Friday, January 28, 2011

Is it safe to store data on a hard drive for a long time?

Is it safe to backup data to a hard drive and then leave it for a number of years?

Assuming the file system format can still be read, is this a safe thing to do. Or is it better to continually rewrite the data (every 6 months or so) to make sure it remains valid?

Or is this a stupid question?

  • I want to say probably (as long as you keep it away from magnets ;-), but I'm not sure. For long-term storage I would transfer the data to some archival format like a DVD - I think that like CDs, they're supposed to last 100 years. You can still keep the HD around for easy access, of course, but the DVD gives you a reliable backup.

    Jeremy Huiskamp : Just curious, but can you point to studies that demonstrate the long term reliability of optical media? Are there certain materials/brands that last longer than others? I have heard (but not experienced) that regular consumer-writable optical disks can become unreadable in a matter of years.
    Martin C. : DVDs (especially the ones you use for burning yourself) have lower life-expecations as HDDs.
    patjbs : Most CD/DVD lifetime estimates I've seen point to more around 10-15 years, and that's in optimal conditions. Non-optimal storage of optical storage media tends to decrease their lifetime dramatically. And I've seen this reflected in my observations.
    Eddie : Backing up a 500GB drive to DVD is pretty painful. Optical media may or may not last as long as a hard drive, depending on many factors.
    duffbeer703 : There are "archival grade" writable optical media, but the actual lifespan is questionable AND require very specific environmental conditions.
  • I wouldn't trust important backups to any single device for any significant length of time.

    I've had plenty of CDs that couldn't be read after a while. (Cheap ones, admittedly, but I'm leary of the longevity claims made.)

    I've had hard disks silently corrupt data.

    I seem to remember I've even had SSD failures, although with a low number of writes I'd expect them to be pretty reliable.

    Aside from all of these things, using a single copy means you've got no protection against physical disasters: fire etc. If you have multiple copies, you can separate them physically. Ideally I'd take some number (e.g. 3) of copies and run a checksum (I usually use MD5) periodically over everything. If one of the copies becomes corrupt in some way, if you've got multiple other copies you should be able to trust the majority, and create a new backup to replace the corrupted one. (Of course, if you keep the correct checksums in a separate place, you could trust even a single backup which still gives the right checksums, as the canonical source for replacements.)

    Of course, how much trouble you go to depends on the value of the data. My personal home data is only backed up on a RAIDed NAS. My work data is in Google datacenters, which I trust fairly strongly :)

    From Jon Skeet
  • I would say you should recycle the media every other year or so - that is, replacing the drive, disc or tape with whatever there is to replace it with and keep more than one copy.

    Few things lasts forever, optical media can degrade rapidly depending on quality, method of writing to it and environment where it's stored. Mechanical parts can always fail or there could be bugs in the firmware that is related to time or to wear and tear.

    I've pondered over your question often, it would be convenient with something that is guaranteed to stay working for say 5 years. There's tapes and other form sof backup media rated for 10 or more years but I'd never trust that, at least not without a decent amount of redundancy (several copies on different batches).

    Keeping the data fresh and continually recycled seems to be the reliable way to go - that way you get to test it regularly as well.

  • From the article

    What advice do you have for long-term storage of disk drives and other media?

    Keep your hard drives in a climate controlled environment within an acceptable temperature and humidity range. Also, protect the drives from electrostatic discharge (ESD) and vibration -- this is normally done in their packaging, but it's important to prevent ESD, physical shock and excessive vibration when the drives are removed for storage.

    All magnetic storage media has a finite life because magnetic fields start to decay as soon as they are written. This means a tape or drive will not retain its data forever. In a proper storage environment, it's reasonable to expect that the drive should remain readable for up to 10 years.

    The concern is more about the drive's mechanical reliability; will it physically spin up? After a very long period of disuse, the spindle bearings or head actuator may be stiff, resulting in read/write errors. These considerations are particularly important for long-term archival storage systems, as well as the new class of removable hard-disk drives that are now appearing from ProStor Systems Inc., Imation Corp., Quantum Corp. and Iomega Corp.

    From splattne
  • HDDs have actually quite high life-expectations, at least from the magnetic side (setting external magnetic fields asside). The main problem with them is, they could eventually suffer mechanically, i.e. not spin up if they are not used regularely, as some oils and coplings could become a problem.

    The safest approaches to really long-time storage in my opinion are:

    • stream to one or more magnetic tapes
    • print to paper and/or micro-film
    • keep copies on operating (running) HDDs distributed over several physical machines and locations
    • use an additional external backup space like Amazon S3

    Optical media, especially the ones available for consumer use have unexpected low life-expectancy. You should at least check the quality of the raw data read every two years. You could have lost data in the meantime, though.

    EDIT: An important aspect in this case is also that you should add checksums to the stored files (MD5, SHA1, etc.), so you'd be able to realize that some corruption occured (or not).

    From Martin C.
  • They will store data safely for a few years but you would be better to copy them every two years or so yes.

    From Chopper3
  • Given your other options for backup, HDD is the safest way to go. Other options include Magnetic Tape, SSD and optical media.

    Let's examine the pitfalls of each:

    MT: More prone to erasure when exposed to a magnetic field than a HDD. Readers are also becoming harder and harder to find. You don't want to come back in 5 years and find that there's no way to remove the data from your medium.

    SSD: Reliable in that there are no moving parts. They are prone to electrical degradation after several read/write cycles which is troublesome and potentially dangerous. The likelihood of losing data while the drive is not in use is slim, however.

    Optical Media: The least reliable of the bunch. They're extremely prone to physical degradation (bending/warping) and it requires very little to throw them out of their deflection spec. Further, the encoding scheme used to write data to most optical media is rather complex, creating a greater likelihood of single element failure leading to unreadability.

    HDDs: Solid, sealed devices. Can be damaged by physical shock more easily than most of the above devices. Has precise mechanical parts that can lead to failed read/writes if damaged.

    The benefit of HDDs, however, is that they ARE sealed. All of the moving parts are stored in an air-filtered enclosure. The magnetic stability of the bits on the disk is quite high and unlikely to change.

    Further, if the mechanical parts fail, it is possible to have the platters removed and the data recovered from them directly.

    There's no perfect option, but of the imperfect ones, HDD would probably be your best bet.

    From ParoX
  • I've had hdds fail while "in storage", i.e. sitting in a climate-controlled room for a few years that, when called into duty again, refused to spin up or be booted from.

    So no, I wouldn't say that this is a particularly good idea. As others have said, as part of a blunderbuss strategy it is one way of keeping a copy of your data, but it probably shouldn't be your only one.

    From Lunatik
  • One additional suggestion is that you should also always move data to the current format technology as soon as the previous technology is nearing its end of life. For example, currently I'd suggest moving away from IDE drives, as computers are starting to ship without IDE connectors and controllers.

    Similarly in the audio/video archiving we have moved from Cassette (VHS) to CD (or LaserDisc) to DVD, and now to flash storage.

    You might keep a USB-to-IDE adapter around, but along with regularly recycling your data between storage devices and locations, you should also keep in mind moving the data to current technology so as not to wait 10 years to find out you can no longer access the data on that 5.25" floppy disk.

  • If you want your data to survive or any period of time:

    • Use tape if access is infrequent. Follow environmental guidelines and do the homework to determine how often you need to rotate the media.
    • Use disk if you need access to the data. The disks should be "active". A disk in a closet is likely to either fail or get thrown out a few years down the road.

    Using a third party provider is another alternative. Something like Amazon S3, Mozzy or a similar service gives you an ultra-low cost way to store stuff.

  • Do not store your hard drives for any length of time. They are designed to be on. If you don't let the HD spin up every now and then, they will go bad. I'm talking months or a year here.

    They will break if not used. MTBF is "guaranteed" for drives in use, not in storage.

    From Thomas
  • It sounds like you're not so much concerned about hardware failures, but file corruption and bit rot. In this case, ZFS is your best ally. If data preservation is your goal, consider using RAIDZ2 if you can afford it, or at least RAIDZ1. RAIDZ is comparable to RAID5, except it uses a variable stripe width to eliminate the infamous RAID5 write hole. This is especially useful with a cheap NAS, because power failures likely won't corrupt the array. The file corruption and bit rot are taken care of by real-time disk scrubbing, in which the data is constantly being checksummed to verify it's accurate. Those are just the tip of the iceberg with how ZFS is THE filesystem of choice.

