Spotting strange connections on the network

Posted on By Mark Wilson
This content is 16 years old. I don't routinely update old blog posts as they are only intended to represent a view at a particular point in time. Please be warned that the information here may be out of date.

A few nights back, I was sorting the pile of books, newspapers and magazines in the bedside reading pile into two more piles: “no time to read so send for recycling”; and “I really must read that”. As I did so, I came across a copy of .net magazine that included an article on using netstat.exe to detect spyware. This is a well-known, but often forgotten tool in the IT administrator’s arsenal:

netstat -a

will give a list of all network and Internet connections, detailing the protocol (e.g. TCP or UDP), local IP address (and port), foreign (remote) IP address (and port) and the state of the connection.

netstat -an

will display addresses in numeric form, so it’s pretty easy to spot those that are listening from another network and a whois lookup will help work out who’s listening in who shouldn’t be (often it will turn out to be something intentional).

netstat -abnv

will take it a step further and show you the applications and components used to initiate the connection – look out on this list and you should be able to spot any strange applications and google them to find out what they are.

Incidentally, netstat is not just for Windows, but the command switches I gave above are. If you are using Windows and you don’t like the command line, then TCPView is a former Sysinternals tool (now owned by Microsoft) that provides a GUI front end for netstat, including whois lookups and process properties. Another useful tool is Nir Sofer’s CurrPorts, which displays the list of all open TCP and UDP ports along with information about the process that opened the port (including highlighting suspicious processes) and the ability to close unwanted TCP connections, kill the process that opened the ports, and save the information to a file.

Unlocking the secrets of Windows 7

Posted on By Mark Wilson
This content is 16 years old. I don't routinely update old blog posts as they are only intended to represent a view at a particular point in time. Please be warned that the information here may be out of date.

Whether or not it’s true, ask people if Windows Vista was ready when it originally shipped and the response is generally a resounding “no”. It seems that Microsoft is not taking any chances with Windows 7 as it has been reported that the new operating system is being constructed in a modular basis and will only include components as they pass through the appropriate quality gates.

Spoof Microsoft staff identity passThose who have a pre-beta build of Windows 7 may be interested to note that there are some extra features in the milestone 3 build (build 6801) that are only available to permanent Microsoft employees using computers that are members of certain Microsoft Active Directory domains.

To circumvent this, Rafael Rivera has written a tool for Windows 7 called Blue Badge (named after the employee passes that permanent ‘softies are issued with). Running this utility will grant access to incomplete features by patching the operating system.

If you do decide to try it (and why not?), bear in mind that there is a reason these features have not been released – they are not ready yet – so don’t be surprised if everything falls over in a heap.

Microsoft after hours: the sequel

Posted on By Mark Wilson
This content is 16 years old. I don't routinely update old blog posts as they are only intended to represent a view at a particular point in time. Please be warned that the information here may be out of date.

A little over 18 months ago, I attended an event at Microsoft titled “Vista After Hours”. The idea was that, instead of showing us all the features of the Windows ecosystem that were relevant to daily life as an IT Professional, Microsoft would demonstrate some of the things that can be done in Windows apart from work – demonstrating that the world of Windows is not all about dull, corporate applications.

Earlier this week, I was back for more – as Viral Tarpara, Paul Foster and Jamie Burgess demonstrated some of Microsoft’s products aimed at consumers and hobbyists.

As is likely to become the norm around here for such events (so many blog posts, so little time), I won’t write it up in full but here are some of the highlights:

  • Gears of War 2 – the latest big game for the Xbox 360 and phenominally successful (but I’m not a games guy).
  • Viral took a look at Windows Live Services – Google, Yahoo! and Microsoft (MSN/Live) are all doing similar things (although each will claim that it has the best new features!) – taking a look at a few of Microsoft’s Windows Live Services:
    • A new look for live.com is on it’s way to the UK. Personally, I like it – and you can hover the mouse over certain positions on that day’s picture to see links to potentially interesting facts.
    • Windows Live Mail: with a new Outlook-like interface and the ability to connect to multiple mail services (and chose which send via); add own stationary (arghh!); and it will soon include photo e-mail capabilities (e.g. select 4 photos, all resized and embedded in e-mail – rather than as an attachment – then add a frame, or make it black and white, make contrast corrections, etc.).
    • Windows Live Photo Gallery provides a gallery view for resizing, viewing/adding metadata, tagging and editing photos (preserving the original) but publishing etc. is where the Live Services come in and pictures may be published to Flickr, Windows Live Spaces, etc. The end result is highly functional software on the desktop PC, plus services in the cloud.
    • Windows Live Writer is Microsoft’s blogging software and it: integrates with various platforms (WordPress, Blogger, etc. – even SharePoint); applies the site’s stylesheet to the posts as you write; allows insertion of pictures, videos (YouTube or Soapbox), etc.
    • Windows Live Maps: whilst many people use Google Maps – Microsoft claim that Live is superior for business requirements (I prefer the Google mapping view) and it now features: a 3D view using an Internet Explorer/Firefox browser plugin (and no more page refreshes – zoom in and out – very impressive, although it’s a lot smoother on Microsoft’s Internet connection than on mine); a bird’s eye view which uses a Photosynth-like effect to select high resolution images; a free API to use and expose in own applications; collections of public or private searches (e.g. a walk around 3D Manhattan) using public data to link to map (e.g. Times Square).
  • Paul demonstrated Photosynth, which works out how pictures relate to one another in a four dimensional space to build up a complete picture. Because synths only show the data that this appropriate at this moment in time it’s possible to jump around and explore the environment at a reasonable speed. Using the example of Stonehenge, even though the photos were all taken at eye level, the synther can work out where the stones stand so that it is possible to view from above (or even below!). More images helps it to work out more points of view and speech synthesis technologies such as mousegrid can be used to navigate and scroll around.
  • Even I (the non-gamer) was impressed by the new Xbox 360 experience that Jamie demonstrated (due for a worldwide release today for a phased deployment to all Internet-connected Xbox 360s):

