Windows on Michael’s Domain

Windows changes my computers clock

Mon, 28 Aug 2017 00:00:00 +0000

If I am not mistaken, Windows is the only OS, that uses local time for the system clock (instead of UTC). This means that in multiple boot configurations, every restart of the system into Windows will screw up the system time. In order to reset it (in Ubuntu 16.04), usesudo timedatectl set-timezone Etc/UTC

Unicorn 7-Benutzer-Einrichtung erfordert manuelle Intervention in einer Netzwerkbenutzer-Umgebung

Fri, 17 Jun 2016 00:00:00 +0000

Unicorn, Äkta Avant, Äkta Explorer, GE Healthcare, Windows, Netzwerk-Authentifizierung, Benutzer-Einrichtung, Methode, Resultat, Wissenschaft, ProteinaufreinigungSince we are operating our Äkta Avant in a multiuser environment, we need to separate the methods and results of the different users. By default, every network user is at the moment able to see every method and every result that has been generated on the machine by any other network user. This is a considerable privancy and security issue as a malicious user could delete (or even worse: modify) methods and results.Our Äkta is set up in a way that allows users to log into the Unicorn 7 computer with their university login/password via the regular Windows network authentication mechanism. However, if several people share the responsibility of a run, this setup becomes impossible as they would need to devulge their passwords to each other. Hence we have created a local account which can be used by users who wish to share the operation of the Äkta.After logging into Winodws, users still have to log into the Unicorn 7 software, which users do with their university login and password (“Windows authentication”). Using this setup, every user is able to see all methods and results, which is not acceptable.When setting up a new user with Unicorn version Access>Folders") and exactly which folders were accessible by that user and the user would see only his/her own methods and results. Since the folder structure under Unicorn 5 was a folder structure of the Windows file system, users could always copy methods and results from one folder to another and thereby make them available despite the limitations set by the Unicorn 5 program.When I first read that Unicorn 7 supports Windows network authentication, I had hoped that we would be able to avoid the painful user setup which we had to go thru for each user on the Äkta Explorer. However, the pain continues as setting up the user privileges once for a group doesn’t give us user isolation.Firstly, one cannot restrict access of individual users in Unicorn 7, but only access of groups. We had to create one Access Group for each network user, add the network user to this group, create a separate home folder for the group and then restrict the folder access to this home folder. Hundreds of clicks were required for a handful of users since the default is no access to anything and every single privilege check box needs to be enabled except for the admin privileges.In that respect, Windows (and every other OS) is way smarter than Unicorn. If a university employee logs into a machine that he or she has never been logging into before, it creates all the necessary default local folder structure automatically and mounts that users private home folder without granting access to everything other employees have been doing on that specific machine. I think that should be an option on Unicorn as well. Maybe it is and I just can’t figure it out?Another big drawback of the above described method of separating each user into an own access group is that login into the Unicorn program becomes a major ordeal: In addition to writing user name and password the user has to select the correct access group for the login to be successful. And even worse: In our setup we cannot avoid that every university employee belongs to two access groups: A manually created access group for each user for user separation and the “default” which works via the Windows network authentication - maybe Kerberos?). Hence, if users do choose the default access group (which is called “Users” in our case), they are able to log in, but they don’t see their methods and results.There are two reasons we cannot delete the “Users” access group: One is the mandate of the faculty and secondly (and we have tried), we cannot delete it anymore as many people have already created methods and generated results being in the access group “Users”. Thus UNICORN prevents us from deleting this account. I am working on this problem: I should be able to access directly the underlying MS-SQL database in order to change the ownership of the methods and results. However, GE was not exactly forthcoming when I was asking about access right handling. The answer was:The DB access credentials in a standalone UNICORN solution are encrypted and are not public. If you had an enterprise solution (hosting your own (SQL server) DB) you would have control of the credentials and in theory you could extract the wanted information (the format is something that you have to figure out by yourself and is not supported by us). You can upgrade your solution to an enterprise if you want.This sounds worse than it is, because we have physical access to the MS-SQL server and pulling out the access credentials seems not very difficult. But it takes my time to find the exploit to “break into our own system” and that is what annoys me. However, according to Lisa Bromark from GE, the 7.0.2 update seems to correct this issue:UNICORN can be configured to use a new database password. It is possible to generate an encrypted password or to enter an already encrypted password. This is done by running the UNICORN Service Tool after UNICORN installation.However, it is unbelievably difficult to get the update (at least it seems to take weeks). Distribution is apparently still via optical media and snail mail. I think the last time I got myself software via a CD/DVD was more than 10 years ago. However, GE told me that they are just moving UNICORN software updates to “electronic distribution”. Welcome to the 21 century!

