Welcome to MSMVPS.COM Sign in | Join | Help

http://www.microsoft.com/technet/security/bulletin/ms06-jun.mspx

Wow.. lots of patches today... including one that I don't agree with ... the patch for RRAS says that Remote Access service is not "running by default on a Windows 2003 server".. and on my SBS "running" boxes, I have RRAS running....

Now granted the fact that this vulnerability is only on SBS boxes can nail us with an authenticated connection (meaning that I'll be hitting someone over the head first before it's a real attack), the fact is that on SBS boxes, it is a running active service on a running active box.

So what patches am I looking at this month to roll out fast?

IE - http://www.microsoft.com/technet/security/Bulletin/MS06-021.mspx

Word - http://www.microsoft.com/technet/security/Bulletin/MS06-027.mspx

Media player - http://www.microsoft.com/technet/security/Bulletin/MS06-024.mspx

The server ones.. I'm going to hang back a bit....

Sometimes it's the little things in life that make you smile... like the line to the men's bathroom at TechEd...

..when of course the women's restroom has no line..

..want to see the keynotes from TechEd?

http://virtualteched.com/default.aspx

Watch them here.. live..

You know you are in geekout land when the airport has this.. and hotel room key looks like this....but I should have packed a powerstrip... we do have the wireless set up so that the gals can share the highspeed Internet..and yes that's a snap shot of the "Anne and Susan" unsecured wireless that is broadcasting from the Omni Paaaaarker House Hotel

...but I forgot the power strip as we yank tables away from walls to plug things in....

The other day (and sorry for being tardy) I got pinged about resources to get started with Sharepoint and I forgot to point folks in the direction of David's blog

http://uksbsguy.com/blogs/doverton/archive/2006/06/06/537.aspx

Scroll down a bit as it's sort of at the bottom of that post.. but honestly..just start playing with it.. and after that check out the blog posts on Sharepoint/companyweb on http://www.msmvps.com/cgross 's page.

Today on my accounting listserve someone posted in that a patch had hurt him... so much so that he was turning off automatic updates and leaving them off...

 I just wasted a few hours of my life when my computer could not connect to my network.  It was working just fine and I didn't do anything!  All the other computers were working just fine.

I spent time with tech support and thought it was a bad Ethernet card so I installed a new one.  Still no luck.

Finally figured out my Registry got corrupted by a Windows update and did a System Restore to a date before the update.

My computer is working fine now, but what a pain.

I now have my Windows update turned off.

How do I know when to update Windows?  I can't afford to lose this time.

And what "patch" did this?  What it a critically needed security patch that broke his trust in patching?  Was it protection against the bad guys?

No it wasn't.  It was a tool to make sure that his legally obtained version of Windows was still valid.

This person indicated that the update that caused this pain was the Windows Genuine Advantage Notification update that he thinks screwed up his registry.  He said the Tech Support person at Gateway said he's been getting a lot of calls about this.  He says he's now afraid to install this update.

I don't blame him one bit.

Lauren Weinstein's Blog: Microsoft Responds Regarding Windows XP Update vs. Spyware: http://lauren.vortex.com/archive/000179.html

Microsoft plans better disclosures for piracy monitoring tool:
http://seattlepi.nwsource.com/local/6420AP_WA_Microsoft_Monitoring_Piracy.html

Yes, Microsoft, you will tell me, you will disclose to me ... because right now you are breaking the trust of folks in patching.  He's turning off security patching that HE NEEDS because you put a "business patch" on his box and it screwed up.  And he's not the only one... there are others in the WU newsgroup that are seeing this issue as well.  And I don't blame folks that are legal in getting a tad bit upset that they now have to take their time and try to get support for this.  Especially when it's an OEM machine and you have to deal with the OEM support.

