THE OFFICIAL BLOG OF THE SBS DIVA

WSUS Product Team Blog : Microsoft Security Essentials anti-malware definitions now available via WSUS:
http://blogs.technet.com/wsus/archive/2010/03/31/microsoft-security-essentials-anti-malware-definitions-now-available-via-wsus.aspx

So if you were wondering about how Microsoft Security Essentials are now in WSUS...that's why.

Separating Pranks From Fraud on the Web - NYTimes.com:
http://www.nytimes.com/2010/04/01/technology/personaltech/01basics.html?partner=rss&emc=rss

Tomorrow (or today if you are in the AU) you will be bombarded with the April fool day jokes.  As that article points out, use tomorrow as your "Phish" test.  Can you spot which things are April fools and which ones are not?

Check yourself and ask yourself if what you are reading is too good to be true.

Online Security Center: Security alert - Phishing Alert for Intuit Small Business Customers-- digital certificate:
http://security.intuit.com/security-alert-3-8-2010.html

If you get an email supposedly from Intuit telling you you need to install a digital certificate in order to continue to run your Accounting software, don't install it. It's a phishing scam.

We saw some earlier last year and we're seeing emails floating around again this year.

Microsoft SMB Community Blog - By Eric Ligman : Announcing Microsoft VLSC 3.5 with “Add Open License” coming in April:
http://blogs.msdn.com/mssmallbiz/archive/2010/03/30/announcing-microsoft-vlsc-3-5-with-add-open-license-coming-in-april.aspx

In April some changes will come to the VLSC web site.

Good news.

https://www.microsoft.com/security/portal/RSS/UpdatesRSS.aspx

For those that use MSE at home and for those that use forefront at the office, a nice RSS feed if you want to keep an eye on what viruses are being updated/caught/stomped on.

APPLE-SA-2010-03-29-1 Security Update 2010-002 / Mac OS X v10.6.3:
http://isc.sans.org/diary.html?n&storyid=8521

Is there anything they DIDN'T UPDATE with that patch of 88 different issues?

No VSS writers are listed when you run vssadmin list writers on Windows Server 2008:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2009533

One to bookmark just in case.

Microsoft Security Bulletin Advance Notification for March 2010:
http://www.microsoft.com/technet/security/bulletin/ms10-mar.mspx

For those that attended the SMBItPros event in Sydney this is one of those "out of band" patching events I talked about.

Tomorrow there will be an out of band IE patch that will not be on the regular patch Tuesday event.  That means they are seeing risk of infection out there and releasing it early.

Be prepared to test fast and deploy fast to workstations.

Do not test and deploy to servers.  Why?  Because we don't surf on servers do we?

I see a lot of servers that don't have update rollup 3 installed.  What's that you ask?  It's the SBS specific update rollup that ensures you can attach Windows 7 machines to your network.

Description of Windows Small Business Server 2008 Update Rollup 3:
http://support.microsoft.com/kb/969121

The good news it fixes a lot of things.

The bad news is that I see a lot of servers that don't have that installed. 

Way one is to flip your server over to Microsoft update.

Way two is to go into the patching section of the Console and look for KB969121 and approve it.

Let me show you way three.

First go to the Microsoft update catalog -- http://catalog.update.microsoft.com/v7/site/Home.aspx

In the search box in the corner, enter 969121

You may be prompted for an ActiveX control.  Approve it.

Now see that KB969121 that showed up?

Click add

Now click on the basket icon at the top

Now you'll get a download icon

Find a place to stick the update and click continue

And the download will occur

Now that patch is in your location to be put on a usb flash drive and taken from computer to computer.

Windows Server General FAQ:
http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/be9029ec-67d1-4980-a380-076741394b86
Windows Server Forum FAQ:
http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/98a013c7-57c5-4e15-b795-35e3dc8b6896

Two forum posts of interest when working with Server 2008.

#SMBITPRO - Twitter Search:
http://twitter.com/search?q=%23SMBITPRO

So you missed out on the Security and Optimization day at the Sydney SMBiT Pros?

Well don't miss out on the next one in May on Backup and Disaster Recovery...

http://www.smbitpro.com.au/

Welcome to the registration site for the SMB IT Professionals Sydney Backup++ workshop. Here you'll find information about a 2 day workshop for IT Professionals that focuses on Backup and Disaster recovery. However, you'll also find that it includes many additional topics that are relevant to IT Professionals including sessions on SharePoint, Group Policy and Windows Server.

The workshop will be held at North Ryde RSL Club, 33 Magdala Road North Ryde on Friday the 21st and Saturday the 22nd of May.

We are currently taking registrations for the workshop from both attendees and vendors who maybe interested in attending. You'll find all the information you require on this site that will also be updated regularly.

Had this issue today with a client -- his minimized windows wouldn't work anymore.  Found this on a forum which puts back into the registry the needed commands to fix the minimize function back up again.

