Moving WSUS content and Windows Internal Database to another drive

Today I had to create a RAID massive from the disk, where WSUS content was stored. Also there was database file of Windows Internal Database (that's how I store the information about my WSUS).
Moving WSUS content is a really easy task involving just a few steps.
It requires just one command.
wsusutil movecontent [path to new location] [path to log file]
(Location of wsusutil command is %drive%\Program Files\Update Services\Tools)
It's a bit strange, but the command couldn't run successfully and terminated with error "access to log file path is denied" nevertheless it had "everyone full access, network service full access, etc." permissions. The solution I found, was to create a simple txt file and point the command to it rather than to the folder. That's funny that the file has to be created manually.

To move database files, I had to install SQL Server Management Studio Express.
Fill the following parameters In the connection dialogue box:
Server Type: Database Engine
Servername: \\.\pipe\MSSQL$MICROSOFT##SSEE\sql\query
Authentication: Windows Authentication

In the "Databases" find "SUSDB", click on "Tasks" and then "Detach". In the dialogue box select "Drop connections".
Then we have to simply copy the folders using explorer or anything else.
When folders are in the right place, open SQL  Server Management Studio Express and right click on "Databases". Select "Attach" and choose the .mdb file.

Done!

Procmon - little handy tool

Recently, I've faced a problem, when wrong GPO from old misconfigured Windows Server 2003 DC applied to newly installed Windows Server 2008. There was a lot of issues related to wrong registry and file system permissions (the only things that doesn't restore to a previous state after removing GPO), so different services, such as Terminal services, couldn't start and produced a lot of errors. The only tool that helped me was Procmon. It allows to see real-time operations of operating system, check all "Access denied" errors and much more. Now everything works just fine.

Assigning restrictions to logon locally, accessing computers from the network and other interesting user permissions on Windows

Today's task was to secure access to the Microsoft Windows 2008 server using GPO. That's an interesting topic to play with because there is a lot of different combinations exists to accomplish this. A combination of local and domain policies, NTFS permissions can be used. Here I will try to post a conclusions that arised after this work.
First of all I would like to talk about NTFS permission named "Traverse Folder". That's a very interesting permission because it allows us to tighten security to a highest level. Let's make an example. Let's say we want to access a folder under the following path: "C:\lala\dada\KEY". For user "Tony" to access folder "KEY" he has to have NTFS permissions for it, but not only for it. What about parent folders? In fact, he has to have a "Traverse Folder" permission on all the parent folders to access "KEY" folder. So we should modify all the parent folders permissions to give "Tony" access to "KEY"? Not at all. By default, GPO assign the following "User Right": "Bypass Traverse Checking" to "Administrators, Backup Operators, Users, Everyone, Local Service and Network Service" on workstations and servers and "Administrators, Authenticated Users, Everyone, Local Service, Network Service and Pre-Windows 2000 Compatible Access" on Domain Controllers.
This is the link to Microsoft support article that describes different incompatibilities that may appear after wrong modification of critical user rights like "Allow logon locally", "Access this computer from the network" etc.

Making a router with NAT from Windows XP without enabling ICS

I've always wanted to know how to enable routing and NAT on XP box without enabling ICS (Internet Connection Sharing). Today it's time to write some lines about it. Let's begin.
1. We should enable service "Routing and Remote Access"
2. Open registry editor and navigate to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" and set IPEnableRouter to "1"

Then, open a command prompt and type the following commands:
3. netsh routing ip nat install
4. netsh routing ip nat add interface "WAN Interface Name" full
5. netsh routing ip nat add interface "LAN Interface Name" private

I'm not sure whether computer has to be restarted after this setup, but the answer is probably "yes".
Anyway, if something doesn't agree to work - just restart the computer before panic :D

P.S. One more thing to add:  
To check configured interfaces type netsh routing ip nat show interface