Assemble your tools:

1. Download the Partial Update manual, the LUNA Reference Guide, and the catalog sample from the Manuals.
2. Download samples from the Hotfixes and Samples pages.
3. If you don’t have a suitable text editor, try Notepad++, which has syntax highlighting for Lua scripts.  Lua for Windows (below) includes the IDE SciTE, as well [and switch it to a monospace font...].
4. Visit the Lua scripting language main website and download Lua for Windows.
5. Order “Programming in Lua (2nd Edition).”  It may be overkill, but there’s no sense being half-assed about it.
6. Download OpenSSL for Windows to compute your MD5 hashes required for file copies.

Example script to install Flash 10.1, slightly modified from sample scripts:

-- IGEL WES partial update to install Flash 10.1.53.64

-- Check OS-Version [OS_CHECK]
product_version = setup.get("product.version")
if product_version == nil then
 error("Cannot get product version")
end

os_version = string.sub(product_version, 1, 2)

if os_version ~= "2." and os_version ~= "02" then
 error("Update cannot be applied. OS-Version must be WES")
end

-- Create the Filetable [CF]
files = {
{src="install_flash_player_10_active_x.msi",
dest="C:\\Temp\\Flash_10_1_53_64\\install_flash_player_10_active_x.msi",
digest="9f1c0833befc49cdf7d4f3156a56d1bf",
size=3574}}

-- Check if Partial Update Package matches to the Thin-Client space at all [SP]
NeededSize = fs.usage(files)
AvailableSize = sys.diskfree("C:")
if AvailableSize < NeededSize then
 error("Not enough space on CF to install Partial Update: Flash_10_1_53_64")
end

-- Install the files from the table [IF]
for FilePos, t in ipairs(files) do
 PKG:install(t.src, t.dest, t.digest)
end

-- Silent install of MSI-File [MSI]
sys.exec("C:\\Windows\\System32\\msiexec.exe /i C:\\Temp\\Flash_10_1_53_64\\install_flash_player_10_active_x.msi /passive")
fs.remove("C:\\Temp\\Flash_10_1_53_64")

-- If demanded, force a reboot [FRB]
if fs.pending() then
 sys.reboot()
end

main.cf:
local_recipient_maps = proxy:unix:passwd.byname $alias_maps $fax_recipients
fax_recipients = regexp:/etc/postfix/fax_recipients
fax_destination_recipient_limit = 1

fax_recipients:
/[0-9]{10}@.*/  OK

transport.regex:
/[0-9]{10}@.*/  fax:localhost

master.cf:
fax     unix    -       n       n       -       1       pipe
    flags= user=uucp argv=/usr/bin/faxmail -d -n ${user}

Windows 2003 terminal servers wouldn’t allow audio redirection over RDP.

Client: Windows XP SP3 w/ RDP 6.1 client (6.0.6001).

Servers:  Windows 2003 Standard R2 (32-bit) , SP2, all current patches.

Servers are in “Terminal Services” OU that sets group policy “Allow audio redirection = Enabled.”  Viewing in RSOP MMC confirms that the setting is applied.

gpresult /v:

GPO: Terminal Server Test
KeyName:     SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\fDisableCam
Value:       0, 0, 0, 0
State:       Enabled

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\fDisableCam == 0

Connect via RDP.  Open Control Panel -> Sounds and Audio Devices.  Uncheck “Mute” and click “Apply.”  “Mute” is checked again.

Clicking “Advanced” under “Speaker Settings” results in error “DirectSound settings not available.”

Similar

http://social.technet.microsoft.com/Forums/en-US/winserverTS/thread/42930f70-a68a-4397-8c61-7d2017a4988b/

http://www.virtualpcfaq.com/Virtual_Server_2005/rn-738-15532_DirectSound_settings_not_available.aspx

Solution

RDPCLIP.EXE wasn’t running.

I didn’t realize that rdpclip.exe was needed for audio redirection and must have unloaded it when trimming startup programs to lower cpu/memory.  I had already disabled clipboard redirection to speed things up, so I figured there was no need to run rdpclip.exe, which, as the name implies, was originally a Windows 2000 resource kit utility to allow copying and pasting files between client and server.  My kingdom for an architecture diagram….

1. Enable SSH on the firewall.
2. Enable SCP (System -> Admin -> Settings -> Enable SCP)
3. Create a ‘backup’ admin user with read_only profile.
4. Run a script to scp the configs.

Uses Net::SCP::Expect

#!/usr/bin/perl -w

use warnings;
use Net::SCP::Expect;

@firewallips = ('192.168.1.1',
 '192.168.2.1',
 '192.168.3.1',
 '192.168.4.1',
 '192.168.5.1',
 '192.168.6.1'
);

foreach $ip (@firewallips) {
 print "$ip\n";

 my $scpe = Net::SCP::Expect->new(auto_yes=>1);
 $scpe->login('backup', 'SUPERSECRET');
 $scpe->scp("$ip:sys_config","/home/fortinetbackups/fortinet-$ip\.conf");

}

Or you could do it this way.