sample pac file

function FindProxyForURL(url, host) {

if (isInNet(dnsResolve(host), "10.0.0.0", "255.0.0.0") ||
   isInNet(dnsResolve(host), "172.0.0.0", "255.0.0.0"))
   return "DIRECT";

if ( shExpMatch(host, "*.facebook.com") )
    return "SOCKS 127.0.0.1:9000";

if ( shExpMatch(host, "*.pchome.com.tw") )
    return "SOCKS 127.0.0.1:9000";

if ( shExpMatch(host, "*.ruten.com.tw") )
    return "SOCKS 127.0.0.1:9000";

if ( shExpMatch(host, "tw.*.yahoo.com") )
    return "SOCKS 127.0.0.1:9000";

if ( shExpMatch(host, "*.blogspot.*") )
    return "SOCKS 127.0.0.1:9000";

return "DIRECT";
}

file://d:\kido.pac

hdd image for PXE boot

dd if=/dev/zero of=kido bs=512 count=20160 --> S63*H16*C20

fdisk -u -C20 -H16 -S63 kido
  c--> DOS Compatibility flag is set
  n --> p --> 1
  t --> b
  a --> 1

ms-sys -9 -f kido
losetup -o32256 /dev/loop0 kido
mkfs.msdos -F 16 -n "KIDO" /dev/loop0
ms-sys -f -6 /dev/loop0
hexedit /dev/loop0
  15h-F8
  18h-3F (S63)
  1Ah-10 (H16)
  1Ch-1Dh (3f 00)
  24h-80

cp command.com  drvspace.bin  io.sys  msdos.sys to image

losetup -d /dev/loop0

mount -o loop,offset=32256 kido hdd --> 32256 = 63*512

shrink down image size by gzip
  gzip kido
  mv kido kido.img

PXE config

  label dos

    kernel /tool/memdisk

    append initrd=/tool/kido.img harddisk c=20 h=16 s=63

mbr --> master boot record (at offset 0)

boot program (at offset 32256)

ms-sys --> http://ms-sys.sourceforge.net/

hexedit --> http://rigaux.org/hexedit.html

f2 to save

f10 to exit

ref=http://www.richud.com/wiki/Ubuntu_Create_Hard_Drive_Image

webatm plugin issue

By disabling ActiveX filtering to enable webatm activeX runs properly.

yum repository setup for yum

After invoking system-config-kickstart, system will try to pull available package information from repository.
If your machine does not have internet capability, it will hang all the time.
Simply create a local repository to /etc/yum.yum.repos.d/folder for system-config-kickstart to build package list.
Please note, repository id must be named as [base] and all system default repository config file need to be moved out of /etc/yum.repo.d to speed up package load process.
[base]
name=CentOS 5.8 x86_64
baseurl=file:///nfs/centos-5.10-x86_64
enabled=1
gpgcheck=1

gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5

copy repodata from cdrom to local drive

#cp -dpR /mnt/cdrom/repodata /nfs/centos-5.10-x86_64/

use following command to clear cache data

#yum clean all 

use following command to read package information from repository

#yum repolist

Please note, repodata folder need to placed underneath baseurl folder. 

And then you are good to go with system-config-kickstart.

non-interactive fdisk

#!/bin/sh
hdd="/dev/hda /dev/hdb /dev/hdc"
for i in $hdd;do
echo "n
p
1


w
"|fdisk $i;mkfs.ext3 $i;done 

http://xmodulo.com/2012/11/how-to-run-fdisk-in-non-interactive-batch-mode.html

speed up SSH login

1: disable UseDNS from /etc/ssh/sshd_config from remote server
2: specify authentication method when connecting --> -o PreferredAuthentications=password

smbus statement

SMBUS is disabled by default. Need to manully enable it at FD(function disable register) bit 3(count from 0 to 31). When bit is set to 1, system will disable that device, vice versa.

