Re: [NTSysADM] move hdd with windows 7 on it

2014-08-28 Thread Daniel Chenault
*shrug* I've done it many times says the guy who owned a shop and did this regularly as part of upgrades. Doesn't always work though, especially AMD-Intel (not relevant here). When it doesn't work a re-install is in order. To rebuild the HAL. It's usually the chipset; if the driver is for a

RE: [NTSysADM] move hdd with windows 7 on it

2014-08-28 Thread Gavin Wilby
I have always used Acronis for this kind of thing, allows clones between VERY different hardware. I once got a DL380 server with SBS 2008 on it to clone and boot off a laptop successfully. It was VERY slow, but there were no errors. Gavin Wilby IT Support Engineer -Original Message-

RE: [NTSysADM] move hdd with windows 7 on it

2014-08-28 Thread James Button
Sorry for the repost of what others said - Don't you just love it when the ISP ships some of the overnight messages, waits a while and then ships them again + the rest of the messages. JimB From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On Behalf Of James

RE: [NTSysADM] move hdd with windows 7 on it

2014-08-28 Thread Steven M. Caesare
Yeah... there were specific HAL's for some specific chipsets to, things like some Compaq's had their own.. as I think NCR did too. The UNI vs. MULTI HAL's was primarily a speed optimization for back in the day when SMP was still a rather exotic thing in the personal workstation space... it

RE: [NTSysADM] move hdd with windows 7 on it

2014-08-28 Thread Steven M. Caesare
To rebuild the HAL. What? The HAL is not built by a user. It's a specific hardware-dependent file. What's more, it has nothing to do with the rest of the drivers in a system. While the shotgun approach of nuking _EVERY_ driver in the system might solve the _SPECIFIC_ issue of this being a boot

[NTSysADM] Password reset for lists.myitforum.com?

2014-08-28 Thread Maglinger, Paul
 I am trying to look back on past posts on an issue I'm having again. Apparently I've forgotten my password to log into lists.myitforum.com. There is no reset password option. Clicking on Help tells me to Contact your hosting company or email administrator to have your password changed.

RE: [NTSysADM] move hdd with windows 7 on it

2014-08-28 Thread Jeff Jackson
I expect this is a dissimilar disc controller issue and you don't have the right drivers to boot on the new computer. How I've gotten around this in the past is to use a PCI or PCIe controller installed in the old machine, boot up and get its drivers installed, then move the controller over to new

RE: [NTSysADM] Password reset for lists.myitforum.com?

2014-08-28 Thread Rod Trent
There is no password for the lists and no logon option. What are you looking for? -Original Message- From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On Behalf Of Maglinger, Paul Sent: Thursday, August 28, 2014 9:45 AM To: New NT System Admin List

[NTSysADM] Printer managment

2014-08-28 Thread Gavin Wilby
Hi All, I need a bit of software that I simply cannot find - there must be something however. I need to be able to point something at any PC on my domain and see what printers it has installed on it. This should include Network printers, local printers and PDF writers etc. Id like the

RE: [NTSysADM] move hdd with windows 7 on it

2014-08-28 Thread Dave Lum
Can a backup-restore accomplish effectively the same thing? From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On Behalf Of John C Owen Sent: Wednesday, August 27, 2014 8:08 PM To: ntsysadm@lists.myitforum.com Subject: RE: [NTSysADM] move hdd with windows 7 on it

Re: [NTSysADM] Printer managment

2014-08-28 Thread kz20fl
PowerShell? Although if you don't want to script it, it's probably not what you're after Didn't DameWare used to enumerate stuff like printers and installed software? Despatched via Blackberry. Mock if you will, but it gets my email without a fuss. -Original Message- From: Gavin

RE: [NTSysADM] Password reset for lists.myitforum.com?

