THE OFFICIAL BLOG OF THE SBS "DIVA" : Best Practices

How many reboots should a server do?

bradley — Wed, 02 Apr 2008 01:50:00 GMT

In the partner SBSC newsgroup, one of the guys asked if it was normal for a SBS server to be rebooted nightly. He didn't think so, but the consultant that came before him had set up a nightly reboot . (Needless to say it was causing issues with Exchange complaining about not be shut down properly).

He said that coming from an Enterprise background that he was NOT used to rebooting servers nightly and in fact the Enterprise servers he was used to many times went months without rebooting.

First off the general rule of thumb for ANY server, whether Enterprise or Small Business is that they really and truly only need to be rebooted if a Security patch demands it. In a SBS network, due to the fact that we have a fair number of applications on our server, the chances are good that every second Tuesday of every month (that's Patch Tuesday) there will be at least one patch offered to a SBS box that needs a reboot. If a patch needs to reboot, you need to reboot. The reason for this is that dlls in use may not be updated until a reboot is complete, so you may not be fully protected if you merely install the update and don't reboot. Also a mismatch of dlls may leave the server to do weird things (event logs wackoness) that doesn't clear up until a reboot.

Rule one: if the patch wants a reboot, reboot the server.

That doesn't mean necessarily you HAVE to reboot if you don't apply the patch in question. Case in point, I have not updated my server for the post sp2, kill off RSS/TOE Advanced networking crud of SP2 because I already followed the guidance in www.sbsbpa.com and shut it off in the registry. That patch demands a reboot. Since I don't NEED to install that patch, since it's not a SECURITY patch, I'm now with a two month uptime because I didn't install any patches in March on the server that demanded a reboot. Then I also decide WHEN to patch. My goal, my job is to buy time. If I'm having to run to the server at noon on Patch Tuesday screaming "Patch now, we're rebooting the server because we're sooo at risk we're screwed", I haven't done my job of risk management. All patches ultimately get installed. I just determine the best time to install them.

Rule two: Just because a patch is offered, doesn't mean you HAVE to install it right then and there.

If your prior consultant is staging a nightly reboot of the server, go fire that consultant. He or she is probably doing that for several reasons:

There's a sucky line of business application on that server sucking up memory and the App developer, nor the consultant hasn't a clue how to tune memory to work on a server.
There's a SQL instance on that box sucking up all memory and the consultant hasn't googled for "Allocated memory alert" and hit my umpteen blog posts on how to fix this.
He or she sees how Exchange uses up all free memory and doesn't realize that it releases it to other apps when needed.

Rule three: There is no reason that makes any logical sense to reboot a box nightly.

Let me restate that for the folks in the back of the blogosphere reading all of those dumb April fools jokes today:

There is no reason to reboot a box nightly. If your consultant is saying this is a best practice he or she does, that is one of the worst best practices in my book, short of running the server with no firewall and all ports open. If they are doing this they are probably doing so to mask a problem that they haven't fixed. If they are doing this because it fixes something else, go fix the something else first.

Rule four: Fix the real issue, don't use rebooting as a bandaid.

We sometimes have a problem where servers don't reboot AFTER a patch as the Remote Desktop Protocol doesn't come back as it should (see Handy Andy's blog for his recent discussion on this issue). Thus to stage a nightly reboot like this is putting a lot of risk of loss of access to that server. It's not normal for servers to BSOD (blue screen of death), it's normally a driver issue, it's not normal for servers to demand a reboot each night, and while it's not normal to lose Remote Desktop access to the server, it can happen to be prepared.

Rule five: Rebooting may impact remote access, if you plan for an alternative strategy to get that server back to full remote access, you will save yourself a lot of unplanned trips to the office.

SBSized Windows 2003 sp2 release notes

bradley — Mon, 19 Mar 2007 03:08:00 GMT

Okay so you've read the REAL Windows 2003 sp2 release notes right? If not, do that and then come back.

If you want to know what’s in Win2k3 sp2, the Windows Server blog points to the highlights - http://blogs.technet.com/windowsserver/archive/2007/03/13/sp2-goes-live.aspx

(edit) Please note that SP2 is fully and utterly supported on SBS 2003 sp1.

Before we begin to install SP2 I want you to do a few steps.

