possible using an e-Sata Raid setup. This solution would be very easy to implement with many server virtualization systems and very inexpensive compared to upgrading the drives in a server.

San Fransisco, CA: Microsoft on Tuesday provided another glimpse at changes coming with the next-generation of Windows software that powers most of the world's computers.

Microsoft is making major improvements to a key Windows Explorer file management program to enhance how it interacts with the coming Windows 8 operating system, according to Windows division president Steven Sinofsky.
 
"Windows 8 is about re-imagining Windows, so we took on the challenge to improve the most widely used desktop tool in Windows," Sinofsky said atop a blog post detailing Explorer modifications.
 
"Windows Explorer is a foundation of the user experience of the Windows desktop and has undergone several design changes over the years, but has not seen a substantial change in quite some time," he added.
 
A control "ribbon" for commands was added to make them more easily accessible to people other than "power users" familiar with Windows Explorer shortcuts.
 
Engineers set out to "return Explorer to its roots as an efficient file manager and expose some hidden gems" in the form of handy commands many people may not know, according to Alex Simmons of the program management team.
 
Microsoft in June provided the first sneak peek at the successor to Windows 7, a next-generation operating system designed to work on both personal computers and touchscreen tablets.
 
Sinofsky demonstrated some of the features of the operating system code-named "Windows 8" at a D9 technology conference hosted by All Things Digital.
 
"Laptops, slates, desktops -- all can run one operating system," Sinofsky said.
 
"Windows 8" builds upon many of the features in Microsoft's latest mobile operating system for smartphones, Windows Phone 7, including the use of touch "tiles" instead of icons to launch and navigate between applications.
 
Microsoft has promised to reveal more features of Windows 8, which uses Internet Explorer 10 as a Web browser, at its developers conference in Anaheim, California, opening on September 13th

Nothing new has been released yet regarding new Windows Server 8 information and if Active Directory upgrades will need to be to unlock the potential for Windows 8 on current corporate network infrastructure.

Electronic discovery services (or e-discovery, eDiscovery) refers to discovery in civil litigation which deals with the exchange of information in an electronic format. This is ofter referred to as "Electronically Stored Information" or ESI. Usually a digital forensics analysis is performed to recover evidence. A wider array of people are involvedlved in eDiscovery like forensic investigators, lawyers and IT managers which leads to problems with confusing terminology.

Electronic information is considered different from paper information because of its intangible form, volume, transience and persistence. Electronic information is usually accompanied by metadata that is not found in paper documents and that can play an important part as evidence (for example the date and time a document was written could be useful in a copyright case). The preservation of metadata from electronic documents creates special challenges to prevent spoliation.

Corporate and government investigators face numerous pressures when performing digital investigations. The number of investigations grows every day along with the amount of electronically stored information requiring analysis. Deadlines continue to be more aggressive, raising the urgency to find all of the evidence and accurately determine who knew what, and when. Controlling the costs remains a major concern, preventing teams from adding more people to cope with an ever-increasing workload.

In working to meet these demands, security and forensics teams have relied on tradition technologies and work-flows. These manual work-flows often employ investigators collecting data across the enterprise using multiple tools, applying simple keyword search techniques and reviewing gigabytes of data document by document. Because of this, today’s corporate investigation process is onerous and time-consuming, requiring a large number of manual steps and significant re-work which, in turn, costs millions of dollars and leaves the organization vulnerable to substantial risk and financial exposure.

There are quite a few electronic discovery software's that can aid in the digital investigation process, helping investigators handle more cases in less time while improving the accuracy of the results. Electronic discovery software forensically collects electronic files from across the organization, automatically analyzes the data, and enables investigators to rapidly identify all evidence and suspects involved in a corporate or government investigation.



Electronic Discovery Software

AccessData - AD Summation eDiscovery (http://accessdata.com/products/ediscovery-litigation-support)

Fios - Relativity - (http://www.fiosinc.com/e-discovery-software/default.aspx)

Clearwell <Symantec> -  (http://www.clearwellsystems.com/electronic-discovery-solutions/electronic-discovery-litigation.php)


Lexisnexis - Concordence (http://law.lexisnexis.com/concordance)


SkyByte Consulting works with several Chicago law offices and companies to provide support and implementation of these software's and other forensic services.

A few weeks ago I could ran across a bizarre issue where I could not access a Citrix Presentation server using Microsoft Remote Desktop.  The server was acting as if it was offline or RDP was disabled when you attempted to connect using the RDP client.  I confirmed the server was online and responding to ping commands.  I could even gain access to the server remotely through the ICA client.  I checked the obvious things such as making sure RDP was enabled and any network firewall security settings were not blocking access on port 3389.  Furthermore, I opened a command prompt on the server and executed a netstat -a command.  I confirmed the RDP service was in fact listening on port 3389.  I even rebooted the server but the problem remained.

