John Howard, IT Pro Evangelist, Microsoft UK : Windows Server 2003

Windows Server 2003 (RSS)

Part 22: Infrastructure essentials Blogcast - RPC/HTTP for Outlook & Exchange - Bounce OWA through Localhost

Continuing the blogcast series on infrastructure essentials.

To make the next steps clearer, here's a picture of what we're trying to achieve in combining Forms Based Authentication with RPC/HTTP, and the routes through which traffic will flow. Hopefully a picture speaks a thousand words - the blogcast goes through configuring ISA to bounce OWA traffic through our Localhost listener. As you watch, you'll notice that no-one is infallible (and especially count myself in that list), but it was only a minor mistake :)

Click here to view.

Series Index:

0. Network configuration and series background.
1. Getting started
2. ISA Server configuration to allow basic web browsing capability
3. ISA Firewall Client basic configuration
4. ISA Firewall Client auto-detection through WPAD configuration
5. Configuring an Exchange mailbox and Outlook profile
6. Fixing 0x8004010F on Outlook send/receive
7. Installing our first Certificate Authority
8. Publishing OWA through ISA using Forms Based Authentication
9. OWA /exchange redirection
10. OWA nearly goes SSL - we have a certificate
11. OWA is available over SSL/HTTPS
12. Sending external email - Configuring outbound SMTP
13. Mail retrieval through POP3 polling
14. Preparations for Email retrieval through SMTP Transfer
15. Completing Email retrieval through SMTP Transfer
16. RPC/HTTP: Overview and installing RPC Proxy component
17. RPC/HTTP: IIS Config and a bit on certificates
18. RPC/HTTP: Exchange IIS Config completion
19. RPC/HTTP: Working from internal network
20. RPC/HTTP: Revisiting our ISA rules
21. RPC/HTTP: Outlook working externally. OWA still requires more work

posted Friday, November 11, 2005 11:29 AM by jhoward with 2 Comments

ADS to deploy Windows XP?

I have to admit, I'd never thought of this one. Yes, I've looked into using ADS (Automated Deployment Services) for deploying Windows Server 2003 and use it as part of the Virtual Server Migration Toolkit (VSMT) solution but never thought of using it to deploy Windows XP. Unsupported it may be, but Mark has some great info on how to go about solving some of the problems.

posted Wednesday, November 09, 2005 1:43 PM by jhoward with 1 Comments

Planning and Deploying the Branch Office Technologies

Just a quick reminder for another Windows Server 2003 R2 related webcast tomorrow (10th Nov) at 9.30AM Seattle Time, 5:30PM UK Time.

This session will cover the essential elements that are required for successful branch office planning and deployment. The session will help identify key requirements that will influence the design, highlight what the technology ought to be used for and key usage scenarios. We will also cover the essential process of building a proper test plan which is based on intended usage. Next the session will cover deployment, focusing on available tools and BP that will lead to successful production deployments.

To register and view, click here

posted Wednesday, November 09, 2005 1:12 PM by jhoward with 0 Comments

Part 21: Infrastructure essentials Blogcast - RPC/HTTP for Outlook & Exchange - Outlook OK, OWA needs some work

Continuing the blogcast series on infrastructure essentials.

With our new rule in place on the ISA Server, this sixth part of configuring TPC over HTTP for Outlook 2003 first takes a quick look at the effects on Outlook Web Access - we now get a basic authentication challenge instead of Forms Basic Authentication. However, we can still log on. We'll come back to that in a few parts time.

Our Outlook profile still has the internal name of our Exchange Server configured for the Exchange Proxy Server, so we alter that to point to the external name, mail.contoso.com. On restarting Outlook with the rpcdiag switch, we see that it connects using RPC over HTTPS through our ISA Server correctly from the Internet. Result!

We put our Outlook profile back to a more "normal" RPC/HTTPS configuration by connecting using TCP/IP on fast networks first, and HTTPS on slow networks first. We then take a look at what happens when we switch our client from internal to external to internal networks. Perfect!

Click here to view.

posted Monday, November 07, 2005 10:10 AM by jhoward with 0 Comments

Improved Generic Exchange Backup Script

So after numerous emails about this, and some comments on my previous blog post back in June, I spent a couple of hours this afternoon improving the backup script (which although was written as a generic Exchange backup script, is suitable for file system, system state and more - it just depends entirely what you set the selection criteria as). I've got it running now at home great, so it's worth sharing to the bigger audience now.

The biggest request I had was for email notification if an error occurs. Sending an email is simple (honestly). However, I didn't just want to send any old boring email, I wanted to utilise some of the more advanced features capable in Outlook, and show you how you can use the extended version of CDO for Exchange (CDOEx) rather than CDO. That having been said, to keep it generic and so that this script would run on any Windows Server, I ended up using CDO and SMTP rather than the more advanced capabilities of CDOEx. I've left the CDOEx code in there if you want to go that route, and I have tested it and it does work, so is a good example if you need it. The advanced features are so that the message flag is set to highlight some action is required. It is complicated due to timezone issues, but I think they're pretty well sust, so it should work all the way from Seattle to Sydney.

Here's an example of what I mean by "advanced" - notice that the email is red, and flagged with a follow-up action

Here's the revised script. I have a question though for someone really techy which I just can't find the answer to. I'll post a followup entry shortly. Cut/Paste and save as backup.vbs. Generate your Windows Backup selection file as before, and change the series of constants at the top of the file according to your needs - recipients for error emails, SMTP servers etc. Note that I haven't tested anything except anonymous SMTP drop.

' ************************************************************************************
' * Weekly Backup Script for Exchange
' * John Howard, Microsoft UK. Created 25th June 2005
' * History:
' * 04 Nov 2005 - Added Email Sending on Failure (see inline comments)
' *
' * Feel free to use/modify for your own needs.
' * No guarantees though although it works for me :-)
' * However, if you can do better, contact me through http://blogs.technet.com/jhoward
' ************************************************************************************

Option Explicit
On error resume next
Const NO_ERROR = 0
Const BACKUP_PROGRAM   = "c:\windows\system32\ntbackup.exe "
Const cdoImportance    = "urn:schemas:httpmail:importance"
Const cdoHigh          = 2 ' Importance
Const cdoAnonymous     = 0
Const cdoBasic         = 1
Const cdoNTLM          = 2
Dim   SMTP_AUTH

' TAILOR THESE NEXT CONSTANTS TO YOUR REQUIREMENTS
Const DEFAULT_SENDER = "Backup Job <servername@contoso.com>"
Const DEFAULT_RECIP = "user@contoso.com"
Const DEFAULT_SUBJECT = "Backup Failure on Exchange!"
Const SMTP_SERVER = "exchange.contoso.com"
Const SMTP_PORT = 25
 SMTP_AUTH = cdoAnonymous ' Choose one of the above
Const SMTP_TIMEOUT = 60 ' Seconds to wait for SMTP Server
Const MESSAGE_FLAG = "URGENT: Backup Job has failed"
Const BACKUP_SHARE = "\\RemoteServer\ExchangeBackups"
Const BACKUP_SELECTION = "Exchange Backup Selection.bks"

Dim szYYWW                    ' Date in YYYY-WW format (Week of year)
Dim szYYMMDD                  ' Date in YYYY-MM-DD format
Dim szFlagsSelection          ' The backup selection script, prepopulated
Dim szSetDescription          ' The description of the backup set
Dim szDestinationFile         ' The destination file in the destination directory
Dim szFlagsJobName            ' Flags for the name of the job [/j "jobname")
Dim szFlagsVerify             ' Flags for verify the backup    [yes|no]
Dim szFlagsRemoteStorage      ' Flags for remote storage       [/rs:no|yes]
Dim szFlagsHardwareCompress   ' Flags for hardware compression [/hc:off|on]
Dim szFlagsLogging            ' Flags for logging in ntbackup [/l:f|s|n] Full SUmmary None
Dim szFlagsAppend             ' Flags for appending data       [/a] or nothing
Dim szFlagsRestrict           ' Flags for restricting access   [/r:yes|no]
Dim szFlagsType               ' Flags for backup type          [/m normal|Incremental|Differential...]
Dim szFlagsTapeName           ' Flags for name of tape
Dim oFSO                      ' File System Object to see if file already exists
Dim owShell                   ' To execute a shell command
Dim rc                        ' Return code
Dim szError                   ' If we have an error, record it in here
Dim szCommandLine             ' What we are going to run as a backup
Dim szUTC                     ' UTC Date/Time for SMTP Reply-By field

Set oFSO        = Nothing
set owShell     = Nothing
rc              = NO_ERROR ' OK So far
szCommandLine   = ""        ' Not sure what we're running yet
szError         = ""        ' Not had an error yet

' Setup our variables
if (NO_ERROR = rc) Then
    szYYWW                   = year(now()) & " w" & formatNumber(DatePart("WW",now()))
    szYYMMDD                 = year(now()) & "-" & formatNumber(month(now())) & "-" & formatNumber(day(now()))
    szFlagsSelection         = chr(34) & "@" & BACKUP_SHARE & "\" & BACKUP_SELECTION & chr(34)
    szFlagsJobName           = "/j " & chr(34) & "Exchange Backup" & chr(34)
    szFlagsVerify            = "/v:yes"        ' Verify YES|NO
    szFlagsRemoteStorage     = "/rs:no"
    szFlagsHardwareCompress = "/hc:off"       ' Hardware compression off - this is to disk
    szFlagsLogging           = "/l:f"          ' f=full s=summary n=none
    szFlagsAppend            = "/a"            ' /a for Append or leave blank to overwrite
    szFlagsRestrict          = "/r:no"         ' no|yes Restrict access to administrators
    szFlagsTapeName          = "/t:Exchange " & szYYWW
    szDestinationFile        = "Exchange " & szYYWW & ".bkf"
    szSetDescription         = "/d " & chr(34) & "Created " & szYYMMDD & chr(34)
    szUTC                    = GetUTCSMTPDateString()
end if

' Instantiate File System Object
if (NO_ERROR = rc) Then
    err.clear
    Set oFSO = CreateObject("Scripting.FileSystemObject")
    if (err.number) or (oFSO is nothing) Then
        rc = -1
        szError = "Failed Creating FSO: " & err.description & " -0x" & hex(err.number)
    end if
end if

' Look to see if the file exists to determine the backup type
if (NO_ERROR = rc) Then
    if not oFSO.FileExists(BACKUP_SHARE & "\" & szDestinationFile) then
        ' Normal | Copy | Differential | Incremental Backup Type
        szFlagsType       = "/m normal "
        szFlagsAppend     = "" ' Don't Append if does not exist
    else
        ' File exists, so incremental backup. We are already in Append mode
        szFlagsType       = "/m incremental "
        szSetDescription = "/d " & chr(34) & "Inc " & szYYMMDD & chr(34)
    end if

' Release File SYstem Object
set oFSO = Nothing
end if

' Create a Shell Object to be able to run the backup executable
if (NO_ERROR = rc) Then
    err.clear
    Set owShell = wscript.createobject("wscript.shell")
    if (err.number) or (owShell is nothing) Then
        rc = -2
        szError = "Failed Creating wscript.shell: " & err.description & " -0x" & hex(err.number)
    end if
end if

' Build the backup command and run it
if (NO_ERROR = rc) Then
    szCommandLine = BACKUP_PROGRAM         & _
                     "backup"         & " " & _
                     szFlagsSelection      & " " & _
                     szSetDescription & " " & _
                     "/f " & chr(34) & BACKUP_SHARE & "\" & szDestinationFile & chr(34) & " " & _
                     szFlagsAppend           & " " & _
                     szFlagsLogging          & " " & _
                     szFlagsVerify           & " " & _
                     szFlagsRestrict         & " " & _
                     szFlagsRemoteStorage    & " " & _
                     szFlagsHardwareCompress & " " & _
                     szFlagsType             & " " & _
                     szFlagsJobName          & " "

rc=owshell.run(szCommandLine,,True)
end if

set owShell = Nothing
if (rc) Then SendErrorEmail
wscript.quit(rc)

Function FormatNumber(szIn)
FormatNumber = szIn
if len(szIn) = 1 then FormatNumber = "0" & szIn
End Function

'-----------------------------------------------------------------------------------
' Function Added: JJH 04 Nov 2005
'-----------------------------------------------------------------------------------
' For Sending an Email. We have the option to use send using exchange, but
' this can only be done on the Exchange server itself and requires CDOEx which
' is only installed on an Exchange Server. However CDO (CDOSys in old speak) is
' also installed on any Windows 2003 Server, and is a subset of CDOEx, we can
' use SMTP to send from any server pointing towards our Exchange Server.
' HOWEVER: It is nice to be able to get a reminder in Outlook to say that
' we need to do something rather than just an email. This requires an additional
' message header Reply-By which is in the Format (eg) Fri, 4 Nov 2005 15:23:08 -0000.
' Now, rather than mess around with timezones etc, I just use UTC. Seems to work,
' but it probably also helps that I'm in the UK so don't have to worry too much
' about timezones generally :-) However, appreciate many people may use this
' who are outside of UK, so best to make an effort!
'
' Note: We also fail safe to assume no time bias if we can't read registry
'-----------------------------------------------------------------------------------
Function GetUTCSMTPDateString()
    Dim dtUTC        ' UTC Date
    Dim szUTC          ' UTC Date string in SMTP RFC Format
    Dim oShell         ' To read registry
    Dim szATBRegKey    ' Registry key for Active Time Bias
    Dim lMinutesOffset ' From UTC
    Dim rc             ' Function return

    On error resume next
    rc = 0
    szATBRegKey = "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TimeZoneInformation\ActiveTimeBias"
    lMinutesOffset = 0
    err.clear

    if (NO_ERROR = rc) Then
        err.clear
        set oShell = CreateObject("WScript.Shell")
        if (err.number) or (oShell = Nothing) Then rc = -1
    end if

    if (NO_ERROR = rc) Then
        lMinutesOffset = oShell.RegRead(szATBRegKey)
        if (err.number) then
     rc = -1
            lMinutesOffset = 0
        end if
    end if

    ' Regardless of error, we do the formatting (default to zero offset)
    dtUTC = dateadd("n", lMinutesOffset, now())
    szUTC = WeekdayName(Weekday(dtUTC),True) & ", " & _
            Day(dtUTC) & " " & _
            MonthName(Month(dtUTC),True) & " " & _
            Year(dtUTC) & " " & _
            FormatNumber(Hour(dtUTC)) & ":" & _
            FormatNumber(Minute(dtUTC)) & ":" & _
            FormatNumber(Second(dtUTC)) & " " & _
            "-0000"

    set oShell = Nothing
    err.clear ' Don't pass any error back as we will have _something_
    GetUTCSMTPDateString = szUTC

End Function

'-----------------------------------------------------------------------------------
' Function Added: JJH 04 Nov 2005
'-----------------------------------------------------------------------------------
' There are several solutions to sending email. We _could_ use CDOEx, but we need
' to be running on an Exchange Server to do this. While you might say "But this is
' a generic Exchange backup program, so of course it's running on an Exchange Server",
' remember although I built it for Exchange backups, it's still pretty generic and
' can be used for file system backups or system state etc.
'
' CDOEx is not "remoteable" - it can only be instantiated on the Exchange Server
' itself. Hence, not very generic.
'
' BUT - CDOEx has advantages. You can use "SendUsingExchange" rather than SMTP
' which allows you to relatively easily set a reminder on the message itself.
' You would unfortunately also be limited to not just running on an Exchange
' Server, but who you are sending it _from_ must have their mailbox on that
' local server.
'
' Plan B: Use CDO which is present on all Windows Servers. However, to do this
' has its own problems if you also want the message to flag up if you're using
' a rich Outlook client to read the message.
'
' Plan B and a half is to incorporate elements of both solution (see inline comments,
' with some code commented out) but using SMTP.
'
' Note: I could have done this, but it just would have been _too_ easy :-)
'
'Dim oMsg
'set oMsg = CreateObject("CDO.Message")
'oMsg.To = "user@contoso.com"
'oMsg.From = "Exchange@contoso.com"
'oMsg.Subject = "Backup Status"
'oMsg.TextBody = "Whatever you want"
'oMsg.Send
'set oMsg = Nothing

'-----------------------------------------------------------------------------------
Function SendErrorEmail()

    Dim oMsg       ' Message we send if failure occurs
    Dim szFrom        ' String
    Dim szBaseFolder ' Base folder for the current users mailbox
    Dim rc

    szFrom = ""
    rc = NO_ERROR
    set oMsg = Nothing

' COMMENTED OUT - COULD USE IF WE KNOW THIS IS RUNNING ON AN EXCHANGE SERVER
' REASON BEING: CDO.Person and IMailbox Interface are only implemented in CDOEx, not CDO
' Following block is to generate a full from email address so that we
' use a better display name if we are sending the email externally from
' the Exchange organisation. Not strictly necessary, but nicer.
' Also, no error checking implemented
' Dim IMailbox ' Mailbox Interface to CDO.Person object
' Dim oADSInfo ' ActiveDS.ADSystemInfo
' Dim oPerson ' CDO.Person
' set oADSInfo = CreateObject("ADSystemInfo")
' set oPerson = CreateObject("CDO.Person")
' oPerson.DataSource.Open("LDAP://" & oADSInfo.DomainDNSName & "/" & oADSInfo.UserName)
' szFrom = oPerson.FileAs ' May be blank if no description in AD
' if 0 = len(szFrom) then szFrom = "Exchange Backup Script"
' szFrom = szFrom & " <" & oPerson.Email & ">"

    ' Need to have a default sender
    if (NO_ERROR = rc) Then
        if 0 = len(szFrom) Then szFrom = DEFAULT_SENDER
    end if

' COMMENTED OUT - AGAIN CDOEX SPECIFIC. Assuming we use code block commented
' above, we need to make sure that the users mailbox we are sending FROM (which
' is the currently logged on user) is homed on the current Exchange Server.
' The base folder will be something like file://./backofficestorage/<domain>/MBX/<User>/
' set IMailbox = oPerson.GetInterface("IMailbox")
' szBaseFolder = IMailbox.BaseFolder
' if (0=len(szBaseFolder)) Then <TRAP ERROR HERE>

    ' Create a message object. Not a lot we can do if we can't - could put further
    ' checking maybe to write to event log. Exercise for the reader though.
    if (NO_ERROR = rc) Then
        err.clear
        set oMsg = CreateObject("CDO.Message")
        if (err.number) or (oMsg is nothing) Then rc = -1
    end if

' Configure the outbound email
if (NO_ERROR = rc) Then

With oMsg.Configuration
'.Fields(cdoSaveSentItems) = False

            ' CDOEX Specific next line
            '.Fields("http://schemas.microsoft.com/cdo/configuration/sendusing") = cdoSendUsingExchange

            ' SMTP Specific lines instead of above commented out line
            .Fields("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2 ' SMTP By Port
            .Fields("http://schemas.microsoft.com/cdo/configuration/smtpserver") = SMTP_SERVER
            .Fields("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = SMTP_PORT
            .Fields("http://schemas.microsoft.com/cdo/configuration/smtpauthenticate") = SMTP_AUTH
            .Fields("http://schemas.microsoft.com/cdo/configuration/smtpconnectiontimeout") = SMTP_TIMEOUT
            ' If using BASIC, need to set cdo/configuration/sendusername and sendpassword accordingly

            ' Update fields from the configuration
            .Fields.Update
        end With

        oMsg.To = DEFAULT_RECIP
        oMsg.From = szFrom
        oMsg.Subject = DEFAULT_SUBJECT

        oMsg.TextBody = "Backup Job has failed" & vbcrlf
        oMsg.TextBody = oMsg.TextBody & "Error: " & szError & vbcrlf & vbcrlf
        oMsg.TextBody = oMsg.TextBody & "Backup Job: " & szCommandLine

        ' CDOEX/SendUsingExchange Specific to set the message flag
        'oMsg.Fields("http://schemas.microsoft.com/mapi/proptag/0x10900003")=2
        'oMsg.Fields("urn:schemas:httpmail:messageflag")= MESSAGE_FLAG

        ' SMTP Way of doing this
        oMsg.Fields("urn:schemas:mailheader:Reply-By") = szUTC
        oMsg.Fields("urn:schemas:mailheader:X-Message-Flag") = MESSAGE_FLAG

       oMsg.Fields(cdoImportance) = cdoHigh
       oMsg.Fields.Update
       oMsg.Send
    end if

set oMsg = Nothing

    ' If using CDOEx
    'set oPerson = Nothing
    'set oADSInfo = Nothing

End Function

Someone smart may wonder what's oMsg.Fields("http://schemas.microsoft.com/mapi/proptag/0x10900003")=2 about. If you want to know, and how I went about finding out, it's a long story. Post a comment and I'll put up the details when I get a spare day (it's that long). <GRIPE>Previous to working at Microsoft, obtaining info like this was my day job - I had plenty of support cases lined up at MS and got pretty up tight about some of the decisions made by the Exchange Dev team, and specifically those working on the SDK tools. Seems like even since my gripes a few years ago, the same lack of documentation (or deliberate hiding of this info more specifically is still there)</GRIPE>

posted Friday, November 04, 2005 6:36 PM by jhoward with 2 Comments

Download details for robocopy.exe (Robust File Copy)

I've been asked this so many times, hence oo save me keep looking up the link each time, I've book-marked it here - it's part of the Windows Server 2003 Resource Kit Tools which are freely downloable (around 12MB). There's loads of useful utilities in there, but remember these are 32-bit and not supported under 64-bit operating systems.

posted Friday, November 04, 2005 11:53 AM by jhoward with 0 Comments

Part 20: Infrastructure essentials Blogcast - RPC/HTTP for Outlook & Exchange - Start External Config

Continuing the blogcast series on infrastructure essentials.

This fifth part of configuring RPC over HTTP for Outlook 2003 changes direction in getting RPC/HTTPS available from the Internet now that it is working internally. We backtrack on our ISA Server configuration as we can't (easily) have forms based authentication and basic authentication listening externally on port 443. Hence, we delete our old rules for publishing Outlook Web Access and new rules for our first stage in getting RPC/HTTPS available from the internet.

Click here to view.

posted Thursday, November 03, 2005 10:44 AM by jhoward with 0 Comments

Online Labs

Just got news in my inbox that all the US Virtual Labs for both Technet and MSDN are running on Virtual Server 2005 R2 which I thought was kind of cool.

If you haven't had a chance to play with the online labs - you should. There's lots of labs which get regularly refreshed, and more importantly take the stress out of having to build your own virtual environment to learn more about the technology. For example, on the TechNet virtual labs, most technologies are covered including ISA, SQL Server, MBSA, WSUS, Active Directory, SMS, Live Communication Server, RMS... and the list just keeps going. For developers, worth checking the MSDN virtual lab site too.

posted Thursday, November 03, 2005 9:13 AM by jhoward with 4 Comments

Part 19: Infrastructure essentials Blogcast - RPC/HTTP for Outlook & Exchange - Completing internal config

Continuing the blogcast series on infrastructure essentials.

This fourth part of configuring RPC over HTTP for Outlook 2003 moves us on to ensuring that RPC/HTTP works internally from our Outlook 2003 client to our Exchange 2003 Server. First though, we correct a typo in the registry settings from the previous blogcast part (sorry!). One thing that is critical is to correctly configure our Outlook Profile for RPC/HTTP connectivity. We walk through the settings and change them, take a look at the "/rpcdiag" switch when starting outlook and end up with Outlook talking to our Exchange server through HTTPS internally.

Next week, we'll start tackling the ISA Server configuration to get RPC/HTTPS available from the Internet.

Click here to view.

posted Friday, October 28, 2005 1:07 PM by jhoward with 0 Comments

Part 18: Infrastructure essentials Blogcast - RPC/HTTP for Outlook & Exchange - Initial Setup

Continuing the blogcast series on infrastructure essentials.

The third part of configuring RPC over HTTP for Outlook 2003 configures the registry on Exchange 2003 and ensures that IIS is correctly configured on our Exchange server. This is a critical step in ensuring that internal problems are non-existant before continuing on to external publication.

Click here to view.

posted Tuesday, October 25, 2005 9:09 PM by jhoward with 0 Comments

Securely Publishing Exchange 2003 using ISA Server 2004 - "Zero to Hero"

Thanks for everyone who attended todays security event in London. I hope you got a lot out of the demonstration I ran through today, plus of course the other sessions. It was certainly the scariest and possibly "riskiest" session I've ever considered - taking on 90 mins+ of unrehursed demo could have gone very very wrong, but fortunately it all worked out perfectly. I totally underestimated the time it would take - if you had the patience, I could have gone on another hour and more besides, so sorry about that! At least no-one was snoring at the end :-)

Anyway, several people asked me for the slide deck (albeit very short and sweet), so here it is (it won't be going on the event site for download). Not the best deck in the world (sorry), but considering half of it was written during the train journey this morning having been awake since just after 3AM (Steve originally said no slides, just real live uncut stuff, but I had to bottle out of that one especially considering the subject material), I hope it helps.

Cheers,
John.

posted Monday, October 24, 2005 8:35 PM by jhoward with 0 Comments

Branch Office Technologies in R2

We IT Forum preparations almost complete and the Windows Server 2003 R2 launch fairly soon, now would be a good time to get up to speed on R2 technologies. There's a series of online chats over the next few months - I'll hold off for the moment for those in december and beyond, but there's a chat on Branch Office R2 Technologies next week. The abstract a link are below.

This chat will focus on the introduction of the new DFS Replication engine. We will discuss the feature set that enables it to efficiently replicate large quantities of data over the WAN. We will discuss mechanisms designed to optimize replication in challenging environments.

Join here. 27th October 10AM PDT (6PM UK Time).

posted Friday, October 21, 2005 8:12 PM by jhoward with 0 Comments

Part 17: Infrastructure essentials Blogcast - RPC/HTTP for Outlook & Exchange - Initial Setup

Continuing the blogcast series on infrastructure essentials.

The second part of configuring RPC over HTTP for Outlook 2003 connectivity to Exchange 2003 is covered in this blogcast. Now that we have the proxy component installed on the Exchange Server, we have some further configuration to perform. First, we take a look at and amend the IIS configuration on the Exchange Server for the newly create rpc virtual directory. Currently our Exchange Server does not have a web server certificate for SSL encryption, so we request that and apply it to our IIS server on the Exchange Server.

Click here to view.

posted Thursday, October 20, 2005 7:36 PM by jhoward with 0 Comments

Part 16: Infrastructure essentials Blogcast - RPC/HTTP for Outlook & Exchange - Initial Setup

Continuing the blogcast series on infrastructure essentials.

By popular demand (so you can all stop emailing me now please!), we're going to tackle the subject of RPC over HTTP in the next 10 or 11 parts. First, I feel it important to set the scene to paint a clearer picture of what we are trying to achieve, and some of the security considerations we need to be sure of.

RPC/HTTP (or HTTPS as you will also see it called, given security is a good thing) is used by Outlook 2003 to communicate back to Exchange 2003 through a firewall such as ISA Server. Which, co-incidentally happens to match the exact configuration we have in our environment. RPCs (Remote Procedure Calls) typically using a broad range of ports, and opening those through a firewall isn't the safest option to you. RPC over HTTP provides a means to encapsulate RPC traffic into HTTPS packets using port 443 which is frequently available and open through firewalls.

While tunnelling through port 443 is good, please open your eyes to a few things here. Your firewall must as a minimum do two things. Firstly, rather than blindly pass the encapsulated RPC traffic straight through, it must to be able to inspect the traffic to provide you with a secure and solid layer of protection. To do this, we have a problem which is where the second requirement of your firewall comes in. HTTPS traffic is encrypted using SSL, and only the recipient web-server should hold the private key to decrypt the traffic. If the recipient web server was not your firewall, the firewall would not be able to inspect any traffic. Hence, the second requirement is the ability to provide SSL termination. This is where inbound traffic encrypted from the Internet is de-crypted at the firewall for inspection prior to entry into your LAN. After inspection, traffic passed to your corporate network can optionally be re-encrypted for an additional layer of security.

We also have another problem. Without going into the fundamentals of TCP/IP programming (although I could wax lyrical for many hours if you are interested - part of my background was to write a TCP/IP stack, so I feel I know a fair bit there), on a single IP address (generally) only a single process can be bound and listening on a particular TCP port. The port in question I'm referring to is 443, that used by SSL. If you've been following the series, you know that within our infrastructure, port 443 is listening on the ISA server using the OWA Forms-Based-Authentication web listener. RPC/HTTP(S) requires us to be listening with basic or integrated authentication. ISA does not support combining FBA with Basic or Integrated auth. We could say to users, sorry you can't have OWA - it's Outlook thick client only. However, that won't go down well. But then, what about if we wanted to host our Internet site internally and have a section of it also available on port 443. Or an Extranet sharepoint server? No, we need to think again. Fortunately, there is a way to resolve this without having a more expensive luxury of multiple external IP addresses as will be seen throughout the series.

So, hopefully you now have a feel for where we are headed over the next few weeks. The first part here walks through the network diagram and sets up the essential RPC/HTTP proxy component built into Windows Server needed for this solution to work. For the first few parts, we will concentrate on getting Outlook 2003 to communicate with Exchange 2003 internally using RPC/HTTP. This is an essential first step as you don't complicate matters by introducing the firewall straight away, and it validates that the configuration is sound. After all, if it doesn't work internally, you'll be scratching your head for hours when you throw the firewall into the mix.

For those itching to get ahead of the game, here's a KB article partly covering this type of configuration with a single Exchange server in your organisation. For more deployment scenarios, particularly if you have multiple Exchange Servers including both front-end (FE) and back-end (BE), take a look at the Technet articles here.

