Reader to Reader - November 2000

[Editor's Note: Share your Windows 2000 and Windows NT discoveries, comments, problems, solutions, and experiences with products and reach out to other Windows 2000 Magazine readers (including Microsoft). Email your contributions (400 words or less) to [email protected]. Please include your phone number. We edit submissions for style, grammar, and length. If we print your submission, you'll get $100.]

Network Engineer Certifications
I'm getting more than a little tired of big companies retiring my network engineer certifications. If Microsoft is going to retire my Windows NT 4.0 MCSE, the company should stop collecting the OS's licensing fees. A neutral, third-party organization should develop a network engineer certification program that isn't dictated by the marketing departments of large software vendors.

—Doug Chick
[email protected]

Maintain Documentation of Your Network
You can use many Microsoft Windows NT Server 4.0 Resource Kit utilities to maintain documentation about the computers in your network. You can run some of these utilities from any computer on the network; others require you to run them from the PDC. I combined many of the resource kit utilities that you can run from any network computer into a batch file, which Listing 1 shows, that I run from my workstation. This script lets me collect the utilities' information in one pass. I schedule the batch file to run once a month so that I have current network information whenever I need it. To keep the Schedule service running under the context of the System account, I created a hidden share for this batch file (i.e., CC$ in Listing 1) and granted the System account full access to the hidden share. You can use the default administrative shares, but in this case, you need to be sure to run the Schedule service under an administrative-level account.

—Melissa Wise
[email protected]

Windows 2000 Network Security
In a Windows 2000 network that contains one domain controller running Win2K Advanced Server, we installed Win2K Server on a new machine. When setup asked whether the server is part of a domain or workgroup, I selected workgroup but entered the domain name as the system's workgroup name. When setup asked for the server's administrator password, I used the same password that we use for the domain administrator.

After we finished the installation, I logged on to the server as administrator, navigated to My Network Places, and saw that the window listed the network's domain controller. I clicked the domain controller, and to my surprise, I was able to access resources that only the domain administrator should be able to access. After I changed the server's administrator password, when I attempted to access the resources on the domain controller, the system prompted me for a password.

Through this experiment, I came to the following conclusion. Suppose you're the employee of a bank that has a Win2K network. You have a Win2K Server laptop that is a member of a workgroup that has the same name as the bank's network domain. By some coincidence, your administrator password is the same as the domain's administrator password. (This coincidence isn't impossible when you consider the quality of most people's passwords.) You can access the resources on the bank's domain controllers and servers without bothering to get permission from the domain administrator. Apparently, Win2K networks are less secure than Windows NT 4.0 networks.

—Queenie Ko
[email protected]

A Helpful Cloning Tool
In Reader to Reader: "Adding a BDC to an Existing Domain" (April 2000), Craig Rhinehart describes his experience trying to join a new BDC to his domain. He found that reinstalling Windows NT Server was his only option.

I discovered a useful, and free, utility that you can use for this purpose. You can use Systems Internals' NewSID utility to use disk-image cloning to create a fully installed and configured NT installation. Image cloning usually creates duplicate account SIDs on cloned systems. You can use NewSID to change the cloned system's SID.

—Robert Posel
[email protected]

Triple-Boot Blues
After many long hours of installing OSs and destroying partitions, I now successfully triple-boot Windows 2000, Windows NT 4.0, and Windows 98 on one physical disk. To accomplish this difficult task, I used the following process to configure the disk and install the OSs.

After this step, the boot menu will show all three OS boot options.

—Sharon Leibel
[email protected]

Answers to This Month's Reader Challenge
You can find this month's Reader Challenge on page 24. The correct answers to the questions are as follows: