Updating Adobe Flash Player with batch files and SCCM 2012

I've been faced with updating a lot of (to me) computers with the current version of Adobe Flash Player due to the recent vulnerabilities in Flash. I haven't found a good way to be notified of a new release, so my browser is now set to open a tab with the version of Flash available.

Of the over 4000 Windows computers I am attempting to keep updated, over 90% have Adobe Flash Player installed, with either the ActiveX or NPAPI version installed (or both). I'm using SCCM, so I deploy Flash Player as a MSI package. And it seemed like I would deploy an update, then a new vulnerability and update would crop up, so a new deployment/upgrade cycle began again. I'm not fond of this Flash Update Ouroboros so I wrote a script to simplify things.

First, the script for ActiveX:

@echo off
REM Run via SCCM against collection of devices with old Flash Player ActiveX

:VERSION
REM set current Flash version
SET CurrentVersion=18.0.0.232
SET CurrentMajorVer=18

:GRACEFUL_UNINSTALL
REM attempt to gracefully uninstall Flash
wmic product where "name like 'Adobe Flash Player%%ActiveX' AND NOT version like '%CurrentVersion%'" call uninstall

:INSTALL_CURRENT_FLASH
REM install current Flash from distribution point
%Comspec% /c msiexec /i "\\server\software\FlashPlayer\%CurrentVersion%\install_flash_player_%CurrentMajorVer%_active_x.msi" /qn

:END

Next, the script for NPAPI Plugin:

@echo off
REM Run via SCCM against collection of devices with old Flash Player Plugin

:VERSION
REM set current Flash version
SET CurrentVersion=18.0.0.232
SET CurrentMajorVer=18

:GRACEFUL_UNINSTALL
REM attempt to gracefully uninstall Flash (old versions "Plugin" new ones "NPAPI")
wmic product where "name like 'Adobe Flash Player%%Plugin' AND NOT version like '%CurrentVersion%'" call uninstall
wmic product where "name like 'Adobe Flash Player%%NPAPI' AND NOT version like '%CurrentVersion%'" call uninstall

:INSTALL_CURRENT_FLASH
REM install current Flash from distribution point
%Comspec% /c msiexec /i "\\server\software\FlashPlayer\%CurrentVersion%\install_flash_player_%CurrentMajorVer%_plugin.msi" /qn

:END

The only real difference is the Uninstall and Install section to reflect ActiveX vs Plugin. The script uses WMIC to look for any Flash Player that is installed but not current, uninstalls it, then installs the current version based on the variables set in the script. Assuming you create the folder with the version number and the current packages, the script can be edited and used to update computers quickly.

On a higher level, I'm using System Center Configuration Manager to limit my collection of devices so I am only running the updates on the computers that need it (that would be an entire other post). While I think that you could just use a GPO to push this, be aware that all systems would end up with Flash Player installed even if it didn't have it installed before. By targeting only the systems that already have Flash Player, I am updating computers but not increasing my vulnerability surface area.

Naturally, I considered installing an update server, but I haven't figured out Adobe's documentation on this. For now, this batch file does the job for me.

To update your packages and script when Adobe releases a new Flash Player,

1. create a new folder named after the current version on a distribution server (i.e. \\server\software\FlashPlayer\18.0.0.999)
2. download the Adobe Flash Player distribution packages (sign up here) via your custom URL obtained from your Adobe Distribution Agreement email and put them in the folder you just created, and
3. update the "CurrentVersion" and "CurrentMajorVer" variables in the batch files, then
4. deploy.

Enjoy. The lack of additional explanation is mainly due to my intention to remind Future Me what I was doing when I forget my methodology and to give other IT guys a starting point for ideas on updating Flash Player en masse.

XP End-Of-Life, What It Means and How It Affects You

UPDATE: 04/28/2014 - if you haven't yet, stop using Internet Explorer (IE) immediately. There's a serious security flaw in IE and XP computers will not be patched. If you want the Microsoft mumbo jumbo, read this and this.

People still running Windows XP and have Automatic Updates turned on will receive the warning that XP is no longer supported. I've gotten several messages from people expressing varying degrees of concern.

What It Mean that XP has reach End of Life (EOL)

• If you are still running Windows XP, it basically means it is really time to upgrade if you have the funds. XP has been around for 12 years, so you're not getting the best of the Internet any more.
• It means Microsoft will no longer provide security updates or technical support for Windows XP. So, if there is a security concern (like the recent OpenSSL Heartbleed Bug), there's no updates to protect you from hackers (Oh Noes!).
• It means no more updates to Internet Explorer, Microsoft Security Essentials and likely other applications like web browsers. That may very well mean that web sites like Facebook just won't look right down the road on your computer.

What It DOESN'T Mean

• Your XP computer is not going to stop working. It'll keep doing the same things it was doing last week.
• Your XP computer is not going to suddenly get hacked. You're no more vulnerable than last week.

An Analogy

Let's say you have an old car named Windows XP. I don't mean a 1965 Ford Mustang, more like a 1972 Ford Pinto. XP's End-Of-Life is like Ford declaring that they will no longer manufacture parts, honor any safety recalls, or for that matter service them at dealerships. You can still put gas in it, drive it around, do oil changes, etc. Your Pinto will still keep running, but when it breaks, that's the end. Windows XP is like that Pinto, it'll keep driving, but you can't find parts.

So, What's the Bottom Line?

Seriously, time for a new computer. Or, get a nice tablet and you may find that it's an adequate replacement for your old XP computer. But don't freak out.

If you must keep using your XP computer, get a different browser and keep your antivirus software up-to-date. I would recommend you stop using Internet Explorer and use Google Chrome instead. Google has promised to keep Chrome running on XP until April 2015.

Google Voice App for BlackBerry and Android

Yesterday, the Official Google Blog announced the release of Google Voice mobile app for Blackberry and Android. I've been waiting for this... Check out the post and get the app at m.google.com/voice.

Vista and Windows 2008 Service Pack 2 available now

You can now download the Vista and Windows 2008 Service Pack 2 installation files. The main page is here at http://technet.microsoft.com/en-us/windows/dd262148.aspx.

• ISO for Windows Server 2008 x86/x64/ia64 and Windows Vista x86/x64
• x86 for Windows Server 2008 and Windows Vista x86
• x64 for Windows Server 2008 and Windows Vista x64
• ia64 for Windows Server 2008 ia64

Most people will want either the x86 or x64 version. I grabbed the ISO as well since I install it stand-alone so often.

Worried about Conficker?

Are you worried about Conficker? It's set to go off on April 1st.

It only affects Windows computers, so if you're running Macs or Linux machines, don't worry about it. (Mac users, don't feel too smug, as the recent PWN to OWN demonstrated an exploit of a fully updated Mac in mere seconds).

There's a fairly detailed analysis at Windows Secrets. If you think you might have Conficker, try visiting http://www.symantec.com/ or http://www.mcafee.com/; if you cannot, you may have it.

To remove Conficker, visit http://www.bdtools.net/ and download BitDefender's single-PC conficker removal tool. If that doesn't work on the infected PC, download it from another and run it on the infected PC.

If you are a network admin, go get Nmap (see also this) and run the following command:

nmap -PN -T4 -p139,445 -n -v --script=smb-check-vulns --script-args safe=1 [subnet]

where subnet is something like 192.168.1.0/24 -- you can thank Doxpara for that.

I would also suggest that you use OpenDNS. They have been blocking conficker since February, and there's more detail here. Seriously, sign up for OpenDNS if you are not using it yet; it's free and does more than just provide DNS. I've talked about them before, but not enough.

Sphincter Moments

I had a very tense morning on Friday, what my coworker refers to as a Sphincter Moment.

The Background
On Thursday, I was doing a server migration from UNIX to Windows. The UNIX server is getting really old and the hardware is no longer reliable.

The data transfers over without conversion, so I could simply send the files via FTP. For convenience, I usually collect the files into a TAR or GZIP file before sending the files. I got people out of the system at 5 PM, made sure last night's backup had ran OK, then created my TAR files for the transfer.

The Reboot
The FTP download wouldn't complete, so I investigated. The UNIX time was off by 80 minutes (no one applied the new timezone patch), and restarting TCP didn't seem to help. System uptime was 287 days, so I figured, "Well, I have two backups, I'll correct the time, reboot and see if that helps."

I flushed the disk controller's cache to disk via the sync command, then issued a shutdown and restart command. Twenty minutes later, I still can't log in and I can't ping it locally... and my contact person on site answered the phone but just left (argh).

The next morning, the client discovered that the server room was locked and nobody had the key. After getting the vice president who had the key to unlock the server room, he turned the machine back on, followed some onscreen instructions, and we were back in business.

"Oh Crap"
I went to my backup folder to try a transfer before they got busy... and my files were gone. The timezone was still wrong, and some other files and changes I made last night were missing, too. I checked the MAC address to make sure I was on the right system, but it was like someone erased all my work. "Weird," I thought, "someone deleted my changes? Oh well, I'll re-do the backup."

Then came the call, "Hey, Lee, we have nothing in our dispatch board. No appointments, period." Then the call from accounting that the fiscal year was wrong. And as I looked at the system logs, I noted that there was a huge gap between 09/25/2008 and 03/27/2009, as if the server had been off for six months. Even our databases were the same way... no data was entered after the morning of 09/25/2008.

I restored the backup from tape (as my TAR backups disappeared with everything else), and the client lost a day of work. Fortunately, it was a light day and they could re-input their data quickly. Out of the IT director, the CIO, CTO, my manager, and myself, I was the one most bent out-of-shape over the whole thing.

What Happened
We pieced it together after the fact. The IT director is new as the previous one left without warning and without leaving any passwords or configuration information. He knew the UNIX server was having problems, but not what problems.

Nobody was monitoring the RAID array, and it is a RAID-1 with a LSIL on-board controller. The LSIL had a neat feature, in that if the array is broken, both the online drive and the offline drive retain data, and the array can be rebuilt with either drive. This allows you to build an array from existing drives without losing data on the drive you copy from.

Well, DISK 0 probably went offline in 09/2008, while DISK 1 kept working. When the server restarted, it either 1) asked which drive to set as primary and defaulted to the old data on DISK 0, or 2) defaulted to DISK 0 without asking. In either case, the drive from 09/2008 became the primary, thus causing a six-month black hole.

The Moral
The moral of the story? Make sure you have backups, make sure you have OFFLINE backups, and make sure those backups can be accessed and restored -- test your backups! Thank God Almighty that the backup restored OK, or that client would be out of business within months. *whew*

Google Contact Sync for BlackBerry available

I was updating my BlackBerry apps and noticed that Google Sync for BlackBerry now includes Google Contact synchronization. You can upgrade from Google Mobile Apps on your BlackBerry (select the "More" option, highlight the Sync icon, and choose upgrade), or you can visit m.google.com/sync from your phone and install or upgrade.

I am using a BlackBerry Curve 8320 and OS 4.5. Google Sync does two-way contact and calendar sync and it is working for me. I am very happy to finally have contact synchronization.

I had just signed up for Soocial, but their BlackBerry sync is still missing.

This move from Google is welcome; I was beginning to think they only love the iPhone and forgot us BlackBerry users. :-D

Ther is no free Microsoft Publisher Reader, but there are options

Microsoft Publisher does not have a free viewing program like Adobe Acrobat Reader. My church uses Publisher, but not everybody has it installed, thus creating a problem for people who have to view Publisher files.

So, if you need to read Publisher files, or if you need to send Publisher files to others, here are a few options, including a "free Publisher reader" of sorts.

For CREATORS of publications:

You can convert your publication to PDF first, and email the PDF file.

• If you have Publisher 2003, you should download a PDF printer. I would recommend that you install CutePDF (you'll also need to install GhostScript). This will give you a CutePDF "printer"; You can create PDF files from anything you print, so just print your Publisher file to CutePDF. You will be prompted to save the PDF file; just email the PDF instead of the Publisher file.
• If you have Publisher 2007, download the "Save as PDF or XPS" plug-in from Microsoft. From your publication, choose the File menu to save the publication as a PDF file, then email it.
• You can also embed the Publication in the body of an email; use the File menu in Publisher to send the publication as an email.
  

For RECEIVERS of publications:

If you receive a PUB file as an attachment and do no have Publisher, you can convert it or get a "free reader."

• You can convert the PUB file to a PDF online, for free, at PDF Online and have the converted document emailed to you.
• You can also get a "free reader" of sorts by running the Publisher trial version until it expires. Download the TRIAL of Publisher 2007. For 60 days, you will have full functionality. After 60 days, it will still open PUB files; you can print but you cannot edit them.

