THE OFFICIAL BLOG OF THE SBS "DIVA" : SBS Installation

Welcome to your SBS 2003 server

bradley — Sat, 11 Feb 2006 03:16:00 GMT

In looking at the documentation for my own SBS 2003 OEM box (which can be found online here), it dawned on me why so many OEM DIYers that contact me haven't a clue about Remote Web Workplace..it's because nowhere in those documents is there a "Welcome to your server".

I mean the 15 minute install is fine, and it dumps you to the ToDo list...but no where...not even really on that To Do list..is there a Cliff Notes guide to the SBS box. I mean sure we can all say "yes, it's really best if you have this set up by a professional" and all that, but let's get real.

The good businesses will have it set up by a professional, the others will pick the geekiest person in the office to do it, or call on the friend of a friend who's studying Computer Science in college...which means he's a Napolean Dynamite wannabe or something like that.

So if you've been suddenly handed responsibility for a SBS box...and while ..yes.. I'd recommend a professionally set up one...here's the cliff notes for admining....

Do read the first bullet point in there about Security. Yes I know it's hard to think about bad guys other than pimply faced kids, but the reality is that the 'bad guys' are a big business. But don't get TOO paranoid. While they are out to get you...they aren't out to get YOU. So don't think that any little time your system hiccups you have a keylogger trojan, nor funky dog files with file sizes of 169K means that you have a hacker on the box. DON'T PANIC. Know your system and know where you've been and where you've surfed. The malware/spyware forum gang tell stories of folks that the spyware is slowing down their downloading of software cracks, illegal music and what not but will not stop the download to go run an antivirus/antimalware scanner on their system. If you are downloading potentially illegal things from questioable sites...don't go blaming me if your computer starts acting up. If you do think that there is something that just cannot be explained 1-866-Pcsafety is Microsoft's security hotline.
The To Do console is your friend. Click on Users. The place where you will be adding users to your network is right here. Go through the wizard adding all the necessary information and set up the computer here as well.
The To Do console opens up the ports in your firewall via the connect to internet wizard. The main ones are port 25 for email, port 443 for access to the server/owa/oma/rww, port 4125 access for RWW, port 444 for external access to companyweb, port 3389 (if) you want access to terminal server remotely on the server and port 1723/gre protocol 47 for VPN (pptp anyway). If you have an external router you need to forward these ports to the IP address of your SBS box.
The connect to Internet wizard (referred to as the CEICW around these parts) is your main wiz' for firewall and remote access to this box. When you run the wizard, select only those items you want to open up for, but it does everything you need on the server side for what that box needs for access. If you have a router on the outside you need to do the port forwarding. But you really want Remote Web Workplace. (more on this later). Also run the Remote access wizard. While I don't VPN into my box, I had funkiness at one time happen on my home server because I forgot to run this wizard.
While in the To Do list, ensure you run both the backup and the monitoring wizard. These days it's not necessary to backup to tape, you can also back up to harddrive..but backing up to DVD... uh...there's not enough room. And the jury is still out on Iomega REV drives liking Windows 2003 sp1 (and therefore SBS 2003 sp1). The monitoring wizard will spit out a daily email that gives you the overview of how your network is doing. I love it and even can read it remotely on my Audiovox 5600.
Okay so the dirty little secret of SBS is that as much as we say with a pompous voice that POP is not for servers, the reality is that for small businesses, pop is the nice warm fuzzy way we get email so they all use the pop connector. Let's get a couple of things straight. No. and No..and don't ask me again. (can it get email faster than 15 minutes and can I leave mail on the server at the ISP? are the two biggest questions...there are some hacks floating around and no, don't ask me for them go google them yourself if you want to hack up your clients SBS box and put it possibly in an unsupported condition). Run the CEICW to set up the pop connector to pull in email and then push it out via SMTP. You do not need to open up port 110 to pull in email, nor open up port 25 to send email. You 'may' need to forward your email to a smart host setting. If you forward email out to a smart host you'll need to also enter in the username and password into the smtp connector (open up the Exchange server Management, drill down to the smtp connector, right mouse click on properties, advanced tab, outbound security, click on basic authentication, then on modify and put in the username and password. Keep in mind that with pop you have to figure out some other spam filtering as the Exchange 2003 sp2 IMF doesn't work.
If you want to grow from pop to "REAL EMAIL" (insert mail grunting noises here), then follow Javier's post on migration from POP to SMTP. You can babystep this and get use to the email coming into the server first before attempting this.
Okay so here we are at THE killer app of SBS 2003: Remote Web Workplace. RWW is a page...on that page you enter in your username and password...it then authenticates you...offers up to you the menu of items you are allowed to have access to. The button that says "Connect to my Computer at Work" allows you to have access to the desktop of your Windows XP machine "as if you were at the office" (with one exception that it doesn't support dual displays if you have dual displays on both ends of the remote tunnel. It is not a VPN connection...yet many in SBSland argue that it "is" and "can be" more secure than a VPN tunnel since most of the time it's just sending screen shots across the wire.
To get all this "goodness" automagically set up, once you have run the CEICW on the server, once you have run the "add user" wizard at the server, go to a workstation, log in as the "Administrator" on the box, and place http://servername/connectcomputer as a trusted site in IE's XP sp2 trusted site zone (this ensures that all the active X stuff works. You then go to that web site and voila...you start a wizard that connects you to the network, installs Outlook, sets up the RWW glue connections, and basically does everything you need to be connected to that network.
To get the goodness of RWW, you need either XP desktops, or.... a separate Windows 2003 server that is set up in a Terminal Server mode.
I 'disable' (okay so my normal slang word is wack off but naive me apparently doesn't know that it has several meanings...so I'll say disable) the Disk quotas on the server, and Peter had an interesting post on ensuring shadow copies were enabled in a certain spot on your server.

