Why doesn’t my Blackberry work? And other Techno-geek problems…

This one entry in my blog is a techno-geek blog and not a whiny writer's entry or even an entry about writing in general. Sorry. Next week. Or see my previous entry which sort of mashed my techno-geek and writing side together in a very uncomfortable mix.

So. You've been warned.

So. For all you desperate admins out there searching the Internet for help on why some of your users' Blackberry's aren't working…or why some of your users can't publish their certificates to the GAL…or why some of the permissions you've delegated in Active Directory don't seem to work all the time…or other anomalies like that…

This blog is for you.

Why Things Just Don't Work As Expected

Having problems with permissions in AD? Problems with Blackberries? Weird anomalies when trying to reset passwords?

I thought so.

Sometimes being an enterprise administrator for a very large organization is just…depressing. Since we've upgraded to Windows 2003, I've learned that Microsoft is serious about best practices such as not using your standard, mail-enabled/mailbox-owning user account for administrative tasks. And I've grown serious about it, too since I've begun to appreciate security. Now, I'm so serious that I'm thinking fondly of starting the Guido School of Admin Training (with sincere apologies to any existing Guidos or schools already named thusly).

Our Guido School of Admin Training is a very informal school held outside in the nice, fresh air in the alley between two office buildings. There are no formal registration procedures, however you do have to be nominated to attend. Admins just need to show up for class to begin.

What to expect: The instructor, Guido, will shake your hand and then gently haul you over to the nearest wall by your collar. Then it becomes really exciting and lots of fun. With a jaunty smile, Guido grabs you securely by the back of the neck and smacks your face against the wall while saying in a firm tone of voice:

Do
{smack}
not
{smack}
nest
{smack}
security
{smack}
groups
{smack}
into
{smack}
protected
{smack}
groups.

And then, after a slight pause for refreshments:

Do
{smack}
not
{smack}
place
{smack}
standard
{smack}
mail-enabled/mail-box associated
{smack}
user
{smack}
accounts
{smack}
into
{smack}
protected
{smack}
groups.

Now, if you can repeat what you just learned, you receive a diploma and a short ride to the nearest hospital.

Our school guarantees success. For the rest of their life, students will remember what they've been taught, even if they imprinted on Windows NT and never learned any other operating system and refuse to use an administrative account because it's just too much trouble. Even if they repeatedly put a group containing all 8,000 users in their domain (within your AD tree, mind you) into Domain Admins because they thought that would be the simplest way to deploy something, say, a patch. And after they remove the group containing all the users from Domain Admins and they suddenly get a rash of calls about how all the managers' Blackberrys are all broken, they call you to fix it.

If this happens, it's time to send the admin to Guido's school, so just take the bull by the horns and nominate them.

Because now you have to deal with the admincount attribute.

You see, protected groups are special. They need to be special because in the past, fanatical admins have removed critical permissions from key groups instead of simply not putting unnecessary admin accounts into those groups to begin with. After removing critical permissions, these fanatics have lost control of their domain, or worse, their AD Tree or even Forest. Okay, maybe that's not the entire reason for protecting these key groups, but it is certainly one good reason. There are a lot of others and this blog isn't long enough for all of them.

So in Windows 2003, Microsoft helped admins avoid such idiocy by developing a mechanism to put back critical permissions on certain key groups called protected groups. Organizations which follow best practices for administration and security are most likely completely unaware of this secret mechanism and don't need to worry about it. If you follow best practices, it will have no impact on you and never will. You deserve to be worshiped as the deity you obviously are.

For the rest of us, we need to learn this rule: You don't put standard user accounts associated with a mailbox into any protected group; and you don't nest groups into protected groups (because you lose track of what you nested and could potentially nest groups containing standard user accounts into protected groups and elevate permissions that should not be elevated).

If you violate this rule, the admincount attribute will afflict you mightly. (And yes, I used "afflict" on purpose so don't leave me a lot of obnoxious comments about that. It's funny. Laugh, darn you.)

Protected Groups

What are the protected groups? With Windows 2003, they include:

Schema Admins

Enterprise Admins

Cert Publishers

Domain Admins

Account Operators

Print Operators

Administrators (domain local)

Server Operators

Backup Operators

How are they protected?

One piece of the mechanism protecting these special groups is an attribute called the admincount.

• The protected groups have the admincount attribute set to 1.
  
• Any group or user account nested into a protected group gets the admincount set to 1.
  
• Any user nested into a group nested into a protected group gets the admincount set to 1.
  

