THE OFFICIAL BLOG OF THE SBS "DIVA" : sbs 2008

So what's your applicationhost.config file like?

bradley — Sat, 12 Sep 2009 04:10:00 GMT

Sometimes the error messages you get on a server point you in exactly the spot to debug something. Working on the blog up here for the last few years has gotten me more used to dealing with XML files and what not and in each SBS 2008 is an XML file you might want to learn more about.

It's called applicationhost.config and it's located at c:\Windows\system32\inetsrv\config\applicationhost.config.

Tonight in the partner forums someone hit an issue that pointed to a specific line in this file. This is also a prime plug as to why you want to ALWAYS have at your disposal a Virtual PC/HyperV/or VMWare version of SBS 2003 and SBS 2008. So that at any point in time you can compare an "in production" box to a clean one.

Like did you know the section on httpcompression actually calls for a dll from WSUS? So for those of you that use a third party patching tool and uninstall WSUS, if that doesn't cleanly uninstall, you may jeopardize your running web sites.

http://msmvps.com/media/p/1722706.aspx I uploaded my raw, clean, VMware copy of my applicationhost.config file so you can see what it does. Open it up in notepad and scroll around. The good news is that these get backed up with shadow file copies... but it wouldn't hurt opening up one (after making a copy of it of course) and just seeing how each of your SBS 2008 servers compare to one another.

Adjusting your VPN in SBS 2008

bradley — Sat, 05 Sep 2009 23:48:00 GMT

When you set up the VPN connection for SBS 2008 there is one thing to keep in mind if you use it a great deal in your business... out of the box it only allows 5 vpn connections

So you run the wizard from the networking section...

And that pretty much does everything you need to set up the VPN -- you can read more about the nuts and bolts of what the wizard is doing from here:

SBS 2008 series : VPN setup in Small Business Server 2008 « Wintivity ™:
http://wintivity.wigital.net/?p=879

Once the wizard is finish it is ... BY DEFAULT set up for only 5 vpn connections at a time....

To increase this value, click on start, go into the administrative tasks and find the Routing and Remote access section

Inside the RRAS find the Ports section, find the WAN Miniport (PPTP) and right mouse click on properties.

Adjust the maximum ports to whatever amount you feel is needed.

How to get shared docs showing up in OWA

bradley — Sat, 29 Aug 2009 02:41:00 GMT

(keep in mind this works for Exchange 2007/SBS 2008, apparently Exchange 2010 doesn't do this)

To allow your RWW to have file access out OWA, go into the Exchange 2007 console...

Exchange Management Console

- Server Configuration

-- Client Access

--- Bottom pane, first TAB; Outlook Web Access

---- Listed should be owa(Default Web Site); Right-Click, select Properties on drop-down menu

----- In Properties dialog, select TAB Remote File Servers

------ Select Allow button

-------- Add hostnames of servers you want owa clients to access. (whatever the host name is of the SBS box)

ttp://social.technet.microsoft.com/Forums/en-US/exchangesvrclients/thread/5539dadc-211d-43d7-bca5-399db5dbc8d6

Exchange rollup 9

bradley — Wed, 29 Jul 2009 01:33:00 GMT

If you are patching today for the out of cycle patches, be aware that the Exchange 2007 update rollup 9 is also out on the update site today.

You Had Me At EHLO... : Update Rollup 9 for Exchange Server 2007 Service Pack 1 has been released:
http://msexchangeteam.com/archive/2009/07/17/451835.aspx

As Don reported, if you use Storagecraft you'll want this patch as it fixes some issues with the backup.

Setting up a second server to be a Terminal Server in SBS 2008

bradley — Thu, 23 Jul 2009 06:16:00 GMT

For whatever reason, there is a document on the download site that goes over how to add a second server to a SBS 2008 box but doesn’t go into the details of how to make it a TS box… and then the TS section doesn’t go over the “hack” to make it exposed in RDP. That’s in another section and not in the TS section of the Technet doc.

But here’s … to the best of my ability (and written in a plane heading home from Seattle to Fresno so this post will be without screen shots… I’ll have do to that at another time)…. the pieces you need to stand up a second server and make it a TS box in SBS 2008.

Step one: Buy SBS 2008 Premium. (like duh). Keeping in mind that you CAN use the premium sku and use one copy of the OS license to build a base to install the HyperV role and then you use your SBS 2008 media to build the box and then you install another copy of the same Windows 2008 standard to be the base for your TS box on that HyperV platform. It is fully legal to do what’s called a “one-plus-one” license where the Windows 2008 standard is a base that you put your SBS and Win2k3 second server on top of in virtualized form.

Step two: Buy TS cals. Terminal server … or in the 2008 R2 era, Remote Desktop Services (sorry, it’s going to take me a LONG time to stop calling it TS), need to have cals over and above the Windows Server cals that SBS 2008 provides to you. While you do not need Server cals for that second Win2k8 server as the cals are covered by the SBS box’s license eula, it does not cover TS cals and thus you need to have Server 2k8 cals to be legal… and for it to flat out work at all. Of all the licensing engines that Microsoft has that go to the Arthur Anderson school of counting cals (which means they can’t count worth beans), TS licensing engine actually does work to count the access and if you don’t have the TS server properly licensed, it will hand out temporary access for a certain period of time (90 days or something like that?) and then it will stop working .

Step three: I’m going to assume that you’ve already installed the SBS 2008 server and it’s working as you need it to do. Talk your Windows 2008 server license and install the second server and give it a local admin username password just for installation purposes. Join the second server manually to the domain.
http://www.microsoft.com/downloads/details.aspx?FamilyID=ad0d5500-1fbd-459e-bc58-137b6f2a4cb5&DisplayLang=en

Note this document assumes you know how to manually join a server to the domain. You can’t use http://connect to do so. You may need to go to the SBS 2008 console, go into computers, and add the name of what you plan your Server name to be. You may be asked for this computer name later on, and call it something descriptive so you know that It’s the member server in the domain. Then go into the system console settings on the server you are joining to the SBS 2008 domain and click on change network settings. Click on Network Identification tab and click on the fact that this computer is joining a domain. Indicate that you are joining a network with a domain and enter in the Admin account credentials, domain name and password .   Click next.   If it needs to know the computer name, supply it with the computer name you created from before.

Now you have to do two steps to move the Server into the right organizational unit and then to enable Remote Desktop on the second server so you can remote into it. While this is done automagically for clients via the http://connect wizard, it is not done for Servers added to the domain.
All Group Policy settings for client computers are applied to the second server with the exception of the Small Business Server Update Services Client Computers Group Policy setting. You must manually move the second server to the SBSServer organizational unit (OU) by using the Users and Computers administrative tool in Active Directory Domain Services.

To move the second server to the Servers category and apply the Group Policy settings for servers
1.   On the server that is running Windows SBS 2008, click Start, click Administrative Tools, and then click Active Directory Users and Computers.
2.   At the User Account Control prompt, click Continue.
3.   In the console tree, expand the root node, and then expand the node for your domain.
4.   Expand MyBusiness, expand Computers, and then click SBSComputers.
5.   In the details pane, right-click the name of the second server, and then click Move.
6.   In the Move dialog box, expand MyBusiness, and then expand Computers.
7.   Select SBSServers, and then click OK.

To enable the second server to connect from the server that is running Windows SBS 2008 or other clients using Terminal Services, you need to enable the remote desktop on the second server.
To enable a remote desktop connection to the second server
1.   On the second server, click Start, right-click Computer, and then click Properties.
2.   In the System dialog box, under Tasks, click Remote Settings.
3.   At the User Account Control prompt, click Continue.
4.   On the Remote tab of the System Properties dialog box, select the appropriate remote desktop options to allow connections from other computers that are using the remote desktop. If you are uncertain about which options to select for your environment, click Help me choose.
5.   Click OK to exit the dialog box.
So now you should have the second server added to the domain. IMPORTANT: If you have not moved the second server into the right Organizational Unit the Terminal Server Role won’t be a happy camper and it will be blocked from working on the TS box.

The next step (s) of the doc was taken from these sections of TechNet:

· Plan Server and Network Resources

· Choose the Licensing Mode

· Configure the Terminal Services Role

· Configure Terminal Services Licensing

· Deploy Windows Server 2008 Terminal Services RemoteApp

(At about this time in the flight I realized that the mhtml documents that I downloaded in the Seattle airport could not be viewed in IE and needed to be opened in Word, right mouse click and open in word allowed me to read them offline, in IE 8 on Win7 I had nothing on the page)

So first we need to plan and spec out the RAM needed for a TS box. I am not the expert here as only a few folks come in via the TS box. It would be best to ask on the SBS2k@yahoogroups.com listserve or your peers as to what they recommend especially for heavy use.

· Plan Server and Network Resources
So in the planning the server and network document it talks about how you need to spec that box accordingly and have enough ram PER expected user.    At one time the magical value on 2k3 era was 128 per person, and I would expect you’d want to bump that up these days.
Now in the planning doc is a very nice exact way to join the second server to the domain… handy when I’m trying to do this from memory on a Win7 laptop…

To join the second server to the Windows SBS 2008 network
1.   On the second server, click Start, right-click Computer, and then click Properties.
2.   In the System window, in Computer name, domain, and workgroup settings, click Change settings.
3.   In the User Account Control dialog box, click Continue. (My comment – if you are still using the original built in admin account on this second box, you won’t see a UAC prompt)
4.   In the System Properties dialog box, click Change.
5.   In the Computer Name/Domain Changes dialog box, type a new Computer name if needed, and then in Member of, click Domain, and then type the Domain name.
6.   Type the username and password for the user.
7.   Click OK to close the dialog boxes, and then restart the computer.

The doc also stresses again that the Server MUST MUST MUST be moved to the right OU otherwise the TS role install WILL FAIL.
If you do not move the server to the SBSServers OU in the Windows SBS 2008 network, the Terminal Services installation might fail.
To move the second server to the SBSServers OU and to apply Group Policy settings for servers to it, use the Users and Computers administrative tool in Microsoft® Active Directory® Domain Services, as follows:

To move the second server to the Server OU
1.   On the server that is running Windows SBS 2008, click Start, click Administrative Tools, and then click Active Directory Users and Computers.
2.   In the console tree, expand the root node, and then expand the node for your domain.
3.   Click to expand MyBusiness, click to expand Computers, and then click SBSComputers.
4.   In the details pane, right-click the second server, and then click Move.
5.   In the Move dialog box, click to expand MyBusiness, and then click to expand Computers.
6.   Click SBSServers, and then click OK.

It may take several minutes to refresh the Group Policy setting on the second server. To manually refresh the setting, do the following:
1.   On the second server, click Start, click Run, type cmd, and then click OK.
2.   At the command prompt, type gpupdate /force, and then press ENTER.
3.   Close the command prompt: Type exit, and then press ENTER.

Now we’re ready for the next step.

· Choose the Licensing Mode

I won’t bore you with the details, you can read that doc there, but basically you need to have from Volume licensing, your favorite “disti”, a purchase of either user TS cals or device TS cals. User cals follow along with the user, device follows along with the device. From the VL purchase you will get an agreement number (bear with me I’m going from memory here) that you will use later on in the licensing window on the server. If you are just using a “play” box, dig out of your action pack that piece of paper that has the sticker on it that is labeled Terminal Server cals. That is like a ‘retail’ purchase and uses the same licensing window, but a different part of the wizard to activate the cals.

· Configure the Terminal Services Role

The gotcha that may nail you at this step is if you forgot to move the Server to the Server OU and out of the computers OU on the SBS 2008 box.
On the server that is running Windows Server 2008 and that you plan to use as an additional server, configure the Terminal Services role.