FD is located at RCBA+3418h in memory.
In PCH spec, FD is defined in D1Fh,F3 (device 1h,function 3)

linux pci bus rescan

After enabling smbus, PCI rescan is required to enable system to find the new added device.

echo 1 > /sys/bus/pci/rescan

all the hardware configurations can be found at /sys.

perl

This is perl, v5.8.9 built for x86_64-linux-thread-multi

Copyright 1987-2008, Larry Wall

Perl may be copied only under the terms of either the Artistic License or the
GNU General Public License, which may be found in the Perl 5 source kit.

Complete documentation for Perl, including FAQ lists, should be found on
this system using "man perl" or "perldoc perl".  If you have access to the
Internet, point your browser at http://www.perl.org/, the Perl Home Page.

[root@mytxlin51 bin]# ./perl -V
Summary of my perl5 (revision 5 version 8 subversion 9) configuration:
  Platform:
    osname=linux, osvers=2.6.9-55.elsmp, archname=x86_64-linux-thread-multi
    uname='linux dev 2.6.9-55.elsmp #1 smp fri apr 20 16:36:54 edt 2007 x86_64 x86_64 x86_64 gnulinux '
    config_args=''
    hint=previous, useposix=true, d_sigaction=define
    usethreads=define use5005threads=undef useithreads=define usemultiplicity=define
    useperlio=define d_sfio=undef uselargefiles=define usesocks=undef
    use64bitint=define use64bitall=define uselongdouble=undef
    usemymalloc=n, bincompat5005=undef
  Compiler:
    cc='cc', ccflags ='-D_REENTRANT -D_GNU_SOURCE -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm',
    optimize='-O2 -g -pipe -m64',
    cppflags='-fno-strict-aliasing -pipe -I/usr/local/include -I/usr/include/gdbm -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -D_REENTRANT -D_GNU_SOURCE -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -D_REENTRANT -D_GNU_SOURCE -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -D_REENTRANT -D_GNU_SOURCE -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm'
    ccversion='', gccversion='3.4.6 20060404 (Red Hat 3.4.6-8)', gccosandvers=''
    intsize=4, longsize=8, ptrsize=8, doublesize=8, byteorder=12345678
    d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=16
    ivtype='long', ivsize=8, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8
    alignbytes=8, prototype=define
  Linker and Libraries:
    ld='cc', ldflags =' -L/usr/local/lib'
    libpth=/usr/local/lib /lib /usr/lib /lib64 /usr/lib64 /usr/local/lib64
    libs=-lresolv -lnsl -lgdbm -ldb -ldl -lm -lcrypt -lutil -lpthread -lc
    perllibs=-lresolv -lnsl -ldl -lm -lcrypt -lutil -lpthread -lc
    libc=/lib/libc-2.3.4.so, so=so, useshrplib=true, libperl=libperl.so
    gnulibc_version='2.3.4'
  Dynamic Linking:
    dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E -Wl,-rpath,/usr/apps/perl/rhel4.x/lib/5.8.9/x86_64-linux-thread-multi/CORE'
    cccdlflags='-fPIC', lddlflags='-shared -O2 -L/usr/local/lib'


Characteristics of this binary (from libperl):
  Compile-time options: DEBUGGING MULTIPLICITY PERL_IMPLICIT_CONTEXT
                        PERL_MALLOC_WRAP USE_64_BIT_ALL USE_64_BIT_INT
                        USE_FAST_STDIO USE_ITHREADS USE_LARGE_FILES
                        USE_PERLIO USE_REENTRANT_API

acl support for glusterfs

ACL test

setfacl -m -u:kido:rw /home/

getfacl /home/

If ACL does not take effect under glusterfs, please disable stat-prefetch

gluster volume set NTCGFS stat-prefetch disable

sound device for vmware exsi

http://virtualization.blognotions.com/2011/07/27/virtual-hd-audio-hardware-in-vsphere-5/
sound.present = "true"
sound.allowGuestConnectionControl = "false"
sound.virtualDev = "hdaudio"
sound.fileName = "-1"
sound.autodetect = "true"
sound.pciSlotNumber = "34"

please note, duplicate pciSlotNumber in vmx configuration is prohibited.