2014-08-28 Thread Maglinger, Paul
I had an Exchange issue less than 2 months ago regarding mailboxes that continue to appear in the Outlook client even after you removed Full Access permissions using the EMC. I'm trying to find the thread for that conversation. -Original Message- From: listsad...@lists.myitforum.com

RE: [NTSysADM] move hdd with windows 7 on it

2014-08-28 Thread James Button
The situation is probably that the setup on the original drive is for the original system’s motherboard and interfaces etc – They will have been selected according to the hardware found when the initial OS install was done. When you copy that to a new drive nothing in the setup changes so that

RE: [NTSysADM] Printer managment

2014-08-28 Thread Gavin Wilby
Dameware I thought would be the winner, but it only lists local printers, not networked ones. Gavin Wilby IT Support Engineer From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On Behalf Of kz2...@googlemail.com Sent: 28 August 2014 15:42 To:

RE: [NTSysADM] Password reset for lists.myitforum.com?

2014-08-28 Thread John Cook
That was mine. Delete the profile is the only way I found to cure it if it persists. John W. Cook Director of Network Operations Partnership for Strong Families Maglinger, Paul pmaglin...@scvl.com wrote: I had an Exchange issue less than 2 months ago regarding mailboxes that continue to

RE: [NTSysADM] Password reset for lists.myitforum.com?

2014-08-28 Thread Randal, Phil
The curse of automapped mailboxes... http://technet.microsoft.com/en-gb/library/hh529943%28v=exchg.141%29.aspx Cheers, Phil -Original Message- From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On Behalf Of Maglinger, Paul Sent: 28 August 2014 16:18 To:

RE: [NTSysADM] Printer managment

2014-08-28 Thread Melvin Backus
The REG command will give you that info. reg query HKCU\Software\Microsoft\Windows NT\CurrentVersion\Devices -- There are 10 kinds of people in the world... those who understand binary and those who don't. From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On

RE: [NTSysADM] Password reset for lists.myitforum.com?

2014-08-28 Thread Maglinger, Paul
That's it. Thanks! I still would like to know how to view archives of the list. Anyone? -Original Message- From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On Behalf Of Randal, Phil Sent: Thursday, August 28, 2014 10:26 AM To: ntsysadm@lists.myitforum.com

RE: [NTSysADM] Password reset for lists.myitforum.com?

2014-08-28 Thread Rod Trent
Archives are stored here: http://www.mail-archive.com/ntsysadm@lists.myitforum.com/ -Original Message- From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On Behalf Of Maglinger, Paul Sent: Thursday, August 28, 2014 11:18 AM To: 'ntsysadm@lists.myitforum.com'

Re: [NTSysADM] Password reset for lists.myitforum.com?

2014-08-28 Thread Ben Scott
On Thu, Aug 28, 2014 at 9:44 AM, Maglinger, Paul pmaglin...@scvl.com wrote: I am trying to look back on past posts on an issue I'm having again. This list is archived at: http://www.mail-archive.com/ntsysadm@lists.myitforum.com/ I've have the best luck searching it by Googling for

Re: [NTSysADM] Printer managment

2014-08-28 Thread Ben Scott
On Thu, Aug 28, 2014 at 10:31 AM, Gavin Wilby gavin.wi...@smppartners.com wrote: I need to be able to point something at any PC on my domain and see what printers it has installed on it. You don't describe your environment, but any Windows that's reasonably recent will have useful tools in

RE: [NTSysADM] move hdd with windows 7 on it

2014-08-28 Thread Dave Lum
I would kind of hope the backup would be on the entire drive including programs, etc. so it should restore to pretty close to original…otherwise a full backup isn’t very helpful J. From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On Behalf Of James Button Sent:

[NTSysADM] RE: move hdd with windows 7 on it

2014-08-28 Thread Jim Mediger
Another tid-bit in case you haven't resolved this yet. In the bios there is a setting for SATA relating to hdd's Change it from ACHI to IDE (sorry don't recall exact wording and is different with each bios). I swap hardware all the time, usually dual core to i5 quad core, very few issues with

RE: [NTSysADM] Printer managment

2014-08-28 Thread Gavin Wilby
Hi, Normally Id be using GPP all the way, but the issue I have (that’s not of my making) is: We have two print servers. One is a 2003 server, one a 2012. The 2003 is being retired the 2012 is to take over its role. All printers in the building, which is about 100 odd, across 7 floors and