Uptime of 38 Years, 4 Months, 3 Weeks

There's no way this is accurate, since I installed this system myself, but I came across a UNIX system that claimed an uptime of 38 years, 4 months and 21 days. If that were true, this would literally be one of the first UNIX systems ever. Must be a math error...

Laptop dead... argh

My laptop died on Sunday. I got done paying bills online, tried to access a server at church, then... blue screen of death. After a couple of reboots that were sucessively less encouraging, my laptop finally said there was no hard disk installed.

I went to work and plugged my laptop's hard disk into another laptop and was able to boot in Safe Mode and copy my files to a USB hard disk drive. But, my laptop is just not working.

Estimate is $560 to fix. We'll see what my boss says....

Windows XP SP3 (Service Pack 3)

Windows XP SP3 (Service Pack 3) is available now as an optional update on Windows Update and will become automatic (probably as a critical update) on June 10th.

If you are using Microsoft Dynamics, Microsoft's POS (point-of-sale, not the other thing you're thinking) retail solution, don't install SP3.

Microsoft requires you to have SP1 installed before SP3, and recommends you have SP2 installed (get SP2 from Windows Update) as well before SP3.

In a nutshell, if you have been running updates all along, this won't be a big deal. However, if you load Windows XP fresh on your PC for some reason, this will save you a great deal of time. It adds some Windows Server 2008 compatibility and other networking features, but the big deal is saving time after installing SP2.

So, don't expect any new features. Getting SP2 was essentially getting a new operating system. SP3 is just a time-saving roll-up of patches.

You can download Windows XP SP3 here (316mb) or (more official looking) here. Of course, you should find it as an optional update.

For more, Paul Thurrott's got a review.

Yeah, I know, lots of boring technical stuff lately, but it's what I do for a living.

Update: Microsoft has released a hotfix for Microsoft Dynamics.

Gmail up to 5.4GB, with IMAP!

I've been using Gmail for a while now. The capacity has grown from 2GB to 5.4GB, and I've only used 9% so far. Google Apps is so appealing to me that I intend to transfer my father-in-law's church to it once I start to administer the network.

The truly amazing thing about Gmail is the free POP3 and SMTP access, and now the inclusion of IMAP. The difference between POP and IMAP is how email is stored; in POP, you take the email away from the server, and in IMAP you duplicate what is on the server.

Some ISP's have offered POP for free, and most charge for SMTP access. None of the other free email hosting services offer IMAP at all. Google is a pioneer in that regard.

With POP email, the mail is moved to your computer; if your computer crashes, the email is gone. With IMAP email, the mail on the server is synchronized with your computer; if your computer crashes, the mail is still on the server and available to you. If you delete a message from the server, it is gone from your computer. If you mark a message as read on the server, it is marked as read on your computer.

If you have used corporate email like Exchange or Lotus then you understand client/server email. IMAP is a great way to pick up email on multiple devices without you having to keep them all in sync.

If you are still using an email like Yahoo! or Hotmail, or YourName@Verizon.net (or sbcglobal.net, etc) then I would encourage you to get a gmail account, or better yet, get your own domain and migrate your mail server to Google Apps. If you need a gmail invite, just drop me a line.

Daylight Saving Time

Note: this is an email I sent my church staff. I figured it would be helpful for those of you reading the blog.

Daylight Saving Time rules have changed. Feel free to pass this along to anyone else who may need to read it.

In August of 2005 the United States Congress passed the Energy Policy Act, which changes the dates of both the start and end of Daylight Saving Time (DST). This law goes into effect in 2007. Starting this year DST will begin three weeks earlier (2:00 A.M. on the second Sunday in March) and will end one week later.

As a result of this change, Daylight Saving Time will begin on March 11, 2007, so please review your appointments so you can prepare for this change before that time. Pay special attention to:

1. appointments between the Second Sunday of March and the First Sunday of April
2. appointments between the Last Sunday of October and the First Sunday of November
3. appointments with recurring schedules

If anyone has a large amount of appointments which require modification, use this link (http://www.microsoft.com/DST2007) to get the patch for your computer.

References:
http://www.microsoft.com/windows/timezone/dst2007.mspx
http://www.microsoft.com/DST2007
http://support.microsoft.com/kb/931667

Look, ma! A custom domain!

