IT

New Year 2016 Resolutions

Posted on by Adam Fowler

New Years Resolutions aren’t something I normally do. I don’t like the idea of using an excuse of something arbitrary such as the year change to start or stop something.

In this case though,  it’s the catalyst for a few things that have been bouncing around in my mind for a while – maybe that’s the case for others too?

(As an aside this is my first blog post I’m writing straight from mobile… Swype these days gets the WPM count closer to what I can do on a keyboard which is less frustrating :) )

In the order that I think of them, here are some things I’d like to change:

1. Be more personal in what I do (selectively).

I guess I do this a little bit,  and put my own flair on blog posts and tweets – but in my mind it’s still very reserved. A technical ‘how to’ I’m happy with my current methods, but I’ve previously taken a rather non-personal approach I believe.
One of the reasons this has come front of mind is due to the roundabout way @thisaintrachel’s blog post was written. I really enjoyed reading the personal side, and without going back to my own write up, i’m sure it was nowhere near as personal as I could have made it.

That doesn’t necessarily mean I’ll write more posts that way, but when I do I’ll put more into it. Same applies to Twitter.

2. Get less caught up in particular individuals or situations.

This one plagued me in the later half of 2015, but it’s definitely happened plenty of times in my life.
There will be someone or something that irks me in what they say or how they act, and I’ll just focus on it too much. It will rattle around in my brain with over analysis.

What I need to do instead is just ‘let it go’ (I hope we are all mentally singing that now). Put it down to just “that’s how that person is” and continue on. I don’t know why certain scenarioa bother me so much, but I know I have an inner sense of righteousness that becomes irritated at certain times. Especially if it’s someone i regarded highly!

I know all that is vague, but the few who know me well probably have heard at least one story where I’ve either confided in a frustration, or got in trouble for getting carried away on trying to “right a wrong” where I should have just given up (if you’re that curious, feel free to ask me privaely!). The intetions are always good, and it’s not even a ‘choose your battles” thing as I already turn a blind eye to many frustrations…

3. Be more positive

This is one that I’ve already been trying, but there is room for improvement. I like having a positive mantra, but it is so much easier (and often funnier) to take a swing at something instead.
I’ll continue those funny swipes (at least in my mind they’re funny) and Twitter is a great platform for that… but it shouldn’t go any further, and should be shared around.
Again I’m not too bad for this, only the very rare situatuonal anti-Apple tweet is made, but I’m going to make more of an effort on the positive side.
I love receiving encouragement, and usually it’s just as meaningful from a random follower as it is froms someone you interract with frequently… so I shall give this more of a conscious shot.

A lot of positive things have happened out of the Twitter tech community for me, and I want to continue this on and pass it onto others.

4. Get more involved in communities

The wheels are slowly turning on this – I did a brief of the Microsoft Ignite conference two User Groups in December, but I really should do more.

And, I know I’m capable. I still need to relax in front of a group of people, but it’s an aquired skill. I know I’m not bad at it (I have previously done things like MCing a quiz night, and will be MCing a wedding!). I’ve had a lot of support in doing this too from different people Ive spoken to – family, friends and people in the tech community – so I really should put some effort in to making this happen. (I’m making a point of not calling people out in this big post – those call outs will happen more personalised and when things happen, or I’ve already done it).

There were several inspirational people at Microsoft Ignite AU 2015 that either directly or indirectly gave me an extra nudge too – and those actions I’m taking on board to try and do the same.

This also flows onto having more interractions with others – I’ll put more of an effort into this one too, and feel free to call me on it!

5. Helping others
I already do this one a lot, so really it’s a ‘continue on’ for number 5. It’s a big part of my job as well as online persona, so I hope (and actually believe) people see and appreciate it. Not that I’m doing it for recognition of helping of course – but recognition does serve as a gague that you’re doing it right.

6. Do more writing

I enjoy writing so I need to do more. It died off a lot in 2015, as it was replaced by my awesome little son and a lack of sleep (if you want photos then just find me on facebook!)

He is getting better at sleeping, so this should give me a bit more time to get back into it. Some paid, some blog posts. I’m still selective on what I choose to write about, I won’t take a paid gig on something that either doesnt interest me or is too far out of my personal experiences and kmowledge – but I could easily find more work if I wanted it. Luckily this is just on the side to my main job, so ‘more work’ isnt that much :)

I still dont think it’s something I’d want to do full time, but I have seen others make very successful careers from several online techy persuits, so maybe one day. Definitely not 2016!

I can’t tell how much I’ve written on WordPress for Android so I’ll just call it there. I do care what others think so if you have any feedback for me I’d love to hear both positive and constructive criticisms – either comment here or privately let me know however you find me :)

Hope you all have a positive and enjoyable 2016 and please say “hi”!

Logon and Logoff Security Event Viewer Auditing

Posted on by Adam Fowler

Update 30th July 2022 – TechNet links no longer work, but updated the script link to a github copy.

Original post:

Logon and Logoff events for a PC running Vista or above are logged to the Security section of Event Viewer. If you’re looking for a particular event at a particular time, you can browse through manually with a bit of filtering in the Event Viewer GUI and find what you need.

On a larger scale though, this doesn’t make sense. If you’re looking at multiple users or multiple events, the task gets tedious very quickly.

Logon and Logoff events on a domain will be logged against the closest domain controller, but unless you’re piping these logs elsewhere (which I briefly talked about here on Tech Target), the DC’s logs will quickly fill up and cycle off. Also, the user may have authenticated against multple DCs, or other scenarios such as an offline laptop user first logging in locally before being on the network.