I'll be writing up more about this "so-called patch" that ended up "breaking trust" in next weeks Patch Watch column on Windows Secrets... I'll also be writing up my "patch priority process" since I'll be away from the office and will have to decide which patches I deploy remotely and which ones I wait until I get back to the office because I'll be in Boston next week.

For those that are in Boston ... if you see a gal pouring over Security bulletins on a tablet PC on Tuesday... stop by and say Hi.. it's just me looking at the risk factors.....

P.S.  This WGA is NOT a security patch and thus is not in the same caliber of the security patches that will come out next week.... this is totally different and thus when WGA breaks the trust of "security patching" ...that's when in my book this is a real shame... 

Hey did you see this?

Microsoft Small Business Applications:
http://blogs.msdn.com/rajattaneja/default.aspx

The Tech Gap: 2006 Innovation Awards Honor Technologies that Advance and Enhance Productivity:
http://www.thetechgap.com/2006/06/2006_innovation.html#more

Microsoft — Microsoft Office Small Business Accounting 2006 — NEWS (The CPA Technology Advisor):
http://www.cpatechnologyadvisor.com/article/article.jsp?id=1177

<warning religious wars ahead>

First off Vlad wrote an interesting 'why SBS works for Small business" on his blog.. and then EmailBattles has the audacity to say why Linux is superior to SBS.... ready for this?

But while Vlad suggests that people buy Linux strictly for the price, a crucial disadvantage of SBS lies in that mountain of software that Microsoft's licensing rules force you to pile onto a single server.

When a Windows-targeted virus strikes... or a Windows-focused attacker penetrates... or any software loaded onto your SBS server crashes... You may lose your whole network.

Yo, Mr. Battles.. may I call you Email? or how about "E".  I wish you were coming to TechEd 2006 in Boston where my good friend Mr. Jeff Middleton will be giving a talk on the myths of Disaster recovery of SBS.. because it truly is a myth... for one .. do you TRULY honestly think that a small business is going to follow the best practices of server building and have like 12 servers (yes we counted one day and if you truly wanted server isolation you'd have 12).  Recovery of a SBS box is no different than recovery of any other network and ... you know what... given the fact that we can be a smidge more flexible in that (while officially unsupported) we can image our single DCs... we have options.

First off "Windows targeted virus strikes".. since when do Windows viruses target my server these days when they are trying to nail my desktops.. that wouldn't change.... and excuse me I have a/v and layers in place...

Secondly... Windows focused attacker penetrates.. hello..again.. bad guys are going after my desktops.... keep patching (gee another reason for that green check 'eh?) and a properly configured SBS box does just fine....

You know what has taken down my network in the past?

NIC
hub (back in the days of hubs)
NIC
Switch
dropped a drive off the array
Switch

And we were not down for very long...and nothing dude.. NOTHING compares to remote web workplace or my daily monitoring email... those are the two killer apps that Linux has nothing in comparison...

I'll be the annoying school of thought that I don't want software spread around.. because the more it's spread around it's not monitored or patched like it should be.  I'll take one nicely watched server thank you very much over a distributed one.. cause I do watch my patch status, my backups, my diagnostics on my hardware, the pings on my firewall and the more spread out .. unless you've got that management in place... you aren't watching that risk properly.

And sometimes it's about the hardware.... dude...$300 white box servers?  Goodness.. how low quality of servers are those?  I pay more for desktops....server quality hardware costs more than $300 whitebox.  That's not even a decent desktop cost.

I was once Lantastic.. I was then Novell.. now I'm SBS.. there might come a day that I'm oh I don't know a google network or something.. but right now.. Mr. E.. there's hands down no compelling reason to be Linux as my core platform.. not right now anyway... there's just no comparison...