The only exception is if there is a user account or group from another domain in your AD tree nested into a protected group, like the domain local Administrators group. The group/accounts from the other domain will not be affected. (But that does not mean you should be a knucklehead and use your standard, mailbox-associated user account for administrative purposes in other domains. Come on, grow up.)

Normally, the admincount is not set at all (it is null).

Every fifteen minutes or so, the operating system looks for the admincount attribute. If it finds it, it does some interesting things. It removes inheritance from the object so it will not inherit the permissions it might once have inherited from its parent OU or OU structure. This prevents unfortunate things from happening if you move one of the protected groups out of the Builtin container to a different OU or container where you might have diddled with the permissions it inherits might cause a breach of security or worse. Like a Help Desk person with full control over a user OU suddenly gaining full control over Domain Admins because some knuckle-dragging yahoo put Domain Admins into that OU. Stuff like that.

In addition, if an object like a user account has the admincount attribute set, the system strips certain key permissions granted to that account or group by the schema definition for that object type at the moment of creation. Specifically, most of the SELF permissions. These are the permissions that let a user account, for example, publish a certificate to AD (and hence, to the global address list or GAL if you are running a product like Exchange 2003).

So this could have the impact of preventing a user from publishing a cert.

Or it may break a user's Blackberry if the user happens to be put into a group like Domain Admins, because generally the Blackberry's service account is granted permissions through the OU hierarchy. These permissions for the BB service account are necessary for the service account to send/receive mail to/from the user's Blackberry to their Exchange mailbox. So if the user's account is affected by the admincount attribute, it will stop inheriting permissions from the OU, the BB service account will not get the permissions it needs, and this user will have a brick instead of a Blackberry.

Just a few examples. I've also seen it cause apparent permission anomalies where an admin grumbles that AD is broken or doesn't work well because sometimes they can't manage an object they supposedly have permissions to manage. When I get that type of call, the first thing I check is if the admincount attribute is set on either the admin's account or on the object they are trying to manage. Most of the time, one or the other (or both) has the attribute set and it's time to nominate the admin for my special school.

Because if a user object can't inherit permissions and has some self-permissions removed, how well do you think you're going to be able to manage an account with delegated permissions? How well will an account thus damaged work with inherited and/or delegated permissions? Not well, my friend. Not well at all.

The Kicker

Once a user account ( or group) is "contaminated" by the admincount attribute, it doesn't come clean just by removing the user account or group from the protected group. Oh, no. You have to fix it.

The nice thing about this is that you can always tell when some admin really needs to meet Guido out in the alley. You can just run ldifde and export a file containing all the users and groups with the admincount attribute set to 1. And of course the event logs on your domain controllers will show membership changes to protected groups so if you catch the problem soon after it occurs, you can see exactly who needs that training.

Here is an example of the ldifde command that will provide you with a text file called ac.txt of all users and groups with the admincount set in a domain (in the example, the domain is example.com):

Ldifde –f ac.txt –d dc=example,dc=com –l samaccountname –r "(admincount=1)"

Note: I like to include the samaccountname attribute in the output (it will by default include the distinguished name) because it helps me in other processes—but this is entirely optional.

You might think that the admincount is a bad thing. It is not. It is your friend because it shows when you are not following best practices and are, in fact, endangering the security of your enterprise. So I'm not in favor of turning off this functionality.

I'm in favor of training and implementing best practices that create a reasonable security model based on the use of a separate account for administration. This secondary account should not be mailbox enabled or associated with a mailbox.

Fixing It

Here is how to fix it if things weren't done exactly right in the past. I will warn you, however, that if you have a lot of user accounts affected (as I have had to fix multiple times for multiple domain admins) this can be a somewhat time consuming process, even if you script it up.

Fix Protected Group Membership

First, you must make sure you undo the cause, which is to say, make sure you don't have any groups nested into protected groups. If you do, remove them. There is no point in trying to cleanse things if you leave the source of contamination. Leaving groups nested into the protected groups means at some future date, you will be addressing this same problem again because people forget and put the wrong accounts into "innocent looking" groups.

So remove all nested groups and remove all standard user accounts that are associated with a mailbox. Just leave your agreed-upon administrative accounts which can and should have the admincount attribute set. Naturally, you won't be an idiot and remove all the accounts before you add the new administrative accounts, because you might find yourself suddenly unable to actually add the new admin accounts, particularly if you empty out Domain Admins without putting any new accounts into it, first. (Just an FYI. I know you know these things but I like to state the obvious. It's so satisfyingly…obvious.)

Clean the Groups and Users Removed

Once you have removed any nested groups and innocent user accounts, you can clean them. You have to clean both the user accounts and the nested groups, if any.

