Desktop Services: From Links
D-LIT


Tips and tricks.

To access all items in this directory, please go to the top-level Links page.

Tip and date. Details.
NetTool ethernet port tester
2/16/04
Keene Silfer says:
Date: Mon, 16 Feb 2004

Desktop Services has purchased a NetTool handheld network tester:

http://www.flukenetworks.com/us/LAN/Handheld+Testers/NetTool/Overview.htm

Handy for testing network jacks (Phone, token ring, or ethernet? 10Mb or 100? What subnet is it on?). It also indicates jack problems like low signal.

It is available for loan to CUL desktop support providers, but proper care and feeding will have to be observed, as it is a $900 handheld and easily-droppable device. ;)

If you check out the info on the website, note that we have the "NT" (standard) version, not the Inline or Pro models. It's the same hardware, but the software features that you get (inline mode, ping) at each of the two upgrade levels are ~$500 extra a pop. We can look into upgrades if anyone wants to make a case for their utility...

NAV updates on boot-up
1/20/04
Colleen Gardner says:
I open the start up folder in Windows Explorer, right click in the folder to create a new shortcut and navigate to the *VPDN_LU* file in the Symantec folder. That way I'm sure the path is correct. When the shortcut is created, I go to properties on the shortcut icon and add a /s switch to make it silent.
Creating PDFs
1/8/04
../pdf/index.htm
Windows Services
10/31/03

Q: What NT/2K/XP services should/could be turned off?

A: Info. Oliver compiled 9/17/03:

http://www.blackviper.com/WIN2K/win2k.htm
Specific link: Services Configuration

DEFAULT Pro ~ this is what runs by default on Windows 2000 Professional.

"SAFE" Configuration ~ this is the configuration that 95% of the people will be able to use with little or no side effects. It will also minimizes the amount of "errors" that is reported in the Event Viewer. This does NOT guarantee it will work for you, but if this scares you, this configuration would be a good starting point. Note: This is not for Windows 2000 Server in a corporate environment. Every network is different. Only you can decide what you need.

Internet Gateway Configuration ~ setup to allow multiple computers on a network to share one access point using Microsoft's "Internet Connection Sharing" software. If you do not have this type of setup, compare the differences between "SAFE" and "GAMING" to find a middle ground that works for your system. Other software or hardware type firewall and gateway software may require a slightly different configuration.

Gaming Configuration ~ this is the power user setup. This setup is a system that connects through a network (such as a gateway /router) to the internet, provides file and print sharing resources and gaming enjoyment. Some things MAY not function with this setup. No passwords save. Its use is not for a computer with analog modems or some DSL/cable connections. Try "Internet Gateway" Configuration first.

Super Tweak Configuration ~ this is the Super Geek setup. This setup is a system that connects through a network (such as a gateway / router) to the internet with a static IP address. This system does not provide file and print sharing resources, nor have the ability to print. Its use is not for a computer with analog modems or many DSL/cable connections. You can use this configuration for extreme tweaking and testing purposes. Many things MAY not function with this setup. No passwords save. The Event Log may display "errors" of not being able to start certain services. Please do not ask, "How do I fix" questions while using this configuration. The answer will be "Use SAFE." This information's intention is for reference only.

Found these seemingly relevant sites, too:

http://www.henrique.bucher.com/windows_services.htm , which pointed to MS's Glossary of Windows 2000 Services:

http://www.microsoft.com/windows2000/techinfo/howitworks/management/w2kservices.asp

Thin Clients and D-LIT
Oct. 27, 2003
../thin_clients/index.htm
Using 700 Clark Hall
Oct. 20, 2003
../700_Clark_Hall/index.htm
Windows: Find actual HD space used.
Oct. 20, 2003
Date: Mon, 20 Oct 2003 07:35:19 -0400
From: Colleen Gardner <crg29>
Subject: Tool for finding files on a hard drive

Here is a great tool I found to help see how much space is actually being used on your hard drive and where it is. I have had at least 2 machines which had been hacked and Windows reported (in one instance) 16GB being used on the c: drive. When I added up the size of each file on c: showed no more than 3 or 4GB. The program is very simple to use and has a great user interface.

http://www.jam-software.com/treesize/index.shtml

Colleen R. Gardner
Digital Library Information Technology
107C Olin Library
(607)255-2845

[n.b. The freeware non-Professional version (currently TreeSize V1.7) may be all you need.]