Click here to view.

posted Tuesday, October 18, 2005 10:58 AM by jhoward with 0 Comments

Netware to Windows Server migration

So, apart from being a great showcase for using Microsoft Virtual Server 2005 to run online labs, this provides a great opportunity to learn about how to migrate from Novell to Windows in this brand new online lab. To sign up and for more information, click here.

posted Monday, October 17, 2005 8:43 PM by jhoward with 0 Comments

Part 15: Infrastructure essentials Blogcast - Completing email receiving through SMTP transfer

Continuing the blogcast series on infrastructure essentials.

In this blogcast, we complete email retrieval configuration through SMTP transfer. Having seen the ISA logs and network analysis, we configure and apply an appropriate ISA firewall policy, and send an email from the Internet into our organisation. During this blogcast, we also look closer at the underlying TCP traffic and SMTP commands during a typical SMTP transfer - if you're wondering why the Exchange Server Teams blog is called "You Had Me at EHLO", all will be revealed.

Click here to view.

The next 10 parts work through the relatively complex task of configuring RPC/HTTPS so that Outlook clients can connect from the Internet side as transparently as if they were in the office. Remember, please drop me an email through the "Contact" option or leave a comment if there's something you specifically would like to see in this series.

posted Thursday, October 13, 2005 7:56 AM by jhoward with 0 Comments

Windows Server 2003 R2 End-To-End Overview

If you missed yesterdays webcast exploring the three key areas of the upcoming Microsoft Windows Server 2003 R2: Branch Office, Storage Management and Active Directory Federation Services, it is available "on demand" to listen at your leisure. If you're new to Windows Server 2003 R2, this provides an excellent overview. It covers how Windows Server 2003 R2 extends Windows Server 2003, providing the most efficient way to manage and control access to local and remote resources while easily integrating into your existing Windows Server 2003 environment and how it enables new scenarios including simplified branch server management, efficient storage management and streamlined collaboration with partners. Windows Server 2003 R2 builds upon the increased security, reliability and performance that came with Microsoft Windows Server 2003 Service Pack 1.

Click here to register and view

posted Wednesday, October 12, 2005 1:02 PM by jhoward with 0 Comments

Part 14: Infrastructure essentials Blogcast - Preparing to receive mail through SMTP transfer

Continuing the blogcast series on infrastructure essentials.

This next blogcast raises the bar in terms of email retrieval. In the previous part, we were using POP3 email retrieval, similar to many home users retrieve email from an ISP hosted mailbox. This solution isn't necessarily ideal for business users, firstly it is relatively "high maintenance" in that you need to perform user mapping between ISP mailboxes and domain users, and secondly, there will be an inherent delay as your server is periodically polling for new email, rather than reactively being told that email is ready to be received.

In this blogcast and the next, we look at using SMTP transfer. This involves creating an MX (Mail Exchanger) DNS record on our ISP to tell the worlds email servers where they should connect to when they have an email for our organisation. We attempt to send an email internally, and use a network analyser and ISA monitoring to determine why we receive an NDR (Non Delivery Report) back to the sender. This will be fixed tomorrow :-)

Click here to view.

posted Wednesday, October 12, 2005 11:59 AM by jhoward with 0 Comments

Part 13: Infrastructure essentials Blogcast - Receive external email through POP3 polling

Continuing the blogcast series on infrastructure essentials.

Unlucky 13 for some - it certainly was for me, I had to record it three times and still had problems along the way! Oh, the joys of real world "live" computing! Anyway, now that we can send email externally from our Active Directory/Exchange based infrastructure using SMTP, the next steps are to be able to receive email from the Internet. There are a couple of ways open to us to configure this, and the solution generally depends on what services are available to us from our ISP, and whether we might have a static IP address externally. The first solution proposed in this blogcast is akin to a home user who uses an ISP to host their email inbox, and an email client to poll the ISPs server using POP3 (Post Office Protocol).

If you were using Small Business Server 2003, a POP3 solution exists "in-the-box", however, we are using Exchange 2003 directly, and we have to use a utility to perform POP3 polling. There are many utilities out there for this, varying in price, number of mailboxes supported and functionality. Some will include spam checking and anti-virus, for example. However, I chose a very basic free utility to demonstrate what can be done. Along the way, we determine what reconfiguration needs to be done to our ISA server to allow POP3 traffic to traverse our firewall.

Click here to view.

posted Tuesday, October 11, 2005 8:29 AM by jhoward with 0 Comments

License changes for Windows Server - Virtualisation goes mainstream

BIG NEWS DAY FOR VIRTUALISATION TECHNOLOGY!

As was just announced at SoftSummit in Santa Clara, CA today, Microsoft is making some big changes to licensing in from Windows Server 2003 R2 which launches very soon. As was announced at the Microsoft Management Summit earlier this year, Microsoft is committed to making a "big bet" on virtualisation. Now that could mean a lot of different thing to different people, but certainly something as a headline which pleases me as it's without doubt my favourite technology. Let's see what that "big bet" really means as today started the wave of change.

Two announcements today affect the way in which Windows Server licensing changes, and for the first time in Microsoft history takes into account the industry trend of a the increasing significance of virtualisation technology.

The first announcement recognises that many companies have images of virtual machines sitting on their hard disk - maybe as a library for test and development purposes. Today, licensing rules means that you must have a license to install that operating system instance, regardless of whether it is turned on and running - in other words (and these are mine rather than official MS licensing speak, so please note the disclaimer on my blog), your license provides the right to install the operating system. Now this could be expensive if you have 10, 20, 100 or even 1000's of virtual images in your library. Each image would require a separate license. The change is that the license EULA will in the future be a "use right". For example, 100 virtual images, 3 running = 3 licenses required. The cost savings here could be huge, and removes a significant barrier to the use of virtual machine technology.

The second announcement is equally as significant, and applies to Windows Server 2003 R2 Enterprise Edition only (ie not Standard). Due to the power of server technology these days, and when looking to the near future when we start talking Intel VT or AMD Pacifica technology, people are going to increasingly be looking at consolidating their workloads onto virtual machines. Again, as for the first announcement, this too can be expensive and a barrier in terms of cost as you require a license for each virtual machine which is running, both host and guests. To address this, the EULA for WS2003 R2 EE (again, my words, not official legal speak) will include the right for your one license to be used to actively run up to five instances of that operating system on a single host machine. That being: One for the host operating system, plus a further four virtual machines for other workloads. The host operating system workload cannot however be used for any application services other than as a virtual machine host and management/monitoring. To put this another way, the effective workloads for the license in terms of application services being provided to your organisation is of the four virtual instances only.

This is just a summary, and part of what is termed "Self Managing Dynamic Systems". You will hear a lot more about this over the coming months, and is a major change to the way in which Virtualisation technology is going to be a key part of the future, so stay tuned!

posted Monday, October 10, 2005 9:00 PM by jhoward with 0 Comments

Part 12: Infrastructure essentials Blogcast - Configuring outbound SMTP

Continuing the blogcast series on infrastructure essentials.

Hot off the headphones, so to speak - literally just recorded. This blogcast goes through a typical scenario in a small/medium organisation where an ISP's SMTP server is used to send outbound email. If you've been watching the series so far,we can send emails to internal recipients, but not outbound to the Internet. However, we can access our corporate email using Outlook Web Access securely from the Internet.

In the demonstration environment, I have configured our "pretend" ISP box to host both an SMTP and POP3 service, and have setup a mailbox and Outlook Express profile to pick up emails on the Internet side. We configure a simple Exchange SMTP connector to forward outbound email for any external domain to our ISP, perform some diagnosis to determine what needs to be configured on our ISA server, do the configuration and prove that everything works.

Click here to view.

posted Friday, October 07, 2005 3:20 PM by jhoward with 0 Comments

WMI for Windows Management

I just noticed this video posted up on Channel 9 from a number of members of the Windows Management Instrumentation (WMI) team at Microsoft show you how to use WMI to manage Windows better. WMI isn't the easiest thing to get the hang of, so it's worth the 45 or so minutes to have a listen & watch. Hope you find it useful.

posted Thursday, October 06, 2005 9:18 AM by jhoward with 0 Comments

Silently Removing XP Games

I'm often sent questions by email about how to do x, how to do y, what does z do etc. This one was a common issue, so I felt it was worth sharing. During their installation, a particular company had included the standard XP games (minesweeper, solitaire and so on). It was a relatively small company - around 200 client machines, some laptop, some desktop. They simply wanted to remove them silently.

There are several methods which vary in completeness, such as considering a group policy software restriction policy to stop those games from running, but I particularly liked the solution here as the script also uses WMI to kill the game should it be running before performing an unattended installation. You can of course add to this script in many ways, or consider including it a group policy logon script (as you can't guarantee that the machines will be connected to the network if you were to use the tool such Hyena.)

posted Tuesday, October 04, 2005 8:48 AM by jhoward with 1 Comments

DFS Namespaces and DFS Replication in Windows Server 2003 R2

Here's a link to a great overview whitepaper describing the Distributed File System Solution in Windows Server 2003 R2. DFS-N and DFS-R when used together provide a relatively simple and fault tolerant mechanism to access file, and is WAN-friendly.

posted Tuesday, September 27, 2005 3:39 PM by jhoward with 0 Comments

Cheaper Windows Server solution for mid-sized businesses

Just noticed a promotional combination offer running in the UK for a Windows Server System Solution aimed at mid-sized businesses, combining a number of core technology components including Window Server 2003 Standard Edition, Exchange 2003 Standard Edition and MOM 2005 Workgroup Edition.

The good part about this offer is that it includes 50 new combination promotional CALs at approx 20% less that Open Licence programmes prices. :-)

For more info, take a look here.

posted Friday, September 23, 2005 7:44 AM by jhoward with 0 Comments

Scripting with Monad

Monad is definitely a hot topic to watch in the future. I've just discovered that Jeffrey Snovers two webcasts about Monad are available for on-demand viewing. If you want to find out more about the future of command line scripting, these are a good place to start.

TechNet Webcast: Next Generation Command Line Scripting using Monad (Part 1 of 2)
Presenters: Jeffrey Snover, Architect, and Jim Truher, Program Manager

What is the next generation Microsoft command-line shell automation and scripting technology (codenamed "Monad") and how does it fit into the realm of tools and languages? To find out, join us in this webcast, one of the top rated sessions from Tech·Ed 2005 in Orlando, Florida (MGT320), as we highlight how the architecture of the shell supports consistent, production-oriented commands. Learn about the power to navigate and manipulate multiple data stores, and see how the powerful command-line shell uses objects to simplify scripting.
http://msevents.microsoft.com/cui/WebCastEventDetails.aspx?EventID=1032277851&EventCategory=5&culture=en-US&CountryCode=US

TechNet Webcast: Next Generation Command Line Scripting using Monad (Part 2 of 2)
Presenters: Jeffrey Snover, Architect, and Jim Truher, Program Manager

Join us as we drill down into more details of the functionality of the next generation Microsoft command-line shell automation and scripting technology, codenamed "Monad". First we conclude the scripting examples from the first session, then move on to advanced scripting constructs. We look at writing secure scripts, using script blocks for maximal power and flexibility, leveraging the shell's dedicated streams for RESULTS, ERRORS, VERBOSE, DEBUG, and PROGRESS, and dealing with errors, exceptions, debugging and tracing.

http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032277852&Culture=en-US

Don't also forget the Channel9 interview which is also available for download to view at your leisure :-)
http://www.microsoft.com/downloads/details.aspx?FamilyID=6c1191af-892f-46d5-94b6-b97521d5a0cd&displaylang=en

posted Monday, September 19, 2005 12:25 PM by jhoward with 0 Comments

Part 11: Infrastructure essentials Blogcast - OWA is SSL :-)

Continuing the blogcast series on infrastructure essentials.

In this blogcast, we do a simple re-configuration to our ISA Server to start using the certificate already installed on that machine to allow encryption of traffic used by our external site, mail.contoso.com. After the reconfiguration, we show that it works for a domain joined machine, but discuss some of the options and problems which could arise is non-domain joined machines attempt to access our secured site. Click here to view.

posted Thursday, September 15, 2005 5:48 PM by jhoward with 1 Comments

ADFS in Windows Server 2003 R2

ADFS is "Active Directory Federation Services". ADFS is just one part of the R2 release coming at the end of this year. If you want to find out more, one place is IT Forum in Barcelona, November 15th to 17th, with a pre-conference day on 14th November. As well as plenty of breakouts covering all aspects of R2 during the main conference, if you choose to attend the pre-conf day, there is a full days material available dedicated entirely to R2. More information can be found online - click the banner below, and now that we're almost there on wrapping up the final content list, I'll be posting more information up very soon.

However, if you want a step-by-step guide to deploying ADFS using Windows Server 2003 R2 Beta 2 now, take a look at this whitepaper.

posted Wednesday, September 14, 2005 8:46 AM by jhoward with 1 Comments

Part 10: Infrastructure essentials Blogcast - OWA goes SSL (nearly)

Continuing the blogcast series on infrastructure essentials.

To re-configure our Outlook Web Access which is currently available on the Internet using http into https, we need a way of configuring the external interface of the ISA server to do "SSL Termination". By this, I mean that the SSL channel exists between the client out on the Internet, and the ISA server itself. Once at the ISA server, the secure channel is terminated. This means that the ISA server can do it's job much better as it is able to perform inspection on the traffic coming in, and block according to content rather than just by URL inspection. Of course, we could re-encrypt traffic to create a secure channel over our LAN, but for now, this is the starting point.

To allow the ISA server to do this SSL termination, it must hold the private key for the certificate being used for the encrypted traffic - only the private key is able to decrypt the incoming traffic. To do this, we use certificate services running on our domain controller and the web service of certificate services to request a certificate for the external site - mail.contoso.com from the ISA server. There is a trick you need to do though to allow this to work, as by default one of the system policy rules on the ISA server blocks traffic. Once the certificate is requested and installed correctly (remembering to install it in the local computer certificate store), we look at how to configure an MMC console to view that certificate and the path to the root certificate store. In the next part, we'll convert our ISA configuration to start using that certificate. Click here to view.

posted Monday, September 12, 2005 4:42 PM by jhoward with 1 Comments

Core Infrastructure at IT Forum in Barcelona this November

So it's been a hectic few weeks for me. I'm nearing the end of pulling together the line-up for the core infrastructure track, so here's a a taster of some of the breakout session content you're going to see (subject to change, just to cover myself!).

Of course, in addition to the content below, there's another 9 tracks chock full of other sessions, plus plenty of "chalk-and-talks", hands on labs, lightning-demos and panel discussions. I'll leave them for another day. For more details of the conference, click the banner above. Note that time is rapidly running out for the early bird discount though! If you are attending, please drop me a line. I'd love to meet as many of you as I can this November. I'll post up a more complete list in a couple of weeks time as we "Dot the i's and Cross the T's".

What the Windows Server 2003 R2 Distributed File System can do for Branch/Remote Office Scenarios
As organizations expand to include more users and servers—whether they are located in one site or in geographically distributed sites—administrators find it increasingly difficult to provide users with intuitive, fast access to the files they need. Administrators who manage remote or branch offices face additional challenges, such as limiting network traffic over slow WAN connections, ensuring the availability of files during WAN outages or server failures, and ensuring that branch servers are backed up correctly. To help administrators address these challenges, the Distributed File System solution in Windows Server 2003 “R2” provides two technologies, DFS Namespaces and DFS Replication, which, when used together, offer simplified, fault-tolerant access to files and WAN-friendly replication.

UNIX Interoperability in Windows Server 2003 R2
This session will discuss the exciting new capabilities appearing in R2 for enabling greater interoperability with UNIX systems. We'll cover support for NFS, changes to the standard Active Directory schema, and the new Subsystem for UNIX Applications, including improved access to Oracle databases and to Win32 APIs and DLLs in general.

Windows Server 2003 R2 Efficient Storage Management
Windows Server 2003 R2 will include new tools that simplify the tasks necessary to set up an efficient storage environment for the Windows platform. Learn about the new quota management tools and SAN management tools. These new tools, coupled with the new management capabilities of DFS and the integration of Windows storage features by Microsoft partners, have made file server deployments and also SANs simpler than ever to deploy on Windows for both iSCSI and Fibre Channel. This session describes and demonstrates the new features and programs that make SANs accessible to a new class of users outside the data center environments.

Storage: Disaster Recovery
Deploying storage disaster recovery solutions for Windows successfully can be complex and expensive depending on the solutions customers choose. Learn about the various levels of failure and the kinds of products available for each kind of recovery solution needed.

Windows Hypervisor and Virtualization Futures
This session provides a technical overview of the Windows hypervisor. The Windows hypervisor will provide the foundation for Microsoft's Windows virtualization solutions in the Longhorn Server timeframe. This session discusses the hypervisor and related I/O virtualization layers.

Windows Hang and Crash Dump Analysis (Mark Russinovich)
Learn to analyze Microsoft Windows crash dumps, diagnose the cause, pinpoint a solution, a resolve the problem. This session for all systems administrators explains how crashes occur and what happens when you reboot a crashed system, and then leads you step-by-step through the crash dump analysis process, introducing the latest tools from Microsoft and handy tricks for isolating the cause of a crash.

Advanced Windows Troubleshooting with Sysinternals Filemon and Regmon (Mark Russinovich)
Learn advanced techniques for applying the Filemon and Regmon freeware tools from Sysinternals.com to troubleshoot a range of Windows system and application issues (DLL conflicts, permission problems, registry problems, etc). These tools are used on a daily basis by Microsoft Product Support and have been used effectively to solve a wide variety of desktop and server issues, so being familiar with their operation and application will assist you in dealing with different problems on Windows. Real world examples will be given that show successful application of these tools to solve real problems.

Printing with Windows Server 2003 R2
Huge improvements have been made to printing and print management in Windows Server 2003 and Windows Server 2003 R2. This session goes end to end with a technical drill down covering tips, tricks and the latest features. Learn how to deal with 64-bit print drivers, cluster improvements and advice for handling printing in branch offices. The Print Management Console (PMC) is new to Windows Server 2003 R2, bringing about significant improvements by allowing you for the first time to manage multiple print servers from a single interface. Through demonstration, find out how to make the most effective use of the PMC by building filters and sending notifications when printers or servers are unavailable. You will also learn how to use the PMC to deploy printer connections to your users through Group Policy.

Terminal Services Drilldown
Discover the new Terminal Services feature in Windows Server 2003 SP1 and how they help you to deploy and maintain your Terminal Services environment. This session will cover the new SP1 features, provide an introduction to x64 and Terminal Services. This session will cover the top support issues seen by Microsoft Product Support and provide a detailed discussion of the symptoms and causes to help you prevent having these issues within your organization.

Active Directory Disaster Recovery Parts 1 & 2 (John Craddock)
No Pressure! Your Active Directory has just failed… Can you pinpoint where it has failed? Do you have a disaster recovery plan? Do you know where to start? Join us for these two sessions and learn how to recover from different failure scenarios including failures of, the database, domain controllers, global catalogs, FSMO roles and SYSVOL. You will learn how to successfully recover domains, forests and perform authoritative restores. We will not only show you how to do it, but also point out any associated caveats. The sessions are backed up with comprehensive demos.

Branch Office Active Directory Deployment
This session will look at the Architecture and Design considerations of implementing Active Directory in a branch or satellite office scenario. The learning is based on recent work Microsoft UK have carried out in the design and deployment of some of the largest branch office domain controller deployments in the world. Expect detailed information regarding the architecture, key decision factors and implications of the design. This session will also look in detail at the Windows Server 2003 Branch Office Deployment Guide, including design and planning considerations (for example DC placement, bridgehead server load and DNS), key components such as KCC redundant mode and other tools such as ADLB and Ultrasound. The session aims to walk you through a branch office deployment picking up the key pertinent points along the way.

Security Policy Management and the Security Configuration Wizard (Jesper Johansson)
In Windows Server 2003 Service Pack 1, Microsoft shipped its first new security policy tool in six years. The Security Configuration Wizard (SCW) can help you author, tailor and apply policy. As with any security policy tool it can also completely disable your network. To learn more about how to manage security policies and how to use the Security Configuration Wizard, come to this session where Jesper Johansson discusses the internals of the security configuration wizard and how to make use of it to author policies in your organization. We cover how to use SCW as well as other security policy tools and resources, such as the Security Configuration Editor, Group Policy, and the Security Guides. We also discuss the idea of role-based security policy and how you can best leverage it to protect your Windows network.

Windows Storage Server 2003 R2 Drilldown: Deciding between it and Windows Server 2003 R2
This session will look under the hood of Windows Storage Server 2003 R2 focusing on the new features like single instance storage, text based search, file server performance optimization. How do they work? How do you deploy and implement the product? What are the scenarios in which Windows Storage Server is deployed? We also explore unique storage features of Windows Storage Server 2003 R2 versus Windows Server 2003.

You've decided to migrate off of Novell, now what?
As Novell Netware customers investigate their upgrade and migration options, they see there is a lot of work that needs to be done to make that migration as smooth as possible.
This session will provide an overview of the various methods of migrating from NDS to Active Directory. We will discuss the concepts and issues involved in such a migration (translating security principles, coexistence and data migration) and the main problems that the customer may encounter. We will then demonstrate Services For Netware, Microsoft Directory Synchronisation Service and Quest NDS Migrator and differentiate between methods to identify where each product set fits in a migration project.

Virtual Server - Advanced Scripting & Other Secrets
Virtual Server provides a powerful selection of COM interfaces for manipulating all facets of a virtual machine. This can support everything from provisioning to day-to-day management operations. In this session we will showcase the COM API and demonstrate a range of scripting examples. We will also demonstrate how partner offerings are using the API to productize key provisioning and management functionality.

Understanding & working with the Virtual Server VHD disk format
Microsoft has standardized on the Virtual Hard Disk (VHD) file format for the running and management of virtual machines. This file format provides for a range of disk types, including dynamically expanding, linked, undo and differencing disks. In this session we will take a deep dive into the file format, and discuss best practices and partner offerings for disk image management and migration.

How MSIT Manages its AD Infrastructure
Ever wondered how Microsoft information technology (IT) manages and operates its Active Directory infrastructure? Do you think Microsoft employees are especially tolerant of downtime or performance issues? Microsoft has the oldest production Active Directory in the world (happily authenticating users since 1999). Come listen as Microsoft IT shares its best practices on everything from domain controller placement, performance monitoring and change management to disaster recovery, tools and 64-bit domain controllers.

posted Monday, September 12, 2005 7:45 AM by jhoward with 0 Comments

Part 9: Infrastructure essentials Blogcast - OWA /exchange path redirection

Continuing the blogcast series on infrastructure essentials.

Yesterday, we got Outlook Web Access available on the Internet (albeit still using http rather than https - later this week we'll solve that). Our users are currently accessing Outlook Web Access using the URL http://mail.contoso.com/exchange. Users being users (bless them), like to remember as little as possible and call the help-desk, office technicial guru or simply blame everything but themselves for not being able to remember to tack on "/exchange". Well, the good news is that there's a few tricks up our sleeve to make sure users only have to remember http://mail.contoso.com instead. In this blogcast, I look at a home-brewed way using a simple script to force the redirection. It does work, but I conclude due to the "supportability" issue, it is not ideal. Good news is though that I have since found an even better way of doing it, thanks to an article Tom Schinders excellent site, isaserver.org.

This is the script I used in this blogcast is:

<%@ language=VBScript %>
<%
response.redirect "/exchange"
%>

Click here to view.

posted Tuesday, September 06, 2005 8:11 AM by jhoward with 0 Comments

Part 8: Infrastructure essentials Blogcast - Publishing Outlook Web Access

Continuing the blogcast series on infrastructure essentials.

One step closer to making webmail available. In this blogcast, we publish our Outlook Web Access on the Internet, but initially using HTTP rather than HTTPS - the reason for this at this stage is that this gives us the potential to be able to monitor network traffic "in the clear" if there were a potential problem to diagnose. (But please note, if you are connected to the actual Internet, then I strongly recommend you don't do this - I'm in a lab environment here.) We take a look at some of the terms used by ISA such as Forms Based Authentication, and look at how you can use the "netstat" command to verify the ISA server is listening for inbound traffic from the Internet.

As a quick digression though, notice a common problem many people make when installing their first AD domain. My internal DNS namespace is contoso.com. However, I also want contoso.com services available externally - for example by making webmail available through https://mail.contoso.com. I took the namespace decision deliberately to emulate that very scenario many companies face. It's not the end of the world - we can easily overcome it and use what is called a "Split-Brain" DNS configuration. In this scenario, it simply means that we have two seperate DNS services authoritative for contoso.com, rather than a single authoritiative service. One service is for internal use, the other for external use (and is provided by our ISP in our case). If you are in the luxurious position of starting out and being able to decide on an internal namespace, I'd recommend you make life easier in the long run by choosing something like corp.contoso.com for the internal namespace instead. Click here to view.

posted Monday, September 05, 2005 7:50 PM by jhoward with 1 Comments

Part 7: Infrastructure essentials Blogcast - Our first certificate authority

Continuing the blogcast series on infrastructure essentials.

We're now moving towards making Outlook Web Access (OWA), Outlook via RPC/HTTP and ultimately VPN connectivity available from the Internet. To make access from the Internet secure, we need a means to be able to encrypt the traffic from the Internet into our network. For OWA, we use SSL, or Secure Sockets Layer to create an encrypted channel between the end users browser and our ISA server. SSL encryption requires us to use PKI (Public Key Infrastructure) certificates. Although we could purchase certificates from third parties at varying levels of expense, we can do it for free, as Windows Server 2003 has a built in Certificate Authority (CA) out of the box. Hence, in this part, we set up our first CA for our contoso.com domain. Early next week, we'll be configuring OWA for Internet Access. Click here to view.

posted Friday, September 02, 2005 2:29 PM by jhoward with 1 Comments

Part 5: Infrastructure essentials Blogcast - Exchange mailbox and Outlook Profile

Continuing the blogcast series on infrastructure essentials.

The next stage in our infrastructure is to extend our infrastructure by building in one of the most important infrastructure applications - email. Our configuration uses Exchange 2003, and the first task for email is to create a mailbox for that user in Exchange. We take a brief look at the RUS (Recipient Update Service) which determines our email addressing format. Once the mailbox is setup, we need to test it. We do this through creating a basic profile in Outlook 2003 to point to the users mailbox. Using that profile, we verify everything is working by sending an email to ourselves. Click here to view.

If you look closely, you'll notice that Outlook throws an error during send/receive 0x8004010F "The operation failed. An object could not be found", even though we did successfully send an email to ourselves. We'll solve that very simply in the next blogcast!

posted Wednesday, August 17, 2005 5:09 PM by jhoward with 2 Comments

Lateral thinking - ADSI LDAP Provider to add users to groups

I've been meaning to blog this for a couple of weeks now. I was approached by Gagik with a query about ADSI scripting. Fortunately, I've certainly done a fair bit with ADSI given my background. The problem Gagik was having was adding a user to a group. This in itself is pretty common thing to want to do. The original code I was sent was attempting to update the "memberOf" attribute of a user object to add a group. This in itself appears to be a very reasonable assumption of how to perform this. Unfortunately complicated by the fact that the memberOf property is multivalued and the lack of methods on IADSUser, but reasonable indeed:

Here's a sanitised version of the sample code I was sent:

Const ADS_PROPERTY_APPEND = 3
intAccValue = 512
Dim objUser
Set objUser = objContainer.GetObject("user", "CN=UserName")
objUser.PutEx ADS_PROPERTY_APPEND, "memberOf", _
Array("CN=MyGroup,OU=My_OU,DC=domain,DC=com")
objUser.SetInfo

This was failing with the error "The server is unwilling to process the request".

Under the covers, Active Directory uses a two-way linkage between users and groups. Hence, if you were to be able to update the memberOf attribute for a user in this way, the multi-valued member attribute of the group would also be updated with the DN of the user account. You can see this for yourself if you run up ADSIEdit.msc and play around in Active Directory Users and Computers.

Given Active Directory has this linkage, the solution to the problem is, as many such problems are solved, to turn it on its head. Rather than update the user object, update the group object. ADSI and AD between them are clever enough to ensure the consistency between the matching user/group attributes are kept intact. There is also one other significant advantage with this mechanism, as the IADSGroup object exposed by ADSI has an "Add" method for just this purpose. Some of the complications in the original code arise directly as the IADSUser object doesn't expose the attribute or provide a method directly.

This is the code I proposed (which works flawlessly) using the LDAP ADSI provider.

set objGroup = GetObject("LDAP://CN=MyGroup,ou=My_OU,DC=domain,DC=Com")
objGroup.Add("LDAP://CN=UserName,ou=MY_OU,DC=domain,DC=Com")

A lot easier. Gagik had been trying to get the old code to work for some time without success, so he was very happy! For more information, see this link on MSDN. Of course, don't forget dsmod group and the -addmbr parameter would also do the trick...

posted Monday, August 15, 2005 1:38 PM by jhoward with 1 Comments

Part 4: Infrastructure essentials Blogcast - ISA and WPAD configuration

Continuing the blogcast series on infrastructure essentials.

Where we left off, we were able to browse the Internet from clients connected to the intranet, but we had to manually configure the ISA Firewall Client application for the name of the ISA server to be used. In part four of this blogcast series, we configure DNS and DHCP on our internal network for a feature called WPAD, or Web Proxy Autodiscover Protocol. Once WPAD is configured, we change our Firewall Client application to automatic proxy discovery to verify our changes have been successful.

Our mini-infrastructure is started to look good. However, we haven't touched on email yet. In the next part, we'll configure an Exchange mailbox for our user, a matching Outlook profile and verify we can send and receive emails internally. Check back soon!

Series Index:

0. Network configuration and series background.
1. Getting started
2. ISA Server configuration to allow basic web browsing capability
3. ISA Firewall Client basic configuration

posted Thursday, August 11, 2005 8:41 AM by jhoward with 2 Comments

Security management column

Jeffrey R. Jones, the Director of the Microsoft Security Business Unit has recently completed the fourth and final part of his column on Security Management. It makes interesting reading and worth a spare 15 minutes for a scan through....

