Work Life: Dueling DHCP Servers (DNS Errors, Unauthenticated Networks)

Heya!
  Today, I visited a school that was having issues with some of their computers in specific locations. Usually, when a district calls with something like that, we start in the room(s) where the trouble seems to be and work our way outward from there. In this case, there was an elementary lab in which all but one row of computers was throwing up some weird errors.

The machines are running Windows 7, and the network icon in the system tray would change from the standard computer to one with a yellow warning triangle. Then, a message would pop up stating that the computer was connected to the local network but was "unauthenticated." Other computers showed the normal computer icon but when they tried to get online, the browser would throw up messages about unresolved DNS issues, etc.

When the tech would check the IP address on any of the errant machines, the initial address would show the local network scheme. However, when the warning icon appeared, an ipconfig revealed the address had been changed to a 192.168 range.

That range, as many of you know, is where things like wifi routers like to live. So, I asked about switches, other network equipment, etc.  The tech had put in a new switch (new to them) that they had received from another district. Since the "new" switch was an HP Procurve, I thought maybe something was going on there. Plus, that had been the most recent change the tech could remember at the time.

I removed the switch and was about to put in another switch, the tech came in and told me that she remembered they were testing their new Kajeet-based MiFi hotspots at about the same time everything went wacko.

Instantly, we had our answer. You see, when they were testing the hotspots, they were using them in tethered mode, meaning they hooked up the device to the computer via USB cable and let the computer use that as the connection. Well, the hotspot is set up to hand out IP addresses (DHCP). Normally, this is not an issue - the computer gets an IP address and life goes on.

Here is the rub: If the computer in question is ALSO connected to the local network (via Ethernet cable, for example), the hotspot actually communicates down that wired line through the computer it is connected to. So... The hotspot was answering DHCP requests from certain computers on the network. Of course, I want to know why only those specific computers and not, say, computers spread throughout the district. Unfortunately, we may never know the answer because all of the trouble took place the day before I arrived and the hotspots were already disbursed.

So, in a nutshell (the TL;DR version, I suppose you kids would say these days): Erratic computer connectivity might be blamed on multiple DHCP devices on your network. Check for Wireless Routers, tethered hotspots, internet connection sharing, etc.

Work Life: Getting Schooled and Going Back to Class

Earlier this week, I made a trip out to an area school to see if I could help figure out why they could not access the digital sign located near the main road. They had wireless access to the sign, but after a power surge, they lost connectivity to the sign and to the access points. They replaced the access points and could a signal to the access point at the sign, but not the sign itself.

We started by checking the settings in the bridged access points. Everything seemed to be checking out because we could get to both the one at the main location and the one at the sign. The sign itself, however, eluded our efforts to connect to it.

After a few more bouts, we decided it would be best to start at the sign end and work our way back.  We opened the sign and examined the guts. We looked over the various connections and determined that some of the network ports on the internal switch might not have been working, or maybe just not configured to be used.  At some point, it occurred to us that we might need a crossover cable, but certain ports gave us connection when we hooked up a laptop. Very weird.

There was an IP address listed on the unit, as well as several others listed in the various manuals we had. Trying to hit those IPs, however, proved fruitless. I am condensing this tale for the sake of space and for the fact that I don't remember the exact steps and details, and they aren't really necessary to get the general gist. In any case, at some point, we called the manufacturer. The reseller/installer left the district high-and-dry several years ago. After convincing the manufacturer that we were on the up-and-up, the tech offered a few suggestions. One of these included the connection of a monitor, keyboard, and mouse to the system in order to access the console. We ate lunch before tackling this.

After lunch, we did as we were instructed, and sure enough, after we rebooted the sign, we saw the sign's computer on our screen. Supposedly, rebooting the sign was supposed to flash the IP address and subnet to all passersby. There were four of us watching at one point, and none of us ever saw it if it did flash up there. Once in the system, we were able to ascertain the address. It was the same address that had been programmed into the connected access point! In their defense, the information had been incorrectly documented, or at least incompletely documented by the installers.

We fixed the addressing situation and after a few false starts and reconfiguring the sign software on the end-user side, we hit the jackpot! We documented the new, working, settings. We then went to the end-user and updated the information so that she could update the sign per her schedule. Whew! Well, I suppose I should say that we put the sign back in order and locked it all down and THEN we went to the end user.

