E-Bitz - SBS MVP the Official Blog of the SBS "Diva"

Drinking that Security Koolaid

There's a vendor out there that is drinking the Security Koolaid.  To the point where that I can even see the telltale sign of a red tongue and a Koolaid mustache on their mouth.  Now this isn't a vendor that you would normally think would be drinking the Security Koolaid... and it's certainly not the vendor you are probably thinking that I'm talking about.....
 

This is a vendor that... indeed may be setting the path for my Accounting Industry by being one of the first to step up to the bar and do the right thing.  Dr. Jesper Johannson in his "Is that Application Really Safe"  presentation talks about how accounting applications are some of the worst offenders for being a security minded application.  And it's true.  Here when we should be the bellweather of the industry..the shining light of best practices... the standard setter.... so many times I hear from folks that it's the "beancounter program" that makes them make compromises in their networks.  Even my fellow CPAs... sorry guys, I have to beat up on ourselves... we really don't take the time sometimes to think about security.  We want to get the job done for our clients and sometimes, like in any business, security has to take a back seat.  We blindly email files containing sensitive data and never even think of what we're doing.

So when the other day I had a conversation with some folks from this Company... it was refreshing to hear in the phone call that they were drinking that Security Koolaid.   And lots of it.  To the point that they will be pushing us in the future....not us pushing them. 
 

But you know something else.... don't just lay this in the lap of our vendors... as fellow Security MVP Harry Waldron pointed out ... Security is spelled sec-U-R-IT-y.  Security isn't just about "them" ... it's about "You".  "You are it."  You are part of it.  Part of Security.  You are in fact the biggest part of the security piece... and without "You", this vendor can drink enough Security Koolaid to make them a sugar diabetic but it's not going to help secure your network, your data, your clients data.  You have to help this process by being an aware end user and not blindly do stuff like we're doing these days.  By setting up your network properly, configuring it properly.  By having security policies, and set forth to your employees an acceptable use policy of what they can and cannot do on your network.  "You" first have to help this process...it can't just be on the backs of vendors.
 

....so ...guess which vendor I talked to the other day that is on their way to getting Security? 

....wanna guess?

....give up?

....and no this isn't an early April Fool's day joke either... I'm serious here.

... I really and truly feel that this Vendor "gets" security and will be pushing us to "get" it too in the near future ...

....the vendor is....believe it or not.... this one!

It's that time of the year again...

I can hardly wait.. it's right around the corner... RFC day...

I think this is a fav... http://klubkev.org/~ksulliva/rfc-april1/rfc1925.txt 

   (3)  With sufficient thrust, pigs fly just fine. However, this is
        not necessarily a good idea. It is hard to be sure where they
        are going to land, and it could be dangerous sitting under them
        as they fly overhead.

I think we need to send this one to Eric Ligman

http://klubkev.org/~ksulliva/rfc-april1/rfc2324.txt

Let's not isolate ourselves too much....

Subtitled... okay MBSA 2.0 is closer...but I STILL cannot consistently scan my domain worth a darn.....

Okay so we already heard from a poster that he used a dll exclusion in the firewall...

So we went back into our Small business server firewall settings... and clicked on "define program exceptions"

And then on "Show" and added an exclusion exactly like this:  %WINDIR%\SYSTEM32\dllhost.exe:10.0.0.2:Enabled:WSUS Port so that it ended up looking like that:

(Remember I'm still on that old fashioned SBS IP addressing that we used to use in the 4.0 days)  And now... on those workstations that are checking into the MBSA console..they are properly scanning the patch status... but I still do not have a consistent scan-ability of the network.  Even when I added the extra RPC connectivity allowance like Level Platforms needs.

I'm still getting way too much of this error on some of the workstations...an  then I'll scan again and won't get it for those same workstations.... I am scanning by netbios domain name... so why isn't this still working?  Or I should say...consistently working?

Why am I seeing error "Could not resolve the computer name: name. Please specify computer name, domain\computer, or an IP address."?

A.

This error is common when scanning based on an IP address range. This is because MBSA will convert the range into a list of specific IP addresses for that range and attempt to resolve each IP address into the associated NetBIOS computer name. When that name resolution cannot be performed because the computer is switched off, or the IP address is not in use, this error will be returned. The error can also happen when using a domain name of domain members are not accessible on the network, such as a laptop computer roaming outside the wireless network, or a desktop computer that has been shut down. If you specify a DNS fully qualified domain name (FQDN) as the domain to be scanned, you will also see these errors. In that case, you need to use the NetBIOS compatible domain name.

But I'm not.. I DID put in the netbios based domain name.... and I kid you not.. many of the people I talk to say that they tried MBSA 2.0... couldn't get consistent scanning results... got frustrated and dropped using it.... because they too couldn't get it to scan through the firewall.

But this reminds me of an email thread I had today with a guy about keeping "some" network goo... as a balance between security and that managability that I need to have ....as while Dr. Jesper Johansson is talking about Server and Domain Isolation techniques... I'm sitting here poking holes in the firewall and knocking off the Strict RPC compliance in ISA server because I want.... no... I NEED to have managability of the network.  I NEED to have a foundational bit of 'goo' that runs throughout my entire network so that I can scan them and get assurances that they have protections in place... I mean yeah... scan my SBS box and it says I have "Severe risks" ...but right now.. the fact that I can't scan my entire network... I think ..means I have a bigger risk.  I mean I know I can't do the Server and Domain isolation stuff the big server guys have to do... but it sure would be nice if I could scan the network with MBSA....

Stay tuned.... we're getting closer.....

What's your IMF settings?

So what's your IMF settings?

Some here are 6, archive, 2.... 5 would be better but gives a few false positives...

Some are reject =6, move to junk =4

Some use the IMF archive manager....some use the one from Hello

Delta airlines seems to get knocked out at 7... but putting it at 8 lets in too much gunk

...so what do you use?

Working with Group policy

Just a nice friendly reminder... that when us non big server land people start mucking around in group policy..your first step should be to do these steps....

Go down in the group policy management console.. in that bottom section....

Right mouse click on Group Policy Objects... 

Ensure you've clicked on "backup all" ...or at least the one you are mucking with...

And make sure it says this:

Because while you are attempting to put in the registry keys for MBSA..and you've obviously screwed something up.... so it looks like this....and when you go to edit it and it looks like this....

Which in turn gives you that error.... you can at least restore the policy from the backup you just made... granted you will go "Oh #%@#$ for a split second as you momentarily think you've horked yourself good as you can't get back into the very template you've screwed up...

As with everything in life.. make sure you have a backup.....

(stay tuned... MBSA still not working...)

Okay big server land people.....

Okay big server land people.....why isn't there an 'edit' key in the Group Policy Object Editor?

In the group policy...you type these GUID thingys in by hand?

I mean ...really... you never make mistakes when setting up group policy settings or something?  So why no edit button? You guys think typing this stuff in by hand builds character or something?  I mean look at the gunk I need to type in there... and for the record... when giving us SBSers instructions on group policy..don't assume that all of us have been in there enough to know that when typing in a new key we will truncate the "HKEY_LOCAL part and just need "MACHINE" up there.....


HKEY_LOCAL_MACHINE\Software\Classes\AppID\
{B366DEBE-645B-43A5-B865-DDD82 C345492}
\Endpoints REG_MULTI_SZ "ncacn_ip_tcp,0,n"

Yuck .. I have to manually type in MACHINE..wack... Software.. wack... yadda yadda

2. Configure Windows Update Agent to use this static custom port by setting a registry key as follows: HKEY_LOCAL_MACHINE\Software\Classes\AppID\
{B366DEBE-645B-43A5-B865-DDD82 C345492}\
Endpoints REG_MULTI_SZ "ncacn_ip_tcp,0,n"
(where n is the port number you have decided to use.) You may also configure the endpoint using the Component Services application in Control Panel. The Windows Update Agent - Remote Access endpoint is located under the path Component Services\Computers\My Computer\DCOM Config. Right-click and select Properties, then use the Endpoints tab on the Properties page to configure the static port.

And why do instructions like this assume that once we get to Component Services section.... in the control panel...that we'll even have a clue of what to do when we get there? I mean like look at this:

Okay.. I see the static endpoint in the Dcom protocol ...but.. now what.. do I need a protocol sequence of connection-oriented TCP/IP?  I guess so but the instructions don't say to mess with that....but gang....don't assume that we've been under the hood before and when giving instructions.. be specific...because if there's anything else in there... we're going to ask and wonder if we need to select anything....

P.S... skip the GUI?  Edit the text file?  Import them from the command line?  Are you insane?  ...excuse me... what do you think I am.... a big server person?

MBSA 2.0... apparently none of us are using it

Brian Kruse has made a new post: re: MBSA 2.0...so what am I missing?.

Ran into this myself...after going through the KB article I finally found someone's post that led me to try the following which worked on a non-ISA system so it may or may not work with ISA.  I added an exception to the GP firewall settings to allow C:\WINDOWS\SYSTEM32\dllhost.exe to accept requests from the server only.  You'll have to use %windir%\system32\dllhost.exe in the GP since the : won't work. Hope that helps!

It's pretty obvious from posts out here that none of us have gotten this to work natively on the SBS box... and there won't be a new release to get this to work... we need to adjust the firewalls to get it to work.... stay tuned as I'll get the definitive answer on this....

MBSA 2.0...so what am I missing?

MBSA 1.2....just went...scanned bam...bing done.

MBSA 2.0 with the XP sp2 firewalls..even with my modfications for additional managment...either MBSA doesn't find the machines....or when it does find them... it can't scan the windows catalog due to firewall issues....and of course we really don't want to turn off the firewalls at the workstations.....

...and so the instructions are as follows to get MBSA to work are below ....

I got the COM hotfix .. I think (I mean right?  it's in 05-051.. I don't have to edit or flag with extra keys to get those extra COMy things installed right?

And it sounds like I need to deploy that registry key?... so like.. can I ask a stupid question... I mean I know us SBSers have our own policy and all that...but it seems to me that other than this issue with MBSA it's kinda of a decent group policy template for everyone to suck down and use in a network... so why isn't that reg key policy already to go inside of every Windows 2003 server that would be used to control any XP sp2 firewall?  I mean like why isn't there a blonde "install this to decently manage, patch and control your network" adm template that would just be there for a typical firm?

Does anyone have MBSA 2.0..not three mind you... scanning consistently on a SBS 2003 with ISA 2004 that didn't add this group policy registry key..and if so how did you do it?...Otherwise I'm about to add another setting to the default SBS group policy for XP sp2 firewalls.

------------------------------------- 

Please refer to:

MBSA 2.0 Frequently Asked Questions
http://www.microsoft.com/technet/security/tools/mbsa2/qa.mspx

Please search for the question:

How can I scan a computer that is protected by a firewall?

Generally, there're 3 steps to complete the task. Step 2 is optional in
case there's any unmanaged computers which does not belong to your
domain. For your convenience, I copied the steps here:

Step 1: Review system requirements

MBSA cannot scan a remote computer protected by a firewall unless the
firewall is configured to open the ports that MBSA uses to communicate
with the computer. The Windows Update Agent implements a remote scanning
interface based on DCOM. The account being used to scan must possess
local administrator rights. The computer must also be configured to meet
the following conditions:

- The Server service, Remote Registry service, and File and Print
Sharing service must be running on the remote computer. 
- The required ports must be open on the firewall.
- The Windows Update Agent must be installed and the Automatic Updates
service must not be disabled.

Remote computer scans are performed using TCP port 135, a dynamic or
static DCOM port, and ports 139 and 445. In a multi-domain environment
where a firewall or filtering router separates the two networks, TCP
ports 135, 139 and 445 and UDP ports 137 and 138 must be open in order
for MBSA to connect and authenticate to the remote computer being
scanned. You must allow these ports to be open on the remote firewall if
a personal firewall is being used.

Note: The use of DCOM for remote scanning through Windows Firewall on
all versions of Windows XP may require a post-SP2 hotfix as described in
Microsoft Knowledgebase article 895200, "Availability of the Windows XP
COM+ Hotfix Rollup Package 9". Customers may now obtain this fix by
installing the COM+ update (KB 902400) using these procedures:

1. Download the update from
http://www.microsoft.com/downloads/details.aspx?FamilyId=20F79CE7-D4DB-4
2D7-8E57-58656A3FB2F7 on the Microsoft Download Center.

2. Copy the update to the computer you are updating and open a command
prompt on that computer.

3. Run the update using the command line options described in KB article
824994 (specifically, the /B:SP2QFE command line option). Doing this
will install all of the Windows XP COM+ Hotfix Rollup Package 9 fixes,
in addition to the fixes released in the security bulletin MS05-051.

Step 2: Configure Unmanaged Computers

DCOM allocates a dynamic port by default, but a firewall blocks access
to these ports unless explicitly opened by using the following
procedure:

1. Open port 135 and a custom port in your firewall (some firewalls may
allow port 135 by default). The port you select should be checked to
ensure it is appropriate, or not associated with other applications.

2. Configure Windows Update Agent to use this static custom port by
setting a registry key as follows:
HKEY_LOCAL_MACHINE\Software\Classes\AppID\
{B366DEBE-645B-43A5-B865-DDD82
C345492}\Endpoints REG_MULTI_SZ "ncacn_ip_tcp,0,n" 
(where n is the port
number you have decided to use.) You may also configure the endpoint
using the Component Services application in Control Panel. The Windows
Update Agent - Remote Access endpoint is located under the path
Component Services\Computers\My Computer\DCOM Config. Right-click and
select Properties, then use the Endpoints tab on the Properties page to
configure the static port.

Step 3: Configure Managed Computers

Use Group Policy to deploy specific administrative firewall and COM+
settings to target computers. You may use the Group Policy editor to
create the needed configuration settings as documented in "Deploying
Windows Firewall Settings for Microsoft Windows XP with Service Pack 2",
in the section entitled "Deploying Windows Firewall Settings With Group
Policy".

Windows Firewall Settings: The following Windows Firewall settings
should be used:

- Windows Firewall: Allow remote administration exception. Used to
enable remote configuration using tools such as Microsoft Management
Console (MMC) and Windows Management Instrumentation (WMI).
- Windows Firewall: Allow file and print sharing exception. Used to
specify whether file and printer sharing traffic is allowed.
- Windows Firewall: Define port exceptions. Used to specify excepted
traffic in terms of TCP and UDP ports. In this step, define the same
ports as you selected for unmanaged computers and from the system
requirements step.

Additional details on the settings available within the administrative
template for Windows Firewall have been documented in "Using the Windows
Firewall INF File in Microsoft Windows XP Service Pack 2" the sections
labeled "Enabling Remote Administration" and "Adding Static Ports to
Windows Firewall's Default Exceptions List".

COM+ Settings: The COM+ endpoint registry settings for the Windows
Update Agent can be configured as a Group Policy registry policy object.
Guidance on how to create a policy for this is located in the Microsoft
Knowledgebase article 323639, and includes a generic sample that you can
modify. When doing this, you must base the policy registry key on the
following:

HKEY_LOCAL_MACHINE\Software\Classes\
AppID\{B366DEBE-645B-43A5-B865-DDD82
C345492}\Endpoints REG_MULTI_SZ "ncacn_ip_tcp,0,n" 
(where n is the port
number you have decided to use.)

Note: When using this method, be aware that additional administrative
template settings may be needed in order to remove this registry setting
when the functionality is no longer desired.

Step one, don't panic....

So I turned on a workstation...one that hadn't been on in a while... and kinda forgot about it... and tonight I was checking the ISA logs to see why the MBSA 2.0 wasn't scanning the network like it should (long story...still in investigation...stay tuned to the blog) and I realized that every minute or so there was this "heartbeat" in the ISA logs.

http://66.151.158.177:80/l?526=-1N8753

....what tha?  says I and I start looking at the computer it's coming from...

So visions of OH MY GAWD I HAVE A TROJAN I'M OWNED .... I'LL BE LICKING STAMPS UNTIL THE DAY I DIE INFORMING CLIENTS THAT MY NETWORK HAS BEEN OVERTAKEN BY ZOMBIES SENDING OUT PHONE HOME MESSAGES TO SOME FOREIGN COUNTRY LOCATED IN......hang on...let me check who's IP that is...... THE TERRORIST COUNTRY OF.....hang on lemme look this up on Arnis... THE TERRORIST COUNTRY OF...Atlanta, Georgia? 

Huh? 

OrgName:    Internap Network Services
OrgID:      PNAP
Address:    250 Williams Street
Address:    Suite E100
City:       Atlanta
StateProv:  GA
PostalCode: 30303
Country:    US

Okay so I calm down enough to realize that the 'heartbeat' I'm seeing is a leftover..old... left to expire from not being paid...but not yet uninstalled...the way we remoted into one pc a few years ago install of ...

Yup... "Gotomypc".

While it may have been an expired account.. it had a red X in the corner... it was alive enough to do a heart beat out to the Gotomypc/Webex servers.

Just a FYI... clean up those kinds of programs on computers.....

So you need to get a USB floppy disk on a server, do you?

A connected USB floppy disk drive does not work when you press F6 to install mass storage drivers during the Windows XP installation process:
http://support.microsoft.com/?kbid=916196

I have a server.. it has no floppy drive.  Now if I want to have SATA drives or something... I need to ensure that I can hit F6 during the install and get the drivers on the box...but ... hmmmmmm may need to warn someone about the fact that there might be times that you can't use a USB floppy... at least on a XP machine.  Wonder if the same is true for a 2003 box?

Can't you just imagine the phone call to product support?

After you restart a Windows XP-based computer, the desktop is displayed upside down:
http://support.microsoft.com/?kbid=915164

Hello?

Yes my computer is upside down?

Excuse me?

It's upside down!

...and a 13 year old on the website solved the issue...

A compelling upgrade story - aka the carrot

Someone asked me ... if a vendor shouldn't be able to have a compelling reason to get you to upgrade.  I mean let's face it.... vendors don't want you to be satisfied..they want you to want more.  To think you need more.  So they are going to want to stick a carrot out there to make you upgrade.

So here's where my geek view meets my beancounter view.....

Geek views....

Read both Wayne's blog and Nick's blog....they have the view (and rightly so) that line of business applications are deadly slow in updating.  That you don't rip out the working SQL database with a new one until the line of business vendor signs off...and they normally take like a service pack or two before they feel confortable updating.  Add on top of that that recoding and testing is like .... oh... slow as molasses..... like watching grass grow... or any other trite statements about how you don't do this easily.  They also have a view that SBSers should be able to compartmentalize SBS and allow not only for additional CAL rights for the SQL 2000, but downgrade just the SQL part back to the SQL 2000 from the SQL 2005 workgroup.

Beancounter views....

A vendor needs a carrot.  They need something to get you to upgrade.  Yeah it's a bit sucky on this...but hey...that's business.  SBS has always been from day one a "bundle" and Microsoft has never allowed a person to "just" upgrade a part of the software ..it's an all or nothing.  So if you want those additional Exchange cal rights or those additional SQL 2005 workgroup cal rights?  You'll need to eat the carrot and upgrade.  And you'll have to upgrade to SQL 2005 workgroup and not get downgrade rights to SQL 2000.  You need SQL 2000 because of your sucky line of business app  is waiting for service pack 3 before he or she even begins looking at SQL 2005 workgroup?  Sorry you'll have to stay back on SQL 2000. You'll have to order the SBS 2003 sp1 sku.

So what do you think?    ... yeah there will be a need for SBS 2003 SP1 in the channel for a long time as those line of business apps are slow....but if you want R2... as a business owner I think it's fair to ask you to eat the carrot.  As a geek... yeah I know that those applications won't be ready for SQL 2005 workgroup for a long...long time.

But the business side of me thinks that the vendor should be consistent in how it's bundled the software in the past... and allowed their carrots....

So what do you think?

There's ONE I haven't HAD Yet?

I got pinged on IM with two questions from my nephew tonight ....

I'd agree, he seems like a reasonable guy for a Boss....

The Official SBS Blog : Meet the SBS Team!:
http://blogs.technet.com/sbs/archive/2006/03/27/423296.aspx

...and ... yes Bob, I've met him, and he seems like a reasonable guy for a Boss to me too...

Here we go again

In January there was an unpatched IE flaw..one that had folks scrambling for cover.  And someone came out with a "community fix".  Fast forward to March and deja vue again.

Unpatched IE flaws.. patch in the works... antivirus vendors having protections in place..... we have mitgations .... and we have a community patch.....

Okay gang let's take a lesson from last time again.....

I CANNOT SET YOUR RISK TOLERANCE LEVEL FOR YOU.

Only you can look at your firm and your desktops and your risk tolerance and you know how your clients surf and how you have your network setup to know if you should use anyone of these mitgations or do nothing at all.

Only you can do that.  So I'm not going to tell you or recommend that you take any other action other than to remind you that we're in this same position and we will again.  So if you are sitting there and you feel you are at extreme risk... then figure out if you truly and really are at risk...or if you are merely in a state of fear because you don't know the true risks of your network.

