Remote Web Workplace ActiveX add-on missing

You've just connected to your Small Business Server (SBS) via the /remote site, looking for Remote Web Workplace and get a warning at the bottom of the browser that the add-on is disabled. When you click on the add-on list the Remote Desktop (RDP) control is missing.

Ramesh over at winhelponline has the answer, you need to delete this registry key:

HKCU\Software\Microsoft\Windows\Currentversion\Ext\Settings\{7584c670-2274-4efb-b00b-d6aaba6d3850}

Then close Internet Explorer and restart. Worked a treat for a client using an IdeaPad S10e with Win XP Home and IE8.

Ignorant BT HomeHub - stops talking to laptop 2200BG wireless

Its Easter weekend - you know when geeks everywhere get to sort out their parents and neighbours home IT. Then again being a geek means any excuse to play with some kit rather than sort the garden or the spring cleaning :-)

So one of the neighbour's laptops is no longer working on wireless, turns out it hasn't been for a while. It works ok with a cabled connection. However his son-in-law is staying and his laptop doesn't work either. Escalate the call! They're running on a v1 BT HomeHub. So tried restarting the router, changing channel, varying all the security settings through none/WEP/WPA, updating the wireless driver (Intel bult-in 2200BG) - no chance. Both start connecting but report a disconnect error. One of them also gets an occasional network is no longer available error on the list. One laptop had the Windows Wireless Zero Config utility, the other used Intel Pro Wireless utility - neither would work.

Just to make it a little more interesting the other wireless devices such as Nintendo DS Lite, DSi, Playstation and my BlackBerry Bold are all perfectly happy with the wireless. After much googling I track down a bunch of guys talking about a BT HomeHub problem with Intel Centrino 2200BG wireless. Both laptops at the house are Dell Inspiron 6000 with you guessed it 2200BG wireless. Bet my IBM ThinkPad would play up too if I'd had it with me.

So the HomeHub is running firmware 6.2.6E (log into your router at http://192.168.1.254 and check System or Status in bottom left) which is a suspect version according to what I found. Latest version is 6.2.6H which includes a 2200BG fix according to the changelog history. Woohoo, except its not an auto update and I couldn't find a manual download to sort this firmware at the time. BT have an automated portal that should carry out a scheduled update - didn't work for us, may be a Bank Holiday issue? The link if you want to try is http://pbteu.bt.motive.com/ElectiveFWUpgradePortal/

I left the guys calling BT, apparently it only took a 90 minute phone call - sounds like getting off lightly with BT ;-) The initial Indian call centre had no idea about firmware, eventually got a Swedish(?) support centre that understood perfectly, checked a couple of settings and did the update. Both laptops associated straight away and were online wirelessly.

So whilst I was subsequently poking around t'interweb, I found this link
http://www.btopenworld.com/broadband/adhoc_pages/hub_firmware.html
which looks like you might be able to run your own 6.2.6H update - sorry haven't had a router victim to test on yet.

Recover deleted Deleted Items from Outlook PST

Here's a really handy little program
http://www.gettingclever.com/2008/06/corrupting-your-outlook-pst-file.html

It forcibly corrupts an Outlook PST file. You then run the standard Microsoft SCANPST utility which you can find in c:\Program Files\Common Files\System\MAPI\1033 or if you're using Vista look in c:\program files\microsoft office\office12

Due to the corruption SCANPST treats any deleted emails it finds as lost and recovers them :-)

Email address distribution missing in public folders

Just setup an email address attached to an Exchange public folder. So incoming emails can be shared between several people but it also acts as a master list, that way you can see what has been actioned already.

You can also add the Send As permission in the Active Directory for that folder, so staff can change the email address that the message is sent from. You then need to enable the From field in the new message box. Also make sure the address is visible in the global address list and not hidden.

We noticed that incoming emails stored in the public folder didn't show the email distribution if anyone had been cc'd in. This was tracked down to the format being IPM.Post not IPM.Note. You can add a registry setting to force all new emails to store as Note, and therefore display the email distribution:

HKLM\SYSTEM\CurrentControlSet\Services\MSExchangeIS\servername\public-folder-id\
"Incoming defaults to IPM.Note"=dword:00000001

Restart the Exchange Info Store.

Antivirus XP 2008 and tdssserv.sys trojan / rootkit

Just had another encounter with this fiend - except this time it was too late to try and load Malwarebytes or AVG updates or Ad-Aware. They were all blocked, although internet access appeared ok for most sites. Trying to access AVG for example just bounced you back to a Google looking results page every time.

There's some good info over here and I was interested to see that the old Microsoft/Sysinternals Rootkit Revealer showed up the hidden components (the F-Secure Backlight rootkit eliminator showed up nothing). I booted off CD and manually removed them - the TDSSserv components were key. Was then able to start Windows and install Malwarebytes to clear up any loose ends.

It's getting rough out there.

