One Lumen

Aug 1 2012

Delete files older than 7 days

Here is a small visual basic script that will delete all files in a folder older than 7 days with a specific file extension. I use it to clean out old spam that’s been archived on our exchange 2003 mail server by the IMF (intelligent message filter). I use task scheduler on the server to run the task once a day.

I have added a few options that are commented out. In vb script this is done with a apostrophe ‘ so just remove to make it active.

1. number of days (7 in this example)

dtmDate = Date - 7

2. by creation date

strDate = Left(objFile.CreationDate, 8)

3. by last modified date

strDate = Left(objFile.LastModified, 8)

4. by file extension (txt in this example)

If objFile.Extension = "txt" Then

Here is the vb script

'Change the number of days to suite your needs
dtmDate = Date - 7

strDay = Day(dtmDate)

If Len(strDay) < 2 Then
 strDay = "0" & strDay
End If

strMonth = Month(dtmDate)

If Len(strMonth) < 2 Then
 strMonth = "0" & strMonth
End If

strYear = Year(dtmDate)

strTargetDate = strYear & strMonth & strDay

strComputer = "."

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set FileList = objWMIService.ExecQuery _
 ("ASSOCIATORS OF {Win32_Directory.Name='C:\Progra~1\Exchsrvr\Mailroot\vsi1~1\UceArchive\ToDelete'} Where " _
 & "ResultClass = CIM_DataFile")

For Each objFile In FileList
 'by creation date
 'strDate = Left(objFile.CreationDate, 8)
 'by modified date
 strDate = Left(objFile.LastModified, 8)
 If strDate < strTargetDate Then
 'uncomment this line below and extra the "End if" to match by file extension
 'If objFile.Extension = "txt" Then
 objFile.Delete
 End If
 'End If
Next

Credits mostly to Hey, Scripting Guy! he is a legend

http://blogs.technet.com/b/heyscriptingguy/archive/2007/11/13/hey-scripting-guy-how-can-i-remove-old-files-from-all-the-folders-that-share-a-folder-name.aspx

By sysadmin • IT, Scripting • 0

Jul 31 2012

Service or driver failed during system startup

I was checking a bios setting on a windows 2003 server and noticed the parallel port was enabled but it was not being used so I disabled it. Now every time I reboot I get the error At least one service or driver failed during system startup. Use the event viewer to examine the event log for details. Looking in the system event viewer I noticed an error source service control manager event id 7000

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 31/07/2012
Time: 11:38:46 AM
User: N/A
Computer: BS01
Description:
The Parallel port driver service failed to start due to the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

I fixed this error by disabling the the parport.sys driver in the registry as I could not see it in device manager.

1. Open the registry editor Start -> Run -> regedit -> ok and find:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\parport

2. Right click on Start and select modify and change the value to 4 disabled.

Restart the computer and check the event log

By sysadmin • IT • 0

Jul 19 2012

Enable Remote Desktop remotely

I completed a fresh installed of windows server 2003 at my office today and thought I could complete the configuration later at home. I arrived home and tried to connect but realized I forgot to tick the check-box “Enable Remote Desktop on this computer” under system properties, remote. To avoid driving back to the office (about a 100kms) here is a tip, you can enable it via the network registry.

1. Start -> Run -> regedit -> ok

2. From the registry editor select File -> Connect Network Registry

3. From select computer enter the computer name and click ok. You should now see your computer.

4. Now find “fDenyTSConnection” under

HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server

right click and select modify to edit the value. The value will be set to 1 change it to 0 and click ok

Now you should be able to connect, if not you may need to restart the remote computer (I did not need to). To do this open a command prompt Start -> Run enter “cmd” and click ok. At the command prompt type in “shutdown -m \\bs01 -r” the -m is computer name and the – r is reboot.

By sysadmin • IT • 0

Jul 11 2012

Capture Terminal Server ip address connection attempts

Today I was working on a Windows 2003 Terminal Server and noticed in Terminal Services Manager repeated connection attempts. To investigate this I need to capture the ip addresses. Wireshark is my tool of choice for this job (download free from http://www.wireshark.org/ )

To capture the ip addresses open Wireshark select capture, options from the menu. I only want traffic that is not local so I used this capture filter “not src net 192.168.5.0/24” and started the capture.

Now that I can see the ip addresses what now? In my case I blocked the network that contained the ip address for tcp port 3389 on a Cisco router.

Wireshark has many capture options see the wiki here; http://wiki.wireshark.org/CaptureFilters

By sysadmin • IT • 0

Jul 10 2012

How is my VMWare disk is provisioned?

Here is the simplest way to check how your VMWare disks are provisioned.

Right click on your virtual machine and select edit, next select the disk you want to check. On the upper right under Disk Provisioning you will see Type: Thick Provision Eager Zeroed, Thick Provision Lazy Zeroed or Thin Provision.

Here is a screen capture from VMWare vShere client 5 showing Thick Provision Lazy Zeroed