ApplicationException: Access is denied when using EPPlus or OfficeOpenXml

I have a basic site setup with reports that can be exported to Excel 2007 .xlsx formatted files. I was running into an issue with one of the larger reports where it would work for a while and then crash with an "ApplicationException: Access is denied" error. Running the same procedure on my test box worked fine though, so I had to scratch my head a little. Luckily Google searching came through again and the fix is very simple. I found it here: http://excelpackage.codeplex.com/workitem/17586

On your web server, create a folder named IsolatedStorage in C:\Documents and Settings\Default User\Local Settings\Application Data\. Then make sure to give the user setup on your ApplicationPool read and write privileges on that folder. If you don't know which user that would be and are running IIS 6, go to your Application Pools in IIS Manager, right-click the pool you want to check and go to Properties. Under the Identity tab you'll find the account name.

Updating BIOS or firmware on Dell server running VMware

I tried using the OMSA liveCD from Dell, but it locked me out of the network preferences and wouldn't pull DHCP, so I had to come up with my own workaround. They failed to mention the need to install a package in order for the updates to run too, so I decided I'd put together a quick walkthrough for anyone else with the same problem, and for me to refer back to the next time I need to remember which package it is that I need.

First, you'll need a bootable live disk of an OS. If you want to make a Windows version for yourself, feel free, and I'm going to imagine you wouldn't be reading this if you already knew how to do that. Otherwise, I've used CentOS. You can check it out at www.centos.org, and visit their downloads section to find a mirror to download an .iso file to burn to disc. I'm currently using v6, and it has worked well on the machines I've needed to update. If you're not familiar with Linux, it's ok, I'm not that great with it myself. There's nothing too technical to these updates though.

If you want to download the updates directly on the server, reboot your server and boot from the CD to load up CentOS. If you have to download the updates onto a USB flash drive, make sure you plug the flash drive into the server before booting from your LiveCD. If you plan to download the updates directly the system should pull in an IP address via DHCP. If you don't have DHCP configured on the network the server is connected to, go to System->Preferences->Network Connections, select the Ethernet card you want to configure, and then change the IP settings to what you need them to be.

Now you can open up Firefox to get to the Dell website to download the updates. Make sure you download the .BIN files that are for updating in Red Hat. You may have to use the "Other download formats" link on each to get to the .BIN option, but they're there. Skip to the next step if you're using a flash drive.

Open up the Terminal (Applications->System Tools->Terminal) and navigate to where your files are using cd /path/to/files/. If you have a USB device plugged in, you should be able to open it on the desktop to see the path (probably /dev/something).

Once you're in the folder the updates are in, run sudo chmod +x *. This will make all the .BIN files executable. After you've done that, you need to make sure one of the dependencies is loaded. I suppose this means you'll need a network connection, unless you can load this onto your USB device and pull it from there as well. To install the required dependency from over the network, use sudo yum install compat-libstdc++-33*. Then follow the prompts to install the latest version of that program on the machine.

Once you have the dependency installed, now you can start installing the updates. To do that use the command sudo ./updateFileName and press Enter. If you want to verify the update first, add a -c at the end. The regular update runs the same thing though and gives you a chance to cancel, so the -c is a little overkill in my opinion. Follow the prompts to get your updates installed, then reboot and get your VMs back up and running.

Allow standard users to update UPS WorldShip

I have a user who uses UPS WorldShip 2012 daily. I didn't want to give the user local admin rights on the computer, but WorldShip updates automatically and it happens more than once a week. Those updates require admin privileges to run, so I did some digging to come up with a workaround. It turns out it's possible, and is pretty easy to setup.

First, run RegAccess.exe in the UPS install folder (the standard path is C:\UPS\WSTD\RegAccess.exe) using an account with admin rights on the machine. It only took a few seconds to run.

Next, you'll need to download the Microsoft Application Compatibility Toolkit, which you can get from here. You want the ApplicationCompatibilityToolkitSetup.exe file. Install that on the machine running WorldShip, and then start the Compatibility Administrator (32-bit) program with an admin account.

From here you'll want to check out this article for instructions on how to use the toolkit. For the name of the program to update, use runpatch.exe. The vendor is UPS (Or whatever you'd like. It doesn't really matter). For the program file location, find the runpatch.exe file in the UPS folder (default is C:\UPS\WSTD\runpatch.exe).

After you run through the setup to check the RunAsInvoker option, choose save as and it will ask you for the database name. This will be the name of the sdb file you need to import, and in their case they used uac-whitelist in the example. I saved my sdb file in the C:\UPS\WSTD folder to keep it all together, but you can save it wherever you'd like.

Once you have your sdb created, you'll need to open a command prompt running with admin rights. From there you can enter sdbinst C:\UPS\WSTD\uac-whitelist.sdb and press Enter. If you saved your file somewhere else, use your path instead, and the same for the sdb file name. That will import your sdb file into the system so you no longer need admin privileges in UPS WorldShip to update the program

OS X mobile user is not recognized as an admin

I've run into the problem more and more as we move our Mac users to laptops. I have an Active Directory security group setup for them, and assign that group admin rights in Directory Utility when binding the Mac to the domain. However, if the Mac cannot access a domain controller and instead uses the mobile credentials, that user does not have admin privileges until the next time they login while connected to the network.