linux fs monitor

with linux 2.6.13 kernel version laster

check kernel configuration

grep CONFIG_INOTIFY_USER /boot/config-`uname -r`|wc –l

and then download inotifywait package

#!/bin/sh

inotifywait -mrq -e create,delete --exclude='ast-ami|swp|swx' /tmp \

| while read folder event file

        do

                echo "${event} ${file} from ${folder}"

        done

manage windows service from Linux

net rpc|rap service  list -I kido.idv.tw -U domain\\account%password

Please note, you need to use either back slash \ or double quote " to  escape special character. If you only specify user account, you will be prompted to enter password.

linux ldap search

ldapsearch -LLL -h 172.16.1.1 -p 389 -b "dc=kido,dc=idv,dc=tw" -x -D "Kido\AD_Account" -w AD_Password -s sub '(&(objectCategory=person)(objectClass=user)(&(sAMAccountName=kidoyen) (!(userAccountControl:1.2.840.113556.1.4.803:=2))))' mail

samba conf sample

   workgroup = KIDO
   password server = ad.kido.idv.tw
   realm = KIDO.IDV.TW
   security = ads
   idmap uid = 16777216-33554431
   idmap gid = 16777216-33554431
   template shell = /bin/bash
   template homedir = /home/%U
   winbind use default domain = true
   winbind offline logon = false

#--authconfig--end-line--
;        workgroup     = ntc
        netbios name  = sambalab
        server string = This is samba server

        unix charset    = utf8
        display charset = utf8
        dos charset     = cp950
        log file = /var/log/samba/log.%m
        max log size = 50
;        security = share
        load printers   = no

[temp]
        comment    = Temporary file space
        path       = /tmp
        writable   = yes
        browseable = yes
#        valid users = %S
admin users = @"ntc\\domain users"

[kido]
        comment = Kido
        writeable = yes
        path = /home/u70604
create mask = 0770
admin users = @"ntc+domain admins"
guest ok = no

[homes]
   comment = Home Direcotries
   valid users = %S
   read only = No
   browseable = No
   path = /home/%S
   create mask = 700
   directory mask = 700
   root preexec = /usr/local/sbin/mkhomedir.sh %U %D
   inherit permissions = Yes

system-auth

auth        required      pam_env.so
auth        sufficient    pam_fprintd.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_krb5.so use_first_pass
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_krb5.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
password    sufficient    pam_krb5.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_krb5.so

password-auth

auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_krb5.so use_first_pass
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_krb5.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
password    sufficient    pam_krb5.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_krb5.so

using wmic to perform wql

wmic /node:computerName path Win32_ComputerSystemProduct get name,IdentifyingNumber/format:list replace computer name with @c:\xxx.txt, it will perform batch query.

 wmic path win32_networkAdapter where "MACAddress like '00:1F:29:89%' and DeviceID is not NULL" get * /format:list

wmic nicconfig where index= DeviceID call enablestatic("192.168.16.4"), ("255.255.255.0")

wmic path Win32_NetworkAdapterConfiguration  where index=7 call enablestatic("192.168.16.4"), ("255.255.255.0")

Google TTS API

http://translate.google.com/translate_tts?tl=zh&q={$text}&ie=utf-8

$base_url = 'http://translate.google.com/translate_tts?';
$qs = http_build_query(array(
    'tl' => 'zh',
    'ie' => 'UTF-8',
    'q' => utf8_encode($transtext)
));
$contents = file_get_contents($base_url . $qs);
file_put_contents("test.mp3",$contents);

file_put_contents($filename,$content);

file -bi file_name
iconv for charset conversion 

enable RSAT component.

RSAT
start /w pkgmgr /iu:RemoteServerAdministrationTools-Roles-AD-DS-SnapIns;RemoteServerAdministrationTools-Roles-AD-DS;RemoteServerAdministrationTools-Roles-AD;RemoteServerAdministrationTools-Roles;RemoteServerAdministrationTools

join machine to specific OU
NETDOM JOIN machine /Domain:domain [/OU:ou path]

netdom.exe need to be copied to c:\windows\system32\
netdom.exe.mui need to be copied to C:\Windows\System32\en-US\