Part one discusses Windows, Linux and Security Notifications
Part two discusses when an issue affects multiple products
Part three discusses patching
Part four discusses security management.

</wear>

posted Tuesday, August 09, 2005 10:00 AM by jhoward with 0 Comments

How to upgrade from SUS to WSUS

Marc Shepard, a Program Manager for Microsoft in the US held a session at Tech·Ed Orlando this year about how to upgrade from SUS to Windows Server Update Services, the next version of SUS. I know this session was highly rated, and I've already listened to it from the conference website. If you don't have access to this, but want to know more about, Marc will be re-delivering this level 300 session as a webcast on 16th August between 11:30 and 13:00 Pacific Time. Unfortunately, this means it's a 19:30 UK time start, but worth it (IMHO). You'll get a chance to learn about the best practices and pitfalls to watch out for when you get round to upgrading your infrastructure, as well as ask your all important questions.

Registration is here.

posted Monday, August 08, 2005 2:23 PM by jhoward with 0 Comments

IT Forum 2005 - Barcelona

The Microsoft IT Forum 2005 web-site is now live to take registrations. The agenda is being formulated now and will be going live in the next few weeks. This is a major event for IT Professionals in Europe (or even further in many cases) with many high-profile speakers, plus an optional full day of in-depth pre-conference on Monday 14th November. Many more details to follow soon, but there will be (approx) 175 breakout sessions, 125 chalk and talk sessions, several panel discussions plus, of course, loads of hands on or instructor led labs. For now, here's the structure of the core tracks:

Microsoft Business Solutions
Messaging & Mobility
Data Management
Management & Operations
Connected Systems Infrastructure
Identity & Access Management
Office System
Windows Client
Security
Core Infrastructure

I'm the "track owner" for the Core Infrastructure track and am now putting together a great set of sessions for that track.

So now your part.... If you plan on attending and have a "must see" session under Core Infrastructure (eg Windows Server 2003, R2, Virtual Server, Longhorn Server, Storage etc), let me know pronto - most of the decisions will be made in the next 10 days! Click the banner to find out more information, including registration information and early-bird discounts. I look forward to seeing you there!

posted Friday, August 05, 2005 9:01 AM by jhoward with 4 Comments

Part 3: Infrastructure essentials Blogcast - ISA Firewall client

Continuing the blogcast series on infrastructure essentials.

Part three of this blogcast series looks at how to install the ISA Server firewall client and updating the configuration of our ISA Server to detect who is browsing for what, rather than leaving everything as anonymous. Although this all works by the end of this blogcast, we end up at the stage where the firewall client is not automatically detecting our ISA Server - we had to do some manual configuration. We'll solve that in the next part...

Series Index:

0. Network configuration and series background.
1. Getting started
2. ISA Server configuration to allow basic web browsing capability

posted Thursday, August 04, 2005 2:42 PM by jhoward with 7 Comments

MOM SP1 is available for download

So hot off the heals of getting MOM 2005 installed with SQL 2004 SP4 , I find out that SP1 for MOM is now available. Now they tell me... quoting from the SP1 homepage (link at bottom) "Broader OS and database support, including <snip> and SQL 2000 SP4, <snip>". Not that I'm complaining that I've got to upgrade again, but I wish I had of known earlier.... However, reading this quote carefully, it isn't clear whether it's referring to MOM itself running on an SP4 back end database, or a management pack which supports SQL 2000 SP4. Not being a database person (or especially a MOM person), I don't know for sure, but if you do know, please can you enlighten me!!!

From the release blurb I've seen (haven't installed it yet), SP1 includes security fixes, addes new operating system and database platform support, and broadens the support for localisation. It also includes a new feature called "License Usage Alerting" which simplifies adhering to license compliance. This new feature allows you to receive alerts when product usage exceeds a configured threshold of Operations Management Licenses. When you install the service pack, you tell it how many OMLs you are licensed for and the MOM server checks the number of managed systems against the entered number of licenses on a periodic basis.

Here's the download link. It's currently available for download in English, French, German and Japanese.

posted Wednesday, August 03, 2005 1:08 PM by jhoward with 2 Comments

Part 2: Infrastructure essentials Blogcast - ISA 2004 rules to allow web browsing

Continuing the blogcast series on infrastructure essentials.

Yesterday, we saw an overview of our network infrastructure and started diagnosing why Internet browsing from our corporate network was not working. In part 2 of this blogcast series on infrastructure essentials, we configure ISA 2004 to allow users to browse the Internet from work. We use ISA Servers built in monitoring capability to detect what is being blocked and to determine how to resolve it. However, we also notice on the ISA monitoring log that it is not picking up who is browsing - we want to have better control over this, so resolve that in the next part of this series....

Don't forget to have your say - drop me a comment if there's something specific you want to see. I'll try and fit it in....

Series Index:

0. Network configuration and series background.
1. Getting started

posted Wednesday, August 03, 2005 7:40 AM by jhoward with 5 Comments

Installing MOM 2005 with SQL 2000 SP4

I was attempting to install Microsoft Operations Manager 2005 on my laptop a week or so ago, and struggling to work out why the MOM installed kept saying that the pre-requisites for installing MOM weren't up to scratch. Specificially, it was complaining that SQL Server 2000 SP3 or later was not installed. I knew it was, in fact I had SP4 installed. Fortunately, the answer was already out on the Internet. You need to "tweak" the registry temporarily during the installation to make MOM think that SQL 2000 SP3 is installed, and then change it back again afterwards. Annoying.

Here's Russ Kaufmann's explanation of the steps you need to follow.

posted Tuesday, August 02, 2005 11:31 AM by jhoward with 4 Comments

Part 1: Infrastructure essentials Blogcast - Getting started

Part 1. Starting with the basics.... (it does get more complex, a lot more complex, I assure you). In this blogcast, you see an overview of the infrastructure and browse the "emulated" Internet using a client machine connected directly to the Internet. This client is move back to the corporate network and discover that Internet browsing no longer works. ISA Server monitoring is used to diagnose the cause, and find, at least in the first instance, that DNS queries to the Internet are failing. A new rule is created in ISA to allow these DNS queries to be made. Part 2 will solve Internet browsing....

Here's the network diagram as published in yesterday's post where you can also find out more about this blogcast series

If you're interested, here's the real quick and dirty ASP page I used for emulating microsoft.com

<%@ Language=VBScript %>
<HTML>
<BODY>

Demonstration INTERNET Web Site. 
(In reality, it exists on the Virtual Machine, "INET") 
<HR>
 


Welcome to Microsoft (www.microsoft.com)
<% response.write " The time is " & now() & " " %>
 

<%
response.write "You requested this page from " & request.servervariables("REMOTE_ADDR") & " "
if request.servervariables("REMOTE_ADDR") <> "72.16.8.252" then
response.write " You are directly connected to the INTERNET"
else
response.write " You are connected to the Corporate LAN"
end if
%>

</script>

</BODY>
</HTML>

posted Tuesday, August 02, 2005 7:36 AM by jhoward with 6 Comments

Blogcast Series: Infrastructure essentials

I've been busy over the past few days recording a series of blogcasts about setting up the essentials for a typical well-managed infrastructure. The network so far consists of six machines as shown in the diagram below.

The intention of these blogcasts are to walk through a number of steps to change a base installation of Active Directory, ISA Server and Exchange Server into what you would typically find in a small or medium sized enterprise. Of course, you'd find a similar infrastructure in larger enterprises too, so if you're an IT Professional in really any type of organisation, there should be something useful for you.

In the pipeline are:

- Allowing clients to browse the internet from the corporate network
- Configuring the ISA firewall client for automatic detection
- Setting up an Exchange mailbox for a user
- Setting up an Outlook profile to use the Exchange mailbox
- Publishing Outlook Web Access on the Internet (HTTP for now)
- Installing a Certificiate Authority
- Using the Certificate Authority to change OWA to use SSL Encryption
- Setting up a PPTP VPN
- Setting up an L2TP VPN
- Implementing quarantine
- Implementing some group policy
- Setting up mail exchange records to send and receive mail externally
....

It's probably no coincidence either that the configuration and ideas I have in mind also broadly match the types of configuration I've been using on my home network as a proving ground and test-bed production network. I find running a production network far more effective that using pre-canned demo's as the types of problem you see are real and can't be left to hang around untreated.

So, that's the plan so far - please pop a comment up if you want to see something specific in the series.

The first blogcast will be posted up tomorrow - keep an eye out :-)

posted Monday, August 01, 2005 2:18 PM by jhoward with 8 Comments

Data Protection Manager usage at Microsoft

More interesting stuff I just came across - a case study which details how Data Protection Manager has been deployed internally at Microsoft to perform backups for over 130 remote sites or "Branch Offices". I just love that term being applied to the UK campus here - with some 2000 people and four buildings, we're still just a "Branch Office"! I suppose compared to the size of the Seattle campus, that's probably true though.

One particular statistic which grabbed me was that in the US, there are 73 remote sites, where as in Europe, there are only 35, but there are only slightly fewer servers in Europe to be backed up. However, here's where we find Europeans to be more verbose than our US counterparts - with a quick calculation, you can (albeit I'm not taking into account the number of users) determine that there is 43.6% more data being backed up from the Europeans than the Americans. Another useless statistic. Time for me to shut up before that figure reaches 43.7% :-)

Here's the download link to "Improving Backup Service at Microsoft using Data Protection Manager"

posted Thursday, July 28, 2005 9:41 AM by jhoward with 0 Comments

TCP/IP Implementation in Windows Server 2003 and XP

Here's a really interesting document I stumbled across yesterday, especially having written part of a TCP/IP implementation in years gone by. It was originally published a couple of years ago, but an updated version was released earlier this month which now includes details of changes in Windows Server 2003 SP1. The whitepaper goes into details of the implementation of the TCP/IP stack for Windows Server 2003, which is, all but a few differences, the same as in Windows XP - where there are differences, they are highlighted in the document.

It goes into way more detail than most IT Pro's are ever likely to need, but I'm sure you'll find some value in it. Here's the download link.

posted Wednesday, July 27, 2005 3:29 PM by jhoward with 0 Comments

Group Policy Wiki

I must learn more about Wiki's - it's not something I've been inclined particularly to look at in any great depth, but they are a great way to collaborate and share information about just about anything. Having just found a Wiki on Group Policy, it had to be worth blogging. It can be found at http://grouppolicy.editme.com or alternatively through http://www.grouppolicywiki.com. There's loads of great information up there. Don't also forget www.gpanswers.com, another great resource.

posted Monday, July 25, 2005 1:09 PM by jhoward with 1 Comments

Longhorn renamed - it will be Windows Vista

Yes, you heard right. I found out a little while ago and there's been a few rumours flying over the Internet this morning. However, now it's 2PM in the UK, and 6AM Seattle time, the announcement is now live on the Microsoft presspass site here.

posted Friday, July 22, 2005 2:00 PM by jhoward with 7 Comments

Malicious Software Removal Tool

As much as a bookmark blog as anything else so I know where to find it. You may have seen the malicious software removal tool come down through WindowsUpdate/MicrosoftUpdate. What I didn't know was that a version with the latest updates is released on the second tuesday of every month, and can be run from a web-page here or downloaded and run more often.

The tool works for XP, 2000 and 2003. The KB describing the tool is 890830, also updated monthly, and if you are considering deploying the tool within your environment, you should read another KB article, 891716. This KB describes the mechanisms for deploying through WSUS, SMS and Group Policy. However, remember that this tool should be considered supplementary to another solution such as anti-virus. Lots of layers help though.

posted Thursday, July 21, 2005 8:50 AM by jhoward with 2 Comments

Popup follow-on from yesterday

Well, there is another difference between the msgbox function and popup method as was pointed out to me by several people. Msgbox only displays the first 1024 characters of a dialog whereas popup displays a lot more (I haven't looked to see what the actual limit is although I can certainly fill the screen and more besides). Taking yesterdays script and adding this immediately before the call to msgbox

szMessage = ""
for i = asc("a") to asc("z")
szMessage = szMessage & String(100,i)
next

Msgbox will display

but Popup will display

So now you know, but please, no more emails if there are other differences!

posted Wednesday, July 20, 2005 8:47 AM by jhoward with 0 Comments

How to automatically dismiss scripted dialogs boxes - alternative to msgbox function

I guess I've been doing a fair bit of scripting recently - admittedly nowhere near as much as I did back in my dev days, but there's always something you learn new. I don't even have a specific use for this, neither was I able to imagine a practical situation I could find for its' potential use it, but who knows who's reading this....?

Generally, in a VBScript I would have used the MsgBox function to display a dialog. Although I've also used the WScript.Shell object a fair few times, I've never had need to use the "Popup" method to also display a dialog when MsgBox was to hand without instantiating another object if you didn't need it.

However, purely by accident I was looking at the documentation for WScript.Shell and found that "Popup" can do one thing "MsgBox" can't - it can be dismissed automatically by a timer. Here's a quick code example which shows how it works. Cut and paste into "dialogs.vbs" and run it. Two identical dialogs will be displayed, it's just that the second one will dismiss after 2 seconds.

Dim szTitle        ' Title for dialog
Dim szMessage      ' Message to go in dialog
Dim iFeatures      ' What options on dialog
Dim iSeconds       ' How long to display for :-)
Dim oShell         ' For Popup Method

szTitle = "Sample Title"
szMessage = "Do you know you could do this?"
iFeatures = vbOKCancel or vbQuestion
iSeconds = 2
set oShell = CreateObject("Wscript.Shell")

msgbox szMessage, iFeatures, szTitle
oShell.Popup szMessage, iSeconds , szTitle, iFeatures

BTW - setting iSeconds to 0, or running "oShell.Popup szMessage,,szTitle,iFeatures" will produce identical functionality to msgbox. Even if you too can't see a use, it's one of those things to keep in your back-pocket for your next geeks outing under the banner of "Bet you didn't know how to...."

Here's the links to the full documentation for msgbox and popup.

posted Tuesday, July 19, 2005 4:23 PM by jhoward with 3 Comments

Debug logging and tracing with Automated Deployment Services (ADS)

I'm nearly bald this morning. Last Friday I had what was nearly a full head of hair. Long story, but it all revolves around a series of problems I've been trying to resolve with Automated Deployment Services. I've been trying to locate the information which I once had to hand, but have had big trouble finding again (it doesn't appear to be in the ADS Help, unless you know better). I'm attempting to add some drivers to the Network Boot Service (NBS) in ADS, but the drivers still weren't being loaded correctly. I see plenty of blog entries on their way about the issues I've found and resolved, but while I've now found the information, this seems a good time to record it...

At the bottom of KB 841550, how to turn on logging is described in all it's glory:

For additional information about the driver installation, turn on logging. If you turn on logging, a file is created in the following folder:
Drive:\Windows\Tracing\Adsbuildsvc.log
Note In this folder, Drive is a placeholder for the drive letter where Windows is installed.

To turn on logging, follow these steps:

1. Log on to your computer as an administrator.
2. Click Start, click Run, type regedit in the Open box, and then click OK.
3. Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AdsBuilderSvc
4. Right-click under the last value in the right pane, point to New, and then click DWORD Value.
5. Type EnableFileTracing, and then press ENTER.
6. Right-click EnableFileTracing, and then click Modify.
7. In the Value data box, type 1, and then click OK.
8. Close Registry Editor

posted Monday, July 18, 2005 9:58 AM by jhoward with 1 Comments

Small Business Server (SBS) 2003 R2

At the World Wide Partner Conference last week, there was an interesting announcement which didn't seem to get much by way of attention, but is especially relevant to many of you running Small Business Server.

The announcement was that Small Business Server 2003 R2 will be released approximately 60-90 days after the Windows Server 2003 R2 release (scheduled for Q4 this calendar year). My understanding so far is that SQL Server 2005 will be included in the premium edition, and the workgroup version included in other editions, although this is still being clarified. General changes are that many of the recently released patching and update management tools will be in the box, and good news also on the Exchange front in that mailbox limits will be up to 75 GB.

posted Friday, July 15, 2005 11:00 AM by jhoward with 0 Comments

64-bit Computing on Windows Server System

If you're now looking at 64-bit Computing on the Windows Server System, there's lots of information out there, if you know where to look.

For developers, there a slew of webcasts available including ones for migrating, optimising, compatibility, and insider tips to name but a few. There's also some webcasts there which are equally applicable to IT Pro's.

For IT Pro's specifically, you're probably wanting to know which applications support the Windows Server 2003 x64 Editions. The answer is here all the way from Allscripts to WRQ. I was hoping that Zondycyber MAPGIS Platform was a native 64-bit app to give me the full A-Z, but unfortunately, it's just an A-W for now :-)

posted Thursday, July 14, 2005 10:48 AM by jhoward with 0 Comments

Active Directory Remote Administration

There is a webcast on 22nd July at 17:30 (UK) about Active Directory Remote Administration - a topic I get many questions about. Hence, take this opportunity to ask your questions live. Here's the description of what's going to be talked about:

See the improvements in the Microsoft Windows Server 2003 Domain and Forest functional levels. Join us in examining the special considerations for the designing and planning for a branch office environment, and the use of command line and GUI tools for remote management and scripting. In this webcast we show how to deploy a domain controller to support a remote branch office connected over a Wide Area Network link. We present the options available for remote management using the Windows Management Instrumentation Command-Line tools. Finally we cover other available remote management tools that administer Active Directory.

Click here to register

posted Wednesday, July 13, 2005 10:41 AM by jhoward with 0 Comments

MBSA 2.0 (Microsoft Baseline Security Analyser) Released

After blogging about the beta of MBSA v2.0 a couple of months ago, I have to thank Steve for giving me the heads up on this as the official release notification must have slipped me by. My excuse is that I've been more than a little busy at TechEd last week, and still wading through a couple of thousand emails.

MBSA 2.0 is a huge improvement on MBSA 1.2.1 and a great way to ensure you have a consistent baseline of security across your infrastructure. If you're also using Windows Server Update Services (WSUS) as I am, you'll be pleased to know that the two play nicely together. I downloaded v2 a little earlier this afternoon, and now have it running perfectly without any problem.

For more information and the download link, here's the home page of MBSA on microsoft.com.

posted Monday, July 11, 2005 4:53 PM by jhoward with 0 Comments

Windows Server 2003 SP1 through Automatic Updates

Just a heads up on this one. If you are running Windows Server 2003 RTM currently and have your machines set for automatic updates, on 26th July, they will start receiving SP1 through automatic update (AU). If you haven't finished testing SP1 in your environment, remember the blocking tool I blogged about a couple of weeks ago.

posted Thursday, July 07, 2005 11:25 AM by jhoward with 0 Comments

Generic scripted weekly backup solution - your feedback results

Following last weeks post regarding the script I used to back up my home Exchange 2003 SP1 Server running under Virtual Server 2005 on a weekly full backup with daily differential backup, I've received upwards of 30 emails, all positive, thankfully!!! I'm overwhelmed, so a big thanks to everyone who responded and I'm glad you found the script useful. The good news is that other people have discovered (as I already had) that it is not just useful for backing up Exchange, but for just about any generic backup including data folders or even system state. That only requires a change to the backup selection file. With only a few lines change in the code, I've also had people say they are using it for a monthly schedule - if you're interested in seeing these modifications, let me know and I'll post them up - it's trivial, trust me!

Most interestingly for me, most people's comments were along the lines of asking why this sort of functionality isn't directly in ntbackup. Well, you'll find it in commercial backup solutions for sure, but they cost money which was absolutely against my requirements when there's perfectly good free software out of the box. My response has to be to use http://www.windowsserverfeedback.com. If there's enough demand and justifcation, the Longhorn Server team will recognise it and maybe it'll be there in 2007....

The one thing I will urge you to do, though, is remember to burn the backup files to DVD/CD/Tape and store them remotely. I use a combination of garage and a friends house just in case, but for an industrial strength solution, use appropriate storage facilities with firesafe and secured access etc.

posted Tuesday, July 05, 2005 10:00 AM by jhoward with 0 Comments

What does each Windows Service do?

Another frequently asked question by many customers. A good answer can be found in the "Threats and Countermeasures: Security Settings in Windows Server 2003 and Windows XP" document which can be downloaded here. A little out of date (being based on WS2003 RTM and XP SP1), but dead useful information none the less.It does however contain a lot of useful security advice as well though.

If that doesn't do it for you, you can also find similar information in the "Windows Server 2003 System Services Reference" here.

posted Friday, July 01, 2005 9:30 AM by jhoward with 0 Comments

Generic Exchange Backup Script (Backing up Exchange 2003 Part 2)

Update: 4th Nov - See updated and improved script here

As part of my backup for Exchange I was playing with at the weekend, I ended up writing a pretty simple script to run as a scheduled task. Although my Exchange environment is simple as well, the requirements and strategy I wanted were:

- Weekly full backup
- Differential daily backups (incrementals apparently don't work so well, according to my research)
- Robust and reliable (obviously)
- Free!!!

Optionally, I wanted it to notify me if the backup failed (through SMS or email), but I'll add that in another day - should be pretty simple.

The basic problem with just running NTBackup on its own is that it's impossible to get it to set the job names and output filename depending on the date. Hence, here's what I ended up with. A single simple VBScript that runs daily as a scheduled task as a delegated Exchange administrator. It has a bit of resilience in it for error checking, such as picking up whether the destination file already exists to determine whether to append or overwrite. It also gracefully handles object creation failure.

As for support - you're pretty much on your own. It works for me very nicely, and I've used the output files to test a restore using the fantastic new feature of Exchange 2003 in the Recovery Storage Group (RSG). If you want to find out more about that, have a look at Ewan's blogcast here.

' ************************************************************************************
' * Weekly Backup Script for Exchange
' * John Howard, Microsoft UK. Created 25th June 2005
' *
' * Feel free to use/modify for your own needs.
' * No guarantees though although it works for me :-)
' * However, if you can do better, contact me through http://blogs.technet.com/jhoward
' ************************************************************************************

Option Explicit
On error resume next
Const NO_ERROR = 0
Const BACKUP_SHARE = "\\RemoteServer\ExchangeBackups"
Const BACKUP_SELECTION = "Exchange Backup Selection.bks"
Const BACKUP_PROGRAM = "c:\windows\system32\ntbackup.exe "

Dim szYYWW                    ' Date in YYYY-WW format (Week of year)
Dim szYYMMDD                  ' Date in YYYY-MM-DD format
Dim szFlagsSelection          ' The backup selection script, prepopulated
Dim szSetDescription          ' The description of the backup set
Dim szDestinationFile         ' The destination file in the destination directory
Dim szFlagsJobName            ' Flags for the name of the job [/j "jobname")
Dim szFlagsVerify             ' Flags for verify the backup    [yes|no]
Dim szFlagsRemoteStorage      ' Flags for remote storage       [/rs:no|yes]
Dim szFlagsHardwareCompress   ' Flags for hardware compression [/hc:off|on]
Dim szFlagsLogging            ' Flags for logging in ntbackup [/l:f|s|n] Full SUmmary None
Dim szFlagsAppend             ' Flags for appending data       [/a] or nothing
Dim szFlagsRestrict           ' Flags for restricting access   [/r:yes|no]
Dim szFlagsType               ' Flags for backup type          [/m normal|Incremental|Differential...]
Dim oFSO                      ' File System Object to see if file already exists
Dim owShell                   ' To execute a shell command
Dim rc                        ' Return code
Dim szError                   ' If we have an error, record it in here
Dim szCommandLine             ' What we are going to run as a backup

Set oFSO        = Nothing
set owShell     = Nothing
rc              = NO_ERROR ' OK So far
szszCommandLine = ""        ' Not sure what we're running yet
szError         = ""        ' Not had an error yet

' Release File SYstem Object
set oFSO = Nothing
end if

rc=owshell.run(szCommandLine,,True)
end if

set owShell = Nothing
wscript.quit(rc)

Function FormatNumber(szIn)
FormatNumber = szIn
if len(szIn) = 1 then FormatNumber = "0" & szIn
End Function

Save the script as something like "Exchange Backup.vbs" and add it to your scheduled tasks to run on a daily basis overnight. The script does contain one dependency, the backup set itself. To create this, start ntbackup, dismiss the wizard and select the backup tab. Ensure that the appropriate storage groups are selected, and save the selection to somewhere on disk. The output of this script will be files in the format "Exchange YYYY wnn.bkf" where YYYY is the year, and nn is the week number. For example, "Exchange 2005 w27.bkf" for this week. The file will have a single full backup at the start, and up to 6 differentials as well. Be sure to change the parameters in the first few lines of the script according to where you want to backup to.

Note also that if you want, you can backup to a local drive simply by using something like "c:\backup" instead of \\server\share in the BACKUP_SHARE definition at the top of the file.

I'm sure this will help someone (otherwise I've wasted my time....) Let me know if it does, or if you can do better without having to resort to more expensive backup solutions.

posted Wednesday, June 29, 2005 9:18 AM by jhoward with 11 Comments Rated Excellent [5 out of 5].

Event ID 8017 Backing up Exchange 2003 Virtual Machines (Part 1)

I was thinking about this also at the weekend (I really should get out more) about how to reliably backup my Exchange 2003 SP1 Virtual Machine running at home. Now it only supports five users and a few resource mailboxes, but now that my wife's email is on it, it suddenly becomes mission critical of course. Since installing it a couple of weeks ago, I'd been relying on a scheduled backup of the VHD files from the host itself, but this isn't sustainable on a long-term basis due to disk space requirements.

One of the first hurdles to overcome was hitting Event ID 8017 when using NT Backup to do a full online backup of the first (and only) storage group. The Event Log says "The operation failed. Consult the backup Report for more details. This didn't give a lot of further information either.

However, after some searching through the internet, I found the answer. It's simply a case that I had circular logging still enabled for that storage group (even though I swear blind I had turned it off). Under Exchange System Manager, select the First Storage Group, right click and de-select "Enable Circular Logging". After this, it will be necessary to cycle the Exchange Information Store service - that was the "trick" to making it work.

Hope that helps someone.

posted Tuesday, June 28, 2005 9:27 AM by jhoward with 2 Comments

Windows Sharepoint Services SP1 on Exchange 2003

This weekend, I was playing around yet more with my home infrastructure, "dogfooding", so to speak. One of the things I wanted to get running was Windows Sharepoint Services SP1 (the baby brother of Sharepoint Portal Server). However, I've pretty much run out of memory on my struggling servers here to be able to rack up another VM, hence, I picked on my Exchange 2003 SP1 server which has got IIS already installed. I obviously made sure I had a backup of it first (which is easy given it's a VM, and yes, I know it's not a supported configuration) in case things were to by any chance go wrong.

Well, things did go wrong - however the information was all there in the readme. Essentially, when opening Outlook Web Access, you get a page not found error as the ISAPI filter for Sharepoint is sucking all the requests made to it (that's not the official term though ;-). The solution (which although hard to follow does work exactly as it says) is documented in KB 823265. Note however that you'll also need to setup Sharepoint Services to use Kerberos authentication as documented in KB 832769.

Even though I got things working fine, my poor old server just couldn't hack the extra load by the time SQL went onto it running in a VM. Hence, I ended up reverting back to my original VM with just Exchange 2003 on it, and popped off to eBay to look for an cheap extra GB or two of ram. That should be enough for at least one seperate VM running the full blown sharepoint portal server, and if I tune it down enough, I should just about be able to squeeze another VM with Live Communications Server on it as well. Afterall, don't you have a full blown SIP service at your home? Nah, I think it's just me. I might have to wait until I can persuade the home "bean-counter" that we really need a twin CPU x64 servers - one of those new dual-core AMD chips are getting great reviews.

Here's the download link to Windows Sharepoint Services SP1.

posted Monday, June 27, 2005 8:04 AM by jhoward with 0 Comments

Branch Office Infrastructure Solution - lots of new information now available

The Branch Office Infrastructure Solution, or BOIS (which is far too easy to mis-type if you've worked in computing for a lot of years - think about it) has been released. The BOIS guidance and tools are designed and structured to address the needs of large organisations and enterprises in designing and deploying appropriate solutions for branch office infrastructures. It includes guidance on planning, design and deployment for a core set of MS technologies working together to provide a complete and integrated branch office infrastructure solution.

Streamlining a branch office infrastructure is basically a matter of consolidating services and applications, both by centralising them (if possible) and physically co-locating them (if centralisation is not possible). A branch office project using this approach can result in substantial benefits for companies of all sizes, especially large organizations and enterprises. The guidance focuses on reducing Total Cost of Ownership (TCO), through:

- Better utilisation of server capacity.
- More efficient systems administration and management.
- Faster and more complete recovery of data in the event of a disaster.
- Higher degree of standardisation and automation.

Click here to download and view or Click here for more information about solutions for Branch Offices.

posted Friday, June 24, 2005 10:49 AM by jhoward with 1 Comments

Understanding Active Directory in the Real World

For those of you who are available on Monday (27th June), this is a reminder that there is an all-day Technet event running at Cavendish Conference Centre in London about how you can deploy, manage, migrate-to, secure and extend the value of your directory platform. Myself and two colleagues from Microsoft Consulting Services (MCS), Mark Cribben and Mike Brannigan, both Active Directory experts, will be on stage presenting. Demand has been very high for this, but there are still a handful (and I really do mean handful) of spaces left only.

To register for this free event and to find out more information, click here. Hope to meet you there.

posted Thursday, June 23, 2005 5:23 PM by jhoward with 0 Comments

Windows Server 2003 SP1 Blocking Toolkit

As for the capability (now expired) to stop Windows XP SP2 being delivered through Microsoft Update, now a similar toolkit is available for download from Microsoft.com to block SP1 for Windows Server 2003. It is critically important to realise that the blocking capability is temporary. After 30th March 2006 (1 year from SP1 release), the block will no longer be enforced.

