Sometimes you need to know the Process Id (PID) of a running service. Since Windows 2003 you can use the tasklist.exe tool with the /SVC switch. But how to do this programmatically?

The QueryServiceStatusEx API returns a SERVICE_STATUS_PROCESS structure that contains the PID.

The code is not very complicated:

A customer had partially implemented a (written) policy in the past where the the Local Administrator account was renamed according to a special convention.

This policy stated that the Administrator account needed to be renamed to admin with the computername as a prefix.

However they didn’t know exactly on which machines this policy had been applied to in the past. I was asked to write a script that would check a list of machine names, query the Administrator account name and write this in a new list.

The Administrator account has a Well Known SID of S-1-5-21-xxxxxxx-500 where xxxxxxx is the SID of the computer.

Read the rest of this entry »

Yesterday I wrote about converting an IP Address to an Integer in C#. But both methods I presented return the IP Address in network byte order.

However in some cases, especially when calling WinApi functions, you will need to convert the Integer to host byte order which is little-endian on Intel processors.

In an unmanaged language we could do very fast byte swap with inline assembly, eg:

From WinApi we could use the ntohl function and in managed languages we can use the NetworkToHostOrder method from the System.Net.IPAddress class.

For an IPv4 address we need to make sure we are using the proper overload by casting the result of System.BitConverter to an int:

For a call to a WinApi function I needed to convert an IP Address to an Integer in C#.

This can be done using the System.Net.IPAddress class:

Although this works, the compiler issues a warning: 

warning CS0618: ‘System.Net.IPAddress.Address’ is obsolete: ‘This property has been deprecated. It is address family dependent. Please use IPAddress.Equals method to perform comparisons. http://go.microsoft.com/fwlink/?linkid=14202′

This warning is issued because the Address property is not IPv6 compatible. The warning can be suppressed like this:

But it would be better to use the non deprecated GetAddressBytes() Method:

After updating a Citrix License server from 11.6.1 to 11.10 the Citrix Licensing Service crashed immediately after startup.

In the Event Log the following error was shown:

I suspected that there was a corrupt licensing file in the MyFiles folder (Default C:\Program Files\Citrix\Licensing\MyFiles).

Read the rest of this entry »

I wanted to call a hash function from a .net executable from my code. My first step was to inspect the executable with Reflector.

The Hash function was in a namespace called Core:

Notice that the Core namespace is marked as internal so it was not meant to be callable outside of the executable. It’s still possible to call it using Reflection:

Read the rest of this entry »

After joining a new Windows 2008 R2 Server to the domain I could not login to the domain.

I would get the following error message:

Additionally the following error was logged in the Eventlog:

Read the rest of this entry »

I had to troubleshoot an application that was published with Citrix XenApp. The problem with this application was that it didn’t have an button/icon in the taskbar and the window would sometimes disappear.

I noticed that this (cr)application was written in Visual Basic, so I decided to run it through a decompilation tool.

The decompiler was able to list the forms used in the Application:

Read the rest of this entry »

I am using a PowerShell script to copy some elements of from the users old profile location to a new location. This includes the Nethood ("My Network Places") folder which contains the Network Places shortcuts.

A user reported that she could not save documents to Network Places anymore and after inspection the Network Places shortcuts were broken.

I started comparing the old Nethood folder to the new and observed the following difference in Explorer:

When copying entries from the Nethood folder with Explorer manually they worked fine, so somehow Explorer gives the Nethood folder special treatment.

Read the rest of this entry »

Today I was asked to troubleshoot an executable that didn’t work correctly on Windows XP Embedded.

On startup it displayed the following message:

I verified that System.Configuration.dll was present (in C:\Windows\Microsoft.NET\Framework\v2.0.50727).

Read the rest of this entry »