THE OFFICIAL BLOG OF THE SBS "DIVA"

KBs of interest for SBS 2008

bradley — Fri, 30 Jul 2010 04:53:00 GMT

SBS 2008 | Configure Server backup | The wizard cannot retrieve backup settings:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2001010

SBS2008: WSUS 3.0 Self-update is not working, getting Event ID 13042:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2000598

Slow Connectivity for Outlook Anywhere and Sites that use the SBS Web Applications App Pool:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2000859

System State backup using Windows Server Backup fails with error: System writer is not found in the backup:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2009272

Backups fails with VSS Event ID 12292 and 11 on Windows Server 2008 and Windows Server 2008 R2:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2009513

No VSS writers are listed when you run vssadmin list writers on Windows Server 2008:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2009533

SBS2008: No mail flow, Getting Event ID: 10003, Error: The type initializer for 'Microsoft.Mapi.ExRpcPerf' threw an exception:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2013890

RWW Returns Error "There is a problem in Remote Web Workplace. A logon error occurred: The data that the server returned is not valid..":
http://support.microsoft.com/default.aspx?scid=kb;en-us;2022997

SBS2008: Cannot browse OWA, Server Error in '/owa' Application:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2024306

Some old KBs in there but some I don't remember...

Remote Web Workplace connect to computer feature may be slow to redraw the screen:

bradley — Fri, 30 Jul 2010 04:48:00 GMT

Remote Web Workplace connect to computer feature may be slow to redraw the screen:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2011807

Adding that to the SBS 2008 build doc

Remote Web Workplace connect to client computer feature may display black bars:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2011825

We're screwed

bradley — Thu, 29 Jul 2010 19:53:00 GMT

It's the annual Blackhat event where you listen to presentations and my takeaway is "we're screwed".

I'm listening to the cloud security thread and my first takeaway is that we're pretty much plopping our premise server brainmindset up into the cloud and we are not reinventing the security we need. Especially in the SMB world. We need more identity management and PKI and in SMB we freak over how often BPOS passwords require you to change them (and as an aside that's adjustable -- all you need to do is open a trouble ticket and ask them to change that). We're looking to move our existing applications to the cloud and not designing them and building them for the cloud.

We keep hearing the headlines about how cheaper it is, how better it is and no one is asking us if we've pulled out a threat model and looked to what risks we're going to face and what changes we need to do.

Don't worry this excessive paranoia will wear off a bit and I'll go back to normal paranoia by next week. But for now I'm sharpening my Dixon Ticonderoga and will be using a No. 2 pencil rather than a computer until I feel safe again.

So I'm listening to the presentation by Tavis Ormandy and Julien Tinnes

bradley — Thu, 29 Jul 2010 19:20:00 GMT

So I'm listening to the presentation by Tavis Ormandy and Julien Tinnes and they are discussing kernel bugs and how the attack surface is growing in general and even in systems that have been designed with security in mind.

One thing I thought interesting was the fact that their deck has the google logo all over it.

The other interesting item to note was the number of kernel bugs still under investigation:

Remember that after the blow up over Tavis' release of a zero day done "on his free time" other security researchers jumped on the zero day band wagon... MSRC will fully disclose vulnerability information discovered in our free time, free from retaliation against us or any inferred employer."

http://news.softpedia.com/news/Upset-Security-Researchers-Start-Releasing-Microsoft-0Days-146251.shtml

Okay so I was giving Tavis the benefit of the doubt that he was doing this on "his free time", but not now. If this was truly on his free time, you'd not put your company logo on the slide deck. If you've ever seen a presentation of mine done in the SMB space I do not put my real firm's logo on that deck. This blog is on my free time and thusly speaking gigs I get as a result do not have my firm's logo on it.

So at least for those particular upcoming kernel bugs that he's pointing out there... dude...that is not on your personal time. You are google finding flaws in Windows and Linux kernels because Chrome's sandboxing depends more on the security of the kernel.