But whatever you do... test.  Because I can't do this for you.  Only you can decide what is the acceptable risk for your firm, your clients, your networks.

My name is Susan, and I'm a patchaholic

There's a new graphic in the side bar of the blog... it indicates that due to the fact that I'm a SA customer I'll be getting SBS 2003 R2.  The one with "just WSUS".  Yeah it's the one that no one in the Var/Vap world is seemingly excited about...but I am.

I got the graphic off the Official SBS blog.

It's times like these that I still say I represent the end user view... because I still think it's cool that SBS will have a patch engine under the hood in the future.

I'm outting myself tonight and saying that I still get goosebumps when thinking how far we've come in patching our SBS boxes that it can now be even be considered a marketing feature.  Back in the 4.5 days...heck even the 2000 days ...there's no way that the "patchability" of a network could even be considered an advantage.  Could even be touted as a feature. 

But hey.... I'm a patchaholic.

Want to know more about the SBS 2003 R2 stuff?  Check out two chances to talk to the SBS Podcast gang on Wednesday.

They myths of the Internet

I'm not pulling your leg, honest:
http://www.microsoft.com/windows/IE/community/columns/pulling.mspx

Read Sandi's excellent article about the myths of the Internet...

The question came up on a listserve of how effective "System restore" was to go back "before" an infection by a trojan.

"Antivirus utilities can affect whether your system can be restored to a previous point. If a restore point contains an infected file because the utility is not set to clean the file within the restore point, or if an infected file has been removed from a restore point by an antivirus utility because it could not be cleaned, System Restore will not recover the computer to this partial or infected state. If System Restore could not restore your computer to a previous state, and you suspect that one or more restore points contain infected files or have had infected files removed by the antivirus utility, you can remove all restore points from the System Restore archive by turning off System Restore and then turning it back on. "

But the question is now..do you know when you had the "incident"?  Because truly.... malware, spyware and viruses are an "incident".  The best way to handle a security incident is to install from trusted media.. that's right you start over....

Help: I Got Hacked. Now What Do I Do? - Microsoft TechNet: Security Management Column:
http://www.microsoft.com/technet/community/columns/secmgmt/sm0504.mspx

MCE plus SBS plus RWW without messin' with the media extenders

Hi,

Since this seems to have been a popular topic, I thought I'd let you know that I've solved this problem for those that have SBS2003, MCEs, and MCXs (and aren't afraid to do some tweaking). I posted a "how-to" guide on TheGreenButton.com ).

For whatever it's worth,

David

Hey thanks David!  What's he's done is give the info on how to have a MCE retain the media center extenders and still have RWW access!

So you have an application that needs to update all the time...

So you want to try this "non admin" thingy I keep harping about but you have this application that updates like every week... so how do you update it..but still run as LUA at the same time?

Well in Aaron's blog he has some ideas in part one... but one way you can consider running that "one" app is setting up a batch file that does a RunAs in front of the application.  Tristan has an old blog post on the topic.

If the application only needs updating by one person.. let that one person handle the updates.. if it depends on all workstations needing updates... well you'll need to decide the best way to handle this.. maybe not right now (and especially not during tax season...) but just keep in mind how your clients work and need to have their applications to run.  For those that need constant updating.. you might need to anticipate those needs.

I think Small Business Jedi Council has a nice ring to it, don't you?

A major thing I like about the Mssmallbiz.com site is the fact that it's a sharepoint site that sends me alerts.  Today Eric asks on the blog "what do you think it should be named?"... as naming does mean that folks immediately know what the 'thing' is about.  It helps people know immediately what they'll find at the site.

So you up for a little renaming to help clarify the site to newbies?

He offered up....

• Small Business Fellowship – A Lord or the Rings fan?  “Welcome to the Fellowship of Small Business”
• Small Business Channel – A place you “tune in to” to get information, ideas, resources, etc. while remaining true to the focus being around those who supply the technology solutions to Small Businesses
• Small Business Collective – A Star Trek fan?  Join the Collective today.  “Resistance is futile.”
• Small Business Society – An upscale place?

I think Small Business Jedi Council should be one up for a vote... but I'm probably the only one to think that ...not to mention George Lucas might want some royalties or something.... I think I like Small Business Channel.

What about you?

Patch Tuesday

I just realized that June's Patch Tuesday will be while I'm in Boston.... I think that's the 4th time I'll be away from the office during a Patching week.  I'll be the "control freak" in the room checking out the security bulletins during the presentations (as I'll have my aircard and tablet of course)

So what do I do?  I look at the patches.  Are they of high risk enough that I need to remotely patch the server? The workstations?  Can I wait?  Do I have other mitigations in place ..or CAN I put other mitigations in place to ensure that I'm protected "enough" until I physically get back?

I look at the role of the machine for the risk level.  I look at the 'chatter' regarding the patches.  "From remote"?  Do I have that risk installed?  Running?  Exposed?  Is there a Proof of concept which means that the exploit is probably near?  Has the exploit been put in an automagical tool so that even us blondes can go out and run it?  So all of these questions go though my mind when deciding "when" to patch and resources on patch testing.

Fixing the real problem

The other day I needed to 'hop on' a clients accounting system/network to pull over a data file.  And my normal tool, a WebEx "permission based" remote control tool wasn't using.  Well it turns out that the problem was that the computer I was trying to connect to was using Firefox as the connection medium.  And Firefox and ActiveX of WebEx wasn't working well for obvious reasons.  So I ended up having to try LogmeIn Reach as a tool for remote control.

So why did I end up having to do this?  Because the IT staff at that location hadn't fixed the real problem. 

The real problem here was that IE got horked.. now yes you can say that may be normal around the web these days.. but the reality is that the user probably surfed and did something she shouldn't have.  And rather than fix the real issue (too high of user rights to allow such horkage in the first place), the IT folks just install another browser but don't fix the real problem.. that of eduating the end user and protecting them better.  They see another Browser as the answer.  Chosing another piece of software, in my opinion, isn't the answer when the underlying system hasn't been fixed for the REAL problem.

As someone posted to me last night... they run systems as "local admin" now because they really don't get "that" burned.  Sure a little popups ...a little spyware... but I mean really... not THAT bad to counter the annoyances of running without admin rights.  I think we're close to...but not quite there.. to where we will get more burned than we are now.  And we need to at least get ourselves prepared.

Do me a favor. 

Take one workstation in a clients office (or yours for that matter) and if you are not running that system as a non admin now, flip it.  Make a new user and make it a "restricted user".  Now tell me all the applications that aren't working for you.  Tell me their names (send them to sbradcpa -at- pacbell.net).  But I want you to try running as non admin for a day.  See how much it "hurts".  See how much it's annoying to you.  Now keep in mind that you need to install software as an administrator, but in general software "should" be able to run as a non-admin.

Should everyone be a non admin in an office?  Good question.  Can't answer that for you.  Some would argue that they can't have non-admin firm wide...yet....but I guarantee you in your clients there are folks in certain "roles" that do not need to install software or updates AT ALL.  So why should they have admin rights? 

Assign risks to your users. Some need more protection.. some you need more protection from.  But let's look at the real problem in our networks. 

Yeah.. it might be hard "at this time" to push everyone to run as non-admin...but I'll bet you you can push some of 'em and they'll never notice a difference.  At least not on the things that they need to do for the business.  You, however, will.

So out in the field...

And I get this call that someone needs to get an updated information on to their accounting system.  I had already pulled over a zip file of the database using Logmein Reach as they did not have RWW, and so I had the data file on the server, but not on the workstation in a position accessable by those who needed it.

What to do?  Well with the Cingular aircard, not a problem.  We just remote back into the office (as I have my laptop with me) and do what I need to do.

No need to walk someone over the phone in how to do what needed to be done, no need to say "sorry can't do that, can we rebook the meetingi for tomorrow?"  I had the access I needed when I needed it, in a secure fashion so this was not an issue.

Bring your own access!

"THE" Blog to have at the top of your blogs to read.

"THE" Blog to have at the top of your blogs to read.

and no I'm not talking about Vlad's blog...or Happyfunboy... or Anne's or Amy's or Dana's or anyone else.....

This one.  This one right here is the blog you want to watch.

And in this post they say why you need to watch this one.

ISA and ActiveSync and Mobile 5

John posted this in the newsgroup...

Setup is SBS Premium SP1, Exchange SP2, have not installed ISA SP2.

Otherwise fully patched. Two Nic, ISA, Sonicwall router. Certificate from

Thawte.

We have both WM 2003 2nd edition and WM 5 devices. The WM2003 with Active

Sync 3.8 works fine. The WM5 with Active Sync 4.1 devices have issues. I

have followed the document "Deploying Windows Mobile 5.0 with Windows Small

Business Server 2003" at http://go.microsoft.com/fwlink/?LinkId=62797 but

have the following problems with USB sync:

I first get the message that "The proxy server you have specified is

incompatible with your device. Specify the correct proxy server in your

connection configuration. Support Code: 85010008" I resolve this issue by

adding our external FQDN to the exception list on the device on the

Connections|Advanced tab.

Then, I can't sync at all and get the error message that "The server could

not be reached." The ISA logs shows "Denied Connection" for the Destination

IP of our external IP address, Port 443, HTTPS Protocol, Rule is SBS

Internet Access Rule. After some research, I temporarily resolved this issue

by changing the SBS Internet Access Rule to apply to All Users rather than

to just SBS Internet Users. Rather than permanently changing the SBS

Internet Access Rule, I created a new rule that was identical to the SBS

Internet Access Rule except that it applied to All Users and only the HTTPS

protocol. This resolves the issue.

This results in two questions: 1) Why does WM2003 work and not WM5 unless I

make the above changes? 2) Does a rule that is identical to the SBS Internet

Access Rule except that it applies to All Users and only the HTTPS protocol

a security risk?

I'm also hoping that my experience and research can help someone in the

future.

Thanks,

John

And the answer is that ISA has some issues with Active Sync 4.1.  Rather than allowing "All", which disables all egress (outbound) filtering, it might be wiser to just give those mobile users this "all right" so that you aren't opening up the entire network.....

Is it a security risk? It opens up all outbound so while you are not allowing things besides what you want inbound, it does mean that anything that wants to go out...goes out.

Egress filtering (outbound filtering) is also something that's recommended to do from a "let's do our part to keep the Internet nice and safe".

Just something to think about...and it depends on your view of risks.

Be a "Dumper"

I saw this post on Peter's blog and immediately thought of a person I know who loves dump files.. doesn't get to play with them as much as he use to ...and he used to say that SBS dump files were some of the ickiest sometime because of our "all eggs in one basket" that we sometimes had stuff all over the place that you had to read through and figure out.

So check out Peter's post!

Choices for our risks

There's a new security advisory tonight.. http://www.microsoft.com/technet/security/advisory/917077.mspx  and the advisory states "Based on our investigation, this vulnerability could allow an attacker to execute arbitrary code on the user's system in the security context of the logged-on user. We have seen examples of proof of concept code but we are not aware of attacks that try to use the reported vulnerabilities or of customer impact at this time."

So let's recap our options shall we?  Here's our Tinfoil recap:

• Ensure you are running Outlook 2003 as the preview pane in that version does no scripting -   (check got that)
• Run in the rights of the users - not local administrator- so we should be running as LUA or screaming our heads off to our bosses and firms to do LUA (as Vista will be pushing us that way anyway)  - check
• *Note* Customers who use the Microsoft Internet Explorer 7 Beta 2 Preview <http://www.microsoft.com/windows/ie/ie7/default.mspx> that was released on March 20, 2006 are not affected by the public reported vulnerability.  -- AH HA deja vue.... one of the ONLY times I rolled out a beta (besides MSAS) was in the XP sp2 era and an download.ject pushed me into deploying XP sp2 beta on my risky workstations. So if we want to take a beta risk...we will be rewarded with protection....
• So far (at this time) I've seen POC postings but no web sites in action...and like the WMF issue last time I would have fired someones assets if they had surfed to that site (and a reason that I don't like banner ads on www.msmvps.com)
• Run in high security in Internet Explorer... and put sites we know in trusted zone (question... in XP I use this old IE 5.x power toys that adds a little button to make it really easy to add sites into the trusted zone)
• "Dropmyrights" in IE (the Michael Howard IE tool) should also do it's job (I'm presuming yes).
  
  .. okay so Chicken Little and the tinfoil gang have options, right?

I've got the Blue Magnfying glass to go with my Green Check

Today he's gone from being a security friend and guru, to a Small Business Security guru.  It's cool to see this come to the marketplace.  I find that it adds a great deal to my already daily routine of my morning email.... in the next phase, SBS 2003 R2 will give me "green checks" in my daily email.

But today, I get blue magnifying glass every day at 6 a.m that keeps me aware and is part of that "hardening me" the business owner process.

Scorpion Software releases Firewall Dashboard for Microsoft's Small Business Server 2003

Chilliwack, BC: March 22, 2006 - Scorpion Software Corp. today announced the general availability of version 1.0 of Firewall Dashboard, a security analytics tool to proactively identify threats before they become problems to small businesses that are using Microsoft's Small Business Server 2003 (SBS 2003). With the Firewall Dashboard, owners of SBS 2003 can now change their raw firewall logs into meaningful and interpretable graphical threat assessments. With its unique ability to first aggregate log data, and then filter out network chatter, users of Firewall Dashboard can easily peel back the layers of firewall event complexity to find the real issues their network is facing. More information about the Firewall Dashboard is available at http://www.scorpionsoft.com/products/fwdashboard/.

"The Firewall Dashboard is our first security analytics tools to help small businesses understand the real threats to their business." says Dana Epp, Scorpion Software's President and computer security software architect. "We want to get relevant computer security intelligence information to business owners, and we are pleased to have worked with the small business community in designing and testing this product. With over 100 SBS servers already running the Firewall Dashboard during its development process, we continue to receive great feedback from SBS administrators and business owners in the field who are actually using the product every day." Testimonials from some of those users can be viewed at: http://www.scorpionsoft.com/products/fwdashboard/testimonials.html

Pricing and Availability

Firewall Dashboard is available today to customers worldwide through Scorpion Software resellers and the Scorpion Software Company Store at https://secure.scorpionsoft.com/store/. MSRP for a single one year license of the Firewall Dashboard is $95 USD. Resellers can purchase the Firewall Dashboard Reseller Pack, a five (5) unit bundling of one year licenses for $356.25 USD.

About Scorpion Software Corp.

Scorpion Software Corp. is a leading provider of security analytic tools for small business, helping organizations proactively identify and remediate network and server vulnerabilities by getting relevant computer security intelligence information to business owners. Headquartered in British Columbia, Canada, Scorpion Software helps small businesses manage online risk while offering unprecedented automated audit reporting and analysis. More information about the company is available at www.scorpionsoft.com.

I do get one Support call now due to SA

Ah but I DO get this as a software assurance benefit...

Dear Susan Bradley,

Please note that the content of this email has been created by Microsoft and is being sent to you by Microsoft, on behalf of the Software Assurance Benefit Administrator, Susan Bradley , within your organization.

As a Microsoft Software Assurance customer, your organization is eligible for benefits that can help you get even more value from Microsoft’s technology. 24x7 Problem Resolution Support (PRS) is one of these benefits.

You have been identified as an Authorized Contact to use this 24x7 Phone Support and Web Support Software Assurance benefit. In order to access this benefit you will need the following Software Assurance (SA) Access ID.

SA##########

24x7 Phone Support
When you want to use phone support, dial the PSS support line. You will then be asked to provide your ID. Use the SA Access ID to open problem resolution requests on eligible Server, Windows and Office products. Your organization has a limited number of phone support incidents, using this ID helps limit access to specific individuals. You can find the Product Support Services phone numbers at http://support.microsoft.com/gp/saphone. More information about 24x7 Problem Resolution Support can be found at http://support.microsoft.com/sasupport.

Web Support for Servers with Software Assurance Coverage
For eligible Standard and Enterprise Edition server products with current Software Assurance coverage, the SA Access ID allows you to open problem resolution requests via the web using the Microsoft Online Assisted Support (OAS) interface http://support.microsoft.com/sasupport.

Please note: If you are also an Authorized Contact on a Premier Services contract, then your SA Access ID allows you to open problem resolution requests via the normal Premier Support channels (Premier Online for eligible server products). Support service levels for these various offerings remain unchanged.

For more information about the number of 24x7 Problem Resolution phone support incidents available to your organization or which servers are eligible for this support coverage under your SA Access ID, please do not hesitate to contact your Benefits Administrator, Susan Bradley.

For more information about Software Assurance, please refer to http://www.microsoft.com/licensing.

Please note that the use of this SA Access ID is specifically granted to you, and is bound by the Terms & Conditions of Microsoft's Problem Resolution Support and Support Lifecycle policies. This ID is not transferable to other individuals within or outside your organization.

You should also note that the use and deployment of Problem Resolution Support software, and any other software provided to our organization in connection with Microsoft's Software Assurance enhancements, is subject to the terms and conditions of our Volume License Agreement, the Product Use Rights (PUR) and the applicable eligibility criteria set forth in the Microsoft Product List and the Microsoft Volume Licensing Services (MVLS) web site.

Once again, we welcome you to Microsoft Software Assurance benefits!

Thank you,

Microsoft, on behalf of your Benefits Administrator

What "I" get with SA

Well eweek talked about Microsoft's offering of "Information Work Solution Services" as part of a SA benefit for small to medium firms.  Once again..it's either eweek not getting the facts...or someone at Microsoft doesn't define Small firms like me as a "small firm".

I have SA licenses for Office and Windows and SBS.  I don't have company wide licenses either... so when I looked at the new SA coverage, the only thing I went ..oh..okay I get that new thing.. was one Support call.

As you can see from this chart inside my licensing window (one for the server, one for Office/Windows), only those items that are hyperlinked am I eligible for.  Everything else I'm not.

So on this screen I get some training cdroms... and the biggie advantage for Office on SA... is that Home Use Rights.  The other day my sister was asking what was the cheapest way to get office for a employee at the place where she works and she went "hang on...we're on software assurance..we have a "Home Use Rights" plan.

On this one I get a Virtual PC Express and the biggie for me is that 1 phone call now I get with SA.

But if you are concerned that suddenly "any" certified partner is going to start calling me for a free day long training session...guess again.  Unless your small firms regularly buy a lot of software, we're down below many of these benefits offered by Software Assurance.

SBShow on Managed services

Is managed services a fad?  Or just something that we should be doing as good networking folks?

I'd argue it's just good business.

Show description:  http://www.vladville.com/2006/03/sbs-show-15-managed-services-with.html

Show download:  http://www.vladville.com/sbsshow/sbsshow-episode15.mp3

Like DUH folks - MCE has rapid sales

Chris Lanier's Blog : Microsoft Sees Rapid Media Center Sales:
http://msmvps.com/blogs/chrisl/archive/2006/03/21/87204.aspx

Yes, there is rapid sales because of the two retail software that our Small Business folks can buy at a retail store, at LEAST Media Center can be hacked to join a domain is why.

This has got to be one of the stupidiest stats I've seen..... go into a retail store and see what is being offered in there.  Home and MCE...and MCE is even being placed on laptops.

Does Bill or Steve know how many times my fellow SBSers walk into a firm and they are stuck with XP home or MCE as the operating system that the owner bought because that was the ONLY thing at Best Buy they could get?

Small Business Server hardening guidance

On the Security 360 webcast that was on earlier today, the topic was on "browser hardening".  And the VERY first question was about Small Businesses and they were looking for guidance on hardening.. and the question included hardening of the SBS box.  I tell ya... us SBSers are EVERYWHERE aren't they? 

Here is the guidance I would highly recommend as guidance for locking down a SBS box.

1. Walk to the server.
2. Turn around.
3. Yes, I said turn around.
4. I really mean, you need to turn around.
5. Walk to the nearest workstation that has a user working on it.
6. Shove the user aside (nicely of course, but you want to be in front of that user's workstation using their session).
7. Click on the date and time in the corner.

Got that?

So why is that a hardening step for locking down a SBS box?

Because I would strongly argue that your biggest threats on a SBS network is the end users.  End that have local administrator rights.  End users that can download and click.  And if you can click on that date and time and it comes up and allows you to modify it, that user most definitely has the right to introduce risks into your system.  So lets talk about how we can harden the workstations, shall we?

Want to harden a SBS server and network?  Start by hardening the user. 

• You don't surf at the server
• You don't use the server as a workstation
• You educate your users that "download here for free" translates into "yes, you really do want malware on your box, don't you?"
• You have an acceptable use policy that says "yes, this is okay to do" and "no, this isn't appropriate for our firm" - check with the sans.org policy site to set up an acceptable use policy.

So that that you have that education task out of the way... you harden the desktop.  Here's the hard part... you need to check with the applications that are poorly written and won't work under these conditions.  Some of these things are not for all..but it will take YOU some time to do, so play first on your own boxes before rolling this out to your clients.