Re: [NTSysADM] move hdd with windows 7 on it

2014-08-28 Thread Ben Scott
On Thu, Aug 28, 2014 at 12:09 PM, Dave Lum li...@theitgarage.com wrote: I would kind of hope the backup would be on the entire drive including programs, etc. so it should restore to pretty close to original…otherwise a full backup isn’t very helpful J. It depends... A pure system image

Re: [NTSysADM] move hdd with windows 7 on it

2014-08-28 Thread Ben Scott
On Thu, Aug 28, 2014 at 9:14 AM, Steven M. Caesare scaes...@caesare.com wrote: While the shotgun approach of nuking _EVERY_ driver in the system might solve the _SPECIFIC_ issue of this being a boot device access issue ... Since this has come up twice now... What you see in Device Manager

Re: [NTSysADM] Printer managment

2014-08-28 Thread Ben Scott
On Thu, Aug 28, 2014 at 12:20 PM, Gavin Wilby gavin.wi...@smppartners.com wrote: We have two print servers. One is a 2003 server, one a 2012. For this problem, the version of the print server isn't as relevant as what the print clients are running. If they're all running Vista/2008 or later,

RE: [NTSysADM] Printer managment

2014-08-28 Thread Kuhlman, Donald
Gavin, I don't know if this will help you but we did some testing with this on Windows 7, Windows 8 and it worked. This is an old program by Foxware Design called PrintMig (not the MS version) It will switch an existing user's printer(s) from one server to another and it can use another name.

RE: [NTSysADM] move hdd with windows 7 on it

2014-08-28 Thread James Button
Jimmy, Can you let the forum know what the motherboards and BIOS's are on the 2 systems, as well as giving details of the drives and partitions (type, size, position etc.,) Also - specifically what is the version of windows on that/them - assuming it is Retail, and thus can be transferred onto

RE: [NTSysADM] RE: move hdd with windows 7 on it

2014-08-28 Thread Daniel Chenault
Details, details... hal.dll exists on the installation media. ntoskrnl.exe is built at install-time and is used by hal.dll to handle hardware. Re-installing rebuilds ntoskrnl.exe, not hal.dll. So my wording was wrong but the end result is the same. From: listsad...@lists.myitforum.com

RE: [NTSysADM] move hdd with windows 7 on it

2014-08-28 Thread Steven M. Caesare
This is true... and back in the good ol' days of NT , the Control Panel was for Services Devices... but that was before PnP. The Dev Mgr enumerates the device objects, but allows you to get at (some of) the drivers associated with them. -sc -Original Message- From:

RE: [NTSysADM] RE: move hdd with windows 7 on it

2014-08-28 Thread Steven M. Caesare
What? Ntoskrnl.exe is built and compiled at MS. It's on the install media (it can be compressed). No files are built at install time. And it's the reverse. NTOSKRNL.EXE is largely the executive of NT and it relies upon the HAL to abstract the hardware. Again, no .exe, .dll., ,sys,

Re: [NTSysADM] RE: move hdd with windows 7 on it

2014-08-28 Thread Ben Scott
On Thu, Aug 28, 2014 at 12:49 PM, Daniel Chenault dani...@hotmail.com wrote: hal.dll exists on the installation media. ntoskrnl.exe is built at install-time and is used by hal.dll to handle hardware. Re-installing rebuilds ntoskrnl.exe, not hal.dll. I believe you are incorrect. There are

[NTSysADM] RE: move hdd with windows 7 on it

2014-08-28 Thread Jimmy Tran
I did check and both are IDE. The owner got frustrated and just decided to take the larger, cloned HDD in the original PC. No longer need to make it work on a quad core till he bitches and moans again. From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On Behalf Of

RE: [NTSysADM] RE: move hdd with windows 7 on it

2014-08-28 Thread James Button
Jimmy, Am I correct in assuming by IDE you mean PATA IDE rather than SATA IDE As in both types of drive are IDE as they come with 'Integrated Drive Electronics' - the bit (board) that goes between the cable and the inside of the drive - motors etc. If so, then have you only got the 1

RE: [NTSysADM] RE: move hdd with windows 7 on it

2014-08-28 Thread Jimmy Tran
I meant IDE/compatibility mode for SATA. No PATA on the motherboard. Bios is set to boot the sata port the drive is connected to. Source machine is a dell optiplex 755 desktop model and replacement machine is an HP Elite 8300 SFF. Again nothing to do here anymore, they are back with their old