Microsoft Product Life Cycle Policies (Support and Availability)
July 2, 2003

Windows Desktop Product Life Cycle Support and Availability Policies for Businesses
http://www.microsoft.com/windows/lifecycle/desktop/business/default.mspx

Other topics available from the above link:

Windows Desktop Service Pack Road Map
Windows Operating System Components (e.g. IE)
Product Life-Cycle Frequently Asked Questions
Notes for Businesses
Windows Desktop Support Life-Cycle Wizard

"Top level" link, in case above links rot:
http://support.microsoft.com/lifecycle

Cleaning HP printers
May 9, 2003
Date: Fri, 09 May 2003 10:42:54 -0400
From: Amy Blumenthal
Subject: HP8100 in DBQE

Laurie, Gary, and I (aka The Three Stooges) spent an exciting 30 minutes attempting to clean the DBQE printer. We followed the directions on this page:
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=bpl05965&locale=en_US&taskId=125&prodSeriesId=25472&prodTypeId=18972
We cleaned some of the stray toner out of the toner cartridge cavity, and we did the printer cleaning page routine a few times.
The print jobs do look a lot better now, and I hope they'll continue to look nice. :-) There are other instructions to follow for specific problems - cleaning rollers, fusers, etc. - but we'll hold off on that until needed.

Amy

Norton Anti-Virus updates and permissions.
May 9, 2003
Date: Fri, 09 May 2003 01:05:17 -0400
From: Rick Lightbody
Subject: Norton silent LiveUpdate: problem and resolution

Today, thanks to Laura and Amy, I became aware that the NAV silent LiveUpdate shortcut in the Startup folder isn't doing anything on our standard cloned Win2K machines. Even though we'd tweaked the registry to allow a restricted user to manually do a LiveUpdate, the silent LiveUpdate at logon was continuing to fail because of permissions problems. (Dang!) So Amy, Joe and I began to research this. Laura had, apparently, already come up with a quick fix, but I wanted to try to understand exactly what was going on. So this evening I did some experimenting. Here's what I've concluded so far:

1) I confirmed that the registry hack we got from the Symantec site and have been running to allow a restricted user to do manual LiveUpdates also permits the scheduled LiveUpdates to run without a problem. (Whew!) That means the machines we've deployed that include this hack are in pretty good shape, since they're set to automatically LiveUpdate every day (usually in the afternoon). The only situation in which they're vulnerable is if they're left off for quite a while (as when someone goes on an extended vacation) and then exposed to a new virus before they've had a chance to do an automatic scheduled update.

2) Here's the best method I've found so far for making all three LiveUpdate modes work. (To review, the three modes are: 1-Scheduled, 2-Silent at logon, and 3-Manual)

Run the registry hack (EnableAllUsers.reg) provided by Symantec at:
http://service1.symantec.com/SUPPORT/ent-security.nsf/3d2a1f71c5a003348525680f006426be/c34ae5c5065b82c188256a2200272972?OpenDocument

Then add "authenticated users", with full control, to the permissions list for the following registry keys:
HKLM\Software\Symantec\InstalledApps
HKLM\Software\Symantec\LiveUpdate
HKLM\Software\Symantec\SharedDefs

(Some documentation I've seen also suggests opening up the permissions on
HKLM\Software\Intel\LANDESK\VirusProject6\CurrentVersion, but I don't like that one. If you do that, it allows a restricted user to change the configuration on their File System Realtime Protection and on their LiveUpdate schedule, and even to turn them both off. Since there's no reason someone with only a user account should need to do that, and it's a big risk if they do, it's a very good idea to keep these options unavailable.)

Also, the permissions need to be opened up on the following folders:
C:\Program Files\Common Files\Symantec Shared\VirusDefs
C:\Program Files\NAVNT (this isn't needed if Symantec AV v.8 is installed)
C:\Program Files\Symantec
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate

Also, for v.8 only, I thought it would be a low-risk precaution to open up permissions on the following folder as well, even though I didn't see this mentioned in any documentation:
C:\Program Files\Symantec_Client_Security

To open permissions on the above folders, I added "authenticated users" to each, with write and modifypermissions. (Full control didn't seem to be necessary.)

I chose to add "authenticated users" on the registry keys and folders, rather than adding permissions to "users", because 1) its more comprehensive without (as far as I know) increasing the risk, and 2) it makes it easier to see what's been manually manipulated (since "authenticated users" doesn't seem to get added by installers).

If anyone has additional insights into this stuff, please let us know. For now, at least, I think we've got a workable, if somewhat inelegant, fix.

- Rick

Injury prevention using a computer
5/8/03
Date: Thu, 08 May 2003 14:10:36 -0400
From: "TIPS, Cornell Library" <healthycul>
Subject: Workstation Self Assessment

Have you been feeling like something is not quite right at your computer workstation ? Are you feeling pain that you have not felt before ? If so, here are a couple of ways you can help yourself.

Do a workstation self assessment. Details on how to do this are available at the following web site: http://ergo.human.cornell.edu/cuergotipsintro.html

If you identify a problem, or need more information, here is a site that has 10 steps for a good ergonomic workstation arrangement. http://ergo.human.cornell.edu/ergoguide.html .

If you have taken a self assessment, and just can't seem to get comfortable, or are having pain, you can contact Charles Curry. Charles is a physical therapist, and coordinates the Musculoskeletal Injury Prevention Program here at Cornell. A native Missourian, he earned his master's degree in physical therapy at the University of Southern California and has worked in numerous locations nationwide prior to arrival at Cornell in September 1997.

Charles' services including individual or group training in injury prevention and work station assessment. These services are available to all Cornell employees as a benefit.

Contact Charles via electronic mail at clc34@cornell.edu

Mysterious "Security" folder
5/7/03
Date: Wed, 07 May 2003 15:58:46 -0400
From: Keene Silfer
Subject: my docs-->security

Rick just asked me a question.

He found a folder called "Security" in the My Documents folder of a computer he was working on. It has a "Database" folder in it filled with a few 0-size temp files.

Sounded strange, so I checked my computer and found I had it too.

I looked it up:

http://www.jsiinc.com/SUBE/tip2300/rh2376.htm

-- KEENE

Colts Supplement
4/30/03

Spreadsheet for tracking time card info. that Colts does not track:
Colts_Supplement_obh_200304.xls

Suggestions welcome. Please send to Oliver.

Renaming Net-Print names
4/29/03
Date: Tue, 29 Apr 2003 12:09:32 -0400
From: Rick Cochran
To: (Laura J Heisey)
Subject: Re: renaming a printer once it's installed

Laura J. Heisey wrote:
Hi all,
I've installed a couple net-printers and can't rename them from, for example, 'physci-lib1 on net-print.cit.cornell.edu' to 'PHYSCI Lib Net-Print 1'.
Is that possible? I used the Printing via SAMBA instructions at http://net-print.cit.cornell.edu/netprint-docs/wxpinstall.html . Should I switch to the Adobe systems driver installer?
Thanks.
Laura

Laura,

Good question! This has been bothering me for a long time. I found a procedure which seems to work, and documented it at http://net-print.cit.cornell.edu/netprint-docs/admin/ under "Operator Documentation" under "Advanced Installation Techniques". The direct link is http://net-print.cit.cornell.edu/netprint-docs/admin/advanced_installation.html.

Good luck!
-Rick

Public Computing Best Practices
3/14/03
Keene Silfer wrote up some of Desktop Services "best practices" procedures we've developed for public computers. Some of these ideas pertain to staff computers, too.

1. Disable Null BIOS sessions (so they can't get a list of the computer's user accounts and shares):

http://www.brown.edu/Facilities/CIS/CIRT/help/netbiosnull.html

Windows 2000
Go to --> Administrative Tools --> Local Security Settings --> Local Policies --> Security Options
Select "Additional restrictions of anonymous connections" in the Policy pane on the right
From the pull down menu labeled "Local policy setting", select
"No access without explicit anonymous permissions"
Click OK
Reboot to make the changes take effect.

2. Set up an account lockout policy (so they can't do a brute force guessing attack to crack your computer's account passwords):

http://security.duke.edu/securepc/acctlockout.html

I have mine set at 5 attempts and a 60 minute lockout duration.

3. Password all accounts and use -good- passwords (so they can't get in on an account with a blank or weak password):

http://www.security.duke.edu/password.html#3

http://news.com.com/2009-1001-916719.html

You can also use local security policies on the computer to enforce minimum password lengths and complexity.

CorporateSync for Palm log
2/18/03

Tip from Peter Hirtle: Find the log of CorporateSync activity on your desktop. Available in the Start Menu's CorporateSync directory. Explicitly, here is where the log appears on Oliver's computer:

C:\Documents and Settings\Administrator\Application Data\Steltor\CorporateSync for Palm\logs\EventLog.html

Finding CPU speed on W2K computer, without rebooting.
2/10/03

Date: Thu, 06 Feb 2003 10:46:24 -0500
From: Christina J. Bucko
Subject: finding out processor in Win 2K

Hi Oliver and Rick,

I remember you guys wondering how to find out the processor speed on computers. In Win 2K you can right click on My Computer and choose Manage. Expand System Information, then click on system summary. It tells a bunch of info about the system. Hope this helps you out.

Chris

Scanner feature comparisons.
2/5/03

Date: Wed, 05 Feb 2003 19:48:32 -0500
From: Rick Lightbody
Subject: Re: Fwd: Re: new scanner fyi

Chris, Oliver,
[...]
PS - Here's another useful website I came across. It allows you to search a database of scanner brands and models by desired features:

http://www.scanstore.com/Hardware/scanners.asp?ITEM_ID=3003

 


Return to: D-LIT | Library Web Sites | CUL


Cornell University Library, Ithaca, NY 14853-5301