Okay so it's pretty clear from the public news that SBS 2003 R2 RTMd just recently.. and honestly.. I really wasn't going to blog about it... why?  Well because for one.. right after I would blog about the RTM RTMing you'd ask me "so what's the pricing?" and I honestly don't know.  All of the details and SKUs and all that will be released in July as the "official launch" for SBS 2003 R2 is going to be at the World Wide Partner Conference in Boston.  The cdroms and boxes and stuff are in production so there's not really a need to start talking about how cool it is when you can't get it or download it or anything... so wait until July when the real party is... besides there will be SBSers in  attendance for that like Chris and Susanne and AmyL and Harry and Beatrice and Vlad for the real launch. 

So I was going to originally hold off saying anything because well.. the cdroms aren't available to purchase and the SKUs aren't set and you can't order them now.. so why start the buzz now when there's "buzz time later" to be had.  I mean let's not start the party when the party will be in July, right?

..but here's the thing... folks that know I'm an SBSers send me the links... and one of them... well.. I mean I know a couple of folks who were quoted in the article and well... lemme put it this way.. let me just give you a hug first..because you might as well just paint a bulls eye target on your forehead...'cause I can't let those comments go by without a rebuttal....and I certainly can't wait until July to come out with my opinion regarding the statements that were made.

In regards to interest in R2, Jason was quoted as saying...."No, there's not much interest at all. The Green Check feature isn’t worth the price of the upgrade. There just is not a lot of compelling value in SBS R2 that makes us want to recommend it to our clients," said Jason Harrison, president of Harrison Technology Consulting, Nashville, N.C.

First up is Jason... and Jason... you know what next week is?  Yup that's Patch Tuesday day... and do you know how many patches are comin' down next week?  A TON.  And do you currently use WSUS?  Do you find it... uh... how can I describe this.... uh... confusing, annoying, baffling, bewildering, complex, esoteric, mystifying, obscure, unfathomable, vex... well you get the idea. 

I bet you do, don't you?  I sure do.  Like Les said, SUS was good, WSUS is confusing and SBS's version of WSUS... just a whole lot easier to handle.  So Mr. Harrison, you SBSer you, I want you to consider a couple of things here that Don Murphy in the SBS2k listserve said yesterday about compelling reasons for SBS:

  • Quota templates -- Don said yesterday -- "Le'ts celebrate!  I want quota templates!"  ....disk quotas are in this release for one.....
  • A patch management tool under the hood that will give both the consultant and the owner a birds eye view of the patch status of their network...
  • Finally SQL 2005 which has a MUCH better security profile than SQL 2000
  • Expandable cal rights for Exchange and SQL for other servers in the network.

Disk/Folder Quotas -- SBS 2003 r2 has that part of the Windows 2003 R2 for disk/folder quotas..(and Microsoft you really need to upgrade your official web site because right now you are totally silent on this item that a lot of var/vaps wanted)  We now have the FSRM feature from R2 that allows us to have quotas by folder. 

Patch Management under the hood.  I'm sorry sir, but I've been patching SBS boxes for a long time and that "green check" you blow off as not being a compelling value IS of value.  When I go and talk to the community do you know how few folks have WSUS installed now?  Are doing any sort of patch management strategy at all?  So before you blow off this release as having 'no value', I'd say you'd better assure me that the ONLY reason why it has no value TO YOU is that you already have a patch management strategy in place.

He went on to say "The only case would be if we have a client who needs update services or SQL 2005"... whoa... sir... yeah I'll let you have the statement about the "needing SQL 2005 (which by the way by default has better security features than SQL 2000 and runs in a better security context and all that) ...but your statement "IF we have a client who needs update services".... dear... sweetie... EVERY CLIENT needs update services.  Every day there's a change in the threats on the horizon...every day the bad guys try a new task to get to us... this is truly big business and they pay people to write bad things to try to get us....we've had all sorts of different threats and unless you keep that guard up... you are just asking for trouble.  So I'm sorry... for anyone who says "if we have a client".. it's more like all of us have clients that need update services.

