We Engineers move the world

Braindump

Favorites

Email: Webmaster

Creating a Boot Disk:

If you have access to a system running Windows NT:

1) Make sure you format a floppy on an NT system.

2) Copy the following files to the floppy from your NT system.   Ntldr, NTdetect.com, Boot..ini, and Ntbootdd.sys (for SCSI systems with BIOS disabled)

3) Edit the boot.ini to reflect the proper ARC path if necessary.

      [boot loader]
      timeout=30
      Default= scsi(0)disk(0)rdisk(0)partition(1)\winnt

      [operating systems]
      scsi(0)disk(0)rdisk(0)partition(1)\winnt="Windows NT"  

http://support.microsoft.com/support/kb/articles/Q102/8/73.ASP

Stop all back office services such as Exchange, SQL, IIS...and set to manual.

Change the name of the domain on the PDC. This will issue a new Domain SID. Reboot the PDC so it can register the new domain entry<1Bh> in WINS.   Force a WINS replication to force the new domain entry throughout the WINS environment.

Change the name of the domain on the BDC's and reboot them so they can enter their <1Ch> entries in WINS.  Force a WINS replication to force the new entry throughout the WINS environment.

Reenter the accounts for any service accounts that you have and start the services.

After this, you can change the domain of all of the members and they will be given a new SID  

See the following Q article for full steps and precautions.

http://support.microsoft.com/support/kb/articles/Q178/0/09.ASP

To get an index of Microsoft Knowledge base articles.  Send a message to
mshelp@microsoft.com with "Index" as the subject and nothing  in the body.
An index will then be emailed to you.  You can then request articles via
E-mail per the included instructions.

Emergency Repair Disk(ERD) You should create an ERD when installing NT and update it anytime you make any changes to the OS. You must be an administrator or power user to create an ERD. The user creating the ERD must have permissions to the systemroot\Repair folder. Run rdisk.exe to create the ERD. You must run Rdisk /s to include the SAM and security information. 

Repair Process:

1) Boot from the three setup floppies. the ERD is not bootable. 

2) Select repair a damaged installation instead of installing. 

3) You will be prompted for the repair disk. You will have four choices to repair: Inspect Registry files - replaces registry files with files from disk. Any system changes since disk was updated will be lost. Inspect Startup environment - will rebuild the boot.ini(useful if win9.x is installed after NT) Verify NT system files - checks Ntldr, NToskrnl and will prompt to replace if the one on the system does not match the disk. Inspect boot sector - use when no OS on the computer boots.  Make sure this disk is kept in a secured place as anyone getting ahold of it has access to your accounts database.  A repair disk from a domain controller can easily be run through any number of password cracking programs to produce all of your administrative passwords.

The most famous password cracking utility is L0phtcrack.  This is actually good to run periodically to see how secure your domain is.  You can get a 15 day trial version here:  http://www.l0pht.com/l0phtcrack/  You will be amazed at how quick this thing spits out passwords.

If you are locked out of a system and do not have the administrator password to log on, here is a hack to get you in: Install a second instance of NT on the system.  This can just be a plain install.Boot into this new install, go to the original install system32 folder, rename logon.scr, then copy cmd.exe to logon.scr. Reboot to the original install, and wait 15 minutes.  A command console will pop up, type explorer.exe, and you will have the desktop.  You can then add another admin user account, or reset the admin password, as you want. When done, hit CTRL+ALT+DEL, and logon using the account you created, or the admin you adjusted. Don't forget to rename logon.scr back to its original.

Windows NT by default is optimized for a 256K size L2 cache. With most
computers now having L2 caches larger than 256K it pays to take the time to
change the SecondLevelDataCache setting to correspond to the size of the L2
cache installed.

1. Using Regedit open the key below.

2. Find the value named 'SecondLevelDataCache', double-click to modify.

3. Click the 'Decimal' radio button, and enter your L2 cache size in Kb's.

4. Exit Regedit and reboot.

Registry Settings:
Key: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
Manager\Memory Management]
Value Name: SecondLevelDataCache
Data Type: REG_DWORD
Data: Cache (in Kb) using Decimal Notation

How do I display a warning or legal notice before logon?

You may want to display a warning at startup stating that unauthorized access to the machine is prohibited.  This will present a popup warning that the user must click OK to before logging on to your server.  The legal department will love this idea.

For Windows 95/98, modify the following registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Winlogon

The string values will appear on the logon banner.

Example:

"LegalNoticeCaption"="Important Notice:"
"LegalNoticeText"="No Unauthorized access allowed"