Perfmon Edits

If you gather a lot of data in a perfmon log (which I do from time to time for troubleshooting purposes) you'll know that vertical bars are displayed on the screen when you view the data. Also, values in the thousands can be difficult to read without the comma separators. To change this behaviour, merge the following registry settings:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\SystemMonitor]
"DisplaySingleLogSampleValue"=dword:00000001
"DisplayThousandsSeparator"=dword:00000001

Happy perfmoning.

B

IIS May Break After Installing KB973917

I got called to look at an IIS Server first thing this morning. Websites were simply saying "Service Unavailable". Looking at the System log, I could see that IIS's Rapid-fail protection was kicking in i.e. five Source W3SVC Event ID 1009 warnings followed by one Source W3SVC Event ID 1002 error. Unsurprisingly, disabling Rapid-fail protection had no positive effect. The logs revealed that a number of patches were automatically installed at 3am, including 973917 which "implements Extended Protection for Authentication in Internet Information Services (IIS)". At the time of writing, 973917 is still at revision 1.0 with no reported known issues. However, I found this blog post on MSDN which points to this KB article (Internet Information Services 6.0 may not function correctly after installing KB973917) which describes the issue.

Moral of the story? In an ideal world, test before patching. In a less than ideal world, be sure you have a known good backup before you patch. And if you have to patch and be damned, I wish you the best of luck.

B

PS Test first or patch asap? Each to their own.

RDP to Console

Ok, so we know to use the /admin switch when running mstsc from the command line if we want to RDP to the console session, but I keep forgetting the RDP file entry to do the same thing, so I'm recording it here for posterity:

administrative session:i:1

B

W2k3 ICMP Types

For reference, here's the ICMP types on Windows 2003:

2 - Allow outbound packet too big.
3 - Allow outbound destination unreachable.
4 - Allow outbound source quench.
5 - Allow redirect.
8 - Allow inbound echo request.
9 - Allow inbound router request.
11 - Allow outbound time exceeded.
12 - Allow outbound parameter problem.
13 - Allow inbound timestamp request.
17 - Allow inbound mask request.
ALL - All types.

Enable ICMP Response on W2k3 Firewall

To enable ICMP response on a Windows 2003 firewall, use the following command:

netsh firewall set icmpsetting type = 8 mode = enable interface = "Local Area Connection"

Watch those spaces!

Select Passive Mode in Windows FTP Client

I always forget what the command is to change the Windows FTP client from Active to Passive mode, so for reference the command is:

LITERAL PASV

Happy FTPing!

Enable ICMP Response on W2k8 Firewall

The firewall on Windows Server 2008 is turned on by default and ICMP echoes are disabled. According to Microsoft you should be able to enable it using:

netsh advfirewall firewall add rule name=”ICMP Allow incoming V4 echo request” protocol=icmpv4:8,any dir=in action=allow

The result of this is "An invalid value was specified" which makes sense if you look at what netsh should be provided with. Rather than adding this custom rule, I had a look to see if there was a rule already there, but disabled. There is, but it's called "File and Printer Sharing (Echo Request - ICMPv4-In)" for some reason.

So, to enable it use:

netsh advfirewall firewall set rule name="File and Printer Sharing (Echo Request - ICMPv4-In)" new enable=yes

Happy pinging.