Although I've been using SP1 for several months now both in beta and RTM releases and found it to be rock solid, this tool may be important for you and your organisation while you continue to evaluate the use of SP1.

For more information on how to use the toolkit which is essentially in three variants (an executable to set a registry key, a script to set the same registry key, and an administrative template which can apply the registry setting through Group Policy), click here.

posted Wednesday, June 22, 2005 1:42 PM by jhoward with 0 Comments

Don't be flamed - use the Image Resizer Powertoy

Continuing the theme of digital imagery and photography, I happened to notice an email go through on an internal discussion group today which had something like 4MB of attachments in the form of photos. As you can probably imaging, the sender was somewhat flamed and pointed to the Image Resizer tool, a PowerToy for Windows XP. Yes, before you ask, I have managed to get it installed and working quite happily under Windows Server 2003 with a tweak to the LaunchCondition value update to VersionNT >=501 using Orca. Purely coincientally, there's also a paper by Marc Saltzman published yesterday about how to use the powertoy which you can view here. It managed to get a 1.2MB image down to well around 80K for me and is very simple to use (right-click, resize)

Download the Image Resizer powertoy directly or find out more on the home page for the XP Powertoys.

posted Tuesday, June 21, 2005 11:26 AM by jhoward with 0 Comments

File Server Migration Toolkit

Virtualisation for migration and consolidation isn't always the best answer. I'm not saying it isn't appropriate always, but there are alternatives. One great example which I was asked by a customer last week about was for migrating and consolidating older file servers. The answer could be the Microsoft File Server Migration Toolkit which provides tools and information to simplify the process.

Take a look at the FSMT homepage, the overview whitepaper or the Solution Accelerator for Consolidating and Migrating File and Print Servers

posted Tuesday, June 21, 2005 10:29 AM by jhoward with 1 Comments

Updated Server Performance Advisor Performance Diagnostic tool for AD and Windows

The latest version of the Server Performance Advisor was released at the end of last week for download here. SPA helps you diagnose the root causes of performance problems in a Windows Server 2003 deployment by collecting performance data and generating comprehensive diagnostic reports that give you the data to easily analyse problems and develop corrective actions.

I'm downloading it now but haven't had a chance to find out more about its capabilities in depth. If it's as good as the first version though, I recommend you giving it a go - especially as it's free. One interesting change, bound to be of interest to many including Eileen and Rod is that SPA 2.0 supports a new management pack which can pass its data through to MOM (Microsoft Operations Manager). Further, it supports on x64 editions of Windows Server 2003.

posted Tuesday, June 21, 2005 8:57 AM by jhoward with 1 Comments

Virtual Server Roadmap and Windows Virtualisation (Virtualization) aka Hypervisor

If you're interested more in the future of Virtualisation (Virtualization if you're from the other side of the Atlantic from me), or where Microsoft is heading in terms of the broad architecture of the Windows "Hypervisor" check out this link to a publicly available slide deck on the Virtual Server roadmap. I've seen more comprehensive decks internally, but these unfortunately are still under NDA for now. Hopefully these will be coming out soon. Steve Ballmer, Bob Muglia and other execs here at Microsoft have made several statements publicly around virtualisation being a core enabling technology - this is absolutely (IMHO) the technology to watch in the future.

You'll either need Microsoft Powerpoint to view the deck. If you don't have it though, fear not. You can use the freely downloadable Microsoft Powerpoint Viewer.

posted Friday, June 17, 2005 9:14 AM by jhoward with 3 Comments

How to create a Custom Group Policy Administrative Template to change Hide File Extensions for Known File Types

I was asked by a customer, or rather a colleague of mine took the query who passed it on to me, how you could use group policy to affect the Windows Explorer setting to hide file extensions for known file types. This isn't a setting which is directly exposed by group policy through one of the standard administrative templates.

Hence, what better way to show the example than through a blogcast. The blogcast demonstrates some important concepts.

If there is a registry setting being changed through Windows Explorer, you need to locate it. Yes, you can use many Internet sites, but why not find it out yourself - I show you how.
You need to craft a custom administrative template - I show an example.
You need to scratch your head for a while when you find that a setting which isn't "True Policy" isn't displayed by default in the Group Policy Object Editor.

The link to the blogcast is here - it's just under 8 minutes and just under 3MB in size. Happy viewing.

By the way, here's the custom ADM file I used to save you re-typing it.

CLASS USER
CATEGORY "Hide File Extensions"
POLICY "Hide file extensions"
KEYNAME "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
   VALUENAME "HideFileExt"
   VALUEON NUMERIC 1
   VALUEOFF NUMERIC 0
END POLICY
END CATEGORY

posted Wednesday, June 15, 2005 7:11 AM by jhoward with 0 Comments

Rebel or Safe? (aka NT4 vs Windows 2000). Your opinion counts

So right now, I'm somewhat in a quandry. "Why John", I hear you ask. "Well readers", I respond: At TechEd Europe this year, I'm going to present a couple of sessions. One will be around the contents of the Solution Accelerator for Consolidating and Migrating LOB (Line of Business) Applications. Here's the official summary of the SA:

This Solution Accelerator package provides technical information and recommendations, processes, build notes, job aids, test scripts, and documented test validation of the processes. The objective of the documentation set is to enable partners and enterprise customers to efficiently consolidate and migrate their existing Windows NT 4.0 based line-of-business (LOB) applications to Windows Server 2003-based technologies, including .NET Framework 1.1, WSRM, and Virtual Server 2005.

Now as it happens, the Virtual Server Migration Toolkit (VSMT) has a big part to play in this in terms of the migration to Virtual Server 2005 solution part. Naturally, I'll be doing a demonstration of a migration live - it's a pretty impressive demo to see live and I always get some great feedback when people see it for real. However, note the particular part of the summary above "...their existing Windows NT 4.0 based". The SA is equally applicable to Windows 2000 (and Windows Server 2003), but doesn't go to town mentioning this. Now, do I (as a Microsoft Employee, remember) stand up and show a Windows NT4 based machine being migrated, which is now "end of life" for want of a better term, or do I bend the rules slightly and show a Windows 2000 Server being migrated. At the UK Technical roadshows over the past few weeks, I've been doing a similar demonstration using Windows 2000 as the server being migrated, simply on account of the "end of life"-ness of NT4.

I'd appreciate a quick comment with your thoughts - play it safe, or be a rebel? FWIW - I'm swaying towards Rebel, but if you were in the audience and saw something which wasn't explicit in the material being talked about, would you mark the session down?
Thanks!

posted Tuesday, June 14, 2005 12:47 PM by jhoward with 9 Comments

Forms Based Authentication and RPC/HTTP over single IP using ISA 2004

You would think that this would be something fairly simple to do.... Well, think again, unless you know. In the scenario I was trying to get working, there are essentially three servers involved - a domain controller running Windows Server 2003, a single Exchange 2003 Server and an ISA 2004 Server.

The goal is to allows users to access the Exchange Server remotely, both via Outlook Web Access and through RPC/HTTP using Outlook 2003.

When you publish OWA (I'm not using a FE/BE [Front-End/Back-End] configuration - just a single Exchange Server) through ISA 2004, the principle is to create a new web listener running on port 443 (SSL) on the ISA Server. You configure the web listener to use forms based authentication (FBA) and forward the requests back to your Exchange Server. I had this going fine without a manual in sight ;-)

However, when it comes to a configuration where you have a single IP address externally, and want to publish RPC/HTTPS also on port 443, you have a problem. You cannot, in ISA 2004, have a web-listener running in both FBA mode and basic authentication.

I was puzzling about this last week, and came close to solving the problem. There wasn't much information I could find out there on the Internet, so my thoughts were to use Basic Authentication on the web listener, and proxy the FBA through another listener. I never quite got there until I found the article below, but the general principle was right.

This article by Tom Schinder "ISA Server 2004: Supporting Both Basic and Forms-based Authentication with a single External IP Address and Web Listener". This article goes through a step-by-step configuration and worked perfectly for me. Lots of screenshots to make it dead obvious what you need to do. The workaround is astonishingly simple in concept, yet resolves what should be such a simple thing to do.

...so here's a small part of my ISA configuration showing it configured

...and here's my OWA (with a few bits disguised - afterall, you wouldn't expect me to publicise my inbox contents or external domain name would you??? :-) )

Now for that XBox theme..... When's the XBox 360 theme coming out then, Eileen.

posted Tuesday, June 14, 2005 11:41 AM by jhoward with 0 Comments

Windows Server Update Services (WSUS) Download Link

While on the subject of patching here is the home page for the newly released Windows Server Update Services (WSUS), the next generation of SUS. To find out more about patching, management and securing your networks, have a browse through Eileens or Steves blog.

WSUS is a patch and update component of Windows Server which offers an effective and quick way to help you get secure and stay secure. WSUS is an important step towards delivering a core software distribution and update management infrastructure in Windows. WSUS has both server and client components.

Most of your immediate questions about WSUS are answered in the FAQ site.

posted Monday, June 13, 2005 1:41 PM by jhoward with 0 Comments

Deleting Web Listeners from ISA 2004 SP1

Enhancing the configuration of my ISA server at 3AM this morning (couldn't sleep), I was trying to resolve an issue that's been nagging me for days now. I wanted to delete a couple of old network Web Listeners I had previously created for testing some publishing rules. I was beginning to think that this just wasn't possible as I'd been looking around on and off for a couple of weeks now. If it's in the documentation, I couldn't find it. I'm sure if I have the problem, so must someone else. It wasn't under the main network configuration or system policy where I might have expected it to be. It's hidden away under the Toolbox under Network Objects and then Web Listeners down the bottom. Simply right-click on the listener to be deleted and click delete.

I think the reason it's hard to find is that first, I frequently hide the right hand pane of the ISA configuration screen to maximise the amount of space in the middle (for example, when doing real-time monitoring, you need as much real-estate available as possible). Even when I do have the right-hand pane open, it is permanently on "Tasks" rather than "Help" or "Toolbox". IMHO - this should be an option on the GUI under the main network section. I'll have to change my habits in the console in the future.

posted Monday, June 13, 2005 12:23 PM by jhoward with 0 Comments

ISA 2004 Patch Caching - new feature to cache BITS traffic over HTTP

You may have missed TechEd last week in the US. I did due presenting at the Technical Roadshow, but something rather significant caught my eye just now from an internal email, which I wasn't aware of before. Gordon Mangione in his security keynote mentioned a filter available later this year which would recognise traffic from Microsoft Update and would cache the content so only the first user would take the hit of the download time.

This is a really powerful feature. To elaborate slightly... ISA's upcoming ability will be to cache the traffic for Windows Update, Microsoft Update and SUS/WSUS. This is achieved by the addition of the ability to cache BITS traffic over HTTP. It is expected that this BITS cache filter will be delivered for free (probably from a feature pack) through microsoft.com.

The net result of this is that the ISA can cache:

Auto update client from the Internet
Auto update client from WSUS or SUS
SMS Client from SMS Server when set to use bits.

Those of you out there with remote sites linked via low bandwidth WAN links no longer may need to place remote WSUS and SMS servers just to cache the updates locally. The ISA server will be do it for you. Exciting times ahead.

posted Monday, June 13, 2005 12:52 PM by jhoward with 1 Comments

Microsoft Update is live - patching on steroids

OK, so Kevin beat me to this one. I've been busy in meetings is my excuse. Microsoft Update is now live. I've been using this for a while now and it is fantastic. You can patch not just your base OS (as in Windows Update), but Office (as in Office Update) and Exchange and SQL in one go. This takes out so much pain by having a one-stop patching shop. Here's the link to the main website on microsoft.com to find out more. Microsoft Update replaces Windows Update once it is installed.

posted Monday, June 13, 2005 12:42 PM by jhoward with 2 Comments

Stopping beeping from Virtual Machines under Virtual Server

This one crops up frequently on the discussion groups internally at Microsoft but I'd never seen it until a couple of days ago.

On some hardware, Virtual guest machines have a very annoying habit of causing the built-in speaker on the host beeping under certain circumstances, such as on popup dialogs. This very thing happened to me this weekend as I've installed yet another virtual machine, but on a server I'd never virtualised before which runs in my loft. While this isn't annoying to me, the bigger problem is that the server is almost directly above one of my kids noses when he's trying to get to sleep. His bed is one of those raised up "bunk" type beds. Hence, his nose is some 2ft from the ceiling, and the server itself is only another 1ft up from there. Hence, me working away remotely does get very annoying for him.

The solution is simple - stopping the "beep" service and it's fully documented in the knowledgebase under KB 838671 - How to turn off the beep sound in a virtual machine under Virtual Server 2005. Essentially there are three ways, through the registry; stopping the beep service through "sc config beep"; and net stop beep.

Of course there is a fourth way which I wasn't sure why the KB didn't list - a pair of pliers or a hammer will also turn off the speaker :-)

posted Monday, June 06, 2005 11:44 AM by jhoward with 8 Comments

KB 900076 - Windows Server 2003 SP1 as guest under Virtual Server

I blogged a week or so ago about issues when running Windows Server 2003 SP1 under Virtual Server 2005.

Two days after that, there was a knowledgebase article published (now why didn't that appear in my RSS feed off the support web site?). The KB article is interesting for a couple of reasons - first it confirms what I said, but this is the first KB I've seen which sent the counter over the 900000 mark :-) Watch out for that hotfix soon.

KB 900076 - You may experience decreased performance when you run Windows Server 2003 with Service Pack 1 as a guest operating system under Virtual Server 2005.

posted Friday, June 03, 2005 11:26 AM by jhoward with 4 Comments

Windows Management through Remote Desktops Snap-in. Save space on your TaskBar

I was speaking to a customer this morning about Windows management generally and this happened to come up in conversation. There are many ways to manage servers remotely in Windows, but the customer was asking if there was a way to avoid his nightmare of having six or more remote desktop sessions open to different servers. The RDP client by default isn't an MDI (Multiple Document Interface) application. [By the way, I never use Start/Programs/Accessories/Communications/Remote Desktop Connection to start up the client - there's simply too many clicks involved. Start/Run/mstsc is a lot quicker :-)]

You can get round having multiple instances of the client application open by using the remote desktops snap-in for the Microsoft Management Console which available out of the box in Windows Server 2003. Unfortunately though, you don't get to see it directly under administrative tools.

To fire up this snap-in, perform the following actions:
- Start/Run/MMC
- From the File menu, select Add/Remove Snap-in
- Click the Add button
- Scan down the list to "Remote Desktops", select it, click add and then close
- Click OK

Once the Remote Desktops snap-in is added, you can right-click on "Remote Desktops" on the left hand side and start adding your favorite servers to be managed. Once you've got the console setup and running, remember to save it somewhere easy to find, such as your desktop. Now it's not a true MDI application as such, but it saves a lot of space on your task bar, and it's much easier to go straight to the right server with a simple click in the treeview on the left hand side.

Here's the link to find out more about Remote Desktops on the TechNet site. From the menu navigation on this site, up one notch will give you lots more information about Remote Administration generally.

posted Wednesday, June 01, 2005 2:56 PM by jhoward with 10 Comments Rated Excellent [5 out of 5].

Turn Off Low Disk Space Notification

Next part of a series of blogs about changes to my home network, but equally as valuable to anyone who runs Virtual Machines in the sort of way I'm going to explain. For performance and due to lack of physical memory on my Virtual Server host, I've seperated out the swap file for a few virtual machines here into a seperate fixed size 500MB volume mounted on drive S. Physically, this VHD is placed on a different spindle on the host to the data and system VHDs for the VM. Once you fill up a volume with the swap file, the default behaviour of XP and 2003 is to have the pop-up on the task bar telling you that you're running low of space and repeatedly asks you if you would like to run the disk cleanup wizard. NO I WOULDN'T!!!!

This can be stopped through a change to the registry, but only on a per-user basis. This link explains how to do it for XP, but I can confirm it also works for Windows Server 2003.

posted Tuesday, May 31, 2005 9:00 AM by jhoward with 0 Comments

ISA Server cannot load the property page 0xc0040357 on export or backup

How to fix the following error on ISA 2004 backup or export:

ISA Server cannot load the property page.
Error: 0xc00403557
The Server referenced by Array [ArrayName] does not exist

A bit off topic for my usual blogging activities, but I had to share the resolution to this problem with you. I've had a busy time over the past few months changing things around on my home network and adding to it big-time. I've probably got enough infrasture now to support a medium size enterprise and an electricity bill to match, but it's also good way of learning by example and that's my excuse! While soaking up the lovely hot bank holiday weekend in the UK satisfied at finally resolving this issue with ISA combined with an hour or two lounging outside wirelessly working on more tweaks to the home network with a cold beer gave me the incentive to write this.

One of the first things I did in the re-org was to move my ISA server from one machine to another and build a new domain. My old ISA server was built on the RTM ISA 2004, and once working as I wanted, I exported the configuration to a safe backup location. As time moved on, I had upgraded that old machine to ISA 2004 SP1, but not altered anything significantly within the configuration. Once I was ready to bring the new server on-line, I figured it should be just a simple export from old and import to new. I failed, but wasn't that bothered as I had a relatively up to date configuration file, so used that and tweaked what needed changing to make the servers match. Whatever the error was then, I can't remember, but I strongly suspect it was the same error as above.

Remember also that the new server was also on a new domain, so I had to do further minor tweaking to resolve a few other issues. All sorted, or so I thought.

Recently, I've extensively changed my new ISA Servers configuration to support a stack of new functionality I need to expose on the Internet. There's many a weeks worth of blog entries in what I've been up to.... However, to be safe, I wanted to make a backup of the latest configuration. However, I hit that error again 0xc00403557. No amount of MSN Searching, Googling, the Microsoft knowledgebase, searching sites such as isaserver.org or even the documentation (yes I did resort to that too) came up with a definitive answer. A few clues were alluded to, but nothing definite.

There were a couple of things I did spot "odd" in the configuration which I thought may have been causing the problem. Firstly, I have VPN access into my home network. Under the Virtual Private Networks configuration, on the VPN Clients Tab, Step 2 of the ISA configuration allows you to specify windows users (or select a RADIUS server). I have my network configured to work with AD, and saw a GUID rather than a specific windows group in here. This is probably because I'd moved the configuration file to another domain and (in my mind) seemed to tied up with a server referenced by the array not existing. I could have sworn I had previously fixed that, but I guess I must have missed it afterall. Oddly though, the VPN restricted configuration was working as expected. Bizarre, but I'll worry about that another day. Solving the GUID issue was easy to correct (simple remove old group, add new group).

However, still the export wouldn't complete giving the same error. Much head scratching and examining every option and dialog I could find in the ISA Server twenty times over finally came up with the actual cause, but certainly not from where I was expecting. I had an old report job defined in the configuration which was imported, probably originally created under ISA 2004 RTM. Simply deleting that fixed the problem. Section two of this readme.htm file here alludes to this.

So, if anyone from the ISA product group is reading this - please can we have a better error message here when you're working on SP2 [;)] Thanks!!

Hope this saves someone hours of digging around otherwise.

posted Monday, May 30, 2005 3:35 PM by jhoward with 3 Comments

Account Lockout Policy cannot be changed and is greyed out

I received an email overnight asking about greyed out settings in the local security policy on a newly installed Windows Server 2003 machine. In my group policy session on Tuesday, I was talking around this whole area, and the reason for it is related to probably one of the most commonly misunderstood concepts I find when talking to customers about Group Policy. If you attend just about any sessions on Group Policy, the presenter will tell you that there is only one password policy in a domain. Even if you scope a Group Policy Object (GPO) to an OU which defines password policy, that GPO is affecting local password policy rather than domain level passwords. This is exactly the same with Account Lockout Policy.

So, for example: Start with a freshly installed standalone server running in a workgroup, rather than being domain joined. Run secpol.msc (shortcut for Local Security Policy under Administrative tools). Drill down into Account Policies/Account Lockout Policy and double click Account Lockout Threshold. You will be able to define an appropriate value. However, once you join that machine to a domain, it will now be under the influence of Group Policy. In a default AD installation, you will be picking up settings from the Default Domain Policy. If there is another GPO scoped to the OU containing the computer account also setting the Account Policies, this will override the default domain policy and will be seen through secpol.msc on the member server. Due to the policy coming from Group Policy, you cannot override these settings. You will also note if you look very carefully that the icon for the policy setting changes to a "pair of servers with a scroll" icon indicating that this is from Group Policy. When it was a standalone server, the icon would have been the binary 0's and 1's.

posted Thursday, May 26, 2005 9:19 AM by jhoward with 2 Comments

Group Policy resetting of local user passwords

Quick blog today - I'm presenting at the Technet Roadshow event in Birmingham today (Harrogate is next week, and London the week following), and am connected to the Internet by something which must be a 2K dial-up line shared between 20 users - slow doesn't begin to describe the experience. I'm presenting again in 30 minutes, so if I hit the post button in the next minute, there's always the chance that this might actually get posted before I have to be on stage again.

Following my presentation on Group Policy this morning, I was asked whether it was possible to reset local user passwords on clients through Group Policy. This isn't directly possible, but there are a couple of ways I came up with to solve this problem. Both will require a level of scripting, but perfectly "do-able". One would be to apply a computer startup script through Group Policy which runs as a system account, which would have the appropriate privileges to be able to reset the local administrator password. The other would be run it centrally from a server-side script connecting to each machine in turn.

Both scripts would need to use ADSI (Active Directory Services Interface) to be able to change the password - when I'm on a better link, I'll have dig out a script from the Technet Script Centre (Center) where there will be plenty of decent examples. From the server-side would probably be more secure in that the script wouldn't be visible from the client at-all, and hence it's easier to hide passwords from eyes if you needed to. Of course, you could generate a random GUID and use that as a password for more security if you never needed to log on as the local administrator.

Remember also that for the server solution, you could use something like dsquery to get a current list of all the client workstations from Active Directory. If you wanted to go the whole hog, you could add in a simple database table through accessed through ADO to keep track of which machines have had their local password reset and when. The world's your oyster with this one, but you get the idea.

...and I said this was going to be a quick blog extry (not)!

posted Tuesday, May 24, 2005 2:26 PM by jhoward with 0 Comments

Executive Chat - Windows Server Vision

Now this really is something you will want to attend online on 15th June at 5PM (UK time). How about a chance to ask whatever you want about where Microsoft is taking server operating systems (I can think of a few things....)! Bob Muglia is the Senior Vice President for the Windows Server Division, and is responsible for all versions of Windows Server and Microsoft’s management products. Learn about Bob’s long-term vision for server operating systems, and why he believes that Microsoft is the company that is and will continue to lead the industry in server operating systems and platforms.

Add to Calendar

posted Monday, May 23, 2005 5:07 PM by jhoward with 0 Comments

Windows Small Business Server 2003 (SBS2003) SP1 - Ask your questions

Following my blog entry a couple of days ago, I've just found out about an online chat taking place next week on 24th May at (gulp) 11PM for those of use in the UK (3PM PST). However, it will be an invaluable opportunity to pose your questions or concerns direct to the SBS product team. Here's the link to put an entry in your Outlook calendar.

posted Friday, May 20, 2005 5:03 PM by jhoward with 0 Comments

Roll your own service account

Something which came up a couple of days ago was a question about creating a service account for a custom service, but not being able to logon interactively with it. The solution is very simple through the use of User Rights Assignment. Fire up the Local Security Policy snap-in from Administrative Tools. Navigate down the tree to:

Security Settings
Local Policies
User Rights Assignment

Depending on your requirements, add the user to "Deny log on Locally" policy rule, or remove the user from the "Allow log on Locally" policy rule. However, be sure to read KB823659 before changing and security settings or user rights assignment.

posted Friday, May 20, 2005 2:19 PM by jhoward with 0 Comments

Windows Small Business Server 2003 (SBS2003) SP1 Now Available

Just gone live is Service Pack 1 for Small Business Server SP1. This builds on the Service Pack 1 release for Windows Server 2003, but is tuned more specifically to the overall capabilities of SBS and introduces some additional features in this really neat product.

In addition to Windows Server 2003 SP1, you now get:

Exchange 2003 SP1
Windows Sharepoint Services SP1
Outlook 2003 SP1
and Windows XP SP2

The premium edition also gets ISA Server 2004 which is a really great product and SQL Server 2000 Service Pack 4.

Here's the links you need:

What's new for SBS2003 with Service Pack 1
SBS Home page on Microsoft.com
Landing page for SP1 download You can also order a service pack CD from this link (approx 6-8 weeks for UK, 1-2 weeks if in North America).

Note: Before you say (and I'm sure you will), I've just tried downloading SP1, and it does currently fail - I've reported it and hopefully it will be resolved very shortly. A little patience and I'm sure things will be resolved :-)

posted Thursday, May 19, 2005 8:43 PM by jhoward with 0 Comments

Microsoft System Centre Data Protection Manager (DPM)

Here's (IMHO) an interesting webcast I've just found out about coming up next week covering a topic many people ask me about. The webcast is on 25th May starting at 11:30 PST (which should be, if my timezone calculator is correct 19:30 BST). In the webcast you will learn about the specific implementation scenarios using Microsoft System Center Data Protection Manager (DPM) in a branch office environment. DPM enables you to streamline your backup infrastructure, use tape more effectively in the datacenter, and lowers your overall cost and administrative overhead in protecting the data in your branches. You will learn the specific steps you need to take to set up DPM in the distributed branch environment. In addition, there will be a look at independent software vendor solutions that interoperate with DPM to complete the disk-to-disk-to-tape scenario.

You can register here

posted Thursday, May 19, 2005 7:22 PM by jhoward with 0 Comments

Technet Sessions - Post Event Archive

A few people emailed me asking where they could locate the download for the webcasts I recently gave, such as on Windows Server 2003 SP1 and Virtual Server 2005. I had to ask internally to find them - unfortunately, it's not as intuitive as I thought. My thought would have been that you could enter an event ID on the booking site, and it would find past events too if you entered the correct code. Sadly, this is not the case. However, as much to bookmark this site as anything else, here is the link to the post-events site. For webcasts, you need to click the last tab on the right.

The direct links for the Windows Server 2003 SP1 webcast is here and the Virtual Server webcast is here

posted Thursday, May 19, 2005 1:31 PM by jhoward with 0 Comments

DHCP Authorization problem - Event ID 1046

I was speaking to a customer yesterday who was telling me about a problem he was having with DHCP in his reasonably small office network (something like three servers). He had recently upgraded to Windows Server 2003 and implemented Active Directory. Previously, he was working in a workgroup and so you can understand it is quite a different situation now. The specific problem he had was that his Windows Server 2003 DHCP machine (also a file server), which had been running quite happily until joined to the new Windows Domain suddenly stopped working.

He showed me a screen-shot of the error which I've replicated through Virtual Machines below. (Click for a bigger image)

The answer (if you know) is simple. You need to authorise your DHCP server in Active Directory. The reason for this step is to stop rogue DHCP servers appearing on the network. From the DHCP snap-in, simply select the server, right-click and authorise it.

After authorising, you will see Event ID 1044 appear in the system log of the DHCP server indicating that it is ~~not :-)~~ authorised to start and is now servicing clients. You do not need to restart the DHCP Server service.

posted Wednesday, May 18, 2005 5:36 PM by jhoward with 1 Comments

Bad day at the office - disk help needed please

I know how you all love horror stories, so for what it's worth, here's my sob story for the day. The good news (if there can be such a thing) is that I have a (hopefully) reliable backup of my data as of the end of last week. The bad news is that my Seagate laptop hard-disk is currently 78% through a full diagnostic check and reporting over 20 bad sectors so far. Now I always thought that running a disk check would ensure that Windows wouldn't use bad sectors on a disk - I had a problem like this a few weeks ago, and felt that a disk check would suffice. However, I "lost" (they're on backup) some VHD files for some virtual machines this morning plus a few other miscellaneous files. Windows was reporting event id 7 in the event viewer.

So, to all those hardware knowledgeable people - do I chance the Seagate diagnostics to remap the drive to not use the bad sectors, or am I doomed to failure with this drive. I don't particularly want to rebuild, although I do fortunately have a partition backup for the boot & system partition, so restoring to a new drive could be useful. Also, do I go for something like the new "Momentum" 7200 100GB Seagate laptop drives - not that I could find a UK distributor for these or is there something even faster? Big and fast is my only real criteria - if they did 500GB 15,000 RPM Ultra-320 SCSI hard disks for laptops, I'd be there like a shot, but sadly I'm stuck with ATA-100....

PS Make that 33 bad sectors now :-(

posted Monday, May 16, 2005 7:42 PM by jhoward with 7 Comments

It's Showtime on Technet

Just gone live are a series of video recordings of live sessions on Technet UK. Come and choose from some of the best recordings of sessions for IT Pro's over the past few months from speakers including John Craddock, Andreas Luther, Jesper Johansson, Rafal Lukawiecki, Steve Riley, and coming soon, you're truly (gulp). The topics are wide, varied and a great additional source of really useful information. To select the recording you want, check out this site, remembering to return again to check out the newest releases.

posted Friday, May 13, 2005 7:02 PM by jhoward with 0 Comments

Group Policy Settings Reference for Windows Server 2003 with Service Pack 1

I've had a couple of people ask me about this over the past week, so rather than answer individually, here's the location for the latest version of the Group Policy Settings Reference spreadsheet.

This spreadsheet lists Group Policy settings described in Administrative Template (.adm) files and Security Settings that shipped with Windows Server 2003 Service Pack 1.