embed msg in CDO

sample

Const cdoSendUsingMethod ="http://schemas.microsoft.com/cdo/configuration/sendusing"
Const cdoSendUsingPort = 2
Const cdoSMTPServer ="http://schemas.microsoft.com/cdo/configuration/smtpserver"
Const cdoSMTPServerPort ="http://schemas.microsoft.com/cdo/configuration/smtpserverport"
Const cdoSMTPConnectionTimeout ="http://schemas.microsoft.com/cdo/configuration/smtpconnectiontimeout"
Const cdoSMTPAuthenticate ="http://schemas.microsoft.com/cdo/configuration/smtpauthenticate"
Const cdoBasic = 1
Const cdoSendUserName ="http://schemas.microsoft.com/cdo/configuration/sendusername"
Const cdoSendPassword ="http://schemas.microsoft.com/cdo/configuration/sendpassword"
Const CdoReferenceTypeName = 1

Dim objConfig ' As CDO.Configuration
Dim objMessage ' As CDO.Message
Dim Fields ' As ADODB.Fields
Dim HtmlBody

Set objConfig = CreateObject("CDO.Configuration")
Set Fields = objConfig.Fields

With Fields
.Item(cdoSMTPServer) = "smtp.gmail.com"
.Item(cdoSMTPConnectionTimeout) = 10
.Item(cdoSendUsingMethod ) = 2
.Update
End With


Set objMessage = CreateObject("CDO.Message")

Set objBP = objMessage.AddRelatedBodyPart("d:\pwd_chg.png", "pwd_chg.png", CdoReferenceTypeName)
objBP.Fields.Item("urn:schemas:mailheader:Content-ID") = ""

Set objBP = objMessage.AddRelatedBodyPart("d:\pwd_chg_chg.png", "pwd_chg_chg.png", CdoReferenceTypeName)
objBP.Fields.Item("urn:schemas:mailheader:Content-ID") = ""

Set objBP = objMessage.AddRelatedBodyPart("d:\pwd_chg_done.png", "pwd_chg_done.png", CdoReferenceTypeName)
objBP.Fields.Item("urn:schemas:mailheader:Content-ID") = ""

objBP.Fields.Update

Set objMessage.Configuration = objConfig
'HtmlBody="
"
'HtmlBody=HtmlBody & "
"
'HtmlBody=HtmlBody & "Testing the mail"
HtmlBody=Read_Template
With objMessage
.To = "kido.idv.tw@gmail.com"
.From = "kido.idv.tw@gmail.com"
.Subject = "mail subject"
'.TextBody = "SMTP Relay Test Sent @ " & Now()
.HtmlBody=HtmlBody
.Send
End With

Set Fields = Nothing
Set objMessage = Nothing
Set objConfig = Nothing


Function Read_Template()
  Const ForReading = 1, ForWriting = 2, ForAppending = 8
  Dim fso, MyFile, FileName, TextLine

  Set fso = CreateObject("Scripting.FileSystemObject")

  FileName = "d:\pwd_notify.template"

  Set MyFile = fso.OpenTextFile(FileName, ForReading, True)
  Do While MyFile.AtEndOfStream <> True
    TextLine = TextLine & MyFile.ReadLine
  Loop
  MyFile.Close
  Read_Template=TextLine
End Function

=========================================================================================================================
Set objBP = objMessage.AddRelatedBodyPart("C:\Users\kido\Pictures\Google Talk\Leaf.bmp", "1.bmp", CdoReferenceTypeName)
objBP.Fields.Item("urn:schemas:mailheader:Content-ID") = "<1 .bmp="">"
'objBP.Fields.Update

Set objBP = objMessage.AddRelatedBodyPart("C:\Users\kido\Pictures\Google Talk\Monkey 1.bmp", "monkey.bmp", CdoReferenceTypeName)
objBP.Fields.Item("urn:schemas:mailheader:Content-ID") = ""
objBP.Fields.Update

HtmlBody="
"

setup image file name mapping first and then use the alias file name in mail content

wmi event monitoring

"select * from __InstanceOperationEvent within 1 where TargetInstance ISA 'Win32_PnPEntity' and TargetInstance.Description='USB Mass Storage Device'"


