Category: Uncategorized
Link for step by step iPhone app
October 27th, 2009The best bit of problem solving I have ever done
January 27th, 2009So here is the mystery.
A script runs every 5 minutes successfully then at 05:00 in the morning it fails. Hmmmm The problem is it never runs again.
Reboot server and the script runs fine and again at 5:00 it stops running.
I used Sysinternals' Process Explorer to look for anything suspicious and there are 20 CSCRIPT processes running. Normally these processes appear and disappear quite quickly but on this machine the 20 processes stayed running for over 5 minutes.

Then... All of a sudden they all disappeared. and a minute later they started up again. Weird.
To cut a very long story short. I used VMWare Workstation to start an XP VM from this VM I started an RDP session to the server with the problem and started Process Explorer. Then I used the video recording feature of VM workstation to record for 10 mins or so. (time for a coffee).

Examining the video I could see the OpsMgr Agent (Health Service) stopping and starting every 10 mins.
-----

This would then force ALL the Management Pack Scripts to restart. Over the next few hours WMI slowly ground to a halt. Something else happens with OopsMgr at 5:00 that then kills WMI for good.
Same problem as this with same solution.
i.e. increasing Agent Restart Threshold to 300Mb for agents with this problem.
My Task List
December 4th, 20081. WMI health Management Pack
2. Backup Health MP
3. Integration Services Training
So what is the vulnerability?
October 27th, 2008If I understand this correctly.
Clever deconstruction of the patch
It used to be possible to force a buffer overflow by forcing the netapi32.dll to load
\..\..\..\..\..\abc
This was fixed in MS06-040 by stripping off and \.. characters at the beginning of the string.
Therefore \..\..\..\..\..\abc becomes \abc
However some bright button noticed that
\abc\..\..\..\..\xyz does the same buffer overflow but MS06-040 does not catch this. Hence the quick release of MS08-067
More links for MS08-067
October 27th, 2008More interesting links regarding problems people are having.
Security Update KB958644 broke my wireless NIC!
We think it also broke the authentication to our firewall in our TestNet.