In fact let me challenge you...next week is a big patch week... you walk around to each desktop, ensuring that each one has flipped to Microsoft Update and you patch every server, every desktop, by hand.  Don't remote it and do this.. you do it by hand.  Now ... tell me again that you don't need a tool to help you keep these machines up to date?  And if you are not patching... I'm sorry you are a ticking time bomb waiting to occur.

The difference between "normal" WSUS and SBS's WSUS.. and no Don, to answer your question there's some tips and tricks to get further functionality out of SBS's WSUS than folks saw during the beta...but this isn't the time nor the place to blog about that... Mark your calendars for July for more info...but there's a lot under the hood that most folks haven't even scratched the surface on.

SQL 2005.  In my not so humble opinion, the ONLY compelling reason WHY you should not upgrade to R2 is quite frankly the database.  If you are a company with a LOB app that is on an existing SQL database... I'll bet you that your app vendor probably hasn't even begun to even think about upgrading that database to SQL 2005.  Due ot the fact that SBS is an integrated bundle..if you need SQL 2000.. you are stuck on SBS 2003 sp1 and can't upgrade to SQL 2005...but... if you are like me where your LOB apps are not tied to that SQL database and the only LOB thing you have on SQL is your ever increasing Sharepoint up on that server, given SQL 2005's increased security posture....man... there's no good reason to be staying on an older database in my book.

Expanded Cal Rights.  Want a second Exchange server?  Another SQL 2005 workgroup box?  Just buy the Windows OS and the Exchange or SQL and plop it into your network and you won't need SQL or Exchange cals for that second (or third or whatever) box.

Folks, Security is a FEATURE...and somehow it feels like folks forget that. 

Okay so now the flip side... Oh, but Susan, that SQL 2005 Workgroup is so much less robust than SQL 2000.  Gentlemen.. a challenge to you...I'll bet you right now your LOB app vendors are supporting SQL 2000.  If you can email me with the name of one of your small business vendors that you build your practice around that is, right now, indicating that they are supporting SQL 2005 standard and will NOT support SQL 2005 workgroup... you tell me the name and I'll send you a Mountain Dew.  (One can, your choice of regular, Live wire, Code Red, Pitch Black, AMP but not Baja Blast unless you want a gift certificate to Taco Bell...subject of course to seasonal availability)  I'll bet you that those app vendors are still on SQL 2000...and that's what will keep you from migrating to SQL 2005 not necessarily the lack of support of Workgroup.

So I promise.. no more hoopla about R2.. not right now anyway... July is the better time for the party poppers and all that...but I just couldn't let that comment go by... for some partners it's the disk/folder quota feature.. for others it's the SQL 2005.. for me... it will be first and foremost and ALWAYS about the pride in the fact that SBS showcases more than any other software platform around just how far patching as come...

I used to sit in front of my SBS 4.5 box and cross my fingers, squint my eyes and think happy thoughts when patching and rebooting my server.  To think now that SBS has UNDER THE HOOD built in patch management and  integration to show that you are patched.... I'm just still.... well it just really cool is all.

So Jason... a hug for ya.. didn't mean to beat you up... and I promise gang... we'll have lots more about R2 in July cause that's when the real party is.... but to me.. R2 IS a compelling story for upgrading.

P.S.  Just heard that Dean Calvert will be presenting at the Small Business Symposium... way cool!

Microsoft Security Bulletin Advance Notification:
http://www.microsoft.com/technet/security/bulletin/advance.mspx

and given that I'm in Boston next week.. I'll have to decide whether to patch remotely or not.. yeah I'll be reading those bulletins and seeing if I feel comfortable in deploying those patches remotely....

