Daily Cup of Tech

I was doing some research the other day on getting your self out of a difficult situation when you don’t have access to some vital system resources because you are running as a normal user and you lost your local admin password.

I discovered that there is a way to reset your user interface and run interactively as the LOCAL SYSTEM account. This is important because the LOCAL SYSTEM account has a lot of privileges available to it. According to Microsoft:

The system account and the administrator account (Administrators group) have the same file privileges, but they have different functions. The system account is used by the operating system and by services that run under Windows. There are many services and processes within Windows that need the capability to log on internally (for example during a Windows installation). The system account was designed for that purpose; it is an internal account, does not show up in User Manager, cannot be added to any groups, and cannot have user rights assigned to it. On the other hand, the system account does show up on an NTFS volume in File Manager in the Permissions portion of the Security menu. By default, the system account is granted full control to all files on an NTFS volume. Here the system account has the same functional privileges as the administrator account.

A little while back, some enterprising individuals discovered a way to run the LOCAL SYSTEM account interactively. Here are the instructions according to one website:

1. Start > Run > cmd.exe > type: at 12:03 /interactive “cmd.exe” (replace 12:03 with a time 2 mins from now). > close command prompt
2. New command prompt will open, when it does > Hit CTRL+ALT+DEL > find explorer.exe and End Process.
3. At command prompt type: cd.. > type: explorer.exe

This all words fine except that it is a bit confusing for someone who does not understand how all this works. So, I thought I would make it easier for those who do not have my background. I created a little program in AutoIt that completely automated the process. Simply run the program, wait for a couple of minutes, and you’re running as the LOCAL SYSTEM account.

You can download this program and play with it all you want.

WARNING: I have tested this program to the best of my abilities but this does not mean it is perfect. I did not have any problems with it but that does not mean you will not. If something goes wrong, don’t blame me! You’ve been warned.

For those of you who are interested, here is the source code for this little program I wrote. Feel free to hack around and make it do different things:

#include <Date.au3>
If $CmdLine[0] = 0 Then
;No command line options
;First run
$RunTime = _DateTimeFormat(_DateAdd(’n', 1, _NowCalc()),5)
$Command = @ComSpec & ” /c AT ” & $RunTime & ” /interactive “”" & @ScriptFullPath & “”" 2″
Run($Command)
Else
;Second run
$Command = @ComSpec & ” /c taskkill /IM explorer.exe /F & ” & @WindowsDir & “/explorer.exe”
Run($Command)
EndIf

Update: Someone asked in the comments how you get back to your normal account. Simply log out and then log back in as yourself. You should be back to normal.

Trackback link - http://www.dailycupoftech.com/2008/05/22/access-locked-resources-be-the-machine/trackback/

Every single IT person will tell you to maintain your Windows security updates. It is critical, we are told, so that we can keep our computers safe. While I don’t completely agree with the statement (I’ve personally experienced an “update” that has completely killed a mission critical server), it is important to be able to update your system with the required patches.

Most people use Windows Update and many IT administrators use Windows Software Update Services (WSUS) to deploy these patches. While both works well, I personally prefer AutoPatcher. And here’s why:

1. It uses way less bandwidth than Windows Update. You download the patches once and you are done. You can now easily deploy all of the update to several computers, even computers without Internet access.
2. AutoPatcher does more than just update Microsoft applications. It is completely customizable and you can use it to install pretty much anything you want.
3. You can deploy AutoPatcher updates over a network without a bunch of registry hacks. Unless you are running Active Directory, you need to perform a number of registry hacks to get WSUS to work.
4. You do not need to install the Windows Genuine Advantage “critical” update in order to install other updates. You can keep your information to yourself.
5. AutoPatcher can be run unattended over a network or from a log-on script.

If you have never used this amazing tool, I would really encourage you to give it a try. It’s freeware so all it will cost you is your time.

Trackback link - http://www.dailycupoftech.com/2008/05/16/why-autopatcher-beats-windows-update-and-wsus/trackback/

Many of you are familiar with the concept of computer imaging. Essentially, you take a system, configure it the way that you would like, and then duplicate the hard drive to all of the other systems, saving yourself all of the same steps that you did on the first system.

Now, there are a lot of great commercial software programs out there that can do this for you. Acronis and Ghost come to mind. But, not everyone can afford these options. For those of you find yourself in this situation, I present you with a list of options that are available for free or are open source. (All descriptions are copied from their respective websites.)

Partimage is a Linux utility which saves partitions having a supported filesystem to an image file. Most Linux and Windows filesystems are supported. The image file can be compressed with the gzip / bzip2 programs to save disk space, and they can be splitted into multiple files to be copied on CDs / DVDs, … Partitions can also be saved across the network since version 0.6.0 using the partimage network support, or using Samba / NFS. If you don’t want to install Partimage, you can download and burn SystemRescueCd. It’s a livecd that allows to use Partimage immediately even if your computer has no operating system installed (useful to restore an image), and it allows to save an image on a DVD on the fly.

