Because I am using the native Exchange cmdlets instead of WMI or CDOEXM, this only reports on Exchange 2007 servers.  I figure accommodating both is more work than it is worth, so I just modified my VBScript version to not include any server in the Exchange 12 admin group and I have both run every day until my migration to 2007 is complete.

The script reports the last successful full backup of any Exchange 2007 server with the mailbox role installed.  It checks for the presence of storage groups and databases within them.  It notes if a backup is currently in progress, as well as if a backup has never completed.  If a backup has not completed in the last 72 hours (modifiable), it is highlighted in red so it is easy to spot.  If a backup is less than the defined number of hours old, I use the Marlett font to display a green checkmark.  This allows for a checkmark without having to reference an external image or embed one.  Lastly, the report is emailed.  The script is shown below, but you can also just download it.

My work installation is beyond the one year of service, so I couldn't download a skin for my AT&T Tilt.  My home installation (separate license), however, was within the service year, so I downloaded the skin and copied it to my work installation.  I could not find anything in the program or on SOTI's site regarding copyright of the skin images, so I am posting the Tilt images (displayed half-size) for anyone who needs it.

A side effect of this limitation is that you can also not enter a product key for a valid 64-bit server from a 32-bit installation such as the management tools on a 32-bit OS.  I have a PowerShell script that configures a server, depending on the roles that are installed.  However, the first thing it does for all servers is apply the product key.  This fails because I am running my configuration script from a 32-bit management installation.

I consider this a bug.  The only solution is to run the Set-ExchangeServer command with the -ProductKey parameter on a 64-bit installation of the management tools.

This time, Jen and I will be traveling four hours and 270 miles to the booming metropolis of Central Point, where they will be performing with Casting Crowns on July 27.  The drive will be worth it since we have seats in Row 2 (!!), which will be the best seats we have ever had seeing them.

I look forward to seeing them since they are my favorite CCM band, along with Chris Tomlin.  And I look forward to Bart's new Hymned album, which he has already recorded and I assume will come out later this year.  If you are a poor, lost soul who hasn't had the opportunity to listen to MercyMe, go to their website to hear them, or visit their blog to see how even grown men can be childish at heart.

One of the difficult parts to remove, if you haven't done it before, is the clutch drum.  To do so, you need to remove spark plug and insert a screw driver into the combustion chamber to keep the piston from moving.  Then use a Torx 15 driver and insert it into the whole in the front of the drum.  Turn the driver counter-clockwise while holding the engine/chassis still to remove the screw holding the drum in place.

After you remove the springs holding the clutch together, loosen the clutch with a wrench and remove it.  Then you can remove the gray plastic cover that houses the starter string, pulley, and spring.  When you remove the pulley retaining parts, you can lift out the pulley.  You need to be careful when doing so because the spring will uncoil all over the place if you don't reign it in while lifting the pulley out.

I slowly let the spring uncoil so I can work with the pulley.  Now you can replace the broken string.  The frustrating part for me at this point was keeping the spring in place while trying to attache the pulley.  After several failed attempts, I figured out a better way.  I was trying to mount the pulley with the string wound around it, which means that the spring has to be uncoiled a bit.  But this leads to the spring not wanting to remain flat when the pulley is being mounted on the shaft.  The better thing to do is to unwind the the starter string so it is fully extended.  You can then wind the spring as tight as it will go around the pulley (less one or two revolutions).

Even though the spring has more potential energy at this point, there is enough friction between each revolution of the spring that it makes it less prone to want to jump off the pulley.  I found it much easier to mount the pulley when the spring is wound tighter around it.

I hope this trick will help you if you need to replace the starter string on your Ryobi trimmer.

So I figured it was time to either reflash with the Faria ROM or use another.  I settled on another, discussed here at XDA Developers.  This is a 6.1 ROM, which is nice because of some of the improvements, such as native threaded SMS.  I also have more memory after a reset: about 24MB versus 21MB with Faria.  Usage feels much snappier, too.  I thought that it might simply be because OMAPClock is included, but when I checked it I was still running at 180MHz.  So if it feels snappy now, I can't wait to try it at 252MHz, which is what I normally run at.

Microsoft KB 899663 instructs how to manually transpose GUID into a format that can be used in an LDAP filter so that you can search for a match.  Why do all this by hand when a script can do it for you?  I took an existing script I had that already does the transposition and added an AD search to return the matching dn.  The dn is passed to a name translation function that converts the dn to the NT4 format (domain\username) and displays the match with username and display name.

In addition to the VBScript file, I have also included a compiled version that uses SAPIEN Script Host as the engine.  This is a self-contained, runs-in-memory-only, no-DOS-box-comes-up engine from PrimalScript.  Running the compiled version is nice since you don't have to ensure that CScript is the default host and no DOS box appears while the script is running.

The zip file with both versions is available on the download page.

The deployment guide doesn't explicitly state that you can or cannot use DFS.  It does say that the wizard validates the path by attempting to set permissions, but it doesn't say if it is trying to set share or NTFS permissions.  If it is trying to set share permissions, that isn't going to work with DFS.  To top it off, there are no log files created during this test, so you can't tell exactly what it is trying to do.

I resorted to calling Microsoft so I could ask them, and the confirmed that you have to go old-school and use \\server\share mapping.  I expressed my dismay at such an antiquated requirement and that it goes against best practices of hard-coding server names.  The engineer said that the product group has had several requests from customers to enable support for DFS, so I can only hope it will come in a service pack.

After listening to the album a number of times, I really enjoy it, and I am glad that I don't judge it based on my first impression of the first track.  This was the same with "Coming Up To Breathe," where repeated listening is what endeared the album to me.  Hopefully for their tour they will choose to stop by Portland.  Their album tours have not led them this way recently, though they have been to Puyallup for the WWC Fair and to Tualatin with Audio Adrenaline.  I have seen them perform three times, so I look forward to the next time.

Launch in external player

A successor to Lookout has found: Lookeen.  Like Lookout, it is a COM add-in just for indexing your mailbox (not a bloated app that also indexes your mailbox).  It is very fast, and offers a nice feature that Lookout never did: it display results in a tabbed window, so you can view results by their item type (messages, appointments, contacts, files, etc.).  Lookeen is in beta right now, but you can download it and give it a try.  I haven't tried any complex searches, but my early results are very positive.

However, the automatic formatting was not being applied to messages that contained the keyword.  I tried several different ways within the conditions editor of applying the formatting, all with the same results.  I decided to open a case with Microsoft since we have loads of Premier incidents available to use.  I had to work through several engineers until I finally got to the Outlook development team who had to look at the source code to determine why it wasn't working.

That is when they discovered the culprit: a limitation that is by design.  When using automatic formatting, only the first 256 characters of the message body will be searched.  This is for performance reasons.  I couldn't understand why this would be the case since rules will search all of a message body.  Then I realized why and it does make sense:  Automatic formatting is part of the view for a folder.  Views are calculated and applied each time you switch to that folder, so displaying the font face/color/size and bold/italics of each message in the folder list is dynamically applied each time you switch to the folder.  The default automatic formatting rules for a folder include unread, overdue, and expired messages, plus group headers, etc.  There is definitely a performance risk if Outlook had to search the entire message body of every message in a folder to determine how it should be displayed.  To mitigate this, message body searches are limited to 256 characters when part of automatic formatting.

Rules aren't subject to this limitation because they are one-time processes.  Rules are applied only when a message arrives or is sent (or when you manually run one).  So the workaround for my issue is to use a rule to search the body for a keyword, assign a category to it if there is a match, and then move it to the folder.  I then use automatic formatting to change how a message is displayed if the category is the one I assigned.  I have to create a rule for each keyword I am looking for (since I am also looking for reports that have errors), which isn't as efficient as defining multiple automatic formatting rules, but it is an acceptable workaround since the results are the same.

Then I found this post on xda-developers.com which indicates that Wizards that have been upgraded to Windows Mobile 5 with AKU2 (notable for the DirectPush functionality) have the portion of the DOC (Disk on Chip) that stores the carrier ID set to read-only.  Faria's instructions show how to successfully CID Unlock the device by first downgrading the ROM to a non-AKU2 version.  Of course, it can't be any ROM since the CID is still locked, so it has to be one from Cingular or something cooked.

I could not find anywhere the Cingular 1.8 ROM that is recommend to use.  I trolled Google, AT&T forums, xda-developers, Google Groups, but the binaries had been pulled awhile ago.  The other option was a cooked ROM that doesn't check for a carrier ID.  Again, I could not find the one mentioned, until I found a forum post that linked to another post on a French forum where the ROM is available.  That took awhile to download.

After finally having all the pieces necessary, I was able to downgrade this morning, CID Unlock the device, upgrade the IPL/SPL, radio, and finally Faria's WM6 ROM:

Combining information and steps from a several different topics at xda-developers and elsewhere, this is what I did:

1. Downloaded and installed the custom 1.05 ROM, called CUSTOM__RUU_Wizard_1050412_WWE_101_11210_WWE.exe.
2. Downloaded and ran lokiwiz's CID Unlocker .2b.
3. Downloaded and installed the T-Mobile 2.26 ROM.
4. Downloaded and installed IPL/SPL 3.08.
5. Downloaded and installed radio 2.19.
6. Downloaded and installed Faria's WM6 ROM.