A PC keeping only it’s own security logs will go back a lot further (over a month hopefully!) so there’s a lot of data to obtain.

There’s an older Microsoft Technet article that covers this briefly called Tracking User Logon Activity Using Logon Events which has some useful information, includoing the Event IDs:

Logon Event ID 4624
Logoff Event ID 4634

Now, you can filter the event viewer to those Event IDs using Event Viewer, but you can’t filter out all the noise around anything authenticating to and from the PC you’re investigating.

One way of doing this is of course, PowerShell.

There are two commands I found for this – Get-EventLog(link now dead) and Get-WinEvent(link now dead). I used Get-Eventlog as it seemed to be a bit easier to get the data I needed…. but I couldn’t get it exactly to work.

Then I read this Technet article – PowerShell Get-WinEvent XML Madness: Getting details from event logs (link now dead) which backed up what I was experiencing, such as “The bad:  All of a sudden reading event logs gets complicated.  The filtering in particular requires some crazy syntax.”

This all started to get too hard, and I couldn’t get my head around the code or get it to work!

Finally, I found someone who’d created a very nice script that did everything I wanted: Security Log Logon/Logoff Event Reporter

The script doesn’t need any parameters to run, just asks for which PC, date range, if you want to only see failed logins (which I don’t for this scenario), and then how to display the information.

pshell

Sometimes it takes a lot of research and time to just use someone else’s script and be done with it :)

Update:
As @GirlGerms pointed out, many people just lock their workstation rather than logging off/on. In that case, these are the two Event IDs:

Workstation Locked Event ID  4800
Workstation Unlocked Event ID  4801

The script I found doesn’t include these, but appears very easy to adjust to see those results too. None of this works if the person doesn’t lock their PC, and never logs off so it’s hardly an all encompassing method.

Lync is Experiencing Connection Issues with the Exchange Server

Posted on by Adam Fowler

We are still running Lync 2010 server and client, so I’m not sure if this is an issue in later versions (or Skype For Business now) – but this problem still occurs in the most patched versions of Lync 2010.

lync

The error “Lync is Experiencing Connection Issues with the Exchange Server” can be caused by many things. The Bytemedev wesbsite lists a lot of common client corruption type solutions to get around the problem.

Checking Lync client logs didn’t help much, and Lync connectivity in Configuration Information just showed an issue in connecting to EWS without any helpful details.

For my case (which has come up more than once), those fixes weren’t the issue. Another blog post got me onto the right track from NetworkAdminSecrets around having a corrupted contact. Lync will fail if it doesn’t like all the contacts in someone’s Contacts – and this includes the Suggested Contacts!

contact

Above is the bad contact I found. Often it won’t like an Asian or European character, but this time it was a space (or some other symbol that’s just being represented by a space). It wasn’t even the saved address, it was the display name. This single record caused the problem.

The painful method I used to find the record was first to scroll through the entire list, looking for a weird character. Since I couldn’t find one, I then moved half of the contacts out, and seeing if the Lync client still complained after a logout/login. Repeating this processed kept narrowing down the contacts until I was left with a few, and could find what I was looking for.

Deleting or fixing the contact was all that was needed to resolve the issue!

Movie Ticket Competition for Australia! Merry Christmas :)

Posted on by Adam Fowler

Just running a quick 7 day competition for 2 free movie tickets in Australia to see how it goes.
I’ve got a few tickets I won’t get time to use in the month before they expire, so happy to send them to someone who wants them!
Comment on this post, then fill in the form. No sharing of page or anything else required!

Email address used to contact winner only, no signups to anything else unless you tick the option to do so.

Prize is:

2 Standard HOYTS Unrestricted Adult e-Cine Gift

Pass admission to a movie of your choice to enjoy

at HOYTS Cinemas across Australia

Expiring 13th January 2016.

Hoyts Movie Ticket Giveaway

 

Update 19th Dec 2015
The winner has been drawn! Congrats Chris L – tickets have been emailed. For those wondering, the draw was done automatically by gleam.io which is what you’re seeing in the widget. All I did was click the button to draw it :)

KB3114409 Causes Outlook 2010 to run in Safe Mode

Posted on by Adam Fowler

Appears to be a bad patch from Microsoft.

KB3114409 dated December 08 2015 has caused many users to only be able to launch Outlook in Safe Mode.

If you need to roll back, I wrote this recently on ‘Rolling back from a bad KB Update‘

Feel free to comment on your experience with this KB, I’ll update this post with any other information I find.

I also found this forum thread on Windows TenForums about the issue.

 

Update 10th December 2015:

Thanks for all the comments – glad it’s helped you all out. We’ll see if the patch gets reissued. Rehash of some of the details below:

Webmaster advises: This is being sold as an improvement: “Adds administrative support to prevent Outlook 2010 from booting into safe mode. Administrators set this function in some scenarios when they have add-ins that must be enabled.”

This technet article contains the key you can modify to stop Outlook going into Safe mode.

Alexej Kucher advises that: On a 64 bit machine with 32 Bit Outlook you have to create following registry key:
HKLM\Software\Wow6432Node\Microsoft\Office\14.0\Outlook\Security\ DWORD: DisableSafeMode = 1

Wayne DeJulia advises that the command to uninstall is: msiexec /package {90140000-0011-0000-0000-0000000FF1CE} MSIPATCHREMOVE={14CDCBF7-3CCC-42E2-A5BB-2D4926E16FAA} /qn /norestart

boozydaboozer  advises: Looks like Microsoft has removed KB3114409 from Windows Update.

 

Update 6th Jan 2016
I’ve noticed clients keep getting prompted to uninstall this, so once your desktops are all unpatched, you will have to decline the update.