The spreadsheet includes separate worksheets for each of the .adm files and the security policy settings that shipped in Windows XP SP2 , a consolidated worksheet for easy searching, and an Update History worksheet that lists policy settings that have been added since the Windows Server 2003 operating systems were released. Using column filters, you can easily filter the information in the spreadsheet by operating system, component, or machine/user configuration. You can also search for information by using text or keywords

posted Thursday, May 12, 2005 9:41 PM by jhoward with 3 Comments

Security Configuration Wizard

Topical after yesterdays webcast on Windows Server 2003 SP1, here's a link to documentation on SCW (Security Configuration Wizard) which contains lots of information to assist you in deployment, extensibility and troubleshooting. Apart from the quick start and deployment guides, the one I particularly found useful was "Extending the Security Configuration Wizard" - extending SCW for custom roles is a really powerful capability.

posted Wednesday, May 11, 2005 2:42 PM by jhoward with 1 Comments

Access Based Enumeration Update + Blogcast

Following todays webcast on Windows Server 2003 SP1, here's the blogcast on Access Based Enueration I promised to record and post up.

Apologies for the technical difficulties during the webcast - unfortunately I wasn't able to show the last demonstration as a lot of you weren't able to see my desktop. If you were watching, I hope the fear and panic from my side didn't spoil the show - it was a "seat-of-your-pants" session. I'd love to hear whether that actually came across.... If you're not interested in what happened, skip to the next paragraph otherwise, this is what it was like on my side. With 15 minutes to go, I gave up trying to advance the slide deck myself due to the LiveMeeting console crashing. My colleage Steve helping me couldn't log onto the session for some reason from his laptop, and I had absolutely no way of being able to do the demonstrations. Decision made was the reboot, but this takes around 4 to 5 minutes, and I also had to save the state of four virtual machines running. So, back online with VMs with under 5 minutes to go, I still couldn't advance the slides or share my desktop for the demos. Also the presenter console kept disconnecting. There's nothing like the adrenalin rush at this point :-) Fortunately, Steve had also rebooted and finally managed to log on as a presenter. However, still no demo's. The answer was to use remote desktop to connect to my laptop remotely to access the VMRC console for my VMs to run the demos. There wasn't time to install VMRC on Steve's laptop. The one problem for those who use both VMRC and MSTSC is that they both use the right alt key as the default 'Host' key. I didn't have time to remap them, so trying to send Control-Alt-Del to a guest VM was made harder. Oh well, I'm sure we've all had nightmare scenarios like this too.....

Since I recorded the blogcast on Access Based Directory Enumeration in Windows Server 2003 SP1 Beta earlier this year, things have moved on. We now have an official whitepaper, a GUI, a supported command line tool and a new name - Access Based Enumeration without the "Directory". To find out how to use both the GUI and the command line tool, click here to view the blogcast. It runs for just under 6 minutes.

Edited by John: 3rd Nov 2005 - Rehosted WMV Files

posted Tuesday, May 10, 2005 7:05 PM by jhoward with 3 Comments

Automated Deployment Services (ADS) 1.0 and Windows Server 2003 SP1 Gotcha

This seemed a timely reminder with my webcast on Windows Server 2003 SP1 this afternoon. A small gotcha which caught me out last week when installing an ADS controller was that when ADS asks for the Windows Server 2003 media, you must use the RTM version, not a slipstreamed SP1 media. The ADS services won't start otherwise. Ironically, the only thing I didn't have to hand at the time was an RTM install - I've slipstreamed everything. Doh! This gotcha is due to be fixed in the next release of ADS.

posted Tuesday, May 10, 2005 9:43 AM by jhoward with 0 Comments

Microsoft Baseline Security Analyzer (MBSA) 2.0

MBSA 2.0 is the next version of the Microsoft Baseline Security Analyzer, which utilizes the Windows Update Services infrastructure for security update scanning. You can sign up for the beta of MBSA by nominating yourself through visiting http://beta.microsoft.com, sign in to the system using your Passport ID and a guest ID of "MBSA20" and completing the survey.

You can also find out more about MBSA 2.0 from Mike Chan, a Technical Product Manager through his webcast "Microsoft Baseline Security Analyzer 2.0: Architecture and Scenarios" which is a level 300 talk on Thursday 26th May between 11AM and 12:30PM PST (ie a 7PM start for us "Brits" which unfortunately, I think, makes it clash with Eastenders [;)])

Here's Mike's description of the session and the link to register.

Microsoft Baseline Security Analyzer (MBSA) 2.0 provides many new and powerful features, including integration with the new Windows Server Update Services (WSUS) infrastructure. Come learn about these new features and architectural changes to help make your IT infrastructure more organized and unified. Knowing what a complex process patch management can be, this session shows how to use MBSA 2.0 in common scenarios to improve your security update management process.

posted Tuesday, May 10, 2005 9:02 AM by jhoward with 4 Comments

DSI (Dynamic Systems Initiative)

Some of you may have heard of DSI - the Dynamic Systems Initiative. Understanding DSI can be difficult, hence I thought I'd alert you to a really great new Flash-based demonstration of DSI which has just gone live on the DSI webpage.

This demo examines the challenges associated with each phase of the IT life cycle, including design, development, deployment, operations, and change management, and the knowledge and requirements associated with each. To deliver effective solutions, IT teams must capture and incorporate this information into their systems.

The Dynamic Systems Initiative (DSI) is a commitment from Microsoft and its partners to help IT teams capture and use knowledge to design more manageable systems and automate ongoing operations, resulting in reduced costs and more time for the organization to proactively focus on what is most important.

The demo link is here, and the DSI home page on microsoft.com is here

posted Tuesday, May 10, 2005 8:59 AM by jhoward with 2 Comments

Windows Server 2003 R2 Customer Preview Program (CPP)

At the end of last week, the long awaited R2 Site on microsoft.com was launched where you can now also register for the R2 Beta 2 Customer Preview Program. I'll be blogging a lot more about R2 in the coming weeks, but for now, have a browse through the links above to find some great information about this important update to Windows Server 2003.

posted Monday, May 09, 2005 5:39 PM by jhoward with 0 Comments Rated Excellent [5 out of 5].

Join me for a webcast on Windows Server 2003 SP1 tomorrow

Just a reminder that I'll be presenting a webcast about the changes to Windows Server 2003 with Service Pack 1. I'll be talking about the Windows Firewall, the Security Configuration Wizard (SCW), the Post Setup Security Updates (PSSU), Access Based Enumeration (ABE), formerly known as Access Based Directory Enumeration and more besides.

The event starts at 2PM UK-time tomorrow, 10th May 2005. Registration is now closed, but you can still attend by using this link with MeetingID 118759410 and Password P223NP. I'd recommend you log on 15 minutes before the start to allow you to download the Live Meeting console to be on the safe side. For more information about the webcast, click here.

posted Monday, May 09, 2005 12:38 PM by jhoward with 1 Comments

European MIIS User Group Meeting - Reading, 17th June

There are two events in one on 17th June at the Microsoft offices in Thames Valley Park, Reading under the banner of the "European MIIS User Group Meeting". One track is for MIIS, and the second track is for Identity Management. Both are free to attend.

Here's the summary and registration links:

This year the Identity team at Microsoft has joined forces with TechNet to put on this free event. It is intended for User Group members, IT architects and security specialists and will feature two tracks covering MIIS 2003 and other hot topics in Identity Management. Track 1 will look at MIIS specifically; including functionality, implementation and best practices for deployment. Track 2 will explore Identity Management beyond the Microsoft environment through federation, as well as other Microsoft and partner technologies. There will also be updates on Microsoft’s roadmap for Identity.

Registration is separate for the two tracks but the intention is, once there you won’t necessarily be tied into the track you’ve registered for if something on the other agenda appeals to you. So there’s no need to register for both – just the one that is your primary interest.

Here's the links to register for the MIIS track and Register for the Identity Identity Management track

posted Monday, May 09, 2005 12:23 PM by jhoward with 1 Comments

Virtual Server Migration Toolkit (VSMT) Guidelines

If you're interested in using VSMT (Virtual Server Migration Toolkit) for migrating a physical machine into a virtual machine, there was a new KB article posted up a few days ago which gives you some general guidelines. Note that there is one error in the article - it currently says it applies to Virtual PC 2004. This is incorrect (and I've submitted feedback). It actually applies to Virtual Server 2005.

If you want to see the VSMT steps through a series of blogcasts, have a look here . Thanks to Kevin for giving me the link to the KB - it was one which had slipped me by.

posted Friday, May 06, 2005 10:11 AM by jhoward with 0 Comments

Group Policy Circumvention by Local Administrators

The reasonably well known about danger of users running as local administrators being able to circumvent group policy settings has been excellently documented and explained by Mark Russinovich with an article on his blog. If you didn't know about this danger, you really should take a look. Mark is one of the guru's behind the excellent sysinternals.com site which I recommend to people on a very regular basis and similarly use their tools to solve numerous problems. Keep up the good work, Mark! I didn't even know Mark kept a blog, so thanks for the link Steven :-)

posted Tuesday, May 03, 2005 8:26 AM by jhoward with 0 Comments

Virtual Server 2005 SCSI Shunt Driver

It's rare you see something in a beta release which makes such a dramatic difference to performance. This is one such instance. If you want to save yourself over 5 hours when installing a Virtual Machine under Virtual Server 2005, read on....

Last week at home, I was installing a new Windows Server 2003 R2 beta server configured with single virtual SCSI hard disk under Virtual Server 2005 SP1 beta. This was on my "big" laptop which physically has an IDE disk (don't they all though?). I was getting really frustrated by the length of time it took to install - just under 6 hours at 100% CPU throughout. At least I didn't need the heating on that day.

At the time, I hadn't even thought about using the SCSI Shunt Driver floppy which is introduced by Virtual Server 2005 SP1, as my understanding was, as per Ben's blog entry last week, that it generally only made a difference to users who had physical SCSI hard disks in the host.

To find out the difference the SCSI Shunt Driver floppy made, I repeated the installation once more but using the driver floppy using F6 during the text mode install portion. The difference was staggering: 6 hours down to 55 minutes including patching, anti-virusing, defragmenting, pre-compacting, compacting and the installation of VM additions. I was just astonished. That probably means the actual install was more like 40 minutes. Of course, I can't guarantee that you'll necessarily see quite that much difference, but it has to be worth a try next time you're installing a VM.

posted Tuesday, May 03, 2005 7:15 AM by jhoward with 0 Comments Rated Excellent [5 out of 5].

Timezones on your desktop

Another one of these really useful utilities which I could have done with it when I was posting another entry on my blog this morning. Adding 8 shouldn't be taxing, although it can be depending on how tired you feel (London is 8 hours ahead of Seattle was where I was coming from when trying to work out the UK start time for a webcast). I hadn't seen this utility before, but it's installed now and working very nicely indeed - Microsoft Timezone. You can choose which timezones to display in the notification area on your taskbar. Free to download.

posted Tuesday, May 03, 2005 6:23 AM by jhoward with 0 Comments

How Microsoft manages Group Policies internally

If you want to find out how, take an hour out online on Tuesday 17th May at 4PM UK time. Learn how Microsoft's own IT organization manages Group Policies across Microsoft Corporation's own internal Active Directory Forest. In this webcast IT professionals from Microsoft will give a brief overview of its Managed Active Directory environment, discuss some of the challenges faced today, and conclude with recommendations for what you can do to manage GPOs in a large enterprise.

posted Tuesday, May 03, 2005 5:27 AM by jhoward with 0 Comments

Remote Desktop Assistant 1.0

Sometimes the most blindingly obvious and simple utility become a weapon of choice in your toolbox arsenal. Here's one such example I stumbled across a few days ago and am now wondering how I ever coped before. Over on longhornblogs.com, Robert (who I remain indebted to) has put up the Remote Desktop Assistance utility to make sure your list of remote desktops is up to date. Take a look for yourself - if you use Remote Desktop Connections a lot, this could be the tool of choice for you.

posted Thursday, April 28, 2005 3:23 AM by jhoward with 0 Comments

MSDTC Event ID 4143 and 53258 on Windows Server 2003 SP1 Domain Controller

I got hit by a problem on a freshly installed virtual machine using a slipstreamed SP1 installation and promoted to a domain controller. Two events were appearing in the event log which were unexpected.

Source: MSDTC Event ID: 4143 Information
MS DTC has detected that a DC Promotion has happened since the last time the MS DTC service was started.

followed by

Source: MSDTC Event ID: 53258 Warning
MS DTC could not correctly process a DC Promotion/Demotion event. MS DTC will continue to function and will use the existing security settings.

To resolve this, go through the following steps:
- Start/Administrative Tools/Component Services
- Navigate the tree view on the left to:
    - Console Root
     - Component Services
      - Computers
       - My Computer
- Right click on "My Computer" and select properties
- Select the MSDTC Tab
- Under "Transaction Configuration" near the bottom, click "Security Configuration"
- On the Security Configuration screen, just click OK - don't change anything.
- Back on the "My Computer Properties" screen, click OK again to dismiss
- Right click on "My Computer" in the tree view and select "Stop MS DTC"
- Right click on "My Computer" in the tree view and select "Start MS DTC"
- Close the Component Services snapin.

All should now be well again. Hope this helps someone.

posted Tuesday, April 26, 2005 6:25 AM by jhoward with 21 Comments Rated Excellent [5 out of 5].

Watch those group policy settings carefully

Many people get caught out with group policy - I stand up and tell people all about some of the gotchas on a regular basis. You know, things like making sure you understand the double negatives such as Disabling "Do not keep history of recently opened documents" to keep the history. It really is worth reading them very carefully. The point? I myself got caught out this morning and was a bit too thoughtless when changing settings for a new virtual machine domain. I wanted to turn off all the password restrictions to make demonstrations easier. Into GPMC, edit the default domain policy and bounce down to the computer configuration/windows settings/security settings/account policies/password policies.

I changed all the settings with the exception of storing passwords using reversible encryption to "Not Defined". Yet, when I was trying to create a test user account with a simple password, it wouldn't take it. No end of gpupdate/force would do it - checked the event logs and found nothing relating to policy. The point? Check your settings very carefully. To turn off password complexity you need to Disable the "Password must meet complexity requirements" rather than set it to "Not Defined".

posted Tuesday, April 26, 2005 6:25 AM by jhoward with 0 Comments

Would you change your PC for $125,000? I would.

If you want to make a difference, now is your chance. Just launched at the WinHEC (Windows Hardware & Engineering) conference is a competition running until October this year open to design teams, students and individual designers alike, to envision the next generation of Windows Based PCs. The prize is a phenomenal $125,000 if you can design the ultimate Next Generation Windows OS PC as judged by three juries including Bill Gates himself.

To find out more - head on over to www.startsomethingpc.com

posted Monday, April 25, 2005 2:27 PM by jhoward with 0 Comments

Minimising VHD size for WS2003 Enterprise SP1 in Virtual Server

I was playing this weekend trying to get the VHD (Virtual Hard Disk) size down to the barest minimum. I thought I did OK - WS2003 SP1 with Support Tools, Admin Pack, Group Policy Management Console, Small Office 2003 installation running Word+Excel patched with Office SP1 and latest security fixes, sysinternals background info, Security Configuration Wizard and a few more utilities in just under 1MB as viewed from inside the VM.

On the host Virtual Server though, the image was some 2.5GB - a far cry from 1MB. Getting the disk size as small as possible is really important for me when building many machines for demonstration. Disk space is an expensive commodity on a slowish 80GB laptop hard disk, and also size is directly proportional to overall performance. With a bit of patience, it is possible to get the VHD size down on the host to 1.2GB in this configuration. Here's some of the stuff I did which I hope you find useful:

- Change the page file on the VM to start at 16MB
- Delete *contents of* c:\windows\system32\dllcache
- Delete *contents of* c:\windows\cursors
- Delete *contents of* c:\windows\inf
- Run the disk cleanup wizard
(Note- there are many others things you _could_ delete, but this gets the big ones)
- Defragment the disk ***at least 5 times****
- Precompact the hard disk (you need VPC2004 SP1 for this - I see another blog entry coming on)
- Compact the hard disk in VS admin
   - Select "Virtual Disks/Inspect"
   - Find your .VHD file
   - Select "compact"
   - Wait 20 mins or more :-)

For some more minimal shaving of space.... After doing the above, the VHD file was down to 1.3GB - some 340MB+ bigger than the data actually being used by the Virtual machine. I tried converting the VHD from an expanding disk to a fixed disk, and then back to an expanding disk again. This gave no improvement in disk size.

However, once you have the fixed disk, start the virtual machine up and precompact once more. (I also did a defrag again, just for good measure). Shut the machine down and convert it back to expanding disk again before finally compacting it. Net result - no change. However, sticking with the full-size disk, pre-compacting it, converting it back to expanding disk and compacting it again did shave a further 80MB off. Hence, hence net result 1.22MB which I thought wasn't too bad.

So, can you do better or have any additional tricks?

posted Sunday, April 24, 2005 1:21 PM by jhoward with 8 Comments

Listen to what Steve Ballmer had to say about Virtualisation first hand

Following the HUGE Virtual Server announcements made by Steve Ballmer a couple of days ago at the MMS conference, if you want to here what Steve had to say first hand, click here to hear his keynote speech streamed directly over the Internet. On that page you can additionally download both a written transcript and a copy of the slide deck he used. The Virtual Server piece starts around 49 minutes 50 seconds in.

posted Friday, April 22, 2005 3:27 AM by jhoward with 2 Comments

Small Business Server (SBS2003) Webcasts and User Group

Small Business Server (SBS2003) is a really great product for (unsurprisingly) small and medium businesses to operate a one-stop server shop comprising most of the major server components from Microsoft. For example, email, firewall, remote access, collaboration and database. The really great thing about SBS is the way in which everything ties together through wizards and simple interfaces without the need to understand in depth what is going on under the covers - a bit like "computing for mere mortals". In the UK, there is a very effective user group run by Scott McKenzie out of Edinburgh which provides real local value - if you thinking about how to run a simple IT solution, I would recommend going along to one of Scotts meetings or dropping him a line.

The reason for this post is to highlight some of the webcasts which are available for SBS which provide excellent information if you are considering evaluating how SBS can assist your organisation. For more detailed information about SBS, take a look at the SBS home page on microsoft.com.

posted Friday, April 22, 2005 3:09 AM by jhoward with 0 Comments

Windows Server 2003 Resource Kit - UK Promotion Offer....

The Windows Server 2003 resource kit will be hitting the streets next month. This is a fabulous resource to have to hand, and is now a full seven volumes covering the entire Windows Server family. The good news for UK people is that by pre-ordering now you can get a 40% discount from Computer Manuals - well worth the saving.

About the Book....

Get practical guidance on managing and tuning system performance to help optimize speed, reliability, and efficiency.
•Implement proactive monitoring practices and procedures
•Use Performance Monitor, event tracing, load testing, and other tools to measure performance and capacity
•Set up logs, alerts, and reports
•Use baseline performance data for troubleshooting and capacity planning
•Learn to interpret key performance indicators and analyze bottlenecks
•Diagnose and resolve common performance problems
•See when to use advanced configuration and tuning techniques

MICROSOFT WINDOWS SERVER 2003 TROUBLESHOOTING GUIDE

Apply expert strategies to troubleshoot your Windows Server 2003 network—and quickly resolve system issues and conflicts.
•Use Windows troubleshooting tools to identify and resolve problems
•Resolve startup issues, including failures and hardware conflicts
•Review stop errors, including memory dump files and common stop messages
•Troubleshoot disks, volumes, and file system issues
•Identify and resolve TCP/IP communication problems
•Manage system services, including configuration and monitoring

MICROSOFT WINDOWS GROUP POLICY GUIDE

Extend your administrative control with Group Policy—simplifying user and computer management and automating routine tasks.
•Design, implement, and modify Group Policy Objects (GPOs)
•Manage GPOs and policy settings; learn best practices for deployment
•Administer user settings, system configuration and access, and software installation and maintenance
•Customize administrative and security templates; create custom environments
•Manage IPSec, public key, and Windows Firewall policy settings
•Use Resultant Set of Policy tools and Group Policy logs to troubleshoot problems

MICROSOFT WINDOWS SECURITY RESOURCE KIT, SECOND EDITION

Learn how to help protect your Windows-based clients, servers, networks, and Internet services.
•Design security-enhanced Active Directory® objects, domains, and forests
•Utilize the Security Configuration Wizard and Windows Update Services
•Configure TCP/IP, 802.1x authentication, and the Windows Firewall
•Define security settings for domain controllers, IIS 5.0 and 6.0, and DNS, DHCP, WINS, RAS, and certificate servers
•Implement the security advances in Microsoft Office 2003 Editions, IIS 6.0, and the latest service packs
•Perform security assessments and respond to incidents

MICROSOFT WINDOWS INTERNALS, FOURTH EDITION: MICROSOFT WINDOWS SERVER 2003, WINDOWS XP, AND WINDOWS 2000

Delve inside the Windows kernel—for the inside details and architectural insights you need for better design, debugging, and performance.
•Understand the key mechanisms that configure and control Windows
•Explore the Windows security model
•Observe how Windows manages virtual and physical memory
•View the Windows networking stack from top to bottom, including mapping, APIs, name resolution, and protocol drivers
•Troubleshoot boot problems and perform crash analysis
•Experience Windows internal behavior firsthand with hands-on experiments

MICROSOFT WINDOWS REGISTRY GUIDE, SECOND EDITION

Understand how the registry works, its role in Windows configurations, and how to customize Windows to run the way you want.
•Learn best practices to back up, restore, manage, and modify the registry
•Customize group and system policies to manage multiple PCs and users remotely
•Track down registry settings and script changes
•Optimize server services, including network connections and authentication
•Deploy user profiles and Microsoft Office program settings
•Configure security services, including Windows Firewall, templates, and service pack features
•Troubleshoot the registry—resolve common problems and corruption issues

Your Resource Kit CD includes:

More than 300 essential tools, utilities, and resources:
•120+ Windows Server 2003 Resource Kit tools for configuring, optimizing, monitoring, and troubleshooting Microsoft Windows®-based servers and clients
•80+ ready-to-use, customizable scripts for automating Windows administration tasks
•VBScript Essentials videos
•20+ tools and scripts from the Microsoft Windows Security Resource Kit
•Utilities, templates, and job aids for Group Policy
•100+ registry files for customizing operating system appearance and behavior

Microsoft Press® eReference Library:
•eBooks of all 7 Resource Kit volumes
•Internet Information Services (IIS) 6.0 Resource Kit eBook
•Microsoft Windows Scripting Self-Paced Learning Guide eBook
•Microsoft Encyclopedia of Networking, Second Edition, eBook
•Microsoft Encyclopedia of Security eBook
•Trustworthy Computing: Reliable in Operations eBook
•Sample chapters from Assessing Network Security and Microsoft Windows Server 2003 PKI and Certificate Security

Windows Server 2003 Technical References:
•Active Directory® Collection
•Core Operating System Collection
•Group Policy Collection
•High Availability and Scalability Collection
•Networking Collection
•Storage Technologies Collection
•Windows Security Collection

posted Thursday, April 21, 2005 5:23 AM by jhoward with 3 Comments

How to sign up for the Virtual Server 2005 SP1 Beta

To participate in the beta program, you need to:

Go to http://beta.microsoft.com. (Note: You need a Passport account to sign in. If you don’t have one, BetaPlace will help you create one.)
Once logged into Beta Place with a Passport account, provide vssp1BetaTester as the guest account. This will take you to the nomination page for the SP1 beta.
Note: The Guest ID is both case and space sensitive and must be entered exactly as shown. The most common reasons for a “Guest ID is locked out” or “invalid Guest ID” error message is because you either incorrectly entered the Guest ID or you entered a space before or after entering the Guest ID in the Guest ID field.
Follow the directions on this page to nominate yourself. You will receive an e-mail notice when you've been accepted into the program. About 24-48 hours after you receive this e-mail, you will be able to log in to Beta Place and download the SP1 beta, read the documentation, etc.

Enjoy!

posted Wednesday, April 20, 2005 3:17 PM by jhoward with 2 Comments

Virtual Server MMS Announcement (2 of 2) - Vision and Strategy of Virtual Computing Environments

The second of my blog entries about the MMS announcements made only minutes ago by Steve Ballmer relate to the longer term strategy for Virtualisation within Microsoft. You can see my commentary highlighting the shorter term vision for Virtual Server here. In his keynote address, Steve announced increased investments in support of the Dynamic Systems Initiative, specifically in the area of virtualization.

Starting in the "Longhorn" timeframe (the next version of Windows) virtualisation capabilities will be built directly into the OS through "hypervisor" technology. This new hypervisor technology is going to support hardware virtualisation technologies such as Intels VT and AMDs Pacifica. Longhorn should be with us as a shipping product some time in 2007.

Management of virtualisation is also going to see a significant boost as the "System Center" product family will be optimised to provide really comprehensive virtualization management capabilities.

These are exciting times. If you want to know more about todays announcments, please join my Virtual Server webcast on 29th April at 2PM GMT. Here's the registration link.

To read the official press release from todays MMS keynote, click here.
http://www.microsoft.com/presspass/press/2005/Apr05/04-20VirtualizationInvestmentsPR.asp

posted Wednesday, April 20, 2005 12:29 PM by jhoward with 0 Comments

Virtual Server MMS Announcement (1 of 2) - VS2005 SP1. Linux is OK :-)

I've just been listening to Steve Ballmer give his keynote session at the MMS (Microsoft Management Summit) and in particular wanted to tell you about some really significant changes to Virtual Server and Virtualisation in general which are happening in the short and medium term here at Microsoft.

The Beta of Service Pack 1 for Virtual Server 2005 has been announced today, due to RTM (Release to Manufacture) in Q4/Autumn/Fall (depending on where you're from). Some of the changes in SP1 are:

- Support for x64 based host operating systems for significant performance boost
- Clustering support with iSCSI for enhanced reliability and availability
- PXE boot support in the guest BIOS

Of course, Steve also talked about the MOM Management Pack for Virtual Server which I blogged about also a few days ago and is available today - you don't have to wait for SP1 for that.

A really important change is that the the file-format for "VHD"s (Virutal Hard Disks) will be licensed royalty free to make VHD files interoperable with other tools and systems. This is really going to open up major opportunities. For example, how does being able to patch virtual guests without starting them up grab you?

Now here's the real one which is a significant change in direction. To date, we have only supported Microsoft Server based operating systems as guests. From SP1, we will extend support for 3rd party guest operating systems to include Linux, Solaris and other x64-based operating systems.

The details still a little sketchy here, but I'll fill in the blanks as I get them over the coming few days.

What this does mean of course, that the content for my webcast I'll be presenting on the 29th April at 14:00 (GMT)about a technical overview Virtual Server 2005 may have to go through the wash a few times between now and then. Hence, please join me if you want to find out more not just about VS2005 as it is, but what the announcments mean for the future. The registration site is https://msevents-eu.microsoft.com/cui/WebCastEventDetails.aspx?culture=en-GB&eventid=118758408 but hurry before all the places fill up. Hope to "see" you there.

The Virtual Server 2005 home page has literally just been refreshed in the past couple of minutes so you're seeing this first. The download link to SP1 Beta is right at the top. You might also want to browse by the official press announcement at http://www.microsoft.com/presspass/press/2005/Apr05/04-20VirtualizationInvestmentsPR.asp

posted Wednesday, April 20, 2005 12:08 PM by jhoward with 5 Comments

Resolving Event ID 40961 LSASRV - DNS/prisoner.iana.org

This was an interesting problem I was discussing with a customer today. The customer had a concerning looking error appearing periodically in the event log:

Event ID: 40961
Source: LSASRV
Version: 5.2
Symbolic Name: NEGOTIATE_INVALID_SERVER
Message: The Security System could not establish a secured connection with the server DNS/prisoner.iana.org. No authentication protocol was available

The concerning part to this is the word "prisoner" which may set alarm bells ringing initially in some peoples minds. As it happens, this is perfectly legitimate, just the name of a DNS server run by iana.org.

After some diagnosis and looking up, I found a few articles on the Internet which relate to this problem, and found the root cause. prisoner.iana.org has a 192.x.x.x IP address. This is a big clue as it's one of the non-routable reserved address spaces commonly used in smaller organisations. The customers internal address space turned out to be 192.168.x.x. The cause of the error was simply that there was no reverse lookup zone configured on their internal DNS server.

Remember, a quick check from a client by running "nslookup" from a command prompt and seeing a timeout error also will point immediately to a reverse DNS lookup zone missing problem.

Once the zone has been created, it may be worth doing the following on your DCs (if you can't afford a reboot and have a small environment):
- ipconfig /registerdns
- net stop netlogon followed immediately by net start netlogon

posted Wednesday, April 20, 2005 11:26 AM by jhoward with 0 Comments

Access Based Directory Enumeration - Download now on microsoft.com

Following my blogcast in February and subsequently posting the markShareforABDE tool for download a few days later, the official download is now available. There's a GUI thrown in as well for good measure for those who try to steer clear of the command prompt. The landing page for the download links is here. There are three versions depending on your processor architecture - i386, AMD64 or IA64. In a nutshell, Access based enumeration (previously known as Access Based Directory Enumeration) hides files and folders for which users do not have rights to see on network shares.

Remember though, Access Based (Directory) Enumeration only works on servers running Windows Server 2003 SP1.

posted Tuesday, April 19, 2005 9:33 AM by jhoward with 5 Comments

Do you use blogging software?

Something which cropped up internally over the past couple of days has been a discussion about how many people at Microsoft must have moved on beyond using the standard HTML interface to their blog engine for posting. I kept quiet at this point once discussions got round to all sorts of software I'd never heard of, not wanting to admin that I still use just the basic interface. It works afterall...... On the assumption that my colleagues won't be reading this, for those who blog regularly, do you use any particular software and if so, which one and why? I'm expecially interested to hear from you if the software works with Community Server which is the engine behind blogs.technet.com and also runs under Windows Server 2003.

posted Tuesday, April 19, 2005 9:01 AM by jhoward with 1 Comments

Virtual Server 2005 Solution Accelerator - a 'must read'

So what else good has come out of my "downtime" (yes, the restore is still running - 13% and counting slowly so far). Well, one thing which I really recommend you take a look at is the Solution Accelerator for Consolidating and Migrating LOB Applications which has kept my attention for several hours. This accelerator is a series of documents which gives you significant guidance when consolidating and migrating your Line of Business applications to Windows Server 2003, including the use of virtual machines technology under Virtual Server 2005.

posted Tuesday, April 19, 2005 7:46 AM by jhoward with 0 Comments

My reason for not backing up

Somewhat of a cynical post, but there's always a bright side to even the darkest of corners. So here's a "glass half full" reason why not to do a backup, or at least not to do a backup in the way I tried yesterday.