Okay so that's the real quicky overview of your admin duties post for the DIY crowd out there...but folks..truly...if you have a SBS server.... fire up that RWW web site folks! You have no idea what you are missing out on if you don't!

The connect computer and one Nic and the MCE problem

bradley — Sun, 15 Jan 2006 23:47:00 GMT

In the mssmallbiz yahoogroups, a post reminded me that you need to make sure you only have one active NIC alive and kicking when you run that wizard as I've seen that wizard fail when two or more nics are active [even vmware network adapters].

Place the http://name/connectcomputer in the trusted zone spot in IE
Ensure one nic [and only one nic] is live and active

But then came the real reason that the wiz wouldn't wiz.... the computers that were being attempted to join the domain were Media Center Edition Computers...which ... officially CANNOT join a domain. Yes there is the 'banana' hack, but unless you are using that MCE to drive a High Defnition TV in your conference room [and btw those units do look very cool] you need to get yourself to XP Pro. I'll be the first to say that yes, I run a MCE here at home joined to my domain...but this IS my home and not my business. Again.. choose the right tool, and you want an XP Professional or XP Tablet in a firm setting. You don't and can't use XP Home, and 'might' want MCE for the 'wow' factor in the conference room. Otherwise stay away from them.

Domain level? Exchange Level?

bradley — Tue, 25 Oct 2005 17:57:00 GMT

From a question from the mailbag today [of which I answered one from an Exchange viewpoint] the question was “What's SBS's domain level?”

A default SBS will have a Domain functional level of “Windows 2000 Native” and a Forest functional level of Windows 2000.

Windows 2000 DOMAIN of mixed mode will support Win NT 4/Win2k and Windows 2003. Windows 2000 native will support 2000 and 2003. A Windows 2003 “interim“ will support NT and 2003 domain controllers, and of course, last but not least Windows 2003 functional level will support Windows 2003 only.

Now for SBS you can only raise it to Windows 2003. You can swing up from a NT domain controller using a variety of methods, but honestly I think I'd want anything NT based to be just a member server and not part of my domain controller structure. You are introducing all the lack of security on those NT platforms in my opinion.

A default install will have an Exchange of Mixed mode. Now I've raised it to Native Exchange since I have no need to connect to an Exchange 5.5 box.

You DO know about the TS2 blogs don't you?

bradley — Thu, 22 Sep 2005 22:48:00 GMT

I hope you are following the TS2 blogs.....because if you did you'd find out the following....

Also, we've received word that PSS will support the hosting of the SBA database on a SBS 2003 Standard Server!

Hoooraay!!

