PCS-SF TECH BLOG

There are excellent tools to suck out data from an IMAP store like GMail and into an Exchange DB, this entry does not address these.  Check out Anderson Patricio’s excllent article on MSExchange.org entitled Migrating from POP/IMAP to Exchange Server 2007 using Microsoft Transport Suite.

For our purposes we are going to assume a small amount of users (less than 50) with data scattered about Google Apps.  In this case I feel it makes the most sense to migrate the individal bits of each Google Apps account directly and individually, that way you can be sure of getting EVERYTHING.

Google Apps migration:  http://www.google.com/support/a/bin/answer.py?hl=en&answer=100458

Gmail Migration -
Update MX records to point to new server or Cloud SPAM filter IP
Enable POP
Change POP settings in the individual account to download ALL pop mail and delete from server when downloaded
Configure Outlook 2007 for each account http://mail.google.com/support/bin/answer.py?answer=86374
Download all email to a PST and place this PST with full name.pst on each users C drive
Export Contacts as an Outlook CSV http://mail.google.com/support/bin/answer.py?hl=en&answer=24911
Export Calendar as an iCal/iCS http://www.google.com/support/calendar/bin/answer.py?answer=37111
Configure Outlook for Exchange per user
Import PST, CSV & ICS into new Exchange Outlook profile
Google Documents migration:
http://docs.google.com/support/bin/answer.py?answer=165320
Each user will have to have their google docs downloaded individually.

AVG Anti-Virus is a very well built AV system for Windows based PC’s.  They have a large variety of AV products but by far their most popular is their free (for personal use) edition, “AVG Free” which averages over 2 million downloads a week on CNET.

A major complaint (and one of the ways AVG will try to get their free users to upgrade to their pay version) is that in order to upgrade versions (they will stop updating old versions regularly rendering your PC unprotected) you must uninstall the old (soon to be unsupported version) and download/install the next free version manually.  The only way to upgrade directly is to pay for the next version. This causes endless confusion not to mention a dizzying array of “your protection will soon expire!” pop-ups on your computer.

The following is a guide to “upgrading” your AVG 8.X Free Edition to AVG 9.X Free Edition and was written for Windows XP users.  The same basic principals apply for Vista and Windows 7 users only the control panel lingo is changed.

1.    Close all open applications.
2.    Remove AVG Free 8.X:  Start Menu -> Add/Remove Programs -> Highlight AVG Free 8.X -> Click “Change/remove”.
3.    Accept defaults and uninstall the applications.
4.    Reboot the computer
5.    Open a browser to http://download.com and search at the top for “AVG free”
6.    Look for AVG Anti-Virus Free Edition 9.X.XXX (9.0.704 as of this writing) (careful not to pick the wrong AVG download here, there should be over a million downloads in the last week) and choose “download now”
7.    Save or run the file directly to begin installation.
8.    During installation, make sure to choose the button that installs “basic free protection” and not the recommended comprehensive protection which is free for thirty days.
9.    Accept the license agreement and choose “standard insallation” (close the browser you used to download AVG 9.X)
10.    Do not choose to install the AVG Security Toolbar.
11.    When prompted to optimize scanning, choose to “wait until the first scheduled scan starts”.
12.    This completes the “upgrade” to AVG 9.X.

PCS is pleased to announce a new hosted solution for small business clients, PCS-SF.NET.

In the past, when a company was getting started, they would need to budget for personal computers, peripherals, printers, networking equipment, backup software / hardware, licensing and SERVERS.   We have just expanded our San Francisco data center to include the following services, available to all clients, new and existing.

• SharePoint 2007 server.  Host all your data in the cloud accessible securely via SSL on SharePoint.
• Exchange 2007 server.  Get away from POP3 or your companies expensive internal Exchange server and get hosted email with standard 5GB allowances per mailbox.
• Blackberry Enterprise Server.  Wireless sync your calendar, contacts and of course, email.
• Terminal server.  Does your office run applications that still require an old fashioned LAN?  You can fool these legacy applications with a dedicated or shared terminal server from PCS-SF.NET.

Once an agreement is in place, we offer a fixed rate migration service and you will never have to worry about changing backup tapes or purchasing new server hardware again.

PCS-SF.NET is monitored 24 hours a day and includes a 24 / 7 / 365 support agreement with live a technician answering our local number every time.

Contact gabe@pcs-sf.com with inquiries for new service.

Common scenario:  Client is ready to upgrade their small business server to new hardware but doesn’t want to spend 20 hours in labor for the migration.  One method to avoids long migration paths, and this really only works for sites with fewer than 15 employees and a fairly simple directory security structure is to install a fresh active directory domain on the new hardware and create identical user accounts.  The only real roadblock to this is that the computers need to be joined to the new domain, thus causing people to lose their important Windows profiles.  Avoid this by following these steps:

1. Find the correct Profile Path:  Start -> Run -> CMD and press enter.  Type: SET USERPROFILE
2. Write down the correct profile path join the computer to the new AD domain
3. Login as the user on the new domain
4. Log out and Login as Administrator
5. Give the user local administrator rights
6. Go to Registry (Backup Registry first before making any changes)
7. HKEY_LOCAL_MACHINE->SOFTWARE->MICROSOFT->WindowsNT->CURRENTVERSION->PROFILE LIST
8. Expand the Profile List Folder
9. Find the Previous Profile Path of the user from the old domain (Example:  %SystemDrive%\Documents and Settings\John Doe)
10. Once you find the correct profile path double click on ProfileImagePath and copy the path
11. Look for new profile path usually it has the domain name next to it (Example:  %SystemDrive%\Documents and Settings\John Doe.NEW_AD_DOMAIN_NAME)
12. Double click on the ProfileImagePath again and paste the Profile that you just copied
13. Reboot the computer

Bandwidth.com normally does not require nor want your SIP registrations via username and password; the exceptions being SwitchVOX and Altigen PBX’s (don’t ask me why).  So let’s get started.