• Get more control using Group policy - Consider IE active X browser filtering using this KB by Nick "the naked MVP" Whittome -
  • Outlook Web Access and Small Business Server Remote Web Workplace do not function if XP Service Pack 2 Add-on Blocking is enabled via group policy:
    http://support.microsoft.com/kb/555235/en-us
  • I honestly do not think that we do enough in group policy in SBS.  We have the GPMC tool right under the hood and all it takes is us to get up to speed.  GRAB A BOOK.  And read this spreadsheet to see all the potential for things you can control.
• Use ISA 2004 (only in premium) or your firewall software to block sites
  • We had this the other day... mysite.com is not for business and thus sites like those should not be used in the office.  Bad sites introduce risk. 
• Get those workstations down to "normal" user mode.
  • Sit down with that client/customer and see what key line of business applications they have.  If they are "designed for XP" they will natively run under this 'normal' user mode or LUA.  If they are not logo'd, come out to the newsgroups, communitities and google on ways to get that app down to 'normal user' mode.  Yell at the vendor. 
  • So many of the latest security vulnerabilities will launch things in the 'context' of the user, so the lower rights you have, the better you are
  • Review Aaron's blog about these issues
• Get patches on those boxes/Get on the latest software.
  • When SBS 2k3 R2 comes out, the "green check" of updates will be there to help keep that system up to date.  You don't have to wait until then or buy it if you don't want to.  Download WSUS now.
  • IF YOU DO NOTHING ELSE, FLIP YOUR SYSTEMS OVER TO MICROSOFT UPDATE.  Yes, I know I'm yelling, but we truly now, with Microsoft update, have the ability to patch our entire system (YES even ISA Server 2004 - which hasn't needed a patch yet), so all the way from the workstations to the server can now be done by MU.  If you have not, all you have to do is go to Windows Update and on the right hand side is the place to click to "flip the bits" over to Microsoft Update.
• Install the same sort of security at home that you do at the office
  • We buy Trend pccillian for all home pcs (especially those that remotely connect back to the network)
  • We require that they have XP sp2, firewalls and all the normal stuff I have here at the office.
• Follow some of the information and guidance on Dana's blog.  He had a webcast on Compliance at the SBsummit..

But even with all of this... what's the best way to harden a SBS server and a network?

You start by hardening ME.  Me the business owner.  Me the onsite admin.  You harden me, you get me to understand that you can't just harden the server, that "I" have to change.  I can't download things like I used to.  I can't surf like I used to. I have to be a little less trusting.  A little more aware.  A little more paranoid.  Accepting of the balance between security and business that I need.  We need to work on this together.  You need me to understand that there's no easy fix.  No one button that I can point you to.

You don't get it by downloading a guide.

You start by hardening ME.

Only then will you have a hardened Small Business Server network.

Vista in late 2006 for us insane SA'ers, 2007 for consumers.

Microsoft Updates Windows Vista Road Map: Business availability for Windows Vista in November 2006, consumer availability in January 2007.:
http://www.microsoft.com/presspass/press/2006/mar06/03-21WindowsVistaDeliveryPR.mspx

Oh good.  More time for me to go beat up Intuit's Quickbooks over LUA and admin rights. 

Someone was asking how do deploy new change like this.... and it's a change management item for sure.  What I do is choose one of my canary testers to be the "early adopter/technology bleeder".  This person will get the OS before anyone else, before me even, and they will go through busy season on that bleeding edge platform.  They will be a "youngster" in the office and thus used to technology as they are recently from a college or University. 

Don't get me wrong, I'll make all software work, but this person will be a bit bleeding edge so that when we get ready to roll new technology out firm wide, this person will know all the tweaks, all the annoyances, all the nuances for a good computing experience.  This helps to reduce the learning curve when you have someone in that "guru" spot that you can go to.

So why do I not do the 'guru' role?  Because I want to stay back with the pack so I can track the issues on existing deployed software.

Real server hardware

See that ... that's a sign that I've got troubles... but you see... I shouldn't be freaking.  If this was a "REAL" server and not my OEM version, I'd be going...okay ...let's deal with this but don't freak because you have a RAID array, good quality hardware and a real server.

On my OEM, this is not real server hardware, and I have no RAID, so no fault tolerance of drives.  Heck I'm soooo non best practices on this OEM test box I don't even have a backup of this.

Do I do this at home where I do have a server that I somewhat care about?  Nope.  I back it up with a LACIE harddrive.  Do I have RAID at home, honestly not, but it is a slightly better server.  Do I do this here at the office where it really is important?  Heck no.  I have RAID, I have server quality hardware, I have backups.

But keep an eye on those daily logs... as just like this, they will give you a heads up that something needs to be done....

(running a chkdsk now as a matter of fact)

P.S. note to self.. when the box has to reboot to do a better checkdisk and the OEM server is headless...keep in mind that you can't see when it's asking for input... gotta go drag it next to a spare keyboard and monitor...

Chris Philips on SBS 2003 - Executive Chat

Executive Chat: Windows Small Business Server 2003 R2
Please join Chris Philips, General Manager of the Windows Sever Solution team, who has worked on this second release of Windows Small Business Server 2003, to discuss what is in it for you and what it can mean to your customers. Exchange points of view, ask tough questions, share experiences and get answers.

http://www.microsoft.com/communities/chats/vcs/06_0413_TN_exec.ics

April 13, 2006
10:00 A.M. Pacific Time
Additional Time Zones

http://www.microsoft.com/technet/community/chats/chatroom.aspx

http://www.microsoft.com/technet/community/chats/default.mspx#06_0413_TN_exec

Sprint PPC 6700 Windows Mobile 5.0 device ROM upgrade

Jason Roy in the SBS2k listserve posts.....

I thought I would share this with the group as I know a few of you have
a Sprint PPC 6700 Windows Mobile 5.0 device.  I stumbled across and an
updated ROM image for the Sprint 6700 on their support site that has the
Messaging & Security Feature Pack integrated.

This gives you the capability for the Direct Push technology, remote
wipe, and support for A2DP.

I went ahead and flashed my phone and have not experienced any issues at
this time.  As an added bonus, they have also included additional
applications such as voice services.

Be advised that the flash update will erase any data that is stored on
the phone and reset the device to factory default settings so you will
need to reconfigure all of your settings once it is complete.

Here is the direct link to the download:

The "Canary"

So what is a "canary" in patch testing anyway?  Since you probably cannot recreate exactly a replica of your client's (or your) network for testing purposes.... you choose a "canary".  Back in the days of coal miners, they would take a canary into the coal mine and if the bird survived, they knew they still had good air... if it didn't.. well. then......you know you are in trouble.

So when you start testing the "now" optional patch that will soon be part of a security patch, you need to select a person, a patient person, and ask them to be your canary.  The system that is prepared to be your early warning system.  To ensure that the "other systems" survive.  Thus take that patch and Install it now on one machine.  Ensure that the person using that systems tests all the line of business applications that firm needs for business and reports back to you regarding all the key line of business applications that do not function as they should.  Contact the app developer and ensure they are aware.  If there are issues, things you just can't get around, contact Microsoft on this to see if they can work with the vendor in solving the issue.

Already there are known issues http://support.microsoft.com/kb/912945/en-us:

You may experience an access violation in the Google Toolbar when you close a window that contains an inactive ActiveX control. Microsoft and Google technical teams have been working together to address this issue. Google is expected to fix this problem by using its automatic "servicing mechanism" for Google Toolbar users. This problem affects Google Toolbar versions before version 3.0.129.2. Visit the following Google Web site to download the latest version:

Start testing that IE patch now

MSFT Upstate NY Technology News and Events : Internet Explorer ActiveX Update being deployed - April 11th 2006:
http://blogs.technet.com/upstate-ny-technology/archive/2006/03/20/422522.aspx

http://support.microsoft.com/kb/912945/en-us is right now in the "optional" section.  Take a "canary" or your own shop and install this and see what it does to web apps.

That Active X patch will be in the next IE update.

What's a "canary" you ask? You take a person, patient, a bit of a uber technologist in the firm you do patching for, you deploy the patch to that person first and ask him or her to monitor the patch impact.  Check those line of business applications.  Ensure that web apps aren't affected in a dramatic way to stop business.  Start now by testing this patch.  It's in Microsoft update in the center section.  And remember ..this patch isn't there because of a security issue, but because of the way our American patent law works.

Testing plans

Identify the operating system subject to testing.

Identify the service pack level.

Identify the hotfixes installed on your systems (if in addition to security fixes).

Identify critical third party applications.

Identify third party applications that have had patching historically.

Identify those files used in patches that may have causes issues in the past. Are the included in this current patch? Assign testing resources appropriately.

Study the bulletin to determine if you can uninstall the patch. If not, determine if additional resources for testing or imaging need to be in place before approving the patch.

Test the installation of the patch both manually and via your automated patch technology.

Can you uninstall the patch using add/remove program or your patch tool?

Review the processes of your line of business applications. Are they performing as expected?

Attempt to replicate a production environment using imaged data. Having an exact image provides the best testing bed.

Set up performance and monitoring tools to review your testing machines43 such as PerfMon, tools from Sysinternals44 and review all log files.

Confirm the installation of the patches via registry review or other means.

(OPTIONAL) Confirm the effectiveness of the patch using testing code.

Follow any additional procedures your situation requires.

Approve the patch for release.

PREPARE BACKUPS.

Company web needs a little help in the external link department?

So you have some links in company web that aren't properly resolving externally?

There are some links on companyweb that don't include the domain name, you need to manually modify them, the appears to be the case on standard too.

They can be modified easily at http://companyweb/Lists/Links/AllItems.aspx

P.S.  Adding Chad's comments about ISA...

Now, for those Premium customers running ISA, you can configure link translation within ISA. As a result, you can have hard-coded internal links on your companyweb site (that point to http://companyweb/<whatever>">http://companyweb/<whatever>). But when you access these links from the outside, ISA will do the heavy lifting for you and automatically translate the links so that http://companyweb is replaced with https://<your.fqdn.com>:444 Way cool :^)

Mobilize SMB©: Taking the SMB Community to the Next Level

Check out what Amy Luby is doing!

Mobilize SMB^©: Taking the SMB Community to the Next Level

Coming to a city near you!  This half day workshop will provide the information and support you need as an SMB IT solution provider to help you build a solid SMB Managed Services Business Model.

What are the pitfalls to avoid?
How do I pay my technicians under this model?
How do I know how many technicians I need in this new model?
What are the stages in moving into a Managed Service Model?
How will this affect my vendor relationships?
How do I measure, and why does it matter what my technician utilization rates are?
How do I sell managed services?
How do I construct my service level agreements?
Who wants these services?
What or who is my competition and how are they doing managed services?
Are there any vendors out there that understand my business?
What tools are available?
What skills do I need?

http://www.mobilizesmb.com/default.htm

I think it might be easier if the folks in Indiana just move?

http://www.microsoft.com/windows/timezone.mspx

Time changes.

Yuck. It's bad enough when an OEM box I have does not grab that "automatically adjust for standard time" and the person starts booking his appointments an hour off from everyone in Outlook... now the entire state of Indiana is going to have to deal with this issue.

The "real" LUA instructions for Quickbooks

The other day I said that it got a lot colder because Intuit finally came out with official instructions to run Quickbooks as a non admin.

Well.. we just warmed up a bit... as while there is a web page with instructions... the instructions are wrong and are missing a key element that makes them not work properly.

In the "official" instructions they say that you need to

Edit permissions to Allow: Full Control for QuickBooksUser in the Access Control List for the following files and registry keys:

File System:

• C:\Program Files\Intuit *this is the default folder; adjust the folder name as appropriate for custom installations.

• C:\Program Files\Common Files\Intuit

Registry:

• HKEY_LOCAL_MACHINE\SOFTWARE\Intuit

• HKEY_CLASSES_ROOT\QuickBooks.CoLocator <<< this key is wrong<<<<

• HKEY_CLASSES_ROOT\CLSID\{E53C85D6-E6D9-4BCF-A623-72062A99AA7F}

There's one problem...that one setting, HKCR\Quickbooks.CoLocator should be HKCR\Quickbooks.CoLocator.1

Tested here and you can see that the LUA setting works with the CoLocator.1 which ends up being the same as the community instructions here.

So you want to be a SBSC?

David asks... "I have just started my own consulting business focusing on small businesses in the engineering and manufacturing verticle.  I have taken the courses for the MCSA and was planning to take the exams shortly.  I may go for the Small Business Specialist first now that I have seen the Summit's webcast.  I have just received a small dell server with SBS 2003 on it and have already reloaded it once. FUN - It is soooo cool what they have done with this product!  OK, the reason for contacting you.  What books do you recommend for the Small Business Specialist Exam and any others that would round out a best practices for the product?  Do you have a book(s)?  Thanks for any help you can provide!"

The book I'd recommend is Harry and Beatrice's 70-282 guide.

As far as other resources... I'd like to first point you to this resource on the Web which has Microsoft's official literature...and then let me point you to a prior blog post about books on SBS.  I've done chapters in two books...and I'm reviewing another by Charlie Russel that will be specifically on the SBS 2003 R2 version.

...the key to passing the SBSC exam is to "think Microsoft".  Meaning that make sure you know the minimum specs of SBS and think it terms of "okay this isn't how I'd do this in the real world ...but I'll bet that's the one that is close to the real world".

As far as best practices... just come out to the communities or find a SBS group near you and ask... but maybe we need to think about a SBS setup wiki that wouldn't just go into "how do I set up the server" but would help in setting up all the OTHER stuff... login scripts, antivirus setups, all the other 'tweaking' we do after the server is set up... something to consider.. a community setup guide maybe... anyone else think that's a good idea?

Burning in those Podcasts for the road...

I was driving around yesterday and the only podcast I had with my in the car burned into a cdrom was the one on Mobility.... it got to the point after listening to it a couple of times I knew right when Mark would say "in SBS ...you know we say that you could have bought the ship in the bottle...or you could have pieced it together... SBS is like the ship in the bottle" and then when Peter would ask Damian about where was is going on the talk about certs.... I knew I had to burn in more for the car.

So do you listen to the podcasts on the road?  On a mp3 player?  Remember that unlike webcasts, podcasts are portable.  Now I do agree with Happy Fun Boy and Vlad..that some things just don't podcast well.... but those items that are "podcasted and pod'ded well", it's easy to take them with you for the car.  Using either Windows Media or Musicmatch, you can take the downloaded mp3s and burn to cdrom.  This converts them to the necessary format that will play in the car.

Hardware food for thought....

We keep saying that we need to future proof hardware and ensure we buy 64 bit worthy hardware.... but if this is true....

***This information is provided with the caveat that Exchange 12 is still under development and processor/memory metrics may change.  This information will be updated as "Best Practices" are defined for Exchange 12.***

Then maybe we need to consider the idea that maybe instead we want to buy CHEAPER hardware now to run the SBS 2003 and then buy the BETTER hardware in the 64 bit era.  Get something "good enough" now, and wait and don't try to guess what the 64 bit hardware will be.  If they haven't finished the product and they don't know what processor/memory metric will be changing... maybe we don't want to try to "guess" and future proof ourselves in case we are dead wrong.

As someone posted in the newsgroups.. maybe we want to get "good enough" hardware now... and save our money for the 64 bit to come.

SBSummit - Q and A followup..

Thanks again to Dana Epp for handling the Q&A part...... we won't go into some of the more private answers to some of the participants... let's just say if you weren't at SMBnation... well what happens at SMBNation.. stays at SMBnation...  I've edited out of the Q&A all the technical questions regarding the sound issues.  Apparently I sounded like Ariel in her grotto.. we even tried having me call back in to ensure a good sound..and yes we tested the setup ahead of time (in fact I moved to another computer and phone to make it better before we started.  The dial in number gave a better audio. 

Questions and Answers >>

Q:   Is this webcast being viewed by a live audience? and you are a small CPA firm, I've never listened to business before.  ;) I guess the slide displayed wrong.
Susan's comment.. not sure what the slide said?  Or are you talking about what I said how I was a small CPA firm?  :-)  Before I start the Q&A properly I should in full disclosure state the following:  When I was first contacted and asked to present at this webcast, the organizers asked what my normal speaker fee was... I said "A mountain dew and a thank you card!".  Seriously..while I was paid for this presentation, the content was all mine, the thoughts were all mine.  As a Microsoft MVP in the category for Small Business Server, while Microsoft considers it a recognition for past community work, I also feel that it allows me to have a voice of Microsoft's customer to Microsoft.  This blog is not paid for by Microsoft, but I consider it a combination personal electronic file cabinet, rant box, and a way to give back to the community the way that Grey Lancaster taught me (he's Gramps of the SBS communities)


Q: Is this the meeting for making decisions faster? The first page im seeing says a different title
Susan's comment.. I didn't write the slide deck title...my talk was about how a server allows you to make decisions faster and have your business be more agile in the process.  And when I got the slide deck back for final review ... I didn't notice that...sorry about that.  But it's the same talk.


Q: What happened to Business Agility ? Helping You to Make Decisions Faster ?
Susan:  It's the same seminar.  Nothing happened to it... the content that I gave was all about having a server helping you make decisions faster.


Q: I have visited the calendar page and do not find a way to evaluate the four web casts I have participated in. I have emailed, telephoned and signed up again using a second email address. It does not work and thus
there is no reason to spend my prime work time viewing these- can watch after the fact in off-hours. I am very disappointed.
Susan:  I found the links to evaluation on the www.Sbsummit.com page.  When I would log back in and go to the "calendar" page, the link for evaluations were there.

Q:   A better background music choice that doesn't involve saxophones which use too high a range would be suggested!
Susan:  That background music is annoying isn't it?


Q:  RWW?
Susan:  RWW is Remote Web Workplace which is the killer app of SBS.  There's more info here at this link.


Q:   Please be sure to Really test your connection quality before you bradcast.
Susan:  Truly ..we really did.  For some it was fine, for others, they had to call in for the audio.

Q:  Hi Susan! Asked: Is there any benefit to using SBS on a stand-alone? Is remote access better than using "remote Desktop?"
Answered: On a standalone server? Remote access through RWW (Remote Web Workplace) has quite a few advantages over using simple Remote Desktop. Access
to the company intranet, your Exchange email via OWA (Outlook Web Access) and a plethora of other advantages make SBS a good choice for small business.
Susan:  Dana couldn't have said it better than that.  SBS isn't just Remote Desktop.  It's lots more.

Q: Well SBS work better on a sever than a home PC.
Susan:  SBS is a "Server" product and thus needs to be on a "Server" hardware and not on a home PC.


Q:  why would a small business need sbs when they can now use office.live
Answered: Office.Live has some similar functions and abilities, but things like RWW provide secure remote access to desktops, servers and data... which Office.live isn't designed to do.
Susan:  Dana is spot on here.  To start with if you have a server, there are some things you can do with a Server you can't do with Office.live.  Sharepoint for one.  If you are a control freak or don't trust the web for another.  And Office.live is only effective if you have guaranteed highspeed access.  Office.live doesn't give you shared faxing.  Office.live doesn't provide a file server storage, or shared access to printers and resources.  So it just depends on your needs.  Office.live has it's advantages.. but there's advantages to having a server.



Q:  is small business server an operating system or app like Office. sorry to be a bit...
Susan:  Small Business Server is a Operating System "suite", you install it on a server and your workstations attach to it.


Q:   Hi Susan! Asked: I meant a standalone desktop computer connected only to the web, not networked.
Answered: Well, if your only machine is a single computer it may not make sense to use SBS. However, if you want to leverage a lot of the benefits servers can provide (as Susan has been talking about), you might consider getting a server.  You gain greater security, more functionality and the ability to grow your IT with your business.
Susan:  Agreed!


Q: Plus office.live does not have ALL of the features and bene's of SBS...
Answered: That is very true. Good point.
Susan:  Agreed.. it's different.


Q: How do you use RWW if you take your laptop with you. Do you access the server through RWW?
Susan:  You need to either have a XP Pro workstation back at the office turned on and ready for access, or you have a second server set up to act like a bunch of desktops.


Q: Well SBS work better on a sever than a home PC.
Answered: SBS, like most Microsoft product, can work on a lot of different hardware. As a server, its minimum requirements are higher than a normal desktop. You can see the system requirements here:
http://www.microsoft.com/windowsserver2003/sbs/evaluation/sysreqs/default.mspx


Q: I have sbs and love it. In RWW Can you run applications through this portal like in remote desktop?
Susan:  RWW is basically remote desktop on steriods.  Aren't you using RWW now?  I have a member server that runs something called Terminal Services, there's a button link in there that allows me to offer up a link to an application server.  Perhaps that's what you mean?


Q: so we could do without Sharepoint?
Susan:  No, Sharepoint is becoming more and more important to my firm.

Q:  Can I access SBS from any computer? If yes, What do I need on client machine?
Susan:  You have to have an XP Pro machine in order to get 'back to the desktop', but you can attach Macintosh computers to the server as well. 