Consider (okay.. how about DO) install this in a VMware or any other server than a client’s production box first. Get a feel for this process. In the era of free Virtual PC the argument that we don’t have test boxes won’t fly anymore. Go build one with Action pack software and leave the 30 day clock running. Use that to test.
Ensure you have a good backup.. a tested backup.
Disable third party services (not just stop the services, turn them to disabled)
Do an additional ... an Oferized backup... of just the SystemState just to be sure. (To Ofer means to ensure your clients and you are ready for anything. Ofer has best practices down to a fine art.)
Consider rebooting the box BEFORE the service pack is applied to know that you have a good solid boot. (Okay so Ofer would say just do it)
Scan the event logs before you start the process to get a feel for the pulse of a "normal" SBS box
Ensure you have enough room to install the SP2 - http://msmvps.com/blogs/bradley/archive/2007/03/15/how-much-space-is-needed-for-win2k3-sp2.aspx

On the ActiveDir listserve (where I suck at lurking), I jokingly call the SBS server the "Kitchen Sink server" because of all the services we have running and because of that we have some errors in the log files that are normal. I call this tripping on our toes. And this tripping might get a smidge enhanced with the application of a service pack on an underpowered box.

Some of the events that I get in a vmware SBS are like this

Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 5603
Date:  11/4/2006
Time:  6:01:50 PM
User:  NT AUTHORITY\SYSTEM
Computer: SERVERTEST
Description:
A provider, PerfProv, has been registered in the WMI namespace, ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

So when I see the SAME error message AFTER the application of the Service pack I know that the service pack is not the thing that caused this and it working fine before and should be fine afterwards.

Like on this VMware system right after each reboot I'll always get this:

Event Type: Error
Event Source: Windows SharePoint Services 2.0
Event Category: None
Event ID: 1000
Date:  3/17/2007
Time:  1:42:28 PM
User:  N/A
Computer: SERVERTEST
Description:
#50070: Unable to connect to the database STS_Config on SERVERTEST\SharePoint. Check the database connection information and make sure that the database server is running.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

But Sharepoint is working just fine. All this is is a timing issue of the websites loading up and my server is actually running just fine. Thus rule one.. don't panic.

So without further ado, here are the SBSized Windows 2003 Sp2 release notes:

1. Reboot a second time after the application of SP2:

We've seen a couple of boxes whose web sites got stuck or needed a manual restart after the application of this service pack. Don't panic on first reboot. Reboot a second time. THEN scan the event logs and start debugging if things don't look right, but don't use that first boot process to be your determination of how well the SP install went.

2. When using the SBS 2003 R2 interface to approve SP2 the .Net will throw off an error.

No biggie. It’s just a .Net weirdness due to two hyperlinks for the one service pack. Just click on continue and it doesn’t hurt a thing.

As Roger is apt to say in such occasions, “Continue on, these are not the droids you were looking for” and keep going.

3. You may see an event in the log files right after that first reboot like this:

Event Type: Error
Event Source: dsrestor
Event Category: None
Event ID: 1005
Date:  3/17/2007
Time:  1:41:21 PM
User:  N/A
Computer: SERVERTEST
Description:
The DSRestore Filter failed to connect to local SAM server. Error returned is <id:997>.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

If the error persists, follow http://support.microsoft.com/default.aspx?scid=kb;en-us;322672

4. Help and support is missing

Several folks in the newsgroup have reported this and we saw it during SP1. If you find this happening, fix it like this:

Suggestion 1. Reinstall Help and Support service.

1. From a command prompt go to the "C:\Windows\pchealth\helpctr\binaries" folder by typing: CD \windows\pchealth\helpctr\binaries

2. Run the following commands one by one:

Start /w helpsvc /svchost netsvcs /regserver /install
net start helpsvc

Suggestion 2. Reinstall Help and Support.

1. Open Windows Explorer.
2. Go to C:\Windows\inf folder.
3. Right click pchealth.inf and click Install.
4. If the system prompts for installation CD, please insert installation CD
5. If the system prompts for SP1 installation CD, you have to manually create a slipstream installation CD
Universal Windows Slipstreaming and Bootable CD Guide http://www.msfn.org/articles.php?action=show&showarticle=49

Suggestion 3. Use SFC to check system protected files.

If the problem persists, please use SFC command to check whether there's any corrupted system protected file.

1. Click Start and click Run.
2. Key in "SFC /scannot", then click OK.
3. The system will automatically scan the protected files.
4. Wait for the wizard to complete.
You may also need to insert the slipstream installation CD 1.

5. If you have not updated ISA to the 2004 version and 2000 is still installed you will see VPN failing

Resolution - install ISA 2004 or follow the registry edit in http://support.microsoft.com/default.aspx?scid=kb;en-us;897651

Specifically do this:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IpNat\Parameters

You must set this value as follows:

Value name: DisableBootTimeSecurity
Value type: REG_DWORD
Value data: 1

6. If ISA 2004 does not include all the sp2 post hotfixes you may see symptoms of Outlook not connecting but OWA works great.