First, reset the admincount attribute to 0 (or null) on the nested groups and users. Null is best, but 0 will work and sometimes it is nice to set it to 0 because you then have a historical artifact you can search for later if you have other issues. A 0 will tell you that this user or group was afflicted by the admincount at one point. (Just as you are afflicted by whichever admin did this to the user or group.)

For one or two users and groups, you can simply edit them in adsiedit.msc, which will allow you to reset the admincount attribute. You can also script it up if you wish. (I use a script for bulk cleaning.)

If you are using adsiedit.msc, you should take the following steps:

• Right click the user (or group) and select Properties.
  
• On the Attribute Editor tab, find the admincount attribute. Select it and click the [Edit] button. Click on the [Clear] button (or set the value to 0 if you want the historical artifact). Click [Ok].
  
• Select the Security tab
  
• Click on the [Advanced] button. Click on the [Default] button. This will restore the removed permissions PLUS it will put a check mark next to the "Allow inheritable permissions…" box, which you want.
  
• Click on [Ok] until you close out that user's properties.
  

Unfortunately, as you see, in addition to clearing the admincount, you have to reset (turn on) inheritance for that object (group or user). Finally, you must give it back the permissions that object normally gets when it is first created. These permissions are not inherited, they are defined in the schema for that object and are granted to the object when it is created. If you use certificates, you're going to want these permissions and that's why the [Default] button is so handy. It restores all those things for you.

DSACLS can also be used to restore inheritance and reset an object back to its default "state" by using the /P:N /S switches.

There is obviously a lot more to be said about this, including administrative practices, best practices, and security whys & wherefores, but I'll be here all day if I don't stop somewhere.

There is a relevant KB article, "Delegated permissions are not available and inheritance is automatically disabled" KB817433, but I don't recommend doing the workaround. In fact, I generally don't like referencing that KB article because it includes that workaround and some knuckleheads always want to do the workaround instead of just tackling the problem and fixing it properly.

I recommend doing things the right way so you don't have to deactivate something that is there to help you and prevent you from doing something really egregiously stupid that could cost you the control of your domain or AD forest.

So…enough already.

Good night and sweet dreams.

Life in general

So this isn't my first blog this week, but you probably didn't realize that. I'm a charter member of Romance Writers of America (RWA) and after getting the June issue, I wrote a very different blog. Posted it and left it up for 24 hours and then deleted it, mostly because I'm trying to find ways to deal with frustration and not simply stroke out. I won't bore you with the details of my first post—I was simply upset because I may have trouble maintaining my published author status with RWA even though I actually have published, have an agent, and am working on publishing more titles.

However, the last few weeks have just been increasingly stressful and it makes me wonder why so many people are so determined to make life difficult. It's like they go out of their way to complicate simple issues instead of just doing the easy, straight-forward solution. It's wearing me down.

Like at my day job. I'm an enterprise admin in Information Technology (IT) for a very large organization—we have over 250,000 users and computers, if that gives you any idea. And a very small part of what I do is help roll out national projects. This is a very small part, mind you. Most of what I do is very unglamorous work with domain controllers, directory services, DNS, WINS, and other techno-geek, backroom stuff that no one has ever heard of and doesn't want to know about. In fact, I'm probably one of a handful of experts on a little know mechanism that exhibits itself via an attribute called the admincount on objects in Active Directory (AD) and prevents a Blackberry from working for users affected by this, as well as preventing them from publishing certificates to AD and so on. Like I said, no one wants to hear this stuff, least of all you. (However, I am actually going to publish two blogs tonight and the second one is going to be on the admincount attribute so if you're a techno-geek who is really into this stuff, you can look at that, later.)

But I am telling you this as a way of segueing into this topic of how humans seem to love making it difficult. So, I have this little side effort going on to do a simple deployment of a simple project. And I get it done all across the country until I get to the west coast of the U.S. These guys, in their brilliant arrogance had decided that the rest of us ignorant savages don't know what we're doing and so they can't possibly implement this the way the rest of the country has implemented it already. They have to reverse engineer it because they are convinced they know better. I mean, if they can't be involved in the development of every single project in our organization, then it's just up to these guys to break it apart and change it to suit their whims. It doesn't matter if changing the project may impact the security and expose information that should not be exposed or that another system was tested and granted FDA-approval as medical equipment and therefore should not be changed without changes being properly documented and tested since it might affect patient care and safety. Oh, no. These guys know better.

And so instead of a simple deployment, they refuse to do things the right way. The easy way. And even they have a change management system they insist everyone in their area follow, they are perfectly content to refuse to allow us to use our change management system and not change things without testing in the middle of a deployment. People might say, well, that's just your opinion. No. This is not my project. I had nothing to do with it. I was handed a finished project and told to deploy it and I'm following the directions. I would never assume that I knew better than the developer and that I could change the system mid-stream, particularly since I know that changing any medical system that is FDA-approved is at a minimum just bad judgment.

So that's my example of how people take a simple thing and make it difficult and stressful and why I'm probably going to stroke out.

Because not being content with a stressful day job in IT, I just had to start a writing career, too. And did I pick the easy road to publication? Did I write nice romances for a great company like Harlequin or write really hot romances that could be best sellers for a company like Avon? Heck no. I had to choose the hard road. I had to start out with writing a romantic comedy for the Harlequin Duets line which folded right after I submitted my manuscript (which they actually held for two years because they liked it—but not after Duets folded).

Then, did I learn my lesson? Heck no, again. I then wrote a traditional Regency. Got an agent. Kensington and Signet stopped publishing traditional Regencies. All right—two for two! And did I learn my lesson, yet? Heck no. What did I write next? I wrote a Regency-set mystery which pretty much no one publishes. Well, there are a few, but they are already pretty well stocked with all the Regency-set mysteries they want from their stable of writers and sort of don't need any more. Particularly not stories that are really kind of romantic mysteries set in the Regency period.

Did that stop me? No, of course not. I wrote four of them. But I also wrote a vampire story that has a romance in it, but it's not really hot, sensuality-wise, because I was actually interested in other issues in the story. So I sort of took a well-selling genre and wrote the story least likely to sell. I can hear my agent sighing…heavily and mournfully in the background.

Am I developing a trend here? Am I just making it difficult for myself? Yes, I guess so. I'd like to think I'm not being as arrogant as the guys from the west coast in my day job, but on the other hand, maybe all the other writers are looking at me and pointing their fingers, saying: if she just wasn't so arrogant and would just write commercial fiction in a well-selling genre, she might not have so many difficulties. She just won't follow the rules. Why is she trying to write Regency-set romantic mysteries, especially ones without long, explicit sex scenes and hot, lingering glances?

Except, I thought writers were supposed to write things they might actually enjoy reading. And I'm taking all kinds of writing classes and listening to all the experts like Jennifer Crusie and Bob Mayer (who are fabulous writers and very generous with their time and advice) and my goal is to be the best writer there is. Of Regency-set romantic mysteries. Which may simply be mutually exclusive, especially if I continue to write what the characters and story demand instead of shoving in a lot of long, explicit sex scenes and things like "he stroked the pearl at the very core of her being as she moaned with ecstasy".

(At this point, I'm sure Crusie and Mayer are thinking: hmmm, if she's really listening to us, she wouldn't be writing this junk and she'd maybe be a best selling author by now. Why is she making this so hard? Write a freaking sex scene, for heaven's sake, and get over it. Grow up if you want to be a successful author.)

Okay, I might even write a few contemporary, romantic mysteries which I will consider romantic even without explicit scenes and pearls of anyone's essences. Darn, I guess that's not really listening, is it?

Okay, I guess I am arrogant and making it hard on myself. I really don't know, but I do know if I don't learn to take a deep breath and put it all behind me, I probably will stroke out. Soon.

Presumption

Looking back over my past blogs, I start to wonder who the heck am I to give advice to other writers? It's not like I'm Jennifer Crusie who has an entire class she is presenting on how to write a novel. She's also an amazingly successful and completely obsessed writer. And if you're not subscribing to her class (going on now!) then shame on you—you ought to be. Check out http://www.crusiemayer.com/workshop/ and listen to them. They have a lot of good things to say, although I have to disagree with several frothing-at-the-mouth points that Jennifer makes which I think are just…well, completely wrong. She's an avid fan (rabid fan) of only using either action tags in dialog or a simple a phrase including: said. No whispers, sighs, moans, whatever. And yet. Hmmm. She's wrong.

You see, in point of fact, while I agree with the use (or rather the non-use) of phrases such as: he hissed, "You'll never get away with that!" And I *sort of* agree with Jennifer's claim that it requires there to be a lot of "s's" in the phrase someone is hissing because of the sibilance—in a way, I actually don't agree. I don't agree that hiss requires there to be "s's" in the words being hissed. I just don't care for that particular attribution. I agree with Jennifer that in most cases, you ought to just use a simple: said. It's cleaner and not so melodramatic.

But she is totally, utterly, completely, mind-blowingly wrong about sigh. It does NOT need any sibilance, and anyone who has EVER been a member of a family will COMPLETELY know the exact mood and how it sounds when a teenager turns to her mother and sighs, "Oh, Mom." That is a sigh. Nothing else fits that description. "Said" does not convey it at all. And I'm shocked that Jennifer doesn't realize this because I believe she has at least one child and has been, at some time in her life, a child, and must therefore have either sighed at or been the recipient of a sigh of this sort.

In fact, I'll bet that at one time, she or her mom, in her turn, looked at her husband/child who has once more doing something incredibly stupid and sighed, "Oh, Person's-Name." You know exactly what is going on and exactly what that sighing, breath-letting-out, phrase means. We've all either uttered it or been the recipient of it many, many times. That long suffering sigh. The sigh of a wounded martyr. That guilt-inspiring sigh that is pretty much saying: "Oh, somebody's-name-who has-just-caused-me-a-vast-ocean-of-disappointment-or-shame."

Sighs absolutely do not include nor imply any sibilance whatsoever, and in dialog, there is nothing like that exhaling sigh, that "what am I going to do with you?" sigh, that sigh that we've all heard and felt guilty over and ashamed at after hearing.

So really, even the great writers sometimes get it wrong or make up rules that actually don't work and may have no basis in reality. Which is why I pretty much ignore all rules that don't make sense to me. Maybe it's why I'm not a great NY Times selling author. Maybe I'm just a mediocre hack with a limited vocabulary that doesn't understand that sighs have to be sibilant. Since when? The dictionary does NOT define it that way. A sigh is exhaled air, period. It's not a hiss. (The sibilant part is just completely wrong, if not entirely nut-so and frankly to my ear means there is something wrong with your hearing, but anyway…)

And while I'm on the subject, you actually CAN laugh something, as in: "You old goat!" she laughed.

I have, many times, tried to talk or did talk while I was laughing and gasping for air.

Why is it that authors who make all these rules about dialog tags don't seem to have lived actual lives? Don't they ever laugh while they're trying to talk? Don't they ever turn to their spouse and sigh, "Oh, Whoever. Why? Why did you do that for the hundredth time?"

I could, on a certain level, accept that Jennifer's real reason is that she doesn't want the reader to pause even for a nanosecond while reading the dialog to "figure out" what the tag means. Okay. I can sort of accept that, but really…ummmm, no. I have a brain. I use it. I read. I have no problem with whispers, sighs, and laughs. In fact, it makes me hear the dialog more clearly and understand what is going on. It doesn't make me think the writer doesn't know his or her business. In fact, it makes the story richer.

In the end, I'm afraid if this means I will forever be a mediocre writer and end up (as Jennifer said) in Writer's Hell for crimes against the reading public, then so be it. If the mother in my story looks at her headstrong child and sighs, "Oh, Henry…" Then by God, I'm going to use the word: sigh. And if my character is laughing and trying to talk at the same time (like I do all the time) then by God they are going to say, "Oh, please, quit—you're killing me," she laughed, wiping the tears from her eyes.

Although I swear I won't ever use the word: hissed. Because quite frankly, it's just silly. I'm not writing melodramas.

Promoting your work

The concept of promoting yourself and your work is such a strange one. I've heard a lot of lectures that say women in particular have problems promoting themselves and their work but I'm not convinced it's a gender thing. I've seen just as many men who not only do not promote themselves but actually downplay their contributions. In many cases, this is a result of having high standards and the search for excellence. The guy I work with/for is absolutely brilliant and yet he insists he's a knucklehead and points out dozens of ways he could have done something better while the rest of us are just sitting there with our mouths hanging open, catching flies, and watching dumbfounded as he cuts to the core of extraordinarily complex information system problems and defines ways to resolve them that actually make sense and are doable.

If you set high standards for yourself and look at your work critically, you'll find the flaws and it will never be good enough—never quite perfect. And it is therefore correspondingly difficult to say how wonderful your work is when you see all too clearly the flaws in it. When you wish it was better. And so how can you promote it without feeling like a fool or worse, a foul liar? Well, I can tell you this, no matter what you do, you're going to feel like an idiot. There's no way around that one unless you're just stunningly full of yourself.

Nonetheless, in all fields of endeavor, you have to promote yourself. In my day job, every year I have to write up a blurb about how I'm the Queen of Perfection in the computer field for my performance appraisal. And now, I also have to try to think of ways to make people sit up, take notice of my books and buy them, despite all my absolute conviction that everything I do could definitely be done better.