PING (Partimage Is Not Ghost)

PING is a live Linux ISO, based on the excellent Linux From Scratch (LFS) documentation. It can be burnt on a CD and booted, or integrated into a PXE / RIS environment. Several tools have been added and written, so to make this ISO the perfect choice to backup and restore whole partitions, an easy way. It sounds like Symantec Ghost(tm), but has even better features, and is totally free.

Clonezilla

Clonezilla, based on DRBL, Partition Image, ntfsclone, and udpcast, allows you to do bare metal backup and recovery. Two types of Clonezilla are available, Clonezilla live and Clonezilla server edition. Clonezilla live is suitable for single machine backup and restore. While Clonezilla server edition is for massive deployment, it can clone many (40 plus!) computers simultaneously. Clonezilla saves and restores only used blocks in the harddisk. This increases the clone efficiency. At the NCHC’s Classroom C, Clonezilla server edition was used to clone 41 computers simultaneously. It took only about 10 minutes to clone a 5.6 GBytes system image to all 41 computers via multicasting!

IRestorer

Drive Snapshot (IRestorer) creates an exact drive image of your system into a file, including the operating system, installed programs, your data and all security attributes, while windows is running and you continue to work. If disaster strikes (a virus, worm, trojan, or hard disk crash), a complete and exact restoration of your system will be possible in only few minutes. The image file can be mounted as a virtual drive, so you can easily restore (or use) single files or directories, using the Windows Explorer, or other programs. Restart to DOS is only necessary, if you must restore your system partition. Otherwise there is no need to reboot, not even during installation. Drive Snapshot saves only the used disk space, compresses the data and is extremely fast, a P4 - 3.0 GHz will save approx. 2.5 GB/Min on a modern hard disk!

Linbox Rescue Server

The Linbox Rescue Server is an asset management software including 5 modules :

• system backup for emergency crash recovery, hard disk cloning or deployment using a
  PXE network boot. This module was fully developped by Linbox FAS.
• file backup, based on the famous BackupPC, to which we have added a configuration interface,
• inventory, based on ocs-inventory agents, and on an agent which runs during the PXE network boot,
• Software deployment module which works with Linux, MacOS X and MS Windows clients, or any Un*x system running OpenSSH,
• remote control, based on TightVNC.

HDClone

Copies smaller drives onto larger ones for migrating or backing up complete installations as well as for data rescue. The download package contains a program to easily create a bootable floppy disk or CD/DVD under Windows with only few clicks. A floppy image, ISO image, and manual as PDF are also enclosed.

DiscWizard

If you are setting up your new drive, you can use the install instructions to assist in mounting the drive, then use the tools built into your operating system to prepare the drive.

G4L

G4L is a hard disk and partition imaging and cloning tool. The created images are optionally compressed and transferred to an FTP server instead of cloning locally.

MaxBlast 5

If you are setting up your new drive, you can use the install instructions to assist in mounting the drive, then use the tools built into your operating system to prepare the drive.

DriveImage XML Backup Software

DriveImage XML is an easy to use and reliable program for imaging and backing up partitions and logical drives.

The program allows you to:

Backup logical drives and partitions to image files

Browse these images, view and extract files

Restore these images to the same or a different drive

Copy directly from drive to drive

Schedule automatic backups with your Task Scheduler

Image creation uses Microsoft’s Volume Shadow Services (VSS), allowing you to create safe “hot images” even from drives currently in use.Images are stored in XML files, allowing you to process them with 3rd party tools. Never again be stuck with a useless backup!

Restore images to drives without having to reboot.

DriveImage XML runs under Windows XP, Windows Server 2003 and Windows Vista only. The program will backup, image and restore drives formatted with FAT 12, 16, 32 and NTFS.

DuBaron DiskImage

DiskImage is the ultimate tool to backup and restore partitions, entire harddisks, usb keys, floppy drives and (read-only) optical media. DiskImage features built-in zip compression, it’s own compression method for data
> 2Gb, MD5 and SHA1 checksumming, a hex editor, and various tools like drive speed and seek testing.

Dumping and restoring partitions, usb sticks, floppies, optical media, diskimage is the swiss army knife.

WinDD - Disk Dump for Windows

WinDD - Disk Dump for Windows! Windows XP version of Unix ‘dd’ command. Safe, effort-free backup for FAT, FAT32, NTFS, ext2, ext3 partitions.

Partition Saving

Partition Saving is a DOS and Windows program that is used to save, restore and copy hard-drive, partitions, floppy disk and DOS or Windows devices.

With this program you could save all data on a partition to a file (such as you could save this file on a CD for example). Then if something goes wrong, you can completely restore the partition from the backup file. You no longer have to reinstall every piece of software from scratch. All you have to do is restore the partition from the backup file and then update any software that was modified since the backup was created.