To install the Terminal Services role
1.   Open Server Manager. To do this, click Start, click Administrative Tools, and then click Server Manager.
2.   In the User Account Control window, click Continue.
3.   In Roles Summary, click Add Roles. The Add Roles Wizard is displayed.
4.   On the Before You Begin page, click Next.
5.   On the Select Server Roles page, select the Terminal Services check box, and then click Next.
6.   On the Terminal Services page, click Next.
7.   On the Select Role Services page, select the Terminal Server check box, and then click Next.
8.   On the Uninstall and Reinstall Applications for Compatibility page, review the information, and then click Next.
9.   On the Specify Authentication Method for Terminal Server page, select the authentication method that you prefer, and then click Next.
10.   On the Specify Licensing Mode page, select the licensing mode that you prefer, and then click Next.
11.   On the Select User Groups Allowed Access To This Terminal Server page, add any users or groups that you want to add to the Remote Desktop Users group, and then click Next.
12.   On the Confirm Installation Selections page, confirm that you want to install the Terminal Services role service, and then click Install.
13.   On the Installation Results page, you are prompted to restart the server to finish the installation process. Click Close, and then click Yes to restart the server.
14.   After the server restarts, the Resume Configuration Wizard completes the installation. When the Installation succeeded message appears on the Installation results page, click Close.

This part should ‘just work’. If it doesn’t, bang yourself on your head for not reading that I wrote…what THREE TIMES now that you had to move the server into the right OU otherwise you were going to fail right here at this point.
Next up … get those TS cal documents out as you need them to enter in the licensing.

· Configure Terminal Services Licensing

Do not install the TS Licensing role service on the server that is running Windows SBS 2008.
Install the Terminal Server Licensing role service

To install the Terminal Server Licensing role service
1.   Open Server Manager. To do this, click Start, click Administrative Tools, and then click Server Manager.
2.   In the User Account Control window, click Continue.
3.   In the console pane, click Roles, and then click Terminal Services.
4.   In the console pane, in Role Services, click Add Role Services. The Add Role Services Wizard begins.
5.   On the Select Role Services page, select the TS Licensing check box.
6.   On the Configure Discovery Scope for TS Licensing page, specify the discovery scope for TS Licensing. To do this, click This domain, and then click Next.
7.   On the Confirm Installation Selections page, confirm that you want to install the TS Licensing role service, and then click Install.
8.   On the Installation Results page, confirm that the TS Licensing role service is successfully installed, and then click Close.

Activate the license server
The Terminal Services license server must be activated in order to certify the server and to allow the license server to issue permanent Terminal Services client access licenses (TS CALs). You can activate a license server by using the Activate Server Wizard in the TS Licensing Manager tool. If a license server is not activated, the license server can issue only temporary TS Per Device CALs, which are valid for 90 days, or temporary TS Per User CALs.

Note
There are other ways that you can activate a Terminal Services licensing server. For more information, see “Activating a Terminal Services License Server” at the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=131675 ).
Important

To activate the license server, you must be a member of the local Administrators group or equivalent on the license server.
To activate the license server
1.   Click Start, click Administrative Tools, click Terminal Services, and then, in Advanced Tools, click TS Licensing Manager.
2.   Right-click the license server that you want to activate, and then click Activate Server. The Activate Server Wizard opens.
3.   Click Next.
4.   On the Connection Method page, in the Connection Method list, click Automatic connection (recommended), and then click Next.
5.   Optional: Specify any other information that you want, such as e-mail and company addresses.
6.   Click Next. The license server is activated.
7.   On the Completing the Activate Server Wizard page, do one of the following:
•   To install TS CALs on you license server, ensure that the Start Install Licenses Wizard now check box is selected, click Next, and then follow the instructions.
•   To install TS CALs later, clear the Start Install Licenses Wizard now check box, and then click Finish.
Add client licenses to the license server
After you activate your Terminal Services license server, you can install TS CALs on it. You need a license code to install the CALs. A license code is provided when you purchase your TS CALs. For more information, see “Purchase client access licenses” at the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkID=81077).
Note
There are other ways that you can install TS CALs. For more information, see “Installing Terminal Services Client Access Licenses” at the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=13168 0).
Important
To add client licenses to the license server, you must be a member of the local Administrators group or equivalent on the license server.
To add client licenses to the license server
1.   Click Start, click Administrative Tools, click Terminal Services, and then click TS Licensing Manager.
2.   Right-click the license server on which you want to install TS CALs, and then click Properties.
3.   On the Connection Method tab, verify that the connection method for the Terminal Services license server is set to Automatic connection (recommended), and then click OK.
4.   In the console tree, right-click the Terminal Services license server on which you want to install the TS CALs, click Install Licenses to open the Install Licenses Wizard, and then click Next.
5.   On the License Program page, select the program through which you purchased your TS CALs, and then click Next.

THIS IS THE FUN PART – if it’s a VL license you wonder at first WHAT STUPID NUMBER THEY WANT!!!!! I think I finally figured out it was the License and agreement number which you should be able to see from your eopen.microsoft.com licensing window. The first time I did this I had to call up the licensing desk and they had to walk me through this part. It was not the most intuitive process the first time I did this.

The license program that you select determines what information you need to provide on the next page. In most cases, this includes either a license code or an agreement number. For more information, see the documentation provided when you purchased your TS CALs.
6.   Enter the license program information, and then click Next.
7.   On the Product Version and License Type page, select the appropriate product version, license type, and quantity of TS CALs for your environment, based on your TS CAL purchase agreement, and then click Next. The TS CALs are automatically installed onto the license server.
8.   On the Completing the Install Licenses Wizard page, click Finish.

Now that the box is “licensed” now comes the fun part.

· Deploy Windows Server 2008 Terminal Services RemoteApp

That doc does a pretty good job of giving the right info so I won’t reprint it here…(not to mention this blog post will be long enough as it is) Charlie Russel will be going over TS Remote Apps coolness in a presentation on Killer Win2k8 features at SMBNation in Las Vegas. So for those that are planning to attend, check out his session.

