Fix: Outlook blocked access to the following potentially unsafe attachments…

How to Unblock Unsafe Attachments in Microsoft Outlook

There’s a vast range of desktop and online email clients but it’s hard to beat Microsoft Outlook. The application has been around since 1997 and, despite a few dodgy decisions regarding HTML rendering, it’s still the email client of choice for me and many others.

Unfortunately, there’s an Outlook message web developers hate:

Outlook blocked access to the following potentially unsafe attachments…

Thanks Microsoft. I know why you’re blocking that JavaScript file, but I know what it is and I really, really want it.

Outlook doesn’t allow you to unblock unsafe attachments. Fortunately, there is a way to obtain the file and prevent the embarrassment of requesting a renamed version. Before we start…

WARNING: YOU’LL NEED TO EDIT THE REGISTRY!

We’re about to delve into the Windows registry. Please move along if you don’t know what the registry is or have never dabbled with it before. It’s a dangerous place — once false move and your PC will stop working...
The fix will also reduce Outlook security settings. That’s not a problem for someone with reasonable IT knowledge, but it’s not for everyone.

DO THIS AT YOUR OWN RISK!

If you still want to proceed, below are the steps to take:

1. Close Outlook

2. Run regedit.exe (Start -> cmd.exe, then type regedit [ENTER])
Navigate to:

HKEY_CURRENT_USER\Software\Microsoft\OfficeXX.X\Outlook\Security

Where XX.X indicates your version of Outlook:

·         15.0 for Microsoft Office / Outlook 2013

·         14.0 for Microsoft Office / Outlook 2010

·         12.0 for Microsoft Office / Outlook 2007

·         11.0 for Microsoft Office / Outlook 2003

·         10.0 for Microsoft Office / Outlook 2002

·         9.0 for Microsoft Office / Outlook 2000

3. Create a new STRING value
Create a new string value key in that location named:
Level1Remove

4. Choose your ‘safe’ file types
Edit the key and enter a list of attachment extensions you want to unblock. Each should start with a period and be separated with a semi-colon. For example…

To unblock JavaScript files only, enter:

.js

To unblock JavaScript, shortcuts, VBScript, and exe files, enter:

.js;.lnk;.vbs;.exe

Click OK to save the value then exit regedit.

5. Restart Outlook
The attachment should be magically unblocked. Try rebooting if that’s not the case.

How ‘netmask ordering’ feature in Windows AD DNS affects the resultant queries

The netmask ordering feature is used to return addresses for type A DNS queries to prioritize local resources to the client. For example, if the following conditions are true, the results of a query for a name are returned to the client based on Internet protocol (IP) address proximity:

• You have eight type A records for the same DNS name.
• Each of your eight type A records has a separate address.

In the initial release of Microsoft Windows 2000 Server, this proximity is calculated based on the native class of address that is assigned to the client. If the client is assigned a native class A address, the responses that are sent to the client are prioritized by entries that match the client class A network membership. This is also true of native class B and native class C addresses. 

The round robin feature is used to randomize the results of a similar type of query to provide basic load-balancing functionality. In the earlier example, eight type A records with the same name and different IP addresses cause a different answer to be prioritized to the top with each query. Because a new IP address is prioritized to the top with each query, clients are not repeatedly routed to the same server.

This can be helpful if your subnets are perfectly configured in a multi site environment, but unfortunately it is not like that most of the times. It could make that a user located in London is using a domain controller in Hong Kong to authenticate or to resolve names. DNS resolution definitely affects your AD implementation! I've seen  enterprises where users are affected by this Windows 'feature', when they are connected to their corporate network or by VPN.

A "fix" is explained in the following article, very well explained, however, it is not applicable to all the cases, especially when diverse subnets exist in the same location, and that don't match with the subnet assigned to the DNS servers / Domain Controllers. It will work, again, if you design (or reorganize) your company's subnets. A workaround is to create additional A records and Cnames to allow DNS resolution of your clients to closest DNS / AD nodes... Every case is be different, but it can be done!

All clients are in the Chicago site. If the user did a DNS look up from Client01 (172.10.1.100) on the domain name Contoso.com the following DCs were returned in order

DC01-172.10.1.1

DC02-172.10.1.2

DC04-172.30.20.1

DC03-172.20.10.1

DC05-192.168.5.1

If they would run the same query a second time from the same machine the list would tend to look like this.