You'd think this would be a simple thing for Apple to include, but at least there is an easy workaround. To get around this:

1. Login as the domain user if you haven't already. This will create a mobile profile for them on the machine
2. Shutdown
3. Disconnect from the network
4. Boot up and login using a local admin account
5. Open System Preferences->Users & Groups, and unlock it if necessary
6. Click on the domain user from step 1 and check the box marked "Allow user to administer this computer"
7. Close and reboot

If you want to test this, leave the network disconnected and login with the domain user account. You should now have admin privileges on the machine in your mobile account. I don't know why I didn't think of this sooner, but thanks to this article for the resolution.

Force Internet Explorer compatibility view to be used for your web site

With Internet Explorer 8 and 9 you may have noticed some websites not working like they used to. It's been quite a while since the release of IE 8 so most of the major sites have probably caught up to this problem, but the easy fix is to setup the site to force IE8 and IE9 to use the compatibility view function with your site. You can do this through the use of a custom header, which is easy to setup in IIS. You can do it on other types of web servers too. The custom HTTP header to add is X-UA-Compatible: IE=EmulateIE7. This is supposed to only be acknowledged by IE, thus leaving any other browser functioning as it normally would. For instructions on how to do this in IIS 6 or IIS 7 or in a Web.config file, check out the Microsoft article here. For an Apache web server you can modify the httpd.conf file or include it in specific directories or pages. Microsoft outlines this process as well in a separate article that you can find here.

Can't uninstall McAfee Agent error 1714 or 1610

The environment I manage uses McAfee EPO for its antivirus needs, and I ran across multiple events in the application log with ID 11714 and 1002 on one of the machines. The event description was "Product: McAfee Agent -- Error 1714. The older version of McAfee Agent cannot be removed. Contact your technical support group. System Error 1610." I tried to manually uninstall the Agent and it kept asking for the MFEAgent.msi installer file, but that file was already in the location it was looking in. This meant the something was corrupt, so a little digging through the McAfee support forums led me to a quick fix using a registry hack.

1. Open up the Registry Editor (regedit.exe)

2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products
3. Go to Edit->Find
4. Search for MFEAgent.msi
5. Delete the PackageName entry that is found with MFEAgent.msi as its value. It should be under something like HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\2C12BAA2ADC498140ACEE56D6611F348\SourceList. The 2C12BAA2ADC498140ACEE56D6611F348 may vary between machines though, which is why you should search for it
6. Restart your computer
7. Reinstall the McAfee Agent

An alternative to searching in steps 3 and 4 would be to look in the Application event log at your event ID 1002. This will give you the exact registry path to the PackageName key you need to delete.

The McAfee forum post can be found here. Look on the second page for an entry by user SeaCat, who posted a long list of steps to fix the problem. Luckily, the first step of editing the registry was all that I needed to do, and from some of the other entries it looks like that also worked for some others.

Disable or enable an Active Directory account on a schedule

I know Active Directory has log on hours and account expiration, but what if you need to disable a user account at a specific time? I found this can be useful when an employee quits or is terminated because as long as I know in advance, I can schedule their account to be disabled and don't have to remember to do it manually. The trick is to use AD command line tools that are available on Windows Server through a batch file so it can be scheduled to run at a certain time. Here's how it can be done:

1. Create a new text file and rename it to something.bat. This is the start of your batch script file that you'll schedule later on.
2. Right-click your .bat file and select Edit. This should open the file in notepad so you can enter your command
3. Enter dsmod user USER_DN -disabled (yes|no) into your batch file. To expand on what this means:
1. dsmod user is required. This uses the directory services modify program built into your server,a and also says it will be a user change.
2. USER_DN represents the DN of the user you want to disable within your Active Directory structure. Say your Active Directory domain is domain.com, your user is named Test User, and the user exists in the OU named DomUsers. Your USER_DN value would be CN=Test User,OU=DomUsers,DC=domain,DC=com
3. -disabled is required because it defines which property for the user that you are changing
4. (yes|no) means to select yes or no, whichever one you want to set disabled equal to
4. Save your batch file
5. Use Windows Scheduled Tasks to schedule the file. You can browse out and select it, then pick the schedule you want it to run.

Here are two basic examples of the command using the information above

To disable Test User the command is

dsmod user "CN=Test User,OU=DomUsers,DC=domain,DC=com" -disabled yes

And to enable Test User

dsmod user "CN=Test User,OU=DomUsers,DC=domain,DC=com" -disabled no

Notice that I put the USER_DN in quotes. This is because there are spaces. You're best off using quotes around the USER_DN regardless since it will work with the quotes regardless or spaces.