Last but certainly not least … this one is also a must have. Now interestingly enough on the TechNet pages, it’s not listed in the TS section of the web site but in the RWW section, so I always forgot where it was until I put a notation at the bottom of Technet. Anyone can add community content to the bottom of technet documentation, but please, do not consider them replacements for newsgroups and forums. I’ve see questions posted on the pages, and that’s not what that community annotation section is for.

So the final step is to put the registry key in place to get the TS box to show up in RWW. Yes, it doesn’t natively occur. Why? Dunno. But the good news is that SBS DOES do this whereas EBS does not expose this ability. They have to use TSgateway and TSremote apps and publish and RDP short cut on their RWW page whereas SBS at least has the ability to expose it.

To do so follow the following instructions:

To add a Terminal Services server in Application mode to the Select Computer drop-down list in Remote Web Workplace

Open Registry Editor.
Open the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SmallBusinessServer\RemoteUserPortal

Note If the RemoteUserPortal key does not exist, create it.

Create the following multi-string (REG_MULTI_SZ) key:
TsServerNames

Type the name of your terminal services server. Type one name per line.

Verify that the name is exactly the same as the server. If a server key already exists, modify its value. If the type isn’t correct, remove it first, and then recreate it.
Click OK.

To create a new registry key that shows all computers
Open Registry Editor. To do this, click Start, in the search field type regedit, and then press ENTER.
In the User Account Control window, click Continue.
Browse to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SmallBusinessServer.
Right-click SmallBusinessServer, click New, and then click Key.
Name the key BusinessProductivity.
Right-click BusinessProductivity, click New, and then click DWORD (32-bit) Value.
Name the new value ShowAllComputers.
Double-click ShowAllComputers, and then, in the Value data text box, type 1.
Click OK, and then close Registry Editor.

In addition to this setting there is a value to extend the time out amount in the Remote Web Workplace session . I forgot to grab that page before I got on the plane in Seattle but when I get back on the ground and on an Internet connection I’ll grab that info and put it up in a follow up blog post.

Edit -- Back in Fresno -- the way to edit this value is here: http://blogs.technet.com/sbs/archive/2009/06/15/how-to-configure-the-rww-timeout.aspx

Now for another follow up blog post… I’ll post up the instructions for how to ensure that Quickbooks runs on a TS box in a 64 bit environment. We’ve had mixed results getting the native PDF printer to work nicely. I’ve blogged some posts previously about how to do it and some folks say it worked for them, some folks say it did not. Some folks have used the “go around it and find some other equivalent app that works nicer in the form of CutePDF as the native PDF writer.

Also if you have a fax in the SBS 2008 network and want TS users to be able to fax you have to add the Fax server role ON the TS box as well as the TS role. If you want to use the Outlook Address Book with fax, the user needs to have an Outlook profile configured with the Fax Mail Transport added. (Thanks to ChrisP for that tip)

If you want to try out Office 2007 on your TS box you MUST have volume license version of Office 2007, most action pack folks do not get a version of Office that will allow it to be installed on a TS box. I’ve heard that in Germany (don’t quote me email your MS rep to confirm) that in Germany partners can request a VL media kit for Office for action pack subscribers. I need to confirm if that is true, I just read a partner posting that in one of the partner forums.

So hopefully that organizes a bit better all of the Terminal server install info into one blog post and not to mention kept me entertained during the flight back home. The plane is starting to get close to Fresno, so it’s time for me to shut down the laptop as well.

(now back home and editing up the post... word is not the greatest of blog editor.. lemme tell ya)

Operation FACEBOOK is on right NOW!

bradley — Thu, 02 Jul 2009 23:07:00 GMT

http://www.facebook.com/pages/Windows-Small-Business-Server/88799484644

Okay troops. We have a mission. Click on that link. If you aren't a facebook person, become one. Now. As we have a mission to get SBS a vanity url "fan" page faster than EBS 2008 did. We need 100 "fans" as soon as possible.

http://www.facebook.com/pages/Windows-Small-Business-Server/88799484644

So click on that link and become a fan and lets get to 100 faster than EBS did. The race is on. On your marks, get ready, GO!

So step one Operation FACEBOOK is on right NOW!

Stay tuned for the SBS twitter feed next.....

..yeah yeah Susan blogging about twitter... what is the world coming to?

So have you attended a SBS build day?

bradley — Tue, 09 Jun 2009 19:01:00 GMT

YouTube - Small Business Server (SBS) 2008 Build Day, May 30, 2009 (Redmond, WA):
http://www.youtube.com/watch?v=nFl29aCMd8Q

So have you attended a SBS build day? One of the recent ones is showcased here in this video. I just love the "golf talk" that Harry is doing in the hallway. These sessions are designed for the small shops that haven't had the chance of 'touching' SBS 2008 directly.

6/13/2009

9:00 AM - 4:00 PM

Welcome Time: 8:30 AM

Time Zone: Pacific

Click to Attend:
https://www.clicktoattend.com/invitation.aspx?code=138261&wa=wsignin1.0
One is coming up this weeking in the So Cal area...

QuickStart Training Facility

16815 Von Karman Avenue, Suite 100

Irvine, CA 92606

Event Cost: In-Person – $25.00 (includes breakfast & lunch) – Cash Only Please

This event will showcase a live step-by-step SBS 2008 build, including joining XP Pro and Vista clients to the domain and a review of the other post-installation Getting Started Tasks. Interspersed throughout the build will be discussions of various topics such as:
• Minimum and recommended hardware requirements
• Use of the Answer File
• Network changes from SBS 2003
• The new Management Console
• Other highly useful information
Following the networking luncheon we will discuss:
• Migration tasks, experiences and caveats
• Securing SBS 2008 with AuthAnvil (Dana Epp – Microsoft MVP)
• SBS 2008 Gotchas (Susan Bradley – Microsoft MVP)
• Licensing
• Mobility

Live Meeting Available – Please do NOT register using this link, email suzl@mcirosoft.com to register for Live Meeting, indicate which date you'll be attending.

And send us photos and videos from Southern California!

