THE OFFICIAL BLOG OF THE SBS DIVA

Server 2008 is launching officially Feb 28th, but there are launch day events all over the country.  This year there's even an official one in Fresno.  Fresno no less!

http://www.microsoft.com/heroeshappenhere/register/default.mspx

And it isn't in a small place either.. it's at the Convention Center.  Check it out and sign up!

On Dr. Jesper Johansson's blog he lays out the evidence for the fact that Vista has had less security patches than XP during the same time frame.  The operative word there is "security patches".  As for the rank and file, the reality is that it 'feels' that Vista has been patched way more often than XP during the time frame (and I haven't honestly counted for sure) because of all the performance and application patches.

One author in PC Magazine has the same feeling...

http://www.pcmag.com/article2/0,2704,2254104,00.asp

'Scarcely stopping for a breath and not noticing that I had long ago left behind conversation for a full-fledged speech, I added, "The UAC [User Account Control] is a prime example. Microsoft Vista is inherently more secure than its predecessors, and, in fact, I cannot recall a recent successful attack—but on the other hand, I get more Windows Updates than I'm really comfortable with." ....'

He then goes on to make a statement that showcases that Microsoft hasn't communicated well the UAC experence at all.

"As I was saying, the UAC. For everything I do, and I mean everything--whether I'm installing an app, a game, or a Microsoft product--the UAC is always jumping in to warn me. It appears with such jarring regularity, and I do mean jarring—what's with that crazy screen shift, Bob?—that I no longer read it. I simply say 'OK' to everything. Is this what Microsoft intended? I ratchet it down in the OS, but then, am I disabling a key portion of Vista's security features? No feature should be so in-your-face that it becomes faceless."

Lance, you are SUPPOSED to get it when you install software... all the things you say you are doing ... your "I mean everything"... the installing an app, a game or a Microsoft product... "installing" is an administrative function.  You are supposed to get prompted.  And how many times do you install stuff?  When I roll out Vista for the very first time, I see it a lot the first couple of days, and then after that... nada.  Like on this Vista here at the office I have not seen it once all day long.  Line of Business apps, the whole shebang, not a single time have I seen it today.  None.

Then Lance loses me completely...

• "Do an Apple and start with new code. Forget about supporting every piece of hardware and software ever written. For people with major compatibility issues, keep Vista Premium around. You'll be surprised at how many people simply want to move forward.

When you have 90% of the marketplace to Apple's 4% ... you can't dump the entire partner eco-structure and 'do over'.  Like the guy on Todd's MS blog  - http://blog.seattlepi.nwsource.com/microsoft/archives/130605.asp who is having issues with printers, I don't buy the argument that 'start with new code' will give you cleaner code, more secure code, and that there's enough of the marketplace that is willing to rebuy everything.  When the first comment on that SeattlePI post, Keith states that Quickbooks 2006 and prior have issues with Vista when it's documented by Intuit that they support 2007 and 2008 on Vista, you can tell that people don't buy new, upgrade, etc nor even read the fact of what is supported on what platform. 

For the record you can get 2006 and prior running on Vista, just follow the guidelines of what we had to do to get the program to run as non admin back in that day.  Hack up the registry and set user/full control for the folder and registry locations of Intuit.  In fact I have to do some more testing as I hit an issue the other day in my network deployment of QB 2007 on Vista opening up and attempting to update a payroll tax table update in Vista and until I loosened the permissions on the Intuit location in the Program files, it wouldn't update.  (This didn't occur in a standalone Vista deployment on a single computer so I'm going to have to do some testing and see if it's due to the data file being parked on the server drive).

But bottom line, new code creates just as many problems as old code and ticks off a large vendor ecostructure in the process (not to mention with the DOJ and EU once again firing up a review... get real).

The other day I got the TechNet magazine and saw this in the Letters to the editor section...

You can see this down at the bottom of the "From the Editor: Dealing with Information Overload -- TechNet Magazine, February 2008" section of the TechEd Magazine:  http://www.microsoft.com/technet/technetmag/issues/2008/02/FromTheEditor/default.aspx

And honestly, for a moment there I went... "uh, I don't remember doing anything for that Magazine.." and then it hit me.  That's the OTHER Susan Bradley.  The Microsoft employee who works in Redmond somewhere in the Server team, somewhere in technical documenation or something like that who shares my name.  There's been a rare occasion I've gotten an email meant for her, and visa versa, sometimes she's gotten one meant for me.

In case you are wondering exactly how many Susan Bradleys there really are....