I'm also sitting here, almost beside myself with anxiety about getting book reviews, particularly real reader reviews. Despite my promise to totally avoid looking at reviews for fear of being forced to face the reality that I'm just a hack whose search for excellence has led her into the outfield of mediocrity, part of me is curled up on my chair shaking with fear at stumbling over some review somewhere that confirms my worst fears. Because I don't want to be a hack. I don't want to be mediocre. I want to be Shakespeare (without a sex change operation or having to use that really weird, overblown language).

So, that's the sum of my fears. And now…promotion. I'm the best thing since Harry Potter, so read my books! How's that?

One of the biggest problems writers face is trying to promote their books. Oh, sure, some of the really lucky/talented/whatever ones actually get a marketing department behind them and get some creative marketing done, but for the rest of us, that ain't an option. And if you write e-books, your options dwindle even further.

Bad Side

Here's the bad side. Reality, if you will. No matter what you write, your task is to get your book in front of someone when they are ready to buy a book. For people with an actual physical hardcover/paperback, you have to convince buyers for bookstores to stock your books. For you, getting that book out there on the actual shelves is going to be crucial. And this isn't all about Amazon. Amazon, while doing amazing things, is actually not selling as many books as say, Wal-Mart and Target. So, it's the book buyers you have to convince.

For e-book writers, it's even harder because you're already pretty much limited to people drifting around the Internet (a smaller number than those drifting through the aisles of Wal-Mart and Target, believe me) and of those, the ones who are actually interested in books, and of THOSE, the ones who are willing to buy an e-book. This is a very small number—unless you are talking about erotica—which seems to go hand-in-hand with the Internet. So you don't have the casual book buyer seeing your cover in the Target check-out line and buying it on impulse.

And to further depress you, most of the advertising avenues, particularly for e-books, are really geared for writers selling to other writers. Rather incestuous, actually, but the ads are in writers magazines or trade magazines sold mostly to writers, and web sites that review romance and other novels that have an audience that is largely…other writers in the same genre(s). Of course, most writers are also voracious readers, so this is not all bad, but it is still like pissing in your own bathwater. It's not getting out there to other people.

And all those online chats, blogs, etc—again—who are you really reaching? A few readers and other fellow writers. I've been on a lot of online chats and the most readers I've seen online chatting is 20. Now I'd be happy to get 20 readers, but that's not going to make me a NY Times bestseller any time soon. I'd say those promotional efforts are a lot of work for very little gain. You spend hours "chatting" with, on average, 4 or 5 other people who may or may not buy your book and are really just Internet cruising hoping to find some free goodies.

Good Side

I'm actually having a bit of difficulty with the good side. Sorry. I'm afraid I'm really more "the glass is most likely half-empty unless I'm wrong about that" sort of person, but it is so easy for me to go on and on about the difficulties you face in promotional efforts.

But if you've got a marketing department behind you, you've got a good start. If not and you have a physical product, e.g. hardcover/paperback, then you'd best start chatting up those Wal-Mart and Target buyers. Chat up librarians. Librarians are your friend. Advertise in mags like Romance Sells which will get you in front of at least some librarians and book buyers.

For both e-book authors and traditional authors with a physical product, think about ways of reaching readers who are NOT just other writers. Sure, if you get the opportunity to advertise in industry rags like Romantic Times, Writer's Digest, The Strand (for mystery writers/readers) and other publications—definitely go for it. Create book trailers on YouTube and wherever else you can get them displayed. Set up a web page on MySpace or the latest web hotspots, and…

Think of avenues that the "normal" non-writing public would run across. Google Adwords, for example, which is what pops up those interesting little website suggestions along the right-hand side of your web browser whenever you Google something. Other web portals do the same thing.

Can you write an article about you as a writer and get it published in a non-writer magazine? For example, if you're seventy and just published your first novel, could you write up your experiences for AARP as a way of expanding your horizons after reaching retirement age? Or, if you wrote a fiction work about rock climbing, could you get an article about the research you did or your own experiences published in an outdoors magazine? It's not rocket science, but it is a bit of work. However, I firmly believe that taking advantage of those other sorts of avenues will pay off.

So that's what I mean—reaching out to audiences outside the normal network of writers. Break outside the somewhat insular community of writers and hard core readers to find new readers who may be interested in what you have to say. It's a bright new world out there with a bunch of people looking for entertainment. Entertain them.

Who knows, maybe you could actually get to be the next Shakespeare?

