14/07/2013

How to Install Mac OS X on a PC (Without Using a Mac)

There are many great tutorials on the web forusing a Mac to install Mac OS X Snow Leopard on a PC. Unfortunately, you may be unable to follow such tutorials if you do not readily have access to a Mac to perform the preparation necessary for the installation.

Great progress has been made in hacking PCs to run OS X, and it is now possible to install Mac OS X without a Mac. Thanks to some great tools put together by some brilliant hackers, it is also much easier and does not involve nearly as much time and effort as was once required.

Step 1: Getting The Hardware Ready

I recently purchased the following set of hardware for the purposes of building a Hackintosh (often PCs running Mac OS X are referred to as such):

Intel Core i3-530 Clarkdale 2.93GHz
Gigabyte GA-H55M-USB3 Motherboard
4 GB DDR3 1333 RAM (2 x 2GB)
DVD Burner
MicroATX Computer Case
585 Watt Power Supply
4-pin to 8-pin Power Adapter

Step 2: Putting The Hardware Together

If you purchase the hardware I used, along with a hard drive and NVIDIA GeForce video card, you should be able to follow the instructions exactly as I’ve laid them out. If you’ve never built a PC before but are willing to give it a try, you’ll definitely want to check out The Idiot’s Ultimate Guide to Build Your Own PC. It is a step-by-step guide to building your own PC, with plenty of photos to help you out.

You can try following this tutorial with existing hardware you have as well, although you may need to make adjustments when configuring the BIOS and installing the boot loader. The more modern your hardware is, the better the chances are it will work for you. It would be best if you have a 64-bit Intel dual-core (or quad-core) processor, although an older CPU might still work as well. I would recommend NVIDIA GeForce video card, but ATI cards should work too.

Step 3: Prepare The Boot Disk

In addition to the hardware and a retail copy of Mac OS X Snow Leopard, you’ll also need a blank CD. You may want to use a rewritable CD if you’re using a different hardware configuration, just in case the first one I recommend doesn’t work for you. There are two boot disk images that will allow you to install OS X directly from the installation DVD:

iBoot (by tonymacx86 and MacMan)
Empire EFI (by Prasys)

I successfully used both of them with my hardware setup. However I recommend you try iBoot first, as it is a bit leaner and doesn’t take as long to boot. If you’re using my hardware configuration, be sure to download the iBoot Supported disk image. If you use Empire EFI, download the

Empire EFI v1.085 R2 image.

You can use one of many free programs to burn CDs if you don’t have one. Be sure to use the disk image burning mode in your CD burning software. Do not just simply copy the disk image file to a blank CD. I like InfraRecorder, because it makes this very easy. All you have to do is click the Write Image button, select the image, and burn it. Once again, you may wish to use rewritable media if you’re using a different hardware configuration than mine.

Step 4: Bios Configuration

Fortunately, the Gigabyte GA-H55M-USB3 does not require a lot of configuration to run Mac OS X. When you first turn on or reboot the machine, press the delete key to enter the BIOS setup. You can just load the Optimized Defaults, and just make a few changes within three sections of the bios: Advanced BIOS Features, Integrated Peripherals, and Power Management Setup.

4.1 – First, go to Advanced BIOS Features and set the First Boot Device to CDROM. I have my USB drive as the second drive and then Hard Disk as third – you can configure yours the same way if you wish to ever boot from a USB drive. Just be sure that Hard Disk is the Second Boot Device or Third Boot Device.

4.2 – Next, configure SATA to run in AHCI mode in the Integrated Peripherals menu. You’ll need to set both PCH SATA Control Mode and Onboard SATA/IDE Ctrl Mode to AHCI.

4.3 – Finally, go to Power Management Setup and set the HPET Mode to 64-bit mode.

Step 5: Installing Mac OS X

5.1 – Insert the iBoot (or Empire EFI) boot disk.

5.2 – When you see screen below, eject the disk.