Default SBS 2008 running Services

bradley — Sat, 06 Jun 2009 01:47:00 GMT

Name	Status	Startup Type	Log On As

Active Directory Certificate Services	Started	Automatic	Local System
Active Directory Domain Services	Started	Automatic	Local System
AdoNavSvc		Manual	Local System
Application Experience	Started	Automatic	Local System
Application Host Helper Service	Started	Automatic	Local System
Application Information	Started	Manual	Local System
Application Layer Gateway Service		Manual	Local Service
Application Management		Manual	Local System
ASP.NET State Service		Manual	Network Service
Background Intelligent Transfer Service	Started	Automatic (Delayed Start)	Local System
Base Filtering Engine	Started	Automatic	Local Service
Block Level Backup Engine Service	Started	Manual	Local System
Certificate Propagation	Started	Manual	Local System
CNG Key Isolation		Manual	Local System
COM+ Event System	Started	Automatic	Local Service
COM+ System Application		Manual	Local System
Computer Browser		Disabled	Local System
Cryptographic Services	Started	Automatic	Network Service
DCOM Server Process Launcher	Started	Automatic	Local System
Desktop Window Manager Session Manager	Started	Automatic	Local System
DFS Namespace	Started	Automatic	Local System
DFS Replication	Started	Automatic	Local System
DHCP Client	Started	Automatic	Local Service
DHCP Server	Started	Automatic	Local System
Diagnostic Policy Service	Started	Automatic	Local Service
Diagnostic Service Host		Manual	Local Service
Diagnostic System Host	Started	Manual	Local System
Distributed Link Tracking Client		Manual	Local System
Distributed Transaction Coordinator	Started	Automatic (Delayed Start)	Network Service
DNS Client	Started	Automatic	Network Service
DNS Server	Started	Automatic	Local System
Dynamic DNS Client		Disabled	Local Service
Extensible Authentication Protocol		Manual	Local System
File Replication Service	Started	Automatic	Local System
File Server Resource Manager	Started	Automatic	Local System
File Server Storage Reports Manager		Manual	Local System
FSCController	Started	Manual	Local System
FSCMonitor	Started	Manual	Local System
FSCStatisticsService	Started	Manual	Local System
FSEIMC		Manual	Network Service
FSEMailPickup	Started	Manual	Network Service
FTP Publishing Service		Manual	Local System
Function Discovery Provider Host		Manual	Local Service
Function Discovery Resource Publication		Manual	Local Service
Group Policy Client	Started	Automatic	Local System
Health Key and Certificate Management		Manual	Local System
Human Interface Device Access	Started	Automatic	Local System
Hyper-V Data Exchange Service	Started	Automatic	Local Service
Hyper-V Guest Shutdown Service	Started	Automatic	Local System
Hyper-V Heartbeat Service	Started	Automatic	Network Service
Hyper-V Time Synchronization Service	Started	Automatic	Local Service
Hyper-V Volume Shadow Copy Requestor	Started	Automatic	Local System
IIS Admin Service	Started	Automatic	Local System
IKE and AuthIP IPsec Keying Modules	Started	Automatic	Local System
Interactive Services Detection		Manual	Local System
Internet Connection Sharing (ICS)		Disabled	Local System
Intersite Messaging	Started	Automatic	Local System
IP Helper	Started	Automatic	Local System
IPsec Policy Agent	Started	Automatic	Network Service
Kerberos Key Distribution Center	Started	Automatic	Local System
KtmRm for Distributed Transaction Coordinator	Started	Automatic (Delayed Start)	Network Service
Link-Layer Topology Discovery Mapper		Manual	Local Service
Microsoft .NET Framework NGEN v2.0.50727_X64		Manual	Local System
Microsoft .NET Framework NGEN v2.0.50727_X86		Manual	Local System
Microsoft Exchange Active Directory Topology Service	Started	Automatic	Local System
Microsoft Exchange Anti-spam Update	Started	Automatic	Local System
Microsoft Exchange EdgeSync		Disabled	Local System
Microsoft Exchange File Distribution	Started	Automatic	Local System
Microsoft Exchange IMAP4		Manual	Local System
Microsoft Exchange Information Store	Started	Automatic	Local System
Microsoft Exchange Mail Submission	Started	Automatic	Local System
Microsoft Exchange Mailbox Assistants	Started	Automatic	Local System
Microsoft Exchange Monitoring		Manual	Local System
Microsoft Exchange POP3		Manual	Local System
Microsoft Exchange Replication Service	Started	Automatic	Local System
Microsoft Exchange Search Indexer	Started	Automatic	Local System
Microsoft Exchange Server Extension for Windows Server Backup		Manual	Local System
Microsoft Exchange Service Host	Started	Automatic	Local System
Microsoft Exchange System Attendant	Started	Automatic	Local System
Microsoft Exchange Transport	Started	Automatic	Network Service
Microsoft Exchange Transport Log Search	Started	Automatic	Local System
Microsoft Fibre Channel Platform Registration Service		Manual	Local Service
Microsoft iSCSI Initiator Service		Manual	Local System
Microsoft Search (Exchange)	Started	Manual	Local System
Microsoft Software Shadow Copy Provider		Manual	Local System
Multimedia Class Scheduler		Manual	Local System
Net.Tcp Port Sharing Service		Disabled	Local Service
Netlogon	Started	Automatic	Local System
Network Access Protection Agent		Manual	Network Service
Network Connections	Started	Manual	Local System
Network List Service	Started	Automatic	Local Service
Network Location Awareness	Started	Automatic	Network Service
Network Policy Server	Started	Automatic (Delayed Start)	Local System
Network Store Interface Service	Started	Automatic	Local Service
Offline Files		Disabled	Local System
Performance Counter DLL Host		Manual	Local Service
Performance Logs & Alerts		Manual	Local Service
Plug and Play	Started	Automatic	Local System
PnP-X IP Bus Enumerator		Disabled	Local System
Print Spooler	Started	Automatic	Local System
Problem Reports and Solutions Control Panel Support		Manual	Local System
Protected Storage		Manual	Local System
Remote Access Auto Connection Manager		Manual	Local System
Remote Access Connection Manager	Started	Manual	Local System
Remote Access Quarantine Agent		Manual	Local Service
Remote Procedure Call (RPC)	Started	Automatic	Network Service
Remote Procedure Call (RPC) Locator		Manual	Network Service
Remote Registry	Started	Automatic	Local Service
Resultant Set of Policy Provider		Manual	Local System
Routing and Remote Access		Disabled	Local System
RPC/HTTP Load Balancing Service	Started	Manual	Network Service
Secondary Logon	Started	Automatic	Local System
Secure Socket Tunneling Protocol Service	Started	Manual	Local Service
Security Accounts Manager	Started	Automatic	Local System
Server	Started	Automatic	Local System
Server Infrastructure License Service	Started	Automatic	Local System
Shell Hardware Detection	Started	Automatic	Local System
SL UI Notification Service	Started	Manual	Local Service
Smart Card		Manual	Local Service
Smart Card Removal Policy		Manual	Local System
SNMP Trap		Manual	Local Service
Software Licensing	Started	Automatic	Network Service
Special Administration Console Helper		Manual	Local System
SQL Server (SBSMONITORING)	Started	Automatic	Local System
SQL Server Active Directory Helper		Disabled	Network Service
SQL Server Browser		Disabled	Local System
SQL Server FullText Search (SBSMONITORING)	Started	Automatic	Local System
SQL Server VSS Writer	Started	Automatic	Local System
SSDP Discovery	Started	Automatic	Local Service
Superfetch		Disabled	Local System
System Event Notification Service	Started	Automatic	Local System
Task Scheduler	Started	Automatic	Local System
TCP/IP NetBIOS Helper	Started	Automatic	Local Service
Telephony	Started	Manual	Network Service
Terminal Services	Started	Automatic	Network Service
Terminal Services Configuration	Started	Manual	Local System
Terminal Services Gateway	Started	Automatic	Network Service
Terminal Services UserMode Port Redirector	Started	Manual	Local System
Themes		Disabled	Local System
Thread Ordering Server		Manual	Local Service
TPM Base Services		Automatic (Delayed Start)	Local Service
Update Services	Started	Automatic (Delayed Start)	Network Service
UPnP Device Host	Started	Automatic	Local Service
User Profile Service	Started	Automatic	Local System
Virtual Disk	Started	Manual	Local System
Volume Shadow Copy		Manual	Local System
Web Management Service		Manual	Local Service
Windows Audio		Manual	Local Service
Windows Audio Endpoint Builder		Manual	Local System
Windows CardSpace		Manual	Local System
Windows Color System		Manual	Local Service
Windows Driver Foundation - User-mode Driver Framework		Manual	Local System
Windows Error Reporting Service	Started	Automatic	Local System
Windows Event Collector		Manual	Network Service
Windows Event Log	Started	Automatic	Local Service
Windows Firewall	Started	Automatic	Local Service
Windows Installer		Manual	Local System
Windows Internal Database (MICROSOFT##SSEE)	Started	Automatic	Network Service
Windows Management Instrumentation	Started	Automatic	Local System
Windows Modules Installer	Started	Manual	Local System
Windows Presentation Foundation Font Cache 3.0.0.0		Manual	Local Service
Windows Process Activation Service	Started	Manual	Local System
Windows Remote Management (WS-Management)	Started	Automatic (Delayed Start)	Network Service
Windows SBS Manager	Started	Automatic	Local System
Windows SBS POP3 Connector		Disabled	Local Service
Windows SharePoint Services Administration		Manual	Local System
Windows SharePoint Services Search	Started	Manual	Local Service
Windows SharePoint Services Timer	Started	Automatic	Network Service
Windows SharePoint Services Tracing	Started	Automatic	Local Service
Windows SharePoint Services VSS Writer	Started	Automatic	Network Service
Windows Time	Started	Automatic	Local Service
Windows Update	Started	Automatic (Delayed Start)	Local System
WinHTTP Web Proxy Auto-Discovery Service	Started	Manual	Local Service
Wired AutoConfig		Manual	Local System
WMI Performance Adapter		Manual	Local System
Workstation	Started	Automatic	Local Service
World Wide Web Publishing Service	Started	Automatic	Local System
WSusCertServer		Manual	Local System

