Guys,

Just wanted to share this little trick that I am using to backup my USB when inserted, if I want to, still have the choice because it pops up.

1. Create an Autorun.inf on the root of the key/drive

Add the following code in the file
[autorun]
ICON=fcw.ico
ACTION=Backup this USB key
OPEN=BACKUP.BAT
LABEL=Joe Blog Key
includeRuntimeComponents=True

2. Add an icon of your choice
So your key comes up with a good looking icon when browsing, mine is called fcw.ico (Copy at the root or any subfolder , but path reference must be in the Autorun.inf)

3. Create a batch file called “BACKUP.BAT”. Create at the root (Or anywhere else, but path reference must be in the Autorun.inf

Add the following in this file.

@echo off
cls
echo ========================================
echo AUTOMATED USB KEY/DRIVE BACKUP
echo.
echo THIS WILL CREATE A DUMP OF YOUR DATA TO:
echo C:\USBBACKUP
echo.
echo DO YOU WANT TO CONTINUE?
echo ========================================
pause>nul
cls
xcopy "*" "c:\usbbackup" /E /R
echo.
echo Your data has been backed up
echo Thank you
echo.
echo Press any key to continue
pause>nul

That’s it, enjoy

HTH

Tags: automatic, backup, key, usb

This only applies to file-system anti-virus type. This does not apply to Forefront Security for SharePoint since this application only scans for malware on download/upload operations at the HTTP level

The following list is based on the following Microsoft article: KB952167 plus some additions of mine.
List of exclusions:

Program Files folder
C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\Logs
C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\Data\Applications
C:\Program Files\Microsoft Office Servers\12.0\Bin
C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\Data\
(This is for the index server. If the index is handled on another partition, please exlude this location too)

Documents and Settings folder
C:\Documents and Settings\All Users\Application Data\Microsoft\SharePoint\Config
C:\Documents and Settings\the account that the search service is running as\Local Settings\Temp\
C:\Documents and Settings\ServiceAccount\Local Settings\Application Data
(ServiceAccount = Account for SharePoint services or application pool identities)

C:\Documents and Settings\ServiceAccount\Local Settings\Temp
(ServiceAccount = Account for SharePoint services and application pool identities and SharePoint Search service account)

Windows folder
C:\Windows\Temp\WebTempDir
C:\Windows\system32\LogFiles
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\
C:\Windows\Temp
(Disable real-time anti-virus scanning on this folder when performing a SharePoint 2007 installation or upgrade)

HTH

Michael Riva

Tags: anti-virus, exclusion, forefront, moss, sharepoint

In a Enterprise type MOSS architecture it is good practice not to have the Central Admnistration installed on the Frontend servers because it reduces the attack window by having lesser ports and services available.

However in some situations you might need it to be installed on all the MOSS servers. Recently for example I came across Symantec AV for MOSS and an issue arose immediately after its installation. As a requirement, this AV product from Symantec requires the Central Admin to be installed on all the servers. And as a matter of fact Symantec was unable to proceed with documents scan if the Central Admin was not deployed in the Farm on all servers.

It took me some time to figure out how to install the Central Admin afterwards once MOSS is installed. As far as I have seen, there is no way to use the Setup wizard to install it. The option is unavailable.

So there you go, here is the command and options you need to use if you want to install it on a MOSS server without affecting the current configuration.

psconfig.exe -cmd adminvs -provision -port 8080 -windowsauthprovider onlyusentlm

There you go, the new Central Admin site installed output from the command line console on your existing MOSS server (Frontend or Application server)

if you have an issue after that and the site is unable to start, use the following command

stsadm -o provisionservice -action start -servicename WSS_Administration -servicetype  Microsoft.SharePoint.Administration.SPWebService

HTH

Michael Riva

Tags: 2007, administration, afterwards, central, moss, sharepoint, site

Interresting security event where Eugene Kaspersky will be speaking.

Join Kaspersky Lab on the 17th September 2008 for its 5th Cybercrime Forum. Supported by guest of honour Eugene Kaspersky, Co-Founder and CEO of Kaspersky Lab, this half day informative and interactive forum on cybercrime will deliver an in-depth view of the issues and challenges businesses face today and the steps to take to protect business IT systems and workforces. The event includes a complimentary networking lunch…

The full story here

Eugene Kaspersky

Tags: cybercrime, event, kaspersky, london, september

I was working on a Content Deployment architecture while on a customer site. The idea was to publish content from a staging server to a live server, both environments separated by a serie of firewalls. So the question really was:

What port(s) do we actually need to open to achieve this?

I have been searching the web for an answer. I could not find any. I found many references to the ports from different sources such as:

Link 1
Link 2

So I was pretty sure we needed SQL Access, NTP (For timestamp on articles), file share access, etc. But I was wrong to base my opinion on some blogs/forums…

The answer was actually lying in this Technet document:
Hardening for content publishing section
http://technet.microsoft.com/en-us/library/cc262834.aspx

But with the customer we decided to run a test with also Wireshark in the background on both staging and live servers. For sure, with a network sniffer, we would have a straight answer.
We were actually surprised that content deployment uses a single destination port: The Central Administration port, in our case 14495. That is all we needed to open. And plus the traffic is unidirectional. From the staging server, to the live server.
We noticed the source server (Staging) was using random ports, in the range of 3xxx and that the data was always sent using 14495.

HTH

Michael Riva

Tags: content deployment, firewall, hardening, port, sharepoint