5.3 – Insert the Retail Mac OS X Snow Leopard DVD, wait a few seconds, and press F5.

5.4 – When you see the screen below, select Mac OS X Install DVD (it should already be selected) and press Enter.

5.5 – If all goes well, you should eventually see the language selection screen for the installer. If all did not go well and you do not make it to the language selection screen, try downloading a different version of iBoot or Empire EFI.

5.6 – Select your language and click the arrow to proceed.

5.7 – Next, you need to partition your drive. Click on Utilities > Disk Utility.

5.8 – Select your disk drive.

5.9 – Click Partition.

5.10 – Select 1 Partition for the partition scheme. Note: If you have a drive that is larger than 2 TB, do not create partitions larger than 1 TB. Split the drive into multiple partitions, and be sure the main installation partition is 1 TB or smaller.

5.11 – Enter a name for the partition (I used Hackintosh).

5.12 – Select Mac OS Extended (Journaled) as the Format.

5.13 – Click Options…, select GUID Partition Table, and then click OK.

5.14 – Click Apply.

5.15 – Quit Disk Utility and proceed with the installation. Install on the Hackintosh partition.

Step 6: Installing the Boot Loader

Do not fret when you reboot after the installation and get a boot error, as you will need to first boot the machine with iBoot (or Empire EFI). Eject the Mac OS X Snow Leopard install DVD, put your boot CD back into the drive, and reboot the machine. Now when you boot up, you should see a second choice for your installation partition (Hackintosh if you named it that way). Select the Hackintosh partition and press Enter to boot into OS X.

Once you’ve completed the first-run setup, open up Safari and download Multibeast. Multibeast is another superb tool by tonymacx86 and MacMan that makes it stupid easy to install the boot loader, along with all the drivers necessary for your Hackintosh to function properly.

In addition to downloading Multibeast, you will need to download the DSDT for the Gigabyte GA-H55M-USB3 and copy it to the desktop. Be sure to save it as

DSDT.aml

. Launch Multibeast and make the following selections (your choices will differ if you have a different motherboard/hardware configuration):

UserDSDT
System Utilities
Advanced Options > Kexts > Audio > LegacyHDA > ALC889
Advanced Options > Kexts > Graphics > NVEnabler
Advanced Options > Kexts > Network > RealtekR1000SL
Advanced Options > Patched Kernels > 10.3.1 Supported Kernel

After MultiBeast finishes installing, eject the iBoot CD and reboot the system. You should be able to boot right up from the hard drive, and all your devices should work just fine.

Getting Started with Your New Mac

12/07/2013

Windows Server 2008: Read-Only Domain Controller (RODC)

A Read-Only Domain Controller (RODC) is a new type of domain controller in Windows Server 2008. Its main purpose is to improve security in office branches. In this post, I summarize the functionality of RODC.

In office branches, it is often not easy to provide sufficient physical security for servers. It is not a big deal to manipulate a Windows system if you can get physical access to it. Since Domain controllers store security sensitive data, they are particularly endangered. RODCs can help with this problem in four ways:

RODC essentials

Read-only feature: An intruder on the RODC can’t manipulate the Active Directory database.
DNS protection: If the RODC server hosts a DNS server, the intruder won’t be able to tamper with the DNS data.
Password protection: A malicious user won’t be able to access passwords using a brute-force-attack. This applies only if password caching is disabled on the RODC.
Administrator Role Separation: You can delegate a local Administrator role to a domain user.

Read-only Domain Controller

An RODC holds all Active Directory objects and attributes.
RODCs only support unidirectional replication of Active Directory changes (i.e., from the forest to the RODC).
If an application needs write access to Active Directory objects, the RODC will send an LDAP referral response that redirects the application to a writable domain controller.

DNS Protection

A DNS server running on an RODC doesn’t support dynamic updates.
If a client wants to update its DNS record, the RODC will send a referral for a writeable DNS server.
The client can then update against this DNS server.
This single record will then be replicated from the writable DNS server to the RODC DNS server.