    If you want an easy NAS setup at home with ZFS built in, check out http://freenas.org. The latest release candidate includes ZFS, and it's not that hard to set up.

    It will be interesting to see the long term results of switching to ZFS simply for data preservation... it's too new at the moment. However, the facts are all there, and it's a no-brainer: the best file system for data integrity is ZFS.

    From churnd
  • Blu-ray seems to be nice solution for this problem.

    From m1k4

Hide users when connecting to Windows Server 2008

If I RDP to a Windows Server 2008 box without proving any username or password information I get to see a list of the users on the computer. In Windows Server 2003 this list was not broadcasted. How can I make WS2008 not advertise what users are on the system? Thanks.

UPDATE: More specifically, this is Windows Server 2008 Web Edition 64 bit.

  • I think this reghack still works in 2008.

    I'm curious as how to reproduce this, I cannot get the RDP client in Vista to connect to a Server 2008 at all without first providing the login credentials manually... the server's I've tried are all in a domain though. Perhaps the old RDP client does that though?

    pbz : I don't have that registry key in WS2008 (specifically SpecialAccounts\UserList). A simple way is to connect without providing the password or provide the wrong password. After you click cancel you'll see a list of possible users much like in the Vista screen shot in that article. I can't believe they even have this for a server OS.
    Oskar Duveborn : You can just create the key. I do not get such a list, the RDP dialog just rethrows the credentials box if I pass it the wrong ones - I never get to actually init an RDP Window without a correct username and password. If it's a domain thing or if it's just that I use the latest RDP client (think that's it) I dunno ^^
    pbz : I know the article claims it works for WS2008, but for me it doesn't. I followed the instructions and triple checked, but they don't have an effect. Not sure why it behaves differently for you. I use Windows Server 2003 to connect with RDP v6. Are you using NLA by any chance?
    Oskar Duveborn : Hmm NLA could be it, yes. I'm afraid I don't have any more ideas to the original problem though - atleast not until I've had time to try it from a 2003 server outside of this environment :/
    Zoredache : @I'm curious as how to reproduce this -- login via rdesktop from a Linux box.
    pbz : For now, as a workaround, I decided to rename the Administrator account (I was planning on doing that anyway). If I rename the Administrator account to let's say XXX on the login screen I can still see the "Administrator" user, but you can't login if you just provide the password. You don't get to see XXX though. Looks to me like they hardcoded in the UI expecting to always have an account called Administrator. If I switch to "Other User" and type XXX and the password it works. Pretty stupid IMO.
    pbz : Well, it turns out this doesn't really work. After a reboot I see XXX as an option.
    pbz : And that, seeing XXX as an option should've clued me in... I feel so stupid, I'm gonna go and sit in the corner now. Thanks for your help.
  • This was written for Vista, but it works fine on my Server 2008 development server:

    "This is possible via the Windows Local Security Policy Editor, or “secpol” tool. To launch the Local Security Policy Editor click start, Control Panel, System Maintenance, Administrative Tools, local Security Policy. Click “Continue” to the prompt presented by the User Account Control. If you are not presented with one, it's fine, just move on.

    In the Local Security Policy editor you will see two panes, one on the left with tree-view navigation and one on the right which will have the actual definitions and items to edit. On the left hand side, expand (either by clicking on the arrow or double clicking) the "Local Policies" section, and then click on "Security Options". On the right hand side, scroll down until you see "Interactive logon: Do not display last user name". Double click on this entry and you will be presented with a dialog box that has two options - "Enabled" and "Disabled", with Disabled being selected as default. Change this setting to "Enabled", and then click on the OK button.

    After double clicking “Interactive logon: Do not require CTRL+ALT+DEL” select the Disable option and hit OK. Next, close the Local Security Policy editor, as you are done. Log off. When you are prompted by a request to press CTRL-ALT-DEL do so, and you will get the classic style logon screen you have been labored so hard to achieve."

    There also seems to be another way. I have not tested that one.