Another issue I was asked to look into while there concentrated on their Mac OS X/ Active Directory integration. They were having an issue with user home folders. After a bit of troubleshooting, I came up with a solution that involved changing the path to the user folder so that the Mac OS X smb protocol could hit the folder as a root. Since all the users were already created, updating all the folders, shares, paths, and accounts would be quite an undertaking. It turns out, the users were already saving files to their Google Drives with various shared folders, etc. No need in fixing something that isn't broken. The district decided to keep things the way they are for now.

---

I am in class for Apple Certified Mac Technician training. Today was the first day. I have another day this week, then we come back next week for a full week of training before the exams. It's been awhile since I've been in class and I suddenly feel like a kid in college. Haha!  I will be doing some serious studying this weekend in prep for my exam.

Once I am certified, we plan to set up our office as a place for our schools to have their Macs repaired. I'm looking forward to adding a certification to my repertoire, especially when it will benefit the schools that wish to use the newly-offered services.

Work Life: Some notes

If you are running Orchard and forget the SQL database password, the following should do the trick (I suggested it to a district in Arkansas and it solved the problem):

1. Open Sql Server Management Studio as Administrator
2. Login to .\SQLEXPRESS using Windows Authentication
3. Go to Security Tab -- > Logins --> Change the "sa" password and Press Ok

I helped a local district onsite with a connectivity issue. We thought one wing of a building was down, but it turned out to be just one room. In a nutshell, here are the troubleshooting paths we took:

1. Unplug/replug power from switches and wifi access point. Did not resolve issue.
2. Testing wired workstation. It could not connect.
3. Checked wiring. Loose connection at wall. Reseated.
4. Wired workstation tested and working. Wifi stations still down.
5. Unplugged power from access point, replugged. No fix.
6. Unplugged/reseated network cable from switch end to access point. No fix.
7. Unplugged/reseated network cable from access point end. Fixed.

Not sure why we have to reseat the connection on the access point end, but that fixed it.

I strongly advise all school personnel to work with their tech department before buying any computers. If you purchase a computer on your own, chances are it will *NOT* work with your school network. Many districts require authentication credentials when connecting to the network. Computers you buy at Best Buy or Walmart or anywhere off-the-shelf are *NOT* going to have the Professional version of Windows. There is an extra cost (either in terms of money or man hours or both) to get that new computer to work on the school network. Save everyone a lot of headaches, and TALK to your TECH person before making a purchase. Thank you.

The school tech and I labeled fiber in preparation for the demarc/fiber center move that I discussed in a n earlier post. I plan to be there for the move to offer tech support, muscle support, and/or moral support. And prayers. Want to see prayer on a school campus, come watch a bunch of folks moving the network core (while it is still live) from one location to another. Oh yes. There will be prayer.

While at that district, I took a call from the office regarding a new electrical line we were having installed. It was supposed to have been done last week, but the vendor never showed or called. We won't be using that vendor again. Anyway, that vendor did show up to run the line but "no longer possessed" the information regarding the type of outlet connector needed. Seriously!? Totally unprofessional in my opinion. Again, we will not be using them in the future. The line finally got installed, but the connector installed does not look exactly like the one pictured in the specs for the new device. We'll see when the device vendor shows up to install things. I have a short fuse for incompetence and non-communication. taken as an "OR" situation, I can handle either one. But when they become "AND," we have a problem.

I worked with a different user on setting up her new MacBook Pro (MBP). The Migration Assistant copied everything from her old MBP to her new MBP, but did not give her account any permissions to do anything! UGH! So, after a bit of poking around online, I found a solution that seems to have worked:

While logged in as the user (though, frankly, I think you could be logged into any account considering you employ the SUDO command, but I didn't try it that way), open Terminal and run the following:

• sudo chflags -R nouchg /Users/username/
• sudo chmod -R 775 /Users/username/
• sudo chmod -RN /Users/username/
• sudo chown -R username:staff /Users/username/
• (info from: https://discussions.apple.com/thread/3241822?start=0&tstart=0)

That cured her, so far as we can tell. We also did change some folder permissions directly (Right-click, Get Info, Permissions), but I believe the commands above did the actual work.

I worked with a different user about setting up her classroom. Due to power circuit issues, I will have to revisit the room to install the equipment at a later date.

Work Life: I want my MTV

This morning, the DL Coordinator and I drove in separate cars to a local district in order to get their compressed video equipment relocated to another room. I took my own car because I was doing some training after the move was done.

