Security by obscurity is not enough by itself. You should always enforce the best practices. However, if you can reduce

This afternoon, I’m attending the funeral for a coworker we lost last weekend. Over the course of the next week or two, we’ll be assisting his family gain access to the many online services he had managed. Each time I’ve experienced a tragedy like this, I’ve seen the families struggle with the digital footprint and account access of their lost loved one. Like life insurance, emergency access to online services is too often an item on our to-do list, rarely ever getting completed. Password managers help families in these situations. They act as a consolidated list of the accounts making up one’s digital footprint. However, if emergency access has not been set up, they provide no help and access becomes a major hurdle to overcome for a grieving family.

I came across an undocumented app the other day. For a number of reasons, we needed to restore the password but it wasn’t documented anywhere. Luckily, the service account was setup in an app pool. In IIS 7.0 or 7.5, APPCMD can be used to recover the password. In 6.0, adsutil.vbs can be used. cscript.exe /nologo adsutil.vbs GET W3SVC/AppPools/AppPoolName/WAMUserPass However, I wanted to write my own little script. Having a little tidbit makes it easy to reuse later for other clients. For example, I could search AD for SPNs starting with “HTTP”, loop through each of their app pools and document the username and passwords for all service accounts used in this fashion. So, here is the little tidbit I threw together.

Here I go on another vbScript tutorial. You might ask why I’m not doing this in powershell yet and it is simple: I still run into 2003 and XP environments. Oh yeah, and this works. I don’t care what scripting language I’m writing in if it gets the job done; you shouldn’t either. My $0.02. If you want to download this script, click here: Morto.A Detection Script. A had to do a little cleanup on a network from the Morto.A worm. The first thing I wanted to do was find out how bad things were. They were reporting a DDOS across their LAN (mostly 3389) and a lot of other issues. It as obvious we were going to need to rebuild a few systems but we wanted to get a grasp out of what the damage was. This were generally working: logons, shares, etc.