I got sucked in

bradley — Thu, 29 Jul 2010 05:16:00 GMT

I got sucked in.... no not to an iPad but to a Kindle.

http://www.amazon.com/gp/product/B003FSUDM4/ref=kinw_dp_gy

Amazon just dropped the prices down to a price tag that I can relate to (better than the iPad price tag for sure)

Don't want the 3g -- check out this price tag -- http://www.amazon.com/Kindle-Wireless-Reading-Display-Graphite/dp/B002Y27P3M/ref=amb_link_353169942_2?pf_rd_m=ATVPDKIKX0DER&pf_rd_s=center-10&pf_rd_r=17N2ZWYPY36CYE3T1F4Y&pf_rd_t=201&pf_rd_p=1270979502&pf_rd_i=B002FQJT3Q

Crypt32 8 events continuously reported on Windows Server 2003, Windows Server 2003 R2, or Windows XP:

bradley — Wed, 28 Jul 2010 06:06:00 GMT

Crypt32 8 events continuously reported on Windows Server 2003, Windows Server 2003 R2, or Windows XP:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2253680&sd=rss&spid=10394

Okay so ... I'm not sure I like the resolution to ignore or untick the update root cert solution. I've seen this on my servers that have no antivirus (ones that I just deployed), I've seen this on ones where the only firewall is the MS firewall so there's nothing third party on them.

So now what? Ignore and hang loose looks like still the best plan of action.

'Configure Internet Mail' wizard crashes on SBS 2008:

bradley — Mon, 26 Jul 2010 19:23:00 GMT

'Configure Internet Mail' wizard crashes on SBS 2008:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2020759

"This issue can occur if the Windows SBS Internet Send connector is not associated with the correct Hub Transport server"

Okay so I wonder who or what is doing that?

Do your checklists have similar info?

bradley — Mon, 26 Jul 2010 19:16:00 GMT

What's fascinating about these consulting engagement KBs is not really that MS is offering consulting engagements in the first place but that they give a framework of what to do and what Microsoft will do.

Check out the posts and see if YOUR checklists have the same info.

Microsoft Advisory Services Engagement Scenario - Windows Small Business Server 2008 – Migrating Exchange Data from SBS 2003:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2275538
Microsoft Advisory Services Engagement Scenario - Windows Small Business Server 2008 – Migrating Folder Redirected Shares from SBS 2003:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2275550
Microsoft Advisory Services Engagement Scenario - Windows Small Business Server 2008 – Hosting POP3/IMAP4 Clients:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2275616
Microsoft Advisory Services Engagement Scenario - Windows Small Business Server 2008 - Migrating SharePoint (CompanyWeb) Data from SBS 2003:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2275764
Microsoft Advisory Services Engagement Scenario - Windows Small Business Server 2008 – Migration Source Server Retirement and Environment Health Check:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2275779

SBS 2003 Performance Report indicates an automatic service is not running

bradley — Mon, 26 Jul 2010 19:13:00 GMT

SBS 2003 Performance Report indicates an automatic service is not running:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2290390

I have a better plan...don't install .net 4 at all on SBS 2003 or SBS 2008. It's not needed for a functional SBS network.

So ticking the box to refuse it/ignore it is the better plan.

Getting ready for betas

bradley — Mon, 26 Jul 2010 05:33:00 GMT

Getting ready for beta season means that you need to get your hardware ready to go.

The first up beta will be "Aurora" which is the new kid on the block. Think of a combo of Windows Home server, but supporting active directory, and then supporting hosted Exchange and hosted SharePoint.

As Exchange 2010 gets ...well... larger... Aurora will fit into those situations where installing Exchange 2010 and it's 8 gig minimum requirements just won't do for the small firms. Unlike SBS 2008 and SBS v7, Aurora includes client backup as well.

If you have not already invested in a virtualization platform, now is the time to do so. If you need help setting up a virtualization platform, don't forget the resources at smbvirtualization@yahoogroups.com .

How to get Vlad upset at you in one easy lesson:

bradley — Sun, 25 Jul 2010 21:30:00 GMT

Cause:

Recovering Disk Space on the C: Drive in Small Business Server 2008 - The Official SBS Blog - Site Home - TechNet Blogs:
http://blogs.technet.com/b/sbs/archive/2010/03/02/recovering-disk-space-on-the-c-drive-in-small-business-server-2008.aspx

Effect:

Vlad Mazek – Vladville Blog » Blog Archive » This is why your email is getting delayed..:
http://www.vladville.com/2010/07/this-is-why-your-email-is-getting-delayed.html

If you want to get Vlad mad at you, continue letting WSUS eat up all of your drive space on your C drive. However if you want to keep him happy (and planning for Vlad v3) do me a favor and SHUT THE IIS WSUS LOGGING OFF!

..stupid grumble grumble not even yet flagged by the sbsbpa stupid grumble grumble rant rant...

(thank you)

One HDMI cable later

bradley — Sun, 25 Jul 2010 06:49:00 GMT

It is rocket science these days to put together a TV/Amp combo. It's no wonder that BestBuy and their kind have TV installers.

I finally go the pieces in the right place but similar to how the COA stickers on PCs are so small that you can't tell what the numbers are, trying to figure out exactly what composite video cables go where.. and at some point in time you just plug without reading and go with your gut of what should go where.

This time we were setting up the TV/dvd/stereo in the upstairs of the house. Everything is working but I need to redo the cables with 3 meter cables rather than the longer 6 foot that I have as I have cables stuck in the back all over the place.

We're redoing the TVs and now using HDMI cable connections which make for a nicer clearer picture. When even Home Depot is selling cat6 cables and what not, you can tell technology for the home is now "normal".

I think setting up a computer is easier than wiring a TV/Cable/Amp.

How to diagnose "Operating system supported for edition" pre-requisite errors while installing SQL 2008 Standard Edition for Small Business

bradley — Sat, 24 Jul 2010 03:40:00 GMT

How to diagnose "Operating system supported for edition" pre-requisite errors while installing SQL 2008 Standard Edition for Small Business - The Official SBS Blog - Site Home - TechNet Blogs:
http://blogs.technet.com/b/sbs/archive/2010/07/21/how-to-diagnose-quot-operating-system-supported-for-edition-quot-pre-requisite-errors-while-installing-sql-2008-standard-edition-for-small-business.aspx

I've seen this a couple of times in migration where the SQL doesn't think it's being installed in a SBS network.

Take one wireless printer

bradley — Fri, 23 Jul 2010 05:56:00 GMT

Take one wireless printer - http://www.brother-usa.com/printer/modeldetail.aspx?PRODUCTID=hl2170W

Set it up on the wireless network..... through a very interesting wireless process where you first hook it up via adhoc and then associate it with the wireless access point.

Then you buy a printing app for the iPad and iPhone.... http://www.macworld.com/appguide/article.html?article=150937 and now one can print wirelessly from the laptops, from the iPhones and from the iPad.

How geeky is that?

Failed extract of third-party root list from auto update cab (solution)

bradley — Thu, 22 Jul 2010 19:31:00 GMT

Failed extract of third-party root list from auto update cab
http://msmvps.com/blogs/bradley/archive/2010/07/21/1773669.aspx

Follow up from that post

Failed extract of third-party root list from auto update cab:
http://social.microsoft.com/Forums/en-US/partnerwinserversbs/thread/84ba0e65-ae99-4b68-9268-321069dde942

Hi Susan,

Thank you for posting!

I also noticed this event error logged on my servers, and have consulted the Dev team. This error has no impact to functionality and no troubleshooting is needed.

Here is the information from the Dev team:

The event log error indicates that the signing certificate for the CTL (certificate trust list) has expired. This was likely caused by the following issue:

The signing certificate for the automatic root update CTL expired on 7/9. We re-signed the CTL with a renewed certificate and published it on Windows Update on 7/7. A valid CTL was available on WU before the signing certificate expired.

However, for any machine that had the older CTL cached, CAPI will first try to use the cached CTL which would result in the error you are seeing. Since the cached CTL does not have a time valid signature, CAPI will retrieve the CTL from WU and obtain the valid CTL. As a result, certificate validation will not be affected but you will see the error being logged due to the cached CTL with an expired signing certificate. Once the updated CTL is retrieved from WU, you will not see this error and no further action will be required for resolving this.

Thanks!

Best regards,

Tony Ma
Partner Online Technical Community
-----------------------------------------------------------------------------------------
We hope you get value from our new forums platform! Tell us what you think:
http://social.microsoft.com/Forums/en-US/partnerfdbk/threads
------------------------------------------------------------------------------------------
This posting is provided "AS IS" with no warranties, and confers no rights

Task scheduler failed to start “\User_Feed_Synchronization

bradley — Wed, 21 Jul 2010 19:59:00 GMT

Added to the "my brain is getting old and I can't remember all this stuff" document is the tip from Yves Gourle about fixing an alert you might see for

Task scheduler failed to start “\User_Feed_Synchronization-{guid}” task for user “<DOMAIN>\user”

Small Business Server 2008 - Build document - TechNet Articles - Home - TechNet Wiki:
http://social.technet.microsoft.com/wiki/contents/articles/small-business-server-2008-build-document.aspx

TWEAKS FOR REMOVING RSS FEED SYNC

Since a server is probably not syncing RSS feeds, there's a task that runs in the background that is not needed on the server. In some cases you may see an alert in the event logs that indicate that the rss sync has not completed. While it can be ignored, you can also adjust the rss feed sync to not occur. This tip is courtesy of Yves Gourle:

You can disable the automatic feed sync as follows:

Run the following command (with a command prompt started with elevated rights) : msfeedssync disable
Or in IE options go to content -feeds and web slices, click on settings and uncheck “automatically check for feeds”

Update for Windows SBS 2008 Migration Preparation Tool (KB981802)

bradley — Wed, 21 Jul 2010 06:05:00 GMT

Critical and Security Updates

Update for Windows SBS 2008 Migration Preparation Tool (KB981802)
This software update adds source server health scanner to Windows SBS 2008 Migration Preparation Tool. This update is highly recommended for all Windows SBS 2008 Migration Preparation Tool users.

To all the WSUS admins out there that are wondering what the heck they have a SBS migration category in WSUS now... sorry... why WSUS has to have a category for a tool that is only used during migration is beyond me.

It adds checks for DNS issues and what not during the migration process.

Google Online Security Blog: Rebooting Responsible Disclosure: a focus on protecting end users:

bradley — Wed, 21 Jul 2010 01:22:00 GMT

Google Online Security Blog: Rebooting Responsible Disclosure: a focus on protecting end users:
http://googleonlinesecurity.blogspot.com/2010/07/rebooting-responsible-disclosure-focus.html

If the .net team told me it would take 150 days to build a .net security update that was GUARANTEED not to blow up a computer and need the Aaron Stebner .net rip out tool, I'd say.. fine. Take 150 days. Take more if it means that you'll permanently fix all .net install issues.

60 days sounds reasonable... until you hit an issue where it's not.

Google is trying to take the high road here when they were the one that started the argument in the first place... or rather Tavis did with his release.

Fast fixes don't always mean quality updates. Let's REALLY focus on end users here and protect them from lousy updates as much as we do from security issues. For a signficant group of users out here that are not specifically targeted in attacks, the risk of updates (.NET for example) is more than the risk of the security vulnerability. Rushing out a patch to ensure it meets the 60 day window... man I'm not sure this will make this process better.

Let's really focus on protecting the users okay? Both on the security issue and the release of the updates. Let's not overlook the risk of the patch is sometimes as much as the risk of the vulnerability.

SMB related videos from WPC

bradley — Wed, 21 Jul 2010 00:45:00 GMT

Extending your business - the cloud opportunity for resellers
http://digitalwpc.com/Videos/AllVideos/Permalink/c3b31d9f-7b4d-40de-a1ed-94de7c80e0dd

BPOS presentation at WPC
http://digitalwpc.com/Videos/AllVideos/Permalink/91f1c4ab-cb8c-4fbb-b8be-4157897049f8

Infrastructure for a New World of Work – Next Generation Solutions for the SMB Space
http://digitalwpc.com/Videos/AllVideos/Permalink/6518d734-aa5f-4061-bb57-86ddd3e420d0

Making your console go boom

bradley — Tue, 20 Jul 2010 05:06:00 GMT

When you have a line of business app and they tell you to change

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Enable64Bit... don't.

The default value for this key is 1, but in the blog post linked below it was 0, forcing framework applications to run in a 32-bit environment.

http://blogs.technet.com/b/sbs/archive/2010/07/19/case-in-the-corner-series-x64-framework-not-working.aspx

Now this isn't the app I'm thinking of.. but I've seen some blog post somewhere telling people to set that Enable64bit to 0.. and you really don't want to do that as it will make your Console go boom.

http://www-01.ibm.com/support/docview.wss?uid=swg21398266