There's the fictional Susan Bradley who was played by Judy Garland in The Harvey Girls - http://en.wikipedia.org/wiki/List_of_Judy_Garland_performances

There's the one who does wallpaper.  http://www.susanbradley.co.uk/

There's the one that does the books on Sudden Money.  http://www.rightonthemoney.org/experts/bradley.html

There's the Love Doctor one.  http://www.saveyourlovelife.com/matchmaking.cfm

There one that does Film titles  http://www.imdb.com/name/nm0103412/

But if you see on a Microsoft publication the name "Susan Bradley"... it might not be me.  It might be her, THE Susan Bradley that works for Microsoft.  I just hope she doesn't get a lot of "oh are you the SBS Susan Bradley?" too much, and doesn't get too annoyed that we share the same name.

Microsoft doesn't recommend creating Vista 'Lite' | Beyond Binary - A blog by Ina Fried - CNET News.com:
http://www.news.com/8301-13860_3-9861474-56.html

"Microsoft does not recommend using any tool to strip out applications from Windows Vista prior to installing it on your system, as it may affect your ability to download future Windows updates and service packs, and may cause your system to become unstable," the company said in an e-mail to CNET News.com.

Yes, indeed it does damage the ability to patch the system.  So don't create "Vista lite".

Did you catch this on the blogs?

There's a couple of Songs I've heard on hold... WAY too often.  Gateway and Dell has annoying hold music.  The IRS is classical (which isn't relaxing as it should be).  I wonder who the guy is who does the recordings for the Live Meeting...because I hear him a lot.

The Acer 24 inch at NewEgg online - http://www.newegg.com/Product/Product.aspx?Item=N82E16824009113

Three Acer 24inch monitors in action (click here for a better view).... Vista, Office 2007 and then on the right, a virtual XP image of the exact desktop just in case I forgot something during the migration for one of the partners in the office. Notice the high tech monitor support in the middle.  I have matching 22inch Widescreen Acer's, he has three matching 24inch widescreen monitors.

We like them so much we bought two more for two other Accountants in the office.  They make a spreadsheet to die for (It ends up from A past Z in column width on the spreadsheet).

(For those keeping track, that's a FASB book, a Business Law book and an Intermediate Accounting Book being used as a temporary stand to see what height he wants the monitor at before he finds or builds something permanent.)

The Official SBS Blog : SBS Clients Lose Access to Shares and/or Cannot Get DHCP Addresses:
http://blogs.technet.com/sbs/archive/2008/01/30/sbs-clients-lose-access-to-shares-and-or-cannot-get-dhcp-addresses.aspx

(due to Symantec Endpoint Protection 11.0)

Today's SBS blog moment brought to you by Mike Lieser

News & Views for Irish SBSC Partners : New Deployment Guide for SBS 2003 & Windows Mobile 6!:
http://blogs.technet.com/sinead_o_grada/archive/2008/01/30/new-deployment-guide-for-sbs-2003-windows-mobile-6.aspx

But if you can't wait you can email for the hotfix now.  I got it within about an hour.

Another of our internal apps that runs perfectly on Vista is a classic example of INSTALLING it on Vista is the hard part..once you have it running it works just fine.

The first step I noticed after running the usual install routine is that it did not use the mapped drive letters but the unc path.  I had to edit the properties of the short cut on the desktop to point to the right locations.

The start in of I:\WinCSI\PS was originally \\Server\Share

Second up, it installed under the subdirectory of ART\ART not plain ART...causing another tweak to be needed. 

Location of Program Files\Microsoft Office\ART edited to be ART\ART where the actual file is located

Then for the first launch I needed to run it with a XP sp2 compatability which launches the 'are you sure' you want to launch this button. 

Once I loaded it the very first time, installed the local file at the c:\local location (manually setting up that folder in case it had issues, the program runs perfectly WITHOUT the compatibility flag.

Moral of this story is once you get it installed, try removing a few hacks and what not to see if it's just the installation and not the operation that's bumpy.

It runs without a UAC prompt with no issues.

You remember this post right? Microsoft wants to learn from us - The Official Blog of the SBS "Diva":
http://msmvps.com/blogs/bradley/archive/2008/01/22/microsoft-wants-to-learn-from-us.aspx

So the other day a few folks on a Yahoogroup weren't too sure about giving feedback to Microsoft as lately they've been moving into the IT Services space.  So when today, someone else posted up in another group the same info, someone said "wasn't the consensus that this was a means for Microsoft to learn from the MSPs how to be a MSP" (not quite worded like that but you get the drift).  And it reminded me of this article about the community thought process..... 

Slashdot Founder Questions Crowds Wisdom - Bits - Technology - New York Times Blog:
http://bits.blogs.nytimes.com/2008/01/29/slashdot-founder-questions-crowds-wisdom/

Especially this part of the article:

But Mr. Malda could not help using the discussion about Idle to address problems at Digg, and what he sees as the flaws of the community news model.

“A lot of these community news sites are all about Ron Paul,” he said. “Ron Paul may be a valid candidate. But what that is really demonstrating is that you are seeing 1 or 2 percent of a community shaping where the whole community is going. A small dedicated group of people can manipulate these sites very easily.”

