The solution was to use PowerShell, which is an extremely effective scripting tool for Windows, especially if you come from a UNIX shell background.

There is actually quite a lot of documentation available for it and rather than go into detail I will simply show you the script:

#
# RenameDirectoryFiles.ps1
#
 
param( [string[]]$paths )
Set-PSDebug -Strict
 
foreach ( $path in $paths ) {
    if ( !(Test-Path $path -PathType Container) ) {
        Write-Error "'$path' doesn't exist or isn't a directory"
        exit 1
    }
 
    $i = 0
    Get-ChildItem $path | sort FullName | foreach {
        $tmp = "{0:000}" -f $i
        $ext = $_.Extension
        $newname = "$path - $tmp$ext"
        Rename-Item $_.fullname $newname
        $newname
        $i = $i + 1
    }
}

So the usage is extremely simple:

RenameDirectoryFiles.ps1 'My Directory'

After which all the files under ‘My Directory’ will be renamed to ‘My Directory – 000.fileextension’.

Strange what goes through the brain of MS Business Productivity.

Polish Alternative

English Alternative

So the first step is relatively simple, access the Event Log and look for a single event by its event code.

set objWMIService = GetObject("winmgmts:\root\cimv2")
set colEvents = objWMIService.ExecQuery _
   ("Select * from Win32_NTLogEvent Where Logfile = 'System' and EventCode = 10")

What we did here was grab all the events with event code of 10 (a print job!). So if we count the number of events within a range then we will have basically completed a huge part of the work.

So next step is to make an interval that will be 15 minutes back from whatever time is current.

set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
dtmStartDate.SetVarDate DateAdd("n",-15,Now()),True

And applying that into our statement:

set colEvents = objWMIService.ExecQuery _
   ("Select * from Win32_NTLogEvent Where Logfile = 'System' and EventCode = 10" _
   & " and TimeWritten >= '" & dtmStartDate & "'")

This means that we are now collecting the events that only occurred within the last fifteen minutes. So what next, well we need to have a statement to pass to BigBrother to indicate success or failure. Fortunately enough I have another script which monitors the cluster (thanks to the awesome DeadCat repository) and it has some code to help place the file that BigBrother collects.

const HKLM = &H80000002
strBBExtPathNew = "SOFTWARE\Quest Software\BigBrother\bbnt\ExternalPath"
strBBExtPathOld = "SOFTWARE\BigBrother\bbnt\ExternalPath"
set oReg = GetObject("winmgmts:\root\default:StdRegProv")
 
oReg.GetStringValue HKLM,strBBExtPathNew,,strExtPath
if isNull(strExtPath) then
  oReg.GetStringValue HKLM,strBBExtPathOld,,strExtPath
end if
if isNull(strExtPath) then
  WScript.Quit
end if

So now we have the path to put our file in, all we need to do now is write the file and add two simple checks to see that the time is within work ours (9-5).

On Error Resume Next
 
strState = "green Printing was active within the last 15 minutes"
strBBFileName = "print"
intEventCode = 10
 
' Find out where to put the BB log files
const HKLM = &H80000002
strBBExtPathNew = "SOFTWARE\Quest Software\BigBrother\bbnt\ExternalPath"
strBBExtPathOld = "SOFTWARE\BigBrother\bbnt\ExternalPath"
set oReg = GetObject("winmgmts:\root\default:StdRegProv")
 
' Check for the BB External Path, new then old otherwise quit
oReg.GetStringValue HKLM,strBBExtPathNew,,strExtPath
if isNull(strExtPath) then
  oReg.GetStringValue HKLM,strBBExtPathOld,,strExtPath
end if
if isNull(strExtPath) then
  WScript.Quit
end if
 
' Get Computer name
set WshNetwork = WScript.CreateObject("WScript.Network")
strComputerName = WshNetwork
 
' Prepare file
set fso = CreateObject("Scripting.FileSystemObject")
set f = fso.OpenTextFile(strExtPath & "\" & strBBFileName, 8, True)
 
' Run between 9 - 5
if Hour(Now()) < 9 then
  strState = "green Not checking as we are outwith work hours"
  f.Write strState
  set fso = Nothing
  set f = Nothing
  WScript.Quit
end if
if Hour(Now()) > 17 then
  strState = "green Not checking as we are outwith work hours"
  f.Write strState
  set fso = Nothing
  set f = Nothing
  WScript.Quit
end if
 
