userAccountControl, Attributes for AD Users

I needed this today for use in querying a large AD.

Repost. Credits go to http://www.selfadsi.org/ads-attributes/user-userAccountControl.htm

 

you can query with this e.g. with powershell and do some counting:

(Get-ADUser -LDAPFilter “(&(sAMAccountName=*)(!userAccountControl:1.2.840.113556.1.4.803:=2))” -SearchBase ‘OU=Users,DC=domain,DC=local’ ).Count

But could also check if password has been set to never expire, etc.

Attributes for AD Users : userAccountControl

The Active Directory attribute userAccountControl contains a range of flags which define some important basic properties of a user object. These flags can also be used to request or change the status of an account.

userAccountControl

 

LDAP name userAccountControl
Data type Integer (DWORD – 4 Bytes)
Multivalue (Array) No
System Flags 0x12
Search Flags 0x19
In Global Catalog? Yes
Attribute ID 1.2.840.113556.1.4.8
AD DB attribute name User-Account-Control
ADSI datatype 7 – Integer
LDAP syntax 1.3.6.1.4.1.1466.115.121.1.27 – Integer
Used in … > W2K
Schema Info Microsoft – MSDN

 

In addition to the mere attribute specification in the schema docu, there are two important websites which explain the meaning of the different userAccountControl flags:

MSDN: Open Specifications – [MS-ADTS] – 2.2.15 – userAccountControl Bits

MSDN: Open Specifications – [MS-SAMR] – 3.1.1.8.10 – userAccountControl

Here are the single flags, you find some annotations afterwards:

 

Flag value (binary) (decimal)
0000000000000000000000000000000x 1  Reserved, the value must always be 0
00000000000000000000000000000010 2  UF_ACCOUNT_DISABLE
00000000000000000000000000000×00 4   Reserved, the value must always be 0
00000000000000000000000000001000 8  UF_HOMEDIR_REQUIRED
00000000000000000000000000010000 16  UF_LOCKOUT
00000000000000000000000000100000 32  UF_PASSWD_NOTREQD
00000000000000000000000001000000 64  UF_PASSWD_CANT_CHANGE
00000000000000000000000010000000 128  UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED
00000000000000000000000×00000000 256  Reserved, the value must always be 0
00000000000000000000001000000000 512  UF_NORMAL_ACCOUNT
000000000000000000000×0000000000 1024  Reserved, the value must always be 0
00000000000000000000100000000000 2048  UF_INTERDOMAIN_TRUST_ACCOUNT
00000000000000000001000000000000 4096  UF_WORKSTATION_TRUST_ACCOUNT
00000000000000000010000000000000 8192 UF_SERVER_TRUST_ACCOUNT
00000000000000000×00000000000000 16384  Reserved, the value must always be 0
0000000000000000×000000000000000 32768  Reserved, the value must always be 0
00000000000000010000000000000000 65536  UF_DONT_EXPIRE_PASSWD
00000000000000100000000000000000 131072  UF_MNS_LOGON_ACCOUNT
00000000000001000000000000000000 262144  UF_SMARTCARD_REQUIRED
00000000000010000000000000000000 524288  UF_TRUSTED_FOR_DELEGATION
00000000000100000000000000000000 1048576  UF_NOT_DELEGATED
00000000001000000000000000000000 2097152  UF_USE_DES_KEY_ONLY
00000000010000000000000000000000 4194304  UF_DONT_REQUIRE_PREAUTH
00000000100000000000000000000000 8388608  UF_PASSWORD_EXPIRED
00000001000000000000000000000000 16777216  UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION
00000010000000000000000000000000 33554432  UF_NO_AUTH_DATA_REQUIRED
00000100000000000000000000000000 67108864  UF_PARTIAL_SECRETS_ACCOUNT
0000×000000000000000000000000000 134217728  Reserved, the value must always be 0
000×0000000000000000000000000000 268435456  Reserved, the value must always be 0
00×00000000000000000000000000000 536870912  Reserved, the value must always be 0
0x000000000000000000000000000000 1073741824  Reserved, the value must always be 0
x0000000000000000000000000000000 2147483648  Reserved, the value must always be 0

 

If there are several flags set for a certain account, you just have to add the decimal values of these flags to get the according value of the userAccountControl attribute. Some Examples:

 

Normal User Account
00000000000000000000001000000000 512  UF_NORMAL_ACCOUNT
Total  512

