NiXC's I.T. Take-Away

Event id 1021 when phoning a UM extension redirected to voicemail

NiXC — Thu, 19 Aug 2010 14:02:21 +0000

We recently started trying to configure the UM role in Exchange 2007 and had to buy an AudioCodes IP gateway to translate traffic from our legacy PBX into SIP traffic for the Exchange server.
Very early on we ran into an issue where we if we diverted a phone to the Exchange UM pilot number (i.e. re-direct all calls to voicemail) then if we called that phone we would get rejected.

A lot of diagnostics and tracing later, we discovered that the calls were being rejected by the UM server, and it was throwing a 1021 warning in the Application log. The message reads:
The Unified Messaging server rejected an incoming call with the ID “@”. Reason: “The Unified Messaging server cannot find a valid UM hunt group for “” associated with UM IP gateway “”.”

So the UM server was trying to find a hunt group for the extension that we were calling, and was thinking there wasn’t one configured. We did however have a hunt group configured! We had deleted the default hunt group on the ip gateway, and configured a new one with the pilot number as the pilot identifier…big mistake…

It turned out that when you configure a hunt group in UM, if you give it any Pilot Identifier number at all, that is the only number that it will be triggered for. So what you have to do is give it a blank Pilot Identifier! Trouble is you can’t do that, when you make a new hunt group the dialog will not let you create it without typing something in. So what do you do?

Well the answer is, delete and recreate the IP Gateway configuration object in the UM IP Gateways tab of the UM Organization Configuration section. That’s all you have to do! What happens is that when you create a new IP Gateway object it automatically creates a default hunt group with a blank pilot number – and that’s what we want.

Once you’ve done that you’ll be able to call the redirected phone and leave voicemail. Phew. Working UM system!

Lesson learned today: don’t configure things in UM if you don’t know what they’re for…

Migration to WordPress complete!

NiXC — Thu, 12 Aug 2010 21:09:03 +0000

This week I decided to move this blog over to WordPress. For the last few years it’s been on Blogger and I’ve never really had cause to complain. However now that I know the power and flexibility of WordPress I’m ashamed that I kept it on Blogger for as long as I did!

I have tried to make sure all the old links still work so referrals from Google keep working, but if anyone discovers something missing or has any problems with the new site, please comment here and let me know.

Here’s looking forward to many more years of WordPressing!

Get your own IPv6 address range

NiXC — Sat, 29 May 2010 20:56:00 +0000

I recently decided to learn about IPv6 and signed up to get my own IPv6 address range. It’s all free and your learn loads in the process.

Just visit http://www.tunnelbroker.net sign-up and get learning about IPv6!

They provide a free PPTP VPN tunnel service so you can set your laptop to have its own static IPv6 address no matter where you’re connecting to the internet from. Plus you get free DNS management and rDNS too!!!

I have to say, it’s pretty cool to be able to give my laptop a static forward and reverse AAAA record.
Oh and if you do it soon you might get a free T-shirt too. Just make sure you put in your correct home address details and T-shirt size in the personal details section. It’s all to aid promoting the switch to IPv6.

How to set proxy settings for the LocalSystem and NetworkService accounts

NiXC — Fri, 28 May 2010 13:51:00 +0000

Sometimes you need to set the proxy settings for the System account or NetworkService account on a server. There’s a super easy way to do this using bitsadmin.

Set accounts to use a static proxy server with exclusions:
bitsadmin /util /setieproxy localsystem MANUAL_PROXY proxysrv:8080 “;*.consoto.com“
bitsadmin /util /setieproxy networkservice MANUAL_PROXY proxysrv:8080 “;*.consoto.com“
bitsadmin /util /setieproxy localservice MANUAL_PROXY proxysrv:8080 “;*.consoto.com“

Set account to use proxy.pac file:
bitsadmin /util /setieproxy localsystem AUTOSCRIPT http://contoso.com/proxy.pac
bitsadmin /util /setieproxy networkservice AUTOSCRIPT http://contoso.com/proxy.pac
bitsadmin /util /setieproxy localservice AUTOSCRIPT http://contoso.com/proxy.pac

Just replace the blue bits with your own organisations servers and pac file addresses, then run the commands for the relevant accounts you want to change from and administrative command-line window.
More info can be found here: http://msdn.microsoft.com/en-us/library/aa362813(VS.85).aspx

SafeNet ProtectDrive – using the 16-bit boot loader

NiXC — Wed, 24 Mar 2010 10:19:00 +0000

We’ve started using SafeNet ProtectDrive for encrypting all our XP laptops (and Bitlocker for all the rest that are using Windows 7), and occasionally we’ve found that one or two laptops refuse to get past the 32-bit vxBios boot loader screen. For whatever reason that it happens the temporary way around this is to press the shift key whilst the system powers-on and the 16-bit boot loader will kick in and let you in.

Unfortunately the administration guide for ProtectDrive does not explain how to make the 16-bit boot loader a permanent choice for the few machines that just can’t handle the 32-bit loader. So after contacting support and getting the answer I thought I’d post here how to do it to save someone else waiting the usual 6 hours or so before America wakes up and responds to the support query.

To make the 16-bit boot loader the default option when using ProtectDrive all you have to do is boot the machine up using the temporary method (pressing shift whilst it boots) then after logging in drop to the command line and run “setpb /16″ from the Tools folder on the original installation media. That changes the mbr to the 16-bit version.
You can also run “setpb /32″ to switch back to the 32-bit loader too.

Hope that helps someone!

Direct Links to get Adobe Flash Player and AIR

NiXC — Sun, 28 Feb 2010 10:34:00 +0000

Adobe have changed things, again, and now you can’t get the flash players for IE and FireFox (et al.) as easily as you used to if you don’t want to use the terrible DLM system they impose on you – which doesn’t work with proxies (fantastic job guys).
And what’s the point of a download manager for something that’s less than 2MB in size? Idiots.

When you go to get the flash player you’ll find the link that used to be at the bottom of the install page which gave you the direct link to the .exe for installing has now vanished. You must go to the troubleshooting page instead, and it’s near the bottom of that.

Here’s the troubleshooting page: http://kb2.adobe.com/cps/191/tn_19166.html

But you don’t need that necessarily as the following links are likely not to change since they are generic.
Latest Flash player for IE: download
Latest Flash player for FireFox, Chrome, Opera, etc.: download
Latest AIR player: download

Hope that helps someone

Here are the links if you want to keep them somewhere:

http://fpdownload.adobe.com/get/flashplayer/current/install_flash_player_ax.exe
http://fpdownload.adobe.com/get/flashplayer/current/install_flash_player.exe
http://airdownload.adobe.com/air/win/download/latest/AdobeAIRInstaller.exe

Hybrid, New Album: Disappear Here

NiXC — Wed, 24 Feb 2010 14:17:00 +0000

Slightly off the usual topic of my blog – but I am obsessed with the band “Hybrid” (thanks to my friend Dave who originally introduced their music to me) and I have just discovered that they are releasing a new album on 29th March 2010 called “Disappear Here”.

The album is available to pre-order on Amazon and there’s a really good teaser for it on their site (www.hybridsoundsystem.com).

First impressions… AMAZING! Hints of their original and best quality work with lots of drum and base and their usual thick globules of classical. Fantastic. I can’t wait for the release date!

Signing a freeware un-signed app for a Symbian phone

NiXC — Sat, 09 Jan 2010 16:53:00 +0000

When you install an app on a Nokia phone these days it won’t install unless it’s been signed with a trusted certificate. Problem is you have to pay to get a certificate you can use to allow anyone to install software. That’s why you get a lot of free software for Nokias at the moment that you just can’t install because they haven’t been signed.

So how do we install the software?! The only easy solution is to get a certificate that only works on your phone, and is locked to your phone’s IMEI number. The easiest way to do this is to use a free site in China that will give you the bits you need.

1. Go to http://cer.opda.cn/en
2. Click register at the top right
3. Fill in the details and register
4. Once you’ve registered click the “My Certificate” link at the top and log in
5. Now click the orange “Apply cer” button near the top right
6. Fill in the details, the only bit that matters in this page is your IMEA number (get it using *#06# on your mobile), the rest of the fields are to help you identify your certificate
7. After clicking the button you’ll go to the My Certificate page where you certificates get listed. It’ll show your newly applied for certificate and that it’s in the ‘apply’ stage
8. Now go down the shops or play your favourite computer game and wait a few hours. It took about 3 hours for my first one to get approved. Perhaps they’re running the system on a 486 or maybe it’s a manual approval thing, either way it takes a while. I’ve heard it ‘can’ take 24 hours sometimes. So keep coming back every few hours. The site will time our after a little while so you’ll need to log in again.
9. When your certificate is approved you will be able to click the “Signing” link on the certificate line that’s been approved. You can then upload your .sis file that you want signed and then download a signed version.

Easy! Pity the Symbian Foundation or Nokia couldn’t make it that easy.

How to update your Forefront Client Security deployment share

NiXC — Thu, 17 Dec 2009 14:37:00 +0000

Microsoft recently created up to date Forefront Client Security installation packages. According to KB976669 these are only available within WSUS. So at least existing installs can get the latest version of the client via WSUS. But what about newly installed clients? Why should we have to install an out of date 2007 version and then do an update just to get the latest client. I want the latest version installed right at the beginning dammit!!!

Well there’s a way of finding the install files if you’re prepared to crawl the WSUS SQL database.

Here are the direct links to the install files with their associated language and architecture.

Basically download the one/s you want and extract to a folder by using /extract
You will then have a folder with the files you should use to overwrite your FCS deployment share.

Of course it’s possible these links might change, in which case you will have to crawl WSUS yourself. The secret is to query the dbo.tbFile table for a value like %fcsclientpackage% in the FileName column. Reasonably easy when you know what to look for

How to install Adobe Flash 10.1 beta on Windows 7 x64

NiXC — Sun, 06 Dec 2009 17:54:00 +0000

Thought I’d try out the new Adobe Flash ActiveX control for IE, and naturally I wasn’t expecting a smooth installation process – this is Adobe after all – and low and behold the plug-in would not install on Windows 7 x64.

In a normal administrative user account (hint hint), and running ‘as admin’ the setup process will get to 100% and then gets killed by Windows with the familiar “program unresponsive” dialog. Even setting compatibility settings on the installer or running it from an administrative command line interface will produce the same results. Plus I did the install on 2 completely different machines with different anti-virus, same thing.

The answer? Enable your proper “Administrator” account, login as that and then do the install. It works perfectly. That sort of points the finger at Adobe not know how to handle UAC again. Yes it’s only a beta, but that’s still quite lame.
I don’t doubt running the installer as the system user would probably work too

Windows Biometric Service stops preventing fingerprint logon

NiXC — Mon, 30 Nov 2009 15:53:00 +0000

Recently I setup one of my work laptops to allow me to login using my fingerprint without the need for any client software other than a driver. A handy new feature built-in to Windows 7, and it works fabulously well. One finger on each hand for different things, one for admin, one for my normal user. Love it!

However I have been finding occasionally that when I switch the laptop on (usually after being in hibernation or standby) that I can’t login with a fingerprint and have to resort to legacy means (typing!).

I think that this is because the “Windows Biometric Service” service has stopped. There are events notifying that it’s happened but no explanation why. I made sure the service was set to automatic (it was) and I’ve added recovery options to the service telling it to restart if it stops. Seems that hasn’t fixed it because the problem cropped up immediately afterwards when I tested it. I’m not quite sure what else to do yet…

Just thought I’d blog this in case someone else runs into it.

Outlook 2007 – Faulty policy for deleting items on a delegated mailbox

NiXC — Tue, 17 Nov 2009 12:59:00 +0000

When you have been delegated the right to delete items from someone else’s mailbox the default functionality is to have the deleted items go into your mailbox’s deleted items folder instead of the owners mailbox.
This functionality can be changed with a registry key, see here: http://office.microsoft.com/en-us/outlook/HA100750921033.aspx

HOWEVER, there is a group policy introduced with Office 2007 that can alter this functionality for all users. It’s located here:
“User Configuration\Policies\Administrative Templates\Microsoft Office Outlook 2007\Tools | Options…\Delegates”
The policy is called:
“Store deleted items in the owner’s mailbox instead of delegate’s mailbox”

The help text says it needs to be enabled to set the functionality to have deleted items remain in the owner mailbox.
Guess what, it’s WRONG! Yes Microsoft have not tested it properly. It turns out if you enable the policy you enforce the default, to have deleted items go into the delegates mailbox, not the owner’s mailbox.
To get this policy to work properly you must set it to DISABLED.

When disabled, a policy key is created that enforces the alternate functionality for deleting mail.
HKLM\Software\Policies\Microsoft\Office\12.0\Outlook\Options\General
DelegateWastebasketStyle = 4

Hope this helps someone else!

PowerShell 2 for XP, Server 2003, Vista and Server 2008 is available!

NiXC — Wed, 28 Oct 2009 16:48:00 +0000

Microsoft are calling it the “Windows Management Framework” but in reality this is PowerShell 2.0 and it’s now available for download: http://support.microsoft.com/kb/968929

If you install over the top of PowerShell 1.0 on XP the startmenu link will go but you’ll be left with the documentation links. So it might be better to uninstall 1 then install 2. Not sure yet.
Part of this is the new ISE (Integrated Scripting Environment) too and it’s wonderfully good. Just go start, run, then type: powershell_ise

Note: it supports only XP SP3, Server 2003 SP2, Vista SP1+, and Server 2008 SP2.
Windows 7 and Server 2008 R2 have PowerShell 2 built-in of course.

How to download individual updates when using Vista or Windows 7

NiXC — Sat, 24 Oct 2009 20:43:00 +0000

If you want to get hold of updates for Windows 7 or Vista when you’re running Vista or Win 7 already, you can get the updates via the updates catalog (catalogue): http://catalog.update.microsoft.com/ (the pages require IE of course).

I actually had to run up my virtual xp machine to get hold of that link! I simply couldn’t remember the word “catalog”. Heh.

What inspired this blog entry was that I thought I’d have a go at making a fully up to date disc of Win7 before I put it on my wife’s PC, i.e. mount the wim with imagex, and use dism with the latest updates. Thought that would be fun, but then I couldn’t get hold of the updates of course. Sorted.

Exchange 2007 SP2 has been released

NiXC — Tue, 25 Aug 2009 08:44:00 +0000

And so to the insignificant clash of tiny mouse sized symbols Exchange 2007 Service Pack 2 has finally been released: http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID;=4c4bd2a3-5e50-42b0-8bbb-2cc9afe3216a

According to a little very sketchy investigation I’ve done there’s a schema change and support for PowerShell 2 – in fact they are recommending it! According to this blog post (link) PowerShell 2 is already in Windows 7 and Server 2008 R2, and sure enough if you run powershell and type $psversiontable and that proves it
[yes i've been running Win7 Enterprise x64 RTM for the last 2 weeks, hehe]