BSD and Linux

Fri, 10 Jun 2016 00:00:00 +0000

I am used to the fact that a Linux installer honours a pre-existing install of Windows and offers to setup the computer with a dual-boot option during installation. Vice-versa no Windows installer honours any other pre-exisiting OS. Therefore I was surprised that when I tried to install Ubuntu 16.04 on my PFSense box (FreeBSD), the Ubuntu installer did not even see that a BSD install exists on the drive. I chose the “erase all” option, but when I rebooted after the installer has finished, the system went straight into PFSense without giving me any option to select Ubuntu. I guess the boot loader had not been touched by the Ubuntu installer. I booted from a live Ubuntu USB stick, reformatted the drive with fdisk and wrote zeros to the boot loader:dd if=/dev/zero of=/dev/sda bs=512 count=1Then I repeated the install and everything was fine. However, my PFSense installation was lost…

Unicorn 7 user separation requires manual intervention in a network user environment

Mon, 09 May 2016 00:00:00 +0000

Since we are operating our Äkta Avant in a multiuser environment, we need to separate the methods and results of the different users. By default, every network user is at the moment able to see every method and every result that has been generated on the machine by any other network user. This is a considerable privancy and security issue as a malicious user could delete (or even worse: modify) methods and results.Our Äkta is set up in a way that allows users to log into the Unicorn 7 computer with their university login/password via the regular Windows network authentication mechanism. However, if several people share the responsibility of a run, this setup becomes impossible as they would need to devulge their passwords to each other. Hence we have created a local account which can be used by users who wish to share the operation of the Äkta.After logging into Winodws, users still have to log into the Unicorn 7 software, which users do with their university login and password (“Windows authentication”). Using this setup, every user is able to see all methods and results, which is not acceptable.When setting up a new user with Unicorn version Access>Folders") and exactly which folders were accessible by that user and the user would see only his/her own methods and results. Since the folder structure under Unicorn 5 was a folder structure of the Windows file system, users could always copy methods and results from one folder to another and thereby make them available despite the limitations set by the Unicorn 5 program.When I first read that Unicorn 7 supports Windows network authentication, I had hoped that we would be able to avoid the painful user setup which we had to go thru for each user on the Äkta Explorer. However, the pain continues as setting up the user privileges once for a group doesn’t give us user isolation.Firstly, one cannot restrict access of individual users in Unicorn 7, but only access of groups. We had to create one Access Group for each network user, add the network user to this group, create a separate home folder for the group and then restrict the folder access to this home folder. Hundreds of clicks were required for a handful of users since the default is no access to anything and every single privilege check box needs to be enabled except for the admin privileges.In that respect, Windows (and every other OS) is way smarter than Unicorn. If a university employee logs into a machine that he or she has never been logging into before, it creates all the necessary default local folder structure automatically and mounts that users private home folder without granting access to everything other employees have been doing on that specific machine. I think that should be an option on Unicorn as well. Maybe it is and I just can’t figure it out?Another big drawback of the above described method of separating each user into an own access group is that login into the Unicorn program becomes a major ordeal: In addition to writing user name and password the user has to select the correct access group for the login to be successful. And even worse: In our setup we cannot avoid that every university employee belongs to two access groups: A manually created access group for each user for user separation and the “default” which works via the Windows network authentication - maybe Kerberos?). Hence, if users do choose the default access group (which is called “Users” in our case), they are able to log in, but they don’t see their methods and results.There are two reasons we cannot delete the “Users” access group: One is the mandate of the faculty and secondly (and we have tried), we cannot delete it anymore as many people have already created methods and generated results being in the access group “Users”. Thus UNICORN prevents us from deleting this account. I am working on this problem: I should be able to access directly the underlying MS-SQL database in order to change the ownership of the methods and results. However, GE was not exactly forthcoming when I was asking about access right handling. The answer was:The DB access credentials in a standalone UNICORN solution are encrypted and are not public. If you had an enterprise solution (hosting your own (SQL server) DB) you would have control of the credentials and in theory you could extract the wanted information (the format is something that you have to figure out by yourself and is not supported by us). You can upgrade your solution to an enterprise if you want.This sounds worse than it is, because we have physical access to the MS-SQL server and pulling out the access credentials seems not very difficult. But it takes my time to find the exploit to “break into our own system” and that is what annoys me. However, according to Lisa Bromark from GE, the 7.0.2 update seems to correct this issue:UNICORN can be configured to use a new database password. It is possible to generate an encrypted password or to enter an already encrypted password. This is done by running the UNICORN Service Tool after UNICORN installation.However, it is unbelievably difficult to get the update (at least it seems to take weeks). Distribution is apparently still via optical media and snail mail. I think the last time I got myself software via a CD/DVD was more than 10 years ago. However, GE told me that they are just moving UNICORN software updates to “electronic distribution”. Welcome to the 21 century!