 


 

Disabled User
00000000000000000000000000000010 2  UF_ACCOUNT_DISABLE
00000000000000000000001000000000 512  UF_NORMAL_ACCOUNT
Total  514

 


 

User whose password never expires
00000000000000000000001000000000 512  UF_NORMAL_ACCOUNT
00000000000000010000000000000000 65536 UF_DONT_EXPIRE_PASSWD
Total  66048

 

To set or erase bits in the userAccountControl attribute, this is what you could do:

 

Const ADS_UF_ACCOUNT_DISABLE = 2 Const ADS_UF_HOMEDIR_REQUIRED = 8 Const ADS_UF_LOCKOUT = 16 Const ADS_UF_PASSWD_NOTREQD = 32 Const ADS_UF_PASSWD_CANT_CHANGE = 64 Const ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED = 128 Const ADS_UF_NORMAL_ACCOUNT = 512 Const ADS_UF_INTERDOMAIN_TRUST_ACCOUNT = 2048 Const ADS_UF_WORKSTATION_TRUST_ACCOUNT = 4096 Const ADS_UF_SERVER_TRUST_ACCOUNT = 8192 Const ADS_UF_DONT_EXPIRE_PASSWD = 65536 Const ADS_UF_MNS_LOGON_ACCOUNT = 131072 Const ADS_UF_SMARTCARD_REQUIRED = 262144 Const ADS_UF_TRUSTED_FOR_DELEGATION = 524288 Const ADS_UF_NOT_DELEGATED = 1048576 Const ADS_UF_USE_DES_KEY_ONLY = 2097152 Const ADS_UF_DONT_REQUIRE_PREAUTH = 4194304 Const ADS_UF_PASSWORD_EXPIRED = 8388608 Const ADS_UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION = 16777216 Const ADS_UF_NO_AUTH_DATA_REQUIRED = 33554432 Const ADS_UF_PARTIAL_SECRETS_ACCOUNT = 67108864 Set obj = GetObject(“LDAP://cn=philipp,ou=user,dc=cerrotorre,dc=de”) ‘The user is disabled (set flag bit): obj.userAccountControl = obj.userAccountControl or ADS_UF_ACCOUNT_DISABLE obj.SetInfo ‘The user is enabled (remove flag bit): obj.userAccountControl = obj.userAccountControl xor ADS_UF_ACCOUNT_DISABLE obj.SetInfo

If you are searching for users with specific userAccountControl properties (in an LDAP search operation), you need special LDAP filters to limit the search to the accounts which have set or not set certain bits in this value:

 

Const ADS_UF_ACCOUNT_DISABLE = 2 Const ADS_UF_PASSWD_NOTREQD = 32 Const ADS_UF_DONT_EXPIRE_PASSWD = 65536 ‘All accounts which are disabled ‘ => ADS_UF_ACCOUNT_DISABLE = 2 ‘ => ldapFilter = “(userAccountControl:1.2.840.113556.1.4.803:=2)” ‘All accounts which are NOT disabled: ‘ => ADS_UF_ACCOUNT_DISABLE = 2 ‘ => ldapFilter = “(!(userAccountControl:1.2.840.113556.1.4.803:=2))” ‘All accounts which do not need a password OR whose passwords never expire: ‘ => ADS_UF_PASSWD_NOTREQD And ADS_UF_DONT_EXPIRE_PASSWD = 32 + 65536 = 65568 ‘ => ldapFilter = “(userAccountControl:1.2.840.113556.1.4.804:=65568)” ‘All accounts which do not need a password AND whose passwords never expire: ‘ => ADS_UF_PASSWD_NOTREQD And ADS_UF_ACCOUNT_DISABLE = 32 + 2 = 34 ‘ => ldapFilter = “(userAccountControl:1.2.840.113556.1.4.803:=34)”

UF_ACCOUNT_DISABLE ( 2 )

If this userAccountControl bit is set, the regarding user account is disabled and cannot authenticate to the domain any more. Please do not confuse this with the Intruder Lockout mechanism which locks out a user if he enter a wrong password to often in too short a time.