DNS ...to forward or not to forward...that 'tis the question

bradley — Sat, 26 Mar 2005 18:50:00 GMT

First off I have to explain..I've been doing knock offs of Shakespeare ever since I briefly caught the interview of Denzel Washington on GMA in his role of Brutus in Julius Caesar on Broadway.....the “To Be or not To Be“ is from Hamlet anyway....we now return you back to the blog....

DNS ...to forward or not to forward...that 'tis the question...whether tis nobler in the mind to suffer the slings and arrows of potential DNS poisoning or to merely use root hints.....

uh...sorry...where was I? Oh yeah...

Muffy in the newsgroups indicates that when she ran the Connect to internet wizard that she 'did not' put in any ISP's DNS entries in there where the wizard indicated and the network is resolving to the Internet just fine. Is this okay, she asks?

And yes, indeed as is showcased here it is truly not necessary to put in ISP forwarders...as the built in DNS root hints pick up the ball and just work.

In fact, many are now arguing that we should 'not' put in DNS forwarders anymore due to DNS poisoning attacks. The only thing I have seen that we need sometimes is adjustments to EDNS0 support evidence by not being able to get to some websites.

So next time you are playing around with your test server... try taking out those forwarders...see what happens... you'll probably find like Muffy did that everything magically still works just fine.

P.S. Check out Eric's comments for some items to think about when choosing between forwarding or no forwarding.

What's a server?

bradley — Sat, 26 Mar 2005 18:11:00 GMT

If you are the IT Pro...what's a server?

No, seriously...what is a server? I would hope that you would say that it's an operating system that 'at least' had the name 'Server' in it and not XP Pro used in a peer setting. I would hope that you would say something that specifically was tuned and optimized to be a server.

If you are the business owner...what is a server?

No, seriously... put your business owner hat on and put aside the geek propeller head hat. What is your view of the server? It's Outlook isn't it? Or it's the shared file storage of Excel. Or it's the business app you are using like CRM. They have no idea, no care of what the 'plumbing' is used to do the job. They just want it so that when they go to turn on the water that the water indeed comes out. It's as simple as that.

It's YOUR job as the propeller head to spec out the plumbing.

Used to be that we only looked at SCSI drives for servers. Raid 5 this. Raid 10 that. Now we're using SATA drives. I personally thing the hardware side is the harder one to keep up with. Maybe I'm just a software gal, but even with I go to Dell's web site invariably I can never put together a server that has the right parts in the right places and I get a “we're sorry you cannot put that backplane with that drive without major hardware issues” ...or some equivalent message.

I'd say most of the gang spec out a system that they get comfortable with and then 'stay' with that footprint for a while until it's time to reevaluate and start over.

Just don't forget when talking to that business owner that they don't care about what size the pipe is our how the backflush device works. They want a nice looking faucet and water that is hot when they want it and cold when they want that too. Don't talk nuts and bolts about servers, show them how the faucet [server] works. Turn on the faucet and show the running water. Show them Remote Web Workplace and Outlook Web Access. In fact, take your own laptop and showcase how 'you' can communicate remotely with 'your' office. Making sure your own 'geek factor' is in place is probably the best sales tool you have. Not to mention, it's a great way to keep up to date on interoperability of technology...and yes...before someone asks..keeping up with all the geek toys is indeed an ordinary and necessary business expense and thus the devices you would be buying to showcase mobility would be deductible.

When is something "private" not Private

bradley — Tue, 28 Dec 2004 19:04:00 GMT

Tony posts that one should santitize the Ipconfig/all posting that is done in the newsgroups and I'd like to clarify one point he's made. He says that you should clean out the 192.168.16.x and 10.0.0.x addresses in your post and I disagree. While those are class c and class a “private” ranges they are so well known of internal IP address ranges that IMHO, you aren't disclosing anything that your email header doesn't post in more stuff on. I would recommend taking off an “external” IP address [something your ISP gave you, but posting in ipconfig/all shouldn't also expose your ISP's DNS info [and it's not like an ISP's DNS isn't googable anyway. We as SBSers don't “host” our own public DNS.

So what are the standard IP addresss that are considered “private“ but so used by everyone that it's common knowledge? There's a page here that talks about the 'standards“. In general in SBS land, back in the SBS 4.0/4.5 days we used a “class a“ with a kind of “class c“ subnet mask. What's a subnet mask? It's the part of the IP address that lets that system know how big of a network range it's going to talk to.