You may already be aware of the Google Blogger custom domain option. It's been ready for a month now. I used to consider publishing to FTP, but I like the new approach (using a CNAME record). The direction for switching to a custom domain are easy enough to follow.

I use http://www.godaddy.com/ mainly due to price. With just a parked domain, I am able to host my Blogger blog and I am using Google Apps for email, too. All that with a parked domain, so there's no monthly fee.

My church just started a blog using Blogger, but the domain name is akin to "reallylongchurchname.blogspot.com," and the "look and feel" does not match our church. I want to convince my pastor to integrate it into our main site, so I figured I would demonstrate the result on my own blog. It was quick and painless, taking less than 30 minutes to execute.

There is a downside: you cannot publish to a subfolder. In other words, you can do "blog.leeandcathy.com" or "www.leeandcathy.com" but not "www.leeandcathy.com/blog". That's not a problem for me, and my intention is to point the blog to "blog.reallylongchurchname.com" anyway.

Anyway, hope you like the change... it's kinda here to stay. And in case you are wondering, all pages that pointed to http://leeandcathy.blogspot.com/ will automatically redirect here, and all previous posts will automatically get to the right location, too. Also, http://leeandcathy.blogspot.com/ remains mine; if I want to go back to that Blog*Spot address, it is still retained by me.

Want email that doesn't suck?

Want email that is portable and doesn't suck? Google's gmail is now open to all for signup.

Disabling Vista UAC Prompts

Vista's new User Account Control (UAC) is a new security component in Windows. If you've used Vista at all, you know that it feels like Windows Vista nags you about launching every single program. Here's a simple explanation: Microsoft wants to protect your from evil software, so it makes you think twice when you do something Microsoft doesn't recognize; it does so by asking "are you sure?" when you do something like install software or launch a program that is not registered with Microsoft (e.g. Firefox). For a detailed explanation, see this Microsoft Technet article.

Anyway, these prompts can get annoying, almost like nagging. I didn't like them in the beta, I don't like them now. I ran Vista with the UAC prompts for a week, and I disabled them today with the secpol.msc tool (see this URL to disable UAC it yourself).

That's why I found this new Apple "get a Mac" ad so funny... (click to watch)

Vista editions and disaster recovery

There may be too many editions of Vista (as I explained previously).

People have been lampooning Microsoft's number of editions, some more seriously, some less so, but the point is well taken: it is just too confusing.

Given the choice, here's what I recommend: get Vista Business or Vista Ultimate. The Home editions do not include built-in hard disk imaging, which is a great backup mechanism. You should routinely make backups, but imaging is fantastic.

Are you familiar with those "system restore" discs? The ones that you can use to wipe out your computer and make the hard disk like you just took the computer out of the box? That's a disk image.

So, get your computer set up the way you like it (backup and remove your documents), then make a disk image. If you ever have problems, restore the image and then restore you documents. It will probably only take you one hour.

The only edition which does not support Aero and the Flip-3D eye candy is Vista Home Basic. Vista Home Premium addes Aero and Media Center (which you don't need if you Tivo). Vista Business adds imaging but removes Media Center. Vista Ultimate has all of the above, plus BitLocker Drive Encryption (for the enterprise user, or the hyper-paranoid).

If you participated in the PowerTogether promotion, you're getting Vista Business (way cool). That's probably what I would recommend for almost everybody.

Vista on my laptop (and driver tips)

So, I installed Windows Vista Ultimate. When I went to the Microsoft's New Day Launch Tour 2007 event in LA and got my copy of Office 2007.

Heres' a hot tip: You are not forced to go to the track you sign up for at the New Day event. If you sign up as a developer, you can still attend the Technology Decision Maker (TDM) track, which is shorter. So if there are any openings left, take them.

Another tip: About 2:30 PM, the TDM track ends, and you can finish your survey and pick up your swag bag.

Final New Day tip: Create a disposable email address to sign up with. Be sure to hit all the booths and have your badge scanned. If you can, preprint some business cards, too, with your disposable email address to enter the drawings. Most booths were having drawings for Microsoft Zune players.

Anyway, the New Day attendee bag includes a "pre-release" version of Vista Ultimate with a valid key. That's what I am running now. I think it is the new equivalent of "not for resale" (NFR). The swag bag includes the Office 2007 license. This gift is actually just the product key; you'll download the install file later, much like the "Power Together" promotion worked (those are beginning to arrive, by the way).