Disabled users and locked users

If you want to enable a disabled user by deleting the UF_ACOUNT_DISABLE flag, this will only succeed if its password complies with the current password policies. If blank passwords are prohibited in your environment and the disabled user has no password (for example because it was just created), it can not be activated: There will be a runtime error (-2147016651: LDAP_UNWILLING_TO_PERFORM). If a user can be activated in such cases, despite an empty password, then maybe the userAccountControl flag UF_DONT_EXPIRE_PASSWD is set …

UF_HOMEDIR_REQUIRED ( 8 )

If this userAccountControl bit is set, there must be the directory property ‘home drive’ set for the regarding account => the LDAP attribute homeDirectory must exist. That’s the theory. In practice, this bit may be set without the system returning a mistake, even when there is no home drive configured for the regarding user.

UF_LOCKOUT ( 16 )

Caution: This bit does not work as expected!

This userAccountControl bit is supposed to indicate that the user is locked by the Intruder Lockout mechanism (the lock can only be triggered by the system itself). But this is just a leftover from Windows NT times. For Active Directory users, this bit is NEVER set for locked users – if you want to know whether an account is locked, you should use the attribute lockoutTime:

‘Unlocking a user account: Set user = GetObject(“LDAP://cn=sandra,ou=user,dc=cerrotorre,dc=de”) user.lockoutTime = 0 user.SetInfo

You can search locked accounts with this LDAP filter:

‘All accounts which are locked: ‘ => ldapFilter = “(&(objectClass=user)(lockoutTime>=0))”

If you are currently connected with a user object via LDAP, you can also examine the attribute msDS-User-Account-Control-Computed. In contrast to the userAccountControl, this shows you in the UF_LOCKOUT whether an account is actually deleted. However, it is a constructed attribute so that it cannot be used as a filter criterion in LDAP search operations.

UF_PASSWD_NOTREQD ( 32 )

If this userAccountControl bit is set, the user is not subject to a possibly existing policy regarding the length of password. So he can have a shorter password than it is required or it may even have no password at all, even if empty passwords are not allowed. This property is not visible in the normal GUI tools (Active Directory Users and Copmputers)!

UF_PASSWD_CANT_CHANGE ( 64 )

Caution: This bit does not work as expected!

This flag is supposed to indicate that the password for that account can not be changed by the account itself. Yet nothing happens if you set the bit (However, there will be no runtime error returned… only the value of the bit remains unchanged). If you want to really make sure that the password may not be modified, you have to deny the extended right ‘Change Password’ for the account itself and each other user.

Prevent password changes

In the access control list, this deny entry is set for the ‘SELF’ trustee also. If you want to change the permissions with a batch script, you can achieve this with two DSACLS commands:

REM Prevent password change
DSACLS “cn=PhilippFoeckeler,dc=selfadsi,dc=org” /D Everyone:CA;”Change Password”

REM Allow password change
DSACLS “cn=PhilippFoeckeler,dc=selfadsi,dc=org” /G Everyone:CA;”Change Password”
DSACLS “cn=PhilippFoeckeler,dc=selfadsi,dc=org” /G SELF:CA;”Change Password”

By the way: A password change is not the same as a password reset. Of course an administrator can perform in that particular case still a password reset.

UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED ( 128 )

If this bit is set, the password for this user stored encrypted in the directory – but in a reversible form. As the term reversible already implies: In principle, you could also say that with this setting,the password of the user can be read with the appropriate permissions (=> security gap!!).

You need the UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED flag when an application needs to know the passwords of the users to authenticate them. This is for example the case when you want/have to use RAS (Remote Access) with the old CHAP Authentication, or if you want to use IIS Digest Authentication embedded in an Active Directory environment.

Normally, passwords are stored as irreversible hash values in the AD database. So you should NEVER use this option unless it is absolutely necessary.

Activation of the option "Store password in reversible encryption"

UF_NORMAL_ACCOUNT ( 512 )

This bit indicates that this is a normal user account. To distinguish this type of account from other types is necessary because not only user objects have a userAccountControl attribute, but also computer objects and others representing domain controllers or trust relationships.

UF_INTERDOMAIN_TRUST_ACCOUNT ( 2048 )

This userAccountControl bit indicates that this is an account which represents a trust connection to an external domain. Normally, the name of the account is the NetBIOS name of the domain with a ‘$’ at the end. This flag should never be set for a user account.

UF_WORKSTATION_TRUST_ACCOUNT ( 4096 )

This user account control bit indicates that this is a machine account of an ordinary computer or member server in the domain. This flag should never be set for a user account.

UF_SERVER_TRUST_ACCOUNT ( 8192 )

This bit indicates that this is a domain controller account. This flag should never be set for a user account.

