Monday, September 12, 2005 - Posts

Part 10: Infrastructure essentials Blogcast - OWA goes SSL (nearly)

Continuing the blogcast series on infrastructure essentials.

To re-configure our Outlook Web Access which is currently available on the Internet using http into https, we need a way of configuring the external interface of the ISA server to do "SSL Termination". By this, I mean that the SSL channel exists between the client out on the Internet, and the ISA server itself. Once at the ISA server, the secure channel is terminated. This means that the ISA server can do it's job much better as it is able to perform inspection on the traffic coming in, and block according to content rather than just by URL inspection. Of course, we could re-encrypt traffic to create a secure channel over our LAN, but for now, this is the starting point.

To allow the ISA server to do this SSL termination, it must hold the private key for the certificate being used for the encrypted traffic - only the private key is able to decrypt the incoming traffic. To do this, we use certificate services running on our domain controller and the web service of certificate services to request a certificate for the external site - mail.contoso.com from the ISA server. There is a trick you need to do though to allow this to work, as by default one of the system policy rules on the ISA server blocks traffic. Once the certificate is requested and installed correctly (remembering to install it in the local computer certificate store), we look at how to configure an MMC console to view that certificate and the path to the root certificate store. In the next part, we'll convert our ISA configuration to start using that certificate. Click here to view.


Series Index:

0. Network configuration and series background.
1. Getting started
2. ISA Server configuration to allow basic web browsing capability
3. ISA Firewall Client basic configuration
4. ISA Firewall Client auto-detection through WPAD configuration
5. Configuring an Exchange mailbox and Outlook profile
6. Fixing 0x8004010F on Outlook send/receive
7. Installing our first Certificate Authority
8. Publishing OWA through ISA using Forms Based Authentication
9. OWA /exchange redirection

Core Infrastructure at IT Forum in Barcelona this November

So it's been a hectic few weeks for me. I'm nearing the end of pulling together the line-up for the core infrastructure track, so here's a a taster of some of the breakout session content you're going to see (subject to change, just to cover myself!).

Of course, in addition to the content below, there's another 9 tracks chock full of other sessions, plus plenty of "chalk-and-talks", hands on labs, lightning-demos and panel discussions. I'll leave them for another day. For more details of the conference, click the banner above. Note that time is rapidly running out for the early bird discount though! If you are attending, please drop me a line. I'd love to meet as many of you as I can this November. I'll post up a more complete list in a couple of weeks time as we "Dot the i's and Cross the T's".

What the Windows Server 2003 R2 Distributed File System can do for Branch/Remote Office Scenarios
As organizations expand to include more users and servers—whether they are located in one site or in geographically distributed sites—administrators find it increasingly difficult to provide users with intuitive, fast access to the files they need. Administrators who manage remote or branch offices face additional challenges, such as limiting network traffic over slow WAN connections, ensuring the availability of files during WAN outages or server failures, and ensuring that branch servers are backed up correctly. To help administrators address these challenges, the Distributed File System solution in Windows Server 2003 “R2” provides two technologies, DFS Namespaces and DFS Replication, which, when used together, offer simplified, fault-tolerant access to files and WAN-friendly replication.

UNIX Interoperability in Windows Server 2003 R2
This session will discuss the exciting new capabilities appearing in R2 for enabling greater interoperability with UNIX systems. We'll cover support for NFS, changes to the standard Active Directory schema, and the new Subsystem for UNIX Applications, including improved access to Oracle databases and to Win32 APIs and DLLs in general.

Windows Server 2003 R2 Efficient Storage Management
Windows Server 2003 R2 will include new tools that simplify the tasks necessary to set up an efficient storage environment for the Windows platform. Learn about the new quota management tools and SAN management tools. These new tools, coupled with the new management capabilities of DFS and the integration of Windows storage features by Microsoft partners, have made file server deployments and also SANs simpler than ever to deploy on Windows for both iSCSI and Fibre Channel. This session describes and demonstrates the new features and programs that make SANs accessible to a new class of users outside the data center environments.

Storage: Disaster Recovery
Deploying storage disaster recovery solutions for Windows successfully can be complex and expensive depending on the solutions customers choose. Learn about the various levels of failure and the kinds of products available for each kind of recovery solution needed.

Windows Hypervisor and Virtualization Futures
This session provides a technical overview of the Windows hypervisor. The Windows hypervisor will provide the foundation for Microsoft's Windows virtualization solutions in the Longhorn Server timeframe. This session discusses the hypervisor and related I/O virtualization layers.

Windows Hang and Crash Dump Analysis (Mark Russinovich)
Learn to analyze Microsoft Windows crash dumps, diagnose the cause, pinpoint a solution, a resolve the problem. This session for all systems administrators explains how crashes occur and what happens when you reboot a crashed system, and then leads you step-by-step through the crash dump analysis process, introducing the latest tools from Microsoft and handy tricks for isolating the cause of a crash.

Advanced Windows Troubleshooting with Sysinternals Filemon and Regmon (Mark Russinovich)
Learn advanced techniques for applying the Filemon and Regmon freeware tools from Sysinternals.com to troubleshoot a range of Windows system and application issues (DLL conflicts, permission problems, registry problems, etc). These tools are used on a daily basis by Microsoft Product Support and have been used effectively to solve a wide variety of desktop and server issues, so being familiar with their operation and application will assist you in dealing with different problems on Windows. Real world examples will be given that show successful application of these tools to solve real problems.

Printing with Windows Server 2003 R2
Huge improvements have been made to printing and print management in Windows Server 2003 and Windows Server 2003 R2. This session goes end to end with a technical drill down covering tips, tricks and the latest features. Learn how to deal with 64-bit print drivers, cluster improvements and advice for handling printing in branch offices.  The Print Management Console (PMC) is new to Windows Server 2003 R2, bringing about significant improvements by allowing you for the first time to manage multiple print servers from a single interface. Through demonstration, find out how to make the most effective use of the PMC by building filters and sending notifications when printers or servers are unavailable. You will also learn how to use the PMC to deploy printer connections to your users through Group Policy.

Terminal Services Drilldown
Discover the new Terminal Services feature in Windows Server 2003 SP1 and how they help you to deploy and maintain your Terminal Services environment.  This session will cover the new SP1 features, provide an introduction to x64 and Terminal Services.  This session will cover the top support issues seen by Microsoft Product Support and provide a detailed discussion of the symptoms and causes to help you prevent having these issues within your organization.

Active Directory Disaster Recovery Parts 1 & 2 (John Craddock)
No Pressure! Your Active Directory has just failed… Can you pinpoint where it has failed? Do you have a disaster recovery plan? Do you know where to start? Join us for these two sessions and learn how to recover from different failure scenarios including failures of, the database, domain controllers, global catalogs, FSMO roles and SYSVOL. You will learn how to successfully recover domains, forests and perform authoritative restores. We will not only show you how to do it, but also point out any associated caveats. The sessions are backed up with comprehensive demos.

Branch Office Active Directory Deployment
This session will look at the Architecture and Design considerations of implementing Active Directory in a branch or satellite office scenario.  The learning is based on recent work Microsoft UK have carried out in the design and deployment of some of the largest branch office domain controller deployments in the world. Expect detailed information regarding the architecture, key decision factors and implications of the design. This session will also look in detail at the Windows Server 2003 Branch Office Deployment Guide, including design and planning considerations (for example DC placement, bridgehead server load and DNS), key components such as KCC redundant mode and other tools such as ADLB and Ultrasound. The session aims to walk you through a branch office deployment picking up the key pertinent points along the way.

Security Policy Management and the Security Configuration Wizard (Jesper Johansson)
In Windows Server 2003 Service Pack 1, Microsoft shipped its first new security policy tool in six years. The Security Configuration Wizard (SCW) can help you author, tailor and apply policy. As with any security policy tool it can also completely disable your network. To learn more about how to manage security policies and how to use the Security Configuration Wizard, come to this session where Jesper Johansson discusses the internals of the security configuration wizard and how to make use of it to author policies in your organization. We cover how to use SCW as well as other security policy tools and resources, such as the Security Configuration Editor, Group Policy, and the Security Guides. We also discuss the idea of role-based security policy and how you can best leverage it to protect your Windows network.

Windows Storage Server 2003 R2 Drilldown: Deciding between it and Windows Server 2003 R2
This session will look under the hood of Windows Storage Server 2003 R2 focusing on the new features like single instance storage, text based search, file server performance optimization.  How do they work? How do you deploy and implement the product? What are the scenarios in which Windows Storage Server is deployed? We also explore unique storage features of Windows Storage Server 2003 R2 versus Windows Server 2003.

You've decided to migrate off of Novell, now what?
As Novell Netware customers investigate their upgrade and migration options, they see there is a lot of work that needs to be done to make that migration as smooth as possible.
This session will provide an overview of the various methods of migrating from NDS to Active Directory.  We will discuss the concepts and issues involved in such a migration (translating security principles, coexistence and data migration) and the main problems that the customer may encounter.  We will then demonstrate Services For Netware, Microsoft Directory Synchronisation Service and Quest NDS Migrator and differentiate between methods to identify where each product set fits in a migration project.


Virtual Server - Advanced Scripting & Other Secrets
Virtual Server provides a powerful selection of COM interfaces for manipulating all facets of a virtual machine. This can support everything from provisioning to day-to-day management operations. In this session we will showcase the COM API and demonstrate a range of scripting examples. We will also demonstrate how partner offerings are using the API to productize key provisioning and management functionality.

Understanding & working with the Virtual Server VHD disk format
Microsoft has standardized on the Virtual Hard Disk (VHD) file format for the running and management of virtual machines. This file format provides for a range of disk types, including dynamically expanding, linked, undo and differencing disks. In this session we will take a deep dive into the file format, and discuss best practices and partner offerings for disk image management and migration.

How MSIT Manages its AD Infrastructure
Ever wondered how Microsoft information technology (IT) manages and operates its Active Directory infrastructure? Do you think Microsoft employees are especially tolerant of downtime or performance issues? Microsoft has the oldest production Active Directory in the world (happily authenticating users since 1999). Come listen as Microsoft IT shares its best practices on everything from domain controller placement, performance monitoring and change management to disaster recovery, tools and 64-bit domain controllers.