Andy
http://absoblogginlutely.pip.verisignlabs.com/

WSUS

Wsus won’t download updates

By on Friday, June 2, 2006

Had a customer whose wsus box wouldn’t download updates from microsoft with event id 364 – Content download failed. Reason: Access is denied. Source File &lt snip &gt destination File: d:\wsus\wsuscontent……
It looks like the permissions on the root of d: (in this case) are not correct – Network Service needs read access – unfortunately Network Service does not appear in the list of users to add to the drive (and you can’t right click d: to assign permissions).
Fortunately by using cacls you can change permissions – note that cacls is very powerful and you need to understand what you are doing before running this – take it from me, cacls going wrong can really mess with your system and your sanity and your job security!

If you are still with me, you need to do the following:
From a dos prompt:-
d:
cd\
calcs . <--- this provides you with the current state before you change it cacls . /e /g "NT AUTHORITY\NETWORK SERVICE":r cacls . Then in wsus console, double click a client that needs an update, click on the status, click on an update that has failed. Click retry download. Look at the eventvwr and you should see event id 361 - Content synchronization started. A quick glance back at your wsus homepage should show the files being downloaded.

Continue Reading
1
Windows Update

error 0x80096001 when trying to run windows updates.

By on Thursday, June 1, 2006

I had a problem trying to run Windows Updates on a machine, getting an error “Windows Update has encountered an error and cannot display the requested page. You may find the following resources helpful in resolving the problem…’Error Number: 0x80096001”

Several kb articles (ie kb822798) mentioned the need to edit security settings and reregister dll’s and/or remove the %windir%softwaredistribution directory but unfortunately this didn’t work.
Part of the troubleshooting for this involves going in and looking at the certificate status within internet explorer. When I tried to double click on the certificate it gave me the error message “system-level error occured while verifying trust” on any of the certificates.

A post on the microsoft.public.windowsupdate newsgroup gave me a clue and by logging on as another administrator it all worked – my certificates are ok and windows updates runs through successfully.
Update It turns out that the problem in this case was partially caused by having a readonly profile – for some reason the desktop folders etc were all redirected to a share that didn’t exist. By searching for this entry in the registry and editing it to point to a share that did exist I was able to get the profile (and windows update) working again.

Continue Reading
0
Beta Testing Office Thunderbird Vista

AV trial for Vista

By on Wednesday, May 31, 2006

CA are doing a free trial of Vista Antivirus software. Thanks to Digitalfive which is a new blog I’ve added to my reading list even though i don’t have Vista yet as I don’t have a machine powerful enough to run it (apart from my home machine but that needs to be stable(ish)
I’m also sorely tempted to download the Office2007 beta now that the rush is over, but again I don’t really have a machine to put it on – the main pc at home only has works – which is all I need on the machine, and the office pc is hands off. I also don’t have access to an exchange server to put 2007 against, and you really need to make outlook your main mail client to get the best shot of testing it. I’m fairly happy with thunderbird, although I wish it wouldn’t disable my extensions every time I upgrade to a newer version and I miss macro’s.

Continue Reading
0
Microsoft Work

Microsoft USB disk doesn’t turn up :-(

By on Monday, May 29, 2006

I got an email on Friday from Microsoft with the following – “Thank you for your interest in the Mystery Solved Windows® licensing promotion. We’ve received your request for more information to help clarify Microsoft® Windows Desktop Licensing pre-loaded on the USB drive. Unfortunately, this Mystery Solved promotion was available in the U.S. only and while supplies last. Supply is depleted at this time, so we encourage you to please utilize the online alternative today.
Simply download* the Windows Desktop Licensing reference files directly at:www.microsoft.com/mysterysolved/corp. Oh well 🙁

Continue Reading
3
Hacking Security

How not to handle data loss

By on Friday, May 26, 2006

I had the misfortune to have to deal with a user who had received an email after their data was stolen from the University of Texas. The email mentioned that their username and email address had been divulged to unauthorised users.
Unfortunately the way the email was sent out to the user, it looked just like a phishing scam. The email contained references to http://www.mccombs.utexas.edu/datatheft/ but if you looked at where the link would take you, it actually went to a convio.com address.
As this is a typical phishing mechanism I did a bit of digging. A whois lookup on convio.com provided an IT contact and the fact that the domain had been registered for 6 years which therefore implied that their server might have been hacked.
I contacted the Convio and received a return phone call where I was told that a lot more data had been revealed (depending on what data was stored on the server) and that the email was genuine.
After that I received two phonecalls from a call center that was set up to answer queries about the data theft. The scary thing is that their records show I requested contact about the problem but they didn’t update the records that someone had already contacted me. It would also make sense to ensure that the users who are manning the call center can actually pronounce the names of the companies involved in the whole farce!

I was also amazed to see that the University are not offering free credit monitoring or any other form of compensation to the affected users – instead they are just given (more redirected) links to a reduced fee.

All the above makes a mockery of the comments on the University website that can be found on google and the REALLY scary thing is that the server was hacked more than a month ago (April 11th), they announced it on the April 23rd and they didn’t contact the user until May 25th (see Attrition for details.
Oh – and there are another 197,000 users also affected – still thats small change in the amount of 81,822,769 that have been affected since the Choicepoint breach in Feb 05

Continue Reading
1