UF_DONT_EXPIRE_PASSWD ( 65536 )

Is this userAccountControl bit is set, the user is not subject to an existing policy regarding a forced password change interval: The password of this account never expires.

UF_MNS_LOGON_ACCOUNT ( 131072 )

This bit indicates that this is a Majority Node Set (MNS) account, such account are required for the operation of cluster nodes for Windows Server 2003 (and newer), in which the quorum data is not stored on a shared media drive. This flag should never be set for a user account.

UF_SMARTCARD_REQUIRED ( 262144 )

This bit shows that for the regarding account only a smartcard authentication is allowed for interactive logon to the domain. Other authentication mechanisms are not allowed. If this flag is set, the password of this account never expires (he doesn’t use his domain password when loging on with the smartcard …).

UF_TRUSTED_FOR_DELEGATION ( 524288 )

This userAccountControl bit indicates that this is an account that can be used for Windows services – and in the way that the service takes on temporarily the identity of a user who are using this services. This is for example the case when the Server service has the same rights on the local disk as the user who is just accessing a shared network drive. We call this process also Impersonation.

UF_NOT_DELEGATED ( 1048576 )

This bit indicates that this is an account for which a service may NOT impersonate the identity (sort of the reverse situation to UF_TRUSTED_FOR_DELEGATION bit).

UF_USE_DES_KEY_ONLY ( 2097152 )

This bit indicates that in the Kerberos authentication of the account ONLY the algorithm DES (Data Encryption Standard) may be used for the generation of tickets. This should only be set for accounts which don’t use a Windows machine to log on to the domain (Windows will always have at least DES and RC4 available).

Actually, this shouldn’t play a big role anymore, because DES is now considered no more as the best algorithm. Since Vista and Windows Server 2008, there is the much more modern AES (Advanced Encryption Standard) algorithm for Kerberos authentication to a domain controller available. For signaling which algorithms are supported for authentication of a specific account, there is now the modern attribute msDS-SupportedEncryptionTypes available. This is used to negotiate the settings between client and domain controller regarding the encryption algorithms.

UF_DONT_REQUIRE_PREAUTH ( 4194304 )

This bit indicates that there is no so-called pre-authentication necessary for Kerberos authentication of the account. This is only for older Kerberos client important, which need to login to the domain from foreign systems and which does not support Kerberos pre-authentication. For accounts that log on from a Windows machine, or just for machine accounts of Windows domain members, this flag flag should NEVER be set, for the pre-authentication prevents certain types of dictionary attacks on the Kerberos login.

UF_PASSWORD_EXPIRED ( 8388608 )

Caution: This bit does not work as expected!

Normally, this user account control bit is supposed to indicate that the user’s password is expired. However, it is not set by the system when the password actually expires, nor can you force the user to change his password at the next logon by setting this bit.

If you really want to know whether the password of an account has expired or not, you can examine the attribute msDS-User-Account-Control-Computed, this is in contrast to the userAccountControl a good indicator for password expiration in the UF_LOCKOUT bit. However, this is a constructed attribute so that it cannot be used as a filter criterion in LDAP search operations.

If you want to force expiration of a password, just set user attribute pwdLastSet to -1.

It’s getting even more complicated if you want to know exactly when a password will expire. This must be calculated with the maxPwdAge attribute of the domain and the pwdLastSet attribute of the account. These are Microsoft Integer8 values that require quite an effort in handling. In Windows 2008, a new LDAP attribute is added, which saves the calculation: msDS-UserPasswordExpiryTimeComputed. This is also constructed attribute so that it cannot be used in LDAP searches nor in an LDAP filter. Take caution when calculating the expiration time AD environments with Windows Server 2008 and newer: There could be so-called Fine Grained Password Policies active.

UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION ( 16777216 )

This bit indicates that the regarding user can request a Kerberos ticket on behalf of another user. This is necessary in rare cases for service accounts, which require so-called S4U2 self-service tickets from the domain controller. This includes the spoofing of identity and goes far beyond normal impersonation, which is sometimes important for running services. For this reason you should set this flag only if it is really necessary.

UF_NO_AUTH_DATA_REQUIRED ( 33554432 )

This bit indicates that the regarding account can request a ticket in the Kerberos ticketing process without sending the so-called Privilege Attribute Certificate (PAC) data. The PAC data structure is a Microsoft-specific Kerberos extension and contains information about the security ID of the user and the groups in which it is member. This bit is only relevant if the account in question logs in from a foreign non-Windows machine at the domain and it does not support PAC.