DC02-172.10.1.2

DC01-172.10.1.1

DC04-172.30.20.1

DC03-172.20.10.1

DC05-192.168.5.1

If they would run it a third time, it would be identical to the first time. The 4^th time would be identical to the 2^nd time. The DCs in their AD site would always be returned as number 1 and 2 in the list. This is what the desired and expected behavior was. However, if Client02 (172.10.8.1) or Client03 (172.10.9.1) did a DNS look up the list would frequently look like those above, but sometimes it would look something like this

DC03-172.20.10.1

DC04-172.30.20.1

DC05-192.168.5.1

DC01-172.10.1.1

DC02-172.10.1.2

The customer first suspected it to be a DHCP vs Static IP issue as that appeared on the surface to be the only real difference between them. The clients were getting different records returned in a round robin fashion but ONLY in their site when using a static address but when it was DHCP it would round robin through all the different records. The devil they say is in the details.

There is a setting on the DNS server on the advanced tab called Netmask Ordering. The purpose of netmask ordering is to try and prioritize local resources for clients. For example if an A record exists in 2 places, 1 on the same subnet as the client and 1 on a different subnet, return the A record on the same subnet client. It assumes since the subnets match, the resource must be closer to the client so return that address.

So what is the problem here? Netmask ordering was enabled on both DC01 and DC02. Why are the DHCP clients behaving differently? Turns out Netmask ordering by DEFAULT matches to Class C addresses (255.255.255.0) I’ve highlighted in red to show the Class C octet for the environment.

DCs

DC01- 172.10.1.1

DC02- 172.10.1.2

DC03-172.20.10.1

DC04-172.30.20.1

DC05-192.168.5.1

Clients

Client01-172.10.1.100

Client02- 172.10.8.1

Client03-172.10.9.1

Since Cilent01 Class C octet matched DC01 and DC02 Class C octet those were always being returned in a round robin fashion. However Client02 and Client03 did not match any Class C octet for any DC so all results were returned in a round robin fashion since none were considered to be close for that client.

For this environment we wanted to actually match on the Class B octet, 172.10.x.x. In order to do this we ran the following DNS command, Dnscmd /Config /LocalNetPriorityNetMask 0x0000FFFF.

DCs

DC01- 172.10.1.1

DC02- 172.10.1.2

DC03-172.20.10.1

DC04-172.30.20.1

DC05-192.168.5.1

Clients

Client01-172.10.1.100

Client02- 172.10.8.1

Client03-172.10.9.1

Now all DHCP clients in the Chicago site behaved like the statically defined client since the Class B octet (255.255.0.0) matched the octet for the DCs. DC01 and DC02 are being returned in a round robin fashion as expected.

For more info around this read http://support.microsoft.com/kb/842197

Ref: http://blogs.technet.com/b/askpfeplat/archive/2013/02/18/how-netmask-ordering-feature-in-dns-affects-the-resultant-queries.aspx

VMware Vsphere: Fix hidden NIC devices after P2V conversion of Windows servers

VMware Vsphere: Fix hidden NIC devices after P2V conversion of Windows servers

After a physical conversion a number of “stale devices” will exist in the new virtual machine. These are hardware devices which are no longer required.

Windows 2000 & 2003

To identify which devices are no longer physically installed on your virtual machine, use the Microsoft environment variable devmgr_show_nonpresent_devices. This is explained in the Microsoft article:

http://support.microsoft.com/kb/315539

1. From the command prompt, type:

set devmgr_show_nonpresent_devices = 1

2. Start the search. Type:

start devmgmt.msc

3. From the Device Manager, list the devices.

Select: View > Show hidden devices.

4. Deinstall the listed devices:

Select the device and uninstall it from the Device Manager.

Reboot.

Run add printer wizard as another user

In a Windows 200X system (Windows 2000, Windows XP, Windows 2003), to start the printer wizard with another user like administration, go to the command line and execute this:


runas /U:administrator "rundll32.exe shell32.dll,SHHelpShortcuts_RunDLL AddPrinter"

Proclarity: The selected page could not be opened because the cube could not be found

Here's a slightly dated but still fantastic document from Dawn Fink regarding cube could not be found errors. Check out the link near the bottom for a whitepaper on Kerberos Delegation and PAS.



SYMPTOMS:
Opening a book with the Standard Web Client displays a warning message. The message states, "The cube used by this page could not be found" [The selected page could not be opened because the cube could not be found.]. The message also states that the details of the condition have been recorded and sent to the web site administrator and that if immediate assistance is required, contact the administrator.

CAUSE:
The message fundamentally means that the ProClarity Analytic Server (PAS) could not contact Microsoft SQL Server Analysis Services (SSAS) successfully. There are many reasons why this might happen. This article will cover some common issues.

Configuration 1:
PAS is located on a separate machine from SSAS, and IIS authentication is set to "Windows Integrated," and Kerberos Delegation is not configured. This is also known as the "two-hop" problem.

