Windows | Breek Een Been

Nac Getting in Control of Your Mab Enabled Clients

Fri, 25 Mar 2011 19:11:08 +0200

It has been a while since I wrote a paper about the implementation of NAC. Now almost a year later it is finally in progress of implementation. One of the most time consuming processes and error sensitive ones is the adding of MAC addresses to the Active Directory of devices which doesn’t support Dot1X. Unfortunately there are a lot of devices which don’t speak Dot1X or having troubles with it. So if you want to do it right (IMO) you put these devices in different categories (and subnets) so you can put ACL’s on it (MAC spoofing can be easily done). At this moment we have three different categories within MAB authentication, which may grow in the near future; Thin clients, Printers and temporarily devices. To keep an clean view of all these MAC addresses in the AD I categories these MAC address in different OU’s, so I have three different OU’s which represent the different devices. We use Microsoft NPS server as Radius server and unfortunately you can’t (at least I didn’t find it) use the OU as a hit for a rule. So you also need to make three groups in which you place the MAC addresses (these are user objects in the AD). You also want to delete the “Domain User” group from the MAC address. Otherwise people would be able to login with MAC address on you domain members. So there you have already three different steps to just add one MAC address.

Add the MAC address to the right OU.
Add the MAC address to the right group.
Delete the group Domain Users (to accomplish this, set the other group as primary.)

This isn’t a problem, but if you have to add MAC addresses regularly, this is quiet annoying and you easily forget one of those steps. Another thing you might consider is that most of the time MAC addresses are added by other persons, it would be nice if you give them a tool which makes it easier for them and less faulty. To accomplish this I wrote a Powershell script (actual my first one, so be nice :-) ). This scripts draws a simple menu where a user simply can add or delete a MAC address. Since we in the same project move the printers to DHCP (reservations) I also added this option.

Below you find the powershell script, make sure the users have rights to the right OU in the AD, in the example it is “Network Access” and also give them rights on the User folder in the AD, otherwise the “Domain Users” group can’t be deleted (Took me almost an hour). If you also want to use the DHCP functionality, make sure they have rights there too. The script makes use of Quest “ ActiveRoles Management Shelf”, so this one needs to be installed. I tried to translate all the Dutch comment, to English and I also filled the variables with fictional values. If you have any comments or improvements, please let me know. Since it is my first powershell script, I’m sure there are.

# =============================================================
#	 NAAM: nac_menu.ps1
#  AUTEUR: Rob Maas
#   DATUM: 21-03-2011
# COMMENT: Adding/deleting MAC addresses to the AD for MAB.
# =============================================================

#[ GENERAL ]
# DHCP Settings
$dhcpServer 		= "DHCPSERVER1"
$dhcpScopePrinters 	= "192.168.1.0"

# Apparaat specifieke eigenschappen
$printer 	= @{"Name" = "Printer"; `
		       "OU" = "ou=Printers,ou=MAC,ou=Network Access,ou=corporation,dc=domain,dc=com"; `
		       "GRP" = "NA_Printers"}
$thinclient	= @{"Name" = "Thin Client"; `
		       "OU" = "ou=Thin Client,ou=MAC,ou=Network Access,ou=corporation,dc=domain,dc=com"; `
		       "GRP" = "NA_Thinclient"}
$temporary = @{"Name" = "Temporarily device"; `
		       "OU" = "ou=Temporarily,ou=MAC,ou=Network Access,ou=corporation,dc=domain,dc=com"; `
		       "GRP" = "NA_Temporarily"}

#[ MENU Declaration ]
# MAINMENU
$mnuMainTitle = "NAC Menu"	#Title
# Name
$mnuMainItems = @((0..4),(0..4))	#Dummy values
$mnuMainItems[0][0] = "Add MAC address"
$mnuMainItems[0][1] = "Delete MAC address"
$mnuMainItems[0][2] = "Add printer to DHCP "
$mnuMainItems[0][3] = "Delete printer from DHCP"
$mnuMainItems[0][4] = "Exit"
# Corresponding functions
$mnuMainItems[1][0] = {ShowAddMacMenu}
$mnuMainItems[1][1] = {DelMAC}
$mnuMainItems[1][2] = {AddPrinterToDHCP}
$mnuMainItems[1][3] = {DelPrinterFromDHCP}
$mnuMainItems[1][4] = {Exit}