Also, if your user is buried in multiple OUs, just add them to the DN. If Test User had been in three tiers of OUs, such as a top-level named USA, a mid-level named MN, and a bottom-level named DomUsers, the USER_DN value would be CN=Test User,OU=DomUsers,OU=MN,OU=USA,DC=domain,DC=com

To see the Microsoft KB article outlining doing this with dsmod, click here

OS X Lion not creating a local home folder for network users

Update: 3/27/12


After a few months of relying on Snow Leopard, I had to get a new Macbook so this topic has come back up. I'm happy to report that the 10.7.3 update Apple released in early February appears to have fixed the mobile account issue this post was about. The only thing that still doesn't work is when disconnected from the network, domain users do not have admin rights on the machine even if they're in a group that Directory Utility has identified as an admin group on the machine. To get around this, check out my other post.


Update: 8/19/11
Apple released 10.7.1 yesterday, so I'm curious to see if it resolves these issues with network accounts. I'll have a chance to test it next week and will update this with what I find. If you're ready this and already tried it please leave a comment as to whether or not it works for you

Original Post

I use local home folders for the Mac users I manage, but the Macs are bound to Active Directory for the user accounts. In OS X 10.7 Lion this seems to be far from complete. First I couldn't get logged in with a network account, which required a workaround. Then after getting in, another error said the "The home folder for user xxxxxx isn't located in the usual place or cannot be accessed". This has worked fine in 10.4-10.6 but is now broken in 10.7. The problem appears to be related to OS X Lion having bugs with creating mobile accounts. By unchecking "Create mobile account", the home folder issue disappears. Supposedly I see a lot of talk of a 10.7.2 update fixing this problem, but since that update is in beta and not available to the general public that doesn't do much good. If you don't know where to go to uncheck the mobile account box, here's a walkthrough:


1. Open System Preferences
2. Go to User & Groups
3. Click Login Options in the lower left. You may have to authenticate first by clicking the lock icon in the lower left.
4. Under Network Account Server, click Edit
5. Select your domain, then click Open Directory Utility
6. Select Active Directory, then click the pencil to edit
7. Click to Show Advanced Options
8. Under User Experience you will see "Create mobile account at login". Uncheck this box
9. Click OK
10. Close your windows
11. Reboot and log in like normal

"Network accounts are unavailable" when logging into OS X Lion

Update: 3/27/12

I essentially gave up with the Mac Mini waiting on an update that solves the problem, and apparently 10.7.3 completely flew under my radar. I had read 10.7.2 still had issues, but in 10.7.3 one of the primary bugs Apple says they fixed is authentication with directory services. I had to get my first new Mac in a while this past weekend and was going to back rev it to run Snow Leopard, which turns out to be a pain. If you're looking to do it, check this article. Essentially you need a second Mac running Lion in order to use Target Disk Mode to install Snow Leopard on the machine.

In the testing I did today after updating to 10.7.3, it appears that both mobile accounts and the network unavailable issue have been fixed. The network unavailable may still show up for a little bit, but it disappeared for me within a minute. Having mobile accounts working also makes it easier since after the first login the user won't need to wait for the network account availability to change.

Update: 8/19/11
Apple released 10.7.1 yesterday, so I'm curious to see if it resolves these issues with network accounts. I'll have a chance to test it next week and will update this with what I find. If you're reading this and already tried it please leave a comment as to whether or not it works for you

Original Post


If you use Active Directory user accounts with your Macs, you may run into this issue after upgrading or introducing OS X Lion. Hopefully Apple comes out with an update to fix it soon, but in the meantime there is a workaround. You can add a custom search path to the Authentication tab and that seems to work. Here's a walkthrough:

1. Open System Preferences
2. Go to User & Groups
3. Click Login Options in the lower left. You may have to authenticate first by clicking the lock icon in the lower left.
4. Under Network Account Server, click Edit
5. Select your domain, then click Open Directory Utility
6. At the top, select Search Policy
7. Under the Authentication tab you should see two paths: /Local/Default, and /Active Directory/YourDomain/All Domains, where YourDomain is a placeholder for the name of your domain name. Click the + to add another
8. You should see /Active Directory/YourDomain listed as an additional option. Select it and click Add
9. Move /Active Directory/YourDomain above /Active Directory/YourDomain/All Domains so it has a higher priority
10. Click Apply
11. Reboot and log in

Thanks to juiced2010 at macrumors.com for posting that the solution.

Mac OS X 10.7 Lion scrolling is inverted

After having my first hands-on experience with Mac OS X 10.7 Lion, one thing I noticed right away is that Apple thought it was a good idea to try to change the way people use scroll buttons on mice. They've set the default to be inverted, so if you scroll down the screen moves up, and scrolling up the screen moves down. I I'd guess this is because of their new swipe gestures to control your computer, but for someone like me who likes a two-button mouse it makes scrolling seem backwards. It's a simple fix though if your preferences are the same as mine:

1. Open System Preferences
2. Go to Mouse
3. Uncheck the box at the top that says "Move content in the direction of finger movement when scrolling or navigating"
4. Close System Preferences