    • The user interface has been redesigned and blades have been replaced with a dashboard.
    • Music can be streamed from another PC to the Xbox and played over the top of games or anything else; effectively the Xbox becomes the presentation layer in the living room.
    • Avatars are a huge new feature – with more and more options coming online all the time.
    • Games may be stored on the hard drive.
    • Xbox messaging capabilities integrates with non-Xbox users of Windows Live Messenger (e.g. on PCs).
    • The interface is much more graphical/visual than previously and therefore become much more immersive.
  • Paul showed how Community Games allow anyone (or at least anyone who can write code) to create and publish their own games to Xbox Live (10 million people) including charging Microsoft points and sharing the revenue with Microsoft (the approval process does require accurate rating of the game’s suitability). XNA Game Studio is used with the Express Edition development tools and the resulting games will run on Windows, XBox, or Zune. For more information, check out the XNA UK user group, which aims to provide “a helping hand for bedroom coders throughout the land”.
  • Moving on to home automation systems, Jamie spoke about how he had run co-axial and CAT5 cabling around his parents’ house to stream content from two Sky Plus boxes to almost any room, using IR receivers in the ceiling to control everything from a single remote control. Further information on this type of setup (with Windows Media Center) can be found at The Digital Lifestyle and The Green Button. Much more tangible was Paul’s demonstration of his home automation with everything from recording and playing media content in Windows Media Center to using the mControl digital home software to remotely access CCTV feeds, set the temperature in a room and even water the plants in the garden. B&QBased on a system of scheduling and triggers, Paul demonstrated a HomeEasy system (available from B&Q) with an RF controller and xPL software to control lights (a blog post has been promised…). More Home Automation products are available from Let’s Automate.
  • Viral took a look a some more of the Windows Live services and admitted that the current version of the Windows Live Homepage is not as engaging as other Web 2.0 technologies (the good thing about Viral is that he may be a ‘softie but he also admits to using alternative solutions “because that’s how real people work”) before commenting that a new version will have tighter integration with various other services (e.g. Flickr, Twitter, etc.).
  • Viral also showed off some of the new features in the latest Windows Live Messenger beta – things like assigning your own entrance sound to play on your friends’ messenger client (uh huh… that will be annoying); what’s new (see what friends are up to – a bit like a Facebook status); activities – games, calendar swap, etc.; and photosharing where you can send a series of thumbnails by messenger and recipient can browse for more detail.
  • Ethernet over powerline is a technologies I considered until I replaced my wireless access point with something decent and Jamie briefly mentioned the success he’s had with a NetGear 200Mbps solution in his modern apartment (where the building construction makes Wi-Fi difficult.
  • Jamie then went on to talk about modifying his Mazda MX5 with a 7 inch touchsreen, connected to a mini-ITX PC in the boot, running a Centrafuse front end for GPS (USB attached), Radio, Phone via Bluetooth, Playlist, Music and videos (using a USB dongle Wi-Fi synchronisation between the car and his home whilst in the garage), OBDII diagnostic data, camera, weather, etc. Apparently, you can even have Live Mesh working on this solution too. It sounds like a neat in car entertainment solution but it also sounds like the classic case of a rich kid putting more electronics inside his car than the car is worth… but if this sounds like something of interest then check out MP3car.com.
  • So, moving on to Live Mesh, Viral demonstrated it as a combination of social networking and synchronisation so that files in Mesh-enabled folders on each connected device are synchronised so that data is accessible wherever (based on synchronisation policies to control which contacts can see which data). Using the “Synchronising Life” video I embedded in my recent post on Windows Live FolderShare, he spoke of the potential for Mesh-enabled picture frame and gave a real-world example of how he (in the UK) and his girlfriend (in the USA) share pictures and other information via Live Mesh as the different timezones and work schedules mean that they may not be online at the same time.
  • Paul spoke of how he has Windows XP Pro trimmed down to 384MB and running on a USB key with a mini-ITX PC. It’s possible to do this using the evaluation tools for Windows XP Embedded/CE to strip down although the operating system image does expire. Pico-ITX PCs are even smaller yet still offer USB support, VGA output and SATA II drives. Find out more at mini-itx.com.
  • A Microsoft Surface table is a $10,000 device based on a technology called Frustrated Total Internal Reflection (FTIR). Paul demonstrated build a DIY multitouch device using nothing more than a cardboard box, a webcam, a sheet of perspex and a sheet of paper, together with software from the Natural User Interface group). Basically, he fed the webcam through a hole in the bottom of the box (camera facing up) and used the perspex as surface (with paper on top to block out ambient light). The NUI software will handle the view, inverting the image, removing the background, etc. but some additional coding will be required in order to build multi-touch applications. I have to say that it was pretty amazing!
  • Next up – robotics. Those who were at the Windows Server 2008 launch in Birmingham earlier this year may remember Paul’s A1-DW robot (A1 = top stuff, DW = a bit of a dimwit – he needs to be told what to do) but Paul showed a video of the robot working its way around his house. A1-DW is controlled with software developed using the Microsoft Robotics Developer Studio (MRDS) which is free for non-commercial use and provides a combination of a visual programming language and physics-enabled based simulation. In Paul’s demonstration he used a simple programme to join the SetDrivePower control on a GenericDifferentialDrive to the TriggersChanged event from XInputController (a Wireless Xbox controller) and drove it around the room – the idea being that services scattered across a home network (one big grid computer) can be used to control less powerful robot.
  • The next demonstration was of Windows Home Server, showing how this product has a very simple user interface, designed to make it easy for consumers to set up a server in their home and manage users, shared folders, storage and websites (e.g. for sharing a photo album with friends and family). Plugins are available (e.g. mControl for home server) whilst the network status is indicated with a simple red, amber, green system which advises of any action to be taken (e.g. update anti-virus definitions, perform a backup). There is also a simple interface for setting up backups, password policies, remote access (reverse DNS is established via the Windows Live ID authentication process – upon sign in, the IP address of the server is recorded in the homeserver.com DNS zone), port forwarding (via uPnP), etc. Windows Home Server is available to system builders as an OEM product, or a fully-configured system costs around £500 (e.g. the HP EX400 MediaSmart server at £499). For more information on Windows Home Server and the digital home, see We Got Served.
  • Looking at some of the developments in Microsoft hardware, Viral demonstrated: Microsoft’s new mice with a blue LED light which can track smoothly regardless of the surface; new LifeCam devices with HD picture quality and messenger integration; and an arcmouse where the end folds in for travel without the usual restrictions of a mobile mouse (i.e. its small size).
  • Finally, Paul showed off Windows 7 Ultimate Edition running on a netbook. The model he used was an Acer Aspire One with a 1.6GHz Intel Atom CPU, 1GB RAM, 120GB Hard drive (not SSD) and I was very impresed at the performance and the graphics (e.g. very smooth Flip-3D effects). For those who were confused by the apparant doublespeak in my recent post about installing Windows 7 on an old PC, it’s worth considering that this machine cost him £228 including shipping (for a Linux version) and has a Windows Experience index of 2.3 (2.9 for the CPU, 3.3 for RAM, 2.3 for graphics, 3.0 for gaming graphics and 5.0 for disk). Having seen this, I’m almost certainly going to be buying a Dell Inspiron Mini 9 for Windows 7.

For someone who mostly concentrates on Microsoft’s business-focused products, it was interesting to spend an evening on the consumer side of the fence. In summary: an evening of geeky goodness.

Access denied when echoing files using SyncToy

Posted on By Mark Wilson
This content is 16 years old. I don't routinely update old blog posts as they are only intended to represent a view at a particular point in time. Please be warned that the information here may be out of date.

