How to specify credentials to restart or shutdown a remote host with ‘net use’

I recently wanted to shutdown a server on my local network (notably a workgroup) using the Windows shutdown command but encountered an access denied error (or no feedback whatsoever).

I needed to use the administrator credentials of the remote server but shutdown.exe doesn’t accept credentials.

Using ‘net use’ to connect to the IPC$ share on remote host, you can set then call shutdown in that security context:

net use \\hostname\IPC$ mypassword /User:administrator

shutdown /r /t 60 /m \\hostname /f

In the net use command above, replace hostname with the name of your remote host (or maybe an IP address), replace mypassword with the password for the account you’re using, and replace administrator with the name of the local account on the remote host you wish to use (which presumably has the necessary rights to restart or shutdown the server).

In the shutdown command above, replace hostname with the name of your remote host, as per the net use command.

Note: Read the shutdown /? usage. The /r flag will restart the host; change /r to /s if you want to shutdown instead. Other parameters can also be specified. I also typically set the timeout (/t) flag to 0 (zero).

I call both commands back-to-back in a Windows Command Prompt, without running the console as Admin.

See below for a few more tips, links, and PowerShell alternatives.

If you’re used to operating as a domain user you may be asking why any of this is even necessary. It’s necessary in a workgroup context because the remote host has no idea who I am if I just tell it to shutdown from some other computer on the local IP network. It may be possible to an account on one host the necessary privileges on another host but I don’t know for certain and, in my limited experience, this can get hard and weird very quickly!

I used to run a domain controller on my small local network (just for fun) and all of my servers were members of a domain, which made security easy. I got rid of the DC as DHCP and other services were migrated to my internet router and to streamline things. In all regards, having one less server to manage, power, and so on is great. I’ll run a virtualised AD when I need to, e.g. for development purposes).

In addition to a media centre, I also still run a physical file server, primarily for backups. My basic process is to power on the file server once a week to backup the media centre, my laptop, etc and then shut it down again (so the kids don’t fiddle and to keep the noise down).

The backup process is otherwise seamless—the backup services on the file server and clients just pick up where they left off and run to completion without any human interaction (I use CrashPlan and would highly recommend it). I only need to power on the file server and then shut it down.

To shut down, I’d previously connect to the file server via Remote Desktop and then shut down. But that’s too hard. I can tell from the backup client on my laptop when a backup is complete so I just want to quickly shutdown the file server and go to bed.

In a domain environment, I could make sure my domain account was a member of the Administrators group on the file server and then call shutdown.exe from a command prompt on my laptop; without the DC, I need to explicitly provide shutdown.exe with the necessary credentials before actually calling shutdown.exe.

A few other notes: the file server is running Windows Server 2012 and my laptop is running Windows 8.1.

In recent versions of Windows (i.e. 2012+), I’ve read that UAC may interfere with things. You may want to turn it off but can simply add or configure this registry key (I didn’t have to):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Value: LocalAccountTokenFilterPolicy
Data: 1 (to disable) or 0 (to enables filtering)
Type: REG_DWORD (32-bit)

You may need to restart after making this change.

Thank to https://helgeklein.com/blog/2011/08/access-denied-trying-to-connect-to-administrative-shares-on-windows-7/ for this one. See also this Microsoft help article (ID 951016) “Description of User Account Control and remote restrictions in Windows Vista”

Others suggested File and Printer sharing must be allowed in the Windows Firewall.

I believe PowerShell offers similar restart (and stop) commands. I haven’t tried them and can’t say whether they work with the techniques described here but I believe both accept a –credential parameter.

See these references:

https://msdn.microsoft.com/en-us/powershell/reference/5.1/microsoft.powershell.management/restart-computer

https://msdn.microsoft.com/en-us/powershell/reference/5.1/microsoft.powershell.management/stop-computer

Enabling Windows File History (aka Shadow Copy on Win 8) without an external drive or network drive

After being hit by a crypto/ransomware trojan, I’m looking at all options to make file management and backups easier and automatic. Shadow Copy is mentioned frequently in relation to the crypto locker virus (…in that the virus typically deletes shadow copies…) so I thought I’d look into this Windows feature. I’ve been after a version history, of sorts, for regular file content for a while so this sort of helps.