The issue is that RPC is being blocked and thus ensure you have the post hotfixes like:

http://support.microsoft.com/default.aspx?scid=kb;en-us;916106 and http://support.microsoft.com/default.aspx?scid=kb;en-us;897716 and http://support.microsoft.com/default.aspx?scid=kb;en-us;930414

Some have reported that following this has fixed the issue: http://msmvps.com/blogs/bradley/archive/2006/03/11/86066.aspx
I actually did that setting in my network as some of my internal management stuff wasn't working with RPC being blocked.

7. Broadcom and their offloading stuff are biting us in the butt again (have we said that we hate Broadcom nics again?)

Remember why we hate Broadcom nics? Did you forget? If you did, review this: http://msmvps.com/blogs/bradley/archive/2007/01/04/the-following-network-cards-are-evil.aspx (Nick says all TOE enabled nics will prob need these edits)

But it looks like that due to the fact that SP2 includes Scalable networking pack, the Checksum offloading stuff and Receive Side Scaling might be causing some issues and the symptoms you will see is slow file copies, problems accessing web sites and DHCP issues where your workstations won't pick up an IP address, Secure NAT and VPN issues especially with Premium boxes. To disable this do the following:

To disable checksum offloading:

From the registry you can do:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

Click Edit, point to New, and then click DWORD Value.

Type DisableTaskOffload as the entry name, and then press ENTER.

Right-click DisableTaskOffload, and then click Modify.

In the Value data box, type a value of 1 , and then click OK.

(edit) Disable RSS (and no we're not talking about disabling Newsgator here) but Receive side scaling - more of that Scalable networking stuff - impacting SecureNat

http://support.microsoft.com/kb/912222/en-us

1. Click Start, click Run, type regedit , and then click OK.
2. Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
3. On the Edit menu, point to New, click DWORD Value, and then type EnableRSS .
4. Double-click EnableRSS, type 0 , and then click OK.

8. IE 7 install causing the very first reboot to “hang”

(I personally saw this on my test VMware SBS box when I chose to install BOTH IE7 and Win2k3 sp2 at the same time)

I am hoping that in June when this patch gets auto installed if you have AU enabled that it will be a slow patch month, as I personally saw in a test situation that installing two big patches at the same time meant that when the box rebooted, it got stuck finishing up the IE 7 install. I had to hit control-alt-delete and get into the task manager and “kill” the configure settings task and then force a reboot. Once I did that the box was fine.

Only install SP2 all by itself. Don’t choose a bunch of patches at the same time. You want to only see the impact from THIS service pack when you patch.

9. Normal patch day weirdness rules apply

Just like in a normal patch Tuesday, the normal catroot corruptions and weirdness may apply. We’ve gotten a few reports that installs via MU and WSUS failed to complete indicating an error in the install and when the system came back online, this was reported:

After the forced reboot, the logon screen gives me a warning about not being able to determine the configuration and having to roll back to last known good.

Check your log files (windowsupdate.log and svcpack.log) for hints but also check out this KB http://support.microsoft.com/kb/822798 and consider dumping the catroot folder or the softwaredistribution folder.

For the Softwaredistribution folder, stop the Update services, delete the folder, rescan Microsoft Update and try again.

For catroot weirdness,
Stop crypto services
rename \windows\system32\catroot2
Create a blank catroot2 folder
Start crypto services
try again...

10. If the install fails check your log files

If the install fails, click on start, then run, then windowsupdate.log. In the notepad that loads up, scroll to the bottom and read from the bottom up and review the messages. Look for the svcpack.log file in the c:\windows folder and review that. Issues with a service pack are a free call to support but you may find the answer to the issues in those log files. Remember Microsoft Partners have "Server down" support and Managed newsgroups and SBSC newsgroups. So you have lots of resources in addition to the public newsgroups.

Last but not least, relax.

All of the issues listed above were seen with Windows 2003 sp1. There’s nothing new here. Nothing unusual, just our typical “crusty boxes” that may need a bit of tender loving care. The Windows server blog indicates that this service pack will come down on Win2k3 sp1 boxes on the June patch day. So before then will you promise me that you will evaluate your stance on this patch and be ready for it. If you don’t want it auto installed, then don’t. If you do want it auto installed, then be ready. If you are using R2’s WSUS you’ll know that it’s sitting up there for your approval when YOU want it.

http://blogs.technet.com/windowsserver/archive/2007/03/14/sp2-buzz.aspx

But bottom line, don't panic. SP2 is not throwing off any unusual weirdness. So far everything we're seeing we saw before with SP1.