• Browse to your SwitchVOX:  https://ipaddress/admin and login
• System Setup Menu -> VOIP Providers sub-menu
• Choose Add New SIP Provider
• Enter in your account ID and password, set the DTMF mode to RFC2833, see screenshot below:

• bandwidth.com supports the PBX controlling your caller ID so set this to whatever you want in the advanced options panel
• Set the provider Codecs to ULAW
• Configure your firewall for SIP traffic
• Configure outgoing call rules to use the SIP provider you’ve just configured and test

Symantec EndPoint installs it’s database at  C:\Program Files\Symantec\Symantec Endpoint Protection Manager\db by default.  If you’re operating with a system volume that’s running tight on space (remember when Dell was shipping Windows 2003 servers with a 12GB system partition?) then you might need to move the DB.  Here are the steps I took to do so with as little pain as possible*:

1.  Create the directory structure:  D:\symantec_DB\db

2.  Stop Symantec Embedded DB Service (dbsrv9.exe)

3.  Copy the sem5.db file to new directory.

4.  Backup registry

5.  Open attached registry file and ensure new DB path matches the directory structure you created in step 1

6.  Run the registry file *

7.  Start the Embedded DB Service

8.  Log in to the management console, log out

9.  Delete old sem5.db file

*  If you decide to follow this path, you will need the registry file referenced in steps 5 and 6 — leave a comment and I will get it to you.

EDIT 3/21/2009:  Folks have emailed about the registry file, so I’m going to post their contents below.  Copy the text and save it in notepad as FILENAME.reg, then run the file.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ASANYs_sem5\Parameters]
“Parameters”=”-c 64m -ch 64m -gp 8192 -gc 30 -gr 30 -o \”C:\\Program Files\\Symantec\\Symantec Endpoint Protection Manager\\db\\out.log\” -oe \”C:\\Program Files\\Symantec\\Symantec Endpoint Protection Manager\\db\\err.log\” -os 1m -gn 80 -n Kedar \”D:\\Symantec_DB\\db\\sem5.db\” -n sem5 -sb 0 -x tcpip(localonly=yes;port=2638)”

I recently had a client who was getting a bounce message when sending email to a particular recipient.  The bounce message was:

“The message was rejected because it contains prohibited virus or spam content”

Seems simple enough.   A quick check of the sending servers IP address on http://www.mxtoolbox.com/blacklists.aspx yielded no results so I started to investigate the recipients email server.

nslookup -q=mx clientdomain.com

redactedt.com        MX preference = 0, mail exchanger = smtp.secureserver.net

secureserver.net is owned by GoDaddy / I asked my colleague to check the senders server logs and verified that the NDR was being generated from secureserver.net.

It turns out, and this is where it gets interesting, I could send email to through secureserver.net without a signature but as soon as I included a signature it bounced, claiming once again “The message was rejected because it contains prohibited virus or spam content”.  How could that be?  The signature contained a hyperlink to the clients website, which is hosted with fatcow, which was on the RBL list.  So GoDaddy’s secureserver.net is going as far as checking the hyperlinks inside the email message against blacklists and rejecting outright.

I got fatcow, as the owner of the IP in question, to get their IP removed from the blacklist and all was well in the world again; but outright rejecting messages that contain hyperlinks to blacklisted IP addresses seems a bit heavy handed to me — I can see marking the message as suspected SPAM, but deliver an NDR off the bat?  Whoa!

If you have a self install kit shipped to your client site, and would prefer not to mess with the ridiculous “installation CD”, follow these steps:

1. Plug in the DSL modem and your laptop to the Ethernet port.  You should have green lights across the board.Figure out your IP address and the IP address of your DSL modem, the Motorola will be http://192.168.1.254.
2. Browse to the modem’s web page, and go to Advanced / Connection Configuration.
3. Enter the following for username and password:  U = attreg@att.net / P = attreg.
4. Open a new browser tab and browse to http://144.160.11.35/register — currently redirecting too:  (https://attreg.att.net/CDSLRegWeb/CDSLRegController).
5. You will need to know the DSL phone number to create a new PPPOE username to associate to the account, write down all the security questions and answers and obviously the username and password you have chosen.
6. Enter in the new PPPOE username and password on the modems configuration page and or configure your router.
7. Document everything and get the heck out of there!

As the market for high speed business class circuits gets more and more competitive, office and IT managers have been shopping around for better deals on broadband.  We’ve had several clients move to Ethernet over copper circuits from XO Communications — up to a 1000Mbps! While that’s obviously overkill for your 15 user CPA office, the 10Mbps line is not out of the question.

Having configured several of these circuits lately, and suffered through XO’s “cutomer care” in the process, I thought I would put up some basic tips to get you started:

• I know this sounds basic, but you will need a router between the XO device and your network, you can’t just pop your Cisco ASA on the other side and expect this to work.
• You need to configure the line speed of the outside facing interface on your router to be 10Mbps full duplex for the 10Mbps circuit.  This cannot be set to Auto - Auto.

XO will provide a cut sheet that specifices your “WAN” IP’s and what they call your useable “LAN” IP’s.  Configure your useable WAN IP Address on the outside interface of your router, the first useable IP Address of your LAN block as the inside interface of your router and configure your firewall to use this IP Address as your default gateway for your firewall.