[NTSysADM] deny logon locally

2014-08-28 Thread Christopher Bodnar
Wanted to hear some of your thoughts on this: Going to have a subset of users in our AD environment that don't need to logon locally (they access web based portals and applications, Office 365, some other SaaS apps). The risk compliance group is worried about how we ensure these guys cant'

[NTSysADM] Remote full computer backup to cloud

2014-08-28 Thread Art DeKneef
Have a new client that wants to backup 15 computers, possibly to the cloud. The cloud seems to be his preference right now. 7 computers are in an office with the other 8 being laptops that rarely come into the office. There is no server (Yeah I know), mix of Windows 7 Home and Pro, Windows 8 and

Re: [NTSysADM] Remote full computer backup to cloud

2014-08-28 Thread Susan Bradley
Does he have any idea how long a full backup to a cloud backup provider takes? I'll bet he doesn't have fiber and has various speeds of connectivity. It takes me weeks to dribble up a large backup. On 8/28/2014 12:57 PM, Art DeKneef wrote: Have a new client that wants to backup 15 computers,

RE: [NTSysADM] RE: move hdd with windows 7 on it

2014-08-28 Thread James Button
Thanks for that - an example of why I whinge about the use of IDE to mean PATA rather than SATA. From Google - that would be a 657094-001 656933-001 chipset Q77 LGA1155 BTX motherboard And that has EFI and UEFI Possibly RAID BIOS MBR save/protection So that's lots of

Re: [NTSysADM] Remote full computer backup to cloud

2014-08-28 Thread John Cook
Or how long a restore could take. .. John W. Cook Director of Network Operations Partnership for Strong Families Susan Bradley sbrad...@pacbell.net wrote: Does he have any idea how long a full backup to a cloud backup provider takes? I'll bet he doesn't have fiber and has various speeds of

Re: [NTSysADM] RE: move hdd with windows 7 on it

2014-08-28 Thread Ben Scott
On Thu, Aug 28, 2014 at 4:07 PM, James Button jamesbut...@blueyonder.co.uk wrote: Thanks for that – an example of why I whinge about the use of IDE to mean PATA rather than SATA. pointless diversion Technically speaking, IDE was originally WDC/CDC/CPQ's name for the interface which was later

RE: [NTSysADM] Printer managment

2014-08-28 Thread Crawford, Scott
This is a little script I wrote that unmaps printers on one server and remaps them on another server. To use it, you'll need to set the appropriate server name in the ReMap Sub and then create pairs of Case statements in the Process Sub, specifying what the old mapping looks like and the name

RE: [NTSysADM] Remote full computer backup to cloud

2014-08-28 Thread James Button
Pain #1 Scheduling backup to happen at appropriate intervals, but not when the user powers up the notebook to use it, and not when they do not have access to a fast link, and not when they do not have access to the designated cloud store Maybe logically split the hard drive into an OS

Re: [NTSysADM] Remote full computer backup to cloud

2014-08-28 Thread Susan Bradley
He will until the first time he needs to recover said machine and it takes a month to dribble the files back. What I would do is backup the local 7 to a local machine, dribble THAT to the cloud and on those laptops, bring them in the office for a good solid full backup and then merely do

Re: [NTSysADM] Remote full computer backup to cloud

2014-08-28 Thread Kramer, Jack
As horrible of an idea as this is…the provider best able to pull it off might be Evault. They can do full backups to cloud, and for restores they can ship you out a HDD with the data. They charge a premium though and you manage your own encryption keys (good for security, but don’t lose it or

RE: [NTSysADM] Remote full computer backup to cloud

2014-08-28 Thread James Button
Brings back memories of when I was asked to go and 'fix' a One-Per-Desk device that BT had supplied to the councillors at a local authority. The systems and phone links had been provided free by their 'Marketing' without any discussion with IT support. The device had 'locked-up' with a coms link

Re: [NTSysADM] Remote full computer backup to cloud

2014-08-28 Thread Andrew S. Baker
The client's desired plan is not going to meet their expectations. They're aiming for a full backup, and will utterly fail to even get a partial one. I cannot add anything extra to what has already been suggested. Perhaps the sheer volume of don't try this at home will be helpful in getting him