In Windows 8, Shadow Copy was renamed File History and is switched off by default. To switch it on, you need an external drive or a network location but that’s lame so I sought a workaround to test the waters and get up and running on an internal drive.

This blog post details the steps to set this up, which basically entails creating a virtual drive in Windows Disk Management, initialising it and creating a simple volume, and then pointing File History (via Control Panel) to that VHD.

This is by no means a bulletproof solution and I noticed the crypto virus that attacked my machine also encrypted my virtual machines so this .vhd would not be immune. But it’s about defence in depth, I suppose.

Although I gave the VHD solution a spin, it’s not for everyone and, most importantly, they’re not attached automatically when you reboot (without a startup script, that is). Instead of the VHD approach, I created a new folder to contain my file history, shared it (granting Read and Change share permissions to my Windows account), and then pointed File History the share via \\127.0.0.1\FileHistory [or whatever you name your share].

Update (a few days on): well that didn’t last. File History very quickly consumed all available free space on my internal laptop drive (a second partition). So I’ve turned it off and am using CrashPlan instead (despite the Java dependency—grrrr) as there was no interface to configure how much storage it uses. File History seems to be yet another one of those inane Windows features that is absolutely useless in real life.

How to configure Hyper-V to use a wireless connection in Windows 8.1

I haven’t used Hyper-V for a while but when I recently built a Windows 8.1 test bed VM I needed a virtualisation platform  and Hyper-V was more or less ready to go within my Windows 8.1 host laptop.

The only hiccup I encountered along the way—and one I was familiar with from my days running Windows Server 2008 on my laptop simply so I could run Hyper-V—was configuring Hyper-V to make use of my laptop’s wireless connection. This time I followed Rick Gipson’s excellent post to get everything working  and I summarise/condense his steps here in the interest of preservation and to document a few notes relevant to my Win 8.1 environment. Check out Rick’s post for screenshots.

1. Create a new Internal virtual network switch named Virtual WLAN from the Virtual Switch Manager in Hyper-V Manager. A new Unidentified Network connected to vEthernet (External WLAN) will now be visible within the host OS’ Network and Sharing Center. Note I renamed this connection to vEthernet (External WiFi) in Windows to reinforce its relationship to the wireless adapter and differentiated it from the Hyper-V object.
2. In Hyper-V Manager, configure the target VM’s network adapter to use the newly-created virtual switch (i.e. Virtual WLAN). Note Rick suggested the need to add a new Legacy Network Adapter but I found this was unnecessary.
3. In the host OS’ Network and Sharing Center, share the host’s physical WiFi adapter by checking the Allow other network users to connect through this computer’s internet connection box and specifying the Home networking connection as vEthernet (External WiFi). Note Rick’s screenshots show the Home networking connection field as a drop-down list but my current configuration displays as a text field. The WiFi adapter should now be listed as Shared in the host OS’ adapter settings.
4. Start up your guest VM when you’re connected to a wireless and enjoy network connectivity including internet access.

If you found this post helpful, please support my advertisers.

Windows Server 2003 x64 on Hyper-V Driver Issues

Installing the 64-bit version of Windows Server 2003 requires service pack 2 and installation of the Hyper-V Integration Services.

Before upgrading RTM and installing the integration services, one of guys was having a bear of a time getting the network  card to appear in the guest.

If you found this post helpful, please support my advertisers.

My Network Places in Windows Server 2008

Where has My Network Places gone in Windows Server 2008? I'm not quite sure but you can add a new network place by right-clicking on Computer in Windows Explorer and selecting Add a Network Location from the context menu. For example, connect to a picture library in a SharePoint content database using this address: http://my_site:30000/Lists/MyPicturesList

After stepping through the wizard, the network location will appear alongside your other mapped drives, etc.

Dirty Words (Michael Hanes) - blog.mediawhole.com mailto:info@mediawole.com

 

DHCP-assigned IP address and DNS host name clash - duh

Mental note #1: if using host headers with MOSS (or IIS) ensure the web server is configured with a static IP address or the NIC’s MAC address is reserved within DHCP.