#ADDMAC MENU
$mnuAddMacTitle = "Add MAC address"
$mnuAddMAC = @((0..3),(0..3))
#Name
$mnuAddMac[0][0] = "Add Thinclient"
$mnuAddMac[0][1] = "Add printer"
$mnuAddMac[0][2] = "Add temporarily device"
$mnuAddMac[0][3] = "Main menu"
#Corresponding
$mnuAddMac[1][0] = {AddMac $thinclient}
$mnuAddMac[1][1] = {AddMac $printer}
$mnuAddMac[1][2] = {AddMac $temporarily}
$mnuAddMac[1][3] = {ShowMainMenu}

#[ -- SCRIPT -- ]
#Methods in alphabeticall order

function AddMac{
	param($device)
	$address = GetMac;
	#New device
	Write-Host "Give in the" $device["Name"] "name: " -NoNewline
	$name = $Host.UI.ReadLine()
	New-QADUser -Name $address -UserPassword $address `
		-DisplayName $address `
		-LastName $address `
		-FirstName $address `
		-UserPrincipalName $address `
		-Description $name `
		-SamAccountName $address `
		-ParentContainer $device["OU"]
	#Unable to change password
	Set-QADUser -Identity $address -PasswordNeverExpires $true | Out-Null
	#Add to right group and delete "domain users" group
	Add-QADGroupMember -Identity $device["GRP"] -Member $address | Out-Null
	Set-QADUser -Identity $address -ObjectAttributes @{PrimaryGroupID=(Get-QADGroup -Identity $device["GRP"]).PrimaryGroupToken } #| Out-Null
	Remove-QADGroupMember -Identity "Domain Users" -Member $address #| Out-Null
	Write-Host "Account is created !!!" -ForegroundColor Yellow
	#If it is a printer, add to DHCP?
	if ($device -eq $printer){
		$dhcp = Read-Host "Add the printer to DHCP? (Y|N) ?"
		if ($dhcp -eq "y") {AddPrinterToDHCP $name $address}
	}
	if (Again) {AddMac $device} else {ShowMainMenu}
}

function Again{
	$again = Read-Host "Again (Y|N) ? "
	switch ($again){
		"Y" {return $true}
		default {return $false}
	}
}

#Add printer to DHCP
function AddPrinterToDHCP{
	param($name, $address)
	if (($address -eq $null) -or ($name -eq $null)){
		$name = Read-Host "Printer name: "
		$address = GetMac $false
	}
	$ip = Read-Host "The IP address of the printer (192.168.1.0)?"
	Write-Host "Printer: `t $name"
	Write-Host "IP: `t`t $ip"
	Write-Host "MAC: `t`t $address"
	$ok = Read-Host "Are the above details correct (Y|N|X = Menu) ?"
	switch ($ok){
		"y" {
			 Invoke-Expression -Command "netsh dhcp server $dhcpServer scope $dhcpScopePrinters add reservedip $ip $address $name" | Out-Null
			 Invoke-Expression -Command "netsh dhcp server $dhcpserver scope $dhcpScopePrinters set reservedoptionvalue $ip 012 STRING $name"
			 if (Again) {AddPrinterToDHCP} else {ShowMainMenu}
			 break}
		"n" {$name = $null
			 $address = $null
			 AddPrinterToDHCP
			 break}
		"x" {ShowMainMenu
			 break}
	}
	$name = $null
	$address = $null
	if (Again) {AddPrinterToDHCP} else {ShowMainMenu}
}