I run Windows Server 2003 on my main laptop (as many of you are probably bored of me reminding you). Unfortunately, certain vendors and their external USB/Firewire disks (who shall remain nameless) bundle badly skinned and functionally half backed software (IMHO) for backing up machines "easily". (Yes, there was supposed to be a hint of bitterness.) However, if you want to run their software under Windows Server, you're pretty much out of luck and have to do backups the harder or more conventional way (such as the ever present NTBackup.exe program built into Windows directly).

Me being me, I just had to try to run their bundled software anyway. I didn't do too badly with a bit of app compat, orca and sheer determination thrown in. Unfortunately, I ended up at a blue screen. Doh! Plan B was to install, on a spare 3GB partition, a bare minimal installation of Windows XP just to use their backup software. Dead simple - pop the disk in, install, reboot, SP2 it, patch it, add drivers for all the hardware, anti-virus, join the domain and you're there. Until, that it, you want to boot back to Windows Server 2003. No chance - no safe mode, hangs in logging startup mode, reboots continually.

Here's the bright side to this story and a valuable lesson should any of you attempt to install XP for dual boot AFTER Windows Server 2003 is already installed. Rule number 1 is to always put XP on first (or at least the oldest OS depending on what media and level of slipstreaming you have to hand). If you break rule 1, rule 2 is the fix up and detailed below.

- Boot into the working XP partition
- Start/Run cmd.exe
- N: (where N is the drive for the WS2003 installation)
- attrib -s -h -r ntldr
- attrib -s -h -r ntdetect.com
- copy ntldr ntldr.sav
- copy ntdetect.com ntdetect.com.sav
- Pop the WS2003 media into your cd/dvd
- copy e:\i386\ntldr c:\ (Confirm overwrite and replacing e: with your DVD drive)
- copy e:\i386\ntdetect.com c:\ (Confirm overwrite)
- attrib +s +h +r ntldr
- attrib +s +h +r ntdetect.com
- Start/Shutdown/Restart
- Boot into Windows Server 2003 :-)

In my case, this was only half the answer (in fact it still is - I'm in the middle of restoring 50GB of data as I write this and destined to wait at least another couple of hours), but if ever you try to dual boot, make sure you take the above on board first!!!

Oh yes, one other thing. Partition mirroring software is extremely worthwhile as a tool to have in your arsenel once you've dug an industrial sized hole to bury yourself in. But, you've probably guessed this one, the version I bought a long time back doesn't run under Server.... Sound familiar???

posted Tuesday, April 19, 2005 7:32 AM by jhoward with 1 Comments

Changing default number of machines users can add to a domain

Most of you know the limit of 10 times authenticated users can join machines to a domain. Upping the limit, or removing it is a very simple thing to do, however everytime someone asks me, I have to go back to look it up again. At least if I have it on my own blog, I'll know where to start looking next time.

The Active Directory attribute you need to change is mS-DS-MachineAccountQuota which is a property of the domain object. Here's the steps to change it:

- Start ADSI Edit (start/run/adsiedit.msc)
- Expand out the Domain node, right click on DC=<yourdomain>,DC=com and select properties
- Scan down to ms-DS-MachineAccountQuota
- Modify the value as appropriate, or clear the value to remove the limit entirely.

posted Monday, April 18, 2005 12:02 PM by jhoward with 3 Comments

Microsoft Knowledgebase is now available as an RSS feed

It had to happen - RSS everywhere, and this is another great example. The Help and Support site (http://support.microsoft.com) can now provide an RSS feed to your favorite RSS reader program with daily feeds of new articles relating to the products you are interested in. For more information, see this page http://support.microsoft.com/default.aspx/gp/rsshelp

To register for the service, use http://support.microsoft.com/selectindex/?target=rss and simply click on the links against the products you're interested in. Obviously, I've registered for all the platform topics I'm particularly interested, but had to include Halo 2 just in case... :-)

posted Saturday, April 16, 2005 5:56 AM by jhoward with 2 Comments

Virtual Server Deployment Manager

Virtual Server Deployment Manager (VSDM) provides a streamlined way to manage and deploy Virtual Machines. Using this tool, regular users (not just administrators) will be able to create and manage their own machines, without impacting other users' machines.

Thanks to Dugie to dropping me a line to tell me about version 1.3 of this product which was just released. This sounds pretty cool - I'll hopefully get a chance to play with it over the weekend or early next week to report back any tips or tricks. Please note though that this is an unsupported tool

Here's the download link
VSDM is written by Nelson Araujo. Check out his project home page here where there's lots of useful information.

posted Friday, April 15, 2005 1:54 AM by jhoward with 0 Comments

Microsoft Virtual Server 2005 Announcements

Yesterday was significant for two reasons. Two related announcements were made on microsoft.com regarding the support policy for those of you running microsoft applications in virtual environments. I am asked about this so often, and am frustrated by the answers I have had to previously give. No longer though.

One announcement defines the level of support PSS will provide should you raise a case with them regarding issues existing in virtual machines. The other announcement provides a list of what products are not supported has been published, why this is the case and when/if you are going to see these issues fixed.

Virtualisation is an area of technology that I am absolutely passionate about, and Virtual Server is a fabulous product to allow you to make virtualisation a reality. If you are not already aware of the benefits of virtualisation for consolidation, testing, rehosting or other scenarios that you may come up with yourselves, please take a few moments to browse through the wealth of information available at http://www.microsoft.com/windowsserversystem/virtualserver/default.mspx.

Here's the links to the announcments:

KB: 897613 Microsoft Virtual Server support policy
http://www.support.microsoft.com/kb/897613

KB: 897614 Windows Server System software not supported within a Microsoft Virtual Server environment
http://www.support.microsoft.com/kb/897614

By the way, if you have any war stories about how the use of virtualisation is saving you time and money, or even if it is causing you grief, please take a moment to drop me a line - either through a comment here or by contacting me directly through the link at the top of the page.

Have a check also on Paul Adare's blog for more information. Paul will be running sessions at TechEd US this year for Virtual Server.

posted Thursday, April 14, 2005 5:27 AM by jhoward with 1 Comments

Backing out overdone Software Restriction Policies

One of the things about playing with Software Restriction Policies is that you can go too far and end up not being able to do anything to rectify the situation. Active Directory Group Policy applied through a link to an OU is easy enough to fix - simply remove the GPO link and reboot the client. However, if you are experimenting with Local Policy, you can come unstuck. To resolve this: Boot into safe mode and logon as the local administrator. Start up the registry editor and remove all values beneath the HKLM\Software\Policies\Microsoft\Safer\CodeIdentifiers. On a reboot, everything should be back to normal.

posted Wednesday, April 06, 2005 8:11 AM by jhoward with 0 Comments

Windows Server System Reference Architecture (WSSRA)

Version 1.1 of the WSSRA was released to the web for download this morning. The WSSRA deliver architectural guidance on enterprise level IT infrastructure.

Download from http://www.microsoft.com/downloads/details.aspx?familyid=d44e34ec-b4e2-49a1-9f40-9ed4ba3765df&displaylang=en

Overview

Windows Server System Reference Architecture is a technology architecture that has been rigorously tested and proven in a partnered lab environment to provide exceptional planning and implementation guidance that addresses fundamental infrastructure issues such as availability, security, scalability, and manageability of the platform.

WSSRA consists of the following downloadable packages:

Overview Documents
Architecture Blueprints
Implementation Guides
Deployment Toolkit

The Overview Documents provide the supporting information that will aid the understanding of the documentation set and ensure its most effective use within IT infrastructure. The documents included in this download package are as follows:

Getting Started
Introduction
Lab Implementation

Architecture Blueprints provide IT professionals with a common understanding of overriding principles prior to leveraging guidance on specific IT services. This download package includes the following:

Introduction to Architecture Blueprints
Network Architecture Blueprint
Management Architecture Blueprint
Application Infrastructure Architecture Blueprint
Security Architecture Blueprint
Storage Architecture Blueprint

The Implementation Guides provide fully integrated sets of service-specific guidance for each of the services covered as part of WSSRA. Each implementation guide package contains an introduction document, a service blueprint, a planning guide, a build guide, and an operations guide.

The Deployment Toolkit provides all of the low-level scripts, plans, and configuration settings used to build the environment that was used to establish and test the Windows Server System Reference Architecture. The download package contains the following:

Build Order Project Plan
Equipment Configuration Matrix
Low Level Diagram of Services and Components
Equipment and Software List
Test Scripts
Build Scripts
Setup Information

posted Monday, April 04, 2005 6:17 AM by jhoward with 0 Comments

Windows Server TechNet major update

So many announcements in one day. To coincide with the launch of Windows Server 2003 SP1, the Windows Server 2003 TechCenter (TechCentre when spelt correctly) has been significantly revamped to include all the latest information. If you haven't seen this site before, I urge you to take a look. Essentially this is a core library of technical documentation for IT Pros.

As of today, three language versions are available:

- English: www.microsoft.com/technet/prodtechnol/windowsserver2003/default.mspx
- German: www.microsoft.com/technet/prodtechnol/windowsserver2003/de/default.mspx
- Japanese: www.microsoft.com/technet/prodtechnol/windowsserver2003/ja/default.mspx

posted Thursday, March 31, 2005 7:33 AM by jhoward with 0 Comments

Windows Server 2003 x64 and Windows XP Professional x64 go RTM

In addition to the SP1 release of Windows Server 2003 the x64 versions of Windows Server 2003 and XP Professional have been released to manufacturing. These release are for processors including the AMD Opteron and Athlon 64, and the Intel Xeon and Pentium 4 processors with EM64T (Extended Memory 64 Technology).

For more information, see the x64 home page at http://www.microsoft.com/windowsserver2003/64bit/x64/default.mspx

posted Wednesday, March 30, 2005 5:36 PM by jhoward with 0 Comments

Small Business Server (SBS) 2003 SP1 availability

In line with the announcements for Service Pack 1 for Windows Server 2003 today, another important announcement was made regarding SP1 for Small Business Server 2003. SP1 for SBS2003 will be available approximately 60 days from today, and will include a rollup of the latest service packs and updates for SBS 2003 and its product components.

Some of the updates will include

- Windows Server 2003 SP1
- Sharepoint Services SP1
- Exchange Server 2003 SP1
- Outlook 2003 security fixes and junk email filters
- SQL Server 2003 SP4

The home page for SBS 2003 is here

posted Wednesday, March 30, 2005 5:36 PM by jhoward with 0 Comments

Windows Server 2003 SP1 for x86 and Itanium is now available

Just released to the web is the a significant release for the Windows Server 2003 platform in the shape of Service Pack 1 for x86 and Itanium. SP1 adds many new features and enhancements primarily in the area of security. If you haven't had a chance to play with the release candidates in a lab environment yes, here's some of the really great features

The PSSU (Post Security Setup Updates) on clean builds and NT4 upgrades ensures that servers are secured from network vulnerabilities by being secured with the latest security patches at the time of initial installation.
The SCW (Security Configuration Wizard) configures server security based upon existing server roles. It uses XML based templates to close un-necessarily open ports and services - akin to boarding up open doors. Being XML based, you can "roll your own" if servers have additional specific roles within your environment.
The Windows Firewall builds on the Internet Connection Firewall and is now present in the server platform. Of course, it can configured through group policy which is a great advantage.

There's several other changes which increase security such as IIS 6 Metabase audition, and the addition of Network Access Quarantine Control components out of the box to isolate out-of-date VPN assets.

Of course, for those of you like me who run Windows Server 2003 on your primary "workstation", having Windows Media Player 10 is also a great bonus...

Links

The home page for SP1 on Microsoft.com is here

SP1 x86: http://www.microsoft.com/downloads/details.aspx?FamilyId=22CFC239-337C-4D81-8354-72593B1C1F43

SP1 Checked Build x86: http://www.microsoft.com/downloads/details.aspx?FamilyId=F07A5E49-4A13-42CB-898B-278A8B287E16

SP1 Itanium: http://www.microsoft.com/downloads/details.aspx?FamilyId=890C5C44-815C-45BD-8B08-4FE901BB8FDF

SP1 Checked Build Itanium: http://www.microsoft.com/downloads/details.aspx?FamilyId=C45F733E-A206-432A-87E2-65A08276FB43

In addition, if you have any questions about SP1, I'll be doing a webcast on 10th May at 14:30 GMT. You can register for this event at https://msevents-eu.microsoft.com/cui/WebCastEventDetails.aspx?culture=en-GB&eventid=118758410.

posted Wednesday, March 30, 2005 3:34 PM by jhoward with 1 Comments

Server Performance Advisor - the Performance Diagnostic tool for Active Directory and IIS

Following a recent Technet session, I was asked where you can download adpref.exe (an Active Directory Performance tool) from. Confession - I didn't know the answer and no amount of searching turned over any stones. It turns out that adperf was an internal diagnostic tool believed not ever made available for public download even though it was mentioned in the Windows 2000 Active Directory Operations Guide...

An excellent alternative tool which is far more customer friendly is the "Server Performance Advisor" available for download at http://www.microsoft.com/downloads/details.aspx?familyid=61a41d78-e4aa-47b9-901b-cf85da075a73&displaylang=en. Server Performance advisor if far more capable than ADPerf, and also helps diagnose performance problems for IIS 6.0.

posted Wednesday, March 23, 2005 10:45 AM by jhoward with 1 Comments

Windows Server Update Services (WSUS) Release Candidate is now available

Someone made a more appropriate choice of name (thankfully!) given some of the alternatives which have been on the table over the past few months. The next version of SUS (Software Update Services) will be officially called Windows Server Update Services (WSUS), or simply Update Services for short.

Updates services is a free of charge update for licensed users Windows 2000 Server and above, intended for all businesses from small through to enterprise to be able to update Microsoft Software. Here's the link to download the release candidate of WSUS which was made available for public download last night. There is also some great documentation at this link for deployment, operations and a step-by-step guide.

WSUS is a huge step forward over SUS and I cannot recommend enough that you take a look at this technology if you haven't already done so. One cautionary note to though currently on the older WSUS Beta 2 release - you should upgrade to the RC as soon as possible as Beta 2 is no longer receiving any new updates.

posted Wednesday, March 23, 2005 10:32 AM by jhoward with 0 Comments

MIIS Alliance formed

A great day for identity management and the MIIS product! The reason - five leading companies, NetPro, Oblix, Oxford Computer Group, PointBridge and Vintela recently announced the formation of the "MIIS Alliance" - a consortium of industry-leading software and services companies that tailor and extend the benefits and functionality of Microsoft Identity Integration Server (MIIS). For more information about the alliance, see their site at http://www.miis-alliance.com

posted Friday, March 18, 2005 12:40 PM by jhoward with 0 Comments

Post domain migration - removing sidHistory

After a successful domain migration, you may be in a situation where it is necessary to remove the sidHistory attributes from objects in your new domain. There are many ways to do this, and many migration tools provide that capability straight out of the box. You could of course use something like ADSIEdit to manually edit each object, but this can be time consuming if there are more than a handful of objects to update.

I've just been through the process of a domain migration on my home setup, and being a bit of a scripting junkie didn't want to go through a manual update process (even though there were only five accounts being migrated). I used a variation of the script in knowledgebase article 295758 which performed the job admirably. Admittedly, it took me longer than a manual migration would have done when there were only five accounts, but if you're in the hundreds or even thousands, this script could save you a lot of time.

posted Friday, March 18, 2005 9:50 AM by jhoward with 1 Comments

Managing your windows websites and web services

If part of your job entails monitoring and management of Windows Websites and Web Services hosted on Windows Servers and are using MOM to manage that environment, take a look at the latest version of the free management pack download "Microsoft Web Sites and Web Services Management Pack for MOM 2005". http://www.microsoft.com/downloads/details.aspx?FamilyId=53BC39B6-756B-4F01-B0D2-A8CA9751011F&displaylang=en

posted Tuesday, March 15, 2005 9:50 AM by jhoward with 0 Comments

Application Compatibility Toolkit 4.0 (ACT) released for download

The latest version of the ACT was released at the end of last week for free download.

Overview
The Microsoft Application Compatibility Toolkit (ACT) version 4.0 for Windows XP, including Service Pack 2, and Windows Server 2003 contains the tools and documentation you need to evaluate and mitigate application compatibility issues before deploying on these platforms. Tools include the latest versions of the Microsoft Application Analyzer that simplifies application inventory and compatibility reporting, the Internet Explorer Compatibility Evaluator that assists testers in locating compatibility issues with Internet Explorer on Windows XP Service Pack 2, and the Compatibility Administrator that provides access to the necessary compatibility fixes to support legacy applications in Windows

Download link: http://www.microsoft.com/downloads/details.aspx?FamilyID=d7d08414-0136-492f-9ad9-ce8aeb7500c7&DisplayLang=en

posted Monday, March 14, 2005 1:42 PM by jhoward with 1 Comments

limitlogon - new download to stop concurrent active directory logons.

My eyes nearly popped out of their sockets this morning. I was discussing this very problem with some colleagues only a couple of weeks ago and pretty much concluded that this is a very difficult problem to solve easily. Low and behold though, into my inbox popped a message about a tool now released onto microsoft.com to address this very issue. Although I haven't had a chance to play with it yet (this is really hot off the press), it isn't bullet proof as identifying concurrent logons where users can logon offline and in distributed environments with slow or intermittent WAN links is incredibly difficult.

Architecturally, there are three components to this download package: On the client, a login script and logoff script connects to a web-service which in turn communicates with an active directory partition holding the limitlogon information. Hence, you'll need an IIS server (to host the web-service) and a mechanism to deploy the client scripts (eg Group Policy or SMS).

Here's the download link - when downloaded and run, the installation files for Active Directory, IIS and the client, plus a help file documenting the process are expanded out. http://download.microsoft.com/download/f/d/0/fd05def7-68a1-4f71-8546-25c359cc0842/limitlogin.exe

posted Monday, March 14, 2005 11:53 AM by jhoward with 2 Comments

Active Directory diagnostic event logging in Windows Server

I mentioned at last nights "Active Directory Diagnosis Troubleshooting and Recovery" Technet session how to turn NTDS diagnostic logging on which causes the KCC to write events to the event log. All the information plus more besides is published in Knowledgebase article 314980.

posted Friday, March 11, 2005 8:40 PM by jhoward with 0 Comments

Active Directory Database monitoring using ESENTPRF.DLL

One of the demonstrations at last nights "Active Directory Diagnosis, Troubleshooting and Recovery" Technet session included the steps to install esentprf.dll to allow monitoring of performance counters for the extensible storage engine (ESE) database underlying Active Directory. The steps to complete this can be found in Chapter 9 of the Windows 2000 Server Active Directory Planning and Deployment Guide - post deployment monitoring of domain controllers. Although this document was written for Windows 2000, the procedure outlined works just as well for Windows Server 2003 as you saw. Here's the link.

posted Friday, March 11, 2005 8:41 PM by jhoward with 0 Comments

Extending the Active Directory schema

There are occasions when you need to extend the Active Directory schema for applications. Besides the best practice of test, test and test again, and the alternative of using ADAM (Active Directory in Application Mode) to avoid changes to your corporate schema, sometimes needs must. In these occasions, you should apply for unique OIDs (Object IDs) which can be done through MSDN at Microsoft where you can have OIDs registered guaranteed to be unique in the microsoft.com namespace. You can of course register OIDs in your own namespace too.

Follow these links to find out more: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ad/ad/obtaining_an_object_identifier.asp and http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ad/ad/extending_the_schema.asp

posted Wednesday, March 09, 2005 4:59 PM by jhoward with 2 Comments

Remote access solution deployed at Microsoft

A webcast coming up on 29th March at 9AM PST (5PM GMT) caught my eye as remote access is something I quite often get asked about, and also recently setup for my home network (although probably not as securely as the Microsoft internal solution). Being able to VPN back into home when on the road is pretty cool for sure. The webcast is about how Microsoft enhanced the remote access service to build the corporate access solution deployed internally at Microsoft. The full brief is below:

"How can you improve the remote access security in your Windows-based IT infrastructure? Join this webcast to learn how Microsoft IT has dealt with remote access security with the latest generation of Microsoft products - Windows XP Professional, Windows Server 2003, Internet Authentication Service, Internet Security Accelerator 2004, Microsoft Operations Manager 2005, SQL Server 2000, Public Key Infrastructure & Certificate Services, and Connection Manager. The solution deployed, called Secure Remote User (SRU), enables Microsoft IT to manage specific remote desktop configurations, ensuring that all established security requirements are met when remote users access corporate network resources."

The registration URL is http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032268556&Culture=en-US

posted Wednesday, March 09, 2005 4:43 PM by jhoward with 4 Comments

Common mistakes when upgrading domains from Windows 2000 to Windows Server 2003

In my line of work, I talk to lots of people about the "hows" of upgrading to the latest and greatest technology. Consequently, I've referred many people to the link below which is a great source of tips and links to other information worth considering when upgrading your domain from Windows 2000 to Windows Server 2003. It's had a recent refresh, so I recommend a re-visit if your upgrade is pending.

http://support.microsoft.com/Default.aspx?id=555040

posted Tuesday, March 01, 2005 2:34 PM by jhoward with 1 Comments

Stretching Directory Boundaries, Cross Platform Identity Management, Authentication and Security

These are all critical pain topics among enterprises the world over. Fear not though (at least if you're UK based). You are guaranteed a fantastic learning opportunity by attending one of two all-day events presented by John Craddock and Sally Storey. These days are crammed full with detail, demos and real world how-tos. The sessions are billed at "400" level - you won't be disappointed.

If you are a system architect, a system integrator or senior administration, you should not miss this rare opportunity to spend a whole day interacting with industry experts and peers. You will find out about how to support multiple directories in your organisation, provisioning using MIIS, ADAM, Windows/Unix interoperability and identity federation.

These are no-cost events to attend. The events are on 7th April 2005 in Reading and 17th May 2005 in London (click date to go to the registration site).

posted Thursday, February 24, 2005 11:54 AM by jhoward with 2 Comments

Killing winlogon.exe remotely

No, not usually a good idea, I know. However, I was asked last night a "what would happen if...." question. Using taskkill, the process is identified as a critical system process. However, if you use pskill from sysinternals to kill winlogon on a remote box, I got an immediate unclean re-boot. Now you know!

posted Wednesday, February 23, 2005 2:58 PM by jhoward with 2 Comments

WMIC Samples

As promised, here are the sample WMIC commands I demonstrated in the Automating Windows Server 2003 session yesterday evening in Reading. Hope they are useful to you.

Update static IP address
wmic nicconfig where index=9 call enablestatic("192.168.16.4"), ("255.255.255.0")

Change network gateway
wmic nicconfig where index=9 call setgateways("192.168.16.4", "192.168.16.5"),(1,2)

Enable DHCP
wmic nicconfig where index=9 call enabledhcp

Service Management
wmic service where caption="DHCP Client" call changestartmode "Disabled"

Start an application
wmic process call create "calc.exe"

Terminate an application
wmic process where name="calc.exe" call terminate

Change process priority
wmic process where name="explorer.exe" call setpriority 64

Get list of process identifiers
wmic process where (Name='svchost.exe') get name,processid

Information about harddrives
wmic logicaldisk where drivetype=3 get name, freespace, systemname, filesystem, size, volumeserialnumber

Information about os
wmic os get bootdevice, buildnumber, caption, freespaceinpagingfiles, installdate, name, systemdrive, windowsdirectory /format:htable > c:\osinfo.htm

Information about files
wmic path cim_datafile where "Path='\\windows\\system32\\wbem\\' and FileSize>1784088" > c:\wbemfiles.txt

Process list
wmic process get /format:htable > c:\process.htm

Retrieve list of warning and error events not from system or security logs
WMIC NTEVENT WHERE "EventType<3 AND LogFile != 'System' AND LogFile != 'Security'" GET LogFile, SourceName, EventType, Message, TimeGenerated /FORMAT:"htable.xsl":" datatype = number":" sortby = EventType" > c:\appevent.htm

posted Wednesday, February 23, 2005 9:54 AM by jhoward with 4 Comments

Access Based Directory Enumeration - markshareforABDE.exe utility download

Following the myriad of emails I received, here's a link to markshareforABDE.exe as used in my blogcast about Access Based Directory Enumeration a few days ago. Many thanks to DuWayne Harrison at Microsoft in the US, the author of this tool for giving his permission to make this available. Please be aware that there is absolutely no support from PSS and all standard disclaimers apply as per resource kit tools. In other words, any use you make of this utility is entirely at your own risk.

Usage is straightforward: markshareforABDE <sharename> 0|1 [servername] where 0=off and 1=on

posted Tuesday, February 22, 2005 3:19 PM by jhoward with 3 Comments

Shared Networking (NAT) workaround in Virtual Server 2005

Following the Virtual Server technical overview event I presented in Manchester yesterday evening, I was asked about Shared Networking (NAT) which is present in Virtual PC 2004, but not in Virtual Server 2005 and whether there was a way to provide this through an alternate mechanism. Here's the answer:

Add a loopback adapter to the host (KB article link) and create a new virtual network under Virtual Server administration bound to the new adapter. You then enable Internet Connection Sharing (ICS) on the host NIC connected to the physical network.

posted Wednesday, February 16, 2005 2:31 PM by jhoward with 2 Comments

Blogcast on Security Configuration Wizard (SCW) in Windows Server 2003 SP1

The Aussies beat me to this one. If you want to find out more about the Security Configuration Wizard (SCW) new to Windows Server 2003 SP1, take a look at this excellent blogcast by Michael Kleef, a colleague and IT Evangelist from MS Austrialia. Nice one Michael.

posted Monday, February 14, 2005 5:05 PM by jhoward with 0 Comments

Windows Server 2003 as a client, MSN Toolbar Suite and Orca

I'm going to have eat a few of my own words now... I blogged in December about the "IT Pro" way of getting an unsupported program to install on a Windows Server box without a hint of an SDK in site. I relent, the Orca tool is the best tool for the job, not appcompat. Here's why.

If like me, you almost exclusively run Windows Server 2003 as a client, you can lose out on too many things. Yes, SP1 introduces Media Player 10 and some other cool stuff from XP SP2 (yippee), but at the brass tacks level, you all want things like the MSN Toolbar suite, powertoys and all the other goodies.... The method I'm going to show you is pretty well bullet-proof, and will cater for a lot more than just the toolbar suite, especially if the product group removes the highly known-about TBSDEVCODE workaround from their installer, which they almost certainly will before it goes gold.

When I wrote my previous blog, I was running the SP1 first release candidate of Windows Server 2003 on my laptop. As many of you discovered, the appcompat method was a bit troublesome on the RTM, and certainly didn't work for many programs. I tend to play around far too much, and ended up breaking that OS installation. If you know me, I do this far more regularly than is healthy. On the bright side, I rarely actually need to activate the OS :-) For now though, I'm now back at RTM build and with demo's next week in the pipeline, can't afford to break it quite yet. I wanted to get a chance to play with the MSN Toolbar Suite, which is particularly relevant as it had another beta refresh very recently.

What you'll need is the GUI tool, Orca, from the Platform SDK. Note that you'll have to use the XP SP2 Platform SDK installer, and select just the Windows Installer SDK Tools. You won't need anything else. When the installer opens, set the options to match the screenshot below.

Download the MSN Toolbar Suite and save it somewhere on your hard disk. Note that this is an EXE which introduces one slight complication - you'll need to unpack it. If you just run the .exe from the command line, all the parameters are given to you on a plate.

Assuming you saved the .exe on the C root directory, run "c:\MSNToolbarSuiteSetup_en-us /T:c:\temp /C". This will extract a setup.exe and an MSI file into the temp directory. Note that if the directory doesn't already exist, it will be created for you. Next you need to fire up Orca which will be under your start menu. You just knew they'd use a dolphin for the icon. Once Orca is running, select File/Open and navigate to the MSI file in your temp directory. On the tree on the left, click on LaunchCondition to see a number of options displayed on the right. Now you can see why the TBSDEVCODE workaround works in the Beta.

Change the following setting from "(REMOVE="ALL") OR ((VersionNT>=500) AND ((WindowsBuild<>3790) OR (TBSDEVCODE=1)))" to "(REMOVE="ALL") OR ((VersionNT>=501) AND ((WindowsBuild<>3790) OR (TBSDEVCODE=1)))" - ie change 500 to 501. Finally select file/save and quit Orca.

That's all there is to it - just run the updated MSI to install. MSN Toolbar Suite is just so fantastic - I know there's a lot of talk on the Internet about it, but I'm finding that just after a few days of use, it's invaluable. That's for another blog, but I hope you found this walkthrough useful. [Disclaimer....] Just remember that you'll obviously be doing something absolutely unsupported, and there may be licensing issues relating to the Platform SDK which you should check up on before doing this.

posted Friday, February 11, 2005 2:45 PM by jhoward with 6 Comments

Blogcast: Access Based Directory Enumeration (A Windows Server 2003 SP1 New Feature)

Find out about one of those really cool new features of Windows Server 2003 SP1, Access Based Directory Enumeration in this latest blogcast recording. In a nutshell, ABDE causes the server to examine access rights to sub-directories on a share, only showing the user those directories to which they have access. If you want to find out how this works in under 4 minutes, click here to view.

Currently there is no capability from the GUI to turn this feature on - unfortunately you'll need to use Win32 APIs. Maybe this will change at a future date, but for now you'll probably need a developer buddy to help you... :-) They will need to know the following: The specific API is NetShareSetInfo, and specifically setting a flag to enable ABDE that points to a SHARE_INFO_1005 structure. The flag value for Access Based Directory Enumeration is #define SHI1005_FLAGS_ENFORCE_NAMESPACE_ACCESS 0x0800.

Update 30th March 2005 - Here's the link to be able to download the tool. I'm reliable informed that a whitepaper and the tool will be on microsoft.com soon. http://blogs.technet.com/jhoward/archive/2005/02/22/378033.aspx

So far, I haven't had any success trying to set this property through the ADSI IADsFileShare object, or even sure that it is possible. If you get there before me, please let me know! Unfortunately, you can't hide shares using this mechanism - there's still just the old "$ suffix" trick. Remember, if this is important to you, you can use the windows server feedback site.

Edited by John: 3rd Nov 2005 - Rehosted WMV file

posted Friday, February 11, 2005 3:58 PM by jhoward with 11 Comments

Windows Server 2003 SP1 RC2 (Build 3790, v1433) released

The second release candidate (aka RC2) for Windows Server 2003 SP1 has now been released to the web.

x32 download link: http://www.microsoft.com/downloads/details.aspx?familyid=02734CEA-7A4B-4D95-B220-8E1708C3ED46&displaylang=en

IA64/Itanium download link: http://www.microsoft.com/downloads/details.aspx?familyid=9514DA0A-44C9-4FCB-83CA-473741D2613D&displaylang=en

The home page for the Technical Preview Program is here where you can find links for a technical overview, features and functionality changes, networking features and release notes.

posted Wednesday, February 09, 2005 7:21 AM by jhoward with 5 Comments

Scriptomatic (revisited)

The Scripting Guys released version 2 of their "Scriptomatic" tool a couple of weeks ago. Don't be put off by the somewhat frivolous name - it has some very true value. One such example I frequently use is for the WQL queries in WMI filters when building Group Policy Objects - this tool saves a lot of effort. The sequel is a completely new. However, this time, it doesn't write just VBScript, it can output in Perl, Python and JScript. Go take a look - you'll be glad you did. It works from Windows 98 right through to Windows 2000 (but you'll need to install WMI 1.5 Core for 98/NT). Oddly though, Windows Server 2003 isn't in the list of supported operating systems for Scriptomatic. I can confirm it works for me under WS2003 so far. Odd!

Here's the download link.

posted Monday, February 07, 2005 8:42 AM by jhoward with 2 Comments

How-To install a certificate for SSL Encryption under IIS

Following on from my post a couple of days ago about using MakeCert to generate a self-signed certificate, this is one way in which you can test that the generated certificate is working correctly for SSL authentication within IIS. It was almost worthy of a blogcast (BTW, congratulations Mike for joining in the fun), but given I've all but lost my voice at the moment, here's the old fashioned way.

Create a new folder such as c:\test, and within it, create a new default.htm file using notepad. The content doesn't matter, but here's a very simple example
<BODY>
This is my SSL protected site
</BODY>
Start Internet Information Services (IIS) Manager from the Administrative Tools folder
(I'm going to lead you through creating a new web-site, although I could assign the certificate to the default web-site)
Right-click on Web-sites and select New Web-Site
Follow through the wizard. When you get to "Description", enter the name "Test"
Keep going through the wizard, and enter c:\test on the path step
On the newly created site, right-click and select properties and select the Directory Security tab
Click Server Certificate and work your way through the wizard
Select Assign an existing certificate
Select your newly created certificate
Choose port 443 (default SSL port)
Click Next/OK to finish the wizard and exit the site properties.
Currently the web-site is stopped. Right click the Test web-site and choose start
Open a browser and go to https://jhoward-5160/test, replacing jhoward-5160 with your machines DNS name. Note the MSN Toolbar :-)
Double-click the padlock icon in the bottom right to view the certificate for your site

Congratulations! If everything works this far, you have managed to create and protect a test web-site using SSL encryption and a self-signed certificate generated using MakeCert.exe

Photo-album on MSN Spaces

posted Friday, February 04, 2005 8:56 AM by jhoward with 1 Comments

How-to boost Microsoft Virtual Server 2005 Guest Performance

One very easy win to gain fairly significant extra performance from your Virtual Server 2005 guest Virtual Machines is to use virtual SCSI disks instead of virtual IDE disks. Of course, a physical fast I/O subsystem on the host is going to make a far bigger difference, but you're probably not likely to be able to do that "on the cheap" (especially in a test/dev situation).

Lets assume you started with a Windows Server 2003 virtual machine, for example, and built it originally using Virtual PC 2004 for example. Virtual PC 2004 does not support virtual SCSI disks or virtual SCSI adapters, so the virtual disk in your machine will be IDE connected. This equally as well applies if you built a VM using default settings under Virtual Server.

Go into the Virtual Server administration Console and add the existing virtual machine.
Select "Edit Configuration" from the Master Status
Click SCSI Adapters
Click Add SCSI Adapter and OK to the default settings
Start your virtual machine and logon. You need to ensure the Virtual SCSI adapter (emulating an Adaptec AIC-7870 PCI SCSI Card) is recognised in your virtual machine. The process will vary from operating system to operating system. (To make this work for me in a Windows 2003 Server SP1 Release Candidate VM, I had to uninstall and reinstall the VM additions). There is further guidance on how to do this in the administrators help file installed locally.
Edit the boot.ini
    Start/Run/cmd
    c:
    cd \
    attrib -s -h -r boot.ini
    notepad boot.ini

Look for the line under the [operating systems] section with an IDE ARC Path starting something like multi(0)disk(0), and create a copy of it. On the newly copied line, change the "multi" to "scsi" and update the comment to identify the SCSI boot option clearly.

Warning! In case something goes wrong, I very strongly recommend you do not change the default boot option or the existing boot options. Just add an additional line. This will allow you to revert back if something does go wrong.

Here's an example of my new boot.ini for the Windows Server 2003 (SP1 RC) guest, with the line highlighted in blue being the one I added.

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows Server 2003, Enterprise" /noexecute=optout /fastdetect
scsi(0)disk(0)rdisk(0)partition(1)\WINDOWS="SCSI Windows Server 2003, Enterprise" /noexecute=optout /fastdetect

Don't forget to reapply the correct attributes to the boot.ini file using "attrib +s +h +r boot.ini"
Shutdown the guest virtual machine.
In the Virtual Server Administration, edit the configuration for the guest and edit the hard disks settings
From the Attachment drop-down, use SCSI 0 ID 0 rather than Primary channel (0)
Restart your Virtual Machine, and from the boot menu, select the new "SCSI" option.

If everything goes OK, your VM will boot as normal with no impact, except that you'll have better disk I/O performance. If you're happy with the changes, you can re-update boot.ini to remove the old IDE boot option, and change the default option in this file to match. Bear in mind that you will no longer be able to revert this virtual machine to Virtual PC 2004 without backing out these changes.

I know someone will ask how much performance gain you get. There aren't any currently any official statistics I know of, although the Virtual Machine Program Manager, Ben Armstrong has previously stated that the main advantage of using SCSI virtual disks over IDE is that it runs the optimised SCSI driver as part of the VM additions. This in turn avoids a lot of the emulation overhead.

Photo-album on MSN Spaces

posted Thursday, February 03, 2005 2:51 PM by jhoward with 7 Comments

How-to use MakeCert for trusted root certification authority and SSL certificate issuance

I wasn't originally going to blog this, but my colleague, Mat, and I were discussing encryption late last night. Mat was specifically interested in its use for security traffic in the context of SQL Reporting Service, but we got massively sidetracked and ended up talking about IPSec, MAPI and all sorts of other things along the way. Interesting, none-the-less.

One thing Mat wanted to demonstrate was the use of a certificate for encrypting traffic between a SQL Reporting Server and a back-end database. Why not install a certificate server, he said. My retort was that he was probably barking if this was just for a simple demonstration.... :-) (You're not, really Mat. Honest!) Hence, one topic along our way was how to use MakeCert.exe to demonstrate SSL encryption. Rather than me show him and get it written down, what better way than to blog it. Makes sense, right? Spookily just last week I was reminding myself about how to use the makecert.exe utility (download link at the bottom) to generate a self-signed certificate for a completely different purpose. However, definitely a subject for another day and besides, I never did succeed in that particular goal :-(

MakeCert.exe allows you to (for test/dev purposes) generate both a trusted root certificate and a certificate signed by that trusted root certificate for encryption purposes (also for signature purposes, but that wasn't relevant in this context). In this way, you can create a test/dev web-site, for example, with SSL encryption enabled. Follow these simple steps if this is something you need to do. I'll follow up later with an example of how you would use these generated certificates to SSL-enable a very simple web-site under IIS 6.

From the command prompt, in the directory where you downloaded makecert.exe, enter all the green bits below on a single line (ie exclude my comments in the right-most column).

makecert	-pe	Exportable private key
	-n "CN=Test And Dev Root Authority"	Subject name
	-ss my	Certificate store name
	-sr LocalMachine	Certificate store location
	-a sha1	Signature algorithm
	-sky signature	Subject key type is for signature purposes
	-r	Make a self-signed cert
	"Test And Dev Root Authority.cer"	Output filename

You will now have a "Test And Dev Root Authority.cer" certificate on disk and a new certificate will also be installed in the LocalMachine Certificate store. If you run up a Certificates MMC at this point, you will be able to see this. However, by default, the Certificates snap-in isn't available as a short cut. Hence, use the following steps:

Start/Run/MMC
File/Add-Remove Snap-In
Click Add
Select Certificates and click Add
Select Computer Account and hit Next
Select Local Computer
Click Close
Click OK

If you expand the console out to Personal/Certificates, you will see your newly created certificate as in the screen shot below.

Now that you have a root certificate, you need to use this certificate (at least the .cer file which is still present on your hard-disk) to sign another certificate you are going to use for encryption purposes. From the command prompt, enter the following

makecert	-pe	Exportable private key
	-n "CN=jhoward-5160"	Full DNS name of the target machine. Note that in this example, I am running a machine with the NetBIOS name "jhoward-5160" which is not a member of a domain. Hence, the full DNS name really is this. Replace this as appropriate. e.g. CN=mycomputer.company.com
	-ss my	Certificate store name
	-sr LocalMachine	Certificate store location
	-a sha1	Signature algorithm
	-sky exchange	Subject key type is for key-exchange purposes (i.e. Encryption)
	-eku 1.3.6.1.5.5.7.3.1	Enhanced key usage OIDs. Trust me on this :-)
	-in "Test And Dev Root Authority"	Issuers certificate common name
	-is MY	Issuers certificate store name
	-ir LocalMachine	Issuers certificate store location
	-sp "Microsoft RSA SChannel Cryptographic Provider"	CryptoAPI providers name
	-sy 12	CryptoAPI providers type
	jhoward-5160.cer	Output file - replace and name as appropriate.

Go back to the certificates snap-in, right-click the "Test and Dev Root Authority" certificate and copy it to the "Trusted Root Certification Authorities" node. Once done, if you expand this node, and then select certificates your newly created root cert should be present.

If you whizz back to the personal certificates in this snap-in, you also note that your new certificate suitable for encryption purposes is installed, as highlighted in the screen-shot below.

If you double-click the certificate, verify that you have a private key that corresponds to this certificate, and that the intended purpose is to ensure the identity of a remote computer.

At this point, you can safely delete the "Test And Dev Root Authority" certificate from the personal certificate store in the MMC snap-in. Remember also that you can save the two .cer files on disk safely away to save you remembering all the above parameters for makecert.exe. You can simply use the "All Tasks/Import" wizard in the MMC snap-in instead (assuming that the DNS name of the target machine matches).

Download makecert.exe from microsoft.com here

Oh the fun of after-work conversations.... Hope this is useful for you

Photo-album on MSN Spaces

posted Wednesday, February 02, 2005 11:26 AM by jhoward with 2 Comments

The future of the Windows-centric IT Pro?

I looked at Monad briefly a couple of months ago - after all it's still a reasonably long way off yet, probably in the Longhorn timeframe. However, there's been a couple of articles just posted on the Internet looking at the future of "shell scripting" (forgive borrowing the Unix terminology) in Windows, for example here on WindowsITPro and here on RedmondMag.

Even though I'm probably now leading myself down a path where I'm going to be flamed from all sides...... where as I see Monad as a huge benefit in the long term, my concern has to be that it is going to scare the wits out of most Windows-centric IT Pro's in the community at large - this is drawing a very thin line between developers and IT Pros. Although somewhat generalising, it is (in my humble opinion) reasonably well accepted that many *nix administrators are comfortable understanding or authoring complex shell scripts, and further, most have a reasonable understanding of writing at least simple programs in C/Perl/PHP etc. My experience tells me that most Windows IT Pros try very hard to shy away from these types of skills.

So, a few thoughts/questions for to throw out for comment...

Where do you see the skill sets of IT Pros heading in the future. Windows has gone a long way with GUIs making point and click management tasks easier, but are we all going to have to get to grips with the developer 'dark'-side as well?
How many Windows IT Pros have at least one command prompt permanently open on their desktop today?
How comfortable would you feel if you were told you have to understand the .Net framework and all that goes with it to perform your job in the future?

posted Tuesday, February 01, 2005 12:00 PM by jhoward with 6 Comments

Blogcast on Install from Media - Promoting a Branch Office server to Domain Controller

For this series of four Blogcast recordings, I've reproduced a demonstration I did for a Technet Evening Session entitled "The New Features of Windows Server 2003" a few days ago. The particular feature is called "Install from Media", and is useful when you need to install a Domain Controller in a Branch Office or remote site, but have limited bandwidth for connectivity. If you were to install a domain controller in the normal manner, and allow AD/FRS replication occur, it could significantly impact your network pulling across gigabytes of data over a small link.

Install from Media first requires a backup of the system state from an existing Domain Controller	View (2:08)
The .bkf file is copied to CD/DVD/Tape and shipped to the remote site and restored to disk. The .bkf file is expanded to it constituent parts.	View (1:55)
DCPromo /adv is run to promote the member server to a domain controller using the system state backup files	View (2:48)
A new site is created in Active Directory (if not previously created) and the AD topology updated to move the new domain controller into that site.	View (1:27)

There is further information on this topic on the Microsoft Knowledge-Base and Daniel Petri also has an excellent write-up about this on his site (plus a stack of other useful info).

They say a picture speaks a thousand words, so how many words does a recording with pictures and words speak? Please let me have your feedback about these style of recordings - whether you love them, loath them or neutral? What else would you like to see recordings of?

Edited by John on 3rd Nov 2005 - Rehosted WMV files.

posted Monday, January 31, 2005 10:23 AM by jhoward with 2 Comments

OS/2 Warp 4 (Merlin) - reminiscence using Microsoft Virtual PC 2004

A little off the beaten track for someone who works at Microsoft evangelising Windows, but following Ben Armstrongs recent blog posting here, here and here about getting OS/2 Warp 4.0 running under Virtual PC 2004, I just had to give it a go. After all, it's the weekend and I've been feeling a bit under the weather, so why not curl up with a warm laptop, wireless connectivity, kids quiet on the Xbox and an inviting sofa to try it out?

Many years ago, I used to be somewhat of an OS/2 guru, having first used it in 1993 back at the time version 2.11 had just come out. I even attended a couple of "ColoradOS/2" conferences way back in 1995 and 1996 (if memory serves me right), and met Paul Giangarra, the lead architect for OS/2 "Merlin" (one of the codenames). What is most worrying is how much you forget after only 6 or 7 years - it all comes flooding back (not).... MPTS, LAPS, WPS, E, the buggy Netscape Navigator for OS/2, Mahjongg Solitaire (now there was a good game). As I recall, I must have been one of the very first people to have a copy of Warp as I brought it back from the states to the UK before it was publicly available over here.

Installation of the OS is easy enough. However, my laptop doesn't have a floppy drive (in fact I only have one machine with a floppy drive now, and besides I don't think I have any disks hanging around anyway - how times have changed). To create the floppies, I simply created a new Virtual Floppy from an XP Virtual Machine, inserted the Warp CD (bit dusty, but still working fine), and run cdinst from the root directory.

THIS WILL FAIL!, but all is OK as long as it gets to around 99%. Once you have a 99% completed disk 1, edit cdinst.cmd and see what it does to create disk 2 and the installation disk needed during boot installation, and run the commands from the command prompt. Respectively these are:

\DISKIMGS\LOADDSKF \DISKIMGS\OS2\35\DISK2.DSK A: /Y/Q/F for Disk 1 and
\DISKIMGS\LOADDSKF \DISKIMGS\OS2\35\DISK0.DSK A: /Y/Q/F for the Installation disk
Note that the file has a %1 in the above lines which you can just lop out and run from a D: prompt.

The install is fine, as long as you heeded Ben's warnings about installing NetBIOS over TCP/IP during installation. I didn't the first time, and given how much I'd forgotten about MPTS and network configuration managed to get myself into a very big mess - fix pack's half installed, network only up once in every 5 or 6 boots, shared folders not working, SVGA mode stuffed. Hence, I went back to the drawing board and started a second time.

I wish I had have found this answer before giving up and going for the second install - it gives a great deal of information on setting up the Network.

The installation of the VM additions was possible before installing FixPak 15 which did surprise me - however, it enabled me to download fixpak 15 from my host machine, and use the VM Shared Folders to copy the extracted file onto the local drive of the OS/2 Warp Guest.

FixPak 15 wasn't quite as easy to install as I thought - unfortunately Bens link to the FTP site on IBM didn't work for me. However, it is downloadable as a .zip file from hobbes (there's a name I haven't heard of for years). To install it, you will need the CSF (Corrective Service Facility) version 1.43. If you use the link I provided, you'll need to download this separately, for example from here. Take care with the directory structure you use in the guest (ie the c:\os2serv\os2serv structure which Ben mentioned), or the fixpak installation will fail.

Ben's link for the SVGA display driver and installation was perfect. Thankyou.

Browsers... Back in the days I was using OS/2, before Warp 4 you were pretty much snookered. On the bright side though, these were the days of BBS's and modems and Warp had a very capable terminal emulator, and combined with PComm/2, you were pretty much sorted. Warp 4 introduced the WebExplorer, but this leaves a lot to be desired. Netscape came out with a highly unsatisfactory browser (I can't find the link now), but fortunately FireFox 1.0 is available for OS/2 today. Note that you'll need to install libc-0.5.1 runtime on which FireFox is dependent. The rendering was a little suspect, but still very usable. Now, if only Microsoft had a version of Internet Explorer 6 for OS/2....

Things to remember about OS/2. No, it's not a bit like Windows 3.x. However, it does make extensive use of the c:\config.sys (sound familiar?). Be careful how you edit it. I think I re-discovered this fact towards the end of giving up on my first installation.

Now for the great stuff. Once it was installed, I had to get the machine participating in my home domain. Yes, you can indeed do this. However, you will need to reduce the security settings if you are running Windows Server 2003. Start the Domain Security Settings snap-in, navigate to Security Settings/Local Policies/Security Options and set "Microsoft network server; Digitally sign communications (always)" to disabled. If you've got everything setup right, go back to a command prompt on the VM and type "logon <username> /P:<domainpassword> /V:d /d:<yourdomain>". You should get back "The command completed successfully". Try using "net view \\<server>".

Finally, a dig around found a copy of IBM VisualAge C++ for OS/2 - the compiler I used for many years. I haven't done much C programming in several years, but this did come flooding back. I still have a first edition Kernihan and Ritchie "The C Programming Language" book (the definitive C language guide) upstairs, but didn't need to refer to it to get a version of the "hello, world" program running - in fact, it compiled and ran first time. There's a load of fixups mentioned on the IBM site (most recent c.2000) , but I couldn't get any of them to download. Fortunately, I didn't need them.

#include <stdio.h>
void main(int argc, char* argv[])
{
printf("Welcome from OS/2 Under Virtual PC 2004 :-)\n");
}

And here's the screen shot....

I also found a copy of Database 2 for OS/2 (aka DB2/OS2), but that's for another day. Me and databases never did get along too well. I hope you found this useful - very much a trip back down memory lane personally. I'm sure I'll be reminiscing for a few weeks yet and have loads of utilities and other software on CD's somewhere or other. Now where can you get that really cool WarpSans font for Windows.....?

Photo-album on MSN Spaces

posted Sunday, January 30, 2005 6:55 PM by jhoward with 0 Comments

Hyperthreading and Microsoft Virtual Server 2005

Several people internally at Microsoft have commented that you should turn off Hyperthreading when you're running Microsoft Virtual Server 2005, especially under load. It appears that the overhead of scheduling between logical processors gives either no performance gain or even possibly adverse performance effects when the host OS is under a "high load".

It's also right there in the Virtual Server Administrators Guide under Best Practices:

Disable hyper-threading technology
Under heavy computing workloads, hyper-threading technology, which allows a single processor to appear as two processors, may cause poor server performance. Because workload is dynamic and can vary quickly, we recommended disabling hyper-threading on the physical server to prevent this potential problem.

Just something to be aware of. I haven't noticed any problem myself - maybe I need to work this machine a little harder :-)

posted Saturday, January 29, 2005 10:26 AM by jhoward with 9 Comments

Sample scripts for dsadd, dsmodify, dsget, dsquery, dsmod, dsmove

Following my Technet session on the New Features of Windows Server 2003 Active Directory, scenario based, here's the scripts which I promised to post up. Hope they are useful. Even if you didn't attend the session, they give you a good example of how these command line programs can be used. Remember that the Windows Server Help and Support has very detailed information on the parameters to these commands - often overlooked when people head straight over to their favourite Internet search engine....

AddUsers.bat

dsadd ou "OU=Sales,DC=worldwideimporters,DC=com"
dsadd ou "OU=Marketing and Finance,DC=worldwideimporters,DC=com"
dsadd user "CN=KimA,OU=Sales,DC=worldwideimporters,DC=com"
dsadd user "CN=SeanA,Ou=Sales,DC=worldwideimporters,DC=com"
dsadd user "CN=NeilC,Ou=Sales,DC=worldwideimporters,DC=com"
dsadd user "CN=AaronC,Ou=Sales,DC=worldwideimporters,DC=com"
dsadd user "CN=AndrewH,Ou=Sales,DC=worldwideimporters,DC=com"
dsadd user "CN=DonH,Ou=Marketing and Finance,DC=worldwideimporters,DC=com"
dsadd user "Cn=GarthF,Ou=Marketing and Finance,DC=worldwideimporters,DC=com"
dsadd user "CN=MarkH,Ou=Marketing and Finance,DC=worldwideimporters,DC=com"
dsadd user "CN=JoB,Ou=Marketing and Finance,DC=worldwideimporters,DC=com"
dsadd user "CN=ScottC,Ou=Marketing and Finance,DC=worldwideimporters,DC=com"
dsadd group "CN=Sales Users,CN=users,DC=worldwideimporters,DC=com" -scope g
dsadd group "CN=Marketing and Finance Users,CN=users,DC=worldwideimporters,DC=com" -scope g
dsadd group "CN=Sales Data,CN=users,DC=worldwideimporters,DC=com" -scope l
dsadd group "CN=Marketing and Finance Data,CN=users,DC=worldwideimporters,DC=com" -scope l
dsadd computer "CN=SALESWKSTN1,OU=Sales,DC=worldwideimporters,DC=com"
dsadd computer "CN=SALESWKSTN2,OU=Sales,DC=worldwideimporters,DC=com"
dsadd computer "CN=MAFWKSTN1,OU=Marketing and Finance,DC=worldwideimporters,DC=com"
dsadd computer "CN=MAFWKSTN2,OU=Marketing and Finance,DC=worldwideimporters,DC=com"

ModifyMembers.bat

dsmod group "CN=Marketing and Finance users,CN=users,DC=worldwideimporters,DC=com" -addmbr "CN=KimA,OU=Marketing and Finance,DC=worldwideimporters,DC=com" "CN=SeanA,OU=Marketing and Finance,DC=worldwideimporters,DC=com" "CN=AaronC,OU=Marketing and Finance,DC=worldwideimporters,DC=com"
dsmod user "CN=KimA,OU=Marketing and Finance,DC=worldwideimporters,Dc=com" "CN=SeanA,OU=Marketing and Finance,DC=worldwideimporters,DC=com" "CN=AaronC,OU=Marketing and Finance,DC=worldwideimporters,DC=com" -pwd Abcd123 -mustchpwd yes

MoveUsers.bat

dsmove "CN=KimA,OU=Sales,DC=worldwideimporters,DC=com" -newparent "OU=Marketing and Finance,DC=worldwideimporters,DC=com"
dsmove "CN=AaronC,OU=Sales,DC=worldwideimporters,DC=com" -newparent "OU=Marketing and Finance,DC=worldwideimporters,DC=com"
dsmove "CN=SeanA,OU=Sales,DC=worldwideimporters,DC=com" -newparent "OU=Marketing and Finance,DC=worldwideimporters,DC=com"ModifyMembers.bat

QueryUsers.bat

dsget user "CN=KimA,OU=Sales,DC=worldwideimporters,DC=Com" -memberof -expand >"c:\documents and Settings\All Users\Desktop\userinfo.txt"
dsquery user "OU=Sales,DC=worldwideimporters,DC=com" >>"c:\documents and Settings\All Users\Desktop\userinfo.txt"
dsquery user "OU=Marketing and Finance,DC=worldwideimporters,DC=com" >>"c:\documents and Settings\All Users\Desktop\userinfo.txt"
Notepad "c:\documents and Settings\All Users\Desktop\userinfo.txt"

Remove1.bat

dsrm -noprompt -c "cn=KimA,OU=Marketing and Finance,DC=worldwideimporters,DC=com"
dsrm -noprompt -c "CN=mafwkstn1,OU=Marketing and Finance,DC=worldwideimporters,DC=com"
dsrm -noprompt -c "CN=Marketing and Finance Users,CN=Users,DC=worldwideimporters,DC=com"
dsrm -subtree -noprompt -c "OU=Marketing and Finance,DC=worldwideimporters,DC=com"

RemoveAll.bat

dsrm -subtree -noprompt -c "OU=Sales,DC=worldwideimporters,DC=com"
dsrm -noprompt -c "CN=Marketing and Finance Data,CN=Users,DC=worldwideimporters,DC=com"
dsrm -noprompt -c "CN=Sales Users,CN=Users,DC=worldwideimporters,DC=com"
dsrm -noprompt -c "CN=Sales data,CN=Users,DC=worldwideimporters,DC=com"

posted Thursday, January 27, 2005 8:35 AM by jhoward with 1 Comments

New Features of Windows Server 2003 Active Directory

There is a forthcoming Webcast on Wednesday 9th Feb 16:00-17:30 UK Time (8AM-9:30AM PST) on the New Features of Windows Server 2003 Active Directory. For those of you who attended my TechNet session last night on the same subject, this should be a good follow up. The webcast is a level 200.

Abstract:
Active Directory has been growing! It has become a powerful - and essential - tool in properly organizing and administering a Microsoft Windows Server 2003 environment. Join this session as we cover most aspects of Windows Server 2003 Active Directory operations, focusing on new features for deployment, administration and management, forest trusts, Group Policies, and application support. Whether you're adopting Active Directory for the first time in Windows Server 2003, or are considering an Active Directory upgrade from Windows NT 4.0 or Windows 2000, you'll definitely want to join this webcast!

Registration site:
http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032268117&Culture=en-US

posted Wednesday, January 26, 2005 3:08 PM by jhoward with 2 Comments

Group Policy - Tips Tricks and Best Practices

Following my session in Birmingham on 13th January, here's a list of the references I referred to. Apologies to all for the delay in posting this. Firstly, Jeremy Moskowitz's excellent book "Group Policy, Profiles, and Intellimirror for Windows 2003, 2000 and Windows XP" can be found on Amazon.

1	Redirecting the Users and Computers Containers in Windows Server 2003 (KB324949)
2	Group Policy Common Scenarios Using GPMC
3	Scriptomatic Tool
4	Staging Group Policy Deployments (Chapter 3, Windows Server 2003 Deployment Kit - Designing a Managed Environment Book) (URL Fixed 25/1/2005)
5	Monitoring and Troubleshooting the File Replication Support Webcast: DNS In the Active Directory Part 2: Best Practices, Common Problems and Troubleshooting
6	File Replication Service (FRS) – includes Sonar and Ultrasound
7	Group Policy Settings Reference Spreadsheet (with history)
8	Cross Forest Logon, Loopback and User Policy Logon (KB 823862)
9	Recommendations for Managing Group Policy Administrative Template Files (KB 816662)
10	Client, Service and Program Incompatibilities That May Occur When Modifying Security Settings and User Rights Assignments (KB 823659)
11	Threats and Countermeasures: Security Policy Settings in WS 2003 and XP
12	Adding Domain Groups to Local Machine Groups on Member Computers (KB 810076)
13	Troubleshooting Group Policy with Windows Server 2003

posted Sunday, January 23, 2005 8:08 PM by jhoward with 4 Comments

VMRC Client (Virtual Machine Remote Control Client) under Virtual Server 2005 - Great scenario

AKA Another great reason to consider using Virtual Server 2005 for test/dev scenarios....

I was asked a question a couple of days ago, and I hadn't thought of using the VMRC client in this particular circumstance. I haven't tested it, but there's no reason I can think of which should cause it to fail. Once I return from the USA, I'll try it out.....

