Adventures with Forefront TMG

We wanted to be able to block users from accessing non business related websites, but only wanted the restriction to be in effect when the user was actually clocked in to their project.  Web surfing on breaks and lunch has always been allowed at our company, and we didn’t want to restrict this, just restrict unauthorized use during work.

We decided to look at Microsoft’s Forefront Threat Management Gateway server, or TMG.  This product has the ability to set various filters for web blocking, and might be suitable for our needs.  Just one problem:

How do we make Forefront aware of a specific user’s “status”, as to whether they are clocked in or out?

Forefront can apply its filtering rules based on the IP address or network segment from which the request originates.  It can also filter based on the user name of the person asking for the website.  Unfortunately, there do not seem to be any other external “triggers” that can be used, so we determined that we would try it using AD authentication.

We set up and configured a test TMG environment, and joined it to our domain.  (For a very helpful step-by-step instruction on how to get TMG up and running, take a look at Raihan Al-Beruni’s blog HERE.)

Once it was configured, we did the following:

1.       Created two rules under Firewall Policy in TMG.  One was the “Allow” rule, essentially letting any traffic through.  The other was the “Deny” rule, which restricted users to only accessing sites related to our business
2.       Created two Groups in AD, one called “Filtered” and the other “Non Filtered”
3.       Under the Properties of the Allow rule, we set the Users to be members of the “Non Filtered” group
4.       Under the Deny rule, the “Filtered” group
5.       Apply all the settings, and then add our test user to the “Filtered” group
6.       Test access for the test user.  Success! They could only access the sites allowed by the rule.

Unfortunately, this is where we hit our first snag.  We moved the user from the “Filtered” to the “Non Filtered” group, and… they were still filtered.  A 2^nd test user in the “Non Filtered” group had regular access.  Looking at the TMG logs we could see that the rules were being applied. 

TMG appeared to be only pulling the AD group membership information when it encountered a new name.  Eventually, after several hours in some cases, the membership was re-authenticated, and the appropriate rule was applied.  But this was not going to work for someone who was clocking out for a 15 minute break!

Some further experimentation showed that the “TMG Client” software for the desktop was designed to handle some authentication duties.  So, we experimented with adding the Client.

That was the trick!  A change in AD Group membership was reflected instantly on the TMG server, and the client’s access was adjusted accordingly.

Except…it was instant only if the change was applied to the same DC that the TMG server uses.  Otherwise, we had to wait for AD replication, which could take several minutes.

However, we now have a solution.  A TMG Server with the appropriate rules, and the TMG client on the desktop, and we can change a user’s access as often as we wish.  And there can be as many different rules as we have projects.  We have complete flexibility regarding what sites are filtered and what sites are allowed.

Outlook Sent and Deleted Items hack

Many of our Outlook users manage “shared” or "additional" email boxes.  Unfortunately, Microsoft’s default actions for email is to store “Sent” or “Deleted” emails in the primary user’s account folders.  Multiple people may be accessing these shared accounts, and it is difficult to track if messages have been sent, or accidentally deleted, if those messages could be stored on one of any number of different user’s email accounts.

However, we have found a way around this problem.  There are registry “hacks” which can be applied which force the Sent and Deleted items to be stored in the email account of their origin.

Fix for Sent Items:

1.     Click Start, click Run, type regedit, and then click OK.
2.     Locate and then click the following registry subkey: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Preferences
3.     On the Edit menu, point to New, and then click DWORD Value.
4.     Type DelegateSentItemsStyle, and then press ENTER.
5.     Right-click DelegateSentItemsStyle, and then click Modify.
6.     In the Value data box, type 1, and then click OK.

Fix for Deleted Items:

1.     Click Start, click Run, type regedit, and then click OK.
2.     Locate and then click the following registry subkey: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Options
3.     Look for a subkey called “General”
4.     If it doesn’t exist, Right-click on Options, select New Key, and name the key "General"
5.     Navigate to HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Options\General
6.     On the Edit menu, point to New, and then click DWORD Value.
7.     Type DelegateWastebasketStyle, and then press ENTER.
8.     Right-click DelegateWastebasketStyle, and then click Modify.
9.     In the Value data box, type 4, and then click OK.

These new registry settings have to be set on each individual’s machine.  It would be possible to use a Group Policy to apply this across your organization, if needed.

How to Configure an HP EVA 5000 for Windows Server 2008 R2 MPIO

We have an older HP EVA 5000 and we wanted to use it with Windows Server 2008 R2, Hyper-V, Cluster Shared Volumes, and MPIO.  With the newer EVA 5000 active-active firmware, we're running version 4.1 or 4100, we simply had to configure the hosts in the Command View EVA manager.  Set the operating system type to custom, and enter 00000004198009A8 as your custom type [documentation for server 2008 available here].  Your host should look like this in command view:

Then discover MPIO devices on your server and you should see "COMPAQ HSV111 (C)COMPAQ".  I believe with the active-passive firmware you would see "COMPAQ HSV110 (C)COMPAQ".