We just have that many more "crusty" boxes is all. (and more with ISA 2004)

(edits) 3/19 - Added line to indicate that Win2k3 sp2 is fully supported on SBS 2003 sp1 (unlike the Win2k3 sp1 era you won't see us yelling to not install it)
3/19 - Added line to indicate that Receive Side Scaling may need to be disabled

If you are into Group Policy... you MUST have this

bradley — Sat, 26 Aug 2006 05:33:00 GMT

http://www.microsoft.com/downloads/details.aspx?FamilyID=7812c9cb-e6ca-4144-98ab-2d78587462c5&DisplayLang=en

This is the combination between beancounter bliss and geek control thrill. An Excel spreadsheet of the Group policy settings for Vista.

Check it out... some very cool stuff....

IIS never remove.. repeat after me... IIS never remove

bradley — Mon, 22 May 2006 06:25:00 GMT

Was doing gardening this weekend and was listing to the podcast from the SBS gang on the "evil" pop connector and the "never remove IIS" part of the podcast reminded me of a blog post I have that is about as narly as you can get...but IIS is still not uninstalled...

This blog post... see all the stuff that's done but not once does anyone say uninstall and reinstall IIS?

And if you hear the podcast gang say "backup that Metabase" ..what they mean is this:

http://support.microsoft.com/?id=324277

Just do yourself a favor and do that before messing with your SBS web sites...

P.S. backing up the metabase before you muck in those web sites... that "is" a best practice if you haven't figured that out...

(and yes the normal SBS backup grabs this as part of it's system state stuff and all that...remember this is a fyi to do this 'before' you start mucking around to make it easier to put things back how you found them)

Okay so THAT's not a best practice anymore

bradley — Mon, 22 May 2006 06:09:00 GMT

The phrase "best practice" is like fingernails on a chalkboard to me sometimes.. why? Because it's like an excuse to shut the brain off and not think.

Take for example.. this nugget of a 'best practice':

http://www.sbslinks.com/SBS_45tips.htm

+ Single partition with SBS on a drive larger than 6G not recommended.

If you are concerned that you wanted the entire drive as 14G, you don't. If you think a single partition makes more sense, it doesn't. Separating the system drive into separate partitions from the user data drives is much smarter. It solves technical and planning problems down the line.

Uh huh...blast from the SBS 4.5 era of what the 'best practice' was then. And is that 6 gig a 'best practice' now? Oh my goodness no. The other day in one of the Activedir.org threads Brian said his normal C partition was 15 gigs.. and I had to adjust my brain from SBS view of the best practices to 'big server view' where each separate server did a unique role.

...it's funny isn't it.. now days 14 gigs for a C drive is way too small.

Well this is how my Friday morning started out....

bradley — Sat, 29 Apr 2006 00:26:00 GMT

...and being the geek that I am.. took a photo of my car and the other car with my Windows Mobile 3 Cell phone....long story short... she pulled out nose first right into traffic... I couldn't avoid/stop fast enough.

But the minor impact reminded me of ... what else.. geek that I am ... of disaster recovery...

Lessons learned today

Have your documentation in one place for your software, hardware, know what systems you have, serial numbers, etc. -- when you are ever so slightly a bit scattered after the event... you'll probably be a smidge flustered... ensure that you keep key information in a spot that you know where that is, in the case of the car accident, that's License, registration, insurance, etc.
Ensure that there is someone less flustered on hand to help you through the disaster -- no matter how old you are.. I still called Dad when the event occurred (he lives not that far away) and he had the presence of mind to remind me that I carry with me a cell phone that has a camera. Great for documenting in just these situations.

Now what this event can't do for disaster.. but I've heard Brian Desmond talk about before.. is make sure you test your DR processes.. because when the real disaster occurs you will be slightly flustered. So make sure you've tested restoring a server and make notes along the way. These days with VPC/VMware/Vserver being free, there's no reason not to fire up and do a test restore. Sometimes you have to see the screens to understand what is going on.

So do a little planning.. because when the real DR hits... don't be like me and flustered on a Friday morning...

P.S.... damage is only the bumper and the headlight.. on the personal front, a little soreness on the right side from tensing, turning the wheel trying to avoid the car....but fortunately no whiplash...

Prove it....

bradley — Mon, 03 Apr 2006 19:24:00 GMT

To the IT pros of the world.. if you are recommending a disaster plan to a small firm.. can you do me a favor and test it out in a testbed first (and now with Virtual server being free you have no excuse)

See if you guys see any problems with this plan....