Password Protection

By default, an RODC doesn’t store user or computer credentials. (The only exception is the computer account of the RODC itself and a special krbtgt account.)
However, an RODC can cache passwords.
If a password isn’t cached, the RODC will forward the authentication request to a writeable DC.
The Password Replication Policy determines the user groups for which passwords caching will be allowed (more about this in my next post).

Administrator Role Separation:

A domain user having the Administrator role on an RODC doesn’t have to be a domain admin.
A domain user having the Administrator role can do maintenance work on the RODC such as installing software.
If an intruder gains access to the credentials of this local administrator account, he will not be able to make changes on other domain controllers.

Windows Server 2008: How to install and configure an RODC

Yesterday, I summarized the features of a new type of domain controller in Windows Server 2008, the Read-only Domain Controller (RODC). Today, I will describe how to install and configure an RODC.

Installing an RODC

One needs at least one writable Windows Server 2008 domain controller to which the RODC can forward authentication requests.
The functional level of the domain and the forest must be Windows Server 2003 or higher.
If your domain level is Windows Server 2003 you have to run adprep /rodcprep before you install the first RODC.
You can use a standard Windows Server 2008 or Server Core as an RODC.
To install an RODC run dcpromo. The wizard lets you choose to install the DC as RODC.

Administrator Role Separation

To configure the Administrators role, launch a command prompt and enter dsmgmt, then enter local roles, and then type add <DOMAIN>\<user> Administrators
To display the Administrators role on the local roles prompt type: show role Administrators
To display other roles, type list roles on the local roles prompt.

Password Protection Policy

To configure the Password Protection Policy, you have to open the properties of the RODC computer object in the Active Directory Users and Computers snap-in.
Click on the Password Protection Policy tab to configure groups for which password caching will be allowed and for which password caching will be denied.
“Deny” overrides “allow”.
The RODC will cache the password after the user logs on the first time. Note that only users with cached passwords can logon if no writeable DC is available.
Click on Advanced to display a list of users for which the passwords have been cached.

Windows Server 2008: the disadvantages of RODCs

I don’t have much experience with RODCs yet. However, I already see some of the downsides of this new kind of domain controller:

If you add RODCs to your network, you certainly increase the complexity. RODCs simply work differently than DCs, which means that new kind of problems might come up.
Administrators need to invest time to learn how to manage RODCs.
Some third party products will not work together with RODCs.
An RODC usually needs a writeable domain controller to work properly. For example, users can’t change passwords, computers can’t join the domain, accounts whose passwords haven’t been cached can’t logon, and Group Policy doesn’t work properly if no writable RODC is available. This means that an RODC doesn’t provide the same failure safety like a writeable DC.

Don’t underestimate the first two points. At first, I thought, it can’t be too difficult installing an RODC. After all, it is just a DC with reduced functionality, i.e. with only unidirectional replication. However, it took me more time than expected to set up a test environment.

My RODC had two network cards, one was in the same sub network as the writeable DC, and the other network card was connected to the same sub network as my clients. Most things worked fine. However, I wasn’t able to authenticate against the RODC if the writeable DC was offline. In theory, this should work if the user’s password is cached on the RODC. Even though I could see that the password was cached, I always got this error message: The trust relationship between this workstation and the primary domain failed. However, if the writeable DC was online, I had no problems logging on to the RODC.

Maybe my configuration was not correct or maybe there was a bug involved. I didn’t try too long to solve this problem, since Windows Server 2008 is still beta. But this example shows how new kind of problems can arise. With two writable DCs I wouldn’t have to invest extra time. Time is money. Maybe it makes more sense to invest this money in a better physical protection of the servers in your branch offices.