Whilst Windows Live Mesh and FolderShare provide me with an effective means to keep files and folders in sync, some of my devices do not run Windows or OS X (e.g. my NetGear ReadyNAS) and I’ve been using the SyncToy v2.0 tool for data that I just want to copy from one location to another (e.g. backing the file data on the notebook PC that I use for work up to a file share).

Unlike FolderShare/Live Mesh, which automatically keep folders in sync, SyncToy is intended for performing on-demand tasks (e.g. backups), as described by Gina Trapani at Lifehacker (and by yours truly a couple of years back when it was still at v1.2).

A few days ago, I was echoing the contents of a large directory to a remote share, but was mystified by some files which would not write to the remote volume. I had full NTFS access to the files but SyncToy produced an error which said:

Error: Cannot write to the destination file. Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) Copying C:\Users\username\filename

After a while, I worked out that the problem files all had the read-only attribute set and that removing this allowed SyncToy to copy the files successfully. I can only assume that the problem was the echo (i.e. file copy, rather than two-way sync) and that the file attributes were being written before the file copy took place, resulting in insufficient permissions to write the file contents.

Send messages in the future and run multiple copies of Outlook

Posted on By Mark Wilson
This content is 16 years old. I don't routinely update old blog posts as they are only intended to represent a view at a particular point in time. Please be warned that the information here may be out of date.

Even though this blog is just a part-time thing (albeit one which is slowly taking over my life), I’m not yet able to give up my day job and become a full-time writer. Even so, I am in the fortunate situation that I do get fed a certain amount of information – information that I want to pass on, but which I can’t until after a certain deadline has passed, usually as the result of a non-disclosure agreement. A few days ago, Microsoft launched SCVMM 2008. I knew some things about SCVMM from public events but I was also told things under NDA and I wanted to get the word out as soon as I was allowed to. With my blog that’s easy enough to do (WordPress allows me to publish a post with a future date and time) but I also wanted to share information with colleagues via e-mail… so I needed a way to send an e-mail message in the future.

Microsoft Office Outlook 2007 Message Options including Do not deliver beforeAs it happens, I already have that capability in Microsoft Office Outlook (I just didn’t know I did) – and as described at My Digital Life, all I needed to do was set a Do not deliver before date and time in the message options. I went out for a while and came back to find that the message sitting in my Outbox had been delivered at the pre-appointed time (I tested first of all with some information that was not really time-critical – just in case!).

Whilst on the subject of Outlook, my friend, colleague and trusted advisor, Garry Martin, told me about a utility he had come across that allows multiple copies of Outlook 2003 or 2007 to run side by side using different profiles. Yes – that’s right – one copy of Outlook connected to, let’s say, work e-mail and the other to, perhaps, GMail. It’s called Extra Outlook! and I’ve yet to try this myself (GMail as a Google Chrome application shortcut is working well for me on my work PC and I use Apple Mail on the Mac) but it certainly sounds useful.

Some more useful Hyper-V links

Posted on By Mark Wilson
This content is 16 years old. I don't routinely update old blog posts as they are only intended to represent a view at a particular point in time. Please be warned that the information here may be out of date.

Regular readers will have realised by now that the frequency of posts on this blog is almost inversely proportional to the amount of my spare time that the day job eats up and, after a period of intense blogging when I had a fairly light workload, the last couple of weeks have left little time for writing (although James Bannan and I did finally record the pilot episode of our new podcast last night… watch this space for more information).

In the absence of my planned post continuing the series on Microsoft Virtualization and looking at application virtualisation (which will make an appearance, just maybe not until next week), here are a few Hyper-V links that might come in useful (supplementing the original list of Hyper-V links I published back in July):

Using psexec to make registry changes on a remote computer

Posted on By Mark Wilson
This content is 16 years old. I don't routinely update old blog posts as they are only intended to represent a view at a particular point in time. Please be warned that the information here may be out of date.

So, here’s the problem. I’m in the UK and I want to send a 15MB file to someone in Australia. My Windows Live SkyDrive and Mesh accounts have 5MB limits (and there is no Mac client for Mesh for a point to point connection). I have an FTP server I can use but I need to create a new user account and I’m many miles away from the server. Of course, being Internet-facing, the FTP server is in a DMZ, so I’m careful about which services it is running but I can use a Remote Desktop Connection to connect to another computer and then use a second remote desktop session to access the FTP server from inside the firewall. At least, I should have been able to, if I’d enabled remote desktop… and I hadn’t.

I tried to connect to the registry remotely and enable Remote Desktop using the method that Daniel Petri describes but that failed:

Error connecting network registry
Unable to connect to ipaddress. Make sure you have permission to administer this computer.

