Farg'n M$ $M$ POS...

[Jammrock]

The brilliant programmers at Micro$#!% have done it again. Their network management tools, SMS, is a giant pile of manure. There's a bug in the SMS 2.0 code that builds the SMS registry key in Local_Machine that makes the key completely undeletable and unwritable.

So the next time a client logs into the domain and the logon script installs SMS automatically, the install creates several user names and profiles for them in 'Documents and Settings' (Win2k SP3). Well now, no big woop, right? Wrong!

Because the registry key unwritable, the SMS install fails, waits a few minutes and attempts a second install. Now that user profile for SMS gets rewritten, but this time as SMSCCSBootAcct.xxxxxx.yyy (where the X's are the host and Y's the folder/profile number). After about 2-3 days of this SMS manages to creat 200-500 of these folders, sucking up every last bit of space on the hard drive.

Solution ... there is none. M$ says the service pack for SMS 2.0 fixes it. It doesn't. Launch REGEDT32.EXE and try and change permissions...access denied! Launch REGEDT32.EXE using AT commands so you use SYSTEM priveleges...access denied!

I so %#@^%! hate Micro$#!% today!!! More so than normal.

Does anyone have any other genius ideas on how to get the SMS reg key out?

JAmmrock

[Umfriend]

I wouldn't know anything about such things.... How about AmigaDos?
Seriously, can't u simply give administrator rights to all users?

[Dr Mordrid]

2-3 lbs of C4 should do it

Dr. Mordrid

[Ribbit]

Re: Farg'n M$ $M$ POS...

Originally posted by Jammrock
Does anyone have any other genius ideas on how to get the SMS reg key out?

I have, but it involves a large fireaxe and potentially voiding a warranty or two.

And now I come to think of it, I don't think it gets the key out, it just makes you feel better.

[Zao]

Let's say you get hold of Windows PE from somewhere...

It can ignore NTFS permissions, and it might ignore Registry permissions if you open the hive with the regedt32 in PE.

[Jammrock]

Originally posted by Dr Mordrid
2-3 lbs of C4 should do it

Sorry, lost my license for heavy explosives.

I have, but it involves a large fireaxe and potentially voiding a warranty or two.

I prefer crowbars, but a fireaxe works nicely too.

Let's say you get hold of Windows PE from somewhere...

Windows PE?

Jammrock

[Mikko]

I don't know if this helps with the "access denied" entries, but have you tried RegCleaner utility?

http://www.webattack.com/get/regcleaner.shtml

[Jammrock]

Originally posted by Mikko
I don't know if this helps with the "access denied" entries, but have you tried RegCleaner utility?

http://www.webattack.com/get/regcleaner.shtml

I've used RegCleaner before, it uses the logged in users rights to access the registry, so it wouldn't help afaik.

Of course, this makes me wonder ... M$ has apparently hidden a user mode that goes above and beyond SYSTEM and Administrator right. Makes you wonder what they'll be locking into the registry in the future.

Jammrock

[The PIT]

Originally posted by Jammrock
Of course, this makes me wonder ... M$ has apparently hidden a user mode that goes above and beyond SYSTEM and Administrator right. Makes you wonder what they'll be locking into the registry in the future.

Jammrock

Thats worrying.

[Technoid]

WindowsPE is Windows xp on a bootable CD
You get vga res and a comandline window
see it as an recovery consol on steroids

[Jammrock]

Originally posted by Technoid
WindowsPE is Windows xp on a bootable CD
You get vga res and a comandline window
see it as an recovery consol on steroids

Very interesting. I'll see if I can get a copy of it somewhere.

Jammrock

[Wombat]

Originally posted by Jammrock

Of course, this makes me wonder ... M$ has apparently hidden a user mode that goes above and beyond SYSTEM and Administrator right. Makes you wonder what they'll be locking into the registry in the future.

That would be the NSA login

[Marshmallowman]

I was thinking editing the hive file externaly while windows is not running...Don't know of any free tools to do this (yet) but here is a commmercial one

http://www.resplendence.com/registrar_compchart.htm

also
apparnetly there are some difference between regedit.exe and REGEDT32.EXE, in that REGEDT32.EXE allows you to change some values that regedit.exe can't

So try using REGEDT32.EXE instead

Just checked the above link to registrar allows you to use the full version for 21 days, so you should be able to grab your hive files, fix'em and restore before the it runs out

[omegaRED]

Originally posted by Wombat
That would be the NSA login

LOL

[DukeP]

Please do post updates on this...

~~DukeP~~