Q:  Can a MAC user login to the server with remote desktop? without running virtual PC? Running a non-profit with board members in different areas, different platforms...Can the server host multiple websites as well, can you run multiple instances for different orgs or the same server?
Susan:  There's a slight workaround to Mac's but yes, Mac's can access a SBS box.  If you are running a non profit, check out www.techsoup.org.  The server "can" host multiple websites, but honestly we still recommend that you outsource that web site.  There's more info on Mac integration here on this site.


Q: Is there a way in load this sharepoint software if it wasn't loading when sbs was first installed?
Susan:  Yes there is, but it probably would be better to come out to the newsgroups and determine the status of your server.  In general though, you go into add/remove and find the Small Business server option and change the option to install it.  Newsgroups are here http://www.microsoft.com/technet/community/newsgroups/server/sbs.mspx


Q:  is small business server an operating system or app like Office. Sorry to be a bit...
Answered: SBS is a bundling of software from Microsoft. It includes the Windows Servers operating system, as well as server software such as Exchange, Sharepoint, ISA 2004, SQL Server and a whole lot more. On top of that, it has been integrated well together for small business with efficient wizards to make the deployment much easier that those technologies alone.


Q:  As an admin, the reporting function is the killer app
Susan:  AGREED!


Q: I have sbs and love it. In RWW Can you run applications through this portal like in remote desktop?
Answered: With RWW, you can use the RWW proxy to directly connect to desktops behind the SBS server (using RDP). There is an option in RWW to "Connect to Desktops" which will let you do this with just a couple of clicks, depending on the permissions you have given the account.


Q:  Word Excel and Powerpoint available on Windows Mobile 5
Susan:  Cool!


Q:  so we could do without Sharepoint?
Answered: You have the option to NOT use Sharepoint if you like. It is not manditory to use the rest of the benefits of SBS. When you are ready, you can always integrate it into your business later, as your business needs change.


Q:  Can I access SBS from any computer? If yes, What do I need on client machine?
Answered: The SBS server itself can be connected to via Remote Desktop (RDP). If you take advantage of RWW, you will be able to do this directly with an IE browser. If you have workstations in your network, it will be able to use the build in Windows networking with Active Directory to connect and use the resources on the server.


Q:  can you run applications like photoshop through RWW?
Susan:  You just attach to your desktop.  Can your desktop run Photoshop?  The answer is yes.


Q:  i have a question not relating to sbs. it has to due with Outlook. Can i go ahead and ask or is it better to ask G.Randall in a personal e-mail?.
Susan:  While you can, there's also great community resources for information that you can check out.


Q:  Can a MAC user login to the server with remote desktop? without running virtual PC? Running a non-profit with board members in different areas, different platforms...Can the server host multiple websites as well, can you run multiple instances for different orgs or the same server?
Answered: It is possible to have a MAC join the Active Directory domain for SBS. You will not be able to use remote desktop in the same manner. It is possible to host multiple websites on SBS. Sean Daniel has some discussion on this on his blog at: http://seanda.blogspot.com/2004/10/hosting-multiple-domains-on-sbs-2003_22.html


Q:   Can you run SharePoint through Safari?
Susan:  Check out  this link.


Q:  Any way to do CRM on SBS? Or any recommendations to put on SBS?
Answered: Yes. THe upcoming updated version of CRM has a version specifically for SBS. You can get more information on implementing CRM on SBS on Microsoft's technet site.
Susan:  Oh heavens yes!!!  CRM SBE is designed specifically for SBS  (and it's already released)  Anne Stanton specializes in CRM on SBS in fact.


Q:  Will sbs 2003 r2 be available through my Action Pack subscription?
Susan:  Yes, after it's released.


Q:  can you have a shared calendar. as in a calendar where you sales guys can book meetings into one calendar. (they need read/write access). thereby not double booking
Answered: Yes you can. Using Exchange's shared calendaring, its possible to do this.

Q:  Also, with Sharepoint, you can integrate a shared calendar with Outlook 2003
Susan:  Absolutely!


Q:  Can susan talk a bit about using Terminal Services with SBS?
Answered: In SBS 2003, Terminal Services in Application mode is no longer supported. You will now need to install a separate Windows Server 2003 TS box, which will integrate as a member server to the SBS domain.
Susan:  I didn't but I can give you this link about it....Step-by-Step Guide to Adding and Managing Additional Servers in a Windows Small Business Server Network


Q:  How can I compare Premium (SQL Server 2000 vs SQL Server 2005 Workgroup coming in R2) ?
Susan:  Check out this information http://www.microsoft.com/sql/prodinfo/features/compare-features.mspx


Q:  where can I find out more information on setting RWW and sharepoint?
Susan:  Come out to the newsgroups.. we need to talk.. RWW and Sharepoint "automagically" get set up when SBS is set up the right way.  There's wizards that set this up. Check out Getting Started- Windows Small Business Server 2003 with SP1



Q  Reason #11 - SQL 2005 runs faster than SQL 2000 on the SAME hardware!
Susan:  Good point!


Q:  do you have a quick link about susan tip to have the sbs2003 emailing you with a daily/weekly update?
Susan: In the server, launch the Server management console... click on TO DO, then run the monitoring wizard.  That's the email set for the daily email.


Q.   do you know a good book or a link on how to setup RWW stepbystep?
Answered: There is some good information in the SBS 2003 Best Practices books by SMB Nation. Check out http://www.smbnation.com/Default.aspx?TabId=22  for more
information.
Susan:  When you install the SBS the RIGHT way it installs automagically.  Check out ths resource:  Getting Started- Windows Small Business Server 2003 with SP1


Q:  Are there any improvements to Shared Fax in R2? Shared Fax didn't support v.34 Fax aside from Brooktrout, which cost more than the SBS itself
Susan:  We're finding that Brooktrouts arent' the way to go these days....check this out... http://msmvps.com/blogs/bradley/archive/2006/02/17/84073.aspx


Q: What are the TCP ports that are required to access the SBS Rdesktop
Answered: RDP itself needs port access through 3389. When using RWW, you will need to open port 4125 for the RDP proxy and 443.


Q:  nod32, Susan - you forgot that :)
Susan:  Yes, I did indeed Hilton...sorry about that.


Q:  What are the SQL database size limits on SBS. Considering exchange is also running on the same box?
Susan: Normal SQL limits. I honestly have more issues with MSDEs than true SQL.  I just stomp on the MSDE memory amounts with no prob.


Q: how fast is information relayed on RWW via cable speed internet?
Answered: Like any web based app, there are some small delays. However, as a  user of RWW every day, I notice very little slow down to my business workflow when using RWW. In all honestly, my productivity INCREASES due to the flexibility gained by such dynamic remote access.


Q:   To get the 6 am daily e-mail about server health do you have to have exchange server set up on your sbs server?
Susan:  Yes you do.. In my opinion ...all the parts of SBS should be installed even if you later don't use them.


Q Can I use RWW with SBS if I have a dynaminic ip address from my broadband provider?
Answered: Sure, as long as you know the IP address of the server. (ie Using dyna-dns etc). However, if you want to REALLY benefit from some of the great features, including Exchange... getting a static IP is recommended.
Susan:  Here at home I use a dynamic IP.. at the office it's static.


Q:  Why don't you the shared fax function in SBS?
Susan:  Just because of the way my firm works.  We fax a lot of original docs outbound and not a lot inbound.  But those who use it, love it.  More info on Faxing is here -- Step-by-Step Guide for Configuring and Using Fax on Windows Small Business Server 2003


Q:  can you hide the "connect to servers" option based on users/groups?
Susan:  Do you mean that it's there all the time?  It shouldn't be.  "Connect to server is only there if you've given users "domain admin" rights.  Don't.  Come into the newsgroup and let's talk.  http://www.microsoft.com/technet/community/newsgroups/server/sbs.mspx


Q:  did you say that antivirus on the server protects the workstations as well? I assume it is still necessary to have antivirus on the workstations as well??
Susan:  I use a a/v product that protects workstations, server and the email.


Q:  Is there an advantage in using RWW versus using Term Services in Admin mode (remote desktop)?
Answered: Well, TS gives you the ability of using 1 server to host applications. And you can use RWW to CONNECT to the TS just like you would normally expect. Of course if you want remote users to be able to access their desktops while on the road, RWW does a great to facilitate that.
Susan:  I sure hope you are not giving someone the ability to remote into that server with admin rights.  They need to be back on their desktops where they belong.  Come out to the SBS community and lets check it out  http://www.microsoft.com/technet/community/newsgroups/server/sbs.mspx


Q:  When wil SBS 2003 R2 be available to us POWER USERS?
Susan:  You mean Action pack folks?  Not until released.  For beta testers  I think they will be announcing a beta soon.


Q What are some main differences between SBS and Windows Server 2003? Will RWW be released to other MS flavors of server operating systems?
Susan:  I did a comparison here:  http://www.sbslinks.com/Us_v_them.htm Will RWW be released to other versions? I hope it's in Centro the planned mid market server solution (HELLO WINDOWS SERVER PRODUCT MANAGERS DO YOU SEE ANOTHER PERSON ASKING FOR RWW IN OTHER VERSIONS?  SEE WE TOLD YOU FOLKS WANT THIS IN OTHER PLATFORMS).... uh.. oh sorry... where was I... at this time, no word if it's in other server products.


Q:  I am using exchange on SBS and I donot seee an option that will read the SPam Block lists like (ORDB.org, or spam-haus.org) to filter the junk. Is it removed out SBS edition or am i missing something?
Susan:  Are you using IMF version 2 which is included in Exchange sp2?  Check out the antispam articles on www.vladville.com click on articles.  I don't like spam blocking lists because this pacbell.net email addy of mine ends up ON spam blocking lists. 


Q: Are you concerned that all your data is only seperated from the Internet via a password to RWW?
Susan:  I'm comfortable with SBS now... ask me again in a few years and I'm guess I'll want more like two factor authentication  :-)  (HINT TO LONGHORN SBS PLANNING PEOPLE -- I'M PARANOID NOW... I'M GOING TO BE MORE PARANOID IN TWO TO THREE YEARS, YOU MIGHT WANT TO TAKE THAT INTO ACCOUNT WHEN PLANNING THE LONGHORN VERSION OF SBS)


Q:   does one need to buy a h/w firewall solution between the SBS and Internet or is their eough s/w protection built into SBS ?  Answered: The Premium edition of SBS includes ISA 2004, an enteprise ready
software firewall and web proxy cache. That is all you really need. However, from a defense in depth point of view, a hardware firewall doesn't hurt. If you use SBS standard, it IS highly recommended to get a hardware firewall (from a NON-MS point of view)
Susan:  Agreed.


Q:  Anything still on your wishlist for SBS, Bitzie? - hfb
Susan:  I bugged them in the beta site already :-)


Q:  with heave use how much ram do you find sbs needing with all the aplications running on one server?
Susan:  My 4 gig dual proc hyperthreading is bored to tears.  If the app is written as it should be, no memory leaks and what not, it will be fine.


Q:  Is SQL Server included in newer version of SBS?
Susan:  Yes in the R2 version SQL Server 2005 workgroup will be included.


Q:  Can I host two different domains on the same SBS box ? One for my Small business and one for my wife's small business ?
Susan:  Yes.


Q:If you take your client computer on the road, do you still use RWW to access email and files on the server or do you use VPN?
Answered: You can use either method. You can RWW, only requiring your browser to access that information. You can also use VPN if you so choose. Personally, there typically is no real reason to open a full layer 3 network connection when you can access your email and files directly through RWW. THe flexibility is there though... allowing you to decide what works best for your business.
Susan:  Agreed. Remember my "client computer, my desktop" doesn't go on the road.. so I have a laptop on the road to RWW.  I don't want my data to move with that laptop. I want data to ALWAYS stay on my server.


Q:  What is needed to get an SBS server to comply with HIPPA in a medical office?
Susan:  Hipaa is a vague non specific regulation.. and more related to policies and procedures.  I'd recommend that you review the info provided by a fellow SBSer at www.endhack.com


Q:  What is Susan's blog address?
Answered: www.sbsdiva.com

Q:  through several different techs working on my sbs is not working "smoothly". Should I have the next tech just start from scratch?
Susan:  I wish you'd ping me with what you mean by "not working smoothly".  Come out to the newsgroups and we'll talk. http://www.microsoft.com/technet/community/newsgroups/server/sbs.mspx


Q:   Susan.. I know you can connect the MACs but I wasn't sure if SharePoint runs through the Safari browser
Susan:  The best resource for Mac Integration is Eriq Neal's SBS Unleashed book http://www.amazon.com/gp/product/0672328054/sr=8-1/qid=1142670156/ref=pd_bbs_1/102-2003783-1536133?%5Fencoding=UTF8 In full disclosure I wrote two chapters in this book.


Q:  Is it really recommended to run the AV software on the SBS server itself? We have been told to run it on a separate machine to keep our SBS box 'clean.'
Answered: SBS is a server. You should consider integrating the corporate edition of your favorite AV to push all signatures and manage all desktops from one location. Keeping SBS clean doesn't mean not doing anything with it to leverage your IT infrastructure. Find an AV product that works with SBS and go to it!
Susan:  who is telling you to do this? 


Q:  If we have SBS 2003 standard, will we be able to upgrade to R2 premium to get ISA included?
Susan:  Yes there's an upgrade SKU http://www.microsoft.com/windowsserver2003/sbs/howtobuy/pricing.mspx


Q:  I don't understand...Are you saying that you do not need Windows XP if you have SBS?
Susan:  SBS is a server platform.. you still need your XP workstations..

Q:  Can you recommend a good backup solution for SBS and client PCs.
Answered: SBS has a great built-in backup software that does a great job of  backing everything up. If you take advantage of things like My Documents redirected folders, you will be able to back up your core business information directly on the SBS box. There are many great 3rd party back up solutions that can also be used, but are out of scope of this conversation.
Susan:  Why are you storing items that need backing up on workstations?  A good backup solution for SBS is built in... ntbackup!


Q: What is the best way to start understanding SBS 2003, any web sites, books, classes recommended?
Answered: Get involved in the SBS community! Check out the various mailing lists and groups. We are a fun and helpful bunch. And the SBS MVPs are great! Also
check out some of the great resources like www.smbnation.com  and www.smbtn.org  .
Susan:  sbs2k-subscribe@yahoogroups.com, mssmallbiz-subscribe@yahoogroups.com and SBS communties and newsgroups http://www.microsoft.com/technet/community/newsgroups/server/sbs.mspx

Q:  Is it possible to upgrade from SBS standard to SBS Premium?
Susan:  Yes, there is an upgrade SKU that "bumps' you up to premium. http://www.microsoft.com/windowsserver2003/sbs/howtobuy/pricing.mspx  Remember premium is the only way you get a search box.


Q:  Who fixes your server when you are on the road?
Answered: With RWW, you can typically fix it remotely. If you cannot connect, depending on the deployment scenario, you may need to get to the machine. There are lots of great Small Business Specialists that I can trust to fix the machine if I am in the field and can't get to it.
Susan:  I do!  In my Jammies in a hotel room :-)


Q:  Follow up to the AV question -- we will install corporate AV software -- it has just been recommended not to run the 'server' side of the AV software on the SBS box. The SBS box would act as a client wrt the AV software.  Does that make sense?
Susan:  Man that's the first I've heard of that.. I run a/v on the server but I do ensure it has all the file exclusions for exchange and what not.


Q:  more tips on reporting. where do i do it on my sbs2003 premium box?
Susan:  The best addition for more reporting on a premium box is Dana's Scorpion Firewall Dashboard http://www.scorpionsoft.com/products/fwdashboard


Q:  What is your "sacraficial box" firewall? What brand and type is it?
Susan:  I'm not gonna tell you... I will tell you the price was around $300 to $400 so that should give you the idea it's under Sonicwall but above Linksys.


Q:  To: what is the difference between work group and the 2000 version?
Susan:  This refers to SQL 2000 versus SQL 2005 workgroup.  The best place for info on this is the SQL 2005 pages  http://www.microsoft.com/sql/prodinfo/features/compare-features.mspx


Q: If we bought SBS 2003 on a server in Jan will it cost to upgrade to r2?
Answered: You will need to contact your Microsoft rep on that one. I do know that Microsoft does a free upgrade for people buying right now, but I am not sure when that started. I believe it started March 1st.
Susan:  I don't know what the price will be for the R2 upgrade.


Q:  WHAT IS THE PRICE FOR SBS 2003 R2?
Susan:  They haven't announced it yet, sorry.


Q:  MS Dynamics can run on SBS right? As my company grows bigger, I need to know I can scale it up
Answered: I don't honestly know. However, since MS Dynamics works well on Windows Server, I don't believe it would be that challenging to get it working on SBS. Its the same OS after all.
Susan:  Yes it can.


Q:  Just a thought, maybe future machines will include a GPS along with a kill button for the machine not the thief. ;) to help end or recover stolen computers.
Answered Privately: Great idea.


Q:   Is an expensive router needed in front of the server, or can a Linksys type router do?
Susan:  I have a Linksys at home, I have better than a Linksys at the office.  Honestly I think it depends on the data you are protecting.


Q:  how to upgrade SQL server 2000 on premium to SQL server 2005?
Answered: The SBS team take great effort to ensure the upgrade migration path is tested. There will be methods to upgrade key components in place. Check with the SBS MVPs who can clarify this much better than I can.
Susan:  You want to wait until SBS 2003 r2 comes out as it will included the supported path to SQL 2005 workgroup.


Q:  how many applications can you run on the one server?
Answered: That is really a limitation to your hardware configuration. However,  it is recommended that LOB apps typically be run on their own TS.
Susan:  It just depend on how well behaved of apps they are.


Q:How about a Terminal Server (on a separate box) and accessing the TS with RWW? Can I run apps from home with a laptop that I normally have at work?
Answered: Not a problem at all. When you join the TS as a member server to the SBS domain, a new option in RWW will be available to allow RWW users to directly to connect to it.


Q:  If we have SBS 2003 standard, will we be able to upgrade to R2 premium to get ISA included?
Answered: If you are running standard, and then purchase Premium R2 you will get ISA. ISA and SQL are a separate install from the core SBS installation.
Susan:  There's actually an upgrade SKU from standard to premium to do just this. http://www.microsoft.com/windowsserver2003/sbs/howtobuy/pricing.mspx


Q:  another advantage to RWW is if you software that has a hardware lock installed on the network there is no chance of lossing the hardware lock.
Answered Privately: Interesting observation. Good point.


Q:   on the RWW connection dialog box, there's a check box for using public or a shsred computer. Will checking that box alleviate the security Susan was mentioning?
Susan:  No, what I'm talking about is the fact that you cannot trust that Kiosk computer.  It's not yours.  So in a firm where protection of data is important.. ensure you hand out laptops, or buy cell phones.


Q:  As a Small Business consultant I have found Project works well on SBS2K3 Premium
Answered: Yep. At its core, SBS runs the Windows Server 2003 operating system.   What you can typically run on Srv03, you can run in SBS.


Q: I want to try SBS 2003 at home behind a Cable ISP provider (I have a home based business). Is there a technical resource, other that a MS Partner or Bus. Specialist, that I can reference to "hook" everything up? (I do have technical experise.)
Answered: One of the great features of SBS is that the built in wizards significantly reduce the burden of "hooking" everything up. If you would like some great guidance offered by third parties, consider some of the SBS 2003 Best practices books published by Harry Brelsford. Check out some of his work at: http://www.smbnation.com/Default.aspx?TabId=18 . You can also check with the SBS
community who can give you a lot of guidance as you work through this. You can check out www.sbslinks.com  for some of those resources.
Susan:  With technical things..normally they either come with technical readme files... or there are books to read  :-)  AT LEAST check this info out http://www.microsoft.com/windowsserver2003/sbs/techinfo/productdoc/default.mspx


Q:  we have standard ver, do we have RWW? and if we want to add ISA, can we install it on a member server?
Answered: If you have standard verison of SBS, you DO have RWW. If you want to get ISA, consider the small upgrade cost to Premium. You will then get ISA for free. However, if you don't want to do that, you can get a standalone server and run ISA in front of it. Depending on your security needs vs. cost/benefit analysis, you may find its a better investment to upgrade to Premium.
Susan:  You cannot take the ISA of the premium SBS and run it on a separate server.  You could purchase another ISA 2004, but you lose all the wizards.  I personally like to have ISA and then a hardware firewall in front of ISA.


Q:   Can I have more than one brand (more than one base domain/url) for SBS exchange server emails? We are one company wth a couple brands.
Answered: Yes it is. Check out:  http://seanda.blogspot.com/2004/10/hosting-multiple-domains-on-sbs-2003.html  for some information on how to do that.


Q:  Susan- Don't forget the .local gotcha with Macs!
Answered Privately: Good point. I guess its a little late now :)

Susan:   Actually there are ways around the .local these days thus it's not quite the issue it used to be.  Connecting Macintosh OS X 10.3 and Higher Clients to a Windows Small Business Server 2003 Network

Q:  do i need to have 2 nics for RWW security? 1 nic for internal ip and the other for the wan ip?
Answered: This is the standard configuration for SBS. You normally use SBS as the gateway between your internal private LAN and the Internet. It is possible though to use a single IP if you place a hardware firewall in front of the SBS box, and port forward as required.