' Get a date 15 minutes in the past.
set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
dtmStartDate.SetVarDate DateAdd("n",-15,Now()),True
 
' Collect the events from eventlog within the last 15 minutes
set objWMIService = GetObject("winmgmts:\root\cimv2")
Set colEvents = objWMIService.ExecQuery _
   ("Select * from Win32_NTLogEvent Where Logfile = 'System' and " _
   & "EventCode = '" & intEventCode _
   & "' and TimeWritten >= '" & dtmStartDate & "'")
 
' If no events then alert.
if colEvents.Count = 0 then
  strState = "red No print job within the last 15 minutes"
end if
 
' Output
f.Write strState
 
set fso = Nothing
set f = Nothing
WScript.Quit

Obviously you can adjust this script to monitor for any regular event and it works well on Windows 2003 and XP machines. It is at this point I thought that I was finished. Testing this script on a Windows XP machine, no issues it was doing exactly what it was meant to. However the server I was intending on running it under was a Windows 2000 server. So I was forced to make some more changes to the script to allow it to run. The changes I made unfortunately make the script slightly harder to adjust to make it work for any event.

The first change was to the statement to collect the print job.

Set colEvents = objWMIService.ExecQuery _
  ("Select * From Win32_NTLogEvent Where Type = 'information' " _
  & "and EventCode = " & intEventCode _
  & "TimeWritten >= '" & dtmStartDate & "'")

The next change I had to make was very strange, the Count method didn’t seem to exist (strange!?) so I was forced to loop to count:

' UGLY
set intCount = 0
For Each objEvent in colEvents
  intCount = intCount + 1
Next
if intCount = 0 then
  strState = "red No print job within the last 15 minutes"
end if

Those two changes allowed me to successfully monitor a single event. Same script in Linux would have taken me seconds! Anyway at least its a working model, let’s hope not a lot more requests come through for Windows issues, especially W2K ones!

Interestingly it didn’t initially work 100% of the time, after a little bit of testing it looked like Microsoft were temporarily throwing away some of the test e-mails. Interesting as it must mean that they look for repetitious e-mails in a bid to fight SPAM. We of course simply contacted MS and got it sorted and now the e-mails come in every hour.

What this does show us though, is that under UNIX/Linux there is a lot of different solutions that can be made, but sometimes you have to work with the tools that are there.

First up I checked to see that I was able to get a POP3 connection to the other domain, as it is hosted by Microsoft for us. Whilst I was able to connect via POP3 I was unable to login. A quick check revealed that only POP3S was being accepted. This meant that I was going to need to utilize the simple s_client tool available with OpenSSL.

So to testing:

$ openssl s_client -connect SERVER:995
.... blah blah ....
+OK The POP3 Service is ready.
USER test.user@example.com
^C
$

Hrmm, what’s going on here, the server isn’t responding to my USER. A quick brain check and I spotted my issue, line endings!

$ openssl s_client -connect SERVER:995 -crlf
.... blah blah ....
+OK The POP3 Service is ready.
USER test.user@example.com
+OK
PASS mypassword
+OK User successfully logged in.
STAT
+OK 49 2758446
QUIT
DONE

That’s more like it. Now I know that I can connect, logged and run arbitrary commands. It may be perfectly OK to manually check like this but that isn’t the reason we started this, we want an automated solution.

The most obvious solution here is expect, ugh TCL! With the above information it is easy to write a simple expect script:

#!/usr/bin/env expect
spawn openssl s_client -connect SERVER:995 -crlf
expect "+OK The POP3 service is ready."
send "USER test.user@example.com\r"
expect "+OK"
send "PASS mypassword\r"
expect "+OK User successfully logged on."
send "QUIT\r"
expect "DONE"
expect eof

Simple enough, send a command and expect a response. Obviously it helps if you understand the protocol that you are dealing with. Running that script happily logs in and then quits. Sweet, we are halfway there already!

So to recap, I plan on sending an e-mail from the first domain to my test account on the second domain and then check that the e-mail actually arrived. Thus proving that the e-mail was getting through without issue. So when I do this I will wish to get the newest e-mail in my INBOX, which may not the be the first. So the script needs some modifying.