With the active-passive firmware (something like EVA 3.110) you would need additional configuration for each drive you present.  Each drive on each host would need to be configured to use the paths for just one controller at a time to make the drive accessible / usable on older EVA firmwares.  With the active-active firmware no additional configuration is necessary.

If you have an EVA running firmware 3.110 and you want to do this you will need to track down a copy of the newest firmware and make sure your license supports it.  HP will not give you a license to run your EVA 5000 if you don't have one, although we managed to get them to make us a new license after many days of pestering many different people in many different departments.

As of writing the 4.1 (4100) firmware is available on HP's site here: ftp://ftp.hp.com/pub/softlib/software9/COL21081/co-55464-1/T3588-10019.iso
and the 3.110 (3110) firmware is available here:
ftp://ftp.hp.com/pub/softlib/software8/COL19159/co-49829-1/EVA_GL_CONTROLLER_FIRMWARE_v3110.zip

I can't find a link to it, but the the Command View software is in an ISO named HP_StorageWorks_Command_View_EVA_v9.3_Software_T5494_10022.ISO

How to grant full access permissions to every mailbox in Exchange 2010

I needed to access 75 mailboxes across multiple mailbox databases and didn't want to grant myself full access permissions to them one at a time so i went searching for a solution.  This nifty command granted me access to every mailbox in the company:

Get-MailboxDatabase  | Add-ADPermission -user <myusername> -AccessRights GenericAll -InheritanceType All


I found a variation of this command in a technet forum post available here and modified it to give myself access to all mailboxes, and set inheritance.

HTH

How to Dedupe a SQL Database Table

We had some log files get parsed twice this morning and accidentally fed the same data in to our table twice due to a race condition.  Removing the extra records was fairly simple, I started out simply trying to find the duplicate rows and expanded from there to remove the extra records.

calllogid is the primary key in the table
uicallid is a row that _should_ be unique but is not because of data from a legacy system being imported in to the table

The logs that were imported twice were identical in every way except for the calllogid, and I chose to match on uicallid because that is a unique value that should never be duplicated.

I started out trying to get the calllogid of every record that was duplicated and I used a subquery to do this:
SELECT 
count(uicallid) as count,
( SELECT TOP 1 CallLogID from dbo.tablename as sub where sub.uicallid = main.uicallid) as id 
FROM dbo.tablename as main 
group by main.uicallid
having count(main.uicallid) > 1 


Manually checking the output I was able to see how many times each record was duplicated and each record from this morning showed up twice, just as i expected.  Once I was confident I had the correct data selected I asked a coworker for help and I was taught you could do a delete where fieldname IN (<a subquery>).  


Now the final query looks like this:

DELETE FROM dbo.tablename
WHERE CallLogID IN ( select
( SELECT TOP 1 CallLogID from dbo.tablename as sub where sub.uicallid = main.uicallid) as id 
FROM dbo.tablename as main 
group by main.uicallid
having count(main.uicallid) > 1 )


The query to delete the duplicate records ran on the 5.5 million row 1GB table in 15 seconds, and it took 3 seconds to do the select to find them.  Not tooo bad.  If there was more than one duplicate entry this query would only delete one of them, so the query would need to be run multiple times to delete multiple entries.

Autoprovision Aastra SIP Phones using mDNS

If you are unable to change the DHCP options on your DHCP server to allow for Option 66 there is a relatively undocumented alternative, mDNS (bounjour).  There is a blurb about it in the manual which tells you this exists, but it doesn't give you any direction, and there isn't much about it on the internet.  I managed to get it to work and am simply posting my solution, hopefully it works for you.

This is the snippet about mDNS in the Aastra Admin Guide:
The IP phones can perform an auto-discovery of all servers on a network using
mDNS. When the IP phone discovers a TFTP server, it is automatically
configured by that TFTP server.
An unconfigured phone (phone right out of the box) added to a network, attempts
to auto-discover a configuration server on the network without any end-user
intervention. When it receives DHCP option 66 (TFTP server), it automatically
gets configured by the TFTP server.
An already configured phone (either previously configured by auto-discovery or
manually configured) added to a network, uses its predefined configuration to
boot up.
Notes:
1. Configuration parameters received via DHCP do not constitute
configuration information, with the exception of a TFTP server.
Therefore, you can plug a phone into a DHCP environment, still use the
auto-discovery process, and still allow the use of the TFTP server
parameter to set the configuration server.
2. DHCP option 66 (TFTP server details) overrides the mDNS phase of
the auto-discovery. Therefore, the DHCP option takes priority and the
remaining process of auto-discovery continues.
3. As the phone performs auto-discovery, all servers in the network
(including the TFTP server), display in the phone window. However, only
the server configured for TFTP automatically configures the phone.


There isn't any other information to be found, and I spent a lot of time trying to get this feature to work.  My final solution was to use avahi-daemon to do be the mDNS responder.  One thing to note is if there is a DHCP server sending out option 66 that will override this and the phone will listen to the DHCP option 66 instead.