Installing Vista: Before you install Vista, run the Microsoft Upgrade Advisor. If you have a 3.0 or better you should be just fine. Vista will load in 40 minutes (at least it did on mine). I have a Toshiba Satellite M105-S322 and almost everything just worked, except for my fingerprint reader and SD card slot.

Finding Drivers: Finding drivers for my laptop was not easy. Toshiba's support site did not list any drivers for my laptop, and I had a few devices not working (biometrics, SD slot, touchpad scroll). If you are going to install Vista, here's a few suggestions:

• Back everything up (duh).
• Before installing Vista, print our your Device Manager screen from System Properties in Control Panel.
• Visit your computer/laptop manufacturer's web site and look for drivers for Vista. If they don't exist, you can either use the XP drivers (not ideal, but works) or hunt for drivers on similar models.
• Download any BIOS updates for your computer/laptop before installing Vista.
  

So far, the biggest problem I've read about in forums is "where's the Vista driver for XYZ?" I have a Toshiba Satellite, so I visited Toshiba's site looking for Vista drivers on other Toshiba laptops. Since the same components get reused in other machines, Vista drivers for those machines work for my laptop, too. That's how I found my SD flash reader drivers, fingerprint reader drivers, and my ALP touchpad drivers.

Experience with Vista: I am pretty jaded. After about 30 minutes of using Vista, the Flip 3D thing lost it's novelty. I like the gadget bar, but that was previously available as a 3rd party add-on.

Here's what I do like, though... performance did not suffer (much). The Start Menu integrated search is pretty handy. And, I must admit, everything is prettier. That's about it.

Bottom Line: If you have XP, there's no compelling reason to purchase an upgrade, unless you use a tablet PC. However, Vista is nice, with some networking enhancements. Vista is probably what XP should have been. Get it if it is cheap or free, but I wouldn't rush out to spend money on it just for the eye candy.

Making Your Blogger Beta Header a Graphic

I haven't spent much time in the HTML of my template (yet). However, I did want to know how to add a graphic as part of my header, perhaps a table with a graphic. There's a great solution I saw with a simple Google search which required only changing the template to NOT lock a template element. I wanted to know how to unlock template elements anyway, and I didn't want to actually modify the header widget in HTML file directly.

Anyway, I tried a work-around that doesn't require editing the HTML template at all. It occured to me that I could just put HTML where the header text would go. And, it worked.

When you edit your template (Dashboard > Template tab > Page Elements), click to edit your header. You can remove the Blog Description text completely if you like. In the Blog Title field, insert the HTML code for your image, with a 99-character limit, like <img src="http://www.example.com/banner.png" />

You should have, as a result, a header with a graphic in it. That's it. I still like the "unlock widget" method best, but this work-around requires no customizing at all.

Free Windows Vista Business & Office Pro 2007

File Under: Technology / Free Stuff

Microsoft is giving away a Windows Vista Business license and an Office Pro 2007 license if you watch three web-based seminars for each. Here's the link to the giveaway site, PowerTogether.com. I am not eligible myself, but my family and friends are eligible!

Here are the requirements: you need to have a Microsoft Passport (your Hotmail email will work), and you need to watch three (3) seminars for either free offer. So, to get both of them, you need to watch a total of six (6) web seminars.

Microsoft Office Professional 2007 comes with the following:

• Microsoft Office Word 2007
• Microsoft Office Excel 2007
• Microsoft Office PowerPoint 2007
• Microsoft Office Publisher 2007
• Microsoft Office Access 2007
• Microsoft Office Outlook 2007 with Business Contact Manager

Vista Business does include the coveted Aero interface. While it is true that Vista Business does not include the Media Center, I do not think most people I know will need it. However, Vista Business includes a spectacular backup / system recovery feature: built-in hard disk imaging.

Here's a rundown of the different Vista editions:
The web site is very slow, being hit by, well, everybody and their brother... so be patient, or try to logon during off hours. Offer expires 02/28/2007. Vista & Office are separate, you can run one without the other.

UPDATE: As of 12/01/2006 at 10:00 AM, they are "sold out." Hope you got one! I think Cathy's either just inside the door or barely got shut out, I'm not sure, but I know she is not getting a copy of Vista. I hope she gets the Office Pro 20007!