Cause:
Because of intentional security restrictions, it is not possible in to have the OLAP server and PAS server on separate physical machines, use Integrated authentication and have OLAP security respected at the same time - unless you configure Kerberos Delegation.

Resolution:
There are a few possible solutions to this problem.

1. Set the IIS authentication to Basic only. This will allow PAS (IIS) to receive credentials and pass them on to the OLAP server. Note that when this is done IIS will display a warning about credentials being passed in clear text when using this mode - please use SSL to secure Basic traffic.

2. Move SSAS and PAS (IIS) to the same machine. This will eliminate one of the two hops in the two hop problem.

3. Do not use any security settings on SSAS by allowing the Anonymous IIS user access to the cube. This means that everyone will have access to all of the information on the server.

4. Configure your network to use the Kerberos Delegation. Please see the document below.

Configuration 2:
PAS and SSAS are located on the same machine OR they are located on separate machines AND IIS authentication is set to "Basic" and not "Windows Integrated".

Cause:
The user attempting to access SSAS does not have sufficient privileges to access the desired data.

Resolution:
Check the security roles on SSAS at both the cube level and the database level. Be sure the user has access to the data they are attempting to view.

Configuration 3:
PAS and SSAS are located on the same machine OR they are located on separate machines AND IIS authentication is set to "Basic" and not "Windows Integrated" (or you are leveraging the features of Kerberos Delegation). SSAS data has recently been migrated to another machine, the SSAS machine name has changed, one or more of the catalog names have been changed, or one or more of the cube names have been changed.

Resolution:
Please use ProClarity Professional and the Change Connection Information Wizard to verify you are pointing to the correct server, database (catalog), and cube.


http://blogs.technet.com/proclarity/attachment/3172290.ashx

Search Function not working in Sharepoint 3.0

I also noticed there were many warning messages in the event log, coming every 15 minutes:
'The start address cannot be crawled' Context: Application 'Search index file on the search server', Catalog 'Search' Details: Access is denied. Check that the Default Content Access Account has access to this content, or add a crawl rule to crawl this content. (0x80041205)

Verify that the account you are using has "Full Read" permissions on the SharePoint Web Application being crawled. verify that the account you are using has "Full Read" permissions on the SharePoint Web Application being crawled.

How to troubleshoot and solve it:

From a newsgroup post: "There are some particulars that are not documented very well when setting up your search settings.
The search engine will only crawl on a site that is the default zone.
If the default zone is secured (https), search will not return any results and you will see this error in the application log.
To fix this, create and extend the current web application with a new site. The default settings will suffice for everything except the zone. Change the “Zone” to Internet or Custom. This new site will be the site the search service uses to index. Bear in mind the site uses the same content as your public SharePoint site.

After creating the site, go to Operations > Alternate Access Mappings and change the “Alternate Access Mapping Collection to your main SharePoint site collection.
Then click “Edit Public URLs” and swap the URLs in the fields such that the Default zone is the new “unsecured” SharePoint site.
The secure site can be in any zone except the default zone.Now when the search indexer runs, it will use the default zone site (the new unsecured site) to crawl.
That’s it.

See the link to "www.kevincornwell.com - Windows SharePoint Services (WSS) 3.0 Search Setup Notes" for the original thread.

WSS Central Console --> Operations --> Alternate Address Mapping

In my case, I only reset the default Sharepoint - 80 site back to the servername.
Once this was configured, the crawling warnings went away.

Workaround also with these additional steps:

- Check accounts with permissions for search feature:
WSS Central Console --> Operations --> Services on Server --> Windows SharePoint Services Search Service Settings

- Select a content database
Central Admin -->Applicaton Management tab -->SharePoint Web Application Management heading --> Content databases
Ensure your web application is the one selectedSelect your content database nameUnder Search Server - select your server
OK

List all Users and Groups in Domain

Using LDIFDE

From the support tools we can find LDIFDE.exe, which is a tool for bulk import and export of Active Directory Objects. You can use LDIFDE to import new user records into the directory, or export specific information on specific users into a text file. LDIFDE defaults to export mode (reading From the Directory). When you add the -i option it can be used to write changes into the Directory. Also, if you want to export and extract only specific details, such as the user name, title and login name for all the users in a specific OU (Organizational Unit), you can run the following command:

ldifde -f C:\ldif\ExportUsers.ldf –s SERVERNAME -d "OU=YourOUname,dc=YourDomainName,dc=com" -p subtree -r "(objectClass=User)" -l "cn,givenName,Title,SamAccountName"

Create a NFS share for VM ISO files with Windows 2003 Server R2

http://vmetc.com/2008/02/19/create-a-nfs-share-for-vm-iso-files-with-windows-2003-server-r2/