RE: [NTSysADM] Remote full computer backup to cloud

2014-08-28 Thread James Button
Further thoughts: Is this a corporate environment where much of the data is effectively pooled, or are you considering individual users having almost entirely separate data on individual PC’s If corporate, presumably the backups, and any restores will be done at the central corporate site,

RE: [NTSysADM] RE: move hdd with windows 7 on it

2014-08-28 Thread Michael B. Smith
TTBOMK there are, for current OSEs, only two NTOSKRNLs for x86/x64. One 32-bit and one 64-bit. There are a few for ARM, depending upon the form-factor and processor, but those are OEM-only. Today, even single physical socket processors tend to have 2/4/6/8 logical processors (cores). (I

RE: [NTSysADM] Remote full computer backup to cloud

2014-08-28 Thread Art DeKneef
I'll add Acronis to the list. Art DeKneef Avanti Computers Mesa, AZ 480-649-4430 Office 480-529-4430 Mobile -Original Message- From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On Behalf Of Susan Bradley Sent: Thursday, August 28, 2014 2:09 PM To:

RE: [NTSysADM] move hdd with windows 7 on it

2014-08-28 Thread Michael B. Smith
And sysinternals autoruns is aware of device drivers. You can easily disable them there (if you aren't comfortable with cmd.exe, PowerShell, or regedit). -Original Message- From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On Behalf Of Ben Scott Sent:

RE: [NTSysADM] RE: move hdd with windows 7 on it

2014-08-28 Thread James Button
Compare the $1000 desktop (yes - almost top-end off-the-shelf) with the power and cost of a 'large' IBM mainframe of 20 years ago - Allowing for 7% annual deflation of money value and that's well under $300 in 1990's money Now consider you can get almost that much power and storage in a laptop!

RE: [NTSysADM] Remote full computer backup to cloud

2014-08-28 Thread Art DeKneef
This is a small construction company. So picture no controls, policies, data spread all over between users, no formal backup of any kind except for the accounting PC, everyone a local admin, etc. You should get the picture. I’ve made some initial suggestions, backup being one of them, to help

RE: [NTSysADM] Remote full computer backup to cloud

2014-08-28 Thread James Button
I have a set of clients who ‘manage’ their own location and it’s needs While using a corporate facility for email, reporting and accounting/banking facilities. They get PC’s from their local store have the corporate IT facility staff install orifice, email and a local desktop view of the

Re: [NTSysADM] move hdd with windows 7 on it

2014-08-28 Thread Free, Bob
Microsoft's documentation on this is not as good as it could be When I wanted to learn and understand this stuff back in the NT days, I went straight to the Custer(Russinovich)(Solomon book). I have quite a stack of them now. The knowledge within is not available anywhere else in such a

RE: [NTSysADM] move hdd with windows 7 on it

2014-08-28 Thread Steven M. Caesare
Indeed. And Custer's original is what I'd consider required reading to really understand the subject. While the subsequent tomes by the follow on authors can stand on their own, the underlying concepts and design principles were best outlined in the original book and provide a lot of context

RE: [NTSysADM] move hdd with windows 7 on it

2014-08-28 Thread Michael B. Smith
+1 The Windows source code is astonishing. Especially the pieces of it that have significant age on them, like Service Controller. :) -Original Message- From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On Behalf Of Free, Bob Sent: Thursday, August 28, 2014

RE: [NTSysADM] move hdd with windows 7 on it

2014-08-28 Thread Steven M. Caesare
As are the docs from the original NT OS/2 design workbook :) -sc -Original Message- From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On Behalf Of Michael B. Smith Sent: Thursday, August 28, 2014 7:12 PM To: ntsysadm@lists.myitforum.com Subject: RE:

RE: [NTSysADM] move hdd with windows 7 on it

2014-08-28 Thread Free, Bob
Couldn't agree more. One of the most worthwhile technical books I've ever read.well actually studied. -Original Message- From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On Behalf Of Steven M. Caesare Sent: Thursday, August 28, 2014 4:06 PM To:

RE: [NTSysADM] move hdd with windows 7 on it

2014-08-28 Thread Steven M. Caesare
And Zachary Pascal's Showstopper captured the feel of the project in a way closest to Kidder's Soul of a New Machine that I've read. Not nearly as technical, but a great look at the team dynamic. The good ol' days when MS still acted like the young upstart. -sc PS- While we are talking

[NTSysADM] Diagnosing machine hangs in network layer?