Back in SBS 4.0/4.5 we used 10.0.0.2 with a 255.255.255.0 mask. That meant that as long as a computer had a IP address that started with 10.0.0.X, our server would “talk“ to that system. You'll also see it noted as a 10.0.0.X/24.

Now in SBS 2003 our default “'base“ range is a classic “C“ address of 192.168.16.x [where the server is normally 192.168.16.2]. Again the subnet mask of 255.255.255.0 makes that system “talk“ only to the 250 someodd systems in that range. What that 255.255.255.255 mask really means is this.

As per RFC 1918, these address are “non routable“ they are your “inside“ addresses. What many consultants do is pick that 172.16.x.x range and that is more often than not, NOT in a SBS network and thus any static VPN routing that the internal firm may do won't mess with that consultant's own ranges and settings.

What do I mean by Class “A“, and Class “C“? These are agreed upon naming ranges for “private“ non-routable addresses. Typically the Class A is a 10.x.x.x with a netmask of 255.0.0.0 and Class C is a 192.168.16.x with a net mask of 255.255.255.0, Thus in the SBS 4.0/4.5 days our 10.0.0.x/subnet of 255.255.255.0 was kinda not exactly the best setup. Our new default of 192.168.16.x is the proper way to name our internal range.

Class	Range of Addresses
A	Any addresses in 10.x.x.x
B	Addresses in the range of 172.16.x.x-172.31.x.x
C	Addresses in the range of 192.168.0.x-192.168.255.x

In computers the use of “on“ and “off“ is really what everything talks in, so 255 is in reality the value of 11111111

Starting from right to left in a logarithmic fashion it's the total of

128 64 32 16 8 4 2 1 = 255

1 1 1 1 1 1 1 1 = 255

Which is telling that system match every single number from the IP “octet“ [between the “.“] to the IP address that you are comparing it to. So a 192.168.16.2 with a subnet of 255.255.255.0 can talk to a 192.168.16.200 that also has a subnet of 255.255.255.0, because the “0“ at the end is telling the system “okay you talk to ANYTHING in the 192.168.16.1 to 192.168.16.255 range and I won't care“.

See how it works?

So when your ISP gives you an external REALLY PUBLIC IP address and the net mask is set for 255.255.255.248, it's saying the following:

128 64 32 16 8 _ _ _ = 248

1 1 1 1 1 0 0 0 = 248

And because 1 + 2 + 4 = 7, your ISP has just given you only “that“ IP addresses that your public IP can talk to [normally a gateway IP address and 6 public IP addresses. Get it? [Assuming I'm doing that right, someone correct me if I'm wrong]

So bottom line when you post your IPconfig /all in the public newsgroups DO clear out an PUBLIC Ip addresses that your ISP gave you but I would argue there's no need to clear out the 192.168.16.x stuff. Wouldn't take a rocket scientist to know that we're “supposed” to be using those inside our networks.

Who's YOUR DHCP

bradley — Tue, 28 Dec 2004 18:26:00 GMT

DHCP.

As it's stated here on a web site:

What is DHCP?

DHCP stands for "Dynamic Host Configuration Protocol".
What is DHCP's purpose?
DHCP's purpose is to enable individual computers on an IP network to extract their configurations from a server (the 'DHCP server') or servers, in particular, servers that have no exact information about the individual computers until they request the information. The overall purpose of this is to reduce the work necessary to administer a large IP network. The most significant piece of information distributed in this manner is the IP address.

I have found that things just work “better” if you let the SBS server be the DHCP “hander-outer”, that is, it NOT your Linksys/firewall/router is the one handing out the IP addresses. Again, if you are migrating from peer to peer this is a bit unusual as you've been used to having a router that does this function. But IMHO [in my humble opinion] the SBS network works the best [connectcomputer works better, wizards run nicer] if the SBS box is in charge of DHCP and DNS. If you ensure that the router has it's DHCP function disabled BEFORE you begin to set up the system, the SBS box will automagically set up the DHCP/DNS functions. Go into the webbased interface and adjust the router to have DHCP disabled and then set up your SBS box. It will no longer see another DHCP server and shut it's own down.

