Another obscure Trustwave PCI scan fail - SBS 2011 fails CVE-2010-3332 / MS10-070, vulnerability in ASP.NET Could Allow Information Disclosure

After clearing up the SharePoint issues, there was just one remaining failure issue in the Trustwave PCI scan of an SBS 2011 server.

The fix turned out to be running the .NET Framework Cleanup Tool from Aaron Stebner at Microsoft, and removing .NET 1.0 and 1.1.

There's some more detailed discussion over at Technet

SharePoint 2010 on SBS 2011 failing Trustwave PCI scan (aka WSS_Search SPSearchDatabase Database is too old)

[ bonus points - that's got to be the biggest post title yet :-) ]

An SBS 2011 server, all patched up with the latest Microsoft Update fixes failed a Trustwave PCI security scan. When we looked at the detail most of the fail points were around SharePoint vulnerabilities.

Looking at the SharePoint Central Administration console, the Health Analyzer was throwing up warnings about out of date databases and upgrades required. they're no entirely straightforward because there's a difference between content databases and other databases.

With SharePoint updates you do need to run the upgrade tool sometimes after Microsoft Updates have been loaded, to get the database to upgrade too.

Start a Command Shell with administrative rights (or the SharePoint PowerShell) and run this command;
PSConfig.exe -cmd upgrade -inplace b2b -force -cmd applicationcontent -install -cmd installfeatures

That cleared all but one of the Health Analyzer warnings for us. The remaining one was the "WSS_Search SPSearchDatabase Database is too old" or more strictly, WSS_Search_servername. We had trouble tracking down that database GUID to issue a PS upgrade, as mentioned on the Technet forum.

Restarting services and rebooting didn't seem to clear either. The only info we could Google was the upgrade command above. In the end, having run the command repeatedly, the database upgraded and the warning cleared. It appeared to take 2-3 repeats of that command before WSS_Search was up to date.

Let you know about the PCI re-scan, I've just requested it ...

Sage Payroll keeps prompting with an older update

Sage Payroll 2014-15 v20

Every time we exit from Sage Payroll 2014-2015 tax year - version 20.02.203 - it prompts to install an older v20.01 update 1. Choose ok and nothing happens, or leave it (and nothing happens!) but you'll get prompted again for the update next time round.

Tried manually loading the update from a download - no luck - tried using Run as admin - no luck - tried editing the version number in the PayrollVersion.dat file - no luck.

So after 15 mins on hold to sage support, here's the trick ...

Look in C:\Programdata\sage\SBD Software Updates
and delete the files
   softwareupdates.dat
   SoftwareUpdateSettings.dat

Restart Sage Payroll and no more prompts, yaaay!

Can't Empty Deleted Items in Outlook, until synchronization with server is complete

Using Outlook with Microsoft Exchange. It looks like a damaged email in Outlook, stuck in the Deleted Items offline folder, which then fails to complete the Empty Deleted Items action. You get this error message:

"Outlook is synchronizing local changes made to items in this folder. You cannot remove this folder until the synchronization with the server is complete."

You can remove the problem item by right-clicking on the Deleted Items folder, then Properties, and choosing the Clear Offline Items button. Press F9 to run a sync

Adding mutiple DNS servers with "netsh int ip" batch command in Windows 8.1

I needed a CMD batch file to change DNS servers for some testing but couldn't find the correct syntax to add more than one DNS server, eg set a primary DNS and a secondary DNS.

The basic command (don't forget to use an elevated Run As Administrator command shell or batch file) is
   netsh int ip set dns "Ethernet connection" static 8.8.8.8

I'm sure on older versions of Windows you could specify multiple servers in one lines using a space or string or comma (or something like that) - maybe I made that up. I googled and tracked down an index option which let you specify a secondary dns server - but not in Windows 8.1 unfortunately. That option is no longer recognised.

Trick in the end was to use set for the primary and add for the secondary, eg.
   netsh int ip set dns "Ethernet connection" static 8.8.8.8 primary
   netsh int ip add dns "Ethernet connection" 8.8.4.4

HTH

Sapphire R9 270X corrupts screen, but only at 1680x1050 on Digimate

Bit of a strange one - and the workaround is even stranger.

Got a Windows 7 PC built around an Asus P5Q Pro motherboard with Intel Q6600 quad core - nice bit of kit, bit dated. It ran an AMD Radeon 4570 X2 (single-handedly responsible for a huge energy bill !) on a Digimate L2262WD. Max resolution 1680x1050. Always worked fine. Anyway the Radeon 4570 finally died.