Woohoo!

This isn’t a difficult installation, but know that it is written by one person who made it available and so there isn’t any real support, but when I found an installation issue and emailed Gil with information of what I did to fix it, he promptly replied.

1. Download the J# 2.0 redistributable package from MS.
2. Download the previewer installation file from Gil's website.
3. Install the J# package.  No reboot is necessary and you shouldn't have to exit any programs.
4. Exit Outlook if it is running and install the previewer.

One bug I have found is that if you try and run a file from within a previewed zip file whose type isn’t registered in Windows, you will get an error (such as a file with no extension).  Outlook won’t crash or anything, but you will have to save the zip file to disk in order to do something with the unknown file type.

These are the combined (Gil's and Stephen's) file types it will preview:

• PDF - This handler uses Adobe Reader's ActiveX control
• SWF - This handler uses Adobe Shockwave Flash's ActiveX control.
• HTML/HTM/XML - This handler uses Internet Explorer's ActiveX control.
• ASF/WMV/WMA/AVI/WAV/MPG/MPEG/MP3/MIDI/AIFF/AU - The same, but with Windows Media Player's ActiveX control.
• ZIP/GADGET/MSI/RESX/SNK/KEYS – Not implemented natively, but only forwards interface calls to Stephen Toub's managed preview handlers.
• CS/VB/SQL/JS - Like the previous group, not natively implemented, but added to a wrapper.

It was easy enough to extract the LDAP filter from the attribute, convert it to a string value, and display it.  But users don't generally know how to read LDAP filters, let alone represented as a long line of text.  So I started looking for utilities or scripts that would take an LDAP filter, parse it, and display it with nesting.  Uh, yeah, there aren't any.  I was determined, and so countless hours later I have a function that do such a thing.

The difficult part was keeping traffic of the level of nesting/indentation at any point.  Since a filter can be written in almost any order as long as the resulting equation equals what you want, I couldn't use any kind of static detection.  Just because an open parentheses is following by another one doesn't mean that you are, say, three levels nested.  So the important part of the script keeps track of the indentation level as the cursor position moves through the filter.

I replace ampersands in the filter with crosshatches while working with it because I was having weird results otherwise, most likely because the ampersand is an operator in both LDAP and VBScript.  And because the output is to an IE window and the indentation uses non-breaking spaces instead of the traditional tab (which doesn't exist in HTML), I substitute the HTML string for a non-breaking space with a unique string of letters so the ampersand in that doesn't get in the way.

Because this is part of a bigger script, I pulled out just the portion that formats the LDAP filter and displays it in an IE window.  You just need to provide the "raw" filter, whether directly in the script or some other method.  Copy and paste the code below or download it here.

Code:  Show  Hide

To do this, add this subroutine to the end of functions.asp, which is the CDO code to send a message.  I didn't use variables that are assigned in config.asp, so you will have to set them in the subroutine directly for SMTP server, from address, to address, and domain name in the body. 

 Then you need to add code to functions.asp to call this subroutine from the subroutine that inserts the comment.  Find the subroutine labeled InsertComment(), which should be around line 475 depending on other mods of mine or your own that you may have inserted.  Right before the existing line: 

 insert this code: 

 This is necessary because the comments are not accessed by using the blog entry ID, but the blog entry's date.  So it is necessary to cross-reference the entry ID to the entry date, and then link to the comments for a given entry ID on that date.  The last line calls the email function which will include a hyperlink to the comments for the blog entry that has a new comment.

Now, that is all fine and dandy.  You will receive the email with the link, but when you follow it to your site, you probably won't have an active session so you will have to log in.  The way the admin default and login pages work, you will lose the link to the entry you need to approve so you have to click the link in the email again.  I work around this by implementing the use of query strings so the site remembers where you were trying to go before you had to log in.

To add this feature, edit admindefault.asp.  At line 8, replace the Response.Redirect line with the following code: 

 This builds a query string of the URL you were going to go to before you are redirected to the login page.  Now edit adminlogin.asp.  At line 34, before the If statement to check for a postback, insert the following line: 

 This retrieves the query string and puts it into a variable.  At line 39, before the SQL statement to select the users from the database, insert the following code: 

 This extra code is added to accommodate you entering a bad password or if you are logging in without following a comment link.  At line 74, comment out Johann's Response.Redirect line after a successful login and then insert and replace the Response.Redirect for no user found with this: 

 This sends you to the page you were intending to go to in the first place.  If you entered a bad password, this also preserves the original URL after the login page reloads.