function DelMaC{
	$address = GetMac $false $true
	$delete = Read-Host "Are you sure, you want to delete $address (Y|N) ? "
	switch ($delete){
		"y" {Remove-QADObject -Force -Identity $address | Out-Null
			 Write-Host "$address verwijderd!" -ForegroundColor Yellow
			 if (Again) {DelMac} else {ShowMainMenu}
			 break}
		default {ShowMainMenu
				 break}
	}
}

function DelPrinterFromDHCP{
	$address = GetMac $false $true
	$ip = Read-Host "The IP address of the printer (192.168.1.0)?"
	Write-Host "MAC Adres: `t $address"
	Write-Host "IP Adres: `t $ip"
	$ok = Read-Host "Are the above details correc (Y|N|X = Menu) ?"
	switch ($ok){
		"y" {
			 Invoke-Expression -Command "netsh dhcp server $dhcpServer scope $dhcpScopePrinters delete reservedip $ip $address"
			 if (Again) {DelPrinterFromDHCP} else {ShowMainMenu}
			 ShowMainMenu
			 break}
		"n" {$address = $Null
			 DelPrinterFromDHCP
			 break}
		"x" {ShowMainMenu
			 break}
	}
}

function DrawMenu{
	param($menuItems, $menuTitle, $menuPosition)
	$fgColor = $Host.UI.RawUI.ForegroundColor
	$bgColor = $Host.UI.RawUI.BackgroundColor
	cls
	$l = $menuItems[0].Length - 1;
	$menuWidth = $menuTitle.Length + 8
	Write-Host "`t" -NoNewline
	Write-Host ("*" * $menuWidth) -ForegroundColor $fgColor -BackgroundColor $bgColor
	Write-Host "`t" -NoNewline
	Write-Host "*   $menuTitle   *" -ForegroundColor $fgColor -BackgroundColor $bgColor
	Write-Host "`t" -NoNewline
	Write-Host ("*" * $menuWidth) -ForegroundColor $fgColor -BackgroundColor $bgColor
	Write-Host ""
	Write-Debug "L: $l MenuItems: $menuItems MenuPosition: $menuPosition"
	for ($i = 0; $i -le $l; $i++){
		Write-Host "`t" -NoNewline
		if ($i -eq $menuPosition){
			Write-Host " $($menuItems[0][$i])" -ForegroundColor $bgcolor -BackgroundColor $fgColor
		} else {
			Write-Host " $($menuItems[0][$i])" -ForegroundColor $fgcolor -BackgroundColor $bgColor
		}
	}
	Write-Host
}

function Exit{
	Invoke-Expression -Command "exit"

}

#Check if the given MAC address is valid.
function GetMAC{
	param([bool]$new = $true,		#Has to be new in the AD
		  [bool]$exist = $false)	#Must exist in the AD
	$mac = Read-Host "Give in the MAC address in lowercase and withouth punctuations: "
	#Check if the address has a length of 12
	If ($mac.length -ne 12){
		Write-Host "Invalid address!" -ForegroundColor Red
		if (Again) {GetMac $new $exist; return} else {ShowMainMenu; return}
	}
	If (($new) -and (Get-QADUser -Name $mac)){
		# Already exist
		Write-Host "Address already exist!" -ForegroundColor Red
		if (Again) {GetMAC $new $exist; return} else {ShowMainMenu; return}
	}
	if ((-not $new) -and ($exist) -and (-not (Get-QADUser -Name $mac))){
		#Address not found
		Write-Host "Address not found! " -ForegroundColor Red
		if (Again) {GetMAC $new $exist; return} else {ShowMainMenu; return}
	}
	return $mac
}

function Menu{
	param($menuItems, $menuTitle)
	$vkeyCode = 0
	$menuPosition = 0
	DrawMenu $menuItems $menuTitle $menuPosition
	While ($vkeycode -ne 13){
		$press = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
		$vkeyCode = $press.virtualkeycode
		Write-Host "$($press.character)" -NoNewLine
		If ($vkeyCode -eq 38) {$menuPosition--}	#Down
		If ($vkeyCode -eq 40) {$menuPosition++}	#Up
		If ($menuPosition -lt 0) {$menuPosition = $menuItems[0].Length - 1}
		If ($menuPosition -ge $menuItems[0].Length) {$menuPosition = 0}
		DrawMenu $menuItems $menuTitle $menuPosition
	}
	$($menuItems[1][$menuPosition]).Invoke()
}

