NT Tips for Administrators

These tips have been compiled from many sources over several years. Many came from perusing Microsoft's KB including HOWTOs. I didn't add any tip that didn't make sense to me, although I have not exhaustively tested everything here. Readers beware. Many of these tips are inherently dangerous. Need I mention backup? Certain techniques may work for my environment and be questionable in yours. Please notify if you have corrections to the exising material or additional "hacks" to add to this compilation. Again, and finally use this data at your own risk. After all, they are administrator tips.

Hits: Failed to execute CGI : Win32 Error Code = 3

Consider making a direct contribution to help keep is-it-true.org on the Net by clicking on my Amazon honr system contribution paybox. FYI if you click on any of my Amazon book, movie, or music links and purchase anything from Amazon, is-it-true.org will get a small percentage. Consider coming back to my site and getting into Amazon from one of my Amazon links, if you are going to purchase an item. It will help keep my site on the Net.

--- A --- Admin Tips

• Access Denied: NT4 and NT2000 clients of Win95 shares
  
• Access Tokens: security context
  
• Accounts:
  • Addusers utility to add large number of user accounts
    
  • Recover lost administrator password
    
  • Change multiple accounts simultaneously
    
  • Create from command-line
    
  • Force logoff when work hours expire
    
  • Net User commandline duplicates functionality of User Manager for Domains
    
  • Rename from command-line
    
  • Determine who is logged on to remote PC
    
• ACLs:
  • DumpAcl dumps NTs permissions and audit settings freeware utility
    
  • NT / Windows 2000 NTFS Permissions Gotcha!
    
• Administration: Domain Admin from NT workstation client-based admin tools
  
• Administrative Shares: Disable Hidden Admin Shares C$ D$ ... Security issue
  
• Administrator:
  • IPC$ - gain admin access when logged in as a user
    
  • Rename Administrator account as a security measure Bull!
    
  • Administrator account: Emasculate as a security measure Bull!
    
  • Administrator password: Who changed it? Q173939
    
  • Free NT Admin Tools from SystemTools.com Q173939
    
  • Send Administrator Alerts
    
• Alt-Ctrl-Del: Delete key must be pressed last
  
• alt-ctrl-del: disable NT security dialog buttons
  
• Alt-Tab: Disable
  
• Anonymous Users: Restricting information available Security issue
  
• Applications: Restrict 16-bit
  
• ASPI: Driver Hell
  
• Associations: Lockdown
  
• AT: Allow nonadmins to issue AT commands
  
• Audit: E-Z Audit does inexpensive PC software audits and PC hardware inventories
  
• Authentication: NTLMv2 Security issue
  
• Autoexec.bat: Add paths in autoexec to NTs PATH environment
  
• Autologon:
  • Automate the logon process Security issue
    
  • Automate registry settings freeware utility
    

--- B --- Admin Tips

• Backdoors : Penetration Testing Tip #18: Backdoors - backorifice, subseven, netbus
  
• Backups:
  • Enterprise backup solutions
    
  • Replace locked files with InUse.exe Q228930
    
  • Replace locked files when NT restarts Q181345
    
• Batch files: Programming/Scripting Resources
  
• Batch Scheduling: Job Management and Scheduling
  
• BDC: Synchronization fails - recovering from minor LSA corruption Q199071
  
• Boot: Triple Boot Dos/Win3.x, Win9x, NT Q157992 lays out steps
  
• BSOD:
  • Auto-reboot after crashing
    
  • BlueSave writes NTs BSOD screen dump to text file Trialware
    
  • Line-by-line explanation Q99743
    
  • /PCILOCK resources
    
• Booting:
  • AutoReboot rather than BSOD
    
  • Create an NT boot disk
    
  • NTLDR Hacking Guide boot OS/2, NT, Win9x, DOS, Linux
    
  • ERD Commander allows xcopy, move, and delete NTFS access via NT boot disks commercial utility - readonly freeware version
    
  • Disable a Service or Device that Prevents NT from Booting Q165748
    
  • How long has server been up?
    
  • On schedule using shutdown.exe
    
  • Prevent open or minimized applications from restarting at reboot
    
  • UpTime display how long NT has been running freeware utility
    
  • Run batch file at NT startup with no one logged on
    
  • Steps to Recover a Failed Mirrored System/Boot Partition Q120227
    
• Briefcase Icon: Disable
  
• Browser: Election messages in event logs
  
• Bug Codes: Descriptions of Bug Codes for Windows NT Q103059
  
• Bug Fix: Remote shutdown causes lose of accounts Q243597
  

--- C --- Admin Tips

• C2: NT Server & Workstations gain C2 certification Orange Book
  
• Cache: CacheSet performance tunes NTs system Cache size freeware utility
  
• Cacls: Automate ACL changes Resource Kit
  
• CAT5: Patch Cable Creation Guide
  
• Change Detection: Penetration Testing Tip #20: Change Detection / Integrity Resource /Rootkits
  
• Chap: MS-Chap PPTP
  
• Ctrl2Cap: Maps Caps Lock to left-Ctrl freeware driver
  
• Chkdsk: Importance of running
  
• cdkey: Lost NT's CD key?
  