There are certainly environments where it makes sense to work with RODCs. Big companies with Active Directory specialists probably won’t be afraid of the increased complexity. However, since bandwidth gets cheaper almost every day, it is probably only a matter of time until domain controllers in branch offices will not be necessary anymore. So maybe it is a bit late for this new technology.

10/04/2013

Installing & Configuring NAT !!!!!

Using Windows Server as a NAT Router

Introduction

Recently I needed to set up a test network in my office which uses a DSL router to connect to the Internet. The test network needed to be on a different subnet than my office LAN but also needed Internet connectivity. I decided to install Windows Server 2008 on a spare box that had two network interface cards (NICs), install the Routing and Remote Access Service (RRAS) on the box, and use the box as a router between my Workplace and Test networks (see Figure 1).

Figure 1: Using RRAS as a router to connect two subnets

There were basically two ways I could have proceeded. First, I could have configured the RRAS box as an IP router to forward traffic between the two subnets. This would have allowed clients on the Test network to send packets to servers on the Internet, but it wouldn't enable return traffic to be routed back to the client. The reason is that a packet entering the DSL router from the Internet side would be routed to the 172.16.11.0 network and would therefore have no way of reaching a client on the 10.0.0.0 network. A solution to this problem would have been to add a static route to the DSL router that directly forwards all packets having a destination address of 10.0.0.x to the Workplace interface of the RRAS box (172.16.11.220). Then, once a packet bound for 10.0.0.x reaches this interface, the RRAS box would then forward the packet to its other interface (10.0.0.1) and from there the packet would enter the Test network and eventually reach its destination. Unfortunately, I did not have admin access to the DSL router since it was managed by my ISP, so I did not follow this approach.
The other approach I could take, and the one that I actually did choose to implement, was to configure the RRAS box as a Network Address Translation (NAT) router. NAT is an IETF standard that provides a way for translating the IPv4 addresses of computers on one network into IPv4 addresses of computers on a different network. Of course, the DLS router on my Workplace network is also configured as a NAT router, so the result of implementing this approach is what is known as cascaded NAT or double NAT. Internet connectivity works fine through 2 or even 3 cascaded NATs, although a few applications can have problems with this type of network topology. For example, Windows Home Server doesn't seem to like cascaded NATs.
Anyways, after searching online a bit I found that there's lots of confusion around how to set up a two-subnet Internet-connected network like that shown in Figure 1, so I decided to write this article which walks you through the steps of setting up this kind of scenario.

Installing the Server Computer

First, Windows Server 2008 was installed on the double-NIC computer and the IPv4 settings of each NIC was configured as follows:
NIC connected to Test LAN:

IP address = 10.0.0.1
Subnet mask = 255.0.0.0
Default gateway = none
DNS servers = none

NIC connected to Workplace LAN:

IP address = 172.16.11.220
Subnet mask = 255.255.255.0
Default gateway = 172.16.11.1
DNS servers = the public IP addresses of my ISP's DNS servers

Note that the NIC connected to the Test LAN (10.0.0.0) should not have a default gateway—see KB 157025 here for an explanation of why multihomed computers (computers connected to multiple networks) should only have one gateway address assigned.
Note also that the NIC connected to the Test LAN has been configured with the IP addresses of public DNS servers. This is not needed in order for the clients on the Test network to access the Internet, but it is needed if you want to be able to access the Internet from the RRAS server itself.

Installing the Client Computers on the Test LAN

Windows 7 was then installed on the client computers, after which their IPv4 settings were configured as follows:

IP address = 10.0.0.101 (.102, .103, …)
Subnet mask = 255.0.0.0
Default gateway = 10.0.0.1 (the near-side interface of the RRAS box)
DNS servers = the public IP addresses of my ISP's DNS servers

At this point all the "wires" are connected, but if we try to ping the DSL router from a client computer on the Test network, or if we try to traceroute an address on the public Internet from the same client computer, these attempts will fail indicating that the Test network does not yet have Internet connectivity (Figure 2):