__InstanceOperationEvent
-->__InstanceCreationEvent
-->__InstanceDeletionEvent
-->__InstanceModificationEvent

ADSI query string

  Set conn = CreateObject("ADODB.Connection")
  conn.Provider = "ADSDSOObject"
  conn.Open "ADs Provider"

DomainFQDN= kido.idv.tw
DomainContainer="DC=kido,DC=idv,DC=tw"
  query_str="(&(objectCategory=person)(objectClass=user)(&(sAMAccountName=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2))))"
  ldapStr = ";" & query_str & ";adspath;subtree"
 Set rs = conn.Execute(ldapStr)

 Set objConn = CreateObject("ADODB.Connection")
 Set objRs = CreateObject("ADODB.Recordset")
 objConn.Provider = "ADsDSOObject"
 strConn = "Active Directory Provider"
 objConn.Open strConn
 strSql = "select mail from '" & DomainFQDN & "' where sAMAccountName='" & "kido" & "'"
 objRs.Open strSql, objConn, 1, 1

configure option for static binary

CFLAGS=-m32 LDFLAGS=-static

list trusted domain info

Dim objConnection, objRootDSE, objRecordSet
Dim strFilter
strFilter = "(NETBIOSName=*)"
Set objConnection = CreateObject("ADODB.Connection")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"
Set objRootDSE = GetObject("LDAP://RootDSE")
Wscript.Echo objRootDSE.Get("configurationNamingContext")
Set objRecordSet = objConnection.Execute( _ 
";" & _ 
strFilter & ";" & "NETBIOSName,dnsroot,ncname;subtree")
Set objRootDSE = Nothing
While Not objRecordSet.EOF 
WScript.Echo "NETBIOSName:" & objRecordSet.Fields("netbiosname").Value & vbTab _
             & "DNSRoot:" & join(objRecordSet.Fields("dnsroot").Value) & vbTab _
             & "CName:" & objRecordSet.Fields("ncname").Value
objRecordSet.MoveNext
WEnd

freebsd partition size expansion

1:vmdk resize --> either through command line or GUI
command line: vmkfstool -X finalsize vmdk_file

2:download lastest freebsd boot only iso file and then boot the system up from CD-ROM

3: start space expansion, if you'd like to specify space to partition, -s option is required, otherwise all free space will be assigned to target partition.
gpart show <-- info="" p="" partition="" show="">gpart resize -i 1 /dev/da0 <-- assign="" br="" free="" partition="" primary="" space="" to="">gpart resize -i 6 /dev/da0s1 <-- br="" da0s1f="" dev="" give="" space="" to="">growfs /dev/da0s1f <-- level="" os="" p="">

script to update local gpo

c:\Windows\System32\GroupPolicy\gpt.ini
c:\Windows\System32\GroupPolicy\Machine\Scripts\scripts.ini

1: add 1 to version parameter in c:\Windows\System32\GroupPolicy\gpt.ini
2: append [{42B5FAAE-6536-11D2-AE5A-0000F87571E3}{40B6664F-4972-11D1-A7CA-0000F87571E3}] to gPCMachineExtensionNames in c:\Windows\System32\GroupPolicy\gpt.ini

3:add following to c:\Windows\System32\GroupPolicy\Machine\Scripts\scripts.ini
[Startup]
0CmdLine=1233kido.vbs
0Parameters=
[Shutdown]
0CmdLine=C:\Windows\System32\GroupPolicy\Machine\Scripts\Startup\1233kido.vbs
0Parameters=

enable remoteRegistry

sc config remoteregistry start= auto

MS office default configuration

HKLM\software\Microsoft\Office\\User Settings\
REG_DWORD count=0
HKLM\software\Microsoft\Office\\User Settings\\\software\Microsoft\Office\\outlook\
REG_EXPAND_SZ ForcePSTPath=

wmi study

http://blogs.technet.com/b/heyscriptingguy/archive/2007/07/25/how-can-i-create-a-new-wmi-namespace-under-the-root-namespace.aspx?Redirected=true

http://blogs.technet.com/b/smsandmom/archive/2007/08/30/how-to-extend-your-hardware-inventory-using-the-sms-def-mof-file.aspx

http://blogs.msdn.com/b/rslaten/archive/2007/03/23/adding-custom-data-to-wmi-as-a-low-rights-user-and-having-sms-collect-that-data.aspx

wmi custom namespace/class creation/deletion via script/mof

wmi associator

1:使用WMI object browser點選要開啟的class
2:點選association tab,找出連結兩個class的associator
3:連結成功後即可query對應物件屬性

strComputer = "."
maxlen=0
Set objWMIService = GetObject("winmgmts:" & "!\\" & strComputer & "\root\cimv2")
Set colAdaptersConf = objWMIService.ExecQuery("Select * from Win32_NetworkAdapterConfiguration Where IPEnabled = True")
For Each objAdapterConf In colAdaptersConf
  set ASSOobjItem = objAdapterConf.Associators_("win32_networkAdapterSetting")
  For each objASSOobjItem in ASSOobjItem
     Wscript.Echo objASSOobjItem.NetConnectionID & " : " & objAdapterConf.IPAddress(0)
  Next
Next

wmi event registration management

wmi registered event removal

host="."
WQL="select * from __eventfilter where Name like '%NTC%'"
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\subscription")
Set colItems = objWMIService.ExecQuery(WQL)
For Each objItem in colItems
  set ASSOobjItem = objItem.Associators_("__FilterToConsumerBinding")
  For each objASSOobjItem in ASSOobjItem
    objASSOobjItem.Delete_
  Next
  Wscript.Echo objItem.Delete_
Next
Event Registration
#PRAGMA AUTORECOVER
#pragma namespace("\\\\.\\root\\subscription")
instance of ActiveScriptEventConsumer as $Consumer
{
    Name = "NTC20130523001 Process Monitor";
    ScriptingEngine = "VBScript";
    ScriptFileName = "D:\\Q.vbs";
};
instance of __EventFilter as $EventFilter
{
    EventNamespace = "Root\\Cimv2";
    Name  = "NTC20130523001 Process Monitor";
    Query = "Select * From __InstanceCreationEvent Within 2"
            "Where TargetInstance Isa \"Win32_Process\" "
            "And Targetinstance.Name = \"calc.exe\" ";
    QueryLanguage = "WQL";
};
instance of __FilterToConsumerBinding
{
  Consumer   = $Consumer; 
  Filter = $EventFilter;
};

%windir%\system32\wbem\mofcomp.exe customize.mof

manaully do wmi event registration
1: create filter
2: create consumer
3: right click on the created filter/consumer from the right pane and pick desired object to register

REF:http://www.codeproject.com/Articles/28226/Creating-WMI-Permanent-Event-Subscriptions-Using-M
REF:http://support.microsoft.com/kb/2545227

dot net tips

C:\Windows\Microsoft.NET\Framework\\
web.config segment encryption
aspnet_regiis -pef ConfigurationStrings webPath -prov "RsaProtectedConfigurationProvider|DataProtectionConfigurationProvider "

hide your source code with aspnet_compiler.exe

wmi win32: rpc unavailable

1: make sure the machine is turned on
2: make sure you can successfully establish the IPC connection with the target machine
3: check firewall setup. RemoteAdmin need to be enabled.
by command
netsh firewall set service RemoteAdmin
netsh firewall add portopening protocol=tcp port=135 name=DCOM_TCP135
by GPO
Windows Firewall: Allow remote administration exception
4: verify firewall setup
netsh firewall show state

windows mount folder as a drive

subst

netbios alias

1:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters Add a new Multi-String value called OptionalNames. Enter one or more aliases, one per line.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters Add a new DWORD value called DisableStrictNameChecking and set to 1.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters Add a new DWORD value called DisableLoopBackCheck and set to 1.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 Add a new Multi-String Value BackConnectionHostNames. Enter one or more aliases, one per line.

2: reboot server

netbios debug tips: nbtstat -RR / -c 
netbios diag tool: browstat

Please note, the target netbios name should match the dns a record or should not exist in dns zone. otherwise, system will always prompt authentication error with error code 1396 when issuing net use command.