What corresponds to the Windows ipconfig /all command in Linux?

Sat, 26 May 2007 00:00:00 +0000

I think /sbin/ifconfig displays at least the ip address, the hardware address and the subnet mask and some other stuff. But not much about anything else like DHCP or DNS addresses…

Loosing your Windows softly

Fri, 25 May 2007 00:00:00 +0000

I have two hard drives and the partitioning is as follows:hda1 120 GB/dev/hda1 100 MB Linux ext3 /boot/dev/hda2 95 GB Linux ext3 /home/dev/hda3 1 GB Linux swap/dev/hdb4 Extended partition/dev/hdb5 17 GB Linux /hdb1 32 GB/dev/hdb1 100 MB Linux ext3 /boot/dev/hdb2 1 GB Linux swap/dev/hdb3 Extended partition/dev/hdb4 12 GB NTFS Windows2000/dev/hdb5 18 GB Linux reiserfsBoth boot partitions had grub installed (there used to be an old Linux Red Hat 7 install on hdb1). The bios was set to use the first hard drive (hda1) to boot. In order to boot Windows 2000, one needs apparently a Windows-written MBR (master boot record), which is to my understanding something like a hidden partition which is in any case the first partition of any drive (something like hda0). Since there was never Windows 2000 installed on hda1 (is was put later into the machine and put into the bios boot priority first), there was also no Windows 2000-like MBR written into its MBR. The other hard drive (hdb) has a Windows install (Linux was installed later), so there must have been a functioning Windows 2000-like MBR. That MBR most likely was destroyed at some time. This distruction did not happen during the first Linux Red Hat 7 install, as after that one could still boot into Windows 2000 via grub. It must have occurred later somehow (maybe during a grub update?). Then I put the 2nd hard drive in, installed Red Hat 9 and during this install the Red Hat installer put the second grub install onto its boot partition, which did contain a Windows entry (as I specified during the Red Hat 9 installation). Booting into Windows 2000 (which was on the other hard drive) was still possible. But as I never used to boot into Windows (I started to use vmware and then wine), I just recently realized that the Windows entry in the grub.conf had disappeared. Consequently I couldn’t boot into Windows anymore. I entered manually the Windows entry like everywhere advised:title Windows 2000rootnoverify (hd1,1)chainloader +1But no go. I always received an error (Error 13 invalid device). I thought I had chosen the wrong partition and tried all possible partitions from (hd1,0) to (hd1,5). Still no go. Although the error messages were different. For the:/boot partition (hd1,0): Grubloader error 25linux /home (hd1,1): Error 13 invalid or unsupported executable format linux swap (hd1,2): Error 12 invalid device extended partition entry (hd1,3): no error occurred, but I was thrown into the grub menu of the boot partition of the 2nd hard drive linux / (hd1,4): Error 12 invalid deviceany other (higher) partition that wasn’t present (e.g. hd1,5): Error 12 invalid deviceSo I booted with the Windows 2000 installation CD and tried to fix the the MBR of hdb. I went into the manual repair section and typed the fixmbr command. There was a warning: “This operation modifies your partition table and could render all your data on the hard drive inaccessible”. I had no choice, so I did it. It didn’t help. At least not much. Once thing improved, however: when I swapped the drives (made hdb the master and hda the slave and gave in the BIOS boot priority to the new master, I could boot into Windows 2000. That was already some improvement. However, I still couldn’t boot into Windows 2000 via grub. So I booted again with the Windows 2000 installation CD and executed another “dangerous” command: FIXBOOT. This was the end of my Windows. After that I couldn’t boot into Windows at all. I always received the error: ntldr is missing (NT loader is missing). I still managed to use this Windows 2000 installation together with VMware, but otherwise there was no possibility to boot it up. The Microsoft Knowledge Base Article 318728 describes many possible solutions to the “ntldr is missing” error, which I tried all, but without any positive results. Microsoft apparently admits, that this error is unrecoverable in some instances as the last method to rescue such a situation is: “Perform a Parallel Installation of Windows 2000 and use the Windows Explorer to copy the data you want to recover”.

Running wine from a real windows install

Wed, 23 May 2007 00:00:00 +0000

I thought wine might run better from a real windows install. So I resized my partitions to free some 8 GB space. Unfortunately the partitioning software was not really great as I lost one of my partitions (the one where I had stored all of my downloads…). So I decided to go for a clean start and formatted the whole hard disk. First I partitioned the disk using cfdisk. Then I installed Windows98 from the installer CD onto the FAT32 partition, after that Windows2000 from the installer CD to another FAT32 partition (I wanted to install WindowsXP, but the installer CD refused to boot my computer). After that I reinstalled Suse 9 and copied back my home folder from my backup disk. So far wine works fine (after some minor adjustments in $home/.wine/config and mounting the Windows98 partition withmount -t vfat -o uid=jeltsch,gid=users,fmask=644,dmask=755 /dev/hda1 /media/win98Without giving the uid, gis, fmask and dmask options you won’t be able to write anything to the partition.

Duplicating Macintosh-formated (hfs and hfs+) CDs under WindowsXP with Nero Express

Mon, 21 May 2007 00:00:00 +0000

Although a standard Windows XP Professional OS cannot read (= mount) Macintosh-formatted CDs (neither hfs nor hfs+), the burning program Nero Express can duplicate such CDs!

BSPlayer and corrupted DivX files

Sun, 20 May 2007 00:00:00 +0000

I have a couple of scratched CDs with DivX video files. Both VLC and DivX Player were not able to play these files beyond the first corrupted frames. They tried to resume, but because the damage was too much, they did get stuck completely. But I found a player that handles most of these problems quite well: BSPlayer . It is only available for Windows though…

Windows NT, network browsing, mounting and disconnecting from network drives (command netuse)

Thu, 05 Apr 2007 00:00:00 +0000

Network browsing in Windows is a mystery. Sometimes some computers simply don’t show up when browsing a network. This seems to be especially true for Linux servers. Under newer versions of the Windows OS (2000, XP), you can connect to a server (if you know its IP adress) via the mount network drive command even though the network browser cannot see that server. Windows NT doesn’t have that option. The only possibility is to use the “net use” command from the command line. This is uncomfortable, although one can make .bat files for frequently used connections. The command is: net use * \\ip-adress\username The asterisk assings the share to the next available drive letter (of course you can assign manually to e.g. H:). To delete this specific network drive type: net use H: /delete Actually, even if you can browse and connect without needing the command line, you need the command line always when you want to disconnect a share from an NT server. Funnily Windows NT has no other way but to type netuse * /delete In some discussion threads it was mentioned, that one should switch on WINS support in the Linux server’s smb.conf file wins support = Yes. If you connect to Linux, make sure that Samba is running and that the user to whose home folder you want to connect to has an entry & password in the smb database (this is NOT preconfigured even in Suse 9.2): as root: smbpasswd -a username It didn’t help me, though. MacOS X computers (10.3) show up now without problems (older MacOS X versions also had problems). Maybe I should compare the smb.conf files or just copy it over to my Suse 9.1.

Converting Mac text files into UNIX text files (tr)

Wed, 04 Apr 2007 00:00:00 +0000

If you though text files are all the same, you are wrong. Mac text file lines end with a carriage return (CR, ASCII 13), UNIX text file lines with a line feed (LF, ACII 10) and Microsoft Windows text file lines end with a combination of 2 characters: CR followed by LF. From Mac to Unix you convert with this command line: tr '\015' '\012' out_file

How to take screenshots in Windows XP without any additional software

Wed, 04 Apr 2007 00:00:00 +0000

Press the PrtSc button (somewhere near PageUp/Down) to capture the whole screen and Alt PrtSc to capture the active window only. Then Open Paint (from Programs, Accessories), paste and save.

smbclient (mount, Windows XP, SFS, file sharing)

Wed, 04 Apr 2007 00:00:00 +0000

Since I always use some GUIs, I don’t really remember anymore how to connect to a Windows machine via the command line. smbclient -L windowshost shows you the shares that are available. Often, you you cannot browse them without a login/password for that windows machine, therefore you need to type smbclient -L windowshost -U username And occasionally the netbios name doesn’t work either and you need to replace it by the IP address.

Windows XP and deleting files with invalid filenames (The system cannot find the path specified)

Wed, 04 Apr 2007 00:00:00 +0000

I was fighting for several days to delete a file in Windows XP that started with dot underscore (.). The message was always: “The system cannot find the path specified”. Nothing worked. No safe mode, no command line, no special syntax. The Microsoft Knowledge Base addresses the problem, but instead of pointing to an easy solution it gives lots of useless and even wrong information , e.g the Windows XP Resource Kit didn’t contain the RM.EXE program, that was supposed to be able to delete those files with “weird” file names. Finally I found a software called Delete FXP Files , that did the job for me. However, how on earth did Windows manage to created such a file in the first place if its file name is invalid? The dot underscore . comes obviously from Macintosh, but in any case Windows must have allowed the creation of that file…