The sky is falling Podcast

Episode 2

Links regarding topics discussed:

Microsoft Security Bulletin Advance Notification:
http://www.microsoft.com/technet/security/bulletin/advance.mspx

Welcome to the Microsoft Security Response Center Blog! : June 2006 Advance Notification:
http://blogs.technet.com/msrc/archive/2006/06/08/434186.aspx

Welcome to the Microsoft Security Response Center Blog! : Windows 98, 98SE and ME: Information about Support Lifecycle and MS06-015:
http://blogs.technet.com/msrc/archive/2006/06/09/434300.aspx

Lauren Weinstein's Blog: Microsoft Responds Regarding Windows XP Update vs. Spyware:
http://lauren.vortex.com/archive/000179.html

Microsoft plans better disclosures for piracy monitoring tool:
http://seattlepi.nwsource.com/local/6420AP_WA_Microsoft_Monitoring_Piracy.html

P.S. remind me to shut down the IM window... that ping is when Vlad hit me on IM..obviously I'm a newbie with this stuff...

P.S.S.  hey.. I don't think it got recorded...

This podcast is provided as a community service and is not meant to replace analysis and proper risk management of your network.  It is only the opnion of one SBSer and should not be considered as guidance specifiic to your environment.

Yoda Backpack - Gizmodo:
http://gizmodo.com/gadgets/gadgets/yoda-backpack-179185.php

bummed I can't get it in time for Boston.. but oh yeah... it's on order..

This question was seen in the beta tester application of a certain software package..... is that software....

a.  The latest and greatest Google app killer targeting another Microsoft app?

b.  The latest and greatest voice over IP dohicky software?

or

c.  A beancounter application known historically for demanding administrator rights to run the software that apparently the Vendor has recently has been drinking major quantities of the Security Koolaid and may just finally push us to also do the right thing and lock down our desktops and better protect ourselves from malware, viruses, zero day threats and all sorts of current and future threats?

<play Jeopardy music>

<buzz>

Give up?

Yes, indeed.. that screen shot is from the beta application of the Quickbooks 2007 program... and the minute I saw that question in the beta app it was a "whoa... they DO GET IT" moment.

In fact have you seen their latest official "how to run as non admin" that includes a detail pdf of the reg keys QB uses?  Man at this rate they ARE going to be diabetics with all the Security koolaid it looks like they are drinking around there....

http://virtualteched.com/default.aspx I'm on the VirtualTechEd site watching the video of the interview with Michael Howard about his new book on the Security Development Lifecycle..yes the book is ordered and shipping from Amazon soon....and it struck me today when .. okay arguing....with a fellow accountant about why you should upgrade software.

It's not just about the features folks....

He was saying that Office hasn't really changed since 1997 and that only he would really need the changes in the 2003 version...the rest of his office didn't need the features of 2003 ...it was just 'pretty' but not needed by anyone. and you know wacko patchaholic me just about fell on the floor.... because to me Office 2003 was a vast improvement in patch and security changes.  It's not just about the features... it's about the security of a product too. 

The fact that in Office 2003 I don't have to feed it cdroms any more to patch is a HUGE improvement.  Something to think about too in your networks of mixed OS's and platforms.. the more you are borg (all XP, all 2k3) the easier it is to patch.

DNS For Simple SBS 2003 Setup, AlphaOne Computing, Brighton, Sussex:
http://www.alphaone-comp.com/kbase/2006/06/dns_for_simple_sbs_2003_setup.php

hmmm ... I don't open the SBS DNS console like that.. I run the connect to Internet and Email wizard....and I don't have the router be the DHCP .. I prefer to have the SBS box be the one that handles the DHCP... just makes everything work better....

Let the wizards handle all of this and everything just works better!

I've send email to someone and when they email back.. up in the header file their IT staff has placed the following right in the subject line:

"CAUTION-Email contains attachment -DO NOT OPEN IT unless you are expecting it. Even if it is from a known or trusted source, it still could contain a virus or malicious code "

I like it... I'm going to go see if I can add it in my network...

WSUS Product Team Blog : WSUS SP1 published to MU and available to WSUS today:
http://blogs.technet.com/wsus/archive/2006/06/07/433695.aspx

In the blog comments..... a poster says.... . Everytime I write up a memo to use WSUS it gets shot down by my boss as "Too dangerous", "It might break something", "But patches force me to reboot and I can't work then".

and to that I say .. TOUGH.