function ShowAddMACMenu{
	Menu $mnuAddMac $mnuAddMacTitle
}

function ShowMainMenu{
	Menu $mnuMainItems $mnuMainTitle
}

ShowMainMenu

XNA 3D Pong

Sun, 07 Mar 2010 20:09:56 +0200

At school we got 2 XNA lessons, just to fill up our last weeks, since I hope to graduate this year. 2 lessons isn’t much, especially when you realize that that’s about 3 hours total. The last assignment of the XNA lessons was to create a simple 3D game with XNA. First I thought this got to be really, really easy, especially cause we build a 3d engine in OpenGL a year earlier. Unfortunately, it was a bit harder then I first thought. Displaying 3D objects in XNA is really easy, but creating a game with it, is a bit harder. There are just tons of tiny little things you just have to know, like a parent bone? I had never heard of it, but it is a bit essential when you create your own objects and want to use them. After all, with a lot of help from my friend called “The almighty Internet”, it seems that it is possible to create a very basic, simple 3D game in one day. Luckily for me, we have to work in pairs, so my classmate may fill in all the details :-). For those who are curious, here is the source code, but remember, I’m a complete n00b at XNA.

Ipplan Export to Import for Poller

Wed, 16 Dec 2009 19:55:04 +0200

Like many others, I also hate administrative tasks. One of these tasks that comes back again and again is IP documentation. To make my life easier and probably that of others :-), I decided to go testing with IP management software. After some googling I found IPPlan, this tool which looks very promising, can do everything I need. It manages my IP addresses and gives me a quick overview of the status, it also gives me the possibility to “poll” addresses and automatically find used ones. This feature is great, except for one little thing, you have to create a new file with all the subnets you like to poll. If you are a greedy bastard like me, you like to have all subnets polled. We have over 500 subnets and after adding them to IPPlan I wasn’t very pleased with the idea of adding them manually to the list. Luckily for me, it is very easy to make a export from IPPlan with all the subnets, unfortunately this export is not well formatted for the polling list. The exported list will look like this:

10.10.4.0 Client-Vlan4 255.255.255.0 10.10.5.0 Client-Vlan5 255.255.255.0 10.10.6.0 Client-Vlan6 255.255.255.0

The import list should look like this:

10.10.4.0/24 10.10.5.0/24 10.10.6.0/24

What I did is created a very small and simple vbscript, which will make this transition for me. You can start the vbscript as follow.

cscript ipplantopoller.vbs exportfromipplan.txt importtopoller.txt

As you maybe have already guessed the exportfromipplan.txt is the exported list and the importtopoller.txt is created by the script. You can download the script below and if you have any comments or questions please let me know, IPPlanToPoller.vbs .

Windows 7 Media Center Suprisingly Good

Sun, 22 Nov 2009 20:16:51 +0200

My parents have a mediacenter which I build for them a few years ago. My parents don’t need a lots of functions and watching TV, having an EPG, and be able to watch a dvd so now and then would satisfied them. So I installed Windows Vista MCE for them and configured it.

Unfortunately there where some issues; so now and then the sound would stutter, the tv quality was poor, and once in a year it just crashes and needed a reinstall. A reinstall would take half a day cause driver issues and setting it up as best as possible. About two months ago, it crashed again and I thought why not give Windows 7 a try.

I use Windows 7 at work since the beta and I like it (even when I’m typing this on a Linux distro). So I put in the DVD and installed Windows 7, I set the refresh rate right and started MCE. All drivers where correctly installed and even almost all OS settings where good. I run through the setup of Windows 7 and I don’t know why, the image quality was way better then in Vista. The whole GUI runs smoother, the audio was working perfectly and they are running it now for about three weeks and their first impressions are very good, hopefully it stays running this way, but for now it is definitely worth trying if you don’t want the hassle you (can) have with MediaPortal or other systems and of course are satisfied with the minimum of options and plugins you get with Windows 7.

Isa SP1 Intra Array Communications Outside Domain

Fri, 21 Aug 2009 19:52:57 +0200

I’m busy to create a nice reverse proxying environment, for this we choose the ISA 2006 server. Mainly because we have some experience with this and it should be really easy to create a High Availabilty solution. The biggest problem in our case is that the ISA servers are not member of a domain and that the ISA Configuration Storage Server is placed on a separate server in a whole different subnet. After some puzzling everything was working great, until we updated the environment to ISA 2006 SP1. The ISA server went complaining that the Intra-Array communication was broken (event id: 221225). The exact message:

For intra-array authentication when array members are in a workgroup, the intra-array account must be defined and enabled. Some features such as VPN, CARP, and reporting will not work unless the intra-array account is properly configured.

It took not really long to figure out what went wrong, but I find it worth mention it, in case someone else rans in the same situation. The problem was that the local accounts had different passwords and since SP1 wasn’t asking for the Array members password anymore it could not establish a connection. So setting the same password on the ISA CSS machine was all we had to do to fix the problem.

Mythbuntu 804 Versus Windows Media Center Vista Xp

Thu, 15 May 2008 19:16:19 +0200

As some you may have read in one of my previous posts, I really was tired of using Windows Media Center. At that moment I decided that I was going to take a look to other Media Center software. After looking around for a while and find some great projects, like Elisa and Media Portal I decided to use Mythbuntu. As you can guess a combination of Ubuntu and MythTV.

I’ve been running a dedicated HTPC for about 5 years, first with Windows XP Media Center after that I used Vista Media Center for about a year and since three weeks I’m running Mythbuntu. So I think I can give a fair opinion between Windows Media Center and Mythbuntu. It is still an opinion, so you don’t have to agree with me.

Installation

Let’s take a look at the beginning the installation. Both products have an easy to follow installation and I think everyone with a bit knowledge about computers can install both products even if you don’t have any knowledge about Linux. In my opnion both products scores equally at this point. If I really had to pick one it is going to be Mythbuntu, cause the driver installation was very very easy with the restricted driver setup.

Configuration

After the easy installation it was time for configuration of both products and I really have to say, even that I’m a bit of a Linux fan, the Windows configuration was much easier then the Mythbuntu configuration.

At first the electronic program guide(EPG) was much easier to configure in Windows, I typed in my zip-code and that was it. Because I live in the Netherlands I had to use a so called grabber to grab my guide information from the Internet and with some reading it wasn’t really hard to configure but it sure takes a lot more time than the configuration of the EPG in Windows.

Another point that was not really hard, but took me a little time to figure out was that you can use different sound systems for each plug-in, so for MythTV you can use another device than for playing music. So when I thought I had running my system I could watch TV and change the sound volume, but when I was listening to some music, I couldn’t. This was easy to solve, but I it is a bit annoying if you run a dedicated system and thought you were done with the configuration.

VGA-RGB scart, I have an old television, such thing with a really big tube at the back, so not an LCD or plasma. So to gain the best picture quality I used a VGA-RGB scart cable, but since the TV cannot display standard computer resolutions, I need to configure so called custem resolutions. F or Windows there is a tool called Powerstrip to accomplishes this, but in Linux I need to configure xorg.conf and after trying this for more than 15hours I gave up, this is so much easier to do with a graphical tool like powerstrip which let you see the effect of the changes immediately. I know, not really a fault of Mythbuntu, but I struggle more with it, then I did with Windows and Powerstrip.

Further there were some small things that could have done better, like browsing to the right media folders instead of typing the complete path.