Microsoft Update error 0x80244022

Just been on the Microsoft Update website (WindowsUpdate) and received error 0x80244022 from three different PCs. Just worked out that if you leave that error open on the screen and go to File > New > Window and run the Update a second time it works ok :-)

Those pesky Update errors just keep coming.

Symantec EndPoint Protection 11 MR3 client fails to install on SBS2003

Just attempted to upgrade one of the Small Business Server 2003 Premium servers from Symantec Client Security (SCS) or was that Symantec AntiVirus (SAV), well v10.2 anyway. Old version System Center Console (SCC) came off ok, rebooted and the new Symantec EndPoint Manager (SEPM) went on without error. However the newly packaged client for the server - AntiVirus and AntiSpyware modules only - wouldn't install. It got most of the way there and then suddenly rolled back without an error. There was a simple error event id 11708 from msiinstaller, operation failed.

Sounded just like some problems discussed on Experts Exchange and the Symantec forums. There was a whole thread dedicated to people opening support cases and requesting EndPoint Cleanwipe. So I did the same and within 20 minutes had a copy off Symantec ftp. It didn't fix the problem but wasted a couple of hours trashing the SEPM install as well as the previous Mail Security for Exchange. So after reinstalling both I was back to square one. Twelve hours later, Symantec tech support popped up having gotten around to reading the install log. Turns out there was an old Alert Management Server installed. It wouldn't remove from Add/Remote Programs or via CleanWipe.

The Microsoft Windows Installer Cleanup tool went all Chuck Norris on it and saved the day. One reboot later and a successful client install :-)

Antivirus XP 2008 or 2009 virus/spyware removal

I've come across a few PCs in the past month with the Antivirus XP 2008 problem. Basically its some spyware that fakes your Security Centre to look like there's a problem and needs fixing. It looks very authentic. There's a very thorough write-up at The Register, Anatomy of a Hack.

Two of the infections I saw had got in past AVG. One had 7.5 Free and the other had v8 but slightly dated definitions - unlucky timing, I wouldn't hold it against the folks at AVG. My AVG 8 Pro spotted the .exe as soon as I copied it over to the PC.

I've heard of a couple of cases where people have had to put hours into extracting the bad and getting their PC back up and running - should have called Redleg tech support first ;-) Best fix I've come across has been the AntiMalware product from Malwarebytes. You can find it over here.

SEP, SBS and SIFMSMSE - they're tech not medical in case you were struggling

There was a time when I could remember what the Symantec antivirus acronyms were - life was simpler with SAVCE (Symantec Anti Virus Corporate Edition) and even SMSMSE (Symantec Mail Security for Microsoft Exchange). Now we've got SEP which doesn't remind you of an AV connection, worse still with the current version its SEP11 which just says its all coming crashing down. Then the latest Symantec Information Foundation Mail Security for Microsoft Exchange which just trips off the tongue, even the acronym SIFMSMSE is longer than most competitors' product names.

Anyway to the point. I've had an SBS2003R2 server running SEP 11.0 MR2 (I'm not even going to go there with the rest of the acronyms, but it was pre MP too) and SIFMSMSE 6.0.6 generating daily warnings in the Event Viewer which were making it into the SBS 6am daily monitoring report. The daily report didn't actually show much other than the source was Symantec AntiVirus. Taking a look in the Event Viewer shows Event ID 45 and screams SYMANTEC TAMPER PROTECTION ALERT. Turns out its Symantec's own product, the SIFMSMSE server which happily lives in the old SMSMSE directory.

Long story short, you can tell the antivirus to stop worrying about Symantec playing with itself (yes there was probably a more popular blog title in that) by going into SEP Console > Policies > Centralized Exceptions > right-click on the policy and choose Edit. Click Centralized Exceptions and add a Tamper Protection Exception for
[PROPGRAM FILES]
\Symantec\SMSMSE\6.0\Server\SAVFMSETask.exe
with an action of ignore.

All quiet on the front now.

PS I do like Symantec products - one of the few - always worked well for me, although the complexity and management from an SBS point of view seems to be increasing significantly. Reminds me of the old MacAfee which just got too complex to manage quickly and easily for a small business - haven't touched that since.

Allocated Memory - please sir, can I have some more

More! Couple of SBS2003 servers have spells of hitting me with daily allocated memory alerts, i.e. the warning threshold has been tripped in the monitoring. Now you can simply push that threshold figure up in the Server Management console, look under Monitoring and Reporting. Then Change Alert Notifications > Performance Counters > Allocated Memory and edit the figure up from say 2147483648 to 2447483648, i.e. another 300MB ish to go at before it starts screaming.

But if you look closely in the Task Manager and find that there are large memory allocations (170MB+) for sqlserver instances, you can adjust their figures.

Details on changing the maximum memory for a SQL instance, e.g. for the SBS Monitoring or the ISA Firewall or the Update Services can be found in the SBS team blog on troubleshooting high memory use.

There are some suggested figures to use from Susan's blog on throttling. They worked fine for me - one server regained 550MB and another around 200MB, with no apparent performance hits. Looked to me like it might be more relevant to pre-R2 servers, but that may have been coincidence.