May 042015
 

So there I was, trying to remember the password to one of the Excel script files I had but nothing was coming to me. So obviously the solution was Google.

http://superuser.com/questions/807926/how-to-bypass-the-vba-project-password-from-excel

http://blog.anidear.com/2013/10/unlock-protected-excel-file.html

  1. If it’s a .XLSM file, you can rename it to a .ZIP,
  2. extract the .\xl\vbaProject.bin,
  3. Rename the .bin to a .txt
  4. Edit in a Text editor (that can handle binary files as text)
  5. Search for DPB=
  6. Replace with DPx=
  7. Save the .txt
  8. Rename back to a .bin
  9. Copy into the .ZIP
  10. Rename the .ZIP to a .XLSM
  11. Open the Excel document in Excel
  12. Bypass the error
  13. Edit the project (Alt-F11)
  14. Right-click the project in the Project Explorer
  15. Choose VBAProject Properties
  16. Select Protection (tab)
  17. Leave Lock project for viewing checked
  18. Enter a new password
  19. Select OK
  20. Exit the VBA for Applications editor
  21. Save the Excel
  22. Re-open
  23. Alt-F11 to enter the VBA Project, use the password entered in Step 18
  24. Your project is now recovered

Other solutions apply for other file extension or for older Excel files.

Note to self: If you require true encryption or better protection for your VBA applications, create a better security strategy.

Mar 092015
 

A New Dawn

Starting in January 2015, Avaya has changed it’s official policy with regards to Microsoft Hotfix updates to AACC servers. Prior to this policy update, all Microsoft Hotfixes were approved for installation only when tested and approved specifically by Avaya. There were numerous Hotfixes that were not approved and if those Hotfixes were installed, Avaya could (and sometimes did) decline to support the customer site. As of the January 2015 policy update, only those Hotfixes specifically listed by Avaya as not compatible are restricted from installation.

What this means for the traditional customer is that the standard IT Security policy of installing the latest Microsoft Hotfixes to ensure OS security is now part of the approved processes for Avaya Aura Contact Center Servers. As long as the Hotfix was released prior to the last published date of the bulletin, and as long as Avaya has not discovered a specific fault, the Hotfix is supported for installation on AACC systems.

As of this blog post, all Microsoft Hotfixes released by Microsoft on or before 10 Feb 2015 are approved for installation on Avaya Aura Contact Center, if the AACC is Release 6.4 SP14. Service Pack 14 was released mid-December 2014. For older systems (AACC SP13 or earlier, or any NES CC or Symposium systems), the older policy remains in force. Only those specifically tested and approved by Avaya are allowed to be installed, and for extremely old systems (NES CC or Symposium) installed on Windows 2003 Server or earlier operating systems, the Microsoft end of life is relevant.

Avaya Aura Contact Center runs on Windows 2008 Server R2 with specific server hardware engineering requirements. [Avaya credentials required] For more information about server specifications, please refer to the linked documentation or contact your support partner for assistance in ensuring hardware compliance.

Take Away

From a partner support perspective, this makes checking compatibility a much simpler endeavor– as long as the system is on SP14 or later, if the Hotfix isn’t listed then it’s OK to install. So the business partner need only look to see if any patches were installed after the “released before” date on the bulletin and only check those (or look for a limited number of specifically restricted hotfixes.)

From a customer support perspective, this ensures that AACC server OS security is capable of being much more current than it ever has been before in the history of the AACC product line.

This is great news for all concerned!

Recommendations

First, consult your support partner. Take their direction over anything you read on the internet. Installation of Service Packs for AACC is (these days) virtually a full dot release upgrade instead of the simple patch window we used to have with early AACC Service Packs or NES CC Service Updates. My experience is that instead of having a 2-5 hour window, windows are now consistantly 4-7 hours, and potentially much longer if the system is Highly Available. And that doesn’t even take into account the pre-upgrade engineering that is necessary to ensure you don’t upgrade and then find yourself exceeding the hardware requirements on the AACC’s Windows 2008 Server hardware.

Second, if you are on anything prior to AACC 6.4 Service Pack 14, you should update to SP14 ASAP. This addresses many of the most common and well known issues on the AACC. Similarly, if you are on anything prior to AACC 6.x you should upgrade now. Windows 2003 Server will soon reach end of life. This will obsolete NES CC6 and NES CC7 even more so than it is obsolete now (since those systems are “functionally stable” and there are no “corrective content” plans for this manufacture discontinued product version.) There are many reasons why you should upgrade, but to keep this focused on OS Security and Microsoft Hotfix compatibility, Windows 2008 Server will continue to receive additional Hotfix content. Windows 2003 Server, and earlier, will not.

Third, in the process of upgrading to SP14, you or your support partner should carefully review the readme to determine all of the known issues and known fixes for associated systems. There are engineering considerations on the PBX, PBX patches, Callpilot versioning (if you have ACCESS ports) and other considerations that should be taken into account. Some considerations aren’t part of the standard PBX DEPLIST, and by updating the DEPLIST the PBX patch required by the AACC Readme gets removed, resulting in recurring maintenance issues.

Dec 282013
 

I like building applications, and these days that means web applications. The challenge is enjoyable. During my vacation this year I decided to spend some time expanding some code that I’ve been working on over the years. In this case, a tool that runs on my PC that integrates with a database. Previously, I tended towards integrating with a local DB, be it via ODBC, a local text or Excel file, etc. This year I’m setting myself the challenge of integrating with a MySQL database over HTML.

The reason for this is because there is a substantial amount of information in my company’s online database (hosted by NetSuite), but getting access to it for any kind of automation can be tricky. However, it can be done if you’re willing to invest the development time to building an application (both sides of one). But, such a task is not something I’ve ever done before. So I’m combining a hobby and self improvement with the intention of building skills which may be useful at some point in the future at work.

As an example, an application which retrieves system information and helps organize and launch system connections (http, ssh, rdc) is a lot more portable if it retrieves the system information from a central database than something which requires all of the system information to be stored locally. If someone updates the system information and you don’t notice it, it means you could be attempting to connect to the wrong IP or server name. By automating the information retrieval you can save minutes (or over a calendar year, save hours or even days) worth of lookup time.

There are plenty of other uses, such as pulling information from a system, parsing it and then pushing it to a MySQL database directly, and then allowing that information to be displayed in an HTML format. Log parsing, etc., could be streamlined. Even, in one case, parsing the Microsoft hotfixes applied to servers and scrubbing it against a database for which hotfixes have been tested/approved by the manufacturer, would be a great application for my environment. Avaya already has something like that for the CS1000 that was created by the engineers back in the Nortel days. But they don’t have anything like that for the Avaya Aura Contact Center product line, even though they have the audit tool that would be necessary to implement the first half of that endeavor.

While tooling around with the XMLHTTP GET/POST integration for the client tool, I ran into an error on my website that was generated by Mod_Security. “An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.

Upon further investigation, I managed to capture an error log out of the shared error log on my web host “ModSecurity: Access denied with code 406 (phase 2). Match of “rx ^0$” against “REQUEST_HEADERS:Content-Length” required. [file “/etc/httpd/modsecurity.d/10_asl_rules.conf”] [line “101”] [id “392301”] [rev “5”] [msg “Request Containing Content, but Missing Content-Type header”] [severity “NOTICE”]

The rest of the error is largely environment specific, so I’m omitting that info, but if you’ve run into this error yourself, you know what it looks like.

Here’s what I learned in my search (I’m effectively building a custom browser using Microsoft XMLHTTP— the mechanism isn’t too important, be it Power Shell, vbscript or jscript)

  1. Must declare RequestHeader User-Agent
  2. Must declare RequestHeader Content-Type
  3. For POST, must declare RequestHeader Content-Length

These are not mandatory for all HTML interactions, but some security configurations may require certain headers in order to process an XMLHTTP request. In the case of my web server (shared webhosting) and my custom browser application, for a GET request only the User-Agent and Content-Type were required. However, Mod_Security was configured on the shared webhost to mandate Content-Length.

What triggered this research and error was a typo in my code.

The typo came down to a bad choice in variable declaration. In a foreach ( item in array ) statement, I poorly chose the variables to be foreach ( item in items ) and, I’m sure you can see the typo risk already, I accidentally typed foreach ( item in item ). As such, the foreach loop did not properly iterate over the array… and since the foreach loop set the RequestHeaders, the request headers were not being set. Thus, the mod_security error.

I didn’t catch the typo initially, as the first error message was mostly meaningless and I couldn’t immediately determine the cause. Still, I saw a number of articles (including some wordpress blog support requests for this error, with some fixes involving changing the behavior of Mod_Security). While the Mod_Security error isn’t very meaningful, if you dig into the error_logs deep enough, you’ll find the error message which will lead you to the root cause of the problem. In my case, an HTTP 406 indicating that “Rquest Containing Content, but Missing Content-Type header.”

Once I found the typo in the code and fixed it, the XMLHTTP request worked perfectly (except that mod_security was also configured to require a content-length request header on POST requests, but once I’d fixed the one problem the other was easily to identify and fix.)

Dec 102013
 

If you’ve ever searched for things like

  • Internet Explorer automatically opens and closes
  • How to repair or reinstall Internet Explorer
  • IE opens, flashes then closes immediately

then you know how frustrating it can be to have Windows automatic updates install the latest version of MSIE only to have it not work the next day;

I had this happen to me today and I spent nearly 90 minutes searching for solutions, trying various things solutions and repairing my Windows install.

I attempted:

The System File Checker (run within an Administrative CMD window) turned out to be my solution. A number of %windir%\system32 files were corrupted during the automatic upgrade of MSIE. SFC found and fixed all files (without the need to reboot into safe mode, etc.)

Unfortunately, if I’d been paying attention, I could have prevented this using MSIE >> About.

Nov 062013
 

Microsoft– MSTSC /console deprecated, and replaced by MSTSC /admin for Windows XP SP3, Windows Vista SP1, Windows Server 2003, Windows Server 2008, Windows Server 2008 R2. However, MSTSC /admin is no longer applicable to Windows Server 2008 environments (such as AACC). http://support.microsoft.com/kb/947723

The KB is from 2008. I occasionally find myself looking for the article, so that’s why I’m posting it here.

Nov 032013
 

Recently worked on an AACC (Avaya Aura Contact Center) where the partitioning of the server was determined to be the cause of the problem. While Disk Management (diskmgmt.msc) is easily accessible from START>>RUN, a screenshot is not quite as portable as text. To that end (and as a recommendation for addition to the Nortel Enterprise Audit Tool, or NEAT, used to survey Contact Center servers for Avaya engineering), I put together a script to query WMI (Windows Management Instrumentation) for the necessary information.

WMI Objects:

  • Win32_DiskDrive
  • Win32_DiskDriveToDiskPartition
  • Win32_DiskPartition
  • Win32_LogicalDiskToPartition

Using WMI queries against these objects you can derive:

  • Win32_DiskDrive => Physical Device ID (.\\.\PHYSICALDRIVE0\)
  • Win32_DiskPartition => Partition Device ID (Disk #0, Partition #1) and a derived type (e.g., Simple Volume? Primary Partition? Extended Partition/Logical Drive?)
  • Win32_LogicalDiskToPartition => Logical Drive Device ID (D:)

For quick “automated” checks of a system to verify compliance with engineering guidelines, this is a must.

Sample output:

\\.\PHYSICALDRIVE0,Disk #0, Partition #2,Basic,True,C:,Primary Partition
\\.\PHYSICALDRIVE0,Disk #0, Partition #3,Basic,False,D:,Extended Partition/Logical Drives
\\.\PHYSICALDRIVE0,Disk #0, Partition #3,Basic,False,F:,Extended Partition/Logical Drives
\\.\PHYSICALDRIVE0,Disk #0, Partition #3,Basic,False,G:,Extended Partition/Logical Drives
\\.\PHYSICALDRIVE0,Disk #0, Partition #3,Basic,False,T:,Extended Partition/Logical Drives

and

\\.\PHYSICALDRIVE0,Disk #0, Partition #2,Dynamic,True,C:,Simple Volume?
 \\.\PHYSICALDRIVE0,Disk #0, Partition #3,Dynamic,True,D:,Simple Volume?
 \\.\PHYSICALDRIVE0,Disk #0, Partition #3,Dynamic,True,F:,Simple Volume?
 \\.\PHYSICALDRIVE0,Disk #0, Partition #3,Dynamic,True,G:,Simple Volume?

The cool thing is that the script is applicable for all systems going back to Windows 2000 (Symposium 4 if I recall correctly) when the WMI query objects were instantiated in the OS by Microsoft.

Apr 272013
 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
“EnableBalloonTips”=dword:00000000

Deleting from my harddrive, but in case I ever want to refer back to it… I found the balloon tooltips really annoying in Windows XP. When I imaged laptops for work, I turned these off.

Apr 142013
 

 

Apr 132013
 

Frequently I find a need to do something with Windows, and VBScript is a flexible and fairly powerful language capable of doing all sorts of useful things. Granted there is JavaScript and PowerShell; and I should learn JavaScript more since there are several utilities that Avaya (formerly Nortel) has developed to collect data on systems and being able to write my own utilities to make myself more effective is a desirable skill.

I was writing a not-work-related utility this weekend and used several web sources to refresh my memory on how various VBScript functions, statements and operators worked. Here’s a list of some of those links:

Dim myArray(10)

myArray(0) = “Nothing to see, move along.”

Erase myArray

Mid( myString, 3, len(myString)-2 )

Replace( myString, “Find me”, “Replace me”, 1, -1)

Dim re

Set re = New RegExp

re.Pattern = “^We hold these truths.*”

re.IgnoreCase = true

re.Test( myString )

Dim re

Set re = New RegExp

re.Pattern = “These are the droids we”

re.IgnoreCase = true

myJediMindTrick = re.Replace(“These are the droids we are looking for”, “These are not the droids you”)

Dim myString

Dim myObject

Dim myInteger

myString = Empty

myObject = Nothing

myInteger = Null

‘ Although you could also use Empty on the integer variable.

UBound(myArray) returns the total number array elements (regardless of element values). isEmpty(myArray) returns false on arrays even if all array elements are empty.

Quick tip:

Const vbQuote = “”””

myString = vbQuote & “Quickly” & vbQuote & ” add quotation marks to any string.”

If Not booleanDroidsWeAreLookingFor Then

Call continueLooking

End if

On Error Resume Next

On Error Goto 0

I looked this up and discovered this really doesn’t do anything that I really want to happen. It would be nice if VBScript had a little bit more powerful error throwing/catching… sadly, it does not.