2014-08-28 Thread Ben Scott
SUMMARY Some of our Windows 7 PCs are going into a partial machine hang condition (locked up/not responding/wedged/etc). It's intermittent, with no trigger or pattern I have been able to discern. Definitely a persistent, repeating problem, though. It seems to be related to the Microsoft

RE: [NTSysADM] Diagnosing machine hangs in network layer?

2014-08-28 Thread Steven M. Caesare
Whilst I mull this over, this may help you grab a dump of the hung process as it can trigger on an unresponsive window handle: http://technet.microsoft.com/en-us/sysinternals/dd996900 No chance these machines all have connections to the same switch? -sc -Original Message- From:

Re: [NTSysADM] move hdd with windows 7 on it

2014-08-28 Thread Ben Scott
On Thu, Aug 28, 2014 at 6:59 PM, Free, Bob r...@pge.com wrote: Microsoft's documentation on this is not as good as it could be When I wanted to learn and understand this stuff back in the NT days, I went straight to the Custer(Russinovich)(Solomon book). I have quite a stack of them now.

Re: [NTSysADM] Diagnosing machine hangs in network layer?

2014-08-28 Thread Ben Scott
On Thu, Aug 28, 2014 at 7:40 PM, Steven M. Caesare scaes...@caesare.com wrote: Whilst I mull this over, this may help you grab a dump of the hung process as it can trigger on an unresponsive window handle: http://technet.microsoft.com/en-us/sysinternals/dd996900 Hmmm. I'll give it a shot.

[NTSysADM] Re: Diagnosing machine hangs in network layer?

2014-08-28 Thread Ben Scott
On Thu, Aug 28, 2014 at 7:33 PM, Ben Scott mailvor...@gmail.com wrote: Some of our Windows 7 PCs are going into a partial machine hang condition P.S.: I should mention that the frequency, on my PC, seems to be in the neighborhood of once a week, or maybe once every couple of weeks. So it

RE: [NTSysADM] move hdd with windows 7 on it

2014-08-28 Thread Michael B. Smith
You just need to know a filesystems MVP. :) -Original Message- From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On Behalf Of Ben Scott Sent: Thursday, August 28, 2014 8:06 PM To: ntsysadm@lists.myitforum.com Subject: Re: [NTSysADM] move hdd with windows 7 on

Re: [NTSysADM] Diagnosing machine hangs in network layer?

2014-08-28 Thread Ben Scott
On Thu, Aug 28, 2014 at 7:40 PM, Steven M. Caesare scaes...@caesare.com wrote: Whilst I mull this over, this may help you grab a dump of the hung process as it can trigger on an unresponsive window handle: http://technet.microsoft.com/en-us/sysinternals/dd996900 It would appear ProcDump

RE: [NTSysADM] Diagnosing machine hangs in network layer?

2014-08-28 Thread Steven M. Caesare
Hmm, not that I know of... I didn't realize until your later post that this was a once a week kind of thing.. so that might indeed be a bit difficult to catch. -sc -Original Message- From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On Behalf Of Ben Scott

Re: [NTSysADM] Diagnosing machine hangs in network layer?

2014-08-28 Thread Daniel Chenault
My first step would be to scan my machine for malware. After that I'd get a known good machine on my network segment running WireShark, set as large a buffer as possible and let it run. When the fault occurs I've caught it and can examine from there. My hunch is someone picked up a nasty and

Re: [NTSysADM] Diagnosing machine hangs in network layer?

2014-08-28 Thread Kurt Buff
A long shot Can you set up a machine on the mirror/span port to which your machine is connected, and rung tcpdump/wireshark with a circular buffer? Doing this might help rule out nastiness coming across the wire, or perhaps pinpoint when the machine starts to become non-responsive. It's

Re: [NTSysADM] Diagnosing machine hangs in network layer?