While the DL Coordinator hooked up equipment, I worked with the local tech to reroute the fiber path to the new location. Luckily, there was an used fiber connection in the building. That left us to map out wiring from the room to the drops in the closet to the tech closet across the hall. Again, as luck would have it, the guy who ran the wiring in the new room pulled two runs back to the tech closet. Whew! No running wires for us! After a false start or two, we had the video unit connected to the correct network. FYI, in Arkansas, the video network is a separate, dedicated LAN connection. Some sites set up VLANS to handle things, but most sites just use physical separation since it is generally easy to do.

We ran into a weird issue where the Polycom unit had reset the admin password AND had cleared out the Gatekeeper information. All other info had been retained, though. Can't say I've seen a "partial reset" in a video unit before. There is a first time for everything, as they say.

Once we had the unit up and going, we ran a couple test calls and called it good.

I stayed for a 3-hour training on a new online forms program the school is subscribing to through us. There was a lot of very good discussion and they got an overview of what the system does. After the training, I came back to the office where I have been performing other duties: answering emails, troubleshooting, etc. I'll do that until 5:00pm.

Work Life: Helping a school

On Wednesday, I headed up to Blevins to help their new tech get some things done. We started in the Distance Learning Lab, where the tech and her son were finishing up installs for Plato. As that was happening, we walked down to a teacher's room to help trace out network wiring and to do a little housekeeping. That ended up also including attaching the computers in the room to the domain.

Since they have a new tech, I made sure to walk through things step-by-step so she could take whatever notes she needed and so she could follow the process. I am a big believer in "teaching to fish," so after I ran through it once with her taking notes, I had her run through it herself. We covered attaching computers to the domain, setting reservations in DHCP for printers, etc, and installing the newly reserved printer(s) on the computers. She also mentioned locking students out of Control Panel on her Win7 machines, and I gave her something of a crash course in Group Policies. When she logged in as a student and the Control Panel was gone and locked, that made her day!

One of the computers still had the Netware Client on it. Additionally, it had Zenworks and Syncroneyes. The client was not installed in the same manner in which I am accustomed, so removing it took a little hunting and pecking. Ultimately, we came up with this solution that worked for us:

• Uninstall Syncroneyes
• Go to Control Panel/Network Connections
• Uninstall Netware Client and anything else mentioning "Netware" from the list
• Uninstall Zenworks
• Open REGEDIT and remove all traces of "seginal.dll" (there are usually 2 or 3 entries)
• Reboot

NOTE: Modifying the registry can do irreparable damage to your computer if not handled with care. I make no warranties or guarantees, expressed nor implied. You edit the registry at your own risk. I assume no responsibility for any damage to your computer, operating system, network, etc. Get permission from your specific designated authority before adding/removing/modifying any software installed on the computer upon which you are working. Completing the above steps on a computer without permission may result in various disciplinary actions at your school or business. I am not responsible for any such actions taken against you or anyone associated with your organization in conjunction with information contained in this post or any other.

We took care of a few other issues, and that pretty well ate up the entire day. As we were wrapping things up, the tech wanted to show me the progress on a building project the district has going on. In my eyes, it is one of the most ambitious ideas I've been this close to. Their core and demarc points were centrally located in a pair of portable buildings that had been connected via enclosed breezeway. For many years, this also served as the central admin offices. After central offices were moved, the building was used as a tech office and band hall.

The district had a metal building at another location and decided they wanted to replace aging portables with this newer metal structure.  The problem: the network core and demarc are in there, remember?  Well, the Superintended came up with a plan: tear down everything except the closet that housed the servers, fiber, telco, and air conditioner and then build the metal building around the core. Once that's done, they would move the equipment from the closet and finish out the building.

When asked my advice, I expressed my concerns about such a venture. Turns out, other professionals have also expressed concern. Nonetheless, things pressed on. Here is a photo from early in the deconstruction phase:

What you see in the photo above is the tech closet with air conditioner on the left (in center of photo) and one of the portable buildings on the right. The other portable building has been removed as they prepared the closet to stand alone. This was taken roughly June 24, 2013.

Below, we have an image as things were on July 31, 2013. You can see the poured concrete surrounding the closet. The closet sits on the cut beams that used to hold up the portable building.  You can see the metal structure going up around the core network closet.

