No mapping between account names and security IDs was done!

Sunday morning and I am busy setting up a SQL 2008 R2 in a VM but get this error message when trying to add in my service accounts, I checked and double checked the accounts, passwords etc with no luck and then wondered was it something to do with the fact that I had cloned these Virtual machines?.....

I then ran psgetsid.exe on my SQL server and DC and found the problem... duplicate machine Sids :'(

Moral of the story is always use sysprep before cloning a VM :)
which is really obvious when you think about it, oh well...

Firefox Profiles for home and work

Just a quick one about firefox profiles..... I wanted a way to get to all of my work related bookmarks at work and from home without mixing them with my personal ones. Here's how to do it:

create 2 new shortcuts as follows:
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -P WorkProfile -no-remote
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -P HomeProfile -no-remote

set up the new "Sync" feature in Firefox 4 and your all done! :)

vbma92a1.sys

So I was looking at another infected laptop *sigh*......

This one was redirecting web traffic to all sorts of places and stopping processes such as rootkit revealer, process explorer dead in their tracks. Since I couldnt see nothing obvious in services, the run key or Task manager I suspected a driver based rootkit... and I was right :)

I looked in system32\drivers and noticed a file called vbma92a1.sys that was dated a few days ago so I renamed it to .old and it recreated itself on next reboot, aha!

I then booted into an offline environment and deleted it and created a dummy vbma92a1.sys file in its place, denying everyone and everything access to it.

Upon rebooting all of my tools now worked :)

just gotta give it a quick scan with something other than what is installed and it should be good to go ;)

hope this helps!

Automatically Merge SCCM Conflicting Records

I have just stumbled upon a very promising looking post by Jörgen Nilsson, in it he shows how to have SCCM automatically merge conflicting records using a combination of a vbs script and a status filter rule, check it out!

Auto merging SCCM conflicting records

Powershell script to monitor for idle CPU then put computer to sleep

Good evening, I have been working on a little powershell script and thought I would post it as it might come in handy for others.
Basically my laptop stays on 24/7 (its tucked away in a corner and runs DNS, DHCP,Downloads and that kind of thing). What I want to do is if nothing is downloading on it overnight then I want it to sleep. I use JDownloader to auto download files for me overnight which has the auto extract (unrar.exe) feature built in too. Take a look at the script you will see it looks for unrar.exe and if that isnt running checks the cpu usage of jdownloader (javaw.exe) if it is below a certain value 5 times then the powershell script calls a batch file and the laptop sleeps.
When it hits 7am a scheduled task (to ping localhost) wakes it up again, nice huh? :)

Anyway enough babbling heres the script:

####### SCRIPT START #######
[int]$ProcessorInactive = $null

do {if(($ProcessorInactive) -le 5)
{
Write-host "ProcessorInactive is less than 5"
do {if(($ProcessActive = Get-Process unrar -ErrorAction SilentlyContinue) -ne $null)
{
Write-host "unrar is active"
$ProcessAlive = "SomeValue"
Start-Sleep -Seconds 900
}
else
{
Write-host "unrar isnt active"
$Process = Get-Counter -Counter "\Process(javaw)\% Processor Time"
$Sample = $process.Countersamples[0]
$CpuTime = $Sample.CookedValue
$CpuTime = ($CpuTime/2)

do {if(($CpuTime) -gt 3)
{
Write-host "CpuTime is higher than 3"
Start-Sleep -Seconds 10
$Process = Get-Counter -Counter "\Process(javaw)\% Processor Time"
$Sample = $process.Countersamples[0]
$CpuTime = $Sample.CookedValue
$CpuTime = ($CpuTime/2)
}
else
{
Write-host "CpuTime is less than 3 now"

}
}
while ($CpuTime -gt 3)
#clear this variable else we will loop forever
$ProcessAlive = $null
$ProcessorInactive++
Start-Sleep -Seconds 30
}}
while (($ProcessAlive) -ne $null)
}
}
while ($ProcessorInactive -le 5)
echo "********VERY END OF SCRIPT NOW DO WHAT YOU WANT HERE*******"
cmd /c """H:\powershell\Sleep.bat"""
####### SCRIPT END #######

And if anyone wants to know the contents of "sleep.bat" are:
rundll32.exe powrprof.dll,SetSuspendState

Note: Aside from the obvious you may have to change this part:
$CpuTime = ($CpuTime/2)
to the number of cores you have (my laptop has 2) as the cpu usage is a total of all cores
Thanks for reading and hope it helps someone! :)

EDIT: I have since changed the cputime percentage for javaw.exe to 1 to see if this improves the script. I think that with it set to 3 the script is sometimes catching the usage below 3% 5 times and sleeping even though there are downloads left so altering this value should help. The 2 parts you need to change are line 21 & line 36

16TB limit on NTFS Volume!

I have been working on upgrading my server (Areca-1230) with 12x2TB drives and hit a volume/partition limit at 16TB.

I stuck the 12x2TB drives in a RAID5 (could have used RAID 6 but its sloooooow!) and discovered I couldnt create a partition in windows server 2008 R2 larger than 16TB without using the format /A command. This basically allows you to specify your own cluster size and as you can see from the following link, certain cluster sizes limit your ability to create certain size volumes (see David Shens reply):

Clicky!--->Cluster Sizes<----Clicky!

The moral of this blog post is, before you create a monster volume double check your cluster size otherwise (as I found out) you wont get very far!

Of course you could just have a few smaller volumes running from one giant raidset but wheres the fun in that?
Thanks for reading :)

THE way to fix "Attention! Your web page request has been cancelled"

wow this one is persistent! and if you have seen it you know what im talking about. No amount of scanning with mbam, comboxfix any antivirus software can fix this.

However...
boot into recovery console, log on to your windows installation and type "fixmbr" and all of your problems will go away,
Phew! this one *almost* made me reinstall the computer in question but persistance on my part paid off.
Please leave a comment and say thanks if this helped you :)