Last, but not least, you need to a hidden form field that will store the original URL when you submit the form to log in.  Near the end of the file, insert a line before the close form tag and paste this: 

 I hope that's not too complicated to follow.  It's a little more convoluted for this modification because it is necessary to add code in multiple places in multiple files, rather than just a chunk of code in one file.  But, now you will receive an email when a comment is posted and be easily able to approve or deny the comment just by following the link in the email.

Like the original script, since we use automated DLs, too, I look for an indication that a given DL is a SmartDL and skip it.  And I now use PrimalScript to work with my scripts, so I use its packager to make an exectuable.  This makes it easier and nicer for non-IT end-users who will be running scripts like these.

Download it here, or copy/paste below.

Code:  Show  Hide

Johann included a copy of Emir Tuzul's free ASP CAPTCHA implementation, but never incorporated it into simpleblog.  I looked at how the code works and how Johann implemented comments, and I have successfully added CAPTCHA verification to the comments system.  Since doing so a few days ago, not a single spam comment has been left.  If you are interested, this is how to do it.

Since Johann included version 2 of the CAPTCHA code page, you do not need to download anything, but you can opt to use version 3 beta 1, which uses more character obfuscation to make it harder for bots to determine the characters in the image.

Edit functions.asp to add the following code to the end of the file, which is the verification function:

Add the following code to functions.asp in the CommentsGet subroutine, which for me starts at line 351.  It may be different for you since I think I have added other code higher in the file.  This adds the actual CAPTCHA image to the comments form.  You will add this code after the call for GetEmoticons and the line break, which for me means inserting this at line 454:

Lastly, replace the code that inserts the comment into the database with the code below, starting at line 492 (after the comment  "insert Comment."  Instead of simply inserting the comment into the database, this will compare the entered characters to the actual ones in the image.  If they match, the comment is inserted.  If not, I use a JavaScript alert to present a popup box and then redirect the user back to the post:

• dBlog - This offered some features I have been looking for, but the default locale is Italian.  There is a translation for English which changes titles and headers, but things like the calendar remain in Italian.  There isn't a lot of documentation in English, so I was left to doing a lot of manual code search-and-replace.


• DotNetNuke - This is one of the primo open-source CMS solutions available.  It is an immensely powerful application that uses modules to offer the features you want: blog, document library, file library, ecommerce, forums, feeback, etc.  The application is geared for more commercial or multi-user sites, not a one-off blog, so the portal is a bit too much for what I am looking for.


• Nukedit - A solution ready to go pretty much right out of the box.  But it lacks some of the features that even simpleblog offers.


• WordPress - Probably the most popular blog software out there.  But it uses PHP and mySQL, whereas I prefer ASP and Access since I know how to write in VBScript.  I installed PHP and mySQL and tried to get WordPress working, but ultimately could not.

I have been using simpleblog 2.3 for awhile, and 2.2 before that.  Version 3 is available and after looking at it before all the others, I decided to look at it again.  It has the advantage that I am already familiar with the code that Johann has used for 2.x.  While it still lacks the features I have been looking for, I grew tired of trying all the other solutions.  So I have upgraded sidefumbling to simpleblog 3.0.

Pros:

• Very simple installation using ASP with VBScript and an MSAccess database.
• Built-in RSS feed.
• Version 3 adds a sidebar for recent posts.
• Version 3 uses FCKeditor for creating posts, which is a customizable WYSIWYG editor.
• Easy to integrate it into your site by editing ASP files and including your own scripts.
• Use of CSS for easy manipulation of global settings for font, layout, etc.

Cons:

• No use of categories or the ability to group/search for posts based on keywords.
• No search engine.
• No notification of pending comments.
• No use of CAPTCHA for comment spam-prevention.
• Difficult to use code blocks for using literal code in posts, though I have figured out in FCKeditor how to do this.
• Admin interface is limited to accessing previous posts by using calendar to access posts written on specific date, i.e., you cannot just browse a list of your posts for the one you one; you have to use the calendar to find the day you want and then bring up any posts for that single day only.
• Cross-browser support is limited, mostly by layout issues.
• No built-in way for posting from a mobile device, which is nice when traveling or making posts while at a conference, etc.
• Not regularly updated.

Despite the cons, I offer my thanks to Johann for creating a free solution that has obviously worked for me.

DL membership does not automatically get updated when this is done, so I have been doing it manually.  It has been on my to-do list for awhile to write a script to copy the DL membership from the old account to the new one.  So I threw this together this morning.  It lacks some of the nice extras my other scripts have (finding the user by logon name, email results, true logging) but it does work.

You have to edit the script to give it the variables for the old and new users' dn.  It will skip security groups (any group without an alias) and also groups whose Notes (info) attribute contains the word SmartDL.  We use Imanami's SmartDL for automated DL membership when applicable.  Those will be automatically updated the next time each of their jobs run.

Download it here, or copy/paste below.

Code:  Show  Hide

A RIM article for troubleshooting EA failures listed several things to check, one of which was that the activation message was actually arriving in the mailbox.  So I checked the Inbox's deleted items cache for one of the mailboxes...nope.  I use a third-party utility called IMF Tune to augment the functionality of the IMF, so I have detailed logs of messages processed by the IMF. (To read a case study regarding my company's use of IMF Tune, go here.)

The logs showed that the activation messages were being deleted/archived at the gateway because their SCL ratings were above the threshold.  Some even were being redirected to the Junk E-mail folder (JMF).  I was wondering why this was the case since I have never had a problem with the activation messages being flagged by the IMF.

Then I remembered that I had updated the IMF definition files on January 18 with the 01/11/07 update, which is right around when the issue started.  For whatever reason, the IMF is now being more discriminatory against the activation messages.  To resolve the issue, I white listed the subdomain the activation messages come from: *.etp.na.blackberry.net.  And when it happened again today, I discovered that that user is in Europe and EA messages from those users come from a different subdomain: *.etp.eu.blackberry.net.

So if you BES and the IMF, be careful that your gateway and store thresholds don't keep the activation messages from reaching the inbox.  And if they do, white list the sender domain.  I didn't want to just white list all of blackberry.net, so I am using the subdomain that activation messages originate from.  If there is yet another contintental subdomain out there (for Asia Pacific, perhaps), I might just chain the white list filter to be blackberry.net AND the subject begins with RIM_.

I started Googling to see what I could find.  The org-level attribute to control UDG conversion was not set, nor has it ever been in my environment.  UDGs are being successfully upgraded by Exchange; it is just nested UDGs that were having a problem.  Then I found the reason, and there is actually a KB article for it: 898082.

By design, for performance reasons, when a UDG is a member, whether direct or nested, and the parent group is a USG, Exchange will not convert the UDG to a USG.  Only if the parent group, the one actually being assigned to a resource, is a UDG at the time it is added to the resource, Exchange will convert the parent group and enumerate all members for other UDGs to be converted.

This makes sense so Exchange doesn't enumerate members every time a group is added to a resource to check for member conversions.  Since conversion is meant to be a one-time event, performance would be adversely affected if it had to enumerate all members every time just to check for a UDG that happened to added since the last time.  So the enumeration only happens if the parent group is a UDG, which implies that the group has never been assigned to an Exchange resource and the one-time conversion can occur.

I was installing ESM on a new application terminal server this morning and could not get SP2 to install.  The error was that Exchange 2003 was not installed and, therefore, you cannot apply a service pack to it.  But I had just installed ESM right before the SP install.  After some troubleshooting, I discovered that I had prematurely created the registry key as described in KB 329136.

The article clearly states to install ESM and the service pack(s) before creating the key.  Apparently, this is why, since the setup routine sees that registry key and it breaks something in it.  Deleting the key and rerunning the SP setup allowed it to proceed normally.

I assume you would also have to delete the key before upgrading to a future service pack, so if you use the key to allow public folder management, remember that its presence will inhibit service pack installations.

I have updated the script, which can be downloaded here, to not error when this happens and include if it is unable to connect to a specific server and read the last full backup time.  The HTML rendering didn't look right for the server reported with an error, and I couldn't figure out why, so also updated how the table is built.  Now the report is one big table instead of every server in its own table.

I have updated the script, which can be downloaded here, to search for the groups based on their objectGUID, which never changes no matter what you do to the object (rename, move, etc.).  Instead of hard-coding the dn of the object, I hard-code the objectGUID.  Then I bind directly to the object based on the GUID to retrieve its dn, which is used in the search filter to find the users I want to modify.

Note that ADO allows you to bind to an object given just its GUID, without having to specify other connection parameters.  You can also use the hexadecimal or binary format of the GUID in the connection string; AD will figure out which format you are using. I used the binary format in my script so that I could just copy and paste the value from Hyena into my script without having to convert to a hex value.

A coworker brought this to my attention today, wondering about the highly suggestive nature of the toy. I don't consider myself to be a crude person, but it didn't take me more than one glance to recognize the dirty overtone the product implicitly conveys. I am a fan of Boots as much as any other parent/fan of Dora the Explorer, but this is taking "spank the monkey" a little too far.