    Oskar Duveborn : +1 I look forward to a report by the pbz if this works... it's interesting if this option somehow how become enabled ^^
    pbz : I actually came across this setting while searching the net. Unfortunately it doesn't have any effect :( I have "Do not display last user name" to enable and "Do not require CTRL+ALT+DEL" to disable. Thanks.
    pbz : The second link seems to deny the ability to login, which would lock me out of the box :) I'll make a new account and try that as well; I'll keep you posted.
    David Collantes : I will keep looking as well 'til I find a proper solution.
    pbz : OK guys, sorry about the storm in the teacup. Please read the updated comment on the top of the page. It actually occurred to me what was going on when I tried to login with a random non-existing account and notice it was displayed in the list. My guess is that their intention was to save me time for retyping the last username, but in my case it was a huge time waster until I figured out what was going on. Thanks for your help!
  • I misunderstood how the logon process works. Please read the question comments for details.

    From pbz

As a system administrator, what Firefox plugin helps you do your job?

I know that there are several Firefox plugins that are invaluable for development. What plugins exist that are useful for system administration, monitoring, and the like? What plugins make your day-to-day job as a system or network administrator easier?

  • Foxyproxy - I cant stand getting attacked by others when they walk over with their stats and say "Hm this Serverfault.com you wasted 5 minutes of our time on it."

    Portman : Wish I could upvote this more.
    Nick Kavadias : this looks more like a tool that would give sysadmins work to do! Maybe give it to all the end users as a ploy to get better funding for network security projects?
    From Shard
  • Xmarks, cause who wants to maintain a local only copy of their Firefox bookmarks. Xmarks will sync your bookmarks across Firefox, IE etc on all your computers. It's fast and stays out of the way.

    Christopher Galpin : Now when will it sync my Chrome bookmarks? :(
  • LastPass. So I don't have to remember the loads of accounts I use (and can generate very strong passwords for each of your accounts), both personal and at work.

    From Ivan
  • ShowIP - allows me to see quickly the IP address of the server where a particular website is hosted. Assists in managing my many clients websites.

    DNSCache - quickly disable/re-enable Firefox's builtin DNS Cache, particularly good if your also manipulating the site's DNS at the time

    ScreenGrab - particularly good at capturing that error and sending to the developers.

    Milner : +1 for screengrab, makes life a lot easier!
    From Quog
  • If you're using amazon ec2; elasticfox

    From xkcd150
  • Even for IT, I'd have to put FireBug at the top of the list, too much good information in there.and

    From WaldenL
  • Firebug and YSlow! FTW

    However I don't see why a web browser is a crucial tool for sysadmins, curl ? wget ? telnet host 80 ?

    Matt Simmons : I admin vmware server 2.x. If I don't run a website, I've got to use the 1500 character-long command lines.
  • WebMail Notifier - Tracks web email accounts

    Live http headers - great for trouble shooting websites

    Ghostery watch the websites that watch you

  • ReloadEvery - so I can get SO refresh automagically while working!

    AdBlockPlus - because so many sites have ads that I don't care about.

    Mentioned before, but super +1 for Firebug and YSlow because there's typically some good information that can be gleaned depending on what issue you might get roped in to.

    From Milner
  • Greasemonkey and the many scripts available for it is all I need.

  • Tamper Data this is handy when you have to examine HTTP headers. This may be necessary if you have virtual hosts in a hosting environment. We also insert a field in the header to identify web machines in some of our web farms to identify problem hosts.

    From mryan1
  • Charles Proxy with Firefox plugin is much better than Firebug network statistics.

  • Delicious Bookmarks to sync my bookmarks across machines.

    spoulson : Yes! Yes! Yes! It's like a catch-all of all the useful content I've come across, tagged and sorted.
  • You can't work without something to give you rhythm

    From Dani
  • From talonx
  • Nagios Checker is pretty nice.

    From jwiz
  • Fireftp for when you don't want to install an ftp client

    From Bourne
  • In addition to others already mentioned, I find SQLite Manager invaluable.

  • Update Scanner - For every site you have keep tabs on that doesn't have email notifications or rss.

    If you ar using google apps:

    Active Inbox - GTD for mail.

    From Erik

How can I map a VMS directory on a Windows 2003 Server?

Is this even possible without compromising the server's security?