NFGDump

nfgdump (Ntfs-Fat-Generic-dump) is a Win32/Linux tool that dumps/restores NTFS (including 3.1=XP), COMPRESSED NTFS, FAT16, FAT32 and arbitrary (generic) partitions. Dump files support compression, encryption, splits, page file content removal, etc.

Forensic Acquisition Utilities

This is a collection of utilities and libraries intended for forensic or forensic-related investigative use in a modern Microsoft Windows environment. The components in this collection are intended to permit the investigator to sterilize media for forensic duplication, discover where logical volume information is located and to collect the evidence from a running computer system while at the same time ensuring data integrity (e.g. with a cryptographic checksums) and while minimizing distortive alterations to the subject system. The components of this package are not intended to preclude changes to the subject system while the evidence collection process is under way. A third party hardware or software write blocker should be employed in those circumstances where it is deemed necessary to guarantee that no changes occur to the subject volume prior to and after the imaging process.

Self Image

SelfImage is the little hard drive utility with big aspirations.SelfImage is capable of making an image file of a hard disk or hard disk partition, and can restore an image back to any drive or partition that doesn’t have open files. Useful for making backups. Unlike dd for Windows (or cygwin), SelfImage is capable of creating an image of a partition that is currently in use.

SelfImage can even create images of partitions that Windows doesn’t recognize (partitions that Windows doesn’t have mounted on a drive letter). This is perfect for the dual-boot system, you can create an image backup of a Linux partition directly from Windows.

PC inspector clone maxx

PC INSPECTOR™ clone maxx is the new professional hard drive copying program from CONVAR. Using the new direct DMA support, data can be copied from hard drives in high speed mode with speeds up to 3.3 GB per minute.This high speed is achieved by PC INSPECTOR™ clone maxx through intelligent inspection of the PC motherboard and the hard drive controller. The software independently determines the fastest data transmission rate and achieves these exceptional speeds through optimal utilization of the DMA chipset on the motherboard of your PC.

PC INSPECTOR™ clone maxx can be started directly from a boot diskette. The copying process is always based on the physical drive and is independent of the file system (e.g. FAT12, FAT16, FAT32, HPFS, NTFS, Ext2, Reiser, etc.) or the number of partitions.

g4u - Harddisk Image Cloning for PCs

g4u (”ghosting for unix”) is a NetBSD-based bootfloppy/CD-ROM that allows easy cloning of PC harddisks to deploy a common setup on a number of PCs using FTP. The floppy/CD offers two functions. The first is to upload the compressed image of a local harddisk to a FTP server, the other is to restore that image via FTP, uncompress it and write it back to disk. Network configuration is fetched via DHCP. As the harddisk is processed as an image, any filesystem and operating system can be deployed using g4u. Easy cloning of local disks as well as partitions is also supported.

FOG :: A Ghost-like Computer Cloning Solution

Fog is a Linux-based, free and open source computer imaging solution for Windows XP and Vista that ties together a few open-source tools with a php-based web interface. Fog doesn’t use any boot disks, or CDs; everything is done via TFTP and PXE. Also with fog many drivers are built into the kernel, so you don’t really need to worry about drivers (unless there isn’t a linux kernel module for it). Fog also supports putting an image that came from a computer with a 80GB partition onto a machine with a 40GB hard drive as long as the data is
less than 40GB.

Fog also includes a graphical Windows service that is used to change the hostname of the PC, restart the computer if a task is created for it, and auto import hosts into the FOG database. The service also installs printers, and does simple snap-ins.

Each has its own pros and cons but all have a purpose. I am personally really liking FOG and am finding a lot of different places to put it to work.

Trackback link - http://www.dailycupoftech.com/2008/05/06/free-or-open-source-imaging-solutions/trackback/

If you are having a hard time convincing your manager that you need to start using encrypted e-mail or to go away from POP3 e-mail access, here is a nifty little trick!

1. Install Wireshark on a computer that is off the network.
2. Install a managed switch that supports port mirroring or port spanning between your Internet connection and your firewall.
3. Mirror the port that your firewall is plugged into to another port andplug your computer with Wireshark into that port.
4. Capture the information with Wireshark for about an hour (or however long you want) using the following filter:

   pop.request.command == "USER" || pop.request.command == "PASS"

5. Show your manager everyone’s username and password that you captured from outside the network on the Internet!

You can also find all of the FTP passwords using the same method and this filter:

ftp.request.command == "USER" || ftp.request.command == "PASS"

Trackback link - http://www.dailycupoftech.com/2007/10/25/e-mail-password-discovery-trick/trackback/

An old computer these days is no longer a completely useless system. In fact, even though I might upgrade my main computer every couple of years, I usually take ten to fifteen years before I completely remove it from my home network and send it to that great LAN in the sky!

Here are ten twelve uses that I have discovered for that more “experienced” computer system!

And once you have read through the article and decided which exciting project you want to do, make sure you let us know by voting in the poll!

Read the rest of the story…

Trackback link - http://www.dailycupoftech.com/2007/09/17/put-that-old-computer-to-good-use/trackback/