Facts:

CPA Firm
Nearly three year old hardware - SBS 2000 server - Raid 5 config - SCSI
Lost two drives already
IT firm is recommending a second server, entry level Dell with Windows 2003 R2 standard edition with a twice daily sync to minimize down time
They say that if the main SBS 2000 goes down... "all that needs to be done is change the login scripts" and the firm will be back in business within 10 to 15 minutes

Okay class... how many problems do we see with this?

First off... no one has pointed them to the MPAN program where they could sign up for the Action Pack and get them up to SBS 2003.

Next.. at about three years.. I start looking at that hardware and start to move it to a secondary position.....so I'd probably recommend a new server and move this existing server to a secondary role

Next... "all that needs to be done is login scripts"? Uh... what about Exchange? Your drive mappings? The fact that you are joined to the domain controller that isn't there? If you are on XPs.. the DNS settings? Does anyone else besides me see issues with this plan?

So I'd say to that IT firm... prove it....

Building a box

bradley — Wed, 15 Feb 2006 20:12:00 GMT

Well it's beta season which means I have to decide which beta gets a real phyiscal box and which one gets a virtual one. While setting up virtual machines is getting easier and easier, I still sometimes like the old fashioned, real, physical box to test with.

My normal way of building a box is to do like many others... install disk one...leaving plenty of room for that operating system. Now I'm still partitioning off server drives, but normally for workstations, I make the whole thing one drive. I then stop after the SBS disk 1, ensure I've partitioned off the rest of the disks like I like them and then I finish the standard install. I then stop, run the Connect to Internet Wizard... ensure that Sharepoint is functional before progressing to the Premium install. Then I lift up Sharepoint to SQL and instlal ISA. But I make sure that standard is good and solid before adding any third party stuff, line of business apps, antivirus, you name it.

Remind me I need to get a KVM switch as right now I have keyboards all over the place.

You might also want to check out Daemon tools (if you install version 4 of the tools ensure you unselect the adware) and "Virtual CD-ROM Control Panel for Windows XP" as two tools to make mounting ISO's and using them to easily install especially in virtual settings.

So? Have you played with VMware? VPC? Virtual Server?

The thing we need to do more of

bradley — Mon, 16 Jan 2006 20:36:00 GMT

Flatten.

You heard me. We need to flatten the boxes we get from the OEMs and rebuild them as we see fit. Without the junk. The add ons. The third party crud. We also need to purchase the right boxes. Yeah... it's hard as a VAR/VAP to argue with the cheap OEM special but they are introducing too much risk in our firms... even our small ones.

SANS today has on their front page a discussion about deploying...and most of them flatten them and get them to a known state.

And look what we do around here. We get OEM images that have stuff all over the place and have ....typically no restore disk [it's hiding in a partition and you have to build your own] when you buy the cheap machines. I've bought business machines and you 'can' ensure that you get real media and not 'restore everything back to it's annoying state' restore media.

But it's hard to talk a client into taking a nice new box and destroying it, isn't it?

[and I don't mean that you necessarily buy new licenses ...but that you ensure you get that OEM media WITHOUT the crud and install from that]

The Screwdriver versus the Forbes Magazine Subscriber

bradley — Fri, 16 Dec 2005 03:25:37 GMT

This Christmas, I want you to buy yourself a present. A book. Now before you start reading this book, I want you to take this book and flip to the ending. Don't worry you won't wreck the storyline. I want you to start at page 287 under the section of "Goals" and take a test. It will be a quick test. Now that you've taken it, I want you to start over at page one and read the stories there.

Now ...hang on..before you start reading... I want you to visualize the image of a screwdriver and a Forbes magazine.

Got that visualization?

Now as you read this book, I want you to ask yourself ...if you are a screwdriver or a Forbes Magazine Subscriber. Time and time again at SMBNation I heard this from a lot of the VAR/VAPs. They had the "screwdriver" stuff down. What they didn't have was the stuff in the "Forbes Magazine" side. The business track.

Now mind you, all of these people who said this you would have proabably thought were quite successful already. But to get to that next level they had to take stock and figure out their weaknesses and their strengths.

I've seen this before in business books where the point is made that to grow from the 'Screwdriver" to the "Forbes Magazine Subscriber" that you have to put down the screwdriver. That you have to let go. That we end up hurting ourselves when we try to do both. Now I'll be honest with you, when I got to that part of the book, I stopped and thought to myself...but wait... do we have to make a choice? Why do I have to choose between a Business Networking Meeting and a User Group meeting [especially if it's a SBS meeting that has a lot more peer business sharing?] Shouldn't I, if I am going to be a good "Business consultant" to talk about ROI to the small business owner, should I have at least a small bit of a screwdriver to make sure that when I discuss technology options to a client that I know what I'm recommending actually works? That I can speak just a little bit from the "been there, done that" side?