I wasn’t sure what was preventing access to the remote registry (the target is a fully patched Windows Server 2003 R2 computer) but I needed another method of access. That method was a Microsoft SysInternals tool called psexec which allowed me to bypass whatever security I was having trouble with and run commands on the remote server. First I edited the registry to allow Remote Desktop:

psexec \\ipaddress -u username -p password reg add "hklm\system\currentcontrolset\control\terminal server" /f /v fDenyTSConnections /t REG_DWORD /d 0

and was pleased to see that:

reg exited on ipaddress with error code 0.

Next I checked the value I’d just set:

psexec \\ipaddress -u username -p password reg query "hklm\system\currentcontrolset\control\terminal server"

Before I restarted the server:

psexec \\ipaddress -u username -p password shutdown -f -r -t 0

After this, I could RDP onto the console and make the changes that I needed.

If all the command line exercise is a little daunting, then it looks as though Phil Morgan’s RD Enable XP will also optionally call psexec to do the same thing…

How tone mapping can transform an HDR image

Posted on By Mark Wilson
This content is 16 years old. I don't routinely update old blog posts as they are only intended to represent a view at a particular point in time. Please be warned that the information here may be out of date.

A few weeks back, I wrote about my efforts to create a photographic image with high dynamic range (HDR). Since then, I’ve learned that Adobe Photoshop’s approach to HDR is really little more than exposure blending. I had been reasonably pleased with the results (at least on screen) but then I gave Photomatix Pro a try.

Pointe de Trévignon HDR from Photomatix Pro

The initial HDR image that Photomatix Pro produced was disappointing, with deep shadows and washed out skies, but then I read in the help text that this was effectively in an unprocessed state, that my monitor cannot display the full range of information and that, in order to reveal highlight and shadow detail, I need to apply tone-mapping. Photomatix Pro did that for me and – wow! What a difference!

Pointe de Trévignon HDR from Photomatix Pro after tone-mapping

I thought this looked a little too surreal on screen so I reduced the luminosity (it’s actually much better when printed) but you can see how the detail is preserved throughout the entire exposure.

Pointe de Trévignon HDR from Photomatix Pro after tone-mapping

If I find myself creating other HDRs, I’ll probably purchase a copy of Photomatix Pro (and probably the Photoshop plugin version too) – until then I can continue to experiment with a fully-functional trial (but the resulting images will be watermarked – these screen shots are low-resolution previews). In the meantime, I’m going to try and get my head around the technical details of dynamic range, tone mapping and HDR imaging.

Windows Management Tools from Quest

Posted on By Mark Wilson
This content is 16 years old. I don't routinely update old blog posts as they are only intended to represent a view at a particular point in time. Please be warned that the information here may be out of date.

I spent most of yesterday with Quest Software, as they explained the various tools that they have that can help to expand and extend off the shelf infrastructure products from companies like Microsoft, Oracle and Sun.

If you’ve performed a large infrastructure migration or implementation, the chances are that you’ve come across Quest at some point (and I knew they had grown rapidly in recent years) but I hadn’t realised just how many tools they had available.

We spent 4 hours talking about Windows Management tools (without even touching on Application Management or Database Management) so clearly there is too much there for a blog post but it’s worth taking a look at their website some time.

Core Configurator – download it whist you can…

Posted on By Mark Wilson
This content is 16 years old. I don't routinely update old blog posts as they are only intended to represent a view at a particular point in time. Please be warned that the information here may be out of date.

A few months ago, I wrote a post on customising Windows Server 2008 Server Core and Michael Armstrong tipped me off about a cool utility, written by former MVP Guy Teverovsky, called Core Configurator. I say former MVP, because Guy has given up that award to join Microsoft in Israel – and I’m not surprised, after his employer claimed it was their intellectual property (even though he developed it in his spare time) and asked him to remove it from the web.

Anyway, Core Configurator is intended to provide a GUI (strange as it may seem on server core) to aid in the initial setup tasks for a server core machine including:

  • Product activation.
  • Display configuration.
  • Date and time configuration.
  • Remote Desktop configuration.
  • Local user account management.
  • Firewall configuration
  • WinRM configuration
  • Networking.
  • Computer name and domain/workgroup membership.
  • Installation of server core features/roles.
  • Shutdown.
  • Reboot.

Because the tool has been removed from the web, it’s now pretty hard to get hold of, so download it while you can (there is another download location but this version has a slightly different filename and I cannot vouch for the file contents – i.e. I have not tested it). Once it’s gone, it’s gone – so don’t ask me where to get it if these links stop working.