And then went in search of where that script came from -- as I downloaded it first to look to see what it did before I ran it even though kellys korner is a reputable place... and found a whole bunch of tweaks on this page:  http://www.kellys-korner-xp.com/xp_tweaks.htm

http://www.kellys-korner-xp.com/regs_edits/xp_taskbar_desktop_fixall.vbs

Message = Message & "This will not harm your system." & vbCR & vbCR
Message = Message & "Continue?"

X = MsgBox(Message, vbYesNo, "Notice")

If X = 6 Then

On Error Resume Next

WshShell.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StuckRects2\"
WshShell.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU\"
WshShell.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop\"

WshShell.RegDelete "HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}\BarSize"

P1 = "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"

WshShell.RegWrite p1 & "NoBandCustomize", 0, "REG_DWORD"
WshShell.RegWrite p1 & "NoMovingBands", 0, "REG_DWORD"
WshShell.RegWrite p1 & "NoCloseDragDropBands", 0, "REG_DWORD"
WshShell.RegWrite p1 & "NoSetTaskbar", 0, "REG_DWORD"
WshShell.RegWrite p1 & "NoToolbarsOnTaskbar", 0, "REG_DWORD"
WshShell.RegWrite p1 & "NoSaveSettings",0,"REG_DWORD"
WshShell.RegWrite p1 & "NoToolbarsOnTaskbar", 0, "REG_DWORD"
WshShell.RegWrite p1 & "NoSetTaskbar",0,"REG_DWORD"
WshShell.RegWrite p1 & "NoActiveDesktop",0,"REG_DWORD"
WshShell.RegWrite p1 & "ClassicShell",0,"REG_DWORD"

p1 = "HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"

WshShell.RegWrite p1 & "NoCloseDragDropBands", 0, "REG_DWORD"
WshShell.RegDelete p1 & "NoMovingBands"

p1 = "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell"

WshShell.RegWrite p1, "explorer.exe", "REG_SZ"

p1 = "HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}\"
WshShell.RegDelete p1 & "BarSize"
WshShell.RegWrite p1, "Media Band", "REG_SZ"

On Error Goto 0

For Each Process in GetObject("winmgmts:"). _
 ExecQuery ("select * from Win32_Process where name='explorer.exe'")
   Process.terminate(0)
Next

MsgBox "Finished." & vbcr & vbcr & "© Kelly Theriot and Doug Knox", 4096, "Done"

Else

MsgBox "No changes were made to your system." & vbcr & vbcr & "© Kelly Theriot and Doug Knox", 4096, "User Cancelled"

End If

The Official SBS Blog : Source Server Does Not Meet Minimum Requirements for Migration:
http://blogs.technet.com/sbs/archive/2010/03/26/source-server-does-not-meet-minimum-requirements-for-migration.aspx

The presentation from the guys from Trend at the Sydney SMBitpro workshop.

http://twitter.com/search?q=%23SMBITPRO

And good thing that our 4 p.m/5 p.m. pacific was right before the time that the Live meeting had a maintenance window of 6 p.m.

http://www.microsoft.com/communities/newsgroups/list/en-us/default.aspx?dg=microsoft.public.livemeeting&tid=9039fe93-a554-47a8-b5d9-de8e2ce4e9db&cat=&lang=&cr=&sloc=&p=1

I'm surprised that in this day and age of cloud services that this hasn't changed.  Good thing the cloud worked prior to 6 p.m. pacific. 

Lesson in cloud for tonight... check those maintenance windows (they did) and when the vendor assures you it will not be doing maintenance tonight, don't believe them.

Fortunately it was functional when we needed it.

Apparently there's a bunch of half naked people in Sydney....  This just in from Wayne Small at the SMBITPro Security day --

"Dana Epp just scared the pants off the room" in regards to securing remote TS gateway

#SMBITPRO - Twitter Search:
http://twitter.com/#search?q=%23SMBITPRO

If you are an ITpro in Sydney...why aren't you there?  If not follow the twitter feed and next time BE THERE!

If you ever get a stuck Win7/Vista or Server 2008 on installing patch 3 of 3 it may be a stuck pending.xml file...

1.  You need to delete this file - C:\windows\winsxs\pending.xml

2.  You need to run this command at a c:\ that is running with elevated credentials.

click on Start

Find the command prompt in the start menu

right mouse click on it

choose "Run as administrator"

In the resulting "elevated" command window then 
Type in the following commands:

takeown /f C:\Windows\winsxs\pending.xml

cacls C:\Windows\winsxs\pending.xml /G :F

Then delete the file

del C:\Windows\winsxs\pending.xml

Vista/Win7/Win2k8 all use the same patching process and this getting stuck on 3 of 3 is more often seen on Vista, less on Win7, sometimes on Win2k8.

 http://support.microsoft.com/default.aspx/kb/949104?p=1

Go there for the latest WU for 64bit:
http://download.windowsupdate.com/windowsupdate/redist/standalone/7.4.7600.226/windowsupdateagent30-x64.exe

If THAT doesn't work then look at the log files here:

1. Boot into Safe Mode with Networking and run System Files Checker (SFC):
Open command prompt as an administrator, then type in "SFC /SCANNOW" without quotes.