  • Samba is the canonical system used to do this on Unix-like systems and did support VMS at one point. However I'm not sure that it still does in the main trunk - you could try an older version. Directories can be shared from the VMS server via the samba server or mounted off a Windows machine via smbmount.

    If you don't want to compile your own version, HP maintains a port of Samba for VMS, which can be downloaded here.

    Alternatively, you could see if the Pathworks32 client will run in Win 2k3 server. Lastly, you may be able to just upload/download files via FTP.

    Keng : rats...they aren't going to let me install anything on the VMS side.
  • Pathworks for OpenVMS (if installed on VMS) provides integration with active directory. Security can be controlled with inter-domain trusts (Windows side) and ACLs with HOSTMAPs that map active directory names to OpenVMS accounts. You could limit the capabilities of the relevant OpenVMS accounts to match any security policy.

    OpenVMS files can have varying record formats, and not all of them can be easily translated to Windows files. Pathworks does a reasonable job translating record formats, but for some files the result is not usable.

    Care should be taken with file version numbers, as the Windows side can see only the file with the highest version. When a Windows client deletes a file from a shared directory, an older version can appear and confuse the client.

    From gimel
  • You could try setting up the OpenVMS system as an NFS server and the Windows 2008 server as an NFS client. The biggest problems with this approach are the fact that OpenVMS has versioned files (so that deleting a file only deletes the latest version) and the fact that OpenVMS filesystems are case-insensitive.

    From what I've read, OpenVMS NFS is also very picky about what it will accept; anything off kilter will cause it to reject the NFS traffic.

    With OpenVMS 8.x, HP TCP/IP is included - as is NFS.

    From David
  • Whether it's Samba or NFS, nothing in the Windows world is likely to compromise the VMS system - the chances of someone leaving malware on the share that could hurt the VMS system are insignificant.

    Or did you meant the other way? That something about the mapping could affect the Windows server? In that case, there'd be nothing more risky than any other drive you mapped on the Windows server.

    From Ward

Printer MAC Addresses

I have three printers that I have to put on our internal network using the printers' internal NICs. They are all currently attached to Windows XP machines and shared via the OS.

So I need to submit details to the networking folks to get IP addresses for each printer.

How do I find the MAC addresses of these printers (they are all HP LaserJets)?

Edit:

Printers:

  • HP LaserJet 3050
  • HP LaserJet 1600
  • HP LaserJet 2420

All are attached via USB currently.

Edit:

None of the printers currently have IP addresses. They all have the capability but currently are not setup.

  • There should be a menu choice to print configuration (on the printer itself). Other than that (or using an application that might have come with the printer for configuration, that might report a MAC address), I do not know.

    TStamper : he doesn't have the IP address so how will he ping
    Berek Bryan : TStamper is correct no ip addresses
    David Collantes : Berek, you should reword your entry. You wrote "I have three printers that I have to but on our internal network using the printers' internal NICs." But later you say they are attached via USB. I assumed, by your first sentence, that there were IPs assigned.
  • Print a test page with the network configuration from the printers. If they have a NIC in them the test page should display the mac. I believe LaserJets also have the mac printed on one of the physical labels on the case. You might have to open a drawer or lift a lid somewhere to find it, depending on what model LJ.

    Berek Bryan : i tried the test page with no luck. i will scourer the case for the addresses physically on them. thanks for the ideas.
    squillman : Are you sure there's a NIC in them then? The configuration page should say something about a JetDirect if the printer is seeing them. You should also get a page kicked out with the JetDirect configuration if the printer recognizes the card.
    Berek Bryan : yes...all there have ethernet jacks
    David Collantes : Squillman, he doesn't know what he is talking about.
    squillman : The other thing you can do is download the JetDirect software, plug the printers into the network and have the software find them. You don't need IP to do that. Other then that *shrug*
    Berek Bryan : @squillman thanks for the feedback and thanks for not being a jerk about it.
    From squillman
  • When you did a 'test page', did you do it from the client machine or the printer?... if you did it from the client machine, I doubt you'll get good information about network settings of the printer (specially if you're connecting through USB).

