Laptop User Not Authenticating in an NT Domain After Changing Password

I just spent a ton of time figuring this one out, so maybe it will help someone else out there doing a Google search (which is kind of the point of everything on this blog). We had a user with an XP pro laptop who changed his password one morning (it was going to expire soon). Later he noticed that none of his drives were mapped, and that his Outlook client not connecting properly. Normally the problem in this scenario is cached logon credentials. When you change your domain password, the laptop doesn't cache your credentials until the next time you log in. So, to ensure that they get cached properly, you need to log out and log back in again using your new password while still connected to the domain network (i.e., do this before disconnecting the laptop and bringing it home). Now, we reset the password several times and it still didn't work. A capture of all network packets during the login (using Ethereal on the server) showed that the Kerberos authentication was failing but of course didn't say why. Articles and mailing lists found while googling for an answer suggested the following:

• Edit the Registry to disable caching of credentials (info found here, scroll down towards the middle): this didn't work for me, I think because it doesn't actually remove the cached credentials.
• Manually map a drive using NET USE to authenticate: This idea was found on this page (first item on the list) which seems to contain a lot of good info but it really turned out not to be helpful. In this case I was able to map drives manually using this method but this didn't trigger a re-caching of the credentials, thus in the end the windows login still was not authenticating the session into the domain. Bzzt!
• Some loser somewhere even claimed the problem for him had been a bad network cable, even though (like me) he was still able to get an IP address and browse the web. Umm, yeah.

Solution: I finally found out where the cached credentials arew actually stored: Go to Control Panel → User Accounts → Advanced tab → Manage Passwords. In this case I found that there was a saved username/password combo stored for the domain controller. I deleted it, logged out, and logged back in again, and it worked.

Inserting graphics into a PDF

If you have Adobe Acrobat (the real deal, not just the reader) you can insert graphics into PDF docs, but it is not intuitive - mainly because Acrobat can only cut and paste graphics within itself, not to/from other programs.

1. Click Document menu → Insert Page
2. In the Browse window, change the file type to your graphics format (GIF, JPG, etc) and select your graphics file.
3. The image will be inserted on its own page.
4. Click the TouchUp Object tool on the toolbar. Right-click the image and select Cut.
5. Go to the page where you want the document and Paste in the image. Drag & drop the image to its correct location.
6. Click Document menu → Delete page and delete the (now-empty) page you just inserted.

Resizing the graphics: I haven't yet figured that out. I am using 5.0 (an old version) so things may be different in the newer versions of Acrobat.

Secure Password Storage on XP

• You have a lot of online accounts, and
• You don't want to use the same password for each, because that is insecure — however
• It's hard to remember all those passwords, so
• You need to store the passwords off-brain somewhere.
  • Also, you don't want to store them in a text file, that is very insecure, almost worse than writing them down on paper, because a malicious program could grab that file without your knowing.
  • Therefore, you need to encrypt the data.
• You could use PGP, because that is undoubtedly the best-designed and strongest encryption software available; but
• You don't want to pay $50 just to store passwords. You could use GnuPG, which is free and just as strong, but
• You don't want to have to use the command line every time you unlock your files, use them, and lock them again.
• You also don't want to store your passwords in the browser because
• Anyone using your browser could get access to your sites.
  • Even when the browser allows you to use a master password to protect your stored passwords, reason tells you that storing sensitive information directly within the browser brings them that much closer to the reach of security exploits and malware.

So in many cases, for reasons of security/cost/convenience, you can rule out: writing them down, plain text files, PGP, GPG, and browser-saved passwords. For these reasons, I've found that the best program for password storage on XP is KeePass.

• It's free
• It is open source, and therefore open to scrutiny for backdoors or weaknesses
• It has a well-designed interface, specifically tuned to the task of securing and using passwords
• It is small in size (440k), and fast
• It doesn't require installation; just unzip and run
• It doesn't need .NET runtimes or other support files
• It uses strong encryption
• It is configurable to be as secure or as convenient as you want

Go to the KeePass website to download it, view screenshots, and read more information. More later on an end-to-end process for securing your software and customizing your KeePass installation.

Outlook 2003: Warn if Subject Line Empty

Outlook does not have a built-in option to warn you if the subject line is empty. (Outlook Express does, but for some reason Outlook doesn't.) Here's how to put one in.

1. Go to the menu Tools → Macro → Visual Basic Editor.
2. Now in the Visual Basic Editor, you should see Project1 in the tree menu on the left. Drill down the tree to Project1 → Microsoft Office Outlook → ThisOutlookSession.
3. In the code area (the big text area on the right) paste in the following code:

   Private Sub Application_ItemSend(ByVal Item As Object, Cancel As Boolean)
   If TypeName(Item) <> "MailItem" Then Exit Sub
   
   'CHECK FOR BLANK SUBJECT LINE
   If Item.Subject = "" Then
   Cancel = MsgBox("This message does not have a subject." & vbNewLine & _
                        "Do you wish to continue sending anyway?", _
                        vbYesNo + vbExclamation, "No Subject") = vbNo
   End If
   End Sub

4. Save and exit the VBA Editor.

You can test this by creating a message with a blank subject and clicking Send. You will be warned that the subject line is empty and asked if you want to send the message anyway. This macro is a simplified version of this code at outlookcode.com. I tested it on Outlook 2003 and it runs with no problems with macro security set to High. (To check your macro security level, click the menu Tools → Macro → Security.)