Q:  which port should be forwarded for RWW?
Answered: only need really 443 and 4125


Q:  on the RWW connection dialog box, there's a check box for using public or a shsred computer. Will checking that box alleviate the security
Susan was mentioning?
Answered: it's only for the timing of the connection... I still would not trust a kiosk computer due to the type of data I have (Susan here -- I'm a control freak)


Q: You had mentioned not being able to access other domains when using SBS.....does this include the following scenario: My domain is hosted by a third party. I can access the configuration of that, and would like to host an SBS server at my office. Can I forward the MX record from my externally-hosted domain to the SBS server in my office?
Answered: That's typcially how SBS is set up... web site is over there.. email is in here with a MX record redirect


Q: what's the link for the oner seminar?Adding Network Security in Minutes
Answered: all the seminars are on the www.sbsummit.com  page


Q:for RWW, can we also access other resources for member servers? like a database on another nt server?
Answered: Oh yeah..it automagically adds a link to a member server if you add one to the domain.... that's what I have at my office (Susan)  I'll put up a blog post of how RWW works and what it looks like.


Q: Will you be copying all of the Q&A and posting them on your BLOG ?
Answered: Yup doing just that :-)


Q: i still can't see how RWW be the same connecting offline. If I have softwares installed in my machine, RWW will also have these softwares?
Answered: I'm not sure I follow? RWW gets you back to YOUR desktop...so if your computer is turned on.. you are AT your desktop


Q: oh. so i need to leave my desktop on to access all the resources.
Answered: You got it...that's what we do at the office... workstations are on, but there's a password protecting screensaver when someone leaves


Q: NOW, it is making sense. THIS IS A GREAT AND THE BEST PRESENTATION I HAD!
Answered: RWW is really great... hey I'm glad you liked it.  I'll be posting up more screen shots so you can see what it really looks like.

I hope that everyone joins me in the SBS communities!  http://www.microsoft.com/technet/community/newsgroups/server/sbs.mspx   See you in the SBS Communities!

The SBSummit presentation....

Whew! Just finished the SBSummit presentation and hopefully I didn't ramble on.. I know there were some sound issues so thanks to everyone for hanging through that.... I will be putting on the blog a recap of all the questions that Dana responded to (and then I get to put comments too) but I did want to give a Shoutout to Therese about how I'm going to put up Screen Shots about how Remote Web Workplace works... I probably should have done more screen shots on that in hindsight.... or actually there should have been a presentation all by itself about RWW.

I'll be posting the follow up tonight...but in the meantime, Therese, check out fellow SBS MVP Wayne Small's paper on RWW and the Security of RWW.

Dana's Small Business Summit presentation on Regulation and Compliance

To all the folks that answer questions live in the Live meeting answer queue during the presentation...hats off to you.... I was the "question and answer monkey" for Dana's presentation at the Microsoft Small Business Summit on Regulation and Compliance...and I don't think he rambled... but it was pretty hectic to handle the questions I must say.  With Mrs. Robert Scoble handling the event ones and me handling the technical ones hopefully we didn't trip over each others toes too often!

Check out Dana's follow up to his presentation

http://silverstr.ufies.org/blog/archives/000928.html

http://silverstr.ufies.org/blog/archives/000930.html

http://silverstr.ufies.org/blog/archives/000927.html

Definitely it's freezing over

Between the second post of Brett the Blogger...to Intuit's official instructions on how to get Quickbooks to run in user mode.... the ice age must be upon us.

It's the only explanation for Intuit's official page on non admin and the blog entry like that...

Regarding Intuit... stay tuned ...I will be testing that out and posting screen shots on how to do that via group policy.

and remind me.. I gotta find a "A list Blogger" T shirt for Brett.

So who said I'm a certified partner?

So in response to Mark..... who said I'm a certified partner?  I'm a registered peon like yourself.  I don't pay for my "Certified partner snobbishness".. I'm just a plain old registered partner who doesn't want people abusing the system to screw it up for the rest of us.  If that N.A. is you...sorry about that ...but really do go back and put a name in because it just looks funny.  But you have to admit.. between my samples and Vlad's.... I just want Microsoft to know there are some folks that aren't abusing the system.  You might also check out the ISV program which is like the Registered Partner Action pack.  You'd probably qualify for either one.

Now... what I AM is a "Small Business Specialist".  And that means that when a customer goes to search for a partner that is small business friendly that I end up on top of those Gold and Certified partner folks in the database.

And in fact we'll be talking about the Small Business Specialist at the next SMBTN-Fresno meeting next month.

So sorry Mark if I sounded like a snooty certifed partner.. I'm just a peon who wants to make sure a good program stays that way for the people that need it.  I'm just a "ranty" registered partner is all.

Looking for a Mobile 5 device?

Today one of the guys in the office that has a Mobile 3 (the Audiovox 5600) said that his daughter (who also has one... yes the Windows Mobile disease travels through families) was having a hard time finding a cigarette lighter because the stores she was going to were not carrying the "Business phones".  I have noticed too that the Cingular store I go to (well last I checked anyway) only had one or two business-like phones and you might need to shop around or order the phone and then activiate it at the store.

There's this thing that you can watch out for when ordering them.. as to whether the phone comes with a "locked" or "unlocked" security policy. 

Now what's that all about?  As a general rule of thumb keep in mind the following:  Unlocked devices mean that you can easily add our SBS self signed certs.  Locked devices means you "may" be able to install our self signed certs.  And the rules are different for Pocket PC devices versus Smartphones.

In regards to Pocket PCs...now obviously the ones that are unlocked ... the certs off the SBS box that you MUST get on to that device will just go (remember what the mobility podcast gang talked about...just get that cert on the device as the key to authentication is if the device can get to that SSL page it's trying to go do without error).  If the device is locked, you can download a utility called spaddcert (it's says 2003 but it works on the 2005 PPCs) to install the certs.  The key here is to get that cert on the Mobile 5 device.  In that respect it's the same for the Mobile 3 that I have.. at least as far as PPC devices go anyway.  Remember like they said...this is just about PPC devices.  As those will allow you to get that cert on the device no matter what.  You just have to follow manual instructions to install the cert like I had to do because I had on previous version of ActiveSync my Mobility Wiz wouldn't Wiz.. (or as someone would say.. Whiz)  ...and I had to manually install it on the device via the using the ActiveSync interface to drag and drop the cert on to the device and then manually "install" it by clicking on the file on the phone. You can either follow the blonde instructions on that process or the official ones.

Unlocked PPCs will just go, Locked PPCs you can use the utility to install it the cert on the device.  Kinda like what I had to do for my sister's phone with her Novell/Groupwise sync software.  We used a little utility to get the cert on the device.  So we're cool with PPC devices and how they handle our Self Signed certs right?

Now then, here comes the fun part. 

Smartphones are different.

Smartphones aren't quite so easy and like the Podcast gang said it depends on the vendor.  If you have a locked Smartphone you are limited to making sure that Vendor provides a "get a cert on the device" utility, or you purchase a third party cert and put that on your box.  If you have a locked smartphone and the vendor is not providing a cert workaround tool... you can't use the spaddcert tool...and you are stuck  yeah.....hmmm... how about those godaddy cheap certs sound?  So far most of the gang installing these devices with the SBS self signed certs have found a couple of vendors to be SBS friendly.  So far primarily i-mate, Verizon and Sprint have the SBS self signed cert friendly ones per what the gang tell me so far.

So here's a tentative list I got from the Mobility community (and please let me know if there are any errors in this listing):

(and this is US devices only so please.. if you know of similar information for your country, please post it)

Cellular	Model	Type	Self Signed OK?
Cingular	2125	SmartPhone	Y
Cingular	8125	PocketPC	Y
T-Mobile	MDA	SmartPhone	N
T-Mobile	SDA	PocketPC	Y
Verizon	6700	PocketPC	Y
Verizon	Treo 700w	PocketPC	Y
Sprint	6700	PocketPC	Y

(Self Signed OK?  = means it's either unlocked or comes with a cert install tool so you can get the cert on the device)

Word is the Motorola Q coming out that's a SmartPhone will most likely be locked but Verizon has been providing the cert tool so as soon as that one comes out and it's confirmed we can add that to the listing.

So overseas, most of the devices I hear the "Drool" factor over is the i-Mate ones like Nick has.  And his is obviously working just fine on a SBS 2003 box, self signed certs and ..yeah...even a .local (I checked with him after that blog post about .local being an issue with phones).  I've yet to hear from the gang any Smartphone overseas working other than the i-mate.  But if you know of others with similar 'they just work' or 'work with a tool to get the cert on them', let me know and I'll add them to the list.  And don't forget the prior post with links and resources.

Configuring Secure Wireless Network Access with Microsoft Windows Small Business Server 2003

Fellow SBSers:

An update to "Configuring Secure Wireless Network Access with Microsoft 
Windows Small Business Server 2003" is now available.  With the help of 
SBS MVP Dave Nickason, it now includes ISA2004 firewall changes which 
are required to allow the methodology to work.

Microsoft Word and Powerpoint documents are available here:

 http://home.comcast.net/~clearviewtc/

The Powerpoint includes extensive screenshots.

This is an ongoing project.  If you use the methodology, please post 
your feedback so its validity can be confirmed -OR- changes to improve 
it can be made (or both!).

Thanks,

-- Owen Williams
ClearView Technology Consulting, LLC

Dear people who code at Intuit:

If you can't get access to this link, let me know.  There is a document newly released on the web that is the "logo" requirements for Windows Vista.  You might need to take a look at this when coding your Quickbooks 2007 version... you remember..the one that was stated will run with normal user rights?  Since you are going to be changing your software ...since it can't do that now... you might as well make sure it fits the guidelines for Vista while you are under the hood fixing things.

Just holler if you can't download it... I'll make sure you get a copy.  Just send and email to sbradcpa -at- pacbell.net

Here.. lemme make it a little easier for you....just make sure you pay attention to this section:

1.1     Follow User Account Protection Guidelines

A user’s Windows experience is more secure when applications run with only the permissions they need.  Unless an application is designed to be run only by system administrators, it should run with least privilege.

Every application must have an embedded manifest to define its execution level:

<requestedExecutionLevel level="asInvoker|highestAvailable|requireAdministrator" uiAccess="true|false"/>

Most applications should have level=asInvoker (leastPrivilege in Beta 1).  Applications that are designed to be run by system administrators may define a higher execution level, and the justification must be documented.

Most applications should run with uiAccess=false.  Applications that need to drive input to the UI of another window may set uiAccess=true, and the justification must be documented.

How many have you installed? Revisited.

The other day I posted about how customers should ask the var/vap how many SBS boxes they've installed ...and I got a follow up question of how do you "jump" into the market when you've only installed them for yourself.

... well you just did didn't you?

That's one. 

Install it at home.  Set up a domain.  Dynamic IP resolution to DNS.  MX redirect and the whole thing.  Install it like you would for a client that didn't have a static IP but wanted everything else.

There ya go.  That's one.  And that's better than the guy that says "oh yeah, we do SBS in our office, it's just like Windows... and we don't use the wizards". 

We typically say it takes three times to install it correctly anyway.  Once to really screw it up, once while reading the manual, and finally when you 'get it'.

Just never be ashamed to reach out for help or call Support.  Calling support doesn't make you look stupid in front of a client.  More like a savvy user of resources.

Steven ..honey.. I know that was a demo..but MAN was that a sucky password

So in the very first webcast of the SBsummit (that is recorded and available for viewing now) Steven is demo'ing RWW at the Small Business Summit and he says one thing...and does another that raises the hair on the back of my neck....

http://www.sbsummit.com/home/

He first says "accessing the date remotely from a Kiosk computer" and then he used like a three character password to demo/log into Remote Web Workplace.  Dude... first off I don't use Kiosk computers...I hand folks a laptop.  I don't have control of that Kiosk computer, I don't 'vet' it for security issues.  But laptops are cheap folks.  Get a refurb'd one.  Then you know it's secure and doesn't introduce rootkits or keyloggers or anything like that.  It's MINE and thus goes though all the same security checks that all the other computers do.

And Steven.. passPHRASES... try something a little bit longer of a password next time... that's ONE SUCKY password.....

Looking professional

On the smallbizit listserve today, the discussion was about renting office space and if it helped getting clients because you looked more professional.

Let's take that one step back shall we?  Go to the Small Business site on the Microsoft.com page.  And now search for a Small Business Specialist in your zip code.  I want you to compare yourself to your competitors.  Forget about the "professionalism" of a shared office space versus a home office, look what your web site and email says about you. 

One of the advantages of a server with Exchange is that you can have a professional email address..and not @yahoo.com. 

Now I need to ask something of you... do you find when getting services that you like to get contact information specifically about a person, rather than a generic sales@firm.com?  Or is hiding the fact that you are a one person shop why you want to do this?  Just not sure if folks want to see a more personable contact address or they don't mind the blind contacts. 

Just keep in mind that while you can sign up for a shared "condo" office space and look more professional, you might want to start with how you look to you customers in other ways as well.

So what do these folks have in common?

What do a Watch and Diamond store, a Real Estate Developer and contractor, and a business called "N/A" all have in common?

They are all "registered partners" in the Microsoft partner database and thus are eligible for the action pack software deal.  A very inexpensive software package that allows those folks that install, support, generate revenue from Microsoft products to run them themselves and understand the technology before installing it for customers.

Folks.. don't screw it up for the ones that truly gain the benefit from this program.  Okay?

If you don't qualify... and I'll give you guys the benefit of the doubt that maybe that's a Microsoft Spot watch dealer...and the House contractor installs MCE's and HDTV units....but hey... at LEAST put your firm name down.  I have a serious time believing that it's "N/A" which is the normal abbreviation for "not applicable" is the name for a real technology firm, especially one that doesn't have a web site but maybe I'm wrong. 

Bottom line, read the EULA folks and keep your nose clean and don't mess it up for the real Microsoft partners.

P.S.  I forgot one more I found... it's a firm that sells "Soap and Music".  No web site, just a phone number.  Now maybe they sell customized waterproof MP3 players for the shower.... yeah...that's the ticket......

...and who said I'm a certified company?  I'm a registered peon like yourselves.  I'm just complaining that folks should fill out the database properly.  And Mark.. check out the ISV program (it's like the action pack).  My point is that I'm a registered partner and folks that abuse it are going to screw it up for us little guys. 

Reason number 4,235 not to use PST files ....

E-mail client computers stop responding, and the Store.exe process uses up to 100 percent of the CPU resources on a server that is running Exchange Server 2003:
http://support.microsoft.com/?kbid=914800

Reason number 4,235 not to use PST files ....

SMBTN-Fresno meeting on Thursday

Just a reminder that there will be a meeting on Thursday at the Fresno Airport Holiday Inn for the Fresno SMBTN chapter.

The topic this month will be on antivirus and spam and we will discuss what vars and vaps like and dislike about Antivirus (and their vendors and their reseller programs)

Just a friendly piece of advice after the McAfee kills Excel ...and Oracle...and just about everything else.....

Don't "identify viruses" and "delete"

"Quarantine" them.  Then when your A/V vendor decides to build a bad dat file... you won't end up with a screwed up system that you'll need them to build a tool to fix you back up.

Where:  Fresno Airport Holiday Inn

When:  Thurday 3/16/2006

What time:  6:30 p.m. to whenever

Giveaways:  70-282 Prep Exam guide books

Patch Tuesday

Paul on R2 and Best Buy

In today's Windows IT Pro newsletter, Paul Thurrot writes....

" The R2 version of SBS 2003 adds all the technology from the mainstream Windows Server 2003 R2 release, along with several unique additions. "

and

" In a bid to make it easier for small businesses to purchase SBS, Microsoft is for the first time opening up Microsoft Financing to smaller purchases. In the past, customers wanting to finance purchases through Microsoft had to buy at least $10,000 worth of merchandise. But this amount was prohibitively expensive for some small businesses, many of which are cash strapped and on month-to-month budgets. To help these businesses, Microsoft is lowering the minimum purchase amount to $3000. So even small business customers can spread payments out over time--
typically 36 months--and pay for the technology as they're using it. Microsoft Financing is currently offering a 12.5 percent interest rate, according to the company.
Finally, Microsoft is working with Best Buy to provide training for that company's Geek Squad, which was previously focused only on supporting client-side technologies. Now, Geek Squad members will be qualified to install, service, and support SBS 2003 R2 and other server products, allowing small businesses to use the local electronics superstore for technology purchases and support. "

First off, repeat after me, SBS 2003 R2, does not now, nor ever have "all the technology from mainstream Windows Server 2003 R2 release"... we don't get the second cdrom at all of the "mainstream Windows Server 2003 R2 release".  I don't know where you are getting your information Paul, but that part is dead wrong.  Now lets not go down the argument again of why we don't get "it" on our "IT", okay?  Let's not start that again as I'm pooped over that issue.

Now as to the Best Buy issue... this has been a bit of a concern for some in the small vap/var marketplace as they try to get their customer from break/fix to managed services.  Vlad posts about it here as well.

Is this a good thing?  Well for one it will get the Small business product out front and center of those small business customers.

Is it a bad thing?  Well.. as a customer of the SBS product.. I want to make sure my fellow customers get a Var/Vap/whatever geek squad person that knows SBS, that understands SBS.. and that Geek Squad person.... or even a var/vap should not be installing SBS for the first time for your business.

I would urge every small business customer to ask that consultant "how many SBS boxes have you installed"... if they hem and haw... or say "oh my firm does"... you say "no, how many have YOU installed".  If the answer is "uh..none..yet", then give them this link to the SBS trial software page and go ask for another consultant. 

As a small business you deserve someone dedicated to the small business marketplace.

But the good news indeed is that financing plan for small businesses.  I think that will indeed be a very good thing.

Learning something new....

WAKEFIELD, WILLIAM ELLSWORTH — Services for William Ellsworth Wakefield, 79, of Fresno will be at 1 p.m. Monday at John N. Lisle Chapel. Mr. Wakefield, a sales manager for 35 years, died Tuesday. Visitation will be from 10 a.m. to 5 p.m. Sunday at Lisle Funeral Home.

......

I was debating on whether to post something about my Uncle.  I mean this is a techy geeky site and even though I tend to be a bit personal on this bit of technology called a blog, it felt a little "too personal" if you know what I mean.  But his son in law who gave the ending speech at the service reminded me of one thing that my Uncle did.

At the age of 50, he earned his pilot's license. 

At the age in life that most people want to start slowing down and stop striving, stop learning, stop doing.  He didn't.  He started something new.  He learned something new.  And it didn't stop there.  From computers, to CB/Ham radio to flying a plane, he kept learning and helping and teaching others.

So to a man who taught me that patience and a kind word can take you far, thank you for what you taught me through the years through your actions. 

To not stop trying something new.... learning something new.....giving something different a chance....

....thank you Uncle Bill, for that lesson I'll never forget.

I finally got him to sign up... thank goodness

My Dad's been on dial up for ages.... and for me... trying to keep him patched and up to date with antivirus was about downright impossible.  He never was on long enough on Patch Tuesday ...so his Patch Tuesday was more like Patch week and a half by the time all the patches got on his box.  And it was so bad that when we'd go over there for Family dinners and holidays I would take my Cingular aircard for the laptop because I couldn't stand the speed of dialup.

So when AT&T/SBC offerred a $12.99 a month high speed access for new sign ups... it was a sign.....

Ordered!

Man these days they don't even send you an Ethernet card and have you provide your own... which just goes to show you how modems are non standard in PCs, but Ethernet cards are standard these days....

This also means it will be tons easier for me to keep him secure.  Because if you can't get the patches on the system.. it's not protected..

Sender ID

"Microsoft and other industry leaders champion Sender ID as an initiative that provides a technical solution to help counter spoofing. Spammers use spoofing as their primary deceptive practice.

E-mail domain spoofing involves forging a sender's address on e-mail messages. Malicious individuals use spoofing to mislead e-mail recipients into reading and responding to deceptive mail. These phony messages can jeopardize the online safety of the user, and can damage the reputation of the company which seemingly sent the e-mail message.

Spoofed e-mail often contains "phishing" scams. In these scams, a spammer, posing as a trusted party such as a bank or reputable online vendor, sends millions of e-mail messages directing recipients to websites that appear to be official, but which are really scams. Visitors to these fraudulent websites are asked to disclose personal information, such as credit card numbers, or to purchase counterfeit or pirated products.

Sender ID seeks to verify that every e-mail message originates from the Internet domain from which it claims it was sent. Sender ID checks the address of the server that sent the mail against a registered list of servers that the domain owner or e-mail recipient have allowed to send e-mail. The Internet service provider (ISP) or recipient's e-mail server automatically perform this comparison before the e-mail message is delivered. If the Sender ID verification passes, the message is delivered as regular mail.