That is the default listing of the running SBS 2008 services and their status on a freshly built box. The spreadsheet is also here: http://msmvps.com/media/p/1694295.aspx

The default SBS 2008 firewall

bradley — Thu, 04 Jun 2009 03:29:00 GMT

When working with the default SBS 2008 firewall... don't click on that button for "Restore defaults" as you will find that it will not put back the Exchange ports you need.

So if you are looking for an example of what's supposed to be there... I have attached some spreadsheets of the default policies on a cleanly built box.

The raw firewall policy here -- http://msmvps.com/media/p/1693770.aspx (please note that Exchange is on the local C: drive in this raw clean policy)

An excel spreadsheet of what the inbound policy is -- http://msmvps.com/media/p/1693771.aspx

An excel spreadsheet of what the outbound policy is -- http://msmvps.com/media/p/1693772.aspx

Use these links instead:

http://msmvps.com/media/p/1721425.aspx

http://msmvps.com/media/p/1721424.aspx

http://msmvps.com/media/p/1721422.aspx

Yes you can

bradley — Tue, 02 Jun 2009 01:12:00 GMT

http://en.wikipedia.org/wiki/Windows_Small_Business_Server

I noticed something wrong on the SBS 2008 wikipedia entry. You can now indeed use the same service packs. Technically since post SBS 2003 R2 era you no longer need unique service packs for SBS. I guess I can put that but in case folks don't read the R2 part in it, it is probably easier to say SBS 2008. Now SBS uses update rollups to specifically patch unique parts of SBS. All other service packs for the parts of SBS can be applied just like the normal server parts.