Because it wasn't a content issue (mailboxes displayed fine) I could ignore permissions being the problem.  Knowing that everything except the content comes from the front-end server (stylesheets, scripts, controls) I started focusing on file version mismatches between the front-end and back-end.  Any patch that affects the rendering of OWA needs to be applied to the front-end first, and then to the back-ends.

I checked for hotfixes on both servers and they showed the same number of patches installed (based on KB article numbers).  The cause started to show itself when looking at directory structures.  The front-end server's highest numeric directory in /exchweb was 6.5.7651.9, but the back-end server's highest directory was 6.5.7651.25.  Researching what hotfix has a build number of 7651 yielded KB 911829.  This hotfix was released in April, but was rereleased in May as v2.

I patched the front-end server some time ago, but the back-end servers were only patched recently with this hotfix.  I used Microsoft Update to install the patch on these systems.  So what happened is that Microsoft rereleased the hotfix with newer files and a newer build number, but kept the article number under which it is published the same.  Microsoft Update doesn't detect that a newer hotfix is available when the article number remains the same.  Downloading the v2 hotfix and running it on the front-end server created the 6.5.7651.25 directory and resolved the issue.

So this issue was caused by Microsoft not using good enough detection methods in Microsoft Update, and by me for not installing the hotfix on all the servers at the same time.  The latter is easy enough to correct, but I doubt that the former will be fixed anytime soon.

• For those who have grown children - this is hysterical
• For those who have children past this age, this is hilarious
• For those who have children this age, this is not funny
• For those who have children nearing this age, this is a warning
• For those who have not yet had children, this is birth control

Things I've Learned From My Boys

1. A king size waterbed holds enough water to fill a 2000 sq. ft. house 4 inches deep.
2. If you spray hair spray on dust bunnies and run over them with roller blades, they can ignite.
3. A 3-year old boy's voice is louder than 200 adults in a crowded restaurant.
4. If you hook a dog leash over a ceiling fan, the motor is not strong enough to rotate a 42-pound boy wearing Batman underwear and a Superman cape. It is strong enough, however, if tied to a paint can, to spread paint on all four walls of a 20x20 ft. room.
5. You should not throw baseballs up when the ceiling fan is on. When using a ceiling fan as a bat, you have to throw the ball up a few times before you get a hit. A ceiling fan can hit a baseball a long way.
6. A double-paned glass window doesn't stop a baseball hit by a ceiling fan.
7. When you hear the toilet flush, followed by the words "uh oh," it's already too late.
8. Brake fluid mixed with Clorox makes smoke, and lots of it.
9. A six-year old boy can start a fire with a flint rock even though a 36-year old man says they can only do it in the movies.
10. Certain Legos will pass through the digestive tract of a 4-year old boy.
11. "Playdough" and "microwave" should not be used in the same sentence.
12. Super glue is forever.
13. No matter how much Jell-O you put in a swimming pool you still can't walk on water.
14. Pool filters do not like Jell-O.
15. VCRs do not eject PB&J sandwiches even though TV commercials show they do.
16. Garbage bags do not make good parachutes.
17. Marbles in gas tanks make a lot of noise when driving.
18. You probably DO NOT want to know what that odor is.
19. Always look in the oven before you turn it on; plastic toys do not like ovens.
20. The fire department in Austin, TX, has a 5-minute response time.
21. The spin cycle on the washing machine does not make earthworms dizzy.
22. It will, however, make cats dizzy.
23. Cats throw up twice their body weight when dizzy.
24. 80% of women will pass this on to almost all of their friends, with or without kids.
25. 80% of men who read this will try mixing the Clorox and brake fluid.

]]> 8/15/2006 4:35:00 PM http://www.flobee.net/?view=plink&id=133 133 Our IT Leadership team decided that it will promote more effective collaboration if the Default calendar permission for all IT employees is set to Reviewer (instead of the Default of None). As with many of my scripts, I started with the work Glen Scales has already done. Go there for information on the prerequisite for using this script to make the change (the need for ACL.dll).

Glen's script uses an input argument of a server name. My distributed environment doesn't allow for such a broad application, so I use the membership of a DL that contains the IT personnel. This DL actually contains other DLs, so I separately use another script by Richard Mueller that enumerates nested groups and puts the results into a domain local group that is used for other purposes.

After getting the group members, I loop through each member for only those with a mailbox that isn't hidden. For those who haven't been touched by the script before, a function is called that uses CDO to log into the mailbox, enumerate the calendar permissions looking for the Default entry, and change it to Reviewer. The user's local FreeBusy Data folder is also updated to set the Default to Editor since that permission goes hand in hand when setting permissions on the calendar.

