Fix: Outlook blocked access to the following potentially unsafe attachments…

How to Unblock Unsafe Attachments in Microsoft Outlook

There’s a vast range of desktop and online email clients but it’s hard to beat Microsoft Outlook. The application has been around since 1997 and, despite a few dodgy decisions regarding HTML rendering, it’s still the email client of choice for me and many others.

Unfortunately, there’s an Outlook message web developers hate:

Outlook blocked access to the following potentially unsafe attachments…

Thanks Microsoft. I know why you’re blocking that JavaScript file, but I know what it is and I really, really want it.

Outlook doesn’t allow you to unblock unsafe attachments. Fortunately, there is a way to obtain the file and prevent the embarrassment of requesting a renamed version. Before we start…

WARNING: YOU’LL NEED TO EDIT THE REGISTRY!

We’re about to delve into the Windows registry. Please move along if you don’t know what the registry is or have never dabbled with it before. It’s a dangerous place — once false move and your PC will stop working...
The fix will also reduce Outlook security settings. That’s not a problem for someone with reasonable IT knowledge, but it’s not for everyone.

DO THIS AT YOUR OWN RISK!

If you still want to proceed, below are the steps to take:

1. Close Outlook

2. Run regedit.exe (Start -> cmd.exe, then type regedit [ENTER])
Navigate to:

HKEY_CURRENT_USER\Software\Microsoft\OfficeXX.X\Outlook\Security

Where XX.X indicates your version of Outlook:

·         15.0 for Microsoft Office / Outlook 2013

·         14.0 for Microsoft Office / Outlook 2010

·         12.0 for Microsoft Office / Outlook 2007

·         11.0 for Microsoft Office / Outlook 2003

·         10.0 for Microsoft Office / Outlook 2002

·         9.0 for Microsoft Office / Outlook 2000

3. Create a new STRING value
Create a new string value key in that location named:
Level1Remove

4. Choose your ‘safe’ file types
Edit the key and enter a list of attachment extensions you want to unblock. Each should start with a period and be separated with a semi-colon. For example…

To unblock JavaScript files only, enter:

.js

To unblock JavaScript, shortcuts, VBScript, and exe files, enter:

.js;.lnk;.vbs;.exe

Click OK to save the value then exit regedit.

5. Restart Outlook
The attachment should be magically unblocked. Try rebooting if that’s not the case.

How ‘netmask ordering’ feature in Windows AD DNS affects the resultant queries

The netmask ordering feature is used to return addresses for type A DNS queries to prioritize local resources to the client. For example, if the following conditions are true, the results of a query for a name are returned to the client based on Internet protocol (IP) address proximity:

• You have eight type A records for the same DNS name.
• Each of your eight type A records has a separate address.

In the initial release of Microsoft Windows 2000 Server, this proximity is calculated based on the native class of address that is assigned to the client. If the client is assigned a native class A address, the responses that are sent to the client are prioritized by entries that match the client class A network membership. This is also true of native class B and native class C addresses. 

The round robin feature is used to randomize the results of a similar type of query to provide basic load-balancing functionality. In the earlier example, eight type A records with the same name and different IP addresses cause a different answer to be prioritized to the top with each query. Because a new IP address is prioritized to the top with each query, clients are not repeatedly routed to the same server.

This can be helpful if your subnets are perfectly configured in a multi site environment, but unfortunately it is not like that most of the times. It could make that a user located in London is using a domain controller in Hong Kong to authenticate or to resolve names. DNS resolution definitely affects your AD implementation! I've seen  enterprises where users are affected by this Windows 'feature', when they are connected to their corporate network or by VPN.

A "fix" is explained in the following article, very well explained, however, it is not applicable to all the cases, especially when diverse subnets exist in the same location, and that don't match with the subnet assigned to the DNS servers / Domain Controllers. It will work, again, if you design (or reorganize) your company's subnets. A workaround is to create additional A records and Cnames to allow DNS resolution of your clients to closest DNS / AD nodes... Every case is be different, but it can be done!

All clients are in the Chicago site. If the user did a DNS look up from Client01 (172.10.1.100) on the domain name Contoso.com the following DCs were returned in order

DC01-172.10.1.1

DC02-172.10.1.2

DC04-172.30.20.1

DC03-172.20.10.1

DC05-192.168.5.1

If they would run the same query a second time from the same machine the list would tend to look like this.

DC02-172.10.1.2

DC01-172.10.1.1

DC04-172.30.20.1

DC03-172.20.10.1

DC05-192.168.5.1

If they would run it a third time, it would be identical to the first time. The 4^th time would be identical to the 2^nd time. The DCs in their AD site would always be returned as number 1 and 2 in the list. This is what the desired and expected behavior was. However, if Client02 (172.10.8.1) or Client03 (172.10.9.1) did a DNS look up the list would frequently look like those above, but sometimes it would look something like this

DC03-172.20.10.1

DC04-172.30.20.1

DC05-192.168.5.1

DC01-172.10.1.1

DC02-172.10.1.2

The customer first suspected it to be a DHCP vs Static IP issue as that appeared on the surface to be the only real difference between them. The clients were getting different records returned in a round robin fashion but ONLY in their site when using a static address but when it was DHCP it would round robin through all the different records. The devil they say is in the details.

There is a setting on the DNS server on the advanced tab called Netmask Ordering. The purpose of netmask ordering is to try and prioritize local resources for clients. For example if an A record exists in 2 places, 1 on the same subnet as the client and 1 on a different subnet, return the A record on the same subnet client. It assumes since the subnets match, the resource must be closer to the client so return that address.

So what is the problem here? Netmask ordering was enabled on both DC01 and DC02. Why are the DHCP clients behaving differently? Turns out Netmask ordering by DEFAULT matches to Class C addresses (255.255.255.0) I’ve highlighted in red to show the Class C octet for the environment.

DCs

DC01- 172.10.1.1

DC02- 172.10.1.2

DC03-172.20.10.1

DC04-172.30.20.1

DC05-192.168.5.1

Clients

Client01-172.10.1.100

Client02- 172.10.8.1

Client03-172.10.9.1

Since Cilent01 Class C octet matched DC01 and DC02 Class C octet those were always being returned in a round robin fashion. However Client02 and Client03 did not match any Class C octet for any DC so all results were returned in a round robin fashion since none were considered to be close for that client.

For this environment we wanted to actually match on the Class B octet, 172.10.x.x. In order to do this we ran the following DNS command, Dnscmd /Config /LocalNetPriorityNetMask 0x0000FFFF.

DCs

DC01- 172.10.1.1

DC02- 172.10.1.2

DC03-172.20.10.1

DC04-172.30.20.1

DC05-192.168.5.1

Clients

Client01-172.10.1.100

Client02- 172.10.8.1

Client03-172.10.9.1

Now all DHCP clients in the Chicago site behaved like the statically defined client since the Class B octet (255.255.0.0) matched the octet for the DCs. DC01 and DC02 are being returned in a round robin fashion as expected.

For more info around this read http://support.microsoft.com/kb/842197

Ref: http://blogs.technet.com/b/askpfeplat/archive/2013/02/18/how-netmask-ordering-feature-in-dns-affects-the-resultant-queries.aspx

VMware Vsphere: Fix hidden NIC devices after P2V conversion of Windows servers

VMware Vsphere: Fix hidden NIC devices after P2V conversion of Windows servers

After a physical conversion a number of “stale devices” will exist in the new virtual machine. These are hardware devices which are no longer required.

Windows 2000 & 2003

To identify which devices are no longer physically installed on your virtual machine, use the Microsoft environment variable devmgr_show_nonpresent_devices. This is explained in the Microsoft article:

http://support.microsoft.com/kb/315539

1. From the command prompt, type:

set devmgr_show_nonpresent_devices = 1

2. Start the search. Type:

start devmgmt.msc

3. From the Device Manager, list the devices.

Select: View > Show hidden devices.

4. Deinstall the listed devices:

Select the device and uninstall it from the Device Manager.

Reboot.

How to run vbs scripts from KiXtart?

You can do it by SHELL (waits for execution) or RUN (continues with Kixtart script)

eg:

shell 'wscript.exe yourscript.vbs [arguments]'

where [arguments] might be one of your KiX variables


http://www.kixtart.org/

Run add printer wizard as another user

In a Windows 200X system (Windows 2000, Windows XP, Windows 2003), to start the printer wizard with another user like administration, go to the command line and execute this:


runas /U:administrator "rundll32.exe shell32.dll,SHHelpShortcuts_RunDLL AddPrinter"

Self-Signed IIS SSL Certificates using OpenSSL

Self-Signed IIS SSL Certificates using OpenSSL

This tutorial assumes that you have a Linux box with OpenSSL installed,and that you want to create a self-signed certificate for IIS5.0 / 6.0

Set up your CA (you only have to do this once)
ON THE LINUX BOX…

Create a private key

openssl genrsa -des3 -out CA.key 1024

(You’ll need to supply a passphrase. DON’T FORGET THIS!!)