Reboot... it takes how long?  Come on folks ..... the bad guys are winning if you won't even reboot.....as far as 'too dangerous'?  As compared to what?  Getting owned?  Breaking something?  Honey I've patched for years and if something breaks (which it doesn't happen that often.. I'll let you know what to keep an eye on in the blog...besides... the 'caveat' section in EVERY security bulletin states what issues have been found.

You know what I think the real problem is?  Not that we're not people persons.... the problem is we're not communicating well enough why all of this stuff is a good thing to do...why it costs..why the bother is miniscule in comparison to the the issues we face if we don't patch.

People don't understand that "free software" costs.. BIG TIME.... and we're not communicating to them that not patching... downloading anything.... accepting programs that are poorly written costs us big time.

So you get ready to patch next week..and reboot.. okay?  ...cause not patching is MORE dangerous than patching...

FIX: You experience high memory usage in the W3wp.exe process on a Windows Server 2003-based computer that has Internet Information Services (IIS) 6.0 installed:
http://support.microsoft.com/?kbid=916984
Information about Microsoft ActiveSync 4.0 error codes, error messages, and how to troubleshoot the error codes:
http://support.microsoft.com/?kbid=915152
Installation fails and mail flow stops when you install Exchange Server 2003 Service Pack 1 (SP1):
http://support.microsoft.com/?kbid=919076
Error message when you use MMC 3.0: "MMC has detected error in a snap-in":
http://support.microsoft.com/?kbid=915797

Programs that use other instances of SQL Server 2000, MSDE 2000, or SQL Server 2000 Desktop Engine (Windows) may fail when you remove an instance of SQL Server 2000, MSDE 2000, or SQL Server 2000 Desktop Engine (Windows):
http://support.microsoft.com/?kbid=918767

and that means that today is NOT Patch Tuesday... that also means that next Tuesday will be patch Tuesday and I WILL BE AWAY FROM MY NETWORK... which means about Friday night after I have remoted into the office and installed the patches there..I will decide if I will remote patch or hang tight... you see it's all about risk management.. and I look to see there's a threat and patch accordingly.....

is it risky to patch remotely when I'm half a country away..yes.. so I weigh the risk of the threats... with the risk of the patching.... but then again... seen on the footnote of a SBS'ers email...

"If you think installing patches and security updates is expensive, try not installing them."

So this morning the power was dropping and the lights were blinking.. so we called PG&E and got them to come over and look.. I was joking that it was due to changing out our old Scientific America cable box with the new digital one that takes a rocket scientist degree to figure out... and I have to reprogram the Pronto remote (ugh)...

So PG&E came out and it was....

the squirrels.. they had eaten through the cables again....

Sometimes it is the little things that make your technology not quite work right...

So I'm out searching the blogs tonight on Technorati and I hit and entry on myspace talking about SBS ...

but.. uh.. like I can't to the page... and then it hits me.. I blocked myspace.com in ISA Server.  You know the other day when folks said that they didn't like ISA server on their DC because it wasn't 'best practice'.. well folks.. technically speaking I have an additional firewall in front of ISA..but this is where ISA rocks.. in the control and reporting that it can do (especially with Dana's additional dashboard on board)

So I asked HappyFunBoy for a synopsis...

starts as a tech rant about activation
ends up talking about God and...
kinda talkin' 'bout a revolution!

 

..okay so maybe it's good I can't get to it..

Okay so we're taking a poll..... read this article.... a couple of folks have pinged and says the author sure sounds like he used the www.sbsmigration.com method to move his problem server... the use of "TempDC" ...and the word "SwingMigration" made a couple of people go..hmmmm that sounds an awful lot like the guy used Jeff Middleton's method and didn't give him credit where credit is due of bailing him out of a situation....

...so what do you think?

More Posts Next page »