Current Scenario:
- User is at home, connected to work network over VPN
- At work, there is an XP machine running Virtual PC
- From home machine, user uses RDP (remote desktop) to connect to the XP host
- Once logged onto the XP host, user starts Virtual Machine
- User at home optionally disconnects RDP session to host machine at work
- From home machine, user uses RDP to connect to the guest virtual machine

New Scenario:
- Upgrade to Virtual Server 2005 on the XP host which is physically at work. (Note this is test/dev only)
- User is at home again, connected to work network over VPN
- Install VMRC on users home machine
- Run up VMRC and get full BIOS space operations on the guest VM running on work machine.

Conclusion:
Previously, to get BIOS space operations from the users home to a virtual machine, it was necessary to operate the virtual machine through the remote desktop connection to the host machine at work. If you've ever tried this, it's very confusing. Trust me. Through VMRC, you wouldn't actually need to get to the host machine atall, you can go straight to the virtual machine and its pre/post BIOS. Kind of neat.

Hope this is useful!

posted Wednesday, January 19, 2005 10:32 PM by jhoward with 6 Comments

Windows Terminal Server Management Pack for MOM 2000 SP1 v2 released

If you are using MOM (Microsoft Operations Manager) 2000 to manage your Terminal Servers, then have a look at the Windows Terminal Server Management Pack for MOM 2000 SP1 version 2 recently released to the Microsoft download site

posted Wednesday, January 19, 2005 12:01 AM by jhoward with 0 Comments

Windows Server Administrative Scripting

Having a developer background, I'm one of those people who isn't scared off by scripting, . However, many IT Pro's shy away from it as one of those things best left to developers. However, a healthy appreciation of some of the scripting capabilities of Windows will assist you in numerous situations.

Tomorrow evening (Tuesday 11th January 17:30-19:00GMT, 09:30-11:00 PST), the book author and founder of ScriptingAnswers.com, Don Jones, is presenting a webcast "Useful Admin Scripts, En Masse".

Registration to tune in is here: http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032262055&Culture=en-US
Remember Technet webcasts are archived, so you can also listen to them after the event if you don't have the opportunity to tune in live.

Expand your scripting to include multiple computers: Inventory client computers, restart multiple servers, change application settings, and much more. This session focuses on basic multi-computer "wrapper" scripts, and then shows you how to plug in your own scripts to perform a number of useful tasks. The wrapper script will include complete logging functionality, helping you write "batch operations scripts" more quickly. Plus, see a bunch of Microsoft® Visual Basic® Scripting Edition (VBScript) based, multi-computer scripts in operation, giving you something to take home and start using immediately.

posted Monday, January 10, 2005 8:50 AM by jhoward with 0 Comments

Windows Task Manager - Alternate View

This is one of those small almost unheard of "things you can do in Windows" tips.
The left image below is a "normal" Windows Task Manager screen shot.
If you double-click anywhere in the graphical part of the tab, it changes appearance to the screen on the right.

Click image to enlarge.

You can also do this on the networking tab. Not sure how much mileage you'll make of it, but it may be useful.

posted Monday, January 10, 2005 8:43 AM by jhoward with 6 Comments

Windows Server 2003 Service Pack 1 (SP1) - Find out more from Peter Meister

Learn more about Windows Server 2003 Service Pack 1 (SP1) from Peter Meister, the Lead Product Manager for Windows Server 2003.
Peter is a man who definitely knows what he's talking about, so don't miss the chance to miss out on this opportunity.

On Thursday 13th January, there is a level 100 webcast lasting 90 minutes entitled "Introducing Windows Server 2003 Service Pack 1 - Overview, Benefits, Availability".
Tune it at 21:00 GMT (11AM PST) on Thursday 13th January.

Windows Server 2003 Service Pack RC1 is here! Learn about the benefits, features, and new functionality of Service Pack 1 - how Service Pack 1 helps you secure your server more confidently and better defend against hackers. Windows Server 2003 SP1 provides new security tools such as Security Configuration Wizard which secures your server for role-based operations, improved defense-in-depth with Data Execution Protection and a safe and secure first boot scenario with Post-setup security Update Wizard. You'll also find out about how to download and test the Release Candidate of SP1 to guarantee compatibility with your network.

On Monday 24th January, there is a follow-up level 200 webcast , again 90 minutes long entitled "Windows Server 2003 Service Pack 1 - Technical Overview".
Tune in at 21:00 GMT (11AM PST) on Monday 24th January.

Join this session for a technical drilldown on Windows Server 2003 SP1. Peter Meister, Lead Product Manager for Windows Server 2003, will present a technical overview on Windows Server 2003 SP1. Learn about the Secure Configuration Wizard (SCW) at a technical depth, and how to couple Windows Firewall with the new Active Directory Group policies to centralize and secure your workstation and servers. The session concludes with a discussion of VPN Quarantine and how to implement the new VPN Quarantine technologies within Windows Server 2003 SP1.

posted Sunday, January 09, 2005 8:22 PM by jhoward with 0 Comments

ActiveSync 3.8 Download - new release now available

ActiveSync 3.8 is now available for download

Of course, the official download page doesn't say anything about being supported under Windows Server 2003 (my main laptop OS), but it does work without any of the workarounds such as those I blogged about last month on an RTM build. At least it does quite happily sync to a Window Smartphone, the only working "syncable" device I have.

Download link: http://www.microsoft.com/downloads/details.aspx?FamilyID=d2645c21-8a85-45a2-8d13-653beb6cdddc&DisplayLang=en.

Found via Angus Logan

posted Sunday, January 09, 2005 9:06 AM by jhoward with 1 Comments

Blogcast on VSMT (Virtual Server Migration Toolkit) - Part 5

As promised, here's the last blogcast installment walking through a VSMT migration of an NT4 server into a virtual machine running under Microsoft Virtual Server 2005. This blogcast walks through deploying the disk image into the blank VM and seeing the final result. It can be viewed by clicking here (10 minutes 6 seconds).

If you missed any of the previous parts:

Part one can be viewed here
Part two can be viewed here
Part three can be viewed here
Part four can be viewed here

Edited by John: 3rd Nov 2005 - Rehosted WMV File

posted Saturday, January 08, 2005 4:02 PM by jhoward with 14 Comments

Do I have local admin rights? Find out how in three mouse clicks (or two keys plus a mouse click)....

I use this quick-tip frequently to determine if I'm a local administrator. The trouble with some tips is that you just know them, they're so simple so you don't bother to tell people as you're under the assumption they "must have known that". This exact circumstance happened today in the office when a colleague was having problems installing some software. They thought they had local admin rights, but didn't.

Click 1: Right-Click My Computer
Click 2: Select Properties
Click 3: Select the "Computer Name" tab

If the "Change" box is available, you're a local administrator. If it's greyed out, you're not. It's that simple.

So as to combine one tip into two, if you didn't know, you could change Clicks 1 and 2 above with 2 keyboard hits: Windows Key + Break.

posted Thursday, January 06, 2005 7:48 PM by jhoward with 10 Comments

Blogcast on Virtual Server Migration Toolkit (VSMT) - Part 4

I'm "virtually" (no pun intended) at the end in the series of blog entries walking you through a VSMT migration of an NT4 server into a virtual machine running under Microsoft Virtual Server 2005. If you've missed out so far:

Part one can be viewed here (links to 2 blogcasts)
Part two can be viewed here (links to 2 blogcasts)
Part three can be viewed here (links to 2 blogcasts)

The seventh and penultimate VSMT blogcast walks through creating a new virtual machine under Virtual Server as a placeholder for the migrated server. It can be viewed by clicking here (6 minutes 55 seconds).

I've had some great feedback about this series from a truly worldwide audience - the level of interest has been absolutely staggering, and I thank you for taking the time to provide feedback. If you would like more of this type of demonstration/blogcast, please drop me an email using the contact me option on the home page of my blog. I'll try my best to accomodate, but I need to know what you want to see....

Edited by John: 3rd Nov 2005 - Rehosted WMV file

posted Thursday, January 06, 2005 7:54 PM by jhoward with 8 Comments

Blogcast on Virtual Server Migration Toolkit (VSMT) - Part 3

If you missed my two previous postings in this series of blogcasts walking you through a VSMT migration of an NT4 server into a virtual machine running under Microsoft Virtual Server 2005, part one can be viewed here, and part two can be viewed here.

This blog provides links to the next two blogcasts parts five and six:

The fifth VSMT blogcast walks through updating the script files to ensure the generated P2V migration files work correctly in the environment validating the XML file describing the hardware on the server being migrated and adds an device to ADS for the target Virtual Server machine. It can be viewed by clicking here (2 minutes 46 seconds).

The sixth VSMT blogcast walks through capturing a disk image of the NT4 server into ADS. It can be viewed by clicking here (7 minutes 33 seconds).

Edited by John: 3rd Nov 2005 - Rehosted WMV files

posted Thursday, January 06, 2005 12:41 AM by jhoward with 10 Comments

Resource Tool Kit 2.0 for Microsoft Identity Integration Server 2003 (MIIS) is now available

The Resource Tool Kit 2.0 for Microsoft Identity Integration Server 2003 (MIIS) is now available for download.

The primary focus of the new release has been to improve the portfolio of tools that helps the manageability of the MIIS system. A description of the new tools available in this release is below and you will find even more information in the ResKit help file.

MIIS Provisioning Assistant enables users to generate a metaverse extension which performs simple provisioning and deprovisioning without having to write a single line of code or have Visual Studio installed.

MIISWorkflow application is a sample solution that provides a way to request and approve accounts by using a Web-based interface. It is designed to help simplify typical workflow requirements on MIIS 2003 by serving as a framework for approval-based provisioning.

AttributeFlowViewer is a tool to show metaverse centric view of attribute flows. The tool processes exported server configuration to shows all import and export flows per metaverse attribute.

MIISInfoBackUp is a tool to gather all MIIS related information to one common place. Information to be gathered can be configured via an input file of xml format.

MVConfigurationViewer is a tool that uses xsl transformations to convert the MV configuration to a readable html format.

PCNSLookup is a VBS script that queries all domain controllers in a specified domain and displays the status of the password change notification service (PCNS) on each domain controller.

posted Wednesday, January 05, 2005 8:32 AM by jhoward with 0 Comments

KB 891609 - Could not connect to Virtual Server. Access was denied.

Summary from KB Article:

When you open the Virtual Server Administration Website in Microsoft Virtual Server 2005, you receive the following error message:
Could not connect to Virtual Server. Access was denied.
You can specify an alternate virtual server below.

I blogged about this problem when I first started running Virtual Server under Windows Server 2003 SP1 Release Candidate, and there have been many instances on the Microsoft internal discussion lists about people having similar problems. There is now a new KB article on support.microsoft.com providing the latest information on how to resolve this problem.

posted Wednesday, January 05, 2005 8:25 AM by jhoward with 2 Comments

Blogcast on Virtual Server Migration Toolkit (VSMT) - Part 2

I hope you enjoyed the first two blogcast demonstrations of VSMT I blogged about yesterday. Today, I'm publishing part two which contains the next two blogcasts in the series.

The third VSMT blogcast walks through validating the XML file describing the hardware which the server being migrated is running. It can be viewed by clicking here (1 minute 23 seconds).
The fourth VSMT blogcast walks through generating the P2V (physical to virtual) files used for the remainder of the migration. It can be viewed by clicking here (2 minutes 44 seconds).

Edited by John: 3rd Nov 2005 - Rehosted WMV Files

posted Wednesday, January 05, 2005 8:01 AM by jhoward with 10 Comments

Blogcast on Virtual Server Migration Toolkit (VSMT) - Part 1

Blogcast, podcast, mini-webcast.... What's in a name - well quite a lot judging by some of the reactions I've had.

Leaving the name issue to one side, I've recorded a series of eight clips which walk through the process of migrating an NT4 server into Microsoft Virtual Server 2005 using the VSMT (Virtual Server Migration Toolkit). Each of these clips is only a few minutes long, with the longest one only 10 minutes. Please feel free to delve in as you want. These clips essentially run through the steps described in a fabulous white paper available on microsoft.com

You will be able to see demo live in Birmingham on January 13th where you can ask me questions in-person.

The first blogcast is an introduction to the environment I'm using to perform the migration and can be viewed by clicking here.

The second blogcast is using the gatherhw tool to generate an XML manifest cataloguing the hardware in my NT4 Server. This can be viewed by clicking here

Hope you enjoy these - I'll blog about the other recordings over the next few days. Also, if you want to see more of these type of recordings relating to Windows Server environments or Virtual Server, drop me a mail or add a comment.

--------------------------------

...added 28th January 2005: Now that they're published, here's the links to the other parts to save you searching.
Part two can be viewed here
Part three can be viewed here
Part four can be viewed here
Part five can be viewed here

Edited by John: 3rd Nov 2005 - Rehosted WMV files

posted Tuesday, January 04, 2005 9:17 AM by jhoward with 22 Comments

Windows Server 2003 System Administration Webcasts

There are two forthcoming webcasts on Windows Server 2003 System Administration taking place early in the new year.

Part 1: 5th January 2005 17:30-19:00 GMT (09:30-11:00 Pacific Time (GMT-8))
This session covers Windows Server 2003 administration from a number of views, including a look at out-of-the-box tools, Systems Management Server 2003 (SMS 2003) options, and Microsoft Operations Manager 2005 (MOM 2005) features. The session focuses on the out-of-the-box server management tools such as Active Directory Command Line tools-trusts and server roles. From the client side, we look at Group Policy management and settings, software installation, and patch management using Software Update Services. The presentation concludes by showing how SMS 2003 and MOM 2005 augment the tools previously covered, including software and patch management in SMS 2003 and server monitoring using MOM 2005.
http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032266386&Culture=en-US

Part 2: 12th January 2005 17:30-19:00 GMT (09:30-11:00 Pacific Time (GMT-8))
This session covers Windows Server 2003 administration from a number of views, including a look at out-of-the-box tools, Systems Management Server 2003 (SMS 2003) options, and Microsoft Operations Manager 2005 (MOM 2005) features. The session focuses on the out-of-the-box server management tools such as Active Directory Command Line tools-trusts and server roles. From the client side, we look at Group Policy management and settings, software installation, and patch management using Software Update Services. The presentation concludes by showing how SMS 2003 and MOM 2005 augment the tools previously covered, including software and patch management in SMS 2003 and server monitoring using MOM 2005.
http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032266396&Culture=en-US

posted Wednesday, December 22, 2004 2:47 PM by jhoward with 0 Comments

Scripting Guys Webcast Week 2 - 24th January 2005

The scripting guys did a great job with a series of webcasts under the banner of "Scripting Week 1" earlier this year. They included topics such as "WMI is not a Four-Letter Word" and "Scripting Files and Folders Makes Me Happy". The week 1 webcasts are archived and available for viewing here.

The really good news is that in the new year, they're back for Scripting Week 2 from 24th to 28th January 2005. Don't be scared off by thinking scripting is just for developers - it's not, IT Pro's can learn a lot to ease administrative burdens, or just to understand more about what's going on under the covers. A quick snippet from the scriptcenter explains about the week:

What Exactly is Scripting Week 2?
Let’s put it this way: you know you’re a true guru when your applications and systems bow to your every whim. Scripting Week 2 is your next step towards achieving this power. It’s not magic—just a few scripting tricks. Scripting is an easier, faster, less error-prone way of managing systems and applications. It enables you to automate procedures and relieve yourself of unnecessary busy work and the worry of human error. We compiled all this and more in our Scripting Webcast Series, which will teach you to:

• Create scripts that harness the power of Microsoft® Office
• Write ADSI scripts to manage Active Directory®
• Take advantage of new WMI capabilities
• Run scripts under alternate user credentials
• Make use of WMI events

posted Wednesday, December 22, 2004 9:55 AM by jhoward with 0 Comments

Group Policy Webcast series

Matt Hester recently finished a great series of 14 webcasts about the ins and outs of Group Policy. If you missed these the first time round, or just want to know more about group policy, they're available for re-run on the Microsoft Technet site.

posted Monday, December 20, 2004 3:02 PM by jhoward with 0 Comments

XP Virtual Desktop Powertoy under Windows Server 2003 (The ITPro way....)

I really like the Virtual Desktop manager powertoy for XP. Unfortunately, it's just not available under Windows Server 2003. Or is it? Read on....

Part of my on-going mission is to run Windows Server 2003 as my main desktop. Not because I'm sadistic (actually I probably am, but that's for another blog) - it's just easier when you have a powerful machine and need to demonstrate certain Windows Server features, I prefer to run Windows Server on the desktop directly and then run Virtual Server to host Virtual Machines underneath. Yes, I could run XP in a Virtual Machine or dual-boot, but that's somewhat defeatest.

Having a developer background, I could take the developer approach and use something like orca from the Platform SDK to edit the MSI installer to change the operating system version..... However, this is IT Pro land - we don't install SDKs. My mission was how to install this powertoy in Windows Server 2003 using IT Pro tools alone.

So you download the .exe and run it - first problem you get is that it says you need XP. Yes, I knew that. Run the installer again and you get a helpful hint about where the extracted MSI has been placed, and whether you want to replace it.

At this point, I took a copy of it and placed it on the desktop. This is not strictly necessary though.

Download and install the Application Compatibility Toolkit, Stop the Windows Installer Service and Kill off any msiexec.exe processes still running in Task Manager

In the Compatibility Administrator, create a new application fix with the Program file location being c:\windows\system32\msiexec.exe. The name and vendor can be anything you want. When you click next here, scroll down on the right hand side to the bottom and select WinXPSp1 and confirm with next until the wizard ends. At this point, your screen should be similar to that below.

You've very close now. Right click msiexec.exe in the treeview from the above screenshot and select "Run Program". When prompted, add /i "C:\Documents and Settings\Administrator\Desktop\Virtual Desktop Manager Powertoy for Windows XP.msi" noting the use of double-quotes.

This time, the install will complete successfully. All you have to now do is right click on the taskbar, select toolbars and then Desktop Manager.

Here it is in preview mode for four desktops.

To tidy up, I removed msiexec compatibility to stop future installs not working quite as otherwise would be expected.
I hope you find this tip useful. Please note that Microsoft will not support what I've done here, so the usual disclaimers apply here.

posted Monday, December 13, 2004 5:00 PM by jhoward with 17 Comments

Blogcasts - surely a typo I hear you say.

No, it's not a typo! A "blogcast" is probably a new term to you as it's been made up by the IT Pro Evangelism team in the UK (not quite true, but it's nice to think we got there first). A blogcast in this context is a webcast delivered through blogs. So what's new about that I hear you ask? The answer to that is the way most of you tell me you view webcasts. How many of you can relate to one of the following statements?

I skip through webcasts to the bit I'm interested in
I pop the kettle on at the start of a webcast
I have the TV on while listening to a webcast, muting it when the presenter gets to the interesting slide

To solve this, a blogcast is a mini webcast (certainly under 10 minutes) delivered through a blog, concentrating on a very specific topic. No frills added. By building a series of these, we hope to be able to take you through a "journey".

Now over to you... We're busy trying to build a list of possible topics, so if you have any specific to the Windows or Virtual Server track, please let me know.

Eileen has already posted a blogcast here to give you a flavour.

posted Monday, December 13, 2004 1:23 PM by jhoward with 4 Comments

Windows 2000 ADSI Scripting for System Administration

Although published a few years ago, one of the most useful books I keep coming back to is "Windows 2000 ADSI Scripting for System Administration" by Thomas Eck. As an IT Professional with a development background, this book has proved invaluable time and time again. Even with no development background, it never hurts to have a little more insight. Note that most of the content applies equally as well to Windows Server 2003.

Futher details are on amazon

posted Monday, December 13, 2004 12:42 PM by jhoward with 0 Comments

Free Technet IT Forum Highlights all-day event in Birmingham on Jan 13th.

The registration site for the IT Forum Highlights event in Birmingham Thursday January 13th, 2005 is now open.
This event is free of charge and being held at the National Motorcycle Museum.

There are 15 70-minute sessions running throughout the day, running in 3 tracks allowing you to pick and choose the content appropriate to you:

Windows and Collaboration
Data and Security
Interoperability and Management

I'll be on at 9:30 to give a technical overview of Microsoft Virtual Server 2005 and you'll also see a great demonstration of the Virtual Server Migration Toolkit.
Hope you can join us!

posted Monday, December 13, 2004 10:48 AM by jhoward with 2 Comments

Updated document - changes to functionality in Microsoft Windows Server 2003 SP1

There is a revised version of a document just posted on microsoft.com describing the changes in functionality in Windows Server 2003 Service Pack 1. It reflects Microsoft's early thinking about Service Pack 1 and its implications for developers. Note that there will be future versions of this document covering all new and changed technologies.

posted Friday, December 10, 2004 7:47 AM by jhoward with 2 Comments

Virtual Server under Windows Server 2003 SP1 RC1 Early Experiences

I went the whole hog this morning and installed Windows Server 2003 SP1 RC1 on my main laptop, not under Virtual Server or Virtual PC as I blogged about yesterday. Now I don't recommend this to anyone as a rule, but there's a fair chance when working for Microsoft there's going to be someone to call on if it all goes wrong. I hope so anyway :-). Bear in mind that I totally rely on this laptop using it as a workstation as well. Hence my uses aren't typical of most "servers". However, everything looked good:

Wireless, LAN and VPN - check
Read and send a few emails - check
Browse the net - check
Catch up on blogs - check
Windows Messenger - check
Start Virtual Server - uhoh

First problem to resolve. The Virtual Server 2005 administration website threw an error in big red letters: "Could not connect to Virtual Server. Access was denied". Although I happened to know that this was likely from reading the virtual server internal discussion groups, I couldn't lay my hands on the solution immediately. But, for the second time today, the Microsoft Knowledge Base dug me out the hole. Article 887491 tells you about how to allow Local DCOM activation for Virtual Server. Note that this problem is as a result of the increased security in both Windows XP SP2 and Windows Server 2003 SP1, and only happens if Virtual Server is installed before the service pack.

The thing that really amused me was the date of the KB article given that it referenced 2003 SP1 explicitly - 7th November 2004. Lots of foresight on someone's part.

posted Wednesday, December 08, 2004 2:46 PM by jhoward with 4 Comments

New windows not opening in IE? Use the Knowledge Base - it knows a lot of stuff!

Internet Explorer on my test Windows Server 2003 box has been playing up for a couple of days - every time I clicked a link which opened a new window, I got a blank window with nothing in the address bar. Annoying, but sometimes you don't have time to sort it out, so you end up working around the problem. For example, I have been copying shortcuts and pasting it in to the blank window. However, there's certain links which just don't work doing this, such as those with scripted links.

There's a limit to my patience, but the answer took no more than two minutes to find and resolve without resorting to reinstalling. From the Microsoft knowledge base under article 281679 - I just had to follow the first step, (re-)registering urlmon.dll. I still don't know why this happened in the first place, but there you go.

The article above has lots of other information if the first step doesn't fix it for you, and applies to IE5, 5.01, 5.5 and 6.0

posted Wednesday, December 08, 2004 2:22 PM by jhoward with 0 Comments

Display build number and OS version on desktop

Something which you often see Microsoft people do in their demonstrations is have the Operating System description and build number displayed on their desktop. While sysinternals do a fabulous job with their Background Info (bginfo) tool (in fact I use this myself), there is a built in facility right out the box in Windows. In the registry, navigate to HKEY_CURRENT_USER, Control Panel, Desktop, change the value of PaintDesktopVersion from 0 to 1. Logoff and back on again. Very useful when you're working with lots of virtual and test machines.

This works for Windows 2000, Windows 2003 and Windows XP, but I haven't tested NT, 9x or Me. There's also a knowledge base article available. Of course, the usual precautions about updating the registry etc., etc....

Click thumbnail for a larger image

posted Wednesday, December 08, 2004 10:04 AM by jhoward with 3 Comments

Slipstreamed Windows Server 2003 SP1 RC1 Screen Shots

I've posted a few screen shots of Windows Server 2003 SP1 Release Candidate 1 to give you a flavour....

To do this, I first built a slip-stream ISO of Windows Server 2003 Enterprise and installed it under Virtual PC. There's lots of information out on the Internet on how to make slip-stream CDs, but in summary:

Use something like ISOBuster to extract a base Windows Server 2003 Enterprise CD to a directory on the hard disk e.g. c:\temp\NRMEFPP_EN.
Extract the bootable bits which should include a .img file to (for example) c:\temp\BootCD
From a command prompt, run the SP1 RC download executable to extract to a temporary directory:
e.g. "spsr1 /U /X:c:\temp\servicepack"
From c:\temp\servicepack\i386\update, run "update /S:c:\temp\NRMEFPP_EN"
Using your favorite burning tool, build a bootable ISO image disk using the contents of c:\temp\NRMEFPP_EN and the .img file from the first step.
Use the new ISO image to boot from and install into a new Virtual PC

Click each thumbnail to view

While installing (No perceptable change)	The first boot (notice 2004)	Windows firewall on the Control Panel menu
Windows Firewall General Tab	Help About	Firewall exceptions after configuring a File and Print role

The gallery is on MSN Spaces

posted Tuesday, December 07, 2004 5:51 PM by jhoward with 6 Comments Rated Excellent [5 out of 5].

Windows Server 2003 SP1 RC1 (Release Candidate 1) is now available for download.

Apart from a plethora of security enhancements, there are some pretty compelling reasons to take an early look at SP1. Apart from the built in firewall which is akin to the XP SP2 firewall, but better, the two features I particularly like are the Post-Setup Security Updates (PSSU) and the Security Configuration Wizard (SCW). PSSU effectively locks down the computer to stop it being hacked after installation. Note that this is only on slipstream installations. The SCW allows you to define the roles for a computer to ensure that the firewall is appropriately configured.

If you have Virtual PC, Virtual Server, a spare machine or a test environment, take a look. Please do not install it on your production environment! It can be downloaded following this link.

posted Tuesday, December 07, 2004 8:54 AM by jhoward with 6 Comments

VSMT (Virtual Server 2005 Migration Toolkit) demo - see it live in Edinburgh

VSMT is a piece of cake! VSMT stands for "Virtual Server (2005) Migration Tookit" and is the P2V (Physical to Virtual) toolset for Virtual Server 2005. VSMT allows you to migrate a physical server running NT4 SP6A, Windows 2000 SP4 or later, or Windows 2003 Standard/Enterprise edition to a virtual machine running under Virtual Server 2005. The hard part is preparing a demonstration on a single laptop to show the steps involved.

I'm going to be presenting a Technet Evening on December 15th in Edinburgh for a technical overview of Virtual Server 2005. While at the IT Forum in Copenhagen last month, I saw Allen Stewart do a live demo moving an NT4 server onto Virtual Server using VSMT and bits of ADS (Automated Deployment Services). Cool, and it worked (not that I doubted it for a minute). While VSMT wasn't planned to be in there next week for my event, it will be now. For simplicity (and the fact that I can't reasonably take two machines up to Edinburgh), I'm going to migrate an NT4 Server running under Virtual PC to Virtual Server, all on a single laptop. If you want to see what this technology is all about, register here. By the way, Technet evening events are free!

ADS is a free addition to Windows Server 2003 and can be downloaded here.
VSMT whitepapers, FAQ and other information and be found here.

Update 7th December: Just had word that this is now postponed until February next year. All is not lost though, I'll be presenting a session on this in Birmingham on January 13th at a UK IT Forum highlights event - stay tuned for a future blog entry...

posted Monday, December 06, 2004 9:49 PM by jhoward with 1 Comments

NT4 Server and Windows Server 2003 Interoperability - Technet Evening Session

I'm co-presenting a free Technet evening event with Dave Sayers tomorrow night (Tue 23rd Nov) at the Microsoft office in Reading, UK discussing "NT4 and Windows Server 2003 interoperability". The session starts at 18:30 with registration opening at 18:00. Click here for the registration site. Remember, it's FREE

If you are planning on attending, please take a moment to say hello during the break or afterwards - it's always nice to meet and chat to the audience and understand your pains/woes about Microsoft technologies. Sign-up now and enjoy the free beer and pizza...

Alternatively, if NT4 and Windows Server 2003 interop isn't your thing, you can always try out learning how to upgrade from Exchange 5.5 to Exchange 2003 being presented by my colleague Eileen Brown in the room next door.

Don't forget that there are many free training sessions throughout the UK. Check on the Microsoft UK Events Homepage

posted Monday, November 22, 2004 5:58 PM by jhoward with 0 Comments

Active Directory Federation Services (ADFS) - Presentation & White Paper

I'm blogging while sitting listening to John Craddock and Sally Storey presenting one of the all-day pre-conference seminars "Stretching Directory Boundaries Cross Platform Identity Management, Authentication and Security" at the Microsoft IT Forum in Copenhagen. On screen as I write is a fantastic demonstration of ADFS (Active Directory Federation Services) which is due to be included in the R2 release of Windows 2003 server some time next year.

This is a fantastically powerful mechanism to allow cross-organisation information sharing. This type of federation is still way in its infancy. However. for a good overview, see the White Paper Active Directory Federation Services: A Path to Federated Identity and Access Management on the Microsoft web-site.

posted Monday, November 15, 2004 4:45 PM by jhoward with 0 Comments

MSN Search (UK) Beta Launch

The beta of MSN (UK) Search went live today. This is a huge investment on the part of Microsoft, and worth a look. I've been trying it out this evening and have found it great. Click here to try

posted Thursday, November 11, 2004 8:51 PM by jhoward with 0 Comments

MSH - Monad. The next Windows Command Shell

There's some great information up on Channel 9 about MSH (codename Monad). If you're a command line or scripting person, the information here on the MSDN Channel 9 site is for you. Sounds very interesting and definitely something worth taking a good look at. Thanks to Thomas Lee for giving me the heads up on this.

posted Thursday, November 04, 2004 9:06 PM by jhoward with 1 Comments

Search

Archives

Navigation

Post Categories

Microsoft UK

Disclaimer

Microsoft Worldwide

Virtual Corner

Blogroll

Group Policy

Shortcuts

Recommended blogs

Windows Server 2003 (RSS)