Throughout the book, keep that in mind, and ask yourself... where are your strengths? Where are you stuck at? Where do you want to be?

Do you agree that there has to be a choice between a screwdriver and a Forbes magazine?

Go read the book, called "Making it big in Small Business in 2006", and for the record, no I'm not getting any royalities out of this blog post as a result. But I think, as we end 2005, and start 2006, I think that you should make a present to yourself to take stock of where you are at and where you want to be.

.... and while you are taking stock.....start with page 287.

The end of the year

bradley — Sat, 10 Dec 2005 01:11:00 GMT

The end of the year means a beginning of a new one... and for those of you running your businesses, this time of year should be when you start looking at your records and expenses in a new light.

For in America, if your business year end is December, it's time to start seeing where you are at, and seeing if you need to buy things to get a deduction. There's a concept called 'ordinary and necessary' business expense. So all of those books, the DSL connection, all of those supplies are ordinary and necessary to your business. Your phone is an expense as well... and hopefully by now it's one of those uber geeky phones so it's marketing as well as a business tool.

The expenses related to you going to SMBnation.com is a deduction. Any books you bought there are an expense. And of course, something we call Section 179 which is where we can immediately deduct the cost of equipment as long as it doesn't exceed certain boundaries.

All of this advice and comment is freely given and is not meant to be a replacement for advice and council of going to a tax professional. Because if you did, you just might get more information and advice about setting up retirement and benefit plans and a whole bunch of other stuff that I'm not including in this post.

December 31st is tax planning time. Are you ready?

The size of the logs

bradley — Mon, 05 Dec 2005 05:31:00 GMT

The default size. You probably haven't even looked at these have you? The default size for the event logs can be pretty small. And the size of this one in particular, the Directory Service event log of 512 KB means that I don't have any entry prior to when a SBS box freaked out on a Consultant.

So can we adjust that? Sure can. What's the max? A heck of a lot more than 512 KB. Just remember we should not go more than 64000 KB as that will cause issues with our backup, but man I sure wish that Directory services event log would have been set a lot higher than 512 KB.

The more of this story? Partition off your C: drive appropriately, move off data folders, but man, mess with the default size of those audit logs, 'cause you never know when you'll need to have the data that those logs will give you. All we have now is confirmation that that box was freaking out. We don't have anything in that log file right 'before' what looks to be the start of the 'freak out'.

Ensuring you have the data you need when you need it...well that extends to the log files as well.

Change Management SBS style part II

bradley — Sun, 04 Dec 2005 22:47:00 GMT

I forgot another person who may introduce 'change management' unknowingly in a SBS system. The LOB app vendor. Now this is where me and my fellow MVP Dave Nickason are lucky. We have pretty self contained LOB apps that don't need some add coder to go mucking around your servers. But most of you are not so lucky.

And when they do want remote access, they don't want to use the built in Remote Assistance tools but instead insist on PCAnywhere or VNC.

As a newsgroup who's seen one too many line of business installer come in and start disabling things and ripping out stuff they shouldn't, talk to your client. Make sure they know to call the consultant in that handles the SBS box. Instruct your client to 'freak out' when Copier/scanner vendors ask for administrator passwords, when LOB app vendors ask to install third party programs, when they start removing things they shouldn't.

Get yourself in that Quarterback role of Change Management in that network.

Change management SBS style.

bradley — Sun, 04 Dec 2005 04:08:00 GMT

Change management. The hardest task [I think] for a VAP/VAR/Consultant is “Change Management”. In a big firm change management is this multi tiered process where any change to the system is tested, reviewed, approved and then and only then is change introduced into a system.

Now come to SBSland where 'change' is more likely than not to be introduced by the receptionist, or by the Son of the owner who “knows a few things about computers”. Now for the VAP/VAR/Consultant I know you document your change management. You do it to ensure you bill for the task. But do you ensure that you have your client track what has been done to a box.

So many times you'll get the “Oh we didn't do anything to the system.....except maybe.....” For some they control change management by having the Administrator password and the boss/owner doesn't have it. For some VAP/VAR/Consultants... we know some of the users passwords even. Going back through the event logs sometimes is the way you check for 'change management'. But if you can? For those that you do allow to be somewhat of admins of their systems? Do you place a notebook by the server to ensure they document what they did [or think they did?]. Do you have an admin account login for them so you can track what they did and when they logged in?

Ensuring those foundations are there

bradley — Fri, 02 Dec 2005 02:36:00 GMT

When you build a house in California, you pour a concrete slab and then build from there. When you install a SBS 2003 system you install it on a server. The foundation. The slab. And as long as your foundation is good and solid, you are good to go as well.

