Category Archives: IT – Information Technology

Standard

Posted by

Posted on

March 5, 2008

Posted under

Computers and Internet

Comments

2 Comments

Remotely Enabling Remote Desktop (the 1337 way)

So this one is a little obscure, but lemme paint a quick picture:

A few years back, I had a small client site that had some remote users and executives that would connect to their office workstations from home via VPN / Remote Desktop.  One day an executive got a new computer and “we” forgot to enable Remote Desktop for her.  Normally this could have been addressed by a GPO, but it was a really small client site, and we just didn’t put that much complexity into the configuration.  Anyway, this same day the user wanted to work from home and she was not able to connect.  She proceeded to call me during dinner to inform me of this situation!  I wanted to help but was thinking it would be tough to allow remote access REMOTELY!  But I thought of a way!  After I completed the below steps I contacted the user and she was able to connect!

I was so proud of myself I saved the steps and now I want to share it with everyone today.  I used a combination of a free utility called psexec which can be downloaded here.  I also used the built-in command prompt and registry editor that comes with Windows.   Look at the below window, and follow the command prompt progress.  I’ve commented along the way in green.

C:\Documents and Settings\admin>”C:\Documents and Settings\admin\Desktop\psexec.exe” \\computer0123 cmd.exe

 

PsExec v1.94 – Execute processes remotel

Copyright (C) 2001-2008 Mark Russinovich

Sysinternals – http://www.sysinternals.com

 

 

Microsoft Windows XP [Version 5.1.2600]

(C) Copyright 1985-2001 Microsoft Corp.

 

C:\WINDOWS\systeadmin2>hostname

computer0123

#verify hostname

C:\WINDOWS\systeadmin2>netsh firewall add portopening TCP 3389 rdp enable

Ok.

#now I’m sure remote desktop will be allowed through the firewall

 

C:\WINDOWS\systeadmin2>netstat -a

 

Active Connections

 

  Proto  Local Address          Foreign Address        State

  TCP    computer0123:epmap       computer0123.Eedge.net:0  LISTENING

  TCP    computer0123:microsoft-ds  computer0123.Eedge.net:0  LISTENING

  TCP    computer0123:39259       computer0123.Eedge.net:0  LISTENING

  TCP    computer0123:netbios-ssn  computer0123.Eedge.net:0  LISTENING

  TCP    computer0123:netbios-ssn  computer0123.Eedge.net:0  LISTENING

  TCP    computer0123:microsoft-ds  kaserver.eedge.net:10442  ESTABLISHED

  TCP    computer0123:1332        kadata.eedge.net:microsoft-ds  ESTABLISHED

  TCP    computer0123:1535        kaserver.eedge.net:netbios-ssn  ESTABLISHED

  TCP    computer0123:2033        kaserver.eedge.net:1025  TIME_WAIT

  TCP    computer0123:1060        computer0123.Eedge.net:0  LISTENING

  TCP    computer0123:10001       computer0123.Eedge.net:0  LISTENING

  UDP    computer0123:microsoft-ds  *:*

  UDP    computer0123:isakmp      *:*

  UDP    computer0123:1025        *:*

  UDP    computer0123:1026        *:*

  UDP    computer0123:1027        *:*

  UDP    computer0123:4500        *:*

  UDP    computer0123:ntp         *:*

  UDP    computer0123:netbios-ns  *:*

  UDP    computer0123:netbios-dgm  *:*

  UDP    computer0123:1900        *:*

  UDP    computer0123:ntp         *:*

  UDP    computer0123:netbios-ns  *:*

  UDP    computer0123:netbios-dgm  *:*

  UDP    computer0123:1900        *:*

  UDP    computer0123:ntp         *:*

  UDP    computer0123:1028        *:*

  UDP    computer0123:1044        *:*

  UDP    computer0123:1209        *:*

  UDP    computer0123:1900        *:*

#I see Remote Desktop is not enabled, as port 3389 is not in the list

#I then use regedit from my machine and remotely connect to the registry on her workstation and enable remote desktop.  (HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\fDenyTSConnection=0)

 

C:\WINDOWS\systeadmin2>shutdown -m \\computer0123 -r

The machine is locked and can not be shut down without the force option.

 

C:\WINDOWS\systeadmin2>shutdown -m \\computer0123 -r –f

 

C:\Documents and Settings\admin>

#it works now

For those who are lost in the command prompt, just look at these steps instead:

  1. Use psexec to open a cmd session on the computer0123 
  2. Use netsh to open a hole in the remote computer’s firewall for TCP 3389.  This is the port Remote Desktop uses.
  3.  Use netstat to check to see if remote desktop is currently listening/running
  4. Use regedit (not shown) to connect to computer0123’s registry and change the 1 to an 0 in the fDenyTSConnection key.
  5. Use the shutdown command to restart the computer, which is required when enabling Remote Desktop via the registry.
Standard

Posted by

Posted on

March 4, 2008

Posted under

Exchange Server

Comments

Leave a comment

Exchange 2007 Certificate Installation in 7 Easy Steps!

Ok, so I know this information is already out there in many formats, but I’m asked how to do it on a regular basis anyway.  And while using www.letmegooglethatforyou.com is a fun site, it’s a good way to lose a client (or at least get uninvited to lunch)!  So here’s how to configure Exchange 2007 to use an public SSL certificate:

 

(the fast, no-nonsense version)

 

1.  Use this link to generate the cmdlet structure for your PowerShell command.  This will output the CSR https://www.digicert.com/easy-csr/exchange2007.htm

2.       Send the CSR to a trusted provider.

a.       Entrust is my favorite but GoDaddy is the cheapest.  Other UCC vendors include DigiCert and Comodo. 

b.      More detail here: http://support.microsoft.com/kb/929395

c.       You’ll notice VeriSign isn’t on this list.  They DO offer UCC but only if you spend thousands in their managed PKI program…

3.       While Windows Mobile support all of these vendors, understand that the iPhone and Palm may not.

a.       Palm doesn’t support UCC at all, but you can get around that by using a UCC / SAN cert anyway, and just putting the OWA/ActiveSync FQDN as the primary name in the certificate.  It just can’t read the alternate fields.

4.       Once you get the certificate back, rename it to a .cer file

5.       Open PowerShell again and type: Import-ExchangeCertificate c:\filename.cer

6.       Type Get-ExchangeCertficate to see your new cert at the top of the list.  Copy the thumbprint to the clipboard.

7.       Then type: Enable-ExchangeCertificate –Thumbprint xxx –services iis, smtp, pop, imap, um

a.       Don’t list all the services unless the role is actually installed on the box itself

b.      If you intend to use the same cert on multiple servers, understand that may break your agreement with the Certificate Authority, and you have to import the key pair on the 2nd server before step 6 works.

Misc: