Thursday, March 24, 2005

Keeping the admins rooted...

One of the challenges I had to deal with in my work was to keep the standard operating environment for our computers as consistent as possible. This means having a common baseline for new client builds as far as security restrictions, installed apps, and look-and-feel are concerned. However, users who are local admins of their computers (most of whom are not aware of security threats, or just simply choose to ignore them) make keeping the SOE homogenous a pain in the butt.

For example, being local admins, these users can remove the default local administrators (domain admins, OU admins, etc.) defined in the SOE and practically make their computers inaccessible to these groups. This could easily be circumvented via a domain-level (or OU-level) startup script which, running under system privileges, can do virtually anything (like net localgroup administrators MyDomain\MyAccount /add, for example). However, this was a no-no as far as the AD team is concerned.

My next suggestion was to create a service (btw, I love doing this on my test PC with instsrv and srvany to automate a lot of stuff, like opening up a cmd shell with root rights --- yes, i always login as non-root!) but this too was rebuffed.

In the end, I had to use an existing service account which runs on all clients (somewhat similar to an SMS agent, if you are familiar with MS SMS). I use this to execute the following script:

Const conForReading = 1
Const HKEY_LOCAL_MACHINE = &H80000002
Const strDomain = "MyDomain"
file1=".\defaultadmins.txt"
Set objNetwork = CreateObject("WScript.Network")

Set WSHNetwork = WScript.CreateObject("WScript.Network")
Set oFS = Wscript.CreateObject("Scripting.FileSystemObject")
Set oInputFile = oFS.OpenTextFile(file1, conForReading)

strComputer = objNetwork.ComputerName

On Error Resume Next

While oInputFile.AtEndOfStream <> True
strUser=oInputFile.ReadLine
Set objGroup = GetObject("WinNT://" & strComputer & "/Administrators,group")
Set objUser = GetObject("WinNT://" & strDomain & "/" & strUser & ",group")
objGroup.Add(ObjUser.ADsPath)
Wend

The script reads a text file containing a list of the default local admins and adds them to the local administrators group when the user logs in. It ignores any error returned.

Ice crrrreeaaammm...



The kid hates ice cream as the pictures clearly show. How the kid has grown, tsk. He was a rather shy (tahimik pero nasa loob ang kulo?) year-old tyke when he left the PH. Now, sobrang kulit and oh-so hyper. Cute naman daw sabi ng mommy. =)

Saturday, March 12, 2005

The weekend warriors...

Whew, what a day! I played in our company's inter-department basketball tournament. We won three games, lost one. Tsk, not enough to book us a seat in the semis though. Oh well, bottomline is I had a great time (busted lip and all, heh). =)

Brought Rizza, Ria and the kids out for dinner at Suntec. The kids and Ria had the standard fried chicken and rice, Rizza had yong tau fo while I wanted to try out ayam penyet from an Indon stall. Tough luck, they've run out of this so I ended up having grilled sotong (squid) instead.

After the binge, we brought the kids to the game arcade and Butoy had a blast playing there. Maybe we'll bring them again there when it is not too crowded and the racing consoles aren't occupied. =)

Here's a picture of me and the kids taken, I think, last December.

Friday, March 11, 2005

Blogging MS...

As I was poring over some Pinoy blogs which delve on IT matters, I cannot help but notice that majority of them (based on the twenty or so that I have seen) are FOSS advocates. These blogs provide never a dearth of info and tips on, say, configuring Ubuntu, running LiveCDs, nmap switches, to name a few. Definitely information such as these are a godsend to noobies like me. Needless to say, I, an open source convert, have made it a habit to leaf through these blogs for a tip or two on FOSS stuff whenever I can. But I digress.

I am supporting an infrastructure that has Microsoft etched all over its face. Web servers? IIS, check. Desktop/notebook OS? Win2K (and a li'l dash of XP here and there), check. Application servers? Win2K/Win2003, check. Basically at work, I live and breath MS. Which explains why I have MCSE, MCSA, and MCP on my business card *grins*. 'Nuff said.

I will try to provide tips, every now and then, concerning MS-related stuff since majority of PC users are using the Redmond giant's products. I'll start next week, as I am about to set off for the IT Fair at Suntec City a few minutes from now. Great buys, so says one of my colleagues... We'll see... It's gonna take a lot of convincing to persuade a saluyot-loving Ilocano to part with his hard earned cash. Sal-it!

Wednesday, March 09, 2005

Requiem...

Uncle Sonny's death caught us all by surprise, to say the least. The last time I had the chance to talk to him was when he went for a vacation in the PH over six years ago. I would have wanted to attend his interment but I wasn't able to secure my visa on time. Besides, I'm in the rut with this month-end training I was tasked to conduct for our AP sysadmins and equipment engineers/owners (more on this on another post).

Going back to Uncle Sonny, he was the epitome of a self-made man. He went on to join the US Navy despite my Lolo's vehement disapproval. Once on an assignment in Japan, he married Aunt Sally. Eventually, they would settle down in San Diego, California.

One unforgettable moment I had with Uncle Sonny happened in Pangasinan during my Dad's wake. I was barely 11 years old when my father passed away in Saudi. Uncle Sonny made an offer to me and my Mom for him to adopt me but I declined. Tsk, tsk, tsk what would have happened had I accepted the offer, only God knows. I'm gonna miss the fella bigtime...

Btw, my sister Nitz is on her way to San Francisco (where Uncle Roger and our cousins are) and will proceed to San Diego before Thursday.

Thursday, March 03, 2005

Recollections...

It's been almost three years now when I started working with this company. Sometimes I wonder how life would have been had I opted for that consultancy work instead. SI work hasn't always been a bed of roses but it helps pay the bills.

Looking back, I still remember my exuberance when, barely a couple of weeks into the job, I was assigned to do a project that would take me to our Asia-Pac regional sites for almost four months. Talk about plain swerte when the angmoh guy who was supposed to be involved in the project quit.

Those few months were a mix of melancholic and blissful feelings. On one hand, I was missing my family a lot, especially my li'l boy who was only 3 months old when I left the Philippines. On the other hand, I was very thrilled to travel to other countries, experience diverse cultures, and see well-known places.

I still get goosebumps when I recall those Chinese military (or were they policemen?) tailing me (or was I just being paranoid?) when I was trying to take some shots in Tian An Men Square in Beijing (the tibak in me can emphatize with the martyrs who lost their lives here...). Or when I took the Shinkansen from Tokyo to Nagoya (or how about that time when I paid this Japanese taxi 120 greenbucks for a less-than 30-minute ride from Shinagawa to, was it Ikebukuro?). How about that curfew thing in Bangalore (almost getting arrested and all!)? The Taipei 101 was just a big hole on the Taipei CBD when I was there (and how contrasting the Hsinchu landscape is with those MNC fabs among rice paddies...). The Shanghai squeeze? That's a cab with two Germans, one Singaporean Sikh, me jammed in this small cab with hardly a space to spare, tsk, tsk... Penang TGIFs are the best so far (ladies night kasi sa mga bars *winks*).

Looking ahead, life seems to get no easier. No complaints, bring it on...