On my HP at the office is the HPSmartStart software that helps to make the SBS install easier and installs all the hardware monitoring software. Yes, the HARDWARE monitoring software. It's checking the condition and status of the RAID array underneath. So if I drop a drive it will let me know. My older server has a lovely, so wonderful, screeching sound that the Adaptec card gives off when it drops a drive.

To me I consider hardware raid a normal part of a server install. You just have a hardware based raid period for a good solid foundation for your network.

People in the newsgroup have seen us post about SBS 2003 sp1 and they say “gee I depend on this server so I don't want to break it”. Well, if you depend on it, ensure two things.

Good solid server hardware and that includes RAID, and that preferably includes monitoring software that alerts you to issues
A good backup, a drive image, something. Les is raving about Paragon Drive image these days saying that it's worth every penny of the Server price tag [and when “Les is more“ says something is good, he doesn't give that recommendation lightly. Remember that while the AD guys go pale when we drive image our DC's, because we are a single DC we can get away with it.

So folks... get those foundations in place and you won't worry abou the server breaking. You'll know proactively when things occur, and you'll have a disaster recovery plan in place should something occur.

Computers on or off?

bradley — Mon, 28 Nov 2005 18:01:00 GMT

Quick question?

Yes? [btw ever notice how quick questions usually end up not being quick questions?]

Is there a way to stop a user from shutting down a machine?

Yes...but....are they a local administrator on that box?

Yes.

Ah, well then if they are admins, then no. In order to do this you need to take back the rights on this machine. Then if you do that you can do such fun things like removing the start button in group policy so they can't shut down. But you need to realize that your stupid line of business applications more often than not will not run as a regular user and you'll end up hacking up the registry hives.

Can it be done? Yes. The issue was a person who used the computer shut it off and then another remote worker wanted to use the computer on the weekend. Unless you want to spend the time and energy into making a technology solution....make a policy solution.

Stick a yellow sticky note to remind people to leave the computers on so that people can remote in, you can to maintenance. Honestly I don't shut off my workstation these days at all and only reboot for patches.

Making the case for upgrades

bradley — Wed, 23 Nov 2005 00:30:00 GMT

On the podcast gang blog today is this post.... and it reminds me of discussions about upgrading... we already find it hard to make a business case for patching, for service packs.... and the upcoming 64bit means we have to make a business case .... a big business case for upgrades. We have to prove to the business owner, before they make a migration, why it's worth it. Why they need to disrupt everything in their office and rip everything out.

In a day is the American holiday of Thanksgiving where we gather together for thanks [and as a guy on Saturday Night Live said.... give thanks to the Native Americans who helped us survive and then we ripped them off and took away their land...okay so it was more funny on SNL....] and you know how I spent my Thanksgiving?

Installing the network at the office.

Ripping out a server that was 3+ years old that had dropped a harddrive. Installing finally a platform that had mobility and remote access. Putting in place the foundation that meant I have cell phones that remotely connect and laptops that can get information and security. Yeah.... I'm into security...so for me the fact that the supportability of the Windows 2000 platform was going down, the fact that SBS 2003 had already been out a year meant that it was a no brainer to me. But it's not an easy sell, is it?

At the end of the day it has to make business sense, feature sense, and give the business something they don't already have.

For SBS 2003 the pain and suffering of migration gave us rock solid platform, and mobility options bar none [so much so that my firm is soon to be a three Audiovox office and hopefully more to come].

For that 64bit SBS that will come in the future.... you need to have a selling feature first guys... and then you need to make it easy to get there. For the business owner.... for some of us upgrading is a no brainer.... it's just the way we are.... for others.... it's a hard sell. The business of migration isn't easy is it?

So can I have an additional domain controller in my SBS network?

bradley — Thu, 03 Nov 2005 02:53:00 GMT

Yes, it's entirely supported, possible, doable to have a an additional domain controller in your SBS network... and in fact, it doesn't even need to be another physical Windows server. You can set up a virtual server 'inside' a workstation in your network and have that be the additional domain controller. That's probably more something for your lab exercises, but it can be done.

Just remember the SBS box must hold all the FSMO roles, but yes, you can have an additional domain controller and all you need is a Windows 2003 license [or 2000 but I really prefer 2003 and the security settings better] as the SBS covers any client license access cals for that additional box.