Group policy Defaults for SBS 2008

bradley — Sat, 30 May 2009 05:10:00 GMT

Links to to detailed pages that show the group policy settings

Under Domain Controllers
Default Domain Controllers Policy

Under MyBusinessOU, Computers, SBSComputers

Under MyBusinessOU, Users, SBSUsers
Small Business Server Folder Redirection Policy

An entire zip file of the raw (as in no wizards run) Group policy settings of a freshly built SBS 2008 box if you need to do any comparisons for any reason is located here: http://msmvps.com/media/p/1693429.aspx

So what's the default group policies for SBS 2008?

bradley — Fri, 29 May 2009 03:29:00 GMT

Ignore this post. I picked the SBS 2008 box that was in the middle of the migration from SBS 2003 to SBS 2008.

I'll redo this post (and format them a better way) and post up the default Group policy settings.

Starting off with the first policy - Default Domain Policy

Default Domain Policy
Data collected on: 5/28/2009 3:12:20 PM

General

Details

Domain	smallbusiness.local
Owner	SMALLBUSINESS\Domain Admins
Created	5/24/2009 10:01:50 PM
Modified	5/25/2009 8:48:04 PM
User Revisions	1 (AD), 1 (sysvol)
Computer Revisions	7 (AD), 7 (sysvol)
Unique ID	{31B2F340-016D-11D2-945F-00C04FB984F9}
GPO Status	Enabled

Links

Location	Enforced	Link Status	Path
smallbusiness	No	Enabled	smallbusiness.local

This list only includes links in the domain of the GPO.

Security Filtering

The settings in this GPO can only apply to the following groups, users, and computers:

Name
NT AUTHORITY\Authenticated Users

WMI Filtering

WMI Filter Name	None
Description	Not applicable

Delegation

These groups and users have the specified permission for this GPO

Name	Allowed Permissions	Inherited
NT AUTHORITY\Authenticated Users	Read (from Security Filtering)	No
NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS	Read	No
NT AUTHORITY\SYSTEM	Edit settings, delete, modify security	No
SMALLBUSINESS\Domain Admins	Edit settings, delete, modify security	No
SMALLBUSINESS\Enterprise Admins	Edit settings, delete, modify security	No

Computer Configuration (Enabled)

Policies

Windows Settings

Security Settings

Account Policies/Password Policy

Policy	Setting
Enforce password history	24 passwords remembered
Maximum password age	0 days
Minimum password age	0 days
Minimum password length	0 characters
Password must meet complexity requirements	Disabled
Store passwords using reversible encryption	Disabled

Account Policies/Account Lockout Policy

Policy	Setting
Account lockout duration	10 minutes
Account lockout threshold	50 invalid logon attempts
Reset account lockout counter after	10 minutes

Account Policies/Kerberos Policy

Policy	Setting
Enforce user logon restrictions	Enabled
Maximum lifetime for service ticket	600 minutes
Maximum lifetime for user ticket	10 hours
Maximum lifetime for user ticket renewal	7 days
Maximum tolerance for computer clock synchronization	5 minutes

Local Policies/Security Options

Network Security

Policy	Setting
Network security: Force logoff when logon hours expire	Disabled

Public Key Policies/Encrypting File System

Certificates

Issued To	Issued By	Expiration Date	Intended Purposes
Administrator	Administrator	5/23/2012 10:05:09 PM	File Recovery

For additional information about individual settings, launch Group Policy Object Editor.

Public Key Policies/Trusted Root Certification Authorities

Properties

Policy	Setting
Allow users to select new root certification authorities (CAs) to trust	Enabled
Client computers can trust the following certificate stores	Third-Party Root Certification Authorities and Enterprise Root Certification Authorities
To perform certificate-based authentication of users and computers, CAs must meet the following criteria	Registered in Active Directory only

User Configuration (Enabled)

Policies

Windows Settings

Remote Installation Services

Client Installation Wizard options

Policy	Setting
Custom Setup	Disabled
Restart Setup	Disabled
Tools	Disabled

Another way to get to that open folder do-dad thingy

bradley — Fri, 08 May 2009 03:21:00 GMT

http://msmvps.com/blogs/bradley/archive/2009/05/06/so-exactly-where-is-the-open-folder-do-dad-in-sbs-2008.aspx

Okay so there's another way that's probably easier and is honestly the same as SBS 2003.

Start

Administrative Tools

Computer management

I'm probably still going to do a short cut on the desktop.

Blowing up drive mirroring

bradley — Mon, 30 Mar 2009 06:08:00 GMT

One of the cool things about having a HyperV test lab is that you can do things like blow up servers and it doesn't matter.

So as a follow up I was asked about booting from the secondary drive when the primary fails.

MirrorDynamicDisksServer2003 < NexusDocumentation < TWiki:
http://www.freebsd.uwaterloo.ca/twiki/bin/view/NexusDocumentation/MirrorDynamicDisksServer2003

When I blew off the main C: drive on my HyperV test I was indeed able to boot into that secondary plex. When you set up a software mirror you will note that you now get a new boot screen like so:

Now let's test that the system will work from the mirror.

We're just going to nuke that drive.

Once we nuke the disk we will select the secondary drive option to test the boot up.

If we'd let it boot from the first drive, it would fail.

But if we choose Windows 2008 - Secondary Plex by scrolling down to it and choosing it as the bootable option, we can boot the box.

Select the secondary plex and the box will boot even though we've just blown off the main drive.

Remember we just nuked the hard drive and the system is still booting up.

When we log in we find that we are missing a drive. (remember I removed it from the HyperV setup but the vhd is still on the computer undeleted)

As you can see it's booted up but it knows it's not a happy camper.

Okay so now let's test putting that drive back online.

In our HyperV test, we're going to go back into the settings and add that existing vhd back. We click on New and then copy the location back in and click ok.

We turn it back on and let it boot back as it was.

We will have an unhappy camper in Disk Management, so make sure you go back and fix the mirror.

You can't reactivate the missing disk you have to import the foreign disk.