To keep tabs on who the script has touched, a notation is added to extensionAttribute4 (customizable). Those with that notation are skipped in the future. Then an email is sent to the user informing them of the change. I chose to do this because Exchange users may be used to the fact the the Default permission is None; this way they are aware that their calendar is open for viewing. It also helps with new employees who are not aware of this "policy" and can mark items as Private as necessary.

Finally, an email is sent to the admin with the results of the job run. It includes the display name, mailbox server, and whether the permission was set or the object skipped (to catch entries that slip through my filter). I have scheduled this to run weekly, and I will get an email each time so I know that the script is successfully running and which users are being modified.

All of the variables that require customization are near the top. These are for mail configuration, search filter, and the notation parameters for touched mailboxes.

Download it here or copy below.

Code:  Show  Hide

I had written a batch file long ago to change the bitmask attribute for users whose mobile services are enabled for everything (0) and are not in the appropriate DL of authorized users to disable only EAS (5).  It was an inefficient script that required explicit permissions for each domain, called a command-line regex tool to format the ldifde export, and was prone to errors.

This updated script accomplishes the same thing, but more efficiently.  It processes all users at one time (inside a for loop) and uses implicit permissions.  It even emails the results of the number of users modified.  The script is customized for my environment, but you can tweak it as necessary. 

I have five user domains, but the DLs for authorization are in one domain.  I wanted it to be as dynamic as possible, but balancing that with all the extra code necessary to make every piece not rely on hard-coded information.  So you need to provide mail config information, the NetBIOS domain names you want to loop through, and the dn of the groups for each user domain.  The GC to search and the DC to make the change to will be determined automatically.

Download it here or copy below.

Code:  Show  Hide

My Problem with Christianism
A believer spells out the difference between faith and a political agenda
By ANDREW SULLIVAN

Are you a Christian who doesn't feel represented by the religious right? I know the feeling. When the discourse about faith is dominated by political fundamentalists and social conservatives, many others begin to feel as if their religion has been taken away from them.

The number of Christians misrepresented by the Christian right is many. There are evangelical Protestants who believe strongly that Christianity should not get too close to the corrupting allure of government power. There are lay Catholics who, while personally devout, are socially liberal on issues like contraception, gay rights, women's equality and a multi-faith society. There are very orthodox believers who nonetheless respect the freedom and conscience of others as part of their core understanding of what being a Christian is. They have no problem living next to an atheist or a gay couple or a single mother or people whose views on the meaning of life are utterly alien to them--and respecting their neighbors' choices. That doesn't threaten their faith. Sometimes the contrast helps them understand their own faith better.

And there are those who simply believe that, by definition, God is unknowable to our limited, fallible human minds and souls. If God is ultimately unknowable, then how can we be so certain of what God's real position is on, say, the fate of Terri Schiavo? Or the morality of contraception? Or the role of women? Or the love of a gay couple? Also, faith for many of us is interwoven with doubt, a doubt that can strengthen faith and give it perspective and shadow. That doubt means having great humility in the face of God and an enormous reluctance to impose one's beliefs, through civil law, on anyone else.

I would say a clear majority of Christians in the U.S. fall into one or many of those camps. Yet the term "people of faith" has been co-opted almost entirely in our discourse by those who see Christianity as compatible with only one political party, the Republicans, and believe that their religious doctrines should determine public policy for everyone. "Sides are being chosen," Tom DeLay recently told his supporters, "and the future of man hangs in the balance! The enemies of virtue may be on the march, but they have not won, and if we put our trust in Christ, they never will." So Christ is a conservative Republican?

Rush Limbaugh recently called the Democrats the "party of death" because of many Democrats' view that some moral decisions, like the choice to have a first-trimester abortion, should be left to the individual, not the cops. Ann Coulter, with her usual subtlety, simply calls her political opponents "godless," the title of her new book. And the largely nonreligious media have taken the bait. The "Christian" vote has become shorthand in journalism for the Republican base.

What to do about it? The worst response, I think, would be to construct something called the religious left. Many of us who are Christians and not supportive of the religious right are not on the left either. In fact, we are opposed to any politicization of the Gospels by any party, Democratic or Republican, by partisan black churches or partisan white ones. "My kingdom is not of this world," Jesus insisted. What part of that do we not understand?