If the SBS box sees any other DHCP server [like your router] on it's same subnet it will shut it's own DHCP server down. Don't forget to run the VPN wizard as I've seen my server want to turn RRAS into a DHCP server without running that wizard.

Ipconfig /all

bradley — Tue, 28 Dec 2004 01:30:00 GMT

Probably the number one asked question back to posters in the newsgroup is

“Please post the results from ipconfig /all at both a workstation and a server”

So many issues with a SBS network are “fixed” with the right Internet Protocol configuration on the server. It's amazing how people and go through the wizard and not “get” what they are trying to set up. I think it's because of coming from peer to peer and on network card setups and now reading about different ways to set these networks up. Many people expect that there should be an “Internet connection sharing” tab on the server, but we don't do things like that.

The most recommended diagrams to follow for setting up a network can be found here:

While you can do a one nic setup as discussed here:How to Configure a SBS for Full Time Internet Access with a Single Network Adapter:
http://support.microsoft.com/kb/309633 I personally feel that two nics is more “separated“, more flexible and I just feel more comfortble with the wizards of SBS than the configuration of a hardware firewall.

The other KB that talks about two network cards is listed here: How to Configure Small Business Server for Full Time Internet Access with Two Network Adapters:
http://support.microsoft.com/kb/306802

Basically you point to the server, the internal IP address for all your DNS entries. You only put in the ISP's DNS information into the DNS configuration as “forwarders“. This is done automagically in the “connect to Internet“ wizard, but you can see the impact in the Admin tools, DNS. Right mouse click on the server name, click on the “forwarders tab“ and you can see where the wizard put in the ISP's forwarders.

See? That's the ISP's DNS that I placed in my box when I ran the connection wizard. You don't put that information in the Network card properties as DNS as you would normally in a peer to peer with a Linksys.

This “separates“ and builds a wall between the inside and the outside to better protect you.

So next time you are having issues with your network, review the settings. Start, command prompt, type in ipconfig /all and hit enter. Copy what you see there, and paste it into the newsgroups and have us check why you are having issues!

Syntax: ipconfig [/all] [/renew [Adapter]] [/release [Adapter]] [/flushdns] [/displaydns] [/registerdns] [/showclassid Adapter] [/setclassid Adapter [ClassID]]

/all : Displays the full TCP/IP configuration for all adapters. Without this parameter, ipconfig displays only the IP address, subnet mask, and default gateway values for each adapter. Adapters can represent physical interfaces, such as installed network adapters, or logical interfaces, such as dial-up connections.

/renew [Adapter] : Renews DHCP configuration for all adapters (if an adapter is not specified) or for a specific adapter if the Adapter parameter is included. This parameter is available only on computers with adapters that are configured to obtain an IP address automatically. To specify an adapter name, type the adapter name that appears when you use ipconfig without parameters.

/release [Adapter] : Sends a DHCPRELEASE message to the DHCP server to release the current DHCP configuration and discard the IP address configuration for either all adapters (if an adapter is not specified) or for a specific adapter if the Adapter parameter is included. This parameter disables TCP/IP for adapters configured to obtain an IP address automatically. To specify an adapter name, type the adapter name that appears when you use ipconfig without parameters.

/flushdns : Flushes and resets the contents of the DNS client resolver cache. During DNS troubleshooting, you can use this procedure to discard negative cache entries from the cache, as well as any other entries that have been added dynamically.

/displaydns : Displays the contents of the DNS client resolver cache, which includes both entries preloaded from the local Hosts file and any recently obtained resource records for name queries resolved by the computer. The DNS Client service uses this information to resolve frequently queried names quickly, before querying its configured DNS servers.

/registerdns : Initiates manual dynamic registration for the DNS names and IP addresses that are configured at a computer. You can use this parameter to troubleshoot a failed DNS name registration or resolve a dynamic update problem between a client and the DNS server without rebooting the client computer. The DNS settings in the advanced properties of the TCP/IP protocol determine which names are registered in DNS.

/showclassid Adapter : Displays the DHCP class ID for a specified adapter. To see the DHCP class ID for all adapters, use the asterisk (*) wildcard character in place of Adapter. This parameter is available only on computers with adapters that are configured to obtain an IP address automatically.

/setclassid Adapter [ClassID] : Configures the DHCP class ID for a specified adapter. To set the DHCP class ID for all adapters, use the asterisk (*) wildcard character in place of Adapter. This parameter is available only on computers with adapters that are configured to obtain an IP address automatically. If a DHCP class ID is not specified, the current class ID is removed.

/?: Displays help at the command prompt.

To display the basic TCP/IP configuration for all adapters, type:

ipconfig

To display the full TCP/IP configuration for all adapters, type:

ipconfig /all

To renew a DHCP-assigned IP address configuration for only the Local Area Connection adapter, type:

ipconfig /renew "Local Area Connection"

To flush the DNS resolver cache when troubleshooting DNS name resolution problems, type:

ipconfig /flushdns

To display the DHCP class ID for all adapters with names that start with Local, type:

ipconfig /showclassid Local*

To set the DHCP class ID for the Local Area Connection adapter to TEST, type:

ipconfig /setclassid "Local Area Connection" TEST

Getting an "Event ID 5" error on "DefaultAppPool"?

bradley — Wed, 09 Jun 2004 11:53:00 GMT

Event Type: Error
Event Source: Active Server Pages
Event Category: None
Event ID: 5
Date: 14/05/2004
Time: 4:32:55 AM
User: N/A
Computer: 001DC001
Description:
Error: The Template Persistent Cache initialization failed for Application Pool 'DefaultAppPool' because of the following error: Could not create a Disk Cache Sub-directory for the Application Pool. The data may have additional error codes..

Try these fixes:

A. Add the NT AUTHORITY\NETWORK SERVICE account to
C:\WINDOWS\Help\iisHelp\common with "Read and Execute," "List Folder Contents" and "Read".

B. Add the NT AUTHORITY\NETWORK SERVICE account to
C:\WINDOWS\system32\inetsrv\ASP Compiled Templates with Full Control.

C. Add the NT AUTHORITY\NETWORK SERVICE account to C:\WINDOWS\IIS Temporary Compressed Files with Full Control.

Thanks David S. for the suggestion! :-)

Interested in installing CRM on your SBS 2003?

bradley — Sat, 22 May 2004 04:20:00 GMT

Don't forget to review the CRM guide --

Installing Microsoft CRM on Windows Server 2003
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/sbs/2003/Default.asp

And especially don't forget to install Message Queuing Service, as it's not installed by default.

And do you know about the yahoogroup set up specifically for CRM in a small biz setting?

Send and email to mscrm_smb-subscribe@[takethisout]yahoogroups.com and you'll join a peer group of CRM experts!

Adding Project Server 2003 to your SBS 2k3

bradley — Thu, 01 Apr 2004 00:54:00 GMT

http://www.sbslinks.com/Project_Server.htm
http://www.sbslinks.com/pdf/ProjectServer.pdf

Huge thanks to SBSer Chris Jones for this document

If you are having issues with saving files on your SBS2003 check this:

bradley — Fri, 19 Mar 2004 00:42:00 GMT

If you can't save any files into your folders check two items:

First, ensure your permissions are set right: http://www.sbslinks.com/permissions.htm

Next ensure that disk quotas aren't causing issues - review this KB for information on Disk quotas and adjust them or turn them off if needed

326212 - HOW TO: Manage Disk Capacity and Usage Using Disk Quotas in Windows Server 2003:
http://support.microsoft.com/default.aspx?scid=kb;en-us;326212

Accessing OMA and getting "item no longer exists" error message?

bradley — Sat, 14 Feb 2004 23:16:00 GMT

When trying to access OMA - are you getting the following error "Item no longer exists.
The item you are attempting to access may have been deleted or moved."
immediately after logging in. The event log shows an error from MSExchange
OMA Category 1000 Event ID 0.

The resolution:

The problem originated when a second email address was added -
user@mydomain.com The real cause of the problem was an incorrect path
on the exchange-oma virtual directory - it was set to
\\.\backofficestorage\mydomain.local\mbx instead of
\\.\backofficestorage\mydomain.com\mbx . Changing this restored full
functionality.

