Our Drones

We have a special room for them ...

Ah! J'understand!

Two cartoons :-

This explains debugging code which has been written with anti-debugging techniques:

http://hackerschool.org/DefconCTF/17/B300.html


This explains how to find a keygen (written in bizarre franglais)

http://pagesperso-orange.fr/l0uk0um/site/dora/fichiers/tutorial.html

Creating mixed-mode Exchange/IMAP users

We have a few managers here whose mail needs are a little complicated. They're available to the whole company via Outlook and Exchange for meeting scheduling, but they prefer to use Thunderbirdand IMAP for managing their mail.

(Of course, one can connect to Exchange via IMAP, but we haven't implemented this, purely for reasons of time resources. Back in the day, we started out with courier IMAP, and brought in Exchange a lot later. Smoothly migrating people to the Exchange server would require a lot of individual support hours, and given that the system is fine at the moment, the bang/buck ratio doesn't pan out.)

Here's how to set up a mixed-mode IMAP/Exchange mail user from complete scratch:

1. Mail Transport Agent - on your external IMAP mail server, create an IMAP box for john.doe@myorg.com
   
2. Mail Transport Agent - create an alias for the user, something like jdo -> john.doe@myorg.com
3. Exchange Server - in the EMC, create a new Mailbox under \Recipient Configuration\Mailbox for John Doe. This creates an AD object for John Doe, with Exchange Mailbox properties.
4. Still on Exchange, right-click \Recipient Configuration\Mail Contact, and choose "New Mail Contact", and radio on "New Contact".
5. Choose the correct Organisational Unit (if you forget this step, don't worry - you can move the Mail User in ADUC later).
6. In the "First Name" field, use the IMAP alias (in this example, "jdo").
7. In the "External e-mail address" field, use the IMAP alias email address (in this example, jdo@myorg.com).
8. Finish creating the contact.

Now we have two separate elements - the Mailbox associated with AD user John Doe, and the Mail Contact jdo.
The existence of the mailbox will allow the user to manage scheduling with Outlook, and to view Public Folders.
However the email must be redirected to the IMAP account. Here's how:

1. Using the EMC, \Recipient Configuration\Mailbox, open the properties sheet of the Mailbox.
2. Choose the Mail Flow Settings tab, and open the Properties of Delivery Options.
3. Tick the box "Forward To ...", then click on "Browse".
4. Tip! Sort by "Recipient Type" to see the Mail Contacts, and choose your newly-created contact from there.
5. Choose Ok, then Ok again to leave the Properties sheet.

Now you have a user who can be scheduled via Outlook, but who can use their preferred IMAP client to manage their email.

Administering someone else's Out Of Office reply

Finally, I have the answer to something that's bugged me for a very long time - how to adjust a user's Exchange-based out of office reply.

Normally, the only way to do this is to log in as the user either to their Outlook, or to OWA, then adjust their OOF settings via Tools, Out of Office Assistant. Since this requires that you know the user's password, it is not always a convenient method.

I thought that there might be some way to change things via the server, perhaps via PFDAVAdmin. None that I could find, sadly, existed.

So here's a kludge that gets you the result you want:

1. In ESM, use the Manage Full Permissions option on the user's Mailbox to give yourself full permissions on the user's account.
2. On your Windows machine, go to Control Panel, Mail, Profiles.
3. Add the user's name - when you fill in the New Account form, leave the password section blank and click Next. Because you have full permissions, you don't need a password.
4. Radio on "Ask for Profile"
   
5. Open Outlook, and choose the user's profile.
6. Fill out their OOF.
7. Quit Outlook, remove their profile from the Mail Control Panel applet.
8. On the server, remove your full permissions from their account.

A kludge because it's too easy to forget the very final step, leaving a security hole.

But it works!

Exchange 2007 Public Folder reporting

Probably the best free tool to report and manage on your Public Folder hierarchy is PFDAVAdmin, available from Microsoft. I've mentioned it before.

There are two main commercial tools available that can help - Ark's Admin Report Kit for Exchange Server, and Priasoft's Public Folder Analyzer. A fairly comprehensive list of Exchange Permissions Management tools can also be found on Slipstick.

Ok, down to the real-world scenario. At the moment, I'm creating a new user, and need to give them the same permissions on the Public Folders as a current employee. I can accomplish this in a variety of ways:

1. Use the context menu, Folder Permissions to view an individual folder's permissions, and to add a user.
2. Use the context menu on the containing folder to add a user, then use context-menu, Propagate Folder ACEs to push the same permissions down to the subfolders, for that user.
3. Use powershell for a single folder:
   Add-PublicFolderClientPermission -Identity "\Marketing\West Coast" -AccessRights PublishingEditor -User Kim
4. Use one of the included E2K7 powershell scripts under C:\Program Files\Microsoft\Exchange\Scripts to recursively apply permissions:
   AddUsersToPFRecursive.ps1 -TopPublicFolder "\Sales" -User "David" -Permission Reviewer
   

Which is fine if you know which folders to touch.
But what if you've come to an organisation with an extensive preexisting Public Folder hierarchy, and missed out on the chance to mind-meld with the previous sysadmin who built it from the ground up?

Obviously you'll need a report. We have a small Public Folder scenario, with 4500+ folders which contain more than 600,000 mail items. Using

Get-PublicFolderStatistics | ft FolderPath,*ItemCount,total*

returns the size of each and every public folder. (You can pipe it out with export-csv and chuck it in Excel.)

To find out which permissions a user has on a particular folder, use:

Get-PublicFolderClientPermission -Identity "\yourfoldernamehere" -User yourusernamehere

Awesome, that's almost what we need!

To get the same info recursively over the whole Public folder tree:

Get-PublicFolder "\" -recurse | Get-PublicFolderClientPermission -user yourusernamehere export-csv

Very useful!

Finding aliases on Exchange 2007

Problem: You have an alias address, and you need to find out to which Exchange 2007 mailbox this is mapped.

Solutions: Use the following powershell command to list all mailbox names and aliases:

get-mailbox | select name, alias | format-table name, alias

(which is OK if you have a small number of users, but not so useful for large orgs). You can also use the Find option whilst looking at the Recipient Configuration tree in the Exchange Management console.

Heike tells a story

One of Heike's sisters lives in a remote area in southern Spain. They recently got a modem connection to their house. Heike was Skyping with her nephew, and typed, "I have to go now, time to walk the dog and meet people for dinner." The nephew replied, "Where will you go for your walk?" "In Görlitzer park," replied Heike, "... why don't you come with me?" Nephew (10 y.o.) said "I will! I will come with you on google earth!"

So sweet!