Set this to read-only for root for security

chmod 400 CA.key

Create the CA certificate

openssl req -new -key CA.key -x509 -days 1095 -out CA.crt

(Provide appropriate responses to the prompts…for Common Name, you might want to use something like “OurCompany CA”)

Set the certificate to read-only for root for security

chmod 400 CA.crt

Obtain a CSR
ON THE IIS BOX…

Open the Internet Manager
Select the site for which you want to create a key
Right-click and choose Properties
Select the “Directory Security” tab
Click the “Server Certificate” button
Follow the prompts to create a CSR
Save
your CSR, then transfer it to the Linux box for further processing.
(For the following steps, we’ll refer to your CSR as “new.csr”)
Sign the CSR
ON THE LINUX BOX…

Sign the CSR (all of this on one line)

openssl x509 -req -days 365 -in new.csr -CA CA.crt
-CAkey CA.key -CAcreateserial -out new.crt

Transfer the new.crt file back to the IIS box
Install self-signed certificate
ON THE IIS BOX…

Open the Internet Manager
Select the site to install the key
Right-click and choose properties
Select the “Directory Security” tab
Click the “Server Certificate” button
Specify that you want to complete the pending request
Select the .crt file that you just transferred
That’s it!



PS: If you have problems with the certification path (”does not chain up to a
trusted root certificate” in System Log), the following seems to fix it:

1. Internet Information Services -> select the site -> right click -> Properties
2. Directory Security -tab -> Secure communications -frame -> Edit…
3. Select “Enable certificate trust list”, click New… -> Next
4. Add from file -> use CA.crt -> Next
5. Write something to the Name and Description, if you like. -> Next -> Finish

Control Windows services of a remote computer using the command line

You can control Windows services of a remote computer just using the command line.
There are some options around there, but the one I use is psservice. This is a command line utility, part of PsTools, that allows you to control services. (See at the bottom a short description of PsTools).
The syntax is very simple:

psservice.exe \\HOST -u USERNAME -p PASSWORD COMMAND SERVICENAME


HOST - is the hostname or ip address of the host to control (local or remote)
USERNAME - a user with permissions to control services of the HOST
PASSWORD - the password of the user
COMMAND - the action to take with the service. The most commonly used are: query, stop, start, restart
SERVICENAME - the name of the service to control

For example, to restart IIS service of a remote server:

psservice.exe \\192.x.x.x -u user -p ******* restart W3SVC

If you receive an error like:


Unable to access Service Control Manager on \\192.x.x.x:
Access is denied.

or

Unable to connect to \\192.x.x.x

It's because pstools relies on $admin share access. A way to open it is:

net use \\HOST\admin$ PASSWORD /USER:USERNAME

HOST - is the hostname or ip address of the host
PASSWORD - the password of the user
USERNAME - a local or domain user with permissions to map a folder in the host
if USERNAME is a local user, type it as HOST\USERNAME,
if USERNAME is a domain user, type it as DOMAIN\USERNAME

For example:

net use \\192.x.x.x\admin$ ****** /USER:DOMAIN\USERNAME

You can remove the connection using:

net use \\192.x.x.x\admin$ /DELETE

Whith this base, you can create a batch file to restart services of a remote host with just a double-click

----------------------------------------------

PsTools description
===================

This tool is a set of command line utilities that allow you to manage local and remote systems
PsTools is a set of commandline utilities that allow you to manage local and remote systems.

All of the utilities in the PsTools suite work on Windows NT, Windows 2000 and Windows XP. The PsTools download package includes an HTML help file with complete usage information for all the tools.

The tools included in the PsTools suite are:

· PsExec - execute processes remotely
· PsFile - shows files opened remotely
· PsGetSid - display the SID of a computer or a user
· PsKill - kill processes by name or process ID
· PsInfo - list information about a system
· PsList - list detailed information about processes
· PsLoggedOn - see who's logged on locally and via resource sharing (full source is included)
· PsLogList - dump event log records
· PsService - view and control services
· PsShutdown - shuts down and optionally reboots a computer
· PsSuspend - suspends processes
· PsUptime - shows you how long a system has been running since its last reboot (PsUptime's functionality has been incorporated into PsInfo)

Terminal Services Manager fails to list sessions on TS server(s) in the same domain

The symptom is that if you start Terminal Services Manager (aka. TSM) and double-click on another server of your domain in the list (to get the list of sessions on that TS server), then that server simply disappears from the server list, or just appears with a red "cancel" icon.

For me the problem was solved only by starting the "Remote Registry" service (since it was stopped) on the TS server.