If the check fails, the message is further analyzed and the receiving server may refuse to deliver the e-mail, or it may flag the e-mail as a possible deceptive message. Depending on the recipient's ISP or e-mail server software, messages that fail the Sender ID check may be flagged and sorted differently. For example, a simple icon may be displayed in the message to indicate the failure. Or the message may be sent to the junk mail folder for the recipient's review, or it may be automatically rejected and deleted.

There is no single solution to stopping all spam and online fraud. However, Sender ID is a significant first step that many in the industry support to counter spam and online phishing attacks."

Makes sense to me......

..this just cracks me up though...

For the record if you want to set up Sender ID...Vlad's articles are the way to go..

An open letter to the "Do it yourself-ers"

We were recording a bit for the mid week SBSShow (with Susanne back in the adding class to Vlad and Chris role) and I said something about "being a representative of the DIY crowd" because quite honestly, I still feel that way as that's my roots and I feel that is some small way that I try to give that voice to the conversation when needed.  Even though I've moved from that position, I can say that I feel like I can relate still to that DIYer who gets a server and sees the potential in a SBS box for their firm.

Well to all of my fellow current DIYers and potential DIYers... I have a message for you.. and please understand that I give it with a great deal of compassion for where you are at.  I understand what you are facing. You are probably the "geekiest" person at your office, and someone read all of the literature of how easy computers are and servers and someone shoved this box in your hands and said "you do the workstations around here, it can't be that hard!".  Or you are the Linux guy or the web developer or someone who's really good at technology and this fell into your lap. 

Now I'm not going to say that your journey from where you are now, to a comfort level with SBS which is where you want to be is not impossible... It definitely is indeed possible.  But you are sure not going to get there if you don't do some basics.  You are honestly not doing your firm any favors if you don't start this process with the understanding that you are setting up the security parameter of your firm, the fortress of your data, so you'd better approach this better than we normally approach technology.

And the first thing... above all other things.. is to put down the mouse and READ.

Start here.. RIGHT HERE and download each and every one of these documents (okay so you can skip the Small Business Accounting one if you don't have that) but you should spend some time on this page... in particular this document.

When I decided to move from geeky DIYer to "okay I'm seriously going to be the onsite network administrator for my firm" in the SBS 2000 era, I ordered a SBS trial kit and install it at home.  Three times.  And then I read.  Books from Harry Brelsford.  Books from Charlie Russel.  And these days I'd add books by Eriq Neale (with the disclosure that I wrote two chapters in that one, and one in Harry's book).  And then I found a hands on lab course that taught a person about SBS.  And these days you don't even have to leave your office.

...but

I did ALL OF THIS before I even considered installing it 'for real'.  And even then, I was ready to hire a specialist if need be.  If I didn't feel that I could do this, secure it, to do the right thing for my firm, I would not have done it.  And I even interviewed Microsoft Partners, but back then there wasn't the Small Business Specialist designation so I didn't find an SBSer that I trusted.  Heck I didn't even find an SBSer.  The consultants I talked to tried to talk me out of SBS...they said "I'd outgrow it"  Uh huh..yeah...right... that's exactly what all of the consultants I interviewed said to me.  That they didn't like to install SBS as they found it too "limiting",they said.   Look where I am now... with SBS 2003 and RWW being EXACTLY what my firm needs.  I think I outgrew them.

And by that time I feel ready and had the resources I needed.  I had done the homework and knew what I was facing.  I was indeed ready to do it myself.

But do you get the idea that this wasn't a decision I took lightly?  That at any point in time that if I didn't think that I had the necessary information, and experience that I was ready to bail and hire someone to do this?  That I realized that I wasn't doing my firm any favors by setting up a network that housed the lifeblood of my firm if I wasn't prepared to do this?

So to all those facing the same thing...looking at a project that they are installing the backbone of your firm.... stop reading that marketing stuff that makes it sounds like all you need to do is add water and stir.  It's a smidge more complicated than that.  And think about that it just might be cheaper for your firm if you get help.  Yeah there's a lot more resources out there to help small businesses these days, but just remember, maybe it's cheaper, maybe it's better, maybe it's more secure, maybe it's better in the long run to READ FIRST and get training... or maybe...just maybe a little help to get you where that SBS box is just chugging, and you are just "admin'ing .  And these days, folks are quite proud to say they install SBS and recommend it to small firms.

Do it Yourself.. .sometimes means doing it with a little help.....

A little less security... a little more management - part two

On my list of things to do is to figure out how to add computers to the Health Monitoring that SBS natively does and I'm a one step closer.  The first step was to adjust the ISA to allow RPC, the second step is an adjustment inside of the XP sp2 group policy settings.

Step one was yesterday...where we adjusted ISA... step two is making an exception for the server to have the ability to remote administer the workstations.

Step one is to fire up the Group policy management console, find the SBS windows firewall policy and edit the policy

Next drill down to find the "Windows Firewall, Domain policy"

Now find the policy that says "Allow Remote administration exception properties" and we're going to edit this

Now we don't want to open this up to everything, so in my case (and since my network is still on that old fashioned funky SBS 4.0 era 10.0.0.x network, I just allowed the server to have the ability.

And once we do that we do a gpupdate /force on both the workstation and server to 'kick' it faster.

Now why are we doing this?  Because editing that will allow you to go grab disk 3 of your SBS set and there's a little folder called "Healthmon21" on there.  Drill down inside there is a Health Monitor agent that is sitting on your SBS box and is building that daily email and you can install that on a workstation.  Once you do, and adjust the firewall, you can add a workstation or member server to the Health monitoring snap in.

uh huh... you see where I'm heading on this?  Needless to say I'm going to play around with this a smidge more to also monitor my member server ...and maybe some workstations.. let's see what we can come up with...

...and in case you are wondering..that's a screen shot from the  home PC running "Vista".  Once I installed that health monitor agent on a XP workstation it is now able to be monitored from the Health Monitor program.... now it's not dumping into the daily email.... but you can definitely see the potential here can't you?  I'll definitely be revisiting this when I have more time.

...now why do I title this up a little less security?  Because it honestly is a smidge.  It's once again showcasing the trade off between the glue you need for management versus the barriers you want in place for security.

Need a little more management of workstations with ISA 2004 on SBS?

I was listening to the SBS Podcast 15 and it happened to flip over to Podcast 1...and my goodness the sound quality has changed TONS...

But they reminded me about one setting that you may hit in ISA 2004 that I don't think I've completely blogged about... if you want to manage computers from the console you'll need to edit off "Enforce Strict RPC compliance" and there's two places to "adjust" it off (I don't use the word wack these days)

Step one... click on firewall policy

On the right hand side, click on Edit system policy

Click on Active Directory

Untick on the box on the right hand side "Enforce strict RPC compliance"

Now find the SBS Protected networks rule

Right mouse click and find the "Configure RPC protocol"

Untick that check box as well

Click apply

Is this one of those "we're choosing management over security because in the long run, more management means we have a more secure network?"  Yup it does mean that.

This is one of those settings that you'll have to decide your "balance".  A little more security versus management... or a little bit more management versus security.

Your call.

Top support issue noted from the Partner newsgroups

One reason for being and checking out the Partner newsgroups is the monthly "Partner newsletter" in there...check out this months....

ISSUE
-----------
When you access companyweb from the Internet, you receive the following
error after entering your user name and password:

HTTP 500 - Internal server error

If you clear "Show friendly HTTP error messages", you get the following
error:

The Local Security Authority cannot be contacted.

CAUSE
--------
The AD user is not allowed to log on to the computer from which he is
accessing companyweb/RWW/OWA/Exchange.

In Security log, you may see the following event:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 533
User:  NT AUTHORITY\SYSTEM
Computer: SBS2K3PRE
Description:
Logon Failure:
  Reason:  User not allowed to logon at this computer
  User Name: xp
  Domain:  157.60.113.61
  Logon Type: 3
  Logon Process: NtLmSsp
  Authentication Package: NTLM
  Workstation Name: SHA-WOODY-03
  Caller User Name: -
  Caller Domain: -
  Caller Logon ID: -
  Caller Process ID: -
  Transited Services: -
  Source Network Address: 157.60.112.148
  Source Port: 4817


RESOLUTION
---------------
In Server Management\Users, right-click the user and click Properties. On
the Account tab, click Log On To.
Either select "All computers", or add the workstation to the permitted
workstations list.



ISSUE
-----------
When you try to connect to server/client desktops in RWW, you may receive
one of the following error messages:

Error message 1:
This portion of the Remote Web Workplace requires the Microsoft Remote
Desktop ActiveX Control. Your browser's security settings may be preventing
you from downloading ActiveX controls. Adjust these settings, and try to
connect again.

Error message 2:
An invalid server name was specified

You may notice that the issue only occurs to certain machines connecting to
RWW/RDP.

CAUSE
--------
The kill bit is set for the Microsoft Remote Desktop ActiveX Control on the
machines connecting to RWW/RDP. This may be caused by 3rd party antispyware,
for example SpyBot S&D 1.4.

240797 How to stop an ActiveX control from running in Internet Explorer
http://support.microsoft.com/?id=240797


RESOLUTION
---------------
Backup the registry and delete the following registry key on the machines
connecting to RWW/RDP:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX
Compatibility\{7584C670-2274-4EFB-B00B-D6AABA6D3850}




ISSUE
-----------
You import a public .cer certificate and it does not work with ISA SSL Web
Listener.


CAUSE
--------
A .CER certificate does not have a private key, while the private key is
necessary for ISA to configure the SSL web listener.


RESOLUTION
---------------
In IIS Management, request a new certificate via the normal IIS process
(Default WebSite\Properties\Directory Security\Server Certificate\Create a
new certificate). Then, the private key is generated here and stored on the
local machine.
Once the request is made, you may send certreq.txt to your vendor and the
certificate is obtained from the vendor (it will be a .cer file at this
point).
You can then run the CEICW and select to use a trusted cert and browses to
the file you received from the vendor.
Things should succeed just fine at that point.

If the current .CER certificate does not match the private key in the local
machine, you will get the following error when you choose this certificate
in the CEICW wizard.
"No certificate has been requested for the default Web site in Internet
Information Services (IIS)."

To resolve this issue, you may process a new request in the IIS on the SBS
server again and send certreq.txt to your vendor to re-obtain the
certificate.
If you can get a .pfx (which include private key) file from the certificate
vendor. you could import it using the following KB, but first you must run
CEICW and select "create a new web certificate" and enter the SAME public
name that is on the certificate from the vendor.  Once that finishes, just
run the steps in the KB and replace the certificate on the "SBS Web
 Listener" with the newly imported 3rd party certificate.

838244 How to configure a certificate for use with a Web publishing rule in
ISA Server 2004
http://support.microsoft.com/default.aspx?scid=kb;EN-US;838244



ISSUE
-----------
When an alert notification email is sent to some external recipient email
domain, it just sits in the queue and the status message in Server Manager
has the message:

The connection was dropped by the remote host.

Error in Network Trace:
SMTP: Rsp: Requested action aborted: local error in processing, 49 bytes
SMTP: Response = 451 See http://pobox.com/~djb/docs/smtplf.html.

This problem was occurring due to the formatting of the message by a custom
application which was leaving "bare line feeds" in the message. All lines in
the message should end in a carriage return (CR) + line feed (LF), not just
a line feed.

To determine if the message has a bare line feed, implement the following
steps:
1. Get a copy of the affected message from the \queue folder.
2. Open the message with a hex editor (such as Hex Workshop).
3. Locate any lines in the message that end with just a line feed (LF)
character. The (LF) appears in hex as 0A. A line correctly formatted with a
carriage return, line feed would end in hex characters 0D0A.

Data Example of a Bare Line Feed:
In the example below, the decimal data is shown for the line ending with a
bare line feed followed by the hex output for that line.

Text Data = Sample of bare line feed..
Hex Output = 5361 6D70 6C65 206F 6620 6261 7265 206C 696E 6520 6665 6564
2E0A

From the above example, the 0A character in the hex output is an indication
of the LF character. Because it does not have a corresponding carriage
return character, 0D, it is considered to be a "bare line feed".


CAUSE
--------
This is a problem with the SBS Monitoring and Reporting component.


WORKAROUND
---------------
To workaround this issue you will configure Outlook to redirect the email
which results in the message being reprocessed and the bare line feeds
removed.  To do
this:

1. Create a local user account and mailbox to originally receive the alert
email
2. Configure the alerts email to go to a local account
    a. Open Server Manager
    b. Click Monitoring and Reporting
    c. Click Change Alert Notifications
    d. Click the Email Addresses tab
    e. Enter the local email address created in step 1
3. From a client log into the account created in step 1 and open Outlook
2003
4. On the Tools menu select Rules and Alerts
5. Click New Rule
    a. Select "Start from a blank rule", highlight "Check messages when they
arrive" and click Next.
    b. Click Next without selecting any conditions.  (This forwards every
mail sent to this mailbox)
    c. Click Yes to the "This rule will be applied to every message you
receive" warning.
    d. Select the "redirect it to people or distribution list" action.
    e. In the step 2 box click the "people or distribution list" hyperlink
and type your EXTERNAL email address in the "To-->" box and click ok.
    f. Click Finish.
6. Configure Exchange to allow forwards.
    a. Open Exchange System Manager
    b. Expand Global Settings
    c. Expand Global Settings.
    d. Select Internet Message Formats.
    e. Right click on the Default * domain and open the properties.
    f. Select the Advanced tab.
    g. Make sure "Allow automatic forwards" is checked.

Customer Support Questionnaire

Customer Support Questionnaire

1.  Describe your problem:

2.  Now, describe the problem accurately:

3.  Speculate wildly about the cause of the problem:

4.  Problem Severity:

        A.  Minor__

        B.  Minor__

        C.  Minor__

        D. Trivial__

5.  Nature of the problem:

        A.  Locked Up__

        B.  Frozen__

        C.  Hung__

        D.  Strange Smell__

 6.  Is your computer plugged in?  Yes__ No__

 7.  Is it turned on?  Yes__ No__

 8.  Have you tried to fix it yourself?  Yes__ No__

 9.  Have you made it worse?  Yes__

10. Have you had "a friend" who  "Knows all about computers" try to fix it

for you?  Yes__  No__

11.  Did they make it even worse?  Yes__

12.  Have you read the manual?  Yes__ No__

13.  Are you sure you've read the manual?  Maybe__ No__

14.  Are you absolutely certain you've read the manual?   No__

15.  If you read the manual, do you think you understood it?  Yes__ No__

16.  If 'Yes' then explain why you can't fix the problem yourself.

17.  What were you doing with your computer at the time the problem

occurred?

l8.  If you answered 'nothing' then explain why you were logged in?

l9.  Are you sure you aren't imagining the problem?  Yes__ No__

20.  Does the clock on your home VCR blink 12:00?  Yes__ What's a VCR?__

21.  Do you have a copy of 'PCs for Dummies'?  Yes__ No__

22.  Do you have any independent witnesses to the problem?  Yes__ No__

23.  Do you have any electronics products that DO work?  Yes__ No__

24.  Is there anyone else you could blame this problem on?  Yes__ No__

25.  Have you given the machine a good whack on the top?  Yes__ No__

26.  Is the machine on fire?  Yes__ Not Yet__

27.  Can you do something else instead of bothering me?  Yes__

Thanks to Cheryl Wise MVP Front Page for passing this along

The support change - and it's all in how you look at it...

Tim blogs the news that there's going to be a change in support ...but I need everyone to not be an SBSer for a moment and be a business person here.

First off... that change that is talked about is for IT Professional phone line.  Remember for most that read this blog... you aren't calling that phone line.  You are (or if you install SBS boxes for your living...man you SHOULD BE) calling the Microsoft Partner line for your support.  And per my understanding the announced change is not affecting the business critical down for the Microsoft Partners.  

And then I need you to do something.

I need you ...all of you in North America to stand on your head.

I'm serious.  Stand on your head. 

Good.  Okay now you are an Aussie.  Before Monday if you were a consultant downunder, (or upside down as we would say) there was no way that your fellow SBSer downunder was able to get ANY support after hours.  If the 6 p.m. dinner bell rang in the land of Kangaroos, you hoped that you got an Engineer that didn't mind working on his own time.  Otherwise the call ended and you were out of luck until the following morning.  Yes, even if it was "Business Critical Down" as we are used to in the United States.  So even if you were stuck with a dead server, you were absolutely down and out.  You had to wait until the following morning... you had to wait until Monday if it was the weekend.  They now have the ability to GET support, whereas before they did not.

What this change will do is level the playing field for our fellow SBSers around the world.  Okay so yeah... the after hours price tag doubled for business critical (again for IT pro calls) it's also showcasing that technology is world wide and allowing all IT Pros around the world to share in the same support that I, in the North America have just taken for granted.  And given that SBS is world wide, to me it makes sense that resources have to slide around a bit.

I'm sure that we'll have more questions and more answers as this shakes out... but it's my understanding that the Partner "Business critical down" policies have not changed one bit.

Then I also want you to look at this from another angle...to me, this change affects ME the DIYer type the most.  Why?  Because the Var/Vap still has all the business critical down support resources they had before, but if I want to call Microsoft with critical issue at say... 2:00 a.m. in the morning, I would be forking out like US$500.  So wouldn't it be cheaper to hire a Var/Vap to deal with my issues?

Not to mention, it's still cheaper than Novell.  There's another way that you can get support incidents... TechNet Plus includes support incidents and I believe I get one support incident with my Software Assurance on the SBS Server.  (I need to check that SA chart benefits). 

Then last but not least... I'm honestly hoping that there will be some changes in support.  I think this is a time to push for more changes.  I've heard many a Var/Vap say that they would indeed be willing to pay more for a support call if they were guaranteed not to get a "script reader" and instead got someone that they trusted with their servers.  I hear time and time again that folks are not calling support anymore. They use to enjoy the calls as they would always end up learning something during the call.  Now they say that they are feeling like they are having someone learn on their box.  They'd like to be in a position to feel that they are turning over the server to someone they can trust.

More than anything else this reflects the reality that we don't necessarily get all of our support over the phone these days.  Google and GoogleGroups is my best troubleshooting tool.  Eventid.net is right behind.  My fellow SBSers who say "you seeing that?". 

But it also reflects that as Microsoft is changing how they view support, so should we.  We need to push for the changes that we'd like to see....

I'm mean...since they are already moving the furniture around a bit... how about shoving some things around just a smidge more while we are at it?

Exchange 2003 SP2

Just a reminder that the best resources for installing Exchange 2003 sp2 are on the Vladville.com site under articles...

http://www.vladville.com/articles.asp

Something for the buyer of the box

The Official SBS Support Blog : Educating SBS End Users Just Got Easier:
http://blogs.technet.com/sbs/archive/2006/03/10/421783.aspx

Did you guys see this new download?  It's kinda cool how it's something for the guy who BOUGHT the server to better help them understand the power of the box they just bought.

Check it out!

It's PODCAST geek out weekend in SBSLand

Another GEEK OUT weekend....the SBS Podcast gang have #16 up

http://blogs.technet.com/sbs/archive/2006/03/10/421791.aspx

You do know where all the SBS Podcasts are right?

What?  You don't?

You know about the SBSShow?

http://www.vladville.com/sbsshow/

And of course Mothership SBS Podcast...but you know what... I think they need "categories" so you can just jump right to all the Podcast posts

http://blogs.technet.com/sbs/

But for those that do understand what an RSS feed is, and have a RSS reader... your best bet is to put this link in your RSS reader  http://sbspod.libsyn.com/rss and then you'll just get the notification automagically.

B - E - T - A does not mean "in production" or "on a box you care about"

I am running a beta of Vista at home...not that I really meant to...but I kinda loaded it up in a dual boot and it's been on the Vista side ever since...but at the office..in the real world where it counts.... I rarely run betas....the exception being the Microsoft Antispyware product.

I don't install IE 7 on any machine...and I don't like the fact that seemingly it's not being quite warned about on blogs and other sources as that it truly is a beta...heck there's even a patch in the optional section that refers to IE 7

• Authentication fails when you use Outlook or Outlook Express to try to log on to a HTTP-based mail server if you use Internet Explorer version 7.0:
  http://support.microsoft.com/default.aspx?scid=kb;en-us;904942

Then DO NOT install the ISA 2006 beta on a SBS 2003 box.  Remember that we are an integrated platform and we wait for our parts.  And I already saw a poster in the newsgroup do this. 

Repeat after me... you DO NOT install betas on computers that you care about.

Those pesky Dat files

For a brief period on Friday, McAfee's security tools killed more than viruses.

An error in McAfee's virus definition file released Friday morning caused the company's consumer and enterprise antivirus products to flag Microsoft's Excel, as well as other applications on users' PCs, as a virus called W95/CTX, Joe Telafici, director of operations at McAfee's Avert labs, told CNET News.com.

