Encryption is a two-edged sword though, and it must be very carefully planned before being rolled out. The same scrambling of data that keeps thieves from getting at the data can also keep a sysadmin from getting at the data in a disaster situation. If you use the built-in Windows encryption for example, you are screwed if you can’t log into Windows. That means your hard drive doesn’t even have to fully crash for the data to become inaccessible. You will have to make sure you have a very robust backup plan in place for your laptop users. If you use a third-party tool such as the excellent TrueCrypt, you still need to backup your files, but it’s possible to restore the volume as long as the header is intact and you have the correct passwords and keyfiles.

Backups are the life-blood of a sysadmin. If backing up your system is not the most important thing you do on a daily basis then you have no business being a sysadmin. So with all of that said, here is a good batch file to get you started with backing up the encrypted folders or drives on your Windows laptops:

@echo off
setlocal

@set src=X:
@set dst=U:\encbackup
@set args=/XD "%src%\Recycled" "%src%\System Volume Information" /COPYALL /B /SEC /MIR 
@set opts=/R:5 /W:3 /LOG+:c:\synclog.txt /NFL /NDL /TEE /ETA

IF NOT EXIST %src% GOTO QUITNOSRC
IF NOT EXIST %dst% GOTO QUITNODST

robocopy %src% %dst% %args% %opts%
GOTO PAUSEQUIT

:QUITNOSRC
echo Couldn’t find "%src%".
echo Your encrypted volume is not mounted.
GOTO PAUSEQUIT

:QUITNODST
echo Couldn’t find "%dst%".
echo If you are NOT connected to the network then this is normal.
GOTO PAUSEQUIT

:PAUSEQUIT
pause
@cls
exit

This is a modified version of a well layed out robocopy script I found on the internet somewhere. The src variable holds the drive letter or folder of the encrypted volume that needs backing up. The dst variable is where the backed up files should be placed. In this case they would go in a folder called “encbackup” in the user’s network home folder. The args and opts variables set up some common exclusions and loggings and such. You can see all of the options for robocopy here. Each laptop user would run this file whenever they come back in the office and hook up to the network.

# touch /root/mysql-nightly1.sql
# touch /root/mysql-nightly2.sql
# touch /root/mysql-nightly3.sql
# touch /root/mysql-nightly4.sql
# touch /root/mysql-nightly5.sql

Here is the script:

#!/bin/sh

##: Go home
cd /root

##: Keep five days of backups on hand
dumpfile=(`ls -1tr mysql-nightly?.sql`)
dbserver=’localhost’
dbadmin=’you@domain.com’

mysqldump --host=$dbserver --user=user --password=password \
 --all-databases > ${dumpfile[0]}
if [ $? -eq 0 ]; then
  echo "Successfully dumped MySql database from $dbserver."\
   | mail -s "INFO: MYSQL DATABASE DUMPED" $dbadmin
else
  echo "Error dumping MySql database from $dbserver." \
   | mail -s "ALERT: ERROR DUMPING MYSQL" $dbadmin
fi

##: Restart the database server
/sbin/service mysqld restart

cd -

Here is the cron job entry:

18 21 * * * /root/backup-database.sh > /dev/null

Desktops

@echo off
cls
:Creates a desktop power profile

:QUERY
powercfg.exe /Q cust_desktop
IF NOT ERRORLEVEL 1 GOTO QUIT
IF ERRORLEVEL 1 GOTO DELETE

:DELETE
powercfg.exe /D OLDPROFILE

:CREATE
powercfg.exe /C cust_desktop

:ADJUST
powercfg.exe /X cust_desktop /monitor-timeout-ac 0
powercfg.exe /X cust_desktop /monitor-timeout-dc 0
powercfg.exe /X cust_desktop /disk-timeout-ac 0
powercfg.exe /X cust_desktop /disk-timeout-dc 0
powercfg.exe /X cust_desktop /standby-timeout-ac 0
powercfg.exe /X cust_desktop /standby-timeout-dc 0
powercfg.exe /X cust_desktop /hibernate-timeout-ac 0
powercfg.exe /X cust_desktop /hibernate-timeout-dc 0
powercfg.exe /X cust_desktop /processor-throttle-ac NONE
powercfg.exe /X cust_desktop /processor-throttle-dc NONE

:GLOBAL
powercfg.exe /G off /OPTION BATTERYICON
powercfg.exe /G off /OPTION RESUMEPASSWORD

:ACTIVATE
powercfg.exe /S cust_desktop

:QUIT
@cls
exit

Laptops

@echo off
cls
:Creates a laptop power profile

:QUERY
powercfg.exe /Q cust_laptop
IF NOT ERRORLEVEL 1 GOTO QUIT
IF ERRORLEVEL 1 GOTO DELETE

:DELETE
powercfg.exe /D OLDPROFILE

:CREATE
powercfg.exe /C cust_laptop

:ADJUST
powercfg.exe /X cust_laptop /monitor-timeout-ac 0
powercfg.exe /X cust_laptop /monitor-timeout-dc 15
powercfg.exe /X cust_laptop /disk-timeout-ac 0
powercfg.exe /X cust_laptop /disk-timeout-dc 30
powercfg.exe /X cust_laptop /standby-timeout-ac 0
powercfg.exe /X cust_laptop /standby-timeout-dc 0
powercfg.exe /X cust_laptop /hibernate-timeout-ac 0
powercfg.exe /X cust_laptop /hibernate-timeout-dc 0
powercfg.exe /X cust_laptop /processor-throttle-ac NONE
powercfg.exe /X cust_laptop /processor-throttle-dc NONE

:GLOBAL
powercfg.exe /G on /OPTION BATTERYICON
powercfg.exe /G off /OPTION RESUMEPASSWORD

:ACTIVATE
powercfg.exe /S cust_laptop

:QUIT
@cls
exit

...
zone "foo.com"{
    type master;
    file "db.foo";
    notify yes;
    allow-update{
        localhost;
    };
};
zone "1.168.192.in-addr.arpa"{
    type master;
    file "db.192.168.1";
    allow-update{
        localhost;
    };
};
...

This gives processes running on localhost the ability to make ddns updates on those zones. Just change “localhost;” to whatever host dhcpd is bound to if it isn’t running on the same server. You can also specify multiple hosts or a whole subnet using the “192.168.1.0/24″ format. After you have configured BIND it’s time to tell dhcpd where to send updates. You do this by adding the following to your dhcpd.conf file:

ddns-update-style   interim;
...
subnet 192.168.1.0 netmask 255.255.255.0 {
  ...
  ddns-updates on;
  ddns-domainname "foo.com.";
  ddns-rev-domainname "in-addr.arpa.";
  ...
}
...
zone foo.com. {
    primary localhost;
}
zone 1.168.192.in-addr.arpa. {
    primary localhost;
}
...

This tells dhcpd where to send ddns update requests and for what domains. Be sure to monitor your syslog as you fire everything up to make sure you aren’t getting any ddns errors from either of the two daemons.

• Outlook wants to tell you that you can’t set up an exchange
  connection while Outlook is running the first time you open it. Just
  click cancel and go right back in and do the same thing again and this
  time it will let you. Typical Redmond.
• Do the 1-step migration if you can. It will import calendar
  items into schedule+ data on the exchange server and import it
  automatically rather than having to save that .sc2 file and import by
  hand.
• When it comes to sharing folders like Calendar and Contacts, it’s
  not enough to just assign permissions in Outlook. You have to also go
  into Active Directory Users and Computers and give the person who will
  be accessing the folder Full Mailbox Rights to the person being
  accessed. I know it’s crazy but I confirmed it on newsgroups and
  that’s the only way I could get it to work too.

So far so good. We’ll see if everything blows on Monday.

’Link to the Groupwise Object API
Set GWApp = CreateObject("NovellGroupWareSession")
Set fso = CreateObject("Scripting.FileSystemObject")

’Login to Groupwise
Set GWAccount = GWApp.Login()

’Check if we’ve already run
If fso.FileExists("\\fileserver\temp\path\" & GWAccount.Owner.EmailAddress & ".tmp") Then
  WScript.echo "Already ran.  Quitting!"
  GWApp.Quit
  WScript.Quit
End If

’Find the account you want to add to the proxy list from the Global 
Address Book
Set GWEntry = GWAccount.SystemAddressBook.AddressBookEntries.Find("(<last Name> CONTAINS ""Migrator"")")
Set GWAddress = GWEntry.Item(1)

&#8217;Add the account as a proxy
call GWAccount.AccountRights.Add(GWAddress, 65535)
call GWAccount.Refresh

&#8217;Touch a file to let us know things ran well
Set ngwFile = fso.CreateTextFile("\\fileserver\temp\path\" & GWAccount.Owner.EmailAddress & ".tmp", True)
ngwFile.WriteLine("Archive " & GWAccount.Owner.EmailAddress & " " & GWAccount.DefaultPathToArchive)
ngwFile.Close
 
&#8217;Finish
GWApp.Quit

It uses the Groupwise Object API. We created a Groupwise account called “Groupwise Migrator” to run the migration wizard with but you can put anyone’s last name in their that you want to add as a proxy. We also touch a temp file just so we don’t run twice on the same machine. Run it early on after the user boots up so their is little chance that they might already be proxied into someone’s box. Enjoy!

• Download source: gwproxyadd.zip

For the 1U servers we cut strips of 2×2’s to a length of 30″(76.2
centimeters). For the 2U servers we cut 3 2×4’s to 30″ and 1 piece of
3/4″ plywood to 3″ by 30″ to act as a baseplate. We covered the wall
with 2 sheets of 4×8’ plywood to mount everything on. Space the bottom
strip and the top strip 17.5 inches apart for both 1U and 2U servers.