So we replaced with a good value Sapphire R9 270X 2GB GDDR5 model. Easy install, latest drivers (14.3 then 14.4). However we noticed the screen corrupts, more so when the mouse moves. You kind of get flashing blocks, mostly across the top third of the screen. It only does this at 1680x1050. Lower resolution is ok and higher is too, interestingly. Running at 1920x1080 looks a little fuzzy from the scaling but doesn't corrupt - which is strange because it almost looks like a bandwidth/timing issue - and you'd expect it to be worse at higher resolution.

• Same problem with all connector types (HDMI, DVI, VGA) and different cables.
• Clean install of Windows on a spare PC with the 270X and Digimate monitor - same problem.
• Plugged into a 42" LG TV and all fine.
• Borrowed a Dell 20" monitor which has max 1680x1050, worked fine.
• Plugged a Radeon 5450 instead of 270X, all fine

So its something to do with the monitor and graphics card combo. This was where I spotted something strange - connecting a second monitor clears the problem up. Doesn't matter which monitor is main or which combination of cables and connectors you use, as long as there is a second monitor present, then the Digimate works perfectly at 1680x1050 off the 270X.

Sapphire still haven't got back to me with any useful suggestions, although I suspect its in their firmware somewhere. Current version is 015.042.000.001

Dell 725 inkjet printer driver setup for Windows 7, 8 and 8.1, 64-bit

Just upgraded a Dell Vostro laptop to Windows 8.1 and the Dell 725 inkjet printer stopped working. At first there were no errors, nothing appeared to happen, no jobs appeared in the print queue. Then it turned into a communications error and a recommendation to enable bidirectional communications - which was already set. Just check that you're on the correct USB port (Printer > Properties > Ports), it appeared incorrectly as COM1 at one point. The correct USB port did show the printer greyed out when disconnected or turned off and then coloured in when online - but still wouldn't print.

I had a lot of trouble tracking down the correct driver. Dell's support website no longer lists Win 7 64-bit for that printer model. However if you look at their full Dell 725 ftp listing, it does show a download ... its just doesn't work with all the spaces in the link. Manually downloading R146546.exe based on that link turns out to be the Japanese version - sigh!

Fortunately Silicon Guide's Dell 725 printer listing has the correct 64 bit Windows 7 / Vista driver, labelled as version G8, A01.

Once run, that should unzip to the c:\dell\drivers\R146546 directory and open a window listing the files. Right-click on setup.exe, click Properties > Compatibility and set to Windows Vista and Run As Admin. Now run the setup and it should proceed normally.

Only problem I came across was one PC where there were still some earlier drivers installed, causing a conflict with this version. Remove the Dell 725 printer from the Devices and Printers Control Panel. You also need to go into Print Server properties too, into Drivers. Click the Change Driver Settings to get admin access. Then remove the Dell 725 driver and package. Look in Control Panel > Programs and uninstall Dell 725 printer. Reboot and look in C:\Windows. Do a search for files starting DLC* and delete the ones you can. That should clear all the old stuff ok, follow the above instructions to install the correct driver. Good luck!

Access to 1and1 VPS on alternate port 8443 (also 4343) via ISA 2004 server, can't find isa_tpr.zip / isa_tpr.js

One of the hosted management tools is the 1&1 VPS login which uses SSL to port 8443 to login. At one client site they're still using an old ISA 2004 firewall and proxy, which blocks this login.

Adding a rule to allow traffic to 8443 doesn't fix this, you need to allow SSL over port 8443.

There's a good note on isaserver.org, which is probably the best source for this product, however it refers to a download for isa_tpr.js from isatools that is no longer available. After a few dead-ends I found the isa_tpr.zip download on Trend Micro's website. You need to set an SSL port of 4343 for their Worry-Free Business Security (WFBS) console too.

Run these lines in the command prompt of your ISA 2004 server
     cscript isa_tpr.js /add ssl8443 8443
     cscript isa_tpr.js /show

Then restart the Microsoft Firewall service to apply.

Photos from two cameras out of sequence because of time difference

I was taking photos on a school trip recently and got back to discover the two cameras I was using had different times set. So when you put all the photos in a directory and sort in time order, they're out of sequence.

I found a quick and easy fix (assuming you're happy to fire up a command prompt) with Matthias Wandel's jhead EXIF jpeg header manipulation tool

simple case of running the command

• jhead -ta+00:10 IMG*.jpg

to add 10 minutes to all the Canon images

and then

• jhead -ta-00:06 P*.jpg

to take 6 minutes off the Lumix images

Job done, back in sequence - its a powerful tool.
Will certainly be back to use that one again.

Its a fax from your dog Mr Dansworth ..

Quite possibly the funniest Far Side cartoon ever.
I start giggling with just the thought of it.