To every action there is an equal and opposite reaction

Newton's laws of motion may seem like an odd set of laws for developing plots in writing, but in fact, they not only work for physics, but they work for fiction, too. It's one of those odd ways in which seemingly unrelated fields actually provide some point of reference and clarity for each other. Perhaps serendipitous, perhaps an example of synchronicity, perhaps simple insanity. You decide.

So what are Newton's laws of motion?

The Law of Inertia: An object at rest will remain at rest unless acted upon by an external and unbalanced force; and an object in motion will remain in motion unless acted upon by an external and unbalanced force.

Story Opening. Some characters begin from what is essentially suspended animation, stasis, or the classic rut. Some external force, be it an inheritance, murder, or just catching the wrong train in the evening has to impel that character into a maelstrom of action.

Other characters may already appear to be in motion, but they are moving in the wrong direction or moving too quickly. In their case, an external force must act upon the character to push them in another direction, or stop/divert their path toward another direction. A U.S. Navy Seal on a critical mission is diverted by the crying of a child, propelling him and the mission into another direction.

Writers label this a number of things. The Inciting Incident or The Call to Action. Call it what you will, it is, in essence, the character overcoming the inertia of their everyday life and starting the story. I actually prefer to think of it this way because it reinforces, to my mind, the essential task you must complete for your story to begin. Your story must overcome the inertia of non-being and become an interesting work of fiction.

• Your character must overcome the inertia of their everyday life
  
• The writer must overcome the reader's initial inertia which translates into a lack of interest in anything the writer has to say. The writer has to hook the reader with the story, pique the reader's interest, and make the reader want to read more.
  
• And the story must overcome the inertia of the backstory, plot contrivances, and everything that must be done to get the story moving and get to the action.
  
• The writer wants to overcome this inertia as quickly as possible, to get the story and the characters moving and get the reader to turn the pages.
  

The Law of Acceleration: The rate of change of momentum of a body is proportional to the resultant force action on the body and is in the same direction.

Fiction is about change. Characters are tortured and put through fire until they come out on the other side, wiser and perhaps in the case of a romance, worthy and ready for love. So if your character and story are going to move forward, you need to think about the law of acceleration, i.e. the rate of change of momentum. Momentum of the story, often called pacing by writers, and the momentum of change for the character(s). The obstacles they face, while they cause problems for the character, are what will propel that character—and story—forward.

The character's obstacles, bad decisions, and stupid actions are the forces acting upon them that will accelerate both the story and the character forward to the conclusion. And you want your story to keep on accelerating if you want your reader to turn those pages.

But not just mindless acceleration. The forces must cause change. Endless fight scenes are boring. What is interesting is the character's reactions to those incidents and how they change the character, change the flow of the story, and cause things to move in another, and hopefully, unexpected direction. Ceaseless action can actually decelerate your story. Think about it.

That's why I like the force aspect in this law, because it reminds me that the character is not in complete control. There are forces acting upon the character which will cause that character to react, reevaluate his or her life, and ultimately change. This is the journey or character's arc.

The Law of Reciprocal Actions: To every action there is an equal and opposite reaction.

And finally, my favorite law. To every action there is an equal and opposite reaction. So many writers forget this and it is so critical and basic to any story. Every time something happens to your character from the very beginning incident, your character is going to make a decision and react. And every time your character acts, there is going to be an equal and opposite reaction, which is many cases is going to be exceedingly unpleasant for your character and get them into deeper poo-poo. This is, in essence, the way stories work.

Your character inherits an old house (an action affecting them and propelling them out of their inertia).

Your character makes a decision and acts upon it by moving to the old house (decision/reaction: their reaction to the initial action) despite the fact that the house has a bad reputation.

Your character is confronted by ghosts/horror/mayhem (action).

Every action your character takes results in an equally bad and unexpected reaction in the story events.

And so it goes:

Your character overcomes inertia as a result of an initial action, starting the story cycle.

Then action / decision / reaction --> which leads to another action / decision / reaction cycle because every action results in an equal and opposite reaction in the plot.

And each cycle escalates (remember acceleration) until the final breaking point, the climax, the black moment, the final conflict—whatever you want to call it, which the character finally does resolve so the story can conclude.

Perhaps this appeals to me because it defines what can be sort of literary "airy-fairy nonsense" in more active, dynamic terms that I can relate to like action/reaction, forces driving a character, and overcoming inertia. It seems to make more sense to me and I'm better able to evaluate if my beginning chapter is strong enough to frame the story and get the character and action going if I think of it in terms of overcoming the initial inertia. And if I remember the laws of acceleration and reciprocal action, it is easier for me to keep the story moving. Perhaps it's just synchronicity after all, or some weird kink in my mental wiring.