• Cloning: Identify When the System Preparation Tool Is Used Q180962
  
• Cluster: Scott Schnoll's Clustering Server Center
  
• com3-com4: Enable
  
• Commandline:
  • Control Panel applets
    
  • Create accounts - addusers.exe
    
  • Changing directories - wildcards make it easy
    
  • Enhancements in NT4.0
    
  • Command Help File
    
  • Logoff.exe - logoff using commandline utility
    
  • Comparison of NT commandline vs Linux commandline
    
• Compress: Registry
  
• Configuration: Change more than 400 hidden functions freeware
  
• Context Menus:
  • Disable right-click on desktop or explorer
    
  • add command prompt: to folder context menus
    
• Control Panel Applets: Application is not listed in Add/Remove applet
  
• Control Panel: Add to Start Menu
  
• Control Panel Applets:
  • Run from commandline, Start/Run, Batch files
    
  • Disable
    
  • Restrict access
    
• Control Panel: Add/remove programs does not work
  
• Copy: Scopy copies and maintains security
  
• Crash:
  • Auto-reboot after crashing server (BSOD)
    
  • Windows Online Crash Analysis
    
• CPU: CPUmon performance monitor (freeware) freeware utility
  
• CSNW:
  • Client Services for Netware Does Not Handle Files Correctly When PBurst Is Enabled Q177526
    
  • Setting Default Server and Script Options Q163979
    
• Ctl-Esc: Enable to start Task Manager
  

--- D --- Admin Tips

• Dates: Display 4 digit dates
  
• Debug: DebugView monitors debug output on local or remote systems
  
• Delete:
  • Emergency Undelete for NT freeware utility
    
  • Fundelete replaces Recycle Bin and protects GUI and commandline deletes freeware utility
    
  • SDelete securely deletes files conforming to DOD 5220.22-M sanitizing standard freeware utility
    
• DDE: Dynamic Data Exchange (DDE) and NetDDE FAQ
  
• Defrag: Registry and Page files
  
• Denial of Service : Penetration Testing Tip #19: Denial of Service (DoS)
  
• DHCP: DHCP Resources
  
• Desktop:
  • Icons redraw frequently Q151723
    
  • Re-create Default Icons Deleted from Desktop Q151723
    
  • Restrictions - no common groups, hide icons, ...
    
• Device Drivers:
  • Where and whether
    
  • Filewatch notifies you when there are updated vendor files
    
• DHCP:
  • Export db contents for analysis
    
  • Enable DHCP logging
    
  • Use jetpack.exe to compress WINS and DHCP databases
    
  • Remotely Reconfigure IP from Static Addressing to DHCP Q194407
    
  • Restore a Corrupted DHCP Database File Q173396
    
  • Stops Assigning IP Addresses to Clients
    
• Directory:
  • Fails when after applying restrict anonymous users restrictions
    
  • Print Directory information
    
• DIRUSE: Display disk usage for directory trees Resource kit utility
  
• DiskMon: Captures hard disk activity freeware utility
  
• DLLs :
  • Download the most common DLLs that suddenly disappears from your computer : www.dll-files.com ListDLLs lists DLLs loaded and path names of modules freeware utility
    Dependency Walker for dlls, exes, ocx, sys freeware utility
    
  • Windows NT/2000/XP Uses KnownDLLs Registry Entry to Find DLLs : Q164501
    NT, W2K, and XP uses the KnownDLLs registry entries to search for either 32-bit or 16-bit DLLs when loading the DLL. For 32-bit DLLs the KnownDLLs registry entry only affects the search for implicitly loaded DLLs. For 16-bit DLLs the KnownDLLs registry entry affects the search for both implicitly and explicitly loaded DLLs. If you incorrectly include a DLL name in the KnownDLLs registry entry, the LoadLibrary in Windows NT/2000/XP WOW fails to load a DLL located in the application's current directory.

• DMA: DMACheck compatibility checker SP6a utility
  
• Documents menu: Clear at boot
  
• DNS:
  • Stop Unauthorized DNS Zone Transfers
    
  • DNSSEC resources
    
  • Penetration Testing Tip #4: nslookup and DNS Zone Transfers
    
• Domains:
  • Administration from NT workstation client-based admin tools
    
  • Windows NT 4 domain models
    
  • Prevent WAN remote BDC controlling login SP4 utility
    
  • Control Maximum bandwidth used for domain synchronization
    
  • Promoting Demoting Moving Servers commercial utility
    
  • Renaming Q178009 - only if you MUST
    
• DOS: Denial of Service Attacks
  • IOCTL (Unprotected) Function Call Q236359
    
  • Malformed Image Header of Executable May Crash Windows NT Q234557
    
  • Switch between full screen and windows mode
    
• Drivers: Find Device Drivers
  
• Dump: Debug a Usermode Crash Dump Q162699
  
• DUN: Disable Save Password option Security issue
  

--- E --- Admin Tips

• Editors: WinHex Windows Hex Editor
  NT/W2K/Win9x, A handy tool for everyday and emergency use: Inspect or repair binary files, recover deleted files or lost data from corrupt drives. This hex editor grants access to data that other programs hide from you.
  http://www.techrepublic.com/download_item.jhtml?id=dr00320000510jed01.htm
• EIDE: FAQ Q141591
  
• Email:
  • ArGoSoft Mail Server freeware STMP/POP3/Finger server
    
  • Blat: Commandline email utility to send ascii or binary text. freeware utility
    
  • IA Email Server
    commercial
    • Anti-Spam features
    • Virus Scanning support
    • Corporate Policy Rules for incoming and outgoing messages
    • Multiple Kick Options
    • Mailing list options
    • Denial of Service attack prevention
    • Relay Mailboxes
    • ETRN / ATRN SMTP store and forward support
    • Multi-IP SMTP / POP3 service support
    • Support for multiple Homed domains
    
    
  • Inframail
    commercial email servers for any size organization
    
  • IIS supports Simple Mail Transport Protocol
    
  • Ipswitch's Imail Server
    commercial web-enabled, secure and spam-resistant mail server for Windows
    
  • Inetserv freeware STMP/POP3/Finger server
    
  • MDeamon Mail Server
    commercial
    • AntiVirus Plug-in
    • Content Filter Processing
    • LDaemon LDAP Server Support
    • IMAP4 support
    • Public Folders
    • Custom Mail Queue Support
    • Automatic Gateway Creation
    • Multiple Domain Support
    • Server-Side Mail Filtering
    • Mailing Lists
    • Integration with Outlook
    • Account Restrictions
    • List Pruning
    • Inactive Account and Old Mail Purging
    • NT Account Integration
    • Account Templates
    • Account Editor
    • Update Checker
    • Reverse Lookup Verification
    • Domain Gateways
    • On-Demand Mail Relay (ATRN)
    • Smart Mail Spooling and Routing
    • APOP, CRAM-MD5 and LOGIN Authentication Support
    • Dialup Control
    • Quota System Enhancements
    • Aliasing Advancements
    • System Tray Icons
    • Auto Responder
    • Priority Mail
    • MultiPOP
    • Programmable API
    • SMS Gateway Support
    • ESMTP Authentication
    • Spam Blocker
    • AntiSpam
    • Suppression Lists
    • IP Shielding
    • POP Before SMTP
    • IP Screening
    • Flexible Email Security
    