The plan, as mentioned above, is to finish most the metal building. Once that is done, the contents of the tech closet (fiber, servers, telco, etc) will be moved to an area almost directly in front of the door you see in the photo. The thought is that connectivity will be down for 10-15 minutes during this process. I would venture an estimate of 3-5 hours, assuming everything remains in tact during the move. After everything is moved, they will finish the metal building which will house the technology equipment and two classrooms.

I will do a follow-up later with how things transpire.

Sharepoint, Exporting, and Ditching the Manifest

While working at one of my areas schools, I was tasked with getting all the pictures out of a Sharepoint site. Specifically, it is a MOSS 2007 installation. I used the stsadm.exe program that comes with Sharepoint in order to export everything from the site. When that runs, it creates a series of CMP files.

Turns out CMP files are just Windows CAB files with a different extension. You can rename the CMP to CAB and then simply double-click them to see what's inside. And, what is inside? In most of the CABs, you will find DAT files. The DAT files are actual usable files (for the most part), but you have to know what they were to start with. For example, you could rename the appropriate DAT file as DOC (assuming that specific file had been a word doc) and it would open in Word.  In one of the CABs, though, you will find a Manifest.xml file. This lists every file the system backed up, what its "real" name is, and what the DAT file was called. You put two and two together and come with the correct filename and extension for the files.

That's great if you have a small set of files. In my case, the Manifest.xml alone was 380MB. Yes, that is 380 Megabytes! Ain't nobody got time for that!  Instead, I took the cheater's route: Rename every DAT file as JPG and see what happens.

Now, before we start patting backs here, let me explain what that entailed: Each CMP has multiple (from about a dozen to more than 2000, depending) files in it. In my case, there were 32 CMP files. I needed a way to extract the information from each of those CMPs and then convert the thousands of files to JPG. Here's another kick: The DAT files all start over in naming with each new CMP file. So, you can't simply extract every file into the same folder because files would overwrite each other.

Enter command line fun:
The first thing I did was rename the CMP to CAB. That was easy:

ren *.cmp *.cab

I created a new folder on the computer called SchoolName (I used the actual name, of course):

md c:\SchoolName

To keep things easy, I made sure I was working in the SchoolName folder on the C:\ drive:

c: (then press Enter), then type: cd\schoolName (and press Enter)

Next, I knew I would have to extract each CAB into its own folder. So, let's create folders:

for /L %a in (1,1,32) do call md schoolname%a

This ran a loop that created a directory called schoolname1, schoolname2, etc to schoolname32 inside the SchoolName folder. So, from the root, they would be C:\SchoolName\schoolname1\, C:\SchoolName\schoolname2\, etc...

I switched back to my flash drive where the renamed CAB files resided:

e: (then press Enter, where "e" is the letter of your flash drive)

Now, I needed to extract those files from the CABS and put them in the correct folders:

for /L %I in (1,1,32) do call expand -F:* schoolname%I.cab c:schoolname%I 

Notice that I did *NOT* put a backslash after the c: in that line! By excluding the backslash, I am telling Windows to use the c: drive, but start in the last directory I accessed on that drive. That was SchoolName, remember? So, this will extract the files inside the CABs to the appropriate subdirectory in that SchoolName folder. That is, schoolname1.cab files will go into the schoolname1 subfolder, etc.

Okay, the next shortcut? I was just looking for pictures. I decided to use JPG as the extension of choice. So, if I rename all the files I just extracted to JPG, then I could use the "Medium Icons" view to see which files actually show images!  Again, I don't have time to delve into every single folder to rename thousands of files, so let's have a FOR-LOOP to the work:

for /L %I in (1,1,32) do ren schoolname%I\*.dat *.jpg

 Once that ran through, I opened each folder, deleted everything that wasn't a valid picture and kept the images. Now, I do realize that there are other picture formats. Ideally, I would have run the REN command to change the extension to PNG or GIF or whatever. But, I knew that the majority of the images they wanted to keep were JPG.

Was this the "best" way to accomplish the task? Maybe not. Did it get the files? Yes. We ended up with 250MB worth of images that someone will have sift through. I'm just glad THAT isn't my job.

Note: The above steps would work for any files. Need to pull all your PDFs? Just name all the DATs as PDF and look for PDF thumbnails. DOC, XLS, PPT, etc might be a bit trickier, and might be worth trying to open a 380MB xml file for somebody. Not for me in the scope of this project.