2. Run CheckSUR:
Run CheckSUR from the link below and collect the generated log:

"Description of the System Update Readiness Tool for Windows Vista, for Windows Server 2008, for Windows 7, and for Windows Server 2008 R2”
http://support.microsoft.com/kb/947821

If you are not able to find CheckSUR, please visit the link below:
http://catalog.update.microsoft.com/v7/site/Search.aspx?q=System%20Update%20Readiness%20Tool

The log files are:
%SYSTEMROOT%\Logs\CBS\CheckSUR.log
%SYSTEMROOT%\Logs\CBS\CheckSUR.persist.log

There is an annual Mini Cooper get together at this time of year - http://www.amviv.com/  that well this time of year is hard for me to take several days off and drive over to Las Vegas.

In honor of it, Karen and I are wearing badges on our cars that highlight the event... (www.whiteroofradio.com is a podcast on Mini Coopers)

In further honorance of the event, we got Elvis antenna balls.

However the folks at the office are questioning whether this really is a proper "Elvis" representation.

I think it's because it's missing the collar treatment.

(Doesn't everyone have antenna balls for unusual occasions?

RunAs Radio:
http://www.runasradio.com/default.aspx

Richard talks to Dave Sobel of Evolve Technologies about how small 
businesses can benefit from virtualization technology. The conversation 
ranges over migration to virtualization, how upgrades change with 
virtualization, the benefits to disaster recovery and more. 
Virtualization on the desktop is explored as well.


Dave Sobel is the founder and CEO of Evolve Technologies, a consulting 
firm that provides information technology (IT) and computer networking 
services to the small business, faith-based and nonprofit communities in 
Washington D.C., Maryland and Virginia. Evolve Technologies provides a 
wide array of services including server installation, virus protection, 
network security, backup services, and complete information technology 
outsourcing. The first Microsoft Small Business Specialist located in 
the Washington, D.C. area, Evolve Technologies is a Microsoft Certified 
Partner.

In 1996, Sobel founded Evolve Technologies, established a successful Web 
hosting facility and won a USA Today award for his reality-based Web 
site. The business expanded into consulting in 1997, and has grown to 
include a number of clients in the Washington D.C. Metro area.

In his role as CEO, Sobel holds overall management responsibilities for 
the company. With over ten years of experience in Internet services and 
consulting, Evolve Technologies is a flourishing IT management firm 
under Sobel’s experienced watch. As such, the business has earned 
several industry awards including the Microsoft Mid-Atlantic Region 
Partner Excellence Award for Customer Satisfaction for Second Quarter 
2007, the MSPmentor 100 and 250, as well as the ConnectWise Best New 
Idea Award for 2008.

Sobel’s consulting clients have spanned from Fortune 500 companies to 
local and regional operations, including such technologies as Web server 
management, database servers, security and software development.

Sobel has spoken at a wide variety of industry events including the 
Microsoft Worldwide Partner Conference, SMB Summit and SMB Nation. Sobel 
is also an active peer group member and faciliatator for Heartland 
Technology Groups (HTG), as a member of HTG5 and facilitator for UK and 
Ireland based HTG11.

He is often quoted in many technology-driven publications and maintains 
his own, popular blogs on business, Evolutionary Business Thoughts 
(www.evolvetech.com) and virtualization (www.smbvirtualization.net). In 
addition, Sobel published his first book, Virtualization. Defined: A 
Primer for the SMB Consultant, in 2008.

In 2010, Sobel’s dynamic voice within the IT community and efforts to 
promote active peer networks were recognized with the Microsoft Most 
Valued Professional (MVP) Award.

Prior to founding Evolve Technologies, Sobel worked as a Web architect 
for a consulting company doing security, network and infrastructure 
design for Fortune 1000 companies. Sobel holds a bachelor’s degree in 
Computer Science from the College of William and Mary.

http://www.runasradio.com/default.aspx?showNum=152

Richard and Greg talk to Robert Crane from the Computer Information Agency in Sydney Australia about Sharepoint 2010. The show digs into the issues that companies face when using Sharepoint without careful governance to manage their data well. Check out Microsoft's Sharepoint Governance Resource Center for more information.

RunAs Radio:
http://www.runasradio.com/default.aspx?showNum=151

Richard and Greg talk to Kevin Royalty about Home Server. Intended for the home, Microsoft's Home Server works great for small businesses with ten or less workstations, providing shared file services, an awesome backup solution and even remote access! Home Server offers a starting point before Small Business Server, but even after you've moved to SBS, you'll want to keep using Home Server for backup.