2014-08-28 Thread Kurt Buff
Heh. Beat me to it by seconds... Kurt On Thu, Aug 28, 2014 at 5:40 PM, Daniel Chenault dani...@hotmail.com wrote: My first step would be to scan my machine for malware. After that I'd get a known good machine on my network segment running WireShark, set as large a buffer as possible and let

Re: [NTSysADM] Diagnosing machine hangs in network layer?

2014-08-28 Thread Daniel Chenault
NB: I'd use a Linux box running tcpdump in case it IS a Windows-specific attack. And no licensing issues. On Aug 28, 2014, at 17:43, Kurt Buff kurt.b...@gmail.com wrote: Heh. Beat me to it by seconds... Kurt On Thu, Aug 28, 2014 at 5:40 PM, Daniel Chenault dani...@hotmail.com wrote:

Re: [NTSysADM] Diagnosing machine hangs in network layer?

2014-08-28 Thread Ben Scott
On Thu, Aug 28, 2014 at 8:40 PM, Daniel Chenault dani...@hotmail.com wrote: My first step would be to scan my machine for malware. Everything here runs Trend OfficeScan real-time, and does a full scan once a week. Nobody runs with admin rights for day-to-day. Software Restriction Policies

Re: [NTSysADM] Diagnosing machine hangs in network layer?

2014-08-28 Thread Andrew S. Baker
If you want an instant kernel dump, kill the SMSS process... :) It might not get you what you need in terms of info, though, but it is worth one try on a different (victim) system. *ASB **http://XeeMe.com/AndrewBaker* http://xeeme.com/AndrewBaker *Providing Virtual CIO Services (IT

Re: [NTSysADM] Diagnosing machine hangs in network layer?

2014-08-28 Thread Ben Scott
On Thu, Aug 28, 2014 at 9:50 PM, Andrew S. Baker asbz...@gmail.com wrote: If you want an instant kernel dump, kill the SMSS process... :) OK, sure. How do I do that on a system which is non-responsive? :-) -- Ben

Re: [NTSysADM] Diagnosing machine hangs in network layer?

2014-08-28 Thread Andrew S. Baker
LOL I always keep a CMD window open for scenarios like this. (It only works about 40-50% of the time, but that's better than 0%.) I had an intermittent issue earlier this year that pretty much tortured me, despite a considerable amount of ProcMon analysis. It was only a single system, though,

Re: [NTSysADM] Password reset for lists.myitforum.com?

2014-08-28 Thread Maglinger, Paul
Perfect. Thanks! Sent from my iPad On Aug 28, 2014, at 10:43 AM, Rod Trent rodtr...@myitforum.com wrote: Archives are stored here: http://www.mail-archive.com/ntsysadm@lists.myitforum.com/ -Original Message- From: listsad...@lists.myitforum.com

Re: [NTSysADM] Password reset for lists.myitforum.com?

2014-08-28 Thread Maglinger, Paul
Thanks for the tip! Sent from my iPad On Aug 28, 2014, at 10:43 AM, Ben Scott mailvor...@gmail.com wrote: On Thu, Aug 28, 2014 at 9:44 AM, Maglinger, Paul pmaglin...@scvl.com wrote: I am trying to look back on past posts on an issue I'm having again. This list is archived at:

Re: [NTSysADM] Diagnosing machine hangs in network layer?

2014-08-28 Thread Ben Scott
On Thu, Aug 28, 2014 at 10:53 PM, Andrew S. Baker asbz...@gmail.com wrote: I always keep a CMD window open for scenarios like this. I usually do, too. I also usually have Process Explorer open. But I haven't been able to do much of anything useful with them when this particular failure mode

[NTSysADM] Re: Diagnosing machine hangs in network layer?

2014-08-28 Thread Ben Scott
On Thu, Aug 28, 2014 at 7:33 PM, Ben Scott mailvor...@gmail.com wrote: ... is there a way to force a bugcheck so I can get a kernel dump ...? I found CrashOnCtrlScroll which looks like it will do that much, at least. Tested on a non-hung system and it did indeed bluescreen.