"At about 1 p.m. PST we started getting reports that people were seeing an unusual number of W95/CTX infections in their environment," Telafici said. "Files that we did identify would probably be deleted or quarantined, depending on your settings."

More:

http://news.com.com/2100-1002_3-6048709.html

Okay first we had Trend with a bad dat file...then Microsoft Antispyware flagged Norton as a bad file...then we have McAfee flagging Excel... and Sandi reports that Trend is flagging Windows Genuine Advantage....  and yet the funny thing is most people freak out when you say you are going to turn on automatic updates in patching and possibly nail a network... what about all the OTHER gunk we are automatically updating all the time around our networks and not even blinking an eyelash?

Issues with Quickbooks 2006 R5

We Found a Potential Issue and Are Working on It Now

We have identified an issue that is affecting those users who, after 
updating to QuickBooks 2006, Release 5, attempt to open a data file 
while two or more users are logged in.

In this multi-user situation, QuickBooks will terminate and not complete 
the update of the file. The next time the data file is opened, the user 
will receive a message stating, “This data file cannot be used because 
it is not completely updated. Please restore your backup.”

It is important to note that while this situation prevents the customer 
from accessing QuickBooks, it causes *no damage to the user’s financial 
data*.

We have stopped making Release 5 available via automatic update while we 
work to fix this problem. In the meantime:

    * If you have experienced this issue, go to KB ID # 72780abd
      for information on how to restore access to QuickBooks.
    * If you have multiple copies of QuickBooks and one has been
      successfully updated to R5 but other copies are not yet updated,
      go to the QuickBooks 2006 R5 Manual Download page
      for information on how to update your other copies.

QuickBooks ProAdvisors will be receiving an Alert as soon as possible 
with additional information to help you work with your clients.

You know about firewalls?

CRM + Web part + Sharepoint = Cool!

Download details: Microsoft Dynamics CRM List Web Part:

Whenever I see "Web part" I think Sharepoint... as I should.... and whenever I think Sharepoint, I think of Chad.

Chad is our Sharepoint guru and gave a presentation last month about Sharepoint.  Wonder if Chad knows about this one yet?  :-)

The problem with translations

I hope he realizes......That I'll probably be running every post he does through a google translation tool...

One of the problems of being a world of languages is that we are a world of languages.... and the sad part is that things don't translate well sometimes... and especially not when it comes to technology trying to translate.

There are some things that have slang meanings, or just have a different meaning in different languages...or worse yet, with all the technology we have... just do not go through the machine translations well "at all".  I still remember someone asking for an example of a badly done machine translated KB article and the response was "pick any".  And the feedback was.."no can you give us examples..." and the person answered back "no, pick any of them, as they all have slight issues with translation".

I find myself in translation issues sometimes too.... Jeff Middleton and I were recently talking and we joked about how ....sometimes I'm just more blonde than I should be and I should have a "George Carlin"-like post of all the words that I just shouldn't use anymore in my posts...because quite frankly .. I thought of them as one thing...but in a different country ..even one that speaks English they didn't quite have the same meaning... or .. and this is more likely the case... the meaning "I" thought it was ... just wasn't what it was in reality when I went and looked it up in an urban dictionary ....

Okay I'll "out" myself on some.....one is "wack", another is "friggin" (hey, I didn't think it meant as bad as the word I was trying to avoid) and one lately.... uh... well.... lemme put it this way.... we're just not going to even post the word that I thought was another word for a smelly brown organic substance commonly seen in the farms near where I live...because on the urban dictionary... it didn't mean what I thought it meant AT ALL.... and we're just going to leave it at that....

Just put it down that sometimes.. some translations don't go well at all whether they are via machine....or via the blonde.

Patch Tuesday coming... well.. next Tuesday

http://www.microsoft.com/technet/security/bulletin/advance.mspx

On 14 March 2006 Microsoft is planning to release:

Security Updates

•	One Microsoft Security Bulletin affecting Microsoft Office. The highest Maximum Severity rating for this is Critical. These updates may require a restart. These updates will be detectable using the Microsoft Baseline Security Analyzer and the Enterprise Scanning Tool.
•	One Microsoft Security Bulletin affecting Microsoft Windows. The highest Maximum Severity rating for this is Important. These updates will not require a restart. These updates will be detectable using the Microsoft Baseline Security Analyzer.

Microsoft Windows Malicious Software Removal Tool

•	Microsoft will release an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services and the Download Center.

Note that this tool will NOT be distributed using Software Update Services (SUS).

Non-security High Priority updates on MU, WU, WSUS and SUS

•	Microsoft will not release any NON-SECURITY High-Priority Updates for Windows on Windows Update (WU) and Software Update Services (SUS).
•	Microsoft will release one NON-SECURITY High-Priority Updates on Microsoft Update (MU) and Windows Server Update Services (WSUS).

Would you live there?

I want you to think for a moment....

If your computer you use was a house would you live in it?

If your computer you use was a city, would you want to live there?

Just think about that for a moment... all of those items I asked you to think if you wanted to do with it... are all about trusting something.  Trusting the house to be safe and secure and liveable.  Trusting the city to be civil and a nice place to raise children and a good economy for jobs. 

Think of where your computer goes and what it does and what you do with it.  Do you trust it? 

Do you trust your network?  If your network was a city would you live there?  If your network was a State would you want to live in that State?

Now think of the Internet.  Think of what goes on in the Internet.  Do you trust it?  Do you feel that it's safe and secure? 

Think of it as a place to live.  A Country.  A city.  A house.  Where you would be, day in and day out.  It would be your home.  Would you want to live there unprotected?  Without a policeman?  Without a guarddog? Without the infrastructure of a 911 call system, and fireman, and doctors? 

So tell me... if you ...right now ... today... live in a house that you consider safe enough.  If you live in a city that you consider good enough to raise children and provide jobs.  If you live in a State or Country that you like to live in.  If you couldn't dream of living in a place that didn't have the basic infrasture of SECURITY as it's foundation.....you couldn't dream of living in a place where there isn't the assurances of fire protection, and emergency services, and protection, and medical attention that proactively ensures that you stay well and eat right and exercise and all of that.......

If that sounds like a really good way to live.....where you would want to be...

...then why do we do what we do to our computers?

...the very things that many of us depend on for our businesses?

...the very things that provide us with jobs?

....why do we not take care of them proactively... why do we instead spend money on the equivalent of the emergency room medical treatment....why do we not ensure we have adequate safety and protection so that we can minimize the risk....

...why do we with our computers and networks live in the equivalent of a crime infested neighborhood, not caring about cleaning up the crack houses and drug addicts, not caring about the drive by shootings and the muggings.  Not caring about our very lives.... why does it seem that if we "lived in our computers" it wouldn't be a good place to live at all....

so I want you to think about that....

If where your data lives.. is not where you'd like to live....

...why do you let your data live there and not protect it?

When a vendor asks you.....

Whenever a vendor says any of the following items you need to stop... stop right in your tracks and ask "Why are they asking me to do that?"

A vendor instructs you that you need to open up an inbound port 80 and port 443 connection.  [Whenever you go to a web site you are going to 'their' port 80 and their port is open inbound.  I've never met a site yet, whose tech support told me I needed an inbound port 80 and port 443 that didn't just merely tunnel back once YOU made an OUTBOUND port 80/443 connection.

A vendor says you need (insert insane amount of ports open on the firewall).  Whenever a vendor tells you some huge number to open in a two way manner between you and them... stop and think about what that means.  That means you must trust what that other system is doing.  How secure it is.  What security and paranoia level it is.  You know how you keep your system... do you know how they keep theirs?

Bottom line... these days the sign of a poorly written program is an application that needs a "way out" ISA server.  Amy Babinchak has on her blog a listing of applications that "need help".  Her "Enable this App" section also points out how some of them need more help than others.  And while you are there on the blog, grab a copy of the SBS unleashed book where Amy wrote two fabulous chapters on ISA server.  If ISA server is your first... or your second line of defense in your firm... you'd be wise to take the time to get better acquainted with it.

Because I could....no... because I can!

Yes, that is an Excel spreadsheet on my phone.

Yes, I could do a spreadsheet on my phone.

Okay so it's probably not something I'd recommend doing on my phone.....

But the point is I could....

What you should do it "pick your tool".  But I'll be showcasing that I could... and honestly joking about how ...no I really have never done a spreadsheet on my phone at the MS Small Business Summit next week.

And one of the reasons that I CAN do the Summit next week is because of technology.  I'm going to be here.  At my desk.  At my office doing a live meeting to folks all over the world... because I can.  Because of technology.  Talking about all the other things I can do because I have a Server.  I'll be talking about how I first learned about Server technology (Tony Teng, CPA in the SBS 4.0 era...doing a conference on technology...showcasing once again that word of mouth sells SBS).  I'll be talking about how I work in my jammies, remoting into the office. I'll be talking about the time we got a workstation stolen and how it was a freak out event from a "someone intruded at the office" standpoint, but because all the data was on the server, I wasn't freaking out.  I'll be talking about how we use file sharing and Instant Messaging, and Sharepoint, and email and communication and all the little things that I take for granted around here because I can......

So yeah... adding a little program from ClearVue means that I "could" do a spreadsheet on my cell phone.... and while I will honestly say during the presentation that I don't do that.... there' s a ton of other things I do with my server.....

...because I can.....

Stuff on Windows Mobile 5

Information on Devices:  http://www.xda-developers.com/

And Vlad's wiki on Mobility and Exchange
http://www.vladville.com/wiki/

SBSPodcast gang on Mobility
http://blogs.technet.com/sbs/archive/2006/02/12/419364.aspx

Peter Gallagher on ActiveSync
http://blogs.technet.com/petergal/archive/2006/02/02/418663.aspx

In particular check this error out...this one is specifically for Graeme:

http://www.vladville.com/wiki/activesync-error-85010014

And of course the whitepaper out earlier this week:

You are right ... it's not as easy as the marketing says it is...

http://www.kellysmith.com/?p=66

A network.  A network with Exchange.  A network with Active Directory.  A network with Mobility devices.  A network with Sharepoint.  A network with a Lost and Found (that's volume shadow copy... that's what one person called VSS the other day and I  love the description).  A domain.  Not a workgroup but a domain. 

And maybe for the small firm it would be cheaper if they get someone who knows what they are doing and can install it faster.  Better.  More secure.  And set it up with Exchange ('cause man... Exchange is not the frosting on SBS...it's part of the gooey delicious cake that you need to have).

But sometimes even us geeky DIYers need to stop and realize that we're not doing our firms any favors by not asking for help, for guidance, for advice.  Even if you are already a geek, setting up a network means tcp/ip and subnets and netmasks and routing and firewalls, and sometimes reaching out and getting advice on setting up a network helps to make it easier.  Whether that advice is from a Small Business Specialist in the area (and I think there's a few in the Seattle area), or at a mere minimum post to a community newsgroup. 

For the record Kelly ... that SBS box HAS to be a domain and CANNOT be a "workgroup".  If you don't... in about a week that box will start complaining.

But a SBSer ..even an owner of a SBS box.... is not an island.  And sometimes that means you need to understand that your job isn't to understand what a subnet mask is.  Sometimes you need someone to "handle" it.

About that Quickbooks R5 update....

Okay from the Quickbooks listserve on yahoogroups.com comes this comment regarding the new R5 QB update:

"I spoke to Intuit's technical support yesterday.  The recommend opening a
sample company after installing this update.

There have been some boot issues and if you try to open your company during
a failed update installation, you may corrupt your data.

Open the sample company first after installing R5"

And on the QB site, they've say the R5 download is down for maintenance.....

Okaaayyyyy ........ so maybe I'll skip that R5 update......

I'm looking for software ..and oh... I'd prefer it to be free...

I see this a lot on listserves and newsgroups....

"I have a client looking for a solution to encrypt email....oh and he'd prefer free"

"I'm looking for a RSS reader.... oh and I'd prefer free"

(Forest Gump like voice) My Mamma said that nothin' in life is for free, that there is a price to everythin....

Now I'm not saying that you can't find some software that will fit your needs and may be free or low cost, but folks, we really need to stop and remember what our Mothers taught us.  People cannot live off of air.   Sure software coders probably can get by with a box of Twinkies and Mountain Dew...but if you are running a business, and you expect to be paid for what you do, why should you consider the things you rely on any differently.  Someone normally "pays" for everything...whether that comes in the form of advertisements, banner ads, emails coming to you regarding the product you downloaded, them selling your email address everywhere, or worse case scenerio.... a malware on your system

Take a look at incidents.org for an example of this...

So when your client....or YOU...want "free software"...in the words of Sgt. Phil Esterhaus on the TV show years ago... "Let's be careful out there"......

You might get more than you paid for.....

¡Compruebe fuera de este nuevo blog de SBS!

http://www.google.com/language_tools?hl=en

Con apologías como estoy utilizando una herramienta del traductor de la máquina.  Donde vivo en Fresno, California, somos un pote que derrite de culturas.  Tanto de modo que la estación española de la TV en hecho, tenga grados más altos que los ingleses.  Así esto está realmente fresco ver, forzarme no solamente ser un pedacito más de un geek cultural también.  Ahora puedo mencionado a "Whizard" de Damian en inglés y su lengua materna.  Ahora...  Apenas tengo que aprender que más que el menú y mí de Taco Bell será fijado....

¡Compruebe tan fuera del Blog nuevo!!

http://blogs.technet.com/sbs_esp/

Y si usted necesita ver sobre cuáles es esto todo... vea el blog de Vlad:

http://www.vladville.com/2006/03/inside-sbs-podcast-en-espanol.html

(and boy did that Google translation make a mess of that... so with sincere apologies...and it's just pointing out how BADLY machine transcribers of language mangle words)

Windows Mobile 5 document on the web!

Okay so we know that Windows Mobile 3 were easily set up with SBS..but the new 5 ones were a bit more troublesome...well not anymore with this document:

http://www.microsoft.com/downloads/details.aspx?familyid=8be70d72-1e5a-4128-a30c-dafeeb43544d&displaylang=en

This white paper provides step-by-step instructions for deploying Microsoft® Windows Mobile® 5.0 powered devices in an IT infrastructure that is based on the Microsoft® Windows® Small Business Server 2003 (Windows SBS) server software.

Check out the Podcast gang resources as well here and here

And check out Nick's early reviews of the push technology..... so far Vlad reports that there's one device that's been spotted.

Get ready for LUA - webcast

Applying the principle of least privilege webcast and whitepaper

A defense-in-depth strategy, which involves overlapping layers of security, is the best way to counter malicious software threats. The least-privileged user account approach is an important part of that defensive strategy. This approach ensures that users follow the principle of least privilege and always log on with limited user accounts. In addition, this strategy aims to limit the use of administrative credentials to administrators, and then only for administrative tasks. This webcast explains the principle of least privilege, discusses why it is an important part of a defense-in-depth strategy, and presents the tools and resources that can help implement it.

Presenter: Mike Smith-Lonergan, Technical Program Manager, Microsoft Corporation

Mike Smith-Lonergan is a technical program manager with the Solutions for Security and Compliance team at Microsoft, where he is currently working on security solutions for the upcoming release of Microsoft Windows Vista. Mike is a Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), and a Microsoft Certified Systems Engineer (MCSE). Armed with a Master’s degree in business administration, Mike spent five years duking it out with hackers as a security consultant with Microsoft Consulting Services.

Okay it's time to Sharepoint... are you ready?

Chad Gross (SBS-MVP) and Nick Whittome (SBS-MVP) present Windows Sharepoint Services in SBS.

For further resources check out Mark Mulvany’s Blog http://www.swifttrain.com

Susan Bradley has invited you to view a Microsoft Office Live Meeting recording.

View Recording 

Recording Details

    Subject:              SBS Group
    Recording URL:        https://www.livemeeting.com/cc/winserver_usergroup/view
    Recording ID:         MJT5DM
    Attendee Key:         K_9G#$t

About Risk

Hey ... this is a pretty cool web site that has a online checklist about business risks.....  http://www.getsafeonline.org/nqcontent.cfm?a_id=1275 Which in chatting with Dana is I think what I'll chat about at SMBTN Spring Conference.  I'm probably still going to do a quick "get ready for WSUS" overview and hit the main troubleshooting pieces... like the fact that you can click on start, type in run, then windowsupdate.log and there's your update history on that box.  Look for the "errors" and google them up.

In fact the overall sections are pretty good at getting you thinking about risk.

So, do you sit down and talk to your clients about risk?

The Podcast gang takes on....

The SBS Podcast gang will taking on the topic of client best practices... an area that I think we SBSers fall down on a lot.  And some of this is due to licensing issues... since we don't take the time to deploy properly.... so check it out.. join the crickets  :-)

http://blogs.technet.com/sbs/archive/2006/03/06/421302.aspx

Do we train well enough in Outlook?

Check out these links...

• http://gemini.lib.purdue.edu/staffdev/handouts/outlook2003.doc
• http://mavmail.mnsu.edu/Outlook2003HTMLfiles/OutlookPt1.asp
• http://mavmail.mnsu.edu/Outlook2003HTMLfiles/OutlookPt2.asp
• http://mavmail.mnsu.edu/Outlook2003HTMLfiles/OutlookPt3.asp
• http://mavmail.mnsu.edu/Outlook2003HTMLfiles/Outlook%20Tips%20and%20tricks%2003.asp
• http://mavmail.mnsu.edu/otlkpermpc.asp

I really don't think we spend enough time training folks on how to use Outlook.  One of the best investments I ever made was in a Running Outlook book by Sue Mosher.  In that book was the foundations for setting up and sharing out Calendars and what not, and it really helped.  I'm not sure we do enough to help train our clients in just basic email. 

So what does your Linksys run as it's OS?

Setting up WSUS..again and again....and again...

If you've set up WSUS in your office and you go to a client to set up WSUS you'll know that it takes forrrreeeevvver for that system to sync up and download patches for the first time.

Well why don't you export and import from your set to your clients?

You know you can?

IPconfig /all

Probably the most asked for diagnostic information in the newsgroups is "Please post the ipconfig /all from a workstation and a client".

And with that basic information we are troubleshooting the setup of your system:

Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

That's the Windows version on the box

C:\Documents and Settings\Administrator>ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : test-9xmtsky84t  ---- Name of the computer...when I was building this box I just called it test and accepted the defaults... you probably don't want to do that as there are many things tied to this..the name of the computer shouldn't be too icky...I mean who in their right mind would do this on a real server and tell their clients/employees to just type in http://test-9xmtsky84t/connectcomputer to set up their workstations.... yeah ... always keep that computer name something reasonable.

   Primary Dns Suffix  . . . . . . . : smallbusiness.local  -- yes... I used a .local to name my internal AD.  But I didn't even have to call it smallbusiness.local it could have been sbs.local or something like that as your Exchange domain name is entered elsewhere.
   Node Type . . . . . . . . . . . . : Unknown
   IP Routing Enabled. . . . . . . . : Yes
   WINS Proxy Enabled. . . . . . . . : Yes
   DNS Suffix Search List. . . . . . : smallbusiness.local

Ethernet adapter Server Local Area Connection:  - this is the Internet NIC.  Notice how the address of 192.168.16.2 won't talk automagically to the 192.168.1.103 because the subnet mask of 255.255.255.0 says that for things to "route" the first three octets have to match.  Since 192.168.16 isn't the same as 192.168.1.... those two nics are in separate IP ranges and all will be well.

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Realtek RTL8139 Family PCI Fast Ethernet
NIC
   Physical Address. . . . . . . . . : 00-E0-4C-7C-9F-97 - unique MAC address
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : 192.168.16.2  - default internal IP address range for a SBS box... the IP has been statically assigned during setup
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . :
   DNS Servers . . . . . . . . . . . : 192.168.16.2 - an SBS box always points inward for DNS .. point your DNS on all NICs to the Internal Address otherwise your XP machines will grind and grind and grind starting up.
   Primary WINS Server . . . . . . . : 192.168.16.2

Ethernet adapter Network Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Realtek RTL8139 Family PCI Fast Ethernet
NIC #2
   Physical Address. . . . . . . . . : 00-50-BF-65-96-15
   DHCP Enabled. . . . . . . . . . . : Yes  - now there's a bit of funkiness here... this is sitting behind a Linksys router at 192.168.1.1 and I could have just set a static IP of 192.168.1.2 or something like that but when I ran the CEICW for this test I was lazy and just said "go get one" because the Linksys DHCP's is enabled it just picked it up from there.  Because the DHCP is on the other side of the network, the two don't see each other.  And then what I typically do in my tzo.com enabled/Linksys on the outside as an external firewall over and above the SBS box and handles the dynamic IP resolution home network is that I leave the RWW for the real network, and I flip any test bed box to be accessable via VPN or TS.  Thus I can RWW to my real home network, but I can TS to any test network because I go into the Linksys application port forwarding console and 443 and 4125 go to the real network at 192.168.1.3 and then VPN and TS can go to this one at 192.168.1.103.
   Autoconfiguration Enabled . . . . : Yes
   IP Address. . . . . . . . . . . . : 192.168.1.103
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.1.1  - here is the IP address of the Linksys box
   DHCP Server . . . . . . . . . . . : 192.168.1.1 - if you statically assign this NIC you won't have this value here
   DNS Servers . . . . . . . . . . . : 192.168.16.2  -- and notice that I'm pointing back to the DNS of the SBS server
   NetBIOS over Tcpip. . . . . . . . : Disabled  - this is a funny one... always look for this value on your "outside nic" never have listed as a value on your 'inside" one.  If it is, you don't have NetBIOS over tcpip and your network is probably not too happy and your clients can't browse to your server.
   Lease Obtained. . . . . . . . . . : Monday, March 06, 2006 7:50:52 PM
   Lease Expires . . . . . . . . . . : Tuesday, March 07, 2006 7:50:52 PM

C:\Documents and Settings\Administrator>

(Insert software choice that will cause religious wars) cracked in (insert time amount that sounds insanely short)

You've probably seen the headlines that it was proven that Mac's can be cracked in about 30 minutes with some unpublished exploits out there.  Well it turns out that it's a little harder than it seems.... http://test.doit.wisc.edu/  but it makes me bring out the tinfoil nonetheless.