If you read this, I guess you may think Windows will easy win this point, but that is not completely true. Mythbuntu and then especially MythTV is much harder to configure then Windows, but I think this is a side effect of all the extra possibilities that MythTV has. I think if Mythbuntu / MythTV will gain more standard users, that this is a point really need some work, for example a basic set-up and an advanced setup.

Working

Both products are stable and that is really important for a dedicated mediacenter, there is nothing such annoying as a reboot during that great film.

So here Windows forgets one big thing I don’t want to reboot my system while I’m watching a film or listening to some great music. When Windows got some automatic updates it gives me a question if I want to reboot or not. So I choose not, but after an hour or so, Windows is still going to reboot, this time without a question!

Also is the speed of Windows compared to Mythbuntu slow, I’ve a lot of albums and movies and if I want to browse through them in Windows Media Center, it is real slow especially compared to mythbuntu.

Both products have an easy to follow menu, but the interface of Vista Media Center is more smoother and dynamic than that of Mythbuntu. I think this has something to do with the themes that are available within Mythbuntu.

I also did the girlfriend and mother proof and for some reason they feel more comfortable with controlling the Vista Media Center than Mythbuntu, I guess this is caused by the smoothness of Vista.

Conclusion

After all this it is still hard for me to say which one wins and I think it has also something to do with your needs and capabilities.

Windows Media Center has some advantages if it comes to simplicity and looks. It is easy to configure and it wins the girlfriend, mother proof test. The biggest disadvantage for me were the reboots even if I said that it may not reboot also the speed and the incapability I had after replacing the motherboard is still on my mind (see my previous post), I want control about my system. Another thing I miss is the central-server (back-end) with multiple front-ends set-ups.

Windows Media Center gives you all the basic needs for a Media Center, but if you want more you still need to look for third-party plugins.

Mythbuntu on the other hand is easy to install, but can be a bit tricky to configure, the interface is a bit simple compared to Windows, but it offers a lot more features, especially the Picture in Picture function, the MythWeb plugin and the back-end/multiple front-end setup are very cool features. It also response much quicker than Windows Media Center especially when using a folder that contains a lot of music or films.

I should say if you really want control over your system and looking for some real cool features you should definatly choose Mythbuntu. If you want a simple and easy to configure system pick Windows.

For my the choice is easy I like to have control over my system and I really like the features of Mythbuntu so that’s going to be my choice even if it takes a lot more time to configure.

A small sidenode, Mythbuntu is free and so you can give it a try if you are not sure which one to choose.

Vista Is Losing It Again

Tue, 29 Apr 2008 20:33:13 +0200

I’m running a dedicated media center for more then 4 years now and I started with Windows XP Media Center Edition, this was at that moment one of the best products available for a dedicated Media Center. About a year ago I decided to update the machine to Vista Media Center (VMC), everything was fine, the update went great and I have to say VMC is an outstanding product.

But, last weekend my powersupply of the MC, decided that it was enough and he hadn’t any power left. Instead of a nice and still suicide, he decided that the mobo had to die too. So I went to a good friend of mine, to see if he had any Socket 775 motherboards and I take one home and after rebuilding the machine and booted it up. GUESS WHAT, Vista decided that it won’t boot with another mobo and also the repair function (on the bootup) decided that a new mobo was just to much. This was enough and I was very angry that there was just no way I could get around the BSOD, why do we take all this suffering from MS.

So after my laptop and desktop, Linux takes over my Media Center. I already have played around with Mythbuntu on my laptop and everything was easy to configure except for the EPG, but with some good tutorials on the net I figured it out. So now I’m going to install my MC and see what troubles I get, I’m very curious :) I already know two things I need to figure out, I’ve an old TV (no LCD or Plasma) and uses a VGA -> SCART cable to get a nice and clean view. In Windows I used powerstrip for custom resolutions. I also used AnyDVD to spindown the DVD player and I’m sure I will bump into some other problems, but I’ll keep you informed at this moment I’m just a bit tired of the Windows OS.