Recently a group of us were asked a question and it was interesting to see how one community that I know on one side would answer the question as compared to another community.  And it begs the question sometimes that I have about whether or not Microsoft or any vendor that looks to a vocal community gets the right input. Am I the right voice?  Am I the right view?  Sometimes I wonder who exact Microsoft talks to when making some of the more insane (okay my opinion anyway) decisions that they do.  And it concerns me when I see either someone looking too narrow of a focus and asking not enough folks.. or conversely...asking for feedback and the feedback is not given. 

For the record the folks asking for feedback to write software not IT services.  And Microsoft needs to get a lot better at being evil before anyone is a trusted relationship role needs to worry.  Talk to your average business owner, and either he or she is indifferent or not trusting of Redmond.  It's a business tool, not a relationship.  You are the one that has to walk the tightrope of the relationship with Microsoft.  And I don't see either role changing soon.

But it's of interest to think about.  If a firm doesn't get feedback from the right people...what then?

http://www.microsoft.com/security/portal/Entry.aspx?name=Worm:Win32/Pushbot.BE 

A new bot worm is making the rounds on IM and if someone in your IM list pings you 
and says "Hey it's your PIC!  Don't click..it's the worm going through IM addresses 
with a bit of soclal engineering.

It will look like that ..again.. don't click.

EDIT -- the proper hotfix is:

You cannot distribute or install a software package in Windows Server 2003 if the software package contains a very large signed file:
http://support.microsoft.com/kb/938759/en-us

http://blogs.technet.com/systemcenteressentials/archive/2008/01/28/vista-sp1-will-be-distributed-via-microsoft-update.aspx

Windows Vista SP1 will be released as an update on Microsoft Update (MU). The patch is very large and there is a bug in Windows Server 2003 in the WinVerifyTrust API that will cause signing validation to fail.

What this means is that once you approve this update on a System Center Essentials 2007 server on a Windows Server 2003 server, every time the server sync’s from MU it will redownload the package, fail the cert validation, and so the download will fail. The problem will continue until you install the WinVerifyTrust patch on the System Center Essentials server. This patch is a hotfix (not a public GDR), so is not intended to be widely distributed. We recommend it only be installed on the System Center Essentials server itself.

You can obtain this hotfix here:

Windows Server Update Services cannot download large Windows update files in Windows Server 2003
http://support.microsoft.com/kb/888303/en-us

Software Tool Strips Windows Vista To Bare Bones -- Windows Vista -- InformationWeek:
http://www.informationweek.com/news/showArticle.jhtml?articleID=205920302

... also is one of the major causes of patch install failures in the newsgroup. 

This is my Vista at home....

This is my Vista at the office...

Install them.  Don't muck them up by trying to use third party tools and you get the best experience and best patching experience.

(Okay so don't blog without a minimum level of Mountain Dew in the system....let's try that again)...

Install Vista's as is.  Don't muck the Vista OS (or any OS for that matter) by attempting to streamline it, hack it up or change it.  Because what I've seen over and over again in the newsgroup that when it comes time to patch it on Patch Tuesday, permissions are screwed up, folders that it thinks should be there aren't there and other patching oddities.  Time and time again, Vista patches and works the best when you use the OS without a hacking up, with the Vista firewall.  And so far my Intel Core2 Duo CPU from HP is noticably peppier than the Home HP that has a lesser graphics card.  And the price tag of the HP was right in line with what we normally pay for machines that we expect to hang on and hand down for 4 years or more.

So how hard is it to attach printers that are connected via tcp/ip and shared out at on the SBS 2003 server to a Vista workstation?

On Vista you go, just like XP and go to add a printer...

And it's a network printer

Choose a printer from the ones that are connected to the domain (remember these only have 2k/XP and 2k3 drivers up there native)

It will notify you that it doesn't recognize the driver.  Click to install the driver.

UAC will prompt for an approval, click continue.

And it will install the printer... and run you through the wizard where it asks if you want to add it as the default printer.. and voila.  You have network attached printers with only native XP, 2000 and 2k3 drivers that work just fine via Vista.

So watching Mansfield Park on PBS tonight and doing some research on the web on the background of the movie I have found out that there appears to be a "religious war" of a sort on the Usenet mailing list of Austen-L mailing list on the virtues of "Fanny".  Apparently a 200 year old fictional character can bring about strong opinions this many years later.

It's always funny when there is an opinion, a strong opinion about something and it's taken over to the web.  One nic, two nic, brand of firewall, even including a quip in a newsgroup about 'nothing is going to secure windows.. at all', it seems that once the religious arguments begin the mind has closed down and no one is open to learn or listen.  Which is a shame really because there is much to learn from another opinion, another view, another new thing.  It is my strong opinion that one can learn something new if one has an open mind to do so.