Mental note #2: Just because it’s SharePoint, don’t forget the easy things! No, really!!!

I came across an unusual problem today after a MOSS server was imaged and restored to a new physical blade: Central Admin, the default SSP web app, and a specially-created sanity check web app were all working beautifully but the single site configured with a host header refused to load.

In addition, the Application event log was full of errors suggesting a database server connectivity issue:

The start address http://site.com cannot be crawled. The item could not be crawled because the crawler could not connect to the repository.

The database connection wasn’t the problem but nevertheless, SharePoint couldn’t find what it was looking for. The WFE’s NIC changed as part of the migration, which meant a new MAC address, and therefore a new DHCP lease for a different IP address that DNS knew nothing about.

Presenting at the next SharePoint User Group Presentation

Just a reminder I’ll be delivering part two of my two-part presentation on how we do web content management on MOSS 2007 this Tuesday at 12:30pm. We had a great turnout for the first presentation so it will be interesting to see who comes back!! Honestly, it’s amazing how many of you SharePoint/MOSS guys I’ve met through the first presentation and I’m really looking forward to bumping into a few more of you—please come up and say hello!

The blurb on the user group site is a straight copy of the part one blurb so here’s what I’ll be talking about tomorrow:

westernaustralia.com was one of the first public-facing MOSS 2007-based internet sites launched in Australia and is billed as the Western Australia Tourism Commission’s flagship web site. Two years on and thirty MCMS 2002-based tourism sites are now being migrated to the MOSS 2007 platform. In the second segment of this two part presentation, Michael Hanes, the Development Coordinator/Tech Lead at Tourism WA, talks about the backend MOSS environments. In this presentation Michael presents the existing and replacement hardware environments, virtualisation, environment structure, farm configuration, security, site collection structure and variations, performance, tooling, content delivery (Akamai), and content deployment.

Jeremy’s aiming to record the presentation again so, all being well, the part two webcast will be available after the event in case you’re unable to come along.

Here’s part one in case you missed it. See you down there for part two!!

[Update: a vodcast of the presentation is now available here with a PDF of the slides and notes here.]

[Update: the original PowerPoint deck is now available.]

Unable to display this Web Part error and Alternate Access Mappings

I ran into an unusual little problem this afternoon while playing with an unusual environment configuration. I say the environment configuration is unusual because the host that contains my Basic MOSS installation isn’t a domain member; that means no DNS and local security accounts—ick. The problem itself is actually quite common but my solution, given my environment setup, is a little unusual, at least for me.

Before diving in, a bit of background: I’m running an x86 Windows 2008 VM on a x64 Windows Hyper-V host machine. The VM has a normal Windows computer name, MOSS is installed in its basic configuration (SQLExpress, using local accounts), and there’s no domain controller or DNS server in sight. I’ve got a  simple web application created on port 30000 running as Network Service and extended into the Internet zone with anonymous access configured. A site collection was created before extending the web app and it’s using the Publishing Portal template. Everything is working fine across both sites within the VM.

The problem arose when I decided to run a quick sanity check and access both sites from another machine on the network. After allowing access to both ports in the Windows Firewall, I was able to browse most of the default page, although with no DNS in place and no hosts file entry, I naturally had to browse to the VM using it's IP address (eg. http://192.168.0.100:30000). I was surprised to get anything back, assuming SharePoint wouldn’t be happy with the IP address-based request. I say I was able to browse most of the page because the empty Press Releases content query web part was coming up with the ol’ favourite:

Unable to display this Web Part. To troubleshoot the problem, open this Web page in a Windows SharePoint Services-compatible HTML editor such as Microsoft Office SharePoint Designer. If the problem persists, contact your Web server administrator.

We normally get this very error at Tourism because deployment stuffs up file system permissions; to fix that we grant Authenticated Users Read & Execute permissions on the web.config file, the /bin directory, and everything in the /bin directory for the authenticated and anonymous sites. I tried that first and the problem went away for a minute and then came back as I reset IIS and fiddled with the firewall.

