Friday, May 25, 2018

Fix for CredSSP terminal server errors

As of May 2018, I'm seeing several instances of errors connecting to terminal servers due to CredSSP errors.  Microsoft released a fix that needs to be applied to both the client and the server.  If one is patched, the other needs to be patched.  If one is patched and the other is not, the connection will fail.

The download will vary based on the OS of the unpatched system.  Here's the link

https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2018-0886

Here's what the error looks like:


Thursday, February 8, 2018

Storing Mac primary data storage folders within cloud storage folders

One of my favorite methods of backup is redirecting the primary data storage folders to a cloud service (like Dropbox or Google Drive).  On a Mac, the process is not intuitive.  Here's my process.

You need to perform the steps once for each folder you want to move.  So if you want to move three folders (desktop, documents, pictures), you'll need to perform the steps three times.  The steps involved two commends.

First, you move the data to the new location.  Then you create a symbolic link to the new location.  In the examples below are a series of commands for desktop, documents, pictures, music, and movies.  The commands with %username% and %Company% would be altered to match the real world situation.

iMac:~ username$ sudo mv ~/Documents "/Users/%username%/Dropbox (%Company%)/laptopdata/Documents"
iMac:~ username$ sudo rm -rf ~/Documents/
iMac:~ username$ ln -s "/Users/%username%/Dropbox (%Company%)/laptopdata/Documents" ~
iMac:~ username$ sudo mv ~/Desktop "/Users/%username%/Dropbox (%Company%)/laptopdata/Desktop"
iMac:~ username$ sudo rm -rf ~/Desktop/
iMac:~ username$ ln -s "/Users/%username%/Dropbox (%Company%)/laptopdata/Desktop" ~
iMac:~ username$ sudo mv ~/Movies "/Users/%username%/Dropbox (%Company%)/laptopdata/Movies"
iMac:~ username$ sudo rm -rf ~/Movies/
iMac:~ username$ ln -s "/Users/%username%/Dropbox (%Company%)/laptopdata/Movies" ~
iMac:~ username$ sudo mv ~/Pictures "/Users/%username%/Dropbox (%Company%)/laptopdata/Pictures"
iMac:~ username$ sudo rm -rf ~/Pictures/
iMac:~ username$ ln -s "/Users/%username%/Dropbox (%Company%)/laptopdata/Pictures" ~
iMac:~ username$ sudo mv ~/Music "/Users/%username%/Dropbox (%Company%)/laptopdata/Music"
iMac:~ username$ sudo rm -rf ~/Music/
iMac:~ username$ ln -s "/Users/%username%/Dropbox (%Company%)/laptopdata/Music" ~

Tuesday, January 23, 2018

IPS error initiated by Fortigate firewall

In this case, we had a user who had no internet access and got this screen when web browsing.


We found that the Fortigate 60D we had was causing this.  The cause seems to have been multiple invalid DNS lookups.  We didn't find any error logs that suggested that problem, but this is what this IPS block is typically caused by.  In the end, we fixed this by changing the user's LAN IP address, but we also could have seen the blocked IP addresses via these commands from the CLI:

OS 5.0:
get user ban list

OS 5.2
diagnose firewall ip_host list

To delete an entry, you'd enter this command:
diagnose firewall ip_host delete src4/src6

Exmaple:
diagnose firewall ip_host delete src4 10.10.10.21

The information from this page came from here:
http://kb.fortinet.com/kb/documentLink.do?externalID=FD36211


Tuesday, October 31, 2017

Ruckus daemon.err wsgclient errors every 5 seconds in the logs (firmware 104.0.0.0.1347)

I'm running a Ruckus R600, and I was getting errors every 5 seconds in the logs that looked like this:

---
Oct  4 13:37:15 RuckusAP daemon.err wsgclient[528]: communicatorInit:364 Init connection failed, ret:124, connectRetry:86990

Oct  4 13:37:15 RuckusAP daemon.err wsgclient[528]: registration:594 Failed to init socket! ret:124 url:https://RuckusController/wsg/ap

Oct  4 13:37:20 RuckusAP daemon.err wsgclient[528]: crResloveAddrInfo:152 getaddrinfo failed, ret:-2/Name or service not known

Oct  4 13:37:20 RuckusAP daemon.err wsgclient[528]: cmrInit:138 Call 'crDefSocketInit()' failed, ip: port:443, ret:124/CR initial socket failed


---

I worked with Ruckus support and found that the Ruckus was reaching out to a cloud server that it was not registered with and receiving these errors.  Ruckus said that these errors were normal and not a problem.  They walked me through the fix.  You fix it by SSLing to the Ruckus (I use Putty for this) and then log in and run these commands (the commands I'm typing are in bold):

Please login: super
password :
Copyright(C) 2016 Ruckus Wireless, Inc. All Rights Reserved.

** Ruckus R600 Multimedia Hotzone Wireless AP: 971603500291

rkscli: set scg disable
OK
rkscli: set discovery-agent
Commands starting with 'set discovery-agent' :
set discovery-agent : set controller discovery agent {options}
                 -> disable/enable
                 -- Configure Controller Discovery Agent Info

rkscli: set discovery-agent disable
OK

Wednesday, October 25, 2017

Submitting phishing and spam emails to Office365 for analysis

I found this link for how you can forward emails that are spam or phishing that are not caught by the Office365 junk filter for further analysis:

https://technet.microsoft.com/en-us/library/jj200769%28v=exchg.150%29.aspx?f=255&MSPPError=-2147217396

Friday, October 20, 2017

Remove HP Client Security for Windows 7 to Windows 10 upgradres

I was doing a Windows 7 to Windows 10 upgrade the other day on an HP EliteBook 840 and after a series of failures (error code 0xc1900208 - the eventual solution was to remove HP Client Security.  It's an incompatible app.

Tuesday, October 3, 2017

Visual Basic script to delete calendar appointments with a specific subject

I had a user on Outlook for Mac 2016 who had thousands of duplicate appointments (created by an Outlook bug).  Here was my fix . . .

I set up the user's account in my Outlook.

I pressed alt-F11 and expanded Project1 and then expanded Microsoft Outlook object and then expanded this Outlook session.  I double clicked on this Outlook session and put in this text in the right hand pane where DESIRED SUBJECT is the subject of the messages you want to remove.

When done, I clicked on the play button in the toolbar (green triangle) to run the script.


Option Explicit

Sub deleteOutlookAppt()
Dim olApp As Object 'Outlook.Application
Dim olNS As Object 'Outlook.Namespace
Dim olAptItemFolder As Object 'Outlook.Folder
Dim olAptItem As Object 'Outlook.AppointmentItem
Dim i As Long

    Set olApp = CreateObject("Outlook.Application")
    Set olNS = olApp.Session
    Set olAptItemFolder = olNS.GetDefaultFolder(9) '9=olFolderCalendar constant
   
    For i = olAptItemFolder.Items.Count To 1 Step -1
        Set olAptItem = olAptItemFolder.Items(i)
        If olAptItem.Subject Like "DESIRED SUBJECT" Then
            olAptItem.Delete
        End If
    Next i
   
    Set olAptItem = Nothing
    Set olAptItemFolder = Nothing
    Set olApp = Nothing
   
End Sub