NIS System trick

1: define the NIS domain name
issue # nisdomainname kido.idv.tw
2-1: initial NIS database
issue # /usr/lib[platform]/yp/ypinit -m
2-2: NIS database synchronization. Please note, when any new auto map is generated, and push feature is enabled on NIS master, you have to manually resync NIS database again.
issue # /usr/lib[platform]/yp/ypinit -s master
3: add nis server name and ip mapping to hosts file
4: join NIS domain
issue # authconfig
5: check init service
[NIS master server] ypserv, yppasswdd, ypxfrd
[NIS slave server] ypserv
[NIS client] NISDOMAIN need to be defined inside the /etc/sysconfig/network file
6: change the default database tree [defined inside /var/yp/Makefile]
please note, when user account database is moved to non-default folder you may need to redefine parameters inside /etc/sysconfig/yppasswdd file

fail to start adobe professional with users permission

When opening adobe professional with users permission, system complains about "An error has been detected with a required application library and the product can not continue. Please reinstall the application".
Root cause: VOL is required unless you need to grant administrator permission to users who you want to enable them to run adobe profession on RDP session.
Way to fix the issue.
1: logon with Administrator account
2: export registry underneath HKCU\software\adobe

http://forums.citrix.com/thread.jspa?threadID=60695

script to manage certificate

capicom.dll is required for managing certificate through script

set oCertStore = CreateObject ("CAPICOM.Store")
set oCert = CreateObject ("CAPICOM.Certificate")

'Param 1 is the Store to use (1 = local computer, 2 = current user)
'Param 2 is the location to use in the store "MY" "ROOT"
'Param 3 is the Read/Write mode. 0 = R, 1 = W, 2 = RW
oCertStore.Open 1, "ROOT", 2
oCert.Load "certnew.cer", , 1, 1

'rem Then, you just need to add the cert to the store
oCertStore.Add oCert

來源: 忘了

how to change language for non-unicode program from registry

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CodePage
ACP 1252 for English ( United States )
MACCP 10000 for English ( United States )
OEMCP 437 for English ( United States )
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language
Default 0409 for English ( United States )

Also you can export HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\
from test computer to anothers after changing settings for non-unicode and
restart computer

來源: http://www.technewsgroups.net/group/microsoft.public.windowsxp.customize/topic41297.aspx

ssh host based authentication

Goal: 類rlogin方式,使用免密碼登入特定主機

1: ssh server : enable the HostbasedAuthentication feature on ssh server.
2: ssh client : enable the HostbasedAuthentication and EnableSSHKeysign feature on ssh client
3: add rsa fingerprint to /etc/ssh/ssh_known_hosts :
issue: ssh-keyscan -vt rsa remote_machine >> /etc/ssh/ssh_known_hosts
4: add hosts that are permitted to use the HostbasedAuthentication method to logon to/etc/ssh/shosts.equiv
issue: echo +@linuxbox > /etc/ssh/ssh_known_hosts

manage local GPO on remote machine

利用指令開啟遠端機器的本機GPO

gpedit.msc /gpcomputer: machine

http://technet.microsoft.com/en-us/library/cc978269.aspx

利用mmc嵌入方法管理遠端本機GPO

當current user的權限不足時~~可用runas利用對方管理者群組的等同帳號密碼,啟動一條cmd的session去執行即可~~

ie: 遠端欲管理電腦kido_client , 管控端kido_controller

kido_client中administrators群組成員帳號kido, kido_controller的current user kido_member

於kido_controller中建立一帳號kido,並且密碼與kido_client中的kido相同~~

接著runas /user:kido cmd

於新啟動的cmd session中進行遠端控制即可~~

default share permission change

基於資訊安全原則,我們不想讓everyone出現在預設的分享權限中,所以必須對系統作微調
機碼位置
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\DefaultSecurity]
"SrvsvcDefaultShareInfo"

由於這各機碼值是不容易讀取的,所以必須藉由tweak-ui去作調整

事後的部署

在AD的環境下~~可透過GPO來安裝~~

Computer Configuration --> Windows Settings --> Scripts (Startup/Shutdown)

regedit /s xxx.reg

在workgroup的環境下可透過psexec,wmi,reg add,powershell來補正


for windows vista and/or higher version
Once you apply default share permission onto your system. All the other machines access either root share or adminitravtive share until you apply below setup onto your machine.

reg add HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters /v Level2Compatibility /f /t REG_DWORD /d 1
restart server service to apply the setup to system immediately
net stop server /y
net start server /y

http://support.microsoft.com/kb/971277/en-us?sd=rss&spid=14019

Below artical instructs you how to customize your default share
all your share permission setup can be found at below path
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\Shares\Security\
customize permission for specific folder and then import the setup to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\DefaultSecurity\SrvsvcDefaultShareInfo

http://www.sepago.de/d/helge/2010/07/23/how-to-modify-default-share-permissions-and-other-tweaks