#!/usr/bin/env expect
spawn openssl s_client -connect SERVER:995 -crlf
expect "+OK The POP3 service is ready."
send "USER test.user@example.com\r"
expect "+OK"
send "PASS mypassword\r"
expect "+OK User successfully logged on."
send "STAT\r"
expect -re "OK (.*) .*" {
  set number $expect_out(1,string)
}
send "TOP $number 1\r"
expect "\."
expect "+OK"
send "QUIT\r"
expect "DONE"
expect eof

Now expect will grab the number of e-mails in the INBOX and request the headers of the newest one. So the final step is integrating this with a simple check. Lets just use a shell script to check with:

#!/bin/sh
TS=`date +%s`
echo "Subject: TESTING $TS
 
Hi,
 
This is a test please do not delete me!
 
Thanks" | mail test.user@example.com
sleep 60
expect collect.exp | grep $TS && \
 echo "Success The E-Mail Arrived!" ||\
 echo "Failure The E-Mail Was Not Found!"

That works, a test and we have a success! We find the TS in the subject line of the e-mail. There is a minor problem here, what happens if I e-mail the test and in-between I receive some other e-mails, hrmm! OK so why don’t we dump the headers of the first few e-mails, we certainly don’t expect a rush of e-mails on a test account within a minute. Let’s change the expect script just a bit more:

#!/usr/bin/env expect
 
spawn openssl s_client -connect SERVER:995 -crlf
expect "+OK The POP3 service is ready."
send "USER test.user@example.com\r"
expect "+OK"
send "PASS mypassword\r"
expect "+OK User successfully logged on."
send "STAT\r"
expect -re "OK (.*) .*" {
  set number $expect_out(1,string)
}
send "TOP $number 1\r"
expect "\."
expect "+OK"
set number [expr $number-1]
send "TOP $number 1\r"
expect "\."
expect "+OK"
set number [expr $number-1]
send "TOP $number 1\r"
expect "\."
expect "+OK"
send "QUIT\r"
expect "DONE"
expect eof

Placing the shell script into a crontab and we are done. Yet another example of how simple scripting can achieve anything.

First you will need to get a hold of your Windows XP CD ready for the installation, put it into the CD-Rom.

Open up the VMware console and select File > New > Virtual Machine. This will open us the Wizard that will walk us through the installation. Click Next and then select Typical and again click Next. Select Windows XP from the list of operating systems available, you can normally leave the location as its default but remember that you need at least 8Gb (the default) per guest OS that you are installing. I normally choose a bridged network setup, with most network layouts now there is a DHCP server and its easy to add another IP to your network. You can however set it to share its IP with the host system. As you go through the next steps, selecting the defaults is normally good enough. You can tweak if you wish but I am happy to settle for the defaults. 

Once all that is complete it will make 8Gb of space available for your install. At this point you can start the guest system and it will then boot from the Windows CD. Continue as normal through the Windows install and you should wind up with a Windows XP installation.

Once it is all up and running I do highly suggest that you install VMware Tools, available by doing VM > VMware Tools. The installer should then pop up and start. You should see the VMware icon in the lower corner by the clock.

Poke around and have fun. All the other OS installs are carried out in much the same manner.

That’s it, a working XP guest installation!

First up you need to discover the storage group that your mailbox is in. This requires a quick search on an active directory server. Once you have that you can go on to create a ‘recovery storage group’ linking it to the correct storage group.

Then you start up your TSM restore and recover the storage group (we use TSM as our backup). On our setup that means that you are restoring approximately 20Gb of data. Once thats done (it can take a while), we can then mount the recovery group. At this point we are left with one of two options: copy all the mail and folders into your existing mail account effectively doubling your mail, or you can merge the contents back into your mail so only copying what is missing.

My issue is that neither of these options are really what a use wants. If we copy the mail back, then we effectively double the amount of mail that a user has. If we merge the data back, it can merge e-mails back into folders that maybe the user will not look at, thus leaving behind stray meant-to-be-deleted e-mails. Nine times out of ten all the user has lost is a single folder or a single mail.

The solution to this is to add another step into the process, extract the mailbox from the recovery group into a PST file, then merge the folder out of the PST file back into the mailbox in the main storage group. But even here there is a problem, if you don’t know the exact folder name you can’t find out what it is and therefore cannot restore it.

In reality what is needed here is a solution that allows the administrators the ability to extract individual folders within a mailbox. It is obvious that the exchange restores are built with the intent of only being used in a situation of disaster, total loss of a storage group or something similar. However almost all the restores undertaken will be for single users.

Looking back to the old method we used with exim makes this look even more silly. As there we could simply find the file representing the mail folder and restore it. Done!