Weirdness. I don’t like weirdness.

Remembering my original surprise, I recalled I was accessing the sites using an IP address instead of the computer name and this ended up as the cause of the problem; an error event in the Application event log confirmed this:

Invalid URL: http://192.168.0.100:30000.  You may also need to update any alternate access mappings referring to http://MyComputerName:30000. 

To get things working, I dropped into Central Admin/Operations/Alternate Access Mappings and added a new internal URL for both zones:

http://192.168.0.100:30000

Et voila! Fixed!

Well nearly. This "fix" now prompts me to authenticate twice when browsing the authenticated site off the VM, once for the IP address and again for the host name. From that point my browser's address bar is also telling me I'm accessing the site via the host name. Not sure what magic the AAM setup is doing there but a minor niggle.

It’s worth noting this could also be resolved using a host file entry:

192.168.0.100 MyComputerName

And it’s also worth noting you’ll get this web part error for many other reasons—remember, my environment configuration today was unusual!!

Dirty Words (Michael Hanes) - blog.mediawhole.com mailto:info@mediawole.com 

 

Dynalink RTA1046VW DMZ Config Kills VoIP

While trying to speed up my P2P downloads yesterday I decided to configure a DMZ host in my Dynalink RTA1046VW router (on advice from a mid-2006 forum thread). My P2P ports were forwarded correctly, according to portforward.com, but I figured it would be worth the experiment.

As I'm now on a naked ADSL 2+ plan, I no longer have a traditional land line and all inbound and outbound calls are shunted across the internet; to facilitate this, my analog phone plugs directly into the back of my modem. My new ADSL account was live on Friday and I spoke with my sister in Canada successfully for an hour straight on Saturday morning. On Sunday I configured the DMZ host and from that point forward I noticed I could no longer hear anything in the phone's earpiece. The internet connection was otherwise fine, apart from a few dropouts every so often, but there was absolutely nothing coming out of the phone's earpiece; calls were otherwise going through (sporadically) but the caller could hear me fine. To top it all off I got home tonight and successfully replayed my phone messages. The problem was reproducible with another phone. Weird. 

The only thing left to do was remove the DMZ host configuration and behold--the tin cans work! I don't get it--I really don't know much about VoIP but my guess is VoIP runs over a port and the port was being forwarded by the router to the DMZ host... dunno, especially considering the default setting is to simply discard packets not belonging to an application configured in the port forwarding table. 

[Update: Silly me, of course VoIP runs over a port--the port I set when I configured VoIP in the first place, duh. Anyway, I still reckon it was being forarded the DMZ host but I've noticed the kitchen microwave interferes with the phone and produces a similar problem where, after successfully initiating a call, I can hear the person I'm speaking to but they can't hear me.

By the way, my P2P speed reached about 180KBps down--a dizzying new height for the likes of someone who had no internet before this point.]

---

Custom-Built Microsoft Office SharePoint Server 2007 Branded Sites and Webpart Development - info@mediawole.com

Windows 2008 Hyper-V

As I'm currently working for Diversus, a Microsoft partner, I was invited to attend the Heroes Happen {2008} event last Wednesday night. The invite promised a free copy of Windows 2008 (as well as Vista Ultimate with SP1--which ended up coming with a stinkin' 365-day license and a silly trial of Team Suite which I won't even waste my finger tips on--get real, Microsoft, and give us real stuff!) and knowing there would most likely be food and alcohol, I went along.

Despite Heroes supposedly being the simultaneous launch of Windows Server 2008, Visual Studio 2008 (which RTM'd late last year), and SQL Server 2008 (which isn't due to launch until Q3), the emphasis was squarely on Windows Server 2008 and Hyper-V. I've been using Microsoft's Virtual PC and Virtual Server tools for a few years now and after taking a close look at ESX Server lately, I was interested to see how Hyper-V would compete. I'm not a system admin or anything close but I reckon MS is headed in the right direction.