The problem for other writers is finding ways to think about writing and the process of building a story in terms that make sense to them and help them with their goal of creating a piece of fiction that is interesting, enlightening, and engaging. For some writers, this is an effortless process that does not require any thought. Others plot and plan, write and rewrite, until they get their work the way they want it. Every writer is unique, every process is unique and all that matters is finding ways to illuminate the dark well enough to get where you want to go.

Speaking of Writing Software…

It's true that I'm a computer geek so some of the new Microsoft programming environments are just dead sexy, and sure, only a small percentage of writers use a Microsoft operating system on their computer, much less have upgraded to VistA, or have any interest what-so-ever in anything to do with Microsoft technologies, but I get an RSS feed (another techie-geek thing) from this guy: Tim Sneath who has been talking about Windows Presentation Foundation (WPF), Silverlight, and some of the new web stuff and he mentioned this bunch of guys at Vertigo who created this supercool application that I found to be useful for writers. At the moment, it's free.

It's even useful for non-writers.

It's called Family.Show and it's a fantastic graphical genealogy program. I've been fumbling around with it and it is one of those serendipitous things that right at the moment when I was editing some of my manuscripts for submission (Yay! The Wild Rose Press asked for a partial!) I found exactly the program I needed for free. You see one thing I've been doing as a writer is creating a community of characters for my Regency novels. Many of the characters are related and what with one thing or another, I've been losing track of birth dates, physical traits, etc. I've used everything from MS Word documents to spreadsheets to a character database and it was just too difficult because I couldn't keep all the relationships straight. So I had been thinking of using a genealogy program to do it and voila! I get an RSS feed from Tim Sneath on exactly the same day when I realized I needed a genealogy program and guess what? The fabulous guys at Vertigo released this super-easy freebie program to show how WPF works (you can even download the source code—I mean how cool is that? — okay, I warned you that I'm a computer geek).

Here is what I really like about this, as opposed to all the other programs out there on the market. Besides the fact that it is free, of course.

You have little humanoid characters with lines and dates showing the relationships of the people (characters) you input, PLUS you can add pictures! PLUS you can add text (they call it "the person's story") where you can describe things like physical traits, etc. I've been adding at least the following:

• Eye color, hair color, distinguishing marks
• Personality type, dominate traits, bad habits, and general motivation: what makes this person do what they do
• Major issues
• Speech habits, pet phrases, etc.
  

This is just so cool because so many genealogical programs just don't have these free-form text areas and ways to include pictures. It is just so perfect for a writer developing their "stable of characters".

Here are pictures of what I have for Oriana Archer, the character in the manuscript just requested by The Wild Rose Press.

As you can see, I visualized Oriana sort of like the actress Gene Tierney with the really sexy overbite.

If you click on the [Photos & Stories] button, you can add all the information about that character you could ever possibly want (as I show in the next image).

You see—here's the thing. I've used a lot of other software, including writing software which lets you drone on about characters all you want. Some of it even lets you add pictures or whatever.

But what was always missing was the graphic representation of the relationships and that's where genealogy software comes in handy. I'm not saying you have to use this software—even if it is tres chic. What I am saying is that sometimes, when you're developing your characters, the family relationships are important and finding a way to track those relationships can be a challenge.

One note: I'm not sure how long this stuff will stay free, which is why in addition to saving all my characters genealogy in Family.Show "format", I'm also saving it in the standard GEDCOM format which is used by a lot of genealogy programs. That way, if it ever comes down to the wire and I have to buy a real program, I can hopefully import all of my information.

There is one other point I wanted to make about all of this. I really like creating an entire world in my manuscripts—which in my case is a world set during the Regency period in the early years of the 19^th century. But this is also done by Science Fiction writers, e.g. Frank Herbert's DUNE series, Andre Norton's Witch World books, and romance writers like Jennifer Crusie in some of her contemporary romances. Kristina Cook's Regency Historicals also have related characters.

The point is that readers seem to enjoy stepping into this world created by the author and peopled with characters who really do have relationships and family trees. It becomes a real world and readers respond to that. If they like the characters, they enjoy reading about the character's brothers and sisters, mothers and fathers, cousins, aunts and uncles. It makes it more interesting and gives the characters more depth, but it also means keeping better track of traits, especially personality traits, so that you don't take a feisty optimist and turn her into a shy pessimist in subsequent novels.

That's where it's really handy to have some way, be it index cards or some cool new program, to keep track.

Anyway, enough for tonight. Enjoy and may all your wishes come true!