    Doing a quick google you can find the manual for your 3050, check for others:

    Network configuration page
    The Network configuration page lists the current settings and properties of the all-in-one. To print the Network configuration page from the all-in-one, complete the following steps:

    1. On the control panel, press Menu.
    2. Use the < or the > button to select Reports, and then press .
    3. Use the < or the > button to select Network report, and then press .
    Berek Bryan : thanks totally missed that on my initial google search
    From l0c0b0x
  • HP LaserJet 3050

    page 271

    http://bizsupport2.austin.hp.com/bc/docs/support/SupportManual/c00495173/c00495173.pdf


    HP LaserJet 2420

    page 85

    http://h20000.www2.hp.com/bc/docs/support/SupportManual/c00224567/c00224567.pdf

    From Joseph
  • I would try a broadcast ping to 255.255.255.255 from a linux box (Windows does not allow this) given they are on the same switch. Then have a look at the arp-cache for any responses using

    arp -a
    

    The arp cache lookup will also work if you can somehow connect to the device using a configuration tool (even if does not show you the MAC address).

    From Martin C.

How to remote a single application, rather than the entire desktop

I would like to run an application on one Windows machine (2008 server preferably, but any platform is okay) and display the UI on another Windows workstation.

I'm not sure what blend of technologies I need to do this. I've looked at MS Application Virtualization 4.5 (formerly SoftGrid), but that's not quite what I'm looking for. I don't want the app to run on the local host, just a remote interface. All app CPU activity and network activity needs to be localized on the remote host.

I know it's dissimilar technologies, but think "Parallels" for the Mac... is this even possible with Windows Remote Desktop/Terminal Services?

  • Sounds like you need Terminal Services Remote Apps, which is in Server 2008. As the technet blurb says:

    With Terminal Services, organizations can provide access to Windows®-based programs from almost any location to almost any computing device. Terminal Services in Windows Server® 2008 includes Terminal Services RemoteApp (TS RemoteApp). You can use several different methods to deploy RemoteApp programs, such as Terminal Services Web Access (TS Web Access). With TS Web Access, you can provide access to RemoteApp programs through a Web page over the Internet or over an intranet. TS Web Access is also included in Windows Server 2008

    Im not sure if a web interface is good enough for what you need, or if your looking for something more integrated. See here for details on TS Remote Apps and here for details on how to do it.

    David Collantes : Actually, I will point him to this instead: http://technet.microsoft.com/en-us/library/cc753844.aspx as he isn't setting up TS RemoteApp just yet, he is just asking for information on the technology.
    Sam Cogan : good point, thanks. Have updated the post.
    Simon Gillbee : Thanks for the info. I will play with this today and see if it meets my needs :)
    From Sam Cogan
  • Citrix does this (seamless window) if you want to pay for it, or as already answered - this is possible as part of the Server 2008 and onwards without Citrix.

    You can even package this as an msi and do a very simple policy deploy of it to user's start menus ^^

    There are also a few hacks out there to do this with the old Terminal Services and some viewport cropping... I haven't tried them though.

    seanyboy : Citrix does do it, but with Win2K8, you don't need Citrix.
    Oskar Duveborn : Yeah I wrote that, but I've tried to clarify my hopelessly vague sentence now ;)
  • If you want your users to run an application on a server with the GUI on a client, then they can do this using Server 2008. Install Remote Applications. For the client side to work, they need to be running XP service Pack 3 or Vista Service Pack 1. For printing over the internet, you'll need Vista Service Pack 1, or XP Service pack 3 with .NET Framework 3.5 installed.

    Simon Gillbee : What is "Remote Applications". Are you talking about Terminal Services RemoteApps like Sam's earlier answer. Or something else.
    seanyboy : re: "Are you talking about Terminal Services RemoteApps." Yes. I am.
    From seanyboy

Using "Run as..." as limited user to modify network connection settings?

I'm running in a non-admin account on my development workstation, using "Run as..." for all things that need administrator privileges. Thankfully under XP even the control panel applets allow that. This doesn't seem to work however (or I simply haven't found out how, yet) for network connection settings. Say I want to temporarily change the IP address of an adapter, what would be the easiest way to open the properties page for the network connection with full privileges, without logging in as another user (fast user switching is disabled)?