How much of a control freak are you?

bradley — Tue, 25 Oct 2005 00:28:00 GMT

Dan [name changed to protect the innocent and the fact that I'm going to rag on his boss in this blog post] in the mailbag today asked a question about 'hosted' Exchange. He said that his boss wanted him to look into hosted Exchange [asp] as an alternative to moving their MX records to their SBS box. The problem is that the boss did not want to leave the server on 24/7. Dan said that he only agreed because he didn't have the environment to run a high availability server.

Dan? Boss of Dan? Come over here... see my network? Do you see my older 'member' server? It used to be my main SBS box but now it's the TS/member server box. That server is 5, maybe 6 years old... now I personally think the sweet spot of server hardware is about 3 to 4. You know what happened to me today? Another drive on the RAID 5 array on that old server dropped off. You know how much down time that affected me? About 45 minutes. During my lunch hour no less. And about 15 of that 45 minutes was on hold with Adaptec [delay due to the Hurricane because all calls are going through Millpitas and not shared between California and Florida] because the drive had to be zapped off again [it did this the last time I lost a drive on that older server about a year ago and I couldn't remember the commands] and then brought back into the array as a hot spare and then it slid into the location where it's supposed to be and drive 0,1 in the three drive array. And other than the screaming like a banshee sound that it makes while one of the three drives has dropped off the face of the earth, the server is still running, still serving, still doing it's thing. In fact, many folks say that you want to leave your servers up and running, that it's the spinning up and spinning down that does more wear and tear on them.

I keep a spare harddrive [in fact now need to order a new one] just so I can slide a new one in with no issues. High availability to a firm doesn't mean a datacenter. It means just reasonably nice hardware. Server hardware. It's certainly not the overgrown desktop hardware that is running the DELL OEM I bought for testing purposes. [It is literally the absolute CHEAPEST model I could get and it's basically an overgrown desktop with one drive].

It means ...that even if you DO go the route of some of your parts being 'hosted', I would argue that you STILL want true Server class hardware. Now these days, I'm not convinced it's SCSI all the way... I think it can be SATA as well. But there's a RAID in there so you could drop a thing or two along the way like I did during lunch and it would not matter one bit.

Next reason why you want your SBS box on 24/7.... remote connectivity. There's many a time I go off to a conference and go 'oh shoot I forgot that' and can remote back into the office 24 hours a day, 7 days a week. Remote Web Workplace 'is' the killer app of SBS.

Next reason why you want your SBS box on 24/7.... patch management. I have and do scan and patch my network in my jammies from home. Now then, if you turn your system off...how can you do that?

So ...okay... next... about that Boss not wanting to point the MX records to the SBS box... okay so the Gang at the SBS podcast will hate me for this but here comes....come closer.... you know about that POP connector that is supposed to be a transition tool? The one that you are only supposed to use temporarily? Well like they said in one of their podcasts... folks have been transitioning on that sucker since SBS 4.0. I use the pop connector at home all the time.

And what about the MX records and all that.... you know that with a service like TZO.com you can have a backup MX record so that if 'IF” your SBS box goes down the email will stay in your backup MX holder and then forward it again when it's back up.

Okay ..so like WHEN would you want hosted Exchange? I think you'd want hosted Exchange ...and hosted SBS for that matter.... if you are

Not a control freak like I am
Live in an area that you need to be nimble and move out of harm's way

I think [hint hint] Vlad in his blog need to post about advantages/disadvantages of hosted Exchange and ways to connect [VPN, RPC over HTTPS [I vote that one even with real SBS]. and whether you should stop Exchange to free up resources [remembering of course that again, if you have a real server, it can handle this stuff just fine]. For me I'm just waaaaayyyy too much of a control freak to handing Exchange not being in my office under my control.

This nimbleness I know came in handy for one of Jeff Middleton's tech support clients. He helped them backup their data and they sent it off to the software vendor that in addition to having a PC based application also had an ASP version. This allowed them to quickly get back online.

So Dan's boss? Leave that server turned on please? You don't need to turn it off and night and reboot in the morning. This is a server, not a workstation. Heck we're even leaving workstations on 24/7. And bad guys can break into you via the Internet just as effectively if you are stupid on setting that box up during the day as well as during the night. While turning a machine off and encasing it in cement, dropping it to the bottom of the ocean probably does increase security of your system greatly, it kinda doesn't help much to boost productivity.

Leave it on, Mr. Boss.

Don't do that... they mean really DON'T DO THAT

bradley — Sat, 15 Oct 2005 20:51:00 GMT

I'm listening to the SBS podcast they remind me of the uniqueness of SBS... don't ...don't ever...rename the domain and expect to live through the experience.

Like the comments... active directory domain name does not equal your email domain name... and only YOU the administrator cares about the domain name.

Like Peter days... DDT.... don't do that.