If your ESX servers are not connected to network storage or if you do not have enough available space on your SAN to dedicate a sub folder of a VMFS volume for ISO files, then you can use a NFS network share to centrally store these images. Creating the NFS share can be done with many server operating systems, but did you know that Windows Server 2003 R2 has native NFS?
VMware-land.com has many “how to” VMware Tips for ESX, and the following is the instructions found there for creating a Windows 2003 R2 NFS share:
window.google_render_ad();
On the Windows 2003 Server make sure “Microsoft Services for NFS” in installed. If not you need to add it under Add/Remove Programs, WindowsComponents, Other Network File and Print Services
Next go to folder you want to share and right-click on it and select Properties
Click on the NFS Sharing tab and select “Share this Folder”
Enter a Share Name, check “Anonymous Access” and make sure the UID and GID are both -2
In VirtualCenter, select your ESX server and click the “Configuration” tab and then select “Storage”
Click on “Add Storage” and select “Network File System” as the storage type
Enter the Windows Server name, the folder (share) name and a descriptive Datastore Name
Once it finishes the configuration you can now map your VM’s CD-ROM devices to this new VMFS volume
Repeat steps 5 through 8 for each of your ESX servers to make the same ISO files available to all ESX hosts.
These instructions assume that you have already configured the VMkernel port group on a vSwitch for each ESX host. For instructions and information about configuring the VMKernel for NAS/NFS storage check the Storage Chapter of the ESX Server 3 Configuration Guide.
Of course, you can use the NFS share for more than just ISO file storage too. This is a good repository for patches and scripts that need to be used on all hosts. NFS also makes a good target for VM image backups too. Use some imagination and install the free VMware server on your 2003 R2 box and you have a low budget DR platform. Oh yeah, I shouldn’t forget to mention you can even run ESX VMs from NFS!
Important Notes:
ESX version 3.x only supports NFS version 3 over TCP/IP.
Best practice for TCP/IP storage is to use a dedicated subnet. This will usually require creating separate Service Console and VMKernel port groups on a dedicated vSwitch.
On the Windows 2003 R2 server be sure to configure the shared folder so that the both the share and the file permissions allow everyone and anonymous full control. You can make the share read only when adding the storage in ESX.
Be sure to remember to punch a hole in the ESX firewall for NFS. On the Configuration tab, go to the Security Profile settings and add the NFS Client so it appears in the allowed outbound connections.


Important:
Dont forget the thing about windows 2003 security thing"On the Windows 2003 R2 server be sure to configure the shared folder so that the both the share and the file permissions allow everyone and anonymous full control. You can make the share read only when adding the storage in ESX." Then u will not be see this error:Error during the configuration of the host: Cannot open volume: /vmfs/volumes/********-********It took me avile to check that, and now i will spank myself around.

HOW TO: Share Windows Folders by Using Server for NFS

http://support.microsoft.com/kb/324089

UNIX uses the Network File System (NFS) protocol to share files and folders on the network. You can use the Server for NFS component in Windows Services for UNIX to share Windows file system resources to UNIX and Linux clients by using NFS, which includes full support for NFS v3. You can use Server for NFS to make interoperability and migration in a mixed environment easier. If you are using Windows, you can use either Windows Explorer or the Windows Nfsshare.exe command-line utility to share files to UNIX clients.

Share Windows Folders by Using Server for NFS

You can use Server for NFS to make Windows resources available to UNIX and Linux clients by using the NFS protocol. You can use either Windows Explorer or the Nfsshare.exe command line utility to share the folder.



To share a folder by using Nfsshare.exe:

1. Log on to the Windows-based server by using an administrative level account.
2. Click Start, click Run, type cmd, and then click OK.
3. Type the following command, and then press ENTER to share a folder to NFS clients and to allow anonymous access:
   
   
   
   
   nfsshare -o anon=yes share_name=drive:path
4. Type the following command, and then press ENTER to delete an NFS share:
   
   
   
   
   nfsshare share_name /delete
5. Type: nfsshare /?, and then press ENTER to display the parameters that you can use with Nfsshare.

To share a folder by using Windows Explorer:

1. Log on to the Windows-based server by using an administrative level account.
2. Start Windows Explorer.
3. Right-click the folder that you want to share, and then click Sharing.
4. Click the NFS Sharing tab, and then click Share this folder.
5. Configure the appropriate settings, and then click OK.NOTE: Microsoft recommends that you install at least one User Name Mapping service on your network to map UNIX and Windows user names to each other. Please view our Kb article about User Name Mapping service in our REFERENCES section.