Choose the mirrored drive and set the mirror back up as it should be.

Now back to happy campers.

Now I'm sure you'll ask but what if you need to blast off the original drive. No prob, you just go into the boot.ini file and edit out the so that the system boots from the main drive, then you rebuild the mirror with a new disk.

Alternatively you can use fixmbr - http://pcsupport.about.com/od/termsf/p/fixmbr.htm and that will set up a new boot record.

Bottom line, get a box, load up a hyperV, build a SBS and start blowing things up.

Basic Software Raid in SBS 2008

bradley — Sun, 29 Mar 2009 08:05:00 GMT

I was wondering if you know where I could learn how to set up software mirrored disks for the C: drive in a SBS 2008 system. This is an AT BIOS machine (not EFI), and using MBR disks (not GPT). Microsoft has kb951985 for the GPT disk case, I'm looking for a corresponding procedure for MBR disks.

MBR is pretty easy. A step by step is here: http://www.techotopia.com/index.php/Mirroring_Windows_Server_2008_System_Disks but basically the process is that once you add a second drive to the server the drive will want to be initiallized. Choose the type of drive of MBR

Go into computer management and it will see the new drive.

Click on Disk Management and you'll need to then initialize the disk.

Choose MBR as the type of drive.

Now convert the main drive to a dynamic drive to prepare it for software mirroring. (Of course make a backup first).

Choose the drive

Click through the "are you really sure" messages.

Now that the main drive is dynamic, right mouse click on that C drive and and choose "Add Mirror"

Select the other drive to make the mirror on.

Convert the mirror to a dynamic drive as well

You'll notice the sync is now underway.

Some RAID purists will say you need a hardware raid and that software isn't good enough. One thing to keep in mind is that with this basic software raid you don't have a lot of diagnostics as to what is going on with the underlying raid sync.

But if you want cheap raid, throw another drive in a system and see how easy it is to set it up.

Changing your Domain name will prevent faxes from being e-mailed:

bradley — Sat, 28 Mar 2009 04:42:00 GMT

Changing your Domain name will prevent faxes from being e-mailed:
http://support.microsoft.com/kb/969552/en-us

The Internet Address Management wizard was run a second time and the domain name was changed. The fax repair task does not run as a part of the Internet Address Management Wizard, and the fax emails are still configured to send as SBSFaxService@domain1.com. When the domain name is changed to domain2.com, the fax service no longer has access to send as domain1.com and the emails will get rejected

1. Launch the SBS Administration console in advanced mode and repair
fax.
2. Click Start, All Programs, Windows Small Business Server, Windows
SBS Console (Advanced).
3. On the Network tab, click the Devices sub-tab.
4. Choose repair fax.

SBS2008's Internet Address Management Wizard - Under the Hood

bradley — Sun, 08 Mar 2009 00:19:00 GMT

SBS2008's Internet Address Management Wizard - Under the Hood - Peter Gallagher's TS2 Blog:
http://ts2blogs.com/blogs/petergal/archive/2009/03/07/sbs2008-s-internet-address-management-wizard-under-the-hood.aspx

The internet management wizard is one of the important wizards in SBS 2008. As Peter said the sound sounds a little tinny but it's worth the watch and the listen for sure!

One nice thing is it goes over the domain name options. There have been folks in the newsgroups questioning the difference between the domain name options for the first and second ones.

So how do I get a 64 bit patch when I only see 32 bit?

bradley — Thu, 12 Feb 2009 07:53:00 GMT

http://msmvps.com/blogs/bradley/archive/2009/02/11/trend-wfbs-5-1-on-sbs-2008-sbsfaq-com-blog-site.aspx

So you are probably wondering how I got the 64 bit version of the patch when you can only see 32 bit, right? There's a secret.

Go to the hotfix page. http://support.microsoft.com/hotfix/KBHotfix.aspx?kbnum=961775&kbln=en-us Click I accept.

See where is says "show hotfixes for all platforms and languages"? Click there.

See how now you can click on and see the other build versions of this patch?

There ya go, that's how you see the other versions and select to get them.

Follow up to "clean install"

bradley — Wed, 11 Feb 2009 15:10:00 GMT

Some follow up comments on the "clean install" post.

http://msmvps.com/blogs/bradley/archive/2009/02/09/so-ya-wanna-do-a-clean-install-in-an-existing-network.aspx

First off read the comments as there's some excellent reminders in there:

1. Set up a local admin username and password on that system before you disjoin them from the network. ESPECIALLY VISTA workstations. If you don't and you don't know that local admin password, you could be using the NT boot disk to reset the password.

2. Outlook is never set up on the server. The 'export to pst' is always done on the workstations, ergo the sneakernetting one has to do.

3. Dig out that "So fish out the .nk2 file from their old profile, then slap them about to remind them that autocomplete does not equal contacts!." because when you reattach the workstations, you get a new .nk2 autocomplete file. It will indeed bother clients that got blown up.

As you can tell from the number of comments, others have also done this 'go around the domain and rebuild it' because they didn't feel comfy with what they had to work with.

Outlook Anywhere and IPv6

bradley — Mon, 09 Feb 2009 02:18:00 GMT

From the comments in the blog --

Exchange 2007 / Server 2008 have the issue where if IPv6 is enabled, Outlook Anywhere doesn't work. Do you know if SBS 2008 has same issue? I would assume it does? The only way to resolve is to disable ipv6. And to do that you have to untick the ipv6 box as well as disable ipv6 via registry.

No, SBS 2008 does not have this issue. Again, let me make myself very clear. Ensure that you do NOT untick IPv6 on SBS 2008.

http://technet.microsoft.com/en-us/library/cc671176.aspx This doesn't apply to SBS. I'll get the details as I don't remember the exact technical reason it doesn't apply whether it's due to Exchange being on the Domain Controller and thus being able to see itself, or if it's the magic done but the SBS 2008 team but no, do not disable ipv6 on SBS 2008. Outlook Anywhere works with IPv6 enabled and the Server needs it enabled as well.