This particular server was a Windows 2003 Server with Citrix Presentation 4.0 installed.  It had been a couple years since virtualization of this server had taken place to a Vmware vpshere cluster and no major changes had been performed in recent time.  The problem ended up being related to a setting in the Terminal Services Configuration.  I opened the properties of the RDP-TCP connection and noticed it was not bound to any networking adapter, while the ICA-TCP connection was.  I chose and applied "All network adapters configured with this protocol" which immediately resolved the issue.  While I don't know how this setting was changed, I was happy it was an easy fix.

With the release of Internet Explorer 9, I have ran into a few users who can no longer launch their Citrix desktop or published apps from a Citrix Metaframe or Xenapp portal.  With the enhanced network security included with IE9, the published apps cannot launch when using an incompatible Citrix Online plugin.  The launch.ica file loads as a downloaded file but fails to launch the desktop or application.

This problem has been addressed by Citrix and has been resolved with a new plugin that supports IE9.   The new plugins can be downloaded from here: http://www.citrix.com/English/ss/downloads/details.asp?downloadId=2313030&productId=186

Once downloaded and installed you can now launch your applications and desktop in IE9.  One thing to note is you must now click on "open" on the downloaded launch.ica file on the bottom of the IE9 window.  From there the application and desktop launches normally.

1. Open the Device Manager. Click Start > Control Panel > Administrative Tools > Computer Management > Device Manager.
2. Expand Network Adapters. Right-click VMware Accelerated AMD PCNet Adapter or Intel Pro/1000MT. Click Properties.
3. Click the Advanced tab.
4. Click NetworkAddress for VMware Accelerated AMD PCNet Adapter or Locally Administered Address for Intel Pro/1000MT.
5. Select Value.
6. Enter the desired MAC address without the colons (:).
7. Restart the virtual machine to ensure that the change takes full effect over the network.

While attempting to configure Outlook Anywhere using RPC over HTTPs in Outlook, I ran across and issue where the Exchange server's hostname would not resolve outside of the office during setup.  When I attempted to configure Outlook Anywhere on the internal office network, it was successful.  Once Outlook Anywhere was configured properly internally, Outlook would connect outside the office.  However, important Outlook features such Calendar and Tasks were either limited or unavailable. 

This client of ours received a Microsoft Exchange Upgrade to Exchange 2007 running Server 2008 R2.  At first I thought it was either a configuration problem on the Exchange server, or a network security problem on their Cisco ASA firewall.  Using this extremely helpful Outlook and Exchange connectivity tool found here: www.testexchangeconnectivity.com, I was able to track down and resolve the issue preventing me from configuring Outlook Anywhere outside the office.

The test results showed the Exchange server could not be reached on port 6004.  After some research on the Microsoft TechNet Exchange library, I discovered the problem was related to connection requests defaulting to using IPv6 in Microsoft Server 2008.  The simple solution is to comment out IPv6 and add the IPv4 address and local hostname in the Exchange server's host file:

127.0.0.1 localhost
#::1 localhost
xxx.xxx.xxx.xxx mailserver
xxx.xxx.xxx.xxx mailserver.domain.local

Once this was saved to the host file, Outlook was able to resolve the hostname outside the office and all functionality of Outlook was restored!

I ran across an issue on a client's SQL Server 2005 Express instance. The problem was that at 4:01am every morning the SQL server would just shutdown with the event messages of

1. Service Broker manager has shut down.
2. SQL Server is terminating in response to a 'stop' request from Service Control Manager. This is an informational message only. No user action is required.
3. SQL Trace was stopped due to server shutdown. Trace ID = '1'. This is an informational message only; no user action is required.

After a week of trying to narrow down the issue I found that it was Windows Update automatically trying to install the SP4 update for MSSQL 2005 Express and failing. This failure would cause the SQL server to shutdown for the update, but not come back up. This shutdown was affecting programs like Blackberry Enterprise Server and also BackupExec which would then crash and need to have their services restarted after bringing the SQL instances back online. The fix for this issue was merely to disable the update and also for preventing future issues I disabled the automatic installation of updates.

This issue could relate to Microsoft SQL Server Upgrades and Blackberry Enterprise Server Support.

In Microsoft Outlook, how do I change the default address book?

To change the default address book in Outlook for Windows, follow the appropriate steps below:


Outlook 2010 :

1. From the Find group on the Home tab, select Address Book.
2. In the Address Book window that appears, from the Tools menu, select Options...
3. Under "When opening the address book, show this address list first:", use the scroll-down menu to select the appropriate listing (i.e., Global Address Book, or Outlook Address Book).
4. To save the changes, click OK.
5. To close the Address Book, click the X in the top right corner.

1.  From the Tools menu, select Address Book.
2. In the Address Book window that appears, from the Tools menu, select Options.
3. Under "Show this address list first:", use the scroll-down menu to select the appropriate listing (i.e., Personal Address Book, Global Address Book, or Outlook Address Book).
4. To save the changes, click Apply.
5. To exit, click OK.