So let me suggest that we take back the word Christian while giving the religious right a new adjective: Christianist. Christianity, in this view, is simply a faith. Christianism is an ideology, politics, an ism. The distinction between Christian and Christianist echoes the distinction we make between Muslim and Islamist. Muslims are those who follow Islam. Islamists are those who want to wield Islam as a political force and conflate state and mosque. Not all Islamists are violent. Only a tiny few are terrorists. And I should underline that the term Christianist is in no way designed to label people on the religious right as favoring any violence at all. I mean merely by the term Christianist the view that religious faith is so important that it must also have a precise political agenda. It is the belief that religion dictates politics and that politics should dictate the laws for everyone, Christian and non-Christian alike.

That's what I dissent from, and I dissent from it as a Christian. I dissent from the political pollution of sincere, personal faith. I dissent most strongly from the attempt to argue that one party represents God and that the other doesn't. I dissent from having my faith co-opted and wielded by people whose politics I do not share and whose intolerance I abhor. The word Christian belongs to no political party. It's time the quiet majority of believers took it back.

This script goes through all accounts in a given AD domain and whose primary email address is the "old" SMTP domain name, makes the primary a secondary, takes the username portion of the address and appends the new domain and makes it the new primary. I log all of the old address and new addresses to the screen, so redirect the output to a file to capture that. It doesn't check for preexisting addresses so conflicts can occur. I had previously done my own extract to look for those, so dealing with them manually was easier and faster than coding for that.

I modified the script each time I ran it to change the AD domain I wanted to search (though I could have just defined an array of domain names and looped through each of them), and ran it against DLs and public folders, too, adjusting the filter to return the different object types. You will need to do the same.

Download the code here, or copy below.

Code:  Show  Hide

The UNIX guys here like to give me grief about it because their Postfix logs contain the conversation/message ID on each line.  So they just do a quick grep for it and get each line that applies only to the message in question.  Figures.

Using MFCMapi to look at the properties of a conflict message, there are several properties that you'd think you could use, but when setting up a rule to use properties of the conflict message form, none of he properties are available.  And if you manually type in property name it gives you an error.

In the end, I tried setting the rule again to fire on subject contains "Conflict Message:" and it worked.  Huh.  So who knows what I was doing wrong before?  You can also have the rule fire if the message form is "Conflict Message."

When I was a kid, adults used to bore me to tears with their tedious diatribes about how hard things were when they were growing up; what with walking twenty-five miles to school every morning, uphill BOTH ways..yadda, yadda, yadda.  And I remember promising myself that when I grew up, there was no way in heck I was going to lay a bunch of crap like that on kids about how hard I had it and how easy they've got it!

But now...I'm over the ripe old age of thirty, I can't help but look around and notice the youth of today. You've got it so easy!  I mean, compared to my childhood, you live in a utopia! And I hate to say it, but you kids today don't know how good you've got it!

I mean, when I was a kid we didn't have The Internet. If we wanted to know something, we had to go to the darn library and look it up ourselves, in the card catalog!!

There was no email. We had to actually write somebody a letter - with a pen! Then you had to walk all the way across the street and put it in the mailbox and it would take like a week to get there!

There were no MP3's or Napsters. You wanted to steal music, you had to hitchhike to the darn record store and shoplift it yourself.  Or you had to wait around all day to tape it off the radio and the DJ would usually talk over the beginning and mess it all up!

We didn't have fancy crap like call waiting. If you were on the phone and somebody else called, they got a busy signal...that's it.

And we didn't have fancy Caller ID boxes either. When the phone rang, you had no idea who it was!  It could be your school, your mom, your boss, your bookie, your drug dealer, a collections agent, you just didn't know. You had to pick it up and take your chances, mister!

We didn't have any fancy Sony Playstation video games with high-resolution 3-D graphics. We had the Atari 2600, with games like "Space Invaders" and "Asteroids," and the graphics sucked! Your guy was a little square. You actually had to use your imagination. And there were no multiple levels or screens, it was just one screen forever. And you could never win.  The game just kept getting harder and harder and faster and faster until you died...just like LIFE!

When you went to the movie theater there no was such thing as stadium seating.  All the seats were the same height!  If a tall guy or somebody with a big hat sat in front of you and you couldn't see, you were just screwed!

Sure, we had cable television, but back then that was only like 15 channels and there was no on-screen menu. You had to use a little book called a TV Guide to find out what was on.  There was no Cartoon Network either. You could only get cartoons on Saturday morning.  Do you hear what I'm saying? We had to wait all week for cartoons, you spoiled little rats!

And we didn't have microwaves.  If we wanted to heat something up we had to use the stove or an oven.  If we wanted popcorn, we had to use that stupid JiffyPop thing and shake it over the stove forever like an idiot.

That's exactly what I'm talking about. You kids today have got it too easy. You're spoiled.
You guys wouldn't have lasted five minutes back in 1980!