UF_PARTIAL_SECRETS_ACCOUNT ( 67108864 )

This bit indicates that this is a ReadOnly domain controller account. These machines accounts always include the UF_WORKSTATION_TRUST_ACCOUNT also. This flag should never be set for a user account.

 

Hope this repost helps. credits to http://www.selfadsi.org

Posted in Active Directory, ldap | Comments Off on userAccountControl, Attributes for AD Users

Sonos controller app for Windows, download link

It was somewhat hard to locate, so here is the link to the windows (10) download for the Sonos Controller:

https://www.sonos.com/redir/controller_software_pc

Cheers

Posted in Microsoft, Sonos, Win10, Windows | Comments Off on Sonos controller app for Windows, download link

HP 2530-24G (J9773A) OID’s for CRC ERR

For my own documentation purposes, here are a bunch of OID’s for SNMP monitoring on a HP 2530-24G managed switch.

I needed to monitor each port for errors.

Apparantly the errors can be obtained using an OID for each port:

CRC ERR IN

.1.3.6.1.2.1.2.2.1.14.1 = COUNTER32
.1.3.6.1.2.1.2.2.1.14.2 = COUNTER32
.1.3.6.1.2.1.2.2.1.14.3 = COUNTER32
.1.3.6.1.2.1.2.2.1.14.4 = COUNTER32
.1.3.6.1.2.1.2.2.1.14.5 = COUNTER32
.1.3.6.1.2.1.2.2.1.14.6 = COUNTER32
.1.3.6.1.2.1.2.2.1.14.7 = COUNTER32
.1.3.6.1.2.1.2.2.1.14.8 = COUNTER32
.1.3.6.1.2.1.2.2.1.14.9 = COUNTER32
.1.3.6.1.2.1.2.2.1.14.10 = COUNTER32
.1.3.6.1.2.1.2.2.1.14.11 = COUNTER32
.1.3.6.1.2.1.2.2.1.14.12 = COUNTER32
.1.3.6.1.2.1.2.2.1.14.13 = COUNTER32
.1.3.6.1.2.1.2.2.1.14.14 = COUNTER32
.1.3.6.1.2.1.2.2.1.14.15 = COUNTER32
.1.3.6.1.2.1.2.2.1.14.16 = COUNTER32
.1.3.6.1.2.1.2.2.1.14.17 = COUNTER32
.1.3.6.1.2.1.2.2.1.14.18 = COUNTER32
.1.3.6.1.2.1.2.2.1.14.19 = COUNTER32
.1.3.6.1.2.1.2.2.1.14.20 = COUNTER32
.1.3.6.1.2.1.2.2.1.14.21 = COUNTER32
.1.3.6.1.2.1.2.2.1.14.22 = COUNTER32
.1.3.6.1.2.1.2.2.1.14.23 = COUNTER32
.1.3.6.1.2.1.2.2.1.14.24 = COUNTER32

CRC ERR OUT

.1.3.6.1.2.1.2.2.1.20.1 = COUNTER32
.1.3.6.1.2.1.2.2.1.20.2 = COUNTER32
.1.3.6.1.2.1.2.2.1.20.3 = COUNTER32
.1.3.6.1.2.1.2.2.1.20.4 = COUNTER32
.1.3.6.1.2.1.2.2.1.20.5 = COUNTER32
.1.3.6.1.2.1.2.2.1.20.6 = COUNTER32
.1.3.6.1.2.1.2.2.1.20.7 = COUNTER32
.1.3.6.1.2.1.2.2.1.20.8 = COUNTER32
.1.3.6.1.2.1.2.2.1.20.9 = COUNTER32
.1.3.6.1.2.1.2.2.1.20.10 = COUNTER32
.1.3.6.1.2.1.2.2.1.20.11 = COUNTER32
.1.3.6.1.2.1.2.2.1.20.12 = COUNTER32
.1.3.6.1.2.1.2.2.1.20.13 = COUNTER32
.1.3.6.1.2.1.2.2.1.20.14 = COUNTER32
.1.3.6.1.2.1.2.2.1.20.15 = COUNTER32
.1.3.6.1.2.1.2.2.1.20.16 = COUNTER32
.1.3.6.1.2.1.2.2.1.20.17 = COUNTER32
.1.3.6.1.2.1.2.2.1.20.18 = COUNTER32
.1.3.6.1.2.1.2.2.1.20.19 = COUNTER32
.1.3.6.1.2.1.2.2.1.20.20 = COUNTER32
.1.3.6.1.2.1.2.2.1.20.21 = COUNTER32
.1.3.6.1.2.1.2.2.1.20.22 = COUNTER32
.1.3.6.1.2.1.2.2.1.20.23 = COUNTER32
.1.3.6.1.2.1.2.2.1.20.24 = COUNTER32

I left out the ports for the modules, but they are .25 .26 .27 and .28

I recon that for the 48-port version of this switch the list is just a bit longer 🙂
I’ll add some more stuff here if I encounter more stuff to know about this kind of switch, as I work a lot with HP.

 

Posted in hp, snmp, switch | Tagged | Comments Off on HP 2530-24G (J9773A) OID’s for CRC ERR

Powershell connect to Azure

I needed this today to quickly find a solution as to why a virtual machine was not running, and had to retrieve some info about an application that runs a script.

Start powershell as admin

Set-ExecutionPolicy Unrestricted -force
Install-Module AzureRM

Answer Yes on NuGet. By the way, executionpolicy is not entirely safe, I know, but it works for me right now, because I needed to fix something in the way of.. right now.
You may want to specify differently.

Import-Module AzureRM
Connect-AzureRmAccount

Enter your Azure credentials.

to test the connection, this should return some tenant info:

Get-AzureRmTenant
Get-AzureRmContext

 

By the way, if you want to do something with AzureAD, you may need to do a

Connect-AzureAD

Enter your credentials again, and then do what you want to do, e.g:

Get-AzureADApplication
Get-AzureADContact
Get-AzureADDevice
Get-AzureADGroup

 

etc.

Hope this helps you!

Posted in Azure, powershell | Comments Off on Powershell connect to Azure

Ubiquity EdgeRouter Lite on “Telfort” glass fiber VLAN config and configure VLAN masquerading rules

So, here is my EdgeRouter config, edited a little for security reasons.

I hope this may help you.

Cheers!

 

Short description:

I use glass fiber from my ISP “Telfort” which uses VLAN 34 on eth1.34 (eth1 vif 34, using dhcp from the ISP, even though they always give me the same IP).
This is how my ISP works, so I have to live with that and set it up this way.

This means I do not use eth1 itself, which has been set to nothing, but is not disabled.

I do not use IPv6.

I am not using interface eth2.

I have my home lan on eth0 and my dirty wifi for IoT and guests on eth0.111 (VLAN111)

To add the nat masquerading rules for a new interface, e.g. eth0.111, log in as admin on the CLI and type:

configure

and then add something like (rule 5010, may be 5011, or something, at least not a rule number that you have already in use.)

set service nat rule 5010 description "VLAN NAT for 192.168.111.0/24"
set service nat rule 5010 outbound-interface eth1.34
set service nat rule 5010 type source
set service nat rule 5010 protocol all
set service nat rule 5010 source address 192.168.111.0/24
set service nat rule 5010 type masquerade

Anyway, here is my config. you may want to  change YOUR-ISP-GATEWAY to the ip-address of the next hop, usually known as gateway, of your ISP.

firewall {
 all-ping enable
 broadcast-ping disable
 conntrack-expect-table-size 4096
 conntrack-hash-size 4096
 conntrack-table-size 32768
 conntrack-tcp-loose enable
 ipv6-receive-redirects disable
 ipv6-src-route disable
 ip-src-route disable
 log-martians enable
 name WAN_IN {
 default-action drop
 description "WAN to internal"
 rule 10 {
 action accept
 description "Allow established/related"
 state {
 established enable
 related enable
 }
 }
 rule 20 {
 action drop
 description "Drop invalid state"
 state {
 invalid enable
 }
 }
 }
 name WAN_LOCAL {
 default-action drop
 description "WAN to router"
 rule 10 {
 action accept
 description "Allow established/related"
 state {
 established enable
 related enable
 }
 }
 rule 20 {
 action drop
 description "Drop invalid state"
 state {
 invalid enable
 }
 }
}
 receive-redirects disable
 send-redirects enable
 source-validation disable
 syn-cookies enable
}
interfaces {
 ethernet eth0 {
 address 192.168.100.254/24
 duplex auto
 speed auto
 vif 111 {
 address 192.168.111.254/24
 description "DIRTY WIFI"
 mtu 1500
 }
 }
 ethernet eth1 {
 description "eth1 - not in use"
 duplex auto
 mtu 1512
 speed auto
 vif 34 {
 address dhcp
 description "eth1.34 - telfort"
 firewall {
 in {
 name WAN_IN
 }
 local {
 name WAN_LOCAL
 }
 }
 mtu 1508
 }
 }
 ethernet eth2 {
 disable
 duplex auto
 speed auto
 }
 loopback lo {
 }
}
protocols {
 static {
 route 0.0.0.0/0 {
 next-hop YOUR-ISP-GATEWAY {
 }
 }
 }
}
service {
 dhcp-server {
 disabled false
 shared-network-name LAN {
 authoritative disable
 subnet 192.168.100.0/24 {
 default-router 192.168.100.254
 dns-server 8.8.8.8
 dns-server 8.8.4.4
 domain-name home.lan
 lease 86400
 start 192.168.100.150 {
 stop 192.168.100.250
 }
 }
 }
 shared-network-name VLAN111 {
 authoritative disable
 subnet 192.168.111.0/24 {
 default-router 192.168.111.254
 dns-server 8.8.8.8
 dns-server 8.8.4.4
 domain-name guest.wifi
 lease 86400
 start 192.168.111.150 {
 stop 192.168.111.250
 }
 }
 }
 }
 gui {
 https-port 443
 }
 nat {
 rule 5009 {
 description "Telfort Internet masq LAN"
 log enable
 outbound-interface eth1.34
 protocol all
 source {
 address 192.168.100.0/24
 }
 type masquerade
 }
 rule 5010 {
 description "Telfort Internet masq DIRTY"
 log enable
 outbound-interface eth1.34
 protocol all
 source {
 address 192.168.111.0/24
 }
 type masquerade
 }
 }
 ssh {
 port 22
 protocol-version v2
 }
 upnp {
 listen-on eth0 {
 outbound-interface eth1.34
 }
 }
}
system {
 domain-name home.lan
 host-name gateway
 ipv6 {
 disable
 }
 login {
 user admin {
 authentication {
 encrypted-password ****************
 plaintext-password ****************
 }
 full-name Someone
 level admin
 }
 }
 name-server 208.67.222.222
 name-server 8.8.8.8
 name-server 8.8.4.4
 ntp {
 server nl.pool.ntp.org {
 }
 }
 options {
 reboot-on-panic true
 }
 syslog {
 global {
 facility all {
 level notice
 }
 facility protocols {
 level debug
 }
 }
 }
 time-zone Europe/Amsterdam
}
Posted in cli, Configuration, EdgeRouter, VLAN, wifi | Comments Off on Ubiquity EdgeRouter Lite on “Telfort” glass fiber VLAN config and configure VLAN masquerading rules

Use a Sonicwall directly on Telfort glass fiber VLAN using a virtual interface.

With the glass fiber in my home I got a louzy ethernet router from my isp Telfort.

Ofcourse I understand they want to keep things affordable for everyone so they hand out these routers free (free as in you lease them) with the connection that you order.

The -feeling- I have is that this thing is slow and/or lags. I haven’t exactly measured it, so it will stay a feeling.

Today I connected an older Sonicwall that I had laying around to play with to my home connection, and in my humble opinion it is a slightly better performing option for my home internet (100 Mbps).

In order to do this with this specific ISP, you have to create a Virtual interface on your main WAN interface, in my case X1.
Connect the ethernet cable that comes out of your fiber box to that X1 interface as well.

Now create a virtual interface (in Networking you can find this option) and apply the following settings:

Zone WAN
VLAN tag is 34 (-> ISP specific)
Parent interface X1
IP Assignment DHCP
Host name <empty>
Comment  <Up to you>
Management and user login <is up to you>

This should get you going with a Sonicwall on your home.lan with Telfort fiber (in the Netherlands).

Perhaps this could help you too configure a Sonicwall with externally incoming VLANS (as internet connection?). Maybe you don’t use DHCP, but set it static, anyhows…

Hope this helps you,

cheers.

 

 

Posted in News | Comments Off on Use a Sonicwall directly on Telfort glass fiber VLAN using a virtual interface.

mstsc credSSP error and client reg fix

CredSSP and mstsc authentication gives some error sometimes, after installing some needed updates, but e.g. youir server is not yet up to date.

You can set back a reg entry… this one:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters]
"AllowEncryptionOracle"=dword:00000002

On the client, save it to a file with .reg extension, as tekst, and double click add to registry, you may need some rights for this.

You can now use mstsc again to your unpatched server, for a while.

Hope this helps.

Posted in credssp, fix, mstsc, News, registry | Comments Off on mstsc credSSP error and client reg fix

Exchange 2010 removing active sync devices, as removing devices hangs for the user in OWA.

Hiyall,

Today at an old server for a customer, a user wanted to finally add one last active sync device, but he already had some listed. Time to remove some, he thought, as he can do this through ye olde owa page. But that process seemed to hang.

Hence the question came to me.

We all love powershell, so we first get a list of the devices this user uses, with this command:

Get-ActiveSyncDevice -Mailbox USER |select Identity, DeviceOS, DeviceType, DeviceModel, Name

Where USER is the alias for the mailbox.

You can then use the cmd Remove-ActiveSyncDevice to remove the device on -Identity, such as:

Remove-ActiveSyncDevice -Identity "domain/org/users/Username and Lastname/ExchangeActiveSyncDevices/phone§%some%number%" -Confirm:$false

Repeated this for all his excess devices, problem solved.

Note that “-Confirm:$false” is not the same as “-Confirm $true”. It can be a little confusing as times. Note the “:”

Hope this may help you,
Cheers!

Posted in Exchange 2010 | Tagged , | Comments Off on Exchange 2010 removing active sync devices, as removing devices hangs for the user in OWA.

Local Exchange Management [power]Shell target info

This is the ‘target’ of a locally installed MS Exchange Management [power]Shell.

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noexit -command ". 'D:\Exchange\bin\RemoteExchange.ps1'; Connect-ExchangeServer -auto -ClientApplication:ManagementShell "

(witih exchange installed on D-drive locally)

Just FYI, I needed this today.

cheers.

Posted in News | Comments Off on Local Exchange Management [power]Shell target info

Convert wav to wav from 8bit to 16bit with ffmpeg cmdline for 3cx from NEC SV8100

Today I had to convert audio messages from a NEC pbx to the format a 3cx pbx uses.
These are the digital audio intro messages etc. that you get when you call e.g. the main telephone number of a company.

They were in the wrong format, and in such state, 3cx does not eat it.
From the NEC we got 8 bit 1 channel (mono) PCM files.
3CX accepts only 16 bit one channel (mono) PCM. Sample rate on both is 8k.

Don’t we love ffmpeg. Fixed!
I have an virus-unchecked exe for windows here if you like, just remove extension .file after download 🙂

Next cmd will fix this: welkcome123.wav was the audio file retrieved from the NEC SV8100.

ffmpeg -i welcome123.wav -acodec pcm_s16le -ac 1 -ar 8000 welcome123-16b.wav

See, it made the file approx twice the size 🙂
Not strange when you make 8 bits into 16 bits….

Input #0, wav, from 'welcome123.wav':
 Duration: 00:00:12.29, bitrate: 64 kb/s
 Stream #0:0: Audio: pcm_alaw ([6][0][0][0] / 0x0006), 8000 Hz, mono, s16, 64 kb/s
Output #0, wav, to 'welcome123-16b.wav':
 Metadata:
 ISFT : Lavf57.51.100
 Stream #0:0: Audio: pcm_s16le ([1][0][0][0] / 0x0001), 8000 Hz, mono, s16, 128 kb/s
 Metadata:
 encoder : Lavc57.58.100 pcm_s16le
Stream mapping:
 Stream #0:0 -> #0:0 (pcm_alaw (native) -> pcm_s16le (native))
Press [q] to stop, [?] for help
size= 192kB time=00:00:12.28 bitrate= 128.1kbits/s speed=7.52e+003x
video:0kB audio:192kB subtitle:0kB other streams:0kB global headers:0kB muxing overhead: 0.039681%

NEC manual here if you like to see how that works.

I hope it may help you as well. Maybe not. who knows.
Have fun!

 

Posted in 16bit pcm, 3cx, 8bit pcm, ffmpeg | Tagged | Comments Off on Convert wav to wav from 8bit to 16bit with ffmpeg cmdline for 3cx from NEC SV8100