    
  • Merak Mail Server
    commercial
    • Full multi domain support
    • Security, anti spam and anti relay, antivirus options
    • Mailbox options
    • TCP/IP Protocols - SMTP/POP3/IMAP4/HTTP
    • Proxy Server
    • TLS/SSL - Secured SMTP and POP3 transfers
    • Mailing lists, list servers, executables, routes
    • ODBC support
    • Multiple CPU Support
    • Server, user, domain statistics
    • Content Filters
    • Web, command-line and GUI remote administration
    • Web mail and WAP mail support
    
    
  • Mercury Mail Server freeware email server
    
  • Pegasus E-Mail Client freeware
    
  • Postie commandline mailer
    commercial, supports the SMTP, ESMTP, MIME, BASE64, UUENCODE/UUDECODE, POP3, IMAP4, HTTP protocols
    
  • RFC821 : Simple Mail Transport Protocol
    
  • VPOP3 Email Server for Windows
    commercial Internet email server and gateway for small and medium sized businesses
    
• Encryption:
  • Data encryption for Windows NT
    
  • Is 40-bit or 128-bit installed? Security issue
    
• Environment:
  • Change environment variables using SETX.EXE
    
  • SetEnv - a better utility
    
  • Variable useful to login scripts
    
• ERD:
  • Can't create - Setup.log missing
    
  • Contents of ERD
    
  • Gotcha!
    
  • Steps Performed by the Emergency Repair Disk
    
• Error Message:
  • IPAddress key has invalid IP address
    
  • Translate error codes in event logs to error messages
    
• etc directory: Change location of etc directory
  
• Evaluation:
  • IsTrial reveals whether NT is a evaluation version freeware utility
    
  • U-Delploy converts evaluation version to retail in place commercial utility
    
• Event Logs
  • Access - Restrict access to application and system logs Security issue
    
  • Archiving Event Logs
    
  • Delete Corrupt Event Viewer Log Files
    
  • DumpEvt exports logs into format suitable for importing into a database freeware utility
    
  • Eventlog FAQ
    
  • EventSave automates saving and deleting logs on a schedule freeware utility
    
  • Forsenics - Set NT to crash when event logs fill Security issue
    
  • Log File Location
    
  • NT EventMonitor freeware tray application
    
  • Save Dump Events Mandatory in NT SP4
    
  • Security Event Log Analysis Tool $30
    
  • SysLog Servers for NT/2000/XP
    
  • Suppress Browser Election Messages
    
  • Suppress Print Jobs Processed Logging
    
  • Security Event Descriptions Q174074
    
  • Security Log - Logon codes
    
• Exchange:
  • Controlling SMTP Relaying with Microsoft Exchange
    
  • Email traffic analysis utility commercial
    
  • Restrict access to all employees distribution list
    
  • Preventing and Correcting Large Distribution List Message Storms
    
• Exploit:
  • Patchwork : Internet Anti-Intrusion Patch Verification and Intrusion Evidence Scanner Microsoft Windows NT
    
• Explorer:
  • Automatic Screen Refresh
    

--- F --- Admin Tips

• F6: NT does not detect any harddrives.
  
• FAT32: driver commerical utility - freeware readonly version
  FAQ: Microsoft's Frequently Asked Questions & Highlights
  
• FAX: Solutions for NT specialized informational site
  
• File System: FileMon monitors activity freeware utility
  
• Files:
  • How To Remove Files with Reserved Names such as LPT1 or PRN
    
  • Find and Remove Locked files.
    
  • NTHandle - which program has file or directory open freeware utility
    
• Firewalls:
  • Personal Firewalls
    
• Floppy Drive: Restrict remote access
  
• Fly-out Menus: Speeding Up Cascading Menus
  
• Folder:
  • Fails when after applying restrict anonymous users restrictions
    
  • Print Directory information
    
• Forensics:
  • Penetration Testing Tip #8: Forensics, Incidents, Analysis, and Evidence
    
• FPNW: File and Print Services for Netware
  • File Locking Behavior Q188710
    
  • Configure Printers on FPNW to Service Pserver.nlm Q173531
    
  • Security Issues Occur Due to How WinNT Handles FPNWCLNT.DLL Q99885
    
  • Slow Performance Saving Documents to FPNW Server Q187766
    
  • Win95 clients using Client for Netware will not be able to run a file that is on a File and Print Services for NetWare (FPNW) volume. Q199208
    
• FTP:
  • FTP Resources
    
  • Using FTP Batch Scripts Q96269
    

--- G --- Admin Tips

• GSNW: Gateway Services for Netware GSNW
  
• Gotcha!: Index of will focus on bug reports, malicious code hotfixes, shot yourself in the foot, ..
  
• Groups: usrtogrp scripts group membership Resource Kit
  
• Guest: DelGuest - deletes the built-in Guest account in Windows NT freeware
  

--- H --- Admin Tips

• HAL:
  • UpToMP upgrades NT for multi-processor mode
    
  • /PCILOCK directive
    
• Handles:
  • Find which program has file or directory open freeware utility
    
  • HandleEX GUI tool which program has file or directory open freeware utility
    
• Harden NT:
  • Build a bastion host in practice
    
  • Configure NT and Windows 2000 stack to resist network Denial of Service
    
  • Procedures for Hardening Windows NT Workstation
    
• Hardware Query Tool
  
• HD:
  • Full Warning
    
  • TechRepublic: 200 ways to revive a HD
    
• HexEditor: Winhex
  NT/W2K/Win9x, A handy tool for everyday and emergency use: Inspect or repair binary files, recover deleted files or lost data from corrupt drives. This hex editor grants access to data that other programs hide from you.
  
• Hidden Admin Shares: Disable Hidden Admin Shares C$ D$ ... Security issue
  
• Hotfixes :
  • HotFix & Security Bulletin Service
    Register to automatically receive security bulletins. Search by Product/Technology and Service Pack.
  • QChain Install Multiple Hotfixes With Only 1 Reboot in Windows NT and Windows 2000
    
  • Query NT, W2K, or XP registry for applied hotfixes
    

--- I --- Admin Tips

• IANA:
  • Protocol Numbers and Assignment Services
    
• Icons:
  • Desktop icons redraw frequently Q151723
    
  • Re-create Default Icons Deleted from Desktop Q151723
    
• IDE: Add More Than Two IDE or ESDI Drives Q103934
  
• IDS :
  • Intrustion Detection System Tips and Resources
    
• IE:
  • AboutURLs
    
  • ActiveDesktop, Disable ActiveDesktop Start/Settings menu option
    
  • Automatic Proxy Caching, How to Disable Internet Explorer Automatic Proxy Caching Q271361
    
  • Cache, Bloated cache in Roaming Profiles environment
    
  • Cache, Clear Internet Explorer cache when IE exits
    
  • Content Advisory, Remove Content Advisory Password
    
  • Downloads : improve IE performance
    
  • Fullscreen, Open in full-screen
    
  • Help Font, Control Internet Explorer and Windows Help Font Size
    
  • History folder on Start Menu
    
  • Kiosk mode for Internet Explorer
    
  • Logo, Remove branded logo
    
  • Online Support Site for Internet Explorer
    
  • Pagefaults, Internet Explorer Pagefaults / General Protection Faults
    
  • PopKill: Kill those annoying pop-up ads!
    
  • Privacy companion
    
  • Restrictions, Internet Explorer Restrictions
    
  • Unsafe list, Modify IE6 Unsafe file list
    
  • User Agent String
    
• IIS:
  • Apache Migration Tool Sets
    
  • Hide IIS Script Code
    
  • IIS supports e-mail solution using SMTP to transmit and deliver Internet mail.
    
  • IIS FAQs, Resources and Tips
    
  • List of Services Needed to Run a Secure IIS Computer
    
  • Logging : HOW TO Enable IIS Logging Site Activity
    
  • Logon Privileges Required for Anonymous Access
    
  • Metabase Registry IIS NT,W2K.XP tip
    
  • NTFS Standard Permissions for IIS
    
  • SecureIIS Application Firewall
    
  • Security Checklist
    
  • Security "What If" Tool, How to Use the IIS Security "What If" Tool
    
  • Start/Stop services using NET START/STOP
    
  • support site : 15seconds.com
    
  • support site : iisanswers.com
    
  • support site : iisfaq.com
    
• Installation:
  • Change where NT expects to find install files
    
  • Create a NTFS partition greater than 4GB during installation
    
  • Change NTs default application install folder from C:\Program Files
    
  • Int13 1024 cylinder limitation & C drive
    
  • Lost the NT Installation CD key
    
  • NT does not delete unattended installation parameter file Security
    
  • Parallel installation
    
  • Re-create lost installation boot disks
    
  • Triple Boot Dos/Win3.x, Win9x, NT Q157992 lays out steps
    
  • Unattended installation gotcha!s
    
  • Windows Installer : Top 10 Myths
    
• Installation Fails: Use debug version of ntdetect.com
  
• IntranetWare:
  • Remove IntranetWare Client for Windows NT Q175806
    
  • Why client is SLOW reading files from Novell file server. Q173815
    
• Intrusion:
  • ICEpack and BlackICE Intrustion Protection
    
  • Tips for NT Administrators in the area of Penetration Testing, Hacking, and Intrusion Detection
    
• IP:
  • ipconfig /all gives your ip information.
    
  • IP Address Subnetting Tutorial
    
  • IP Addressing and Subnetting
    
  • IP Private address ranges
    
  • tracert utility traces routes
    
• IPC$ Gain admin access when logged in as a user
  
• IPX: IPX network number vs NT virtual network number Q150546
  

--- J --- Admin Tips

--- K --- Admin Tips

• Kernel:
  • Open Files Can Cause Kernel to Report INSUFFICIENT_RESOURCES Q192409
    
  • Poolmon, Use Poolmon to Troubleshoot Kernel Mode Memory Leaks Q177415
    
• Keystroke Loggers:
  • Penetration Testing Tip #22: Keystroke loggers and spy software / hardware
    

--- L --- Admin Tips

• Last Access Timestamp:
  • NTFS - disable (performance)
    
• Legal Links : Penetration Testing Tip #17: Legal Resources re: Hacking, cracking, and security
  
• Life cycle:
  • Windows NT Server Retirement Cycle
    
• Locked Files:
  • Replace with InUse.exe Q228930
    
• Log:
  • Monitor and capture all text a program writes to the screen
    
• Log settings:
  • Allow non-Administrators to change Log settings Q173367
    
• Logon Related Issue:
  • Authenication - NTLMv2 Security issue
    
  • Automatic Logon - Enable Q97597 Security issue
    
  • Cached password hashes Security issue
    
  • Restricting Concurrent Logons
    
  • Control which domain controller a workstation uses to establish a secure channel Q181171
    
  • Displaying Company Logo or Other Bitmap During Logon
    
  • Force Logoff Due to Inactivity Security issue
    
  • GINA - Graphical Identification and Authentication DLL
    
  • Hide the Logon Script Dialog Box Q176197
    
  • Hide last logon ID Security issue
    
  • Integrity Checking on Secure Channels with Domain Controllers Q183859
    
  • LoggedOn displays logged on users for remote PCs freeware utility
    
  • Login Script Tricks and Tips
    
  • Logon scripts - Determine whether login from Win9x or various NT platforms Q190899
    
  • Logon scripts - performing operations depending on user group membership
    
  • Logon scripts - prevent users logging onto multiple workstations simultaneously
    
  • Logon scripts - Troubleshoot Local Logon Scripts Q102907
    
  • Machine account replication - effects on domain Q175468
    
  • Make Shell Start Before Logon Script Finishes
    
  • Multiple Windows Open Automatically at Logon - Disable Q197077
    
  • Remove Shutdown button from logon dialog screen
    
  • Track Account Lockouts Using the Checked Netlogon.dll
    
  • Why are there no account lockout messages in security log for domain controllers? Security issue
    

--- M --- Admin Tips

• Mac:
  • MacWorld NT tips (left side of page) Services for Macintosh SFM
    
  • MacWorld NT tips (left side of page) Q102726
    
  • Overview of MacPrint Services for Windows NT Server Q102726
    
• MAC Addresses: Determine
  
• Madge: Getting Madge PCMCIA Token Card to Join a Domain During Setup Q165958
  
• Management:
  • NT/W2K/XP Management Tools: SetupBatcher, SetupExplorer, NTInfo, NTreport, WinRemote
    
• MBR:
  • Backup/Replace using DISKSAVE.EXE
    
  • Rewrite
    
• MDAC: Component Checker
  
• Memory:
  • "Out of memory" error - Increasing the Desktop Application Heap Q126962
    
  • Tweak Parameters
    
  • Increase application virtual memory space from 2GB RAM to 3GB RAM
    
• Memory Leaks:
  • Finding Memory Leaks; release with empty.exe
    
  • Use Poolmon to Troubleshoot Kernel Mode Memory Leaks Q177415
    
• Memory Management: Debug kernel pool corruption Q192486
  
• Menus: Control cascade speed
  
• Microsoft:
  • Authentication and Security for Internet Developers
    
  • Exchange Server home page
    
  • DLL Help lookup which version where
    
  • ftp.microsoft.com
    
  • Hardware Compatibility List
    
  • Newsgroups
    
  • NT Server
    
  • NT Workstation
    
  • NT 4.0 Option Pack
    
  • Resource Kit updates
    
  • Security Advisor Page
    
  • Security Notification Service
    
  • Support get a support contract if at all possible - save your sanity
    
  • Technet Subscription to Technet is single best investment NT Admin can make.
    
  • Workstation Deployment Resources
    
• Mirror: Disk Mirroring (RAID Level 1) in Windows NT
  
• MMC: Microsoft Management Console
  
• Modem Sharing: Small Business Server supports modem sharing
  
• Monitor: Server Alive freeware utility
  
• Mouse: Acceleration
  
• Moving NT folder: Don't - there are some hard coded paths, such as c:\winnt\system32\ instead of %SystemRoot%\system32\ in the registry.
  
• MSD: Create a WinMSD Report
  
• My Computer: Disable
  

--- N --- Admin Tips

• Name: Server can have multiple names (aliases)
  
• Name Space: WinObj is ultimate NT Object Manager namespace viewer freeware utility
  
• Named Pipes: Filemon monitors activity freeware utility
  
• Net Commands: Microsoft Net command
  
• NBTSTAT: Determine MAC address and who is logged on to remote PC
  
• Ndis: How to add NDIS2 drivers to Network Client Administrator Q128800
  
• Net: Ping works but Net View and Net Use fail
  
• Netcat: Penetration Testing Tip #21: netcat ( nc ) utility resources
  
• Net Use: Account validation during network access
  
• NetBIOS:
  • Block NetBIOS over TCP/IP 135, 137, 138, 139
    
  • NetBIOS Service codes in the NetBIOS suffix
    
• Netbt.sys: Crashes upon receipt of broadcast 0.0.0.0 Q243478
  
• Netdom: Access Denied fixed with v1.8
  
• Netlogon: NETDOM resets failed secure channel
  
• Netmeeting:
  • ILS directory service for NetMeeting
    
• Netware:
  • Gateway Services for Netware GSNW
    
  • NT equivalents of NetWare Rights
    
  • Broadcasts - Disable
    
  Network:
  • Discovery Tool freeware
    
  • Reduce network traffic - dormant connections
    
  • Sniffers
    
• Network Neighborhood:
  • Hide Server or Workstation Security issue
    
  • No Entire Network Security issue
    
  • Hide your own workgroup or domain contents
    
  Newsletters:
  • CMP Net Newsletters
    
  • Desktop Engineer's Junk Drawer Netsletter
    
  • NTBugtraq Security & Bug Exploits Newsletter
    
  • NT FAQ Newsletter
    
  • NT Insider Newsletter software development
    
  • ntwarenewsletter
    
  • Tipworld Newsletters
    
• NICs: Manually remove network adapter from registry Q146333
  
• Notepad:
  • Configure Notepad to automatically insert the date / time
    
  • Configure Notepad to Open unknown file types
    
  • Make Notepad Wordwrap
    
  • Using Notepad and Wordpad
    
• Nslookup & DNS:
  • Penetration Testing Tip #4: nslookup and DNS Zone Transfers
    
• ntdetect.com: Debug version
  
• Null connection :
  Null sessions :
  • Restricting information available Security issue
    
  • A look at null sessions
    
• NT:
  • IsTrial reveals whether NT is a evaluation version freeware utility
    
  • U-Delploy converts evaluation version to retail in place commercial utility
    
  • Manually Remove Windows NT
    
• NTFS:
  • NTFSDOS accesses NTFS partition from DOS, Win95 or Win98 boot disks commercial with readonly freeware
    
  • CACLs automates ACL changes
    
  • Cancel conversion
    
  • Last Access Timestamp - disable (performance)
    
  • Metadata files
    
  • Permissions
    
  • File / Folder copy/move rules
    
  • NTFSDOS Professional allows xcopy, move, and delete access via NT boot disks commercial utility - readonly freeware version
    
  • NTFSInfo display NTFS volume info freeware utility
    
  • Streams displays which files have alternate streams content freeware utility
    
• NTLMv2: Authenication Security issue
  
• NTLM: Penetration Testing Tip #1: SmbRelay captures NTLM hashes Security issue
  
• NWLink: Tuning NWLINK Registry Parameters Q99745
  

--- O --- Admin Tips

• Office 2000 : File and Registry Eraser freeware utility
  
• Office:
  • Gideon removes hidden GUID privacy issue
    
  • EasyRecovery FileRepair repairs and restores corrupted MicrosoftR Office files
    
  • Recover corrupted office files
    
• Objects: WinObj is ultimate NT Object Manager namespace viewer freeware utility
  
• ODBC/OLE: MDAC Component Checker
  

--- P --- Admin Tips

• Page File:
  • Clean Page File at shutdown Security issue
    
  • How large should it be?
    
• Password Oriented Issues:
  • Recover lost administrator password
    
  • Administrator password. who changed it? Q173939 Security issue
    
  • Cached password hashes Security issue
    
  • Change Filtering & Notification Q151082
    
  • disable NT security dialog Change Password button
    
  • Cracking Security issue
    
  • nt password cracker freeware utility
    
  • Encrypt hashes in SAM with 128-bit encryption using Q143475 Security issue
    
  • Enforcing strong passwords Security issue
    
  • Enforcing alphanumeric passwords Security issue
    
  • Expiration warning - change 14-day warning
    
  • Penetration Testing Tip #12: Password Recovery Resources
    
  • Where NT Stores Passwords
    
• Path names: Support for greater than 255 characters
  
• paths: Parse paths in autoexec to NTs PATH environment
  
• PCI:
  • PCI & AGP Support page
    
  • Resource conflicts, /PCILOCK parm
    
• PCMCIA Modems: Troubleshooting Q131868
  
• Peer Services: Disable NT workstations shares
  
• Performance: Tweak Memory Parameters
  
• Performance Monitor:
  • Architecture
    
  • Control Remote Access
    
  • perfmon.xla, Help diagnose performance problems
    
  • TCP, IP, ICMP, & UDP Counters
    
• Performance Tuning: Frob sets NT foreground and background quanta freeware utility
  
• PERL:
  • Carvdawg's Perl Page
    
  • valuable tool for any OS
    
• Permissions:
  • DumpAcl dumps NTs NTFS permissions and audit settings freeware utility
    
  • Create and modify share permissions with rmtshare commandline utility
    
  • NTFS
    
  • NT / Windows 2000 NTFS Permissions Gotcha!
    
• Personal Firewalls:
  • Personal Firewalls resources
    
• Ping: works but net view and net use fail
  
• Ports:
  • TCP, UDP
    
  • PortMon monitors and displays serial and parallel port activity NT/Win9x freeware utility
    
  • PortsLock lets you control which users can access what TCP/IP based protocols
    NT/W2K/XP tip
• PPP: logging
  
• Print:
  • All users of the NT workstation, How to install a network printer only once for
    
  • Allow Print Operators to add a printer
    
  • Centralized tracking and management commercial utility
    
  • Delete Stuck Print Job
    
  • Hide Printer
    
  • HP Web JetAdmin a must for administrating large numbers of networked printers
    
  • Jobs processed recorded in event log, disable
    
  • Manually Delete Print Shares or Printers Q102116
    
  • Manually Remove and Reinstall a Printer Driver Q135406
    
  • Print Server Migration Utility Server Resource Kit
    
  • Move Default Paging and Spool File Q123747
    
  • Prevent Users From Adding/Removing Printers
    
  • Printer install generates message The RPC server is unavailable.
    
  • Spool formats: Raw, EMF, Text, Journal
    what is type is and when NT uses each type
    
  • Troubleshooting: How to Print Windows NT 4.0 EMF Spool Files Q179774
    
  • Change print job priority for a workstation - Open the printers window. Right-click the printer. Select 'Properties'. Click the 'Scheduling' tab and drag the slider to the desired priority.
    
  • Error Printing From Lotus Notes - Cannot access printer or printer driver (may be due to insufficient memory) Notes supports up to 32 characters in printer names - if printer has more letters in its name, use different printer.
    
  • Registry entries for printing Q102966
    
• Processes:
  • PMon displays process, thread and NT context swaps freeware utility
    
  • Remotely kill server processes using rkill Resource kit
    
  • pslist monitors local and remote process and thread activity freeware utility
    
• Profiles:
  • Logon scripts - performing operations depending on user group membership
    
  • How to Create and Copy Roaming User Profiles Q142682
    
  • User Profile copying
    
  • User Profile Quotas
    
• Product Key:
  • Keyfinder retrieves your Product Key (cd key) from registry
    
• Protocol :
  • Ethereal free network protocol analyzer for Unix and Windows
    
• Proxy Server: Backup/Restore configuration
  
• Public: How to Protect Windows NT Desktops in Public Areas Q143164 Security issue
  

--- Q --- Admin Tips

• Quanta: Frob sets NT foreground and background quanta freeware utility
  

--- R --- Admin Tips

• RAID: Disk Mirroring (RAID Level 1) in Windows NT
  
• RAS:
  • Determine Whether a Client Is Connected by RAS or LAN
    
  • Error codes in System log Q117304
    
  • Improve data transfers using RAS, RRAS, or slow links. Q151996
    
  • NTP RAS Manager provides management needed for RAS / RRAS commercial product
    
  • Name resolution VERY slow after switching from LAN to RAS connection.
    
  • User Cannot Log On to LAN Because of RAS Logon Failures Q177125
    
• Recover:
  • NTRecover accesses dead NT systems via serial connection commercial with freeware readonly version
    
  • SDelete unrecoverable deleted files conforming to DOD 5220.22-M sanitizing standard freeware utility
    
• Recycle Bin: Fundelete replaces Recycle Bin and protects GUI and commandline deletes freeware utility
  
• Redirector: Increase network performance
  
• Registry :
  • RegCleaners: automated clear inconsistent and obsolete sections from registry
    
  • RegDACL: Set Windows NT Registry DACLs freeware/shareware commandline utility
    
  • RegDel: Delete registry entries from commandline with source code freeware
    
  • RegMaid: powerful GUI tool to examine and clear registry corruption and deadwood freeware
    
  • RegMon: Spy on registry accesses freeware
    
  • RegUtil: Powerful registry utility freeware
    
  • Registry: Compress
    
  • Registry: DumpReg exports to text format freeware utility
    
  • Registry: Defrag
    
  • Registry: Disable registry editors
    
  • Registry: Disable remote registry editing Security issue
    
  • Registry: MultReg manages multiple remote registries commercial utility
    
  • Registry: Remote registry editing Win9x registry using NT
    
  • Registry: regedt32 restore error: Registry Editor could not accomplish the requested operation. Q158294
    
  • Registry: Scanreg scans for strings in registry keys, values, or data Server Resource Kit utility
    
• Remote:
  • NetOp Remote Control for Windows
    
  • Shutdown of workstation or server
    
  • Freeware VNC : Virtual Network Computing
    
• Repair directory: Automate update of repair directory
  
• Replication: Service
  
• Resource Kit: utilities
  
• Resource Kit: Updated utilities - free download
  
• Rights: Standard and Advanced User Rights
  
• Risk Analysis: RiskWatch
  
• Rollback: Registry rollback utility kills NT
  
• Roaming profiles: debugging
  
• Roaming profiles: Bloated IE cache
  
• ROM BIOS: Shadowing - Not for NT
  
• RPC: Troubleshooting
  
• Run Command: Remove from Start menu
  
• RunOnce: Welcome Owner message or action
  

--- S --- Admin Tips

• Save Dump Events: Mandatory in NT SP4
  
• Schedule: Move a Scheduled Job to Another NT Server Q178555
  
• Scopy: Copies and maintains security
  
• Scanners:
  • Penetration Testing Tip #13: Network scanners, detectors and vulnerability scanners
    
• Screen Savers:
  • Activate screen saver when no one is logged on.
    
  • OpenGL uses too many CPU cycles
    
  • Transparent Screen Lock for Windows 2000/NT/XP
    
• Scripting :
  • TechNet Webcast: Basic Parts List for Building System Admin Scripts
    
  • Scripting Toolkit : Win32 utilities to make scripting a bit easier
    
• SCSI:
  • NT detects only 1st eight LUs
    
  • NT does not detect any harddrives.
    
  • What NT knows about your SCSI devices
    
• Security :
  • Penetration Testing Tip #8: Forensics, Incidents, Analysis, and Evidence
    
  • Microsoft Baseline Security Analyzer (MBSA)
    
  • Microsoft Technet Security Tips
    
  • Security Dialog:disable NT security dialog buttons Alt-Ctrl-Del
    
  • Security Log: Logon codes
    
  • Sample security policies and guidelines
    
  • Wayne's Security Resources
    
• Serial Ports: PortMon monitors and displays serial and parallel port activity NT/Win9x freeware utility
  
• Server :
  • Hide from network neighborhood Security issue
    
  • Windows NT Server Retirement Cycle
    
• Service Packs:
  • Can't install - Setup.log missing
    
  • Gotcha!
    
  • Service Pack 2
    
  • SPCheck freeware SP checker
    
• Services:
  • LocalSystem account context
    
  • Allow non-admins to start/stop NT Services commerical utility
    
  • Start, Stop, Pause, Continue services remotely freeware & resource kit
    
  • Change service account and passwords commerical utility
    
  • Delay starting a service until the services it depends on are started Q193888
    
  • Alternative to SRVANY freeware and commercial utilities
    
  • Services: Srvany.exe from the Resource Kit is used to run applications as services.
    • Create a User-Defined Service, Srvany.exe Q137890
      
    • Passing Environment Variables to Applications started by Srvany.exe Q197178
      
    • Troubleshooting Srvany using CMD.EXE Q152460
      
• Setup:
  • Does not work - add/remove programs does not work
    
  • Change more than 400 hidden functions freeware
    
• Shares:
  • Create and modify shares and share permissions with rmtshare commandline utility
    
  • Disable NT workstation peer services
    
  • Hidden Home directories
    
  • Restore Share Definitions To Another Server
    
  • Win9x clients can not access long share names
    
• Shortcuts:
  • Create shortcuts from commandline, automation Resource Kit Utility
    
  • Windows NT 4.0 Shortcuts Resolve to UNC Paths - admin access problems Q158682
    
• Shutdown:
  • Clean Page File at shutdown Security issue
    
  • Eliminate 'Not Responding'
    
  • Force shutdown at certain time, certain days freeware utility
    
  • Remote shutdown of workstation or server
    
  • Remove Shutdown button from logon dialog screen
    
  • WrapUp executes programs when you logoff
    
• SID: NewSID SID changer complete with full source code freeware utility
  
• SMS:
  • Resources On The Web, SMS
    
  • SMS Discussion group
    
• Sniffers :
  • ButtSniffer
    freeware, hacker tool
    
• Penetration Testing Tip #14: Snort freeware packet sniffer
  
• SQL :
  • Penetration Testing Tip #6: SQL Server worm exploits blank sa password
    
  • MS SQL Support sites
    • www.mssqlcity.com
      
• Ssh :
  • Ssh Secure Shell Resources
    
• Stack Overflow in dos apps at commandline
  
• Start Menu:
  • Change word "Start" or associated logo
    
  • Faster Fly-out menus Cascading menus
    
  • Hide Run Command
    
• Startup: Run batch file with no one logged on
  
• Startup Folders: Hold down Shift during your logon and any programs in the startup folders will not run.
  
• Stenography: Penetration Testing Tip #11: Information Hiding Techniques for Steganography and Digital Watermarking
  
• Stop
  • Auto-reboot after crashing server (BSOD)
    
  • Windows Online Crash Analysis
    
  • Stop 0x00000050: Services for Macintosh Q240864
    
  • Stop 0x00000050: NT 4.0 SP4 Tcpip.sys Q238763
    
  • Stop 0x0000007F: Causes Q137539
    
  • Stop 0xA: Netbt.sys crashes upon receipt of broadcast 0.0.0.0 Q243478
    
• Stop Screens: Debugging Q123750
  
• Switching: Disable ALT-TAB
  
• Sync: Force buffer flush freeware utility
  
• Symbol file: versions
  
• Syskey:
  • Determine whether Syskey has been applied to a system
    
  • Encrypt hashes in SAM with 128-bit encryption. Q143475
    
  • Has it been applied?
    
  • Setpass Does Not Update the NetWare Password with SYSKEY Q243419
    
  • SYSKEY on Terminal Server Causes Intermittent Logon Problems Q243419
    
• Syslog:
  • SysLog Servers for NT/2000/XP
    
• System Requirements: Windows 2000 Pro, Server, Advanced Server, Data Center Server
  
• Systems applet: Add company logo to General tab
  
• System Preparation Tool: Cloning - Identify When the System Preparation Tool Is Used Q180962
  

--- T --- Admin Tips

• Tape: Enterprise backup solutions
  
• Task Manager:
  • Disable
    
  • Launch Task Manager
    
• tcp/ip:
  • Block NetBIOS over TCP/IP 135, 137, 138, 139
    
  • Book Recommendations
    
  • Host names (RFC952)
    
  • Implementation details of Windows 2000 TCP/IP
    
  • IP forwarding buffer consumes all available kernel memory Q221926
    
  • Penetration Testing Tip #16: tcpip resources related to penetration testing
    
  • Ports (TCP, UDP)
    
  • TCPView enumerates active TCP and UDP ports freeware utility
    
  • Using TRACERT to Troubleshoot TCP/IP Problems in Windows NT
  • Troubleshooting tcp/ip LAN and RAS Routing Issues Q128647
    
  • Uri's TCP/IP Resources List FAQs, tutorials, guides, web pages & sites
    
• Telnet: Telnet servers for Windows NT
  
• testdir.tmp: Temporary file created during copy to NTFS partition
  
• Threads: pslist monitors local and remote process and thread activity freeware utility
  
• Time:
  • Grant normal users right to set system time
    
  • Synchronize client workstation to server time
    
  • Time Synchronization resources
    
  • TimeServ service sets PC clock to within 10 milliseconds NT Resource Kit Uility
    
  • Remotely Check the Time Zone on Windows NT Q207563
    
• Tip of Day: Add your own
  
• Triple Boot: Dos/Win3.x, Win9x, NT Q157992 lays out steps
  

--- U --- Admin Tips

• UDP: TCPView enumerates active TCP and UDP ports freeware utility
  
• Uninstall: Manually Remove Windows NT
  
• Unix: Windows NT Services for UNIX
  
• Update:
  • Windows Update Site
    
• UpTime:
  • Displays how long NT has been running freeware utility
    
  • net statistics
    
• UpToMP: Utility upgrades NT for multi-processor mode
  
• User Manager for Domains:
  • Change multiple accounts simultaneously
    
  • Commandline User Manager for Domains
    
• Users:
  • Create accounts from command-line using ADDUSERS
    
  • Disable accounts vs delete accounts
    
  • Force logoff when work hours expire
    
  • Limit number of users logging onto server
    
  • Profile copying
    
  • Rename accounts from command-line
    
• Utilities: Windows NT Adminstrative Toolset freeware
  

--- V --- Admin Tips

• VDM: Make separate VDM default for 16-bit apps
  
• Video Drivers: How to Check the Video Driver Q200435
  
• Virtual Memory: Increase application memory space from 2GB RAM to 3GB RAM
  
• VolumeID: Changes NT and FAT volume IDs freeware utility
  
• VPN:
  • Virtual Private Networking Technote
    
  • Virtual Private Networking Tips
    
• Vulnerability:
  • DOS: IOCTL (Unprotected) Function Call Denial of Service Attack Q236359
    
  • DOS: Malformed Image Header of Executable May Crash Windows NT Q234557
    
  • Promote Privileges: Protect KnownDLLs Lookup Table
    

--- W --- Admin Tips

• Webserver: IPCheck monitors your servers shareware
  
• Welcome: RunOnce Welcome Owner message or action
  
• Welcome splash screen: Disable - rename %Systemroot%\System32\Welcome.exe
  
• Win9x:
  • "Access Denied" Accessing Windows 95 Shares from Windows NT 4.0 Q169841
    
  • Slow Copying from WinNT to Win95 using IPX
    
  • Event ID descriptions truncated using Win9x reader
    
  • Event ID descriptions truncated using Win9x reader
    
  • Remote edit Win9x registry using NT
    
• WINS:
  • Architecture and Capacity Planning
    
  • How to Move a WINS Database to Another Server Q193820
    
  • Use jetpack.exe to compress WINS and DHCP databases
    
  • Tombstoning
    
• Windows Animation: Disable
  
• Wireless WLAN security resources : tools, whitepapers, books
  
• Workgroup: Hide contents in Network Neighborhood
  
• Windows Key: Disabling the Windows Key on Microsoft Natural Keyboard (Windows+ shortcuts) Q181348
  
• Wireless :
  • How To Configure a Wireless Link That Uses Infrared in Windows XP ( Q305551 )
    
  • Penetration Testing Tip #23: Wireless penetration testing resources
    
• Workstations: Change settings on many workstations simultaneously 3rd party commerical utility
  
• WSH :
  • Disable Windows Scripting Host ( WSH )
    

--- X --- Admin Tips

--- Y --- Admin Tips

--- Z --- Admin Tips

Consider making a direct contribution to help keep is-it-true.org on the Net by clicking on my Amazon honr system contribution paybox.

FYI if you click on any of my Amazon book, movie, or music links and purchase anything from Amazon, is-it-true.org will get a small percentage. Consider coming back to my site and getting into Amazon from one of my Amazon links, if you are going to purchase an item. It will help keep my site on the Net.