Figure 2: Can not ping a public IP address from a client on the Test network
And naturally, if we try to browse the Web from our client machine, this too will fail (Figure 3):

Figure 3: Can not browse the Web

Installing and Configuring RRAS

To enable the client computers on the Test network to access the Internet, we need to install the RRAS role on the server and then configure the server as a NAT router. To install the RRAS role, launch the Add Roles Wizard from Server Manager or OOBE.exe and add the Network Policy and Access Services role (Figure 4):

Figure 4: Installing RRAS step 1
On the next wizard page, select Routing and Remote Access Services to install two role services, Remote Access Service and Routing (Figure 5):

Figure 5: Installing RRAS step 2
Once the wizard finishes, open the Routing and Remote Access console from Administrative Tools, right-click on the local server and select Configure and Enable Routing and remote Access. This launches the Routing and Remote Access Server Setup Wizard; select Network Address Translation (NAT) on the Configuration page of this wizard as shown in Figure 6:

Figure 6: Configuring RRAS for NAT step 1
Next, on the NAT Internet Connection page, we select the network interface that is on the Workplace LAN, which is the "public interface" of the NAT router (see Figure 7)

Figure 7: Configuring RRAS for NAT step 2
The next page asks us whether the NAT router should also provide DHCP and DNS services to the computers on the Test network, which is connected to the "private interface" of the NAT router. Since our client computers all have static IP addresses assigned, we'll choose not to do this (Figure 8):

Figure 8: Configuring RRAS for NAT step 3
Once the wizard finishes, the RRAS service starts up and the service is configured for both IPv4 routing and NAT. To see this, begin by right-clicking on the local server in the RRAS console and selecting Properties. The General tab shows that IPv4 routing has been enabled, which means IPv4 packets can be forwarded from one NIC to the other (Figure 9):

Figure 9: Verifying RRAS configuration step 1
Selecting the NAT node in the RRAS console shows that three network interfaces were created when NAT was configured on the server using the Routing and Remote Access Server Setup Wizard. Figure 10 shows the properties of Local Area Connection, which in this scenario is the network connection to the Test (10.0.0.0) network. Note that NAT considers this network the "private" network, that is, the network "behind" the NAT router:

Figure 10: Verifying RRAS configuration step 2
Figure 11 shows the properties of Local Area Connection 2, which in this scenario is the network connection to the Workplace (172.16.11.0) network. Note that NAT considers this network the "public" network, that is, the network "in front of" (on the Internet side of) the NAT router:

Figure 11: Verifying RRAS configuration step 3
The Internal network interface is also added to the NAT configuration as a private interface.

Testing NAT

At this point NAT has been configured with IP routing, and if I try and ping the DSL router from a client computer on the Test network, or if I try and traceroute from the same client to a server on the public Internet, these attempts should now succeed (Figure 12):

Figure 12: Network connectivity verified between the Test network and the Internet
Likewise, if I try and browse the Web from a client computer on the Test network, this too should succeed (Figure 13):

Figure 13: Computers behind the NAT can browse the Web
I can also monitor NAT activity using the RRAS console. To do this, open the console and select the NAT node and examine the network statistics for Local Area Connection 2 (the "public" or Internet-facing NAT interface) as shown in Figure 14:

Figure 14: Viewing NAT activity
Finally, by right-clicking on this interface and selecting Show Mappings, you can open a separate window that lets you view more details concerning what your NAT router is doing (Figure 15):

Figure 15: Viewing detailed NAT activity

Conclusion

By using the Network Address Translation and IP routing capabilities of the RRAS role of Windows Server 2008, you can easily set up a separate test subnet on your network and ensure that computers on this test subnet have access to the Internet. This article has walked you through how to set this up step by step.

18/03/2013

IIS Server 7.0

Installing Internet Information Services

Click the Start button and type server in the Search programs and files text box
Click Server Manager in the Programs list

The steps above are highlighted in the image below: