November 2007 - Posts

So one of the points that Amy Babinchak made in AU at the SMB security summit was that each time there was a rule in ISA that said "let the world in" you needed to stop and ask yourself why. RDP from THE WORLD may not be a wise move. You can easily ...even without a static IP, limit the access to a range of IPs that represent your ISP. So even if you have a Dynamic IP address, all you need to do is to place the ISP's range as the "from" access and you will be allowed to RDP to that server.
Concerned that you'll be on the road and need to connect? Connect first to your server and then to the clients.
But bottom line, review the globe.. WHY do you need it?

So let's say you want to be alerted when someone does a password attempt on your system. Go into the health monitor, copy the Account Lockout alert service and edit it to look for event 529 in the event logs. Adjust the Actions to not only log to the system but to email you when someone does a bad password attempt and voila... you now have a early warning system when someone from remote is banging on things.
I personally limit the access to port 25 to only those ports that need access to the servers at ExchangeDefender.com and don't get drive bys... but if you are concerned.....
The Official SBS Blog : Network Behind a Network:
http://blogs.technet.com/sbs/archive/2007/11/29/network-behind-a-network.aspx

Today's sbs blog post brought to you by Wayne McIntyre
http://www.pcworld.com/article/id,139492-c,internetexplorer/article.html $521 million
http://seattlepi.nwsource.com/business/329766_msfteolas31.html $60 to $70 a share for the shareholders in dividends
http://www.theinquirer.net/en/inquirer/news/2006/08/23/microsoft-and-autodesk-lose-product-activation-patent-suit $158 million
How many billions of dollars have been spent that provided no benefit, protected no clients, gave no needed features?
http://www.usdoj.gov/atr/cases/f227500/227585.htm
First, the California Movants argue that extension of the Final Judgment is necessary to "pry open" the OEM channel to non-Microsoft web browsers.(7) They make no showing, however, that any conduct by Microsoft (either in violation of the decree or otherwise) has foreclosed the OEM channel to third-party browsers. Rather, they simply state that to date, no OEM has shipped a non-Microsoft web browser as the default web browser. This is a non sequitur. The Final Judgments do not mandate that OEMs, who are not parties in this case, install non-Microsoft web browsers as a default. The Final Judgments only seek to ensure that Microsoft does not block the OEM distribution channel.

Funny, I don't see any non Apple browser shipped in the Macintosh. Nor do I see any other OEM channel other than Apple. Okay so one could argue that they aren't in a "monopoly" position, but why not ensure that from the get go that monopolistic practices aren't followed by manufacturers? Why is it that in the supposed "name of ensuring competition", that all I see is companies being forced to pay patent settlements in millions of dollars.
In reading some of the stuff on http://www.usdoj.gov/atr/cases/f227500/227585.htm is there anyone else besides me wondering how much money has been spent in "compliance" that gives no value, provides no real competition, provides nothing other than making a bunch of attorneys rich? I thought this country was founded on capitalism and building a better mousetrap theory?
I mean given the unofficial survey I did of college students on the train home where I saw two MacBooks, two Vista laptops and one XP, hasn't mere "mousetrap" provided more leveling of the playing field than any judicial ruling that required the removal of a media player, a browser and what not?
How much money has been spent on this stuff? Has it added security? Has it provided more competition? Has it really?
http://www.usdoj.gov/atr/cases/f225600/225691.htm
Changes to Internet Explorer were delivered to consumers on August 14, 2007, and changes for Windows Media Player were delivered on August 28, 2007. Microsoft plans to incorporate the changes to Windows XP into Service Pack 3 and will make its proposed changes to the code available for review by the TC in the near future.
Somewhere in http://www.microsoft.com/technet/security/bulletin/ms07-045.mspx is something that the DOJ demanded as part of it's settlement. What it is, I don't know. How it has security impact is debatable. Questionable, even. But because some Judge or Attorney who probably still runs Windows 98 and Word Perfect deemed it appropriate, something they deemed as increasing competition is probably in that patch.
I think my favorite read is this section: http://www.usdoj.gov/atr/cases/f225600/225658.htm .... titled " The Final Judgments Have Protected the Development of Competing Middleware Products" where they argue that due to the Judgements applications and browsers like Firefox, iTunes, Google, software as a service has been impacted, enhanced and protected by the Final Judgments.
Since the entry of the Final Judgments, there have been a number of developments in the competitive landscape relating to middleware and to PC operating systems generally that suggest that the Final Judgments are accomplishing their stated goal of fostering competitive conditions among middleware products, unimpeded by anticompetitive exclusionary obstacles erected by Microsoft.
To argue that the settlements by the DOJ have in any way impacted the rise of iTunes is laughable. To argue that the DOJ had a hand in increasing Firefox penetration is hilarious. THEY BUILT A BETTER PRODUCT THAT SOLVED A NEED. Basic business 101. It had nothing to do with the millions of dollars ...potentially billions of dollars that have spent on these lawsuits.
Is the marketplace changing?
Do posts like the links at the bottom indicate a mood shift, a reevaluation of the marketplace? And were a SINGLE one of these posts.... influenced at all by what the Department of Justice did ....or is it all the result of businesses building something for a customer base? I'd argue that the DOJ/EU judgments did nothing to impact or foster competition. Sure, the marketplace is moving. Changing. It did before and will again. Technology should evolve. But it has nothing at all to do with judgments that were made.
So... how much money has really and truly been wasted... in the name of competition and anti-trust... and patent enforcement....and ...well all of that..... and as consumers of software we haven't seen an impact?
Are any of these posts a result of the DOJ settlements/judgments? Or are the just an acknowledgement that times change and so do businesses?
So your client bought a Vista Home premium and now you are wanting to tweak it for that setting that allows the Administrator to silently elevate rather than to get the (supposedly) annoying UAC prompt and you are looking for secpol.msc on Vista Home Premium?
And you find out ...it's not there.. so now what?
Regedit and find the section of the Vista registry
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
Change the value of ConsentPromptBehaviorAdmin to a "0" from the listed "2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"
"ConsentPromptBehaviorUser"
"EnableInstallerDetection"
"EnableLUA"
"EnableSecureUIAPaths"
"EnableVirtualization"
"PromptOnSecureDesktop"
"ValidateAdminCodeSignatures"
"FilterAdministratorToken"
http://www.computerperformance.co.uk/vista/ConsentPromptBehavior.htm
The AT&T edge sync'd and then it didn't... and I was getting a 0x80072efd error...
Googled.. and it was due to this: http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=994379&SiteID=17
What I realized is that for one reason or another my PDA picked up the office Proxy Server settings. Once I removed the proxy setting it was able to sync over the air with no problems.
Proxy can be found by going to:
Start
Settings
Connections Tab
Connections Icon
Task
Manage existing connections (Your mobile providers network should appear)
Proxy Settings Tab
Uncheck This network users a proxy server to connect to the internet.
Ok
It was picking up the proxy server settings..
http://tech.yahoo.com/blogs/patterson/5383
I was setting up a phone tonight and remembered that I couldn't call the time lady at 767-8900 (also dial-able as pop-corn) any more to check the phone.
California's time lady got deprecated back in September. Word is they said that the equipment was aging and that time is available in so many other ways. But the Time lady was one constant for ensuring that time was correct.
At the tone tine time will be.... 11:28 p.m. Pacific Standard Time...
<beep>

Welcome! We are going to be in your area demoing Microsoft Office Accounting 2008 and answering your questions! Here's a great chance to learn about using this great financial management software and to network with fellow users in your area!
Here's your opportunity to discover the NEW Office Accounting 2008 features and be a part of a fast growing, local community of fellow product users. Please join us for this free event. Refreshments will be provided.
The following topics and opportunities will be included at each session:
> Learn about new Office Accounting 2008 and how it can help better manage your business finances
> Create a networking and support community with your fellow users
> Share stories and best practices about improvements from your previous process
> Help direct Microsoft's future product development by providing feedback on the product or ideas on new feature enhancements
Be a part in establishing a local Office Accounting user group that will meet regularly in each region.
All meetings will be held at regional Microsoft offices; addresses and driving directions can be found on the individual pages at http://www.microsoft.com/about/companyinformation/usaoffices/default.mspx
A Microsoft Office Accounting team member will host the meeting. Please join us and learn how Office Accounting can help save time with everyday financial tasks and grow your business!
| City |
Date |
Time |
| Redmond Campus, WA |
November 29 |
6-8pm |
| Los Angeles, CA |
December 4 |
5-7pm |
| Denver |
December 6 |
5-7pm |
| Mountain View, CA |
December 6 |
6-8pm |
| Las Colinas, TX |
December 11 |
6:30-8:30pm |
| Downers Grove, IL |
December 11 |
6-8pm |
| Boston, MA |
December 12 |
5-7pm |
| Bloomington, MN |
December 12 |
5-7pm |
| New York City |
January 8 |
3-5pm |
| Washington DC |
January 10 |
5-7pm |
Sign up today by emailing Kathy Yakal at oausergroups@msn.com with your name, company, address, date and location desired. If you can't make the meetings but would like to share feedback, please send it to Kathy Yakal at oausergroups@msn.com.
We look forward to seeing you there!
Microsoft Office Accounting Team
There I said it. I don't normally give up on technology but I've given up on trying to get an AT&T Tilt connected via bluetooth to act like a modem for a laptop. Instead I will just loan out my wireless card that ALWAYS works.
All of the websites/and boards talked about ... well it works.. but don't forget to reset your phone after using it as it messes up the networking. Huh? Why is it with phones these days that the geeks consider what they do to get it to work normal?

It seems to me the cell phones have turned into the new arena of bad customer service lately. Reminds me of the time that Lily Tomlin did the Ernestine skit where she said "We're the phone company... we don't care! We don't have to!"
I as a customer of AT&T STILL waiting for the promised Windows Mobile 6 upgrade to the Treo 750, I am amazed that once again Microsoft Mobile platform is being totally slammed again by OEMs. The folks on the forums are googling for bootleg versions of Windows Mobile 6 because they have had it with the vendor saying 'soon...soon".
http://forums.cingular.com/cng/board/message?board.id=palm&thread.id=11286&view=by_date_ascending&page=20
Meanwhile we are teaching people how to go download software from untrusted locations. Way to go vendors. Lets train customers to go to bootleg sites just because they are so darn frustrated with the manner in which you are promising upgrades.
Just yesterday in fact, a fellow mvp who had a cab file that gave a Windows mobile 6 phone the ability to do RDP was asked to remove it from the file download location. The argument was that it was piracy.
Well excuse me but who is more of the pirate here? If I'm a large corporate AT&T customer, word is that the upgrade is available. If so, that makes AT&T more the pirate than their customers.
Sometimes I just don't get business. Yeah if the goal is to make the customer so frustrated that they will give up and buy the new phones, I guess that's a win for the company, but it's not a good long term win in my book. Verizon opening up the door to non Verizon phones is a start... a good start.. http://www.eweek.com/article2/0,1895,2222771,00.asp but it's one that should be sooner versus later.
It's funny isn't it that the item called "mobility" is offered by some of the least flexible vendors out there?
“Here at the Phone Company we handle eighty-four billion calls a year. Serving everyone from presidents and kings to scum of the earth. (snort) We realize that every so often you can’t get an operator, for no apparent reason your phone goes out of order [snatches plug out of switchboard], or perhaps you get charged for a call you didn’t make. We don’t care. Watch this [bangs on a switch panel like a cheap piano] just lost Peoria. (snort) You see, this phone system consists of a multibillion-dollar matrix of space-age technology that is so sophisticated, even we can’t handle it. But that’s your problem, isn’t it ? Next time you complain about your phone service, why don’t you try using two Dixie cups with a string. We don’t care. We don’t have to. (snort) We’re the Phone Company!”
– Lily Tomlin, as Ernestine
Still needing to get back to those old files after you installed Office 2003 sp3
http://support.microsoft.com/kb/938810/
Take the contents of this and put it in a text file and save it as officefix.reg, or download the zip file and unzip it.
Or you can use this http://msmvps.com/blogs/bradley/attachment/1367599.ashx downloadable file there.
Click on the file to have it insert the info into your registry.
-----------
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Excel\Security\FileOpenBlock]
"LotusandQuattroFiles"=dword:00000000
"DifandSylkFiles"=dword:00000000
[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\PowerPoint\Security\FileOpenBlock]
"FilesBeforePowerPoint97"=dword:00000000
[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\PowerPoint\Security\FileSaveBlock]
"Converters"=dword:00000000
[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Word\Security\FileOpenBlock]
"FilesBeforeVersion"=dword:00000000
[HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Graphics Filters\Import\CDR]
"Enabled"=dword:00000001
NEW RELEASES: QuickBooks 2008, 2007 and 2006
We're working hard to get several updates to current versions of QuickBooks ready for you and your clients by the dates shown below. These releases are also for QuickBooks Enterprise Solutions 8, 7, and 6, although for brevity we are listing them by the QuickBooks desktop year only.
QuickBooks 2008, Release 3*
This is a major release. See below for details.
- Manual Update Planned to Go Live Thursday, Nov. 29.
- Automatic Update Planned to Go Live Thursday, Dec. 13.
*There is no Release 2 or R2; R3 is the first release to update QuickBooks 2008. The numbering scheme will skip a release if superseded in development. Note: For clients looking to purchase and download QuickBooks 2008 from QuickBooks.com, Release 3 is expected to be available Monday, Dec. 3.
QuickBooks 2007, Release 10**
This is a minor release; detailed release notes will be posted when live.
- Web and Automatic Update Planned to Go Live Monday, Dec. 10. Minor release; release notes posted when live.
**There is no R9. The prior update was R8. The numbering scheme will skip a release if superseded in development.
QuickBooks 2006, Release 11
- Web and Automatic Update Planned to Go Live Monday, Dec. 10. Minor release; release notes posted when live.
For all of these releases, check the QuickBooks Support site for Product Updates.
TIP: Use the "Select a Different Product" button to check on a different version of QuickBooks from the version that is your current default.
Improved Reconciliations in QuickBooks 2008 Accountant's Copy
Another Reason to Use Accountant's Copy. When you and your clients update to R3, you will have improved reconciliation functionality in the Accountant's Copy.
With R3, either you or the client or both can reconcile their bank and credit card accounts while the Accountant's Copy is with you. The client's reconciliation of a particular account is saved and will be retained as long as you did not also reconcile the account during the period you worked on the Accountant's Copy. (If you have reconciled the same account as the client, your reconciliation will be retained when the client accepts the Accountant's Copy.)
More Changes in R3. More information on QuickBooks 2008 R3 will be posted with the Web update, which we expect on Nov. 29, 2007. Enhancements and resolutions of known issues are expected for a variety of QuickBooks functions.
Notes:
- In its initial release, QuickBooks 2008 allowed a situation where clients could send an Accountant's Copy, then do a reconciliation, and discover the reconciliation was undone when the updated Accountant's Copy was imported. Individually and through various advisor groups, you told us we had to fix this so clients would not see their reconciliations disappear.
- In R3, if a ProAdvisor and client should both reconcile the same account while the Accountant's Copy is out with the ProAdvisor, the ProAdvisor's reconciliation will override the client's reconciliation.
- With your QuickBooks Premier Accountant Edition 2008, you are able to share an Accountant's Copy with clients in either QuickBooks 2007 or QuickBooks 2008. However, to take advantage of the revamped reconciliation ability identified in this newsletter, the ProAdvisor must have Accountant Edition 2008 R3 and the client QuickBooks 2008 R3.
I wanted to comment on this comment:
Seems like we need some type of grand SBS Unifying Theory. On the one hand, we have this fabulous all-in-one box that is perfectly priced for the small business and brings a plethora of enterprise-worthy capabilities that you could previously only find in a Fortune 500 company. Easily one of the most transformational of these is remote access, giving workers access to their info and workspaces no matter where they are.
On the other hand, the cadre of talented and intelligent consultants who have built respectable consulting practices on this product are telling us that most of the things that make SBS so compelling are too dangerous to actually be employed. No RDP! No VPN! No business data on the SBS box - which would include files as well as databases! No pubic web sites! No FTP!
If the only bang for the buck I can get out of SBS is Exchange, why bother? I can find a whole truck load of free SMTP and POP mail servers if I want to host my own mail.
So what's the SBS Grand Unifying Theory? Because right now it seems that the immoveable object (SBS as a first class all-in-one solution) and the irresistable force (most SBS capabilities are too vulnerable to be exposed on the external network) are in violent conflict with one another.
I didn't say "no RDP"... what I said was no RDP from any ol' external access. What I mean by this is that generally speaking ONLY the consultant should be doing a direct RDP to the server itself. Everyone else (and I do me EVERYONE ELSE) should be using the access that was built for remote access...and that is Remote Web Workplace.
Who said anything about no business data on a SBS box? I do, as do most of us...and BECAUSE we have business data we make the choice to limit who does unfettered VPN access to the box. Unless you take the time (and most of us do not) to limit the kind/type/means of VPN access, the person making the connection with their home PC that is probably bot-netted and owned, will make a layer 3 full connection to your network. Unless you are like Dana Epp of www.scorpionsoft.com and have Windows 2008/RC and Network Access Protection running, what we're doing here is making risk choices.
Yes we can have remote access... but it's limited to who needs it and from what locations and types.
Yes to Remote Web Workplace as that's the safest connection.
Yes to RDP but ONLY to server administrators and limited to their locations. The entire world does not need to have the ability to try to connect to your server's port 3389.
Why Exchange? Shared calendars. Active Sync. I'm sorry but hosted email is not the same when you have a full on rich Exchange in your own backyard.. pop3 does not cut the mustard.
When hosting websites externally is cheap .. do so. When hosting ftp externally (as there's not much protecting that password) is cheap, do so.
But you cannot ...and no one is saying to shut off/down/limit Remote Web Workplace to those users that need it (...well.. I do say don't use kiosk computers).
But this isn't about saying "No" all the time.. it's determining what the right balance of risk versus implentation is. Most SBS capabilities are indeed too vulnerable to expose to everyone in the entire universe...nor would you want to in the Enterprise space as well.....and that's exactly why the consultant doesn't do exactly that. He or she finds the right balance of exposing some services to full access (RWW) and some to limited access (RDP and VPN).
The balance is different for each client as well.
Does everyone in the entire Internet need access to your server's RDP port? Nope. And that's the point that Eriq and Amy were trying to get across. THEY need access. The entire world doesn't.
The wonderful thing about SBS is that it's flexible enough to be able to build the right solution for many clients.
More Posts
Next page »