The SBS platform was "outted" in a USA Today article about a year or so ago about how fast it was to crack... the only problem was it was sitting bare on the Internet with a sucky password of "Password" and no firewall.  You try and survive standing in the middle of the 405 Freeway in the number one lane at the 7:45 am rush hour and see if you fare as comparatively well in what I would call a comparable test to what they did to that SBS box.

Once upon a time there was a book that said that you should plan assuming that you will get intruded on and design your network accordingly...but I think we need to also put a bit of business realism in this thought process as well and understand that ...yes...beleive it or not... even with running with administrator rights.... yes, even with running without spyware and antivirus... I do know folks...mostly uber geeks who can run their computers and not get nailed by anything bad.  Yes they are a "bit more intelligent than the average bear", but the reality is they aren't downloading stupid stuff.

The other day on the Managed Services listserve someone said that he didn't push all of his clients to run as local admin....as he couldn't push them.  And you know what... I think I agree.  But I think in order for you do to this, you need to know your clients and know their risks.  There are some clients and some end users that I just know are going to get nailed unless I do something to help.  That antivirus isn't enough, that anti spyware isn't enough that they need additional help.  But the there are some folks (and what they are using) that sometimes you just can't push it and you know you'll have to wait until Vista's LUA/UAC/UAP to come out.  And then to go yell at your software vendors to do a better job....because quite frankly some of this protection could be done a lot more natively than it is done now.

So what about you... do you do a "risk analysis" of your clients?

ISA 2004 sp2

(as Sandi noted on IM... I sounded a little stressed in some recent blog posts... and honestly.. more like just a little tired of the religious wars is all... so let's get back to fixing issues shall we, and get a bit de-stressed?)

So... you have ISA 2004 sp2 and you are having issues?  Problems downloading or certain web sites not working?

First off turn off these compression items as we don't need them (and they should be the settings causing issues with iTunes and what not) and then keep an eye our for a hotfix that is in the works for the other issue.  You can view the information (and technical discussions around it) here.  The hotfix will be released soon so hang loose.

Private versus Public DNS...

http://blogs.technet.com/canitpro/archive/2006/03/05/421256.aspx

Between the arguments over "IT", and the religious wars over .local and DNS routing..... here we go again...why do certain setups just seemingly bring out a near religion effect?  Even me.. look how I'm reacting to this post.

Let's see how many of these are an issue with me and my firm in the real world:

• Spam scores... let's see if you go to your ISP and point the MX records to your box and your Exchange server says "domain.com" exactly how do we have this issue?  Publish those Sender IDs while you are out there will ya?  It only when we do pop connector that we might have that issue and then we bounce stuff through SmartHost.
• Identity on the web going forward.... you can always edit up the A records... but right now my web site is over "there" not in here and I don't want it inside the network.  Remember that I look interally for DNS and then rely on DNS forwarding or root hints.  Get someone that it easy to do DNS changes like zoneedit, but remember we don't expose our DNS for external resolution when we're this sized anyway.
• Self signed certs - even on Mobile 5, as long as you can get the certs "on" the device, there isn't an issue.  I use self signed (as do many) and as long as you can get the cert on the device, we have no issues.  You know how EASY it is to use a self signed cert than to try to get an external cert and the hassle of that?  During the CEICW wizard I name that self signed wizard whatever I want to be... it's not tied at all to .local or .lan or .whatever.  I name it whatever I want.  And when I'm running that wizard, I'm making it match what that MX record is ...and it's certainly not called .local.
• Macs after OSX don't hate it but you can always use .lan and there are ways to "fix" the issue anyway.
• Active Directory Federation Services?  Dude.. Oh..man... let's not even start down that one.... and don't even start that religious war that that topic will start... It's only on the Windows 2003 R2 Enterprise edition and thusly not even available to us SBSers at all.  By the time we need to worry about that one, we'll have grown out of SBS and past the transition pack and probably merged with another Company and into their AD domain namespace anyway.  By that time the "routable" issues are the problem of that much much larger merged firm.

Why .local?  Or more precisely, a private domain name?  Go talk to the SBS Dev team.  Because they wrote the wizards, and folks, unless you really and truly know what you are doing (and chances are folks even if you have been designing AD infrastructure for small and midsized firms... it's still better to stay with the wizards of SBS) go take up your issues with them.

Because .local works and I have not found it limiting at all in my firm. 

And you run the Connect to Internet Wizard and it DOES name the default recipient policy whatever externally resolvable name that you enter in the wizard.  AD works for SBS because we don't even open up the Active Directory MMC snap in unless we really want to torture ourselves.

I haven't found that calling our boxes .lan or .local has limted the SBS domains from growing at all.  But at the same time understand that there are some firms (like mine) that want to stay small.  We've actually turned down offers to join with other firms because we wanted to stay the size we are.

Why do it?

Go install a SBS.

Go run the wizards... ALL of the wizards.

I'm going to challenge you....go install SBS ..... go see exactly what the wizards (or as a certain person would say... whizards) do and then you tell me why you think your way is easier.... 'cause so far the issues you've brought up.... I honestly just haven't seen them in SBSland...in my little brain... I just haven't seen them as deal breakers at all.

Looking for resources on Asterisk?

Looking for resources on Asterisk for Voice over IP?

• http://asteriskathome.sourceforge.net/
• Newbie’s Guide to Asterisk@Home 2.5: Unabridged Soup-to-Nuts Installation Guide
• http://nerdvittles.com/index.php?p=112
• Nerdvittles.com
• www.nerdvittles.com
• Jacken’s Blog
• http://www.jackenhack.com/blog/archives/category/asterisk-pbx
• Asterisk@Home Forums
• http://sourceforge.net/forum/?group_id=123387
• Asterisk at VoIP Info wiki:
• http://www.voip-info.org/wiki/index.php?page=Asterisk

One more resource... Asterisk in a vmware distro... http://www.vmwarez.com/2006/03/asteriskhome-virtual-machine-updated.html

IT

You see I'm tired of the argument over "IT".  Yes I know we don't get "it" in '"IT", but sometimes, especially in a small business we don't always get exactly what we want.  And sometimes we have to come up with our own solutions.  These days business owners really don't care if the solution is from this vendor or that vendor.  It's your job to come up with a solution.

For the record if you want to know what of "it" you can do on "IT", you might want to check out this blog posting.

If you can't sell "IT" to your clients because it just because you already have a patch management in place and don't need SQL 2005 Workgroup?  More power to you.  Wonderful.  Fabulous.  You are ahead of 99% of the rest of the universe because most people I talk to don't have WSUS and a patch management/testing program/process in place.  And that's the gang that I'm beta testing "IT" for.  Because there are some firms that will want "IT", and as long as there are some customers out there that will be buying "IT", I'm beta testing for them.  I'm not walking away from "IT" just because it doesn't have "it", because there are still clients and customers that will be running "IT".

But gang... business owners don't care if "IT" has R2 bits or not.  They want you to listen to them and solve their needs with whatever tools are in your tool bag.  So if you need to use robocopy or Rsync... then do it.  And indeed post up the "how to" on a web site or wiki and share your solution with others.  Because the deed is done and every single time we argue about "IT" not having "it", it's not helping your client that doesn't care about "IT" or "it".  He just want you to handle your Information Technology needs.  You know.... the other IT in this argument. 

He or she hired you to propose a solution.  He or she doesn't really care where it comes from.  He or she just wants it to work.  And that's your job to pick based on his needs.  Just don't mess with his desktop or his Solitare game and just handle the server side and come up with something that works.  And if you stay on the "old" "IT" because your line of business apps won't upgrade to SQL 2005, that's do-able too.  Line of business apps do not upgrade to new databases quickly AT ALL and SQL 2005 is still a bit young for most LOB app developers.

So if you want to give feedback about what you think is wrong with "IT", a good spot might be steveb@microsoft.com, and can we all agree that "yes, it sucks, Microsoft, the Lawyer run Monopoly has got to be smokin' somethin' up there in Redmond with all of their SA/R2 stuff and man Longhorn better be good" and get back to solving real problems and not arguing over how dumb it is that we don't get "it" in "IT" and get on with providing real solutions to real clients?

One thing you have to remember about me.... at the end of the day I'm a business owner and look at things a little differently than most (besides the fact that I'm a Dew drinking female in a Tech/Geek world sort of adds to that wacko viewpoint too).  You see, I still see that there's still a lot of "drool" factor left in the Us Versus Them, even after I update it with the "it" versus "IT" stuff.

Because you see Remote Web Workplace and the 6 am email is still there.  And to me, the business owner, that's still the two killer apps of SBS along with the normal Email and sharing of calendars.  SBS isn't perfect.  And your job it to add to it to solve the needs for your clients.

You are the solution provider.

And if you noticed, I'm staying away from calling "IT" by it's real name.  For two reasons.. one I'm tired of the arguments over "IT", and for your clients, even calling "IT" as just plain SBS 2003 has some businesspeople (including my sister) asking "Isn't that out of date?  It's 2003?  Isn't there something newer?" 

So what would you like to call "IT"?  (We were calling it by something else but I found in the urban dictionary ...but what I thought it meant wasn't what the urban dictionary gave as the meaning....another blonde moment for Susan.... so I think I'm going to have to stop calling "IT" by what I was calling it.)

The trust factor

Define a "Managed network".

Got an idea?  Is it like Durf's ideal managed network?  http://smbmsp.wikispaces.com/Defining_Managed 

Yesterday someone was asking how do they get "into" the vertical market of Accountants and it reminded me that it's the same uphill battle the "managed" network folks face.

How do you become the "employee" they aren't paying with a W-2..  trusted..... part of the technology team?

Here are just some of my thoughts..... and first off with a caveat ....this is a very US centric post and these offers are not world wide.

• Build the trust.  While we beancounters are probably still running (or fondly looking back anyway) to Windows 98, there was one thing that would (and still does) drive me crazy.  When a consultant comes into a firm, ensure me that you treat access to my network in a secure manner.  Don't ask me for the Administrator password and then build yourself a "backdoor" admin account and don't tell me you did that.  Inform me what you did.  Ensure that you change that password if employees change.  Consider discussing remote access windows and adjusting the access time so that you can only have access to the network at certain times.  Don't ask me to email or fax you a list of my network passwords either (I've had this with printer/copier vendors). 
• Remind Accountants that they have client social security numbers on their systems and should take reasonable precautions in protecting that data.  Reasonable... quite frankly... doesn't include Windows 98.  Yes change is hard, but so is putting information back together again when your peer network that isn't properly backed up ...isn't being backed up.  They want and need shared calendars.  They need to send email (even though most of us are not encrypting it)
• Be knowledgable about restoring a SBS box.  One of the issues that comes up in "selling" SBS is the "ol" single points of failure.  All on one box and all that.  But be prepared by explaining that a proactively managed system along with quality hardware is the way to do this.
• Be prepared to deal with the "is it secure enough" discussions.  When even Vars/Vaps are not deploying Remote Web Workplace and instead use VPN, get a better understanding of the security of the technology and the real risk of that network.  Do a technology assessment with them.  Ask them about the last "incident" they had.
• Sign them up for the Microsoft Accountant's Program (www.microsoft.com/accountant ) This is the US centric part of the post as SBA 2006 hasn't released to all shores.  As a result this MPAN isn't offered world wide.  If the person who works in the field of accounting (bookeepers, CPAs, etc) signs up, they are eligible for the Action Pack software offer.  Now think about that... that's the normal software the registered MS partners get that you can then take to your Accountant client and sign them up for and get all of their computers on a solid network.
• And last but not least.... come up with a solution to get clients data from there....into here... now whether that solution is using a third party site or solution, or building something on that server (but quite honestly I'm scratching my head a bit about how you could do this with a SBS box with the user/device cals and the fact that you would always want that transmission to be over a SSL tunnel so they'd have to authenticate).  You may want to set them up with Logmein or I use Quickbooks Remote access which is a Webex 'invite' and 'approve' remote access solution.  Use the server for the data repository, but come up with a remote data transfer on approval solution for them.

Build the trust...fix the needs...

(just updated the post as I think they just redid their web site today on that RemoteAccounting link)

$612 million later

Your fingers may not be safe but your Blackberries are.

But here are some thoughts on the device from conversations on a listserve.....

Pick a PDA not by picking a standard mobile company but by the device you want

• Look at what additional apps are built for the platform.  Folks may love Blackberries, but there isn't much software you can add to it
• Find the device most usable for your needs.
• Check with your firm as to what they are rolling out and supporting.  If given the choice between a Blackberry or Palm/Windows PDA, for flexibility consider the Palm/Windows platform.

Remember in SBSland we have put Blackberry servers 'on' our SBS boxes but you can also bounce emails out alternative email address or install the Blackberry software on the workstation.

Seeing an issue with Window Genuine Advantage?

Eric Vogel reported that the Genuine Advantage update was having a bit of issues.  I had installed it on my XP workstation the other day with no issues, but there were newsgroup reports of problems in addition to Eric's report.

Looks like there's a solution.... as reported in the newsgroups

If you received this error 0x80070005, go to the WGA diagnostic tool which has been updated.

Quickbooks R5 version now released

Are you tired of XP Home?

http://www.wservernews.com/

I spotted this in the Sunbelt WinServer newsletter and had to share it here......personally I think we need to have a contest.... a scavenger hunt if you will....first person to find a Vista Operating system that can connect to a domain in a retail store like Best Buy during the Christmas season wins a prize....

"Seven Vista Flavors? NO NO NO NO NO NO NO

Subscriber Nick Meyer from Grande Prairie Canada wrote me, and I agree wholeheartedly... :

"On the Vista front, I told MS at a Technet briefing in the fall when we heard rumors of 7 SKU's that as technicians the answer is NO NO NO NO NO NO NO. I was surprised that 700+ people gave me a standing ovation for that! It is too darn complicated--"Oh sorry, you bought Vista home, no you can't do remote desktop."; "No, you needed to buy Media Center edition to use that swanky new remote control you bought off the shelf"; "How the heck do you turn off Simple File Sharing--oh you can only do that with Vista Pro, darn"

"Somebody once called it the "unixification" of Windows. When Vista hits shelves you'll have a bunch of Windows 2000 Server flavors, Server 2003 flavors, W2K Pro, XP Home and Pro, couple of Media Center 200x's and SEVEN?! flavors of Vista. NO NO NO NO NO NO NO NO!"

"Make it a configuration wizard, like SBS has. Want to change from home to pro? Run a wizard, poof. Added the necessary TV-in/out card and want Media Center? Run the wizard, poof. And make EVERYTHING one price, too. I am *so* tired of not being able to buy ANYTHING off the shelf because they're ALL loaded with XP Home 'cause it is a hundred bucks cheaper..."

For the record... I do have good news for Nick Mery from Grande Prairie Canada... it's only six versions..not seven...

SMBTN Spring Conference

I'm making a mad dash down to Los Angeles on a Saturday and then back home Sunday at the end of March/first of April for the Spring SMBTN Conference.... and while I could talk about WSUS and patching issues.... since I did that last year and I seemingly have done it a lot lately... I think I'm going to ask for feedback.

If you are attending the SMBTN Spring Conference... what topic are you interested in?  I'd like to make it interactive.  So here are some ideas I have....

• I could do WSUS (especially since it's under the hood in the R2 era) and discuss what patches come out on WSUS but since I've done that... I'm like hmmmmmm
• I could do a brainstrorming sesson on the real risks of a SBS network.  I still strongly believe that we immediately jump to the "Oh we MUST do THAT since that's best practices" but it's my belief that you can't say that without looking at the data you are protecting.
• I could do a talk on the Support resources and stuff available from PSS Security... how they will handle issues with a security patch, how they have investigators that review issues, what the MSRC is and what resources there are to keep aware of breaking security issues (hmmm...that one isn't a bad idea....)
• I could do one on investigating audit logs ....

In fact the more I think about this... since Dana Epp will be there too, I'll probably bounce this off of him too since it's always fun to do a he said/she said presentation.

But got any other ideas that you'd like to see discussed and/or talked about?

Psssttt... don't tell Dana that I need to download the latest Firewall Dashboard beta as mine expired yesterday and I forgot to download it and install it today....

Is everyone ready for technology?

My Dad's a kind of a guy that sometimes will tinker around with technology a lot longer than I will... (especially when it comes to dial up).  But then there are those clients of yours that just aren't ready for technology...but you have to be ready for them.

There are just some folks in a firm that you know you can only push so far.  That you are pleased that they are using computers in general, and to expect that they are going to handle any more than they already can and do handle, is probably asking too much.

Like there are some clients that I know I will never get them to trust online banking, or electronic paychecks, and then there are those clients that (and typcially they are younger) that do embrace technology and ask us to embrace it too.

So what are your clients like?  Ready to embrace technology?  Or ones that you need to do hand holding?

Selling Software

Yesterday I talked about how I went to a retail store to buy software for a client, and a comment asked why I wasn't in the business of selling software.

For several reasons.

Firstly, I do not want the hassle of the vendor relationship, the sales tax reports and all that would accompany that transaction.  Secondly, you have to understand there are some historical barriers to accepting "commissions" in my accounting industry.  The Business and Professions Code in California actually has a section on accepting commissions and our State Board of Accountancy discusses how we have to disclose any relationship.

So for me, there's a cultural industry bias against making a "commission" on a transaction.  Especially not without disclosing the relationship to the client.

For some of you, you do want to "sell the hardware and software" to make that additional percentage.  For some like me, I don't want the hassle, I'm just a "service" person, not a seller of software or hardware.

Sometimes it's not just enough that the software is good...it's the vendor relationship and reselling hassle as well.

Happy 44th birthday to a certain lead singer!

So want to guess where I went with Sis tonight?  Sponsored by "Sprint" and before the "thing" started you could text message something and it would end up on the Jumbotron.  And between all the digital cameras and the camera phones (including mine....) that were snapping photos, and all the technology broadcasting the image and the syncronization of the lights and cameras and everything...there was a lot of technology on stage.  And in the parking lot about 5 custom busses and umpteen semi trucks moving it from place to place.

Give up?  Okay another hint is that March 2nd is also the birthday of the lead singer.....

Still can't figure out what band it is from the slightly blurry logo in the photo (taken from my camera phone and yes, I was ridiculous enough of a geek to be emailing it so certain people during the concert, done of course because it syncs back with my office network and can email out the email attachments.  I do admit that I cannot T9 worth a darn, so the folks I sent emails to got blank subject lines on their emails.

Need another hint?

Try here...

P.S. ... my ears are still ringing... but it was great nonetheless...

Rum and Coke and a bit more....

A wee bit of Irish.....

A dash of Dutch.....

A heaping of the Mardi Gras of New Orleans.....

And the best thing that ever happened to Vladville and the SBSshow (because boy did those two guys need some major class) ......

What do you get when you put all these together with a dash of Rum and Coke?

http://www.smbnation.com/Default.aspx?TabId=105

A place where I'd like to be on April 6th if I could..... so if I were you.... and you are over there... anywhere near Amsterdam.... register.....go..get a bit of SBS family and community love....

And tell Suzanne that she's doing a wonderful job giving the SBSshow Podcast some class.

Buying software

Went to Office Depot tonight to buy Accounting software for a client who needed to update (old 2003 version ....yes... I bought Quickbooks... I think they will take my Security MVPdom away for that....) and I noticed that Small Business Accounting 2006 was no where to be found.  Oh sure, I could buy a SBS 2004 (three day shipment special order) but Microsoft SBA 2006? 

Nope. Not on the shelves.

Folks... Office Depot and Costco are where my small business clientele go to get software most of the time.

Adding a member server that uses R2 bits

The SBS Podcast gang has a blog post on how to add a R2 member server to the SBS domain and the blog comes to the rescue on how to do just that

http://blogs.technet.com/sbs/archive/2006/02/28/420825.aspx

Check it out!