This is found in the IIS Manager, click on your server name, then on web sites, then on default web site and look for the “exchange-oma“

Having issues with POP connector yanking all the resources?

bradley — Fri, 06 Feb 2004 23:24:00 GMT

Download details: Hotfix for Windows Small Business Server 2003: KB 833992:
http://www.microsoft.com/downloads/details.aspx?FamilyId=206E4E32-1E37-4836-B4F7-8D6A543A7C7F&displaylang=en

Installing GFI Faxmaker 10 in SBS2k3

bradley — Wed, 28 Jan 2004 15:20:00 GMT

How to install GFI Faxmaker 10 in SBS 2003.

On a default SBS 2003 installation, the Microsoft Exchange MTA stacks
service and functionality are disabled. Faxmaker requires the interaction
with this service for its Exchange connector to function properly. In order
to get the full functionality of Faxmaker or any other product that requires
the user of a connector through the MTA, the following steps need to be
followed:

How to re-enable the MTA Stacks in SBS 2003.

Enabling the MTA is a two step process; it requires making changes to the
startup type of a service and also perform some registry editions.

Before starting, make sure you have a good working system state backup.

1-Removal of Registry Keys:

1.1-Open Regedit.exe

1.2-Go to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\servername
\Private-guid_of_private_mdb

Remove (Delete) the following two entries:

            "Gateway In Threads"

           "Gateway Out Threads"

1.3-Go to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\servername
\Public-guid_of_public_mdb

Remove (Delete) the following two entries:

            "Gateway In Threads"

           "Gateway Out Threads"

1.4-Close Regedit.exe.

2-Changing the startup type of the Microsoft Exchange MTA Stacks service.

2.1-Open the Services MMC (or open Run and type Services.msc and then press
OK).

2.2-Double click on top of the Microsoft Exchange MTA Stacks entry to open
its properties.

2.3-In the General tab, change the Startup type from Disabled to Automatic,
click Apply and then start the service. Close the properties.

2.4-Do not close the Services MMC yet.

3-Re-starting services

3.1-Select the Microsoft Exchange System Attendant service and perform a
re-start, this will also re-start all dependant services. (If Faxmaker was
already installed, re-start the proper services from that product). If in
doubt, re-start the system.

3.2-Close the Services MMC.

4-Install GFI Faxmaker 10 if it has not been installed yet, if it was, after
the services are re-started, faxes should start flowing through Exchange to
FaxMaker.

Getting an error during inplace upgrade that Base DAV protocol 0XC103748A can't install?

bradley — Sun, 18 Jan 2004 20:19:00 GMT

FIRST
if Microsoft Office 10 Beta is or ever has been installed on the
computer. Office 10 Beta includes a local Web store. This local Web
store registers itself in the following registry key:

HKEY_LOCAL_MACHINE/Software/Microsoft/DataAccess/RootBinder/file

This key contains the following three values:
- //\\.\backofficestorage
- //\\<server_name>\backofficestorage
- //\backofficestorage

These values contain a class ID. The class ID for the Office 10 local
Web storage system is {9da0e11f-86ce-11d1-8699-00c04fb98036}, but the
class ID for the Exchange 2000 Web storage system is
{9da0e0f3-86ce-11d1-8699-00c04fb98036}. If any of these registry values
contain the class ID for the Office 10 Web store, Setup does not work
and you receive the error message in the "Symptoms" section of this
article.

SECOND:
296436 XADM: Setup Cannot Register the Exoledb.dll File
http://support.microsoft.com/?id=296436

THIRD:
How do you feel about an uninstall/reinstall of
IIS/Exchange. That's also mentioned as a fix.

Try to make anew Default Web Site and what happens?
1. Start Internet Services Manager.
2. Right-click <YourServerName>, click New, and then click Web Site.
This step starts the Web Site Creation Wizard.
3. Click Next.
4. Enter a description for this Web site, and then click Next.
5. Set the appropriate Internet Protocol (IP) and port setting, and
then click Next.
6. Set the path for the Web site, and then click Next.
7. Set the appropriate Web site access permissions, and then click Next.
8. Click Finish.

This is mentioned in:
303063 XADM: An Error Message Occurs and Exchange 2000 Server Setup May
Not
http://support.microsoft.com/?id=303063

Are the entries in the Exchange Server Setup Progress.log consistent in
all these issues?

Inplace upgrade from SBS2k to 2k3 and get an error regarding driver not signed?

bradley — Sun, 18 Jan 2004 20:18:00 GMT

"The driver software you are installing has not been
properly signed with authenticode technology. Therefore,
Windows cannot tell if the software has been modified
since it was published. The publisher's identity cannot
be verified because of a problem:
The parameter is incorrect"

Resolution is to set Key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Non-Driver Signing\Policy to 00.

"The driver software you are installing has not been
properly signed with authenticode technology. Therefore,
Windows cannot tell if the software has been modified
since it was published. The publisher's identity cannot
be verified because of a problem:
The parameter is incorrect"

UPDATE: You probably need to edit this via Group Policy instead -- this is an example of the group policy for kernel mode drivers for printers:

1. Open Group Policy Management and open the Default Domain Controllers
policy. NOT the default domain policy.
2. Double-click Administrative Templates, and then double-click Printers.
3. Right-click Disallow installation of printers using kernel mode drivers,
and then click Properties.
4. In the Setting tab, click Disabled, and then click OK.

Explanation of the 'Disallow installation of printers using kernel mode
drivers'

Determines whether printers using kernel-mode drivers may be installed on
the local computer. Kernel-mode drivers have access to system-wide memory,
and therefore poorly-written kernel-mode drivers can cause stop errors.

Having DNS issues with your SBS 2003?

bradley — Thu, 15 Jan 2004 00:23:00 GMT

******Begin User Part 1******
...[Server is] a Dell PowerEdge 600sc server with RAID 1. There is 1
NIC. SBS 2003 Standard came pre-installed by Dell. I plugged the server
onto a network that is sharing a public IP in a NAT configuration on a
Sonicwall Firewall, which is also the DHCP server for all PCs on the
network. I configured the NIC on the SBS server with a static IP
address. I configured the DNS server with forwarders to the public IP
addresses of the DNS servers of the Internet provider. And I made the IP
address of the new SBS server the primary DNS server assigned by the
DHCP server. PCs on the LAN, using the IP address of the SBS server as
their primary DNS server, were not able to get DNS resolution. But the
server was for itself.

Here is the response I received from Microsoft:
******End User Part 1******

******Begin Microsoft******
The configurations in SBS 2003 is simialar to configurations in SBS
2000.
There is no need for you to run ICW.exe on the computers.

This issue can occur because Extension Mechanisms for DNS is enabled on
Windows 2003 by default (it is disbled in the Windows/SBS 2000). (The
SBS 2003 is based on the Windows 2003)

828731 - An External DNS Query May Cause an Error Message in Windows Server 2003:
http://support.microsoft.com/default.aspx?scid=kb;en-us;828731&Product=w

Please try the following command to turn off EDNS0 support 1. Start a
command prompt.
2. Type "dnscmd /Config /EnableEDnsProbes 0" (without the quotation
marks), and then press ENTER.

Then please check the issue again. You can take a look at the following
URL for more information: 828263 DNS query responses do not travel
through a firewall in Windows Server
http://support.microsoft.com/?id=828263
******End Microsoft******

******Begin User Part 2******
The settings changed that is recommended by Microsoft disables Extension
Mechanisms for DNS that is supposedly blocking the computers using this
DNS server to get their name resolution. So disabling this thing then
allows proper resolution.

Apparently, Extension Mechanisms for DNS was disabled by default in SBS
2000, but Microsoft changed that in 2003 to make it more secure.
******End User Part 2******

Want to install Live Communication Server on SBS 2k3?

bradley — Tue, 23 Dec 2003 21:07:00 GMT

Steps.
1. Open LCS, right click User Services Global Settings, Properties. Under
the Domains tab, click Add, and add the .com domain (i.e. microsoft.com)
2. Under LCS again, in the Users folder, verify the user is enabled, and
the SIP URI is set to sip:user1@microsoft.com
3. Go to DNS, create a forward lookup zone called "microsoft.com".
4. Right-click microsoft.com, Other New Records, select Service Location
(SRV). For the Service, type _sip, for the Port number, type 5060, for the
host offering this service, type the FQDN of the server.
5. Ipconfig/flushdns, ipconfig/registerdns.
6. Go to LCS, right click the server, select Stop, then Start.
7. Logon to the IM (Windows Messenger 5.0) using the username
user1@microsoft.com under SIP Communications Service Accout.
8. Try to logon now.