The other interesting trait that I've seen lately is the "cheese" issue.  The next few months are a time where we all need to open our minds and be open to learn and to change.  When I see someone with what appears to be a closed mind towards a 'new thing', it's always amazing how much they are fighting change. 

http://en.wikipedia.org/wiki/Who_Moved_My_Cheese The book "who moved my cheese" is an excellent study of "If you do not change you can become extinct". 

Seemingly Vista brings out this cheese issue a lot.  "The infrastructure of Vista has changed a lot".  Folks, if you think the infrastructure of Vista has changed and you can't handle that, then I'd advise a bit more of an open mind if you start thinking about Ubuntu or Macintosh.  Because it's really different over there.

So if My documents in Vista is a stub file placeholder

And the real locations of documents is under Users

And the folders of

Local
Locallow
Roaming

Are freaking you out a bit...

A judicious planning for changing of cheese just might be wise...along with a reading of this document:

P.S. I do agree.. Fanny's hair was all wrong though... http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2008/01/26/DDR0UJP7D.DTL 

<cue Prince's song "1999">

So if you were concerned about not being able to run older applications on your Vista there's a few tricks that you have to learn... the first one is command line.  Yup, good old fashioned command line.  You know that DOS prompt stuff from years ago.

Try to install a vintage 2002 Lacerte from browsing to the mapped drive and installing it from there and you get an error:

BUT!  Drop to the command line and attempt to do the very same thing and you get a fully functional Lacerte (well granted there are things that have "broken" over the years even in XP... like online help is obviously non functional, but printing works perfectly).

I went back as far as I could and the year that doesn't like Vista and complains about a config.sys file is 1997 Lacerte (written for Windows 95).

I'll have to fire that one up in a XP and see how it runs, but bottom line I can go back as far at 1998 just merely by installing the programs from an administrator elevated command line.  I'll have to next see if I can do some config.sys file= changes and see if I can get even farther back on this Vista.  We actually have tax software back to the DOS years of 1986 and in those days to end the program you typed in END.  A couple of years back then had these funky 'pif' files as well.  In fact this machine may now have the most complete set of tax years yet as on the other XPs in the fleet, I've not taken the time to reinstall all of the old years until we needed them.

While it worked the best to run the command line install from the "Run as administrator" prompt, I found that I didn't need this registry key: 

Error message when you try to access a mapped drive that is mapped to a Windows XP-based computer from a Windows Vista-based computer: "System error 5 has occurred":
http://support.microsoft.com/default.aspx?scid=kb;en-us;947235&sd=rss&spid=11712

And this one was already in the system:

After you turn on User Account Control in Windows Vista, programs may be unable to access some network locations:
http://support.microsoft.com/kb/937624/en-us

Now why did I need a 1999 vintage Tax software besides memories of Prince and the Revolution's song "1999"?  Because while we certainly update software every year, there are times we have clients that come in that have not filed their tax returns in years.  This was an exercise to see how far back I could get old software to run on Vista.  So for all those who have accounting clients, or are an Accounting firm, old software does run on Vista.

P.S. http://www.newegg.com/Product/Product.aspx?Item=N82E16824009113 three matching 24 inch widescreen monitors are to die for on Vista.  Prince would approve.

P.P.S. Bill Whitson from Intuit posted this link -- http://www.lacertesoftware.com/pdf/2007InstallGuide.pdf

Then turn on Network Discovery in Vista

Networking section...turn on network discovery...

When running connectcomputer to join a Vista machine.. don't reuse an existing username and set up a new computer and expect it not to barf at the end.  I did my usual of setting up the computer and realized I was horking up the SBS install wizard in the process.

CAuthPage::GetUsersAndComputers() - ADsOpenObject( LDAP://SERVERNAME.DOMAIN.lan/DC=DOMAIN,DC=lan, Susanb, [PW] )
CAuthPage::GetUsersAndComputers() - ADsOpenObject( LDAP://SERVERNAME.DOMAIN.lan/DC=DOMAIN,DC=lan, Susanb, [PW] )
GetXMLNode() - DOMDocument::selectSingleNode( root/mapping[@user='susanb'] ) failed [1]
LoadMappingInfo() - find [root/mapping[@user='susanb']] failed, user not mapped
CWizard::PrepAutoLogon()
CWizard::PrepAutoLogon() - runonce key set

This ends up screwing up adding remote desktop and all sorts of weirdness.

The moral of this story is that remember to look in the log file and figure out what tripped you up.

The Official SBS Blog : Error When Trying To Approve Silverlight 1.0 Within Update Services:
http://blogs.technet.com/sbs/archive/2008/01/24/error-when-trying-to-approve-silverlight-1-0-within-update-services.aspx

Today's SBS blog post courtesy of Chris Puckett.  (and I have a better way to solve this.. don't install Silverlight :-)