The installation and configuration is incredibly simple.  On Debian I installed the daemon and the utilities.  I did this directly on my phone system in order to create an all in one type of appliance where I didn't need access to the DHCP server or be at the mercy of the configuration options available in that device.


apt-get install avahi-daemon avahi-discover avahi-utils 

Next, we need to configure avahi for the Aastra phones.  We need to create

/etc/avahi/services/tftp.service 

This is the config file that tells avahi-daemon to listen for aastra phones and tell the phone to use tftp to boot.

/etc/avahi/services/tftp.service:

<?xml version="1.0" standalone="no"?>
<!DOCTYPE service-group SYSTEM "avahi-service.dtd">
<service-group>
<name replace-wildcards="yes">Aastra self-configuration on %h</name>
<service>
       <type>_aastra-cfg._tcp</type>
       <txt-record>protocol=tftp</txt-record>
</service>
</service-group>

And that's it.  Reboot your phone and it should auto discover the tftp server and grab the aastra.cfg and mac.cfg files from there.

I've tested this with the following phones:
Aastra 6757i
Aastra 6739i
Aastra 6731i

Infocus 3114 Projector Review

Scroll to the bottom for an update
Our old projector died when somebody tuned it off without letting it go through the cool down cycle so we decided it was time to find a new projector.  We wanted something bright that would allow us to throw a large image in our training / conference room that would be visible with the lights on, which our old projector could not do.  We found the Infocus 3114 which is quite bright at 3,500 Lumens and seemed to fit the bill so we ordered it.

We ceiling mount our projector and the process was fairly straightforward.  The bracket that held the old one up had the right layout to also hold the new one so it was simple.  Upon turning it on it was of course upside down, and finding the menu to configure the projector for upside down mode became a chore.  Unfortunately it's not an easy to find option, you have to open settings, and then scroll through several pages worth of options before getting to the Ceiling Mount: On/Off option.  For ease of use I would like to see this option on the first page, or be a question on first boot up along with language.  The ultimate cool factor would be for the projector to be able to figure out if it were upside down or right side up, but that would add additional cost for added hardware, so simplifying the process in software seems acceptable to me.

The projector has a ton of features, if you plug a laptop in to it via USB it can emulate a second display by installing drivers and allowing you to use it without needing the right HDMI/DVI/VGA cable, etc.  This is a feature we have yet to try but are planning to in the near future.  It seems intriguing and if it works well it could be fairly handy.

The projector throws a great image in our training room with all of the lights on, so we're quite happy with it.  Unfortunately a week or so after we got it we noticed it would flicker every once in a while, and then come back.  We figured it was a cabling issue and reseated all the cables but unfortunately it kept doing it, but it wasn't a huge annoyance.  After 45 days or so it did this one day, and then simply shut off.  Upon turning it back on it made an interesting noise and didn't boot up but displayed a couple warning lights on the button array.  A minute later I tried again and it did boot, and worked great for another 10 or 15 minutes before shutting off.  This cycle has been repeated several times now, so I called CDW where we bought it and unfortunately it's been too long so we can't exchange it through them.  I was given the support number for Infocus and sent their way.  I called Infocus and was told 10 to 15 days for them to process and return it, excluding shipping to and from.  No advanced replacement option.  Ugh.

It's 2011, it's a $1,300 business projector, and they don't offer advanced replacement?  What am I supposed to do in my training room for the next month?  Fortunately our CDW sales rep suggested we purchase a new unit from them, RMA the old one, and return the new unit back to CDW once we got the broken unit back (within 30 days to avoid restocking fees).   Thankfully CDW is accomdating and understanding that Infocus is terrible.

I went ahead and tried to submit an RMA, but the form they emailed me me kept saying my email address was invalid and I couldn't submit my RMA.  Turns out the propulated address they used (my gmail, which was entered properly) couldn't be used for some inexplicable reason. "You have entered an Invalid Field Value XXXXXX@gmail.com for the following field: email."  I used a different address and their system decided that address was valid and let me submit my ticket.  I submitted this bug to them, hopefully they fix it.

Finally I got the packing instructions,  but I find it interesting they don't service their projectors in house, they use projector doctors!

Even more interesting they don't insure the projector when they ship it back to you, if you want that you have to contact them for pricing.

**Update 1/17/2012**
It took 4 weeks to get our projector back.  It worked for about a week, and then died again.  We ended up sending our old one back to Infocus directly and they sent us a replacement, although it was delayed a couple weeks because they were on back order.  It was nice of them to replace it directly, but would have been nice had they told me how long it would take.  This may be the last Infocus projector I purchase.  We've owned it somewhere around 12 weeks and has been in our possession and worked for about 1/4 of that.

Infocus apparently changed their replacement policy to send refurbished units rather than repairing your old projector in order to expedite the process but it wasn't done in time to save us from having quite the ordeal.