Edit:

I'm looking for a solution working on Windows XP (64), where ncpa.cpl does what I want, but seems to just open an Explorer window when started from an Administrator cmd while logged in as a limited user.

  • You can use netsh from the command line to change IP, modify DNS, etc. Examples:

    To change default gateway and IP:

    netsh int ip set address "Local Area Connection" static 10.100.100.10 255.255.255.0 10.100.100.254 1
    

    Changing DNS:

    netsh int ip set dns "Local Area Connection" static 10.100.100.20 primary
    

    Change from static to DHCP:

    netsh int ip set address "Local Area Connection" dhcp
    

    You run those from an elevated command line. The examples above assume the network adapter is "Local Area Connection" (change this accordingly).

    You can read more about netsh at Microsoft.

    NOTE: I believe you can use ncpa.cpl (under system32) to call the Network Connections "folder". This is what you are looking for.

    mghie : Thanks for the tip, +1. That's great for scripts. It looks a little overwhelming for casual use though, any idea how to get to the "normal" properties page?
    David Collantes : I am close to find it. I know that the Control Panel network extension is netcpl.cpl, but it is not found on my XP VM (I run Windows 7 now). I am still researching and will post back.
    David Collantes : Amended my note to add ncpa.cpl. That is your answer, I believe.
    mghie : I'm on Windows XP 64. Entering ncpa.dll in an administrator cmd.exe opens an Explorer window with the root of the system drive (C: in my case). It can't even be started on 32 bit XP without a full path, but then it shows the same Explorer window :-(
    David Collantes : It is ncpa.cpl, not .dll.
    David Collantes : The ncpa.cpl is under system32.
    mghie : Indeed, stupid of me. Still, the point about the Explorer window remains.
    David Collantes : Not sure what could be going on on your side. If I go to my C:\Windows\system32 and right click on "ncpa", pick "Run as...", enter proper credentials, it will open the "Network Connections" window, from which I can modify my "Local Area Connection".
    mghie : I get always the same behaviour: "Run as..." on ncpa.cpl, "ncpa.cpl" in an Administrator cmd, "control ncpa.cpl" in an Administrator cmd - none of them work. All three do work when executed by the current user, which hasn't the necessary privileges. It's frustrating, this is exactly what I am looking for, if only it worked.
    David Collantes : Have you tried on a different machine? I am starting you think you might have problems on that XP machine. I have tried what I wrote on two different machines now (well, a VM and a real machine), and it works flawlessly.
    Oskar Duveborn : This difference in behaviour might as well be caused by Explorer being or not being configured to "launch folders as a separate process"?
  • Try the runas with the following:

    explorer.exe /n,::{7007ACC7-3202-11D1-AAD2-00805FC1270E}
    

    Post back the behavior, please. Aha! This explains why it doesn't work. I did not realized the user I was testing with was part of the Administrators group (totally my fault). Extract from the link:

    "In the system32 folder, the file properties of ncpa.cpl show that it is the “Network Connections Control-Panel Stub”. So why doesn’t RunAs work with Network Connections? Because that stub merely calls the ShellExecuteEx API to launch an item in the shell namespace, which appears as a folder within Explorer."

    The cmd scripts files he refers to there, which are not longer available, can be found on this wiki.

    mghie : Thanks for the link, I'm reading and trying out now, but still it doesn't work completely as advertised. Maybe it's the XP 64? Anyway, thanks for persisting with this, I will mark an accepted answer when I have it working both on XP 32 and XP 64.
    mghie : All is well: It does work exactly as advertised, with minor cosmetic glitches - the network connection symbols don't react on double clicks, and they still have the little "Locked" symbol superimposed, that's what led me to believe it was still not working. However, choosing Properties in the context menu opens a completely functioning page, all options enabled. Thanks a lot, the links to the incredible blog post and the scripts made me accept this for the answer.
  • You should be able to just runas "Control" if you've set Explorer to launch new folder windows as separate processes.

    Then you can just hit whatever item inside it and it should start as that user... there might be a way to force this if you don't have "launch folders as separate processes" by using explorer.exe and its argument /separate

    mghie : Thanks for the tip, +1, I will mark an accepted answer when I have it working both on XP 32 and XP 64.