I wasn't sure the Heroes-supplied W2k8 disk would include Hyper-V; apparently Server will be sold with and without at a price difference of about $50. Why MS would do that is beyond me but I was pleased to see the Hyper-V check box listed in the Add Roles Wizard (Hyper-V is still in beta but the beta has been included with the Windows Server 2008 RTM build). The final Hyper-V release is supposed to be available on Windows Update around the same time SQL Server 2008 launches.

As a natural geek, I've got a handful of old PIII and PIV boxes lying around the place serving various roles within my home network. There's one box for AD/DNS/DHCP, another working as a dedicated file server, and others configured as web and database servers. By contrast, SharePoint being SharePoint, everything I do in relation to said software has been within a virtualised environment and it's been that way for a while now; I can provision new VPCs and backup existing VPCs as required. Having had success with Virtual PC and Virtual Server, I figure it's time to virtualise as many boxes as possible. I'm a Green at heart and running running multiple boxes in my small home office makes a hot Aussie day even hotter ;-)

The Heroes media included 32 and 64-bit editions of Server 2008 so I figured I'd go 64-bit just for fun. Apart from a few extra folders and Control Panel items referring to 32-bit, I haven't noticed a differece. The host box is only used as a server so I don't have weird hardware running and everything was detected automatically by the installer. Speaking of the installer, it's wonderful! Select your location and go. Not long after, the OS fires up and you do all the stuff you used to be promted for within the installer. I installed Hyper-V post-installation and everything went, um, fine... see below.

Apparently Hyper-V is supposed to be a "bare metal" (Type 1) hypervisor coming in at 650KB in size; I'm not entirely clear whether Hyper-V can be installed on a Windows Server Core base but at this point I'm still looking at Window and it's sitting right there between the metal and the virtualisation components. Apart from that, it seems like a pared-back version of Virtual Server: the admin screens are very simple and it just works.

I did have one issue after firing up the Hyper-V console for the first time: the Virtual Machine Management service wouldn't start and I had no idea why. Apart from a less-than-helpful UI error on attempting to start the service, the following event entry was logged:

The Virtual Machine Management service terminated with the following error:
The parameter is incorrect.

Luckily Ben Armstrong and Joe Hemmerlein from Microsoft were kind enough to weigh in on the discussion of this issue and pointed me in the right direction. As a I reside in Australia, I naturally selected English (Australia) as my location when I installed Windows but apparently that's not good enough for Hyper-V and it only likes the US. The link above goes through the configuration of your regional settings and language options to get the VMM service running without a Windows reinstall. I changed all my settings back to Oz after things started working but that's no good either: starting up the box today the VMM service failed again. This time I managed to get the service started without having to remove the role: I simply went through the necessary regional/language option config steps, applied to all accounts, and rebooted. I've since changed my account and the default account back to Aussie, leaving the System Accounts as they are. Long story short: this is really annonying and I hope Microsoft fixes this before launch.

After that rigamarole, I installed Windows Server 2008 in a VM, giving it 1GB of RAM (I've successfully installed 2003 on 128MB but Vista has made me wary). Performance at the UI hasn't been too zippy but this is a VM after all.

In the virtual world, I installed the AD role and it was a painless affair. I also turned off IPv6 because I don't know enough about it and those 128-bit hex addresses aren't going to give me much on a home network. DHCP was next and it too was uneventful. As mentioned previously, I'm not a system admin or a network engineer or a network anything--I was suprised when I managed to install AD on Windows 2003 so easily a few years ago and I've noticed the process is that much easier in 2008.

And so the network build continues. I'll soon be whacking MOSS onto a 2008 box for the fun of it and I'll let you know how that goes!

Great Subnetting Tutorial

The link below provides superb, in-depth information about IP addresses and subnetting. All the basics are covered: the breakdown of IP address ranges by class, converting decimal IP addresses to binary, and so on but lesson 6 explains subnetting more clearly than I've ever seen it explained. The author also covers routing and communications and the diagrams make it all as clear as possible.

You have to register to view the article but even if you think you understand subnetting, it's worth it.

http://searchnetworking.techtarget.com/tip/0,289483,sid7_gci1016859,00.html