Aimless Ramblings from a Blithering Lunatic . . . : SBS

MSKB 961143 fails to install on SBS 2003

cgross — Sat, 15 May 2010 02:53:51 GMT

So I’m having an exciting Friday night at home catching up on some support tickets, and I have one monitoring ticket for one of my managed SBS 2003 boxes where Microsoft update 961143 fails to install repeatedly. Normally, whenever I have a patch that fails to install via Kaseya – simply logging in to the device & running Windows Update to install the problem patch resolves the issue. Yeah – not so much with this one. Installing the update via Windows Update, or by downloading the update & running it manually – it consistently fails. Running the install manually, I just get a pop-up saying something vague to the effect that installation failed and click OK to undo changes. I searched the web, and continually found thread after thread after thread of people having the same issue, but no solution. Some suggested solutions included verifying the companyweb site was using the default app pool, some saying to check a registry key or two – but nothing worked.

The windowsupdate.log was vague – and the error code it provided (0x8007f070) didn’t help any with my web searches either. I then dug down and found the individual update installation log (%temp%\QFE73170.log) and reviewed its contents:

2010/05/14 21:33:36    --------------------------------------------------------------
2010/05/14 21:33:36    begin installing the fix
2010/05/14 21:33:36    enable kerberos if necessary on companyweb
2010/05/14 21:33:36    the current start type of iis admin service is: 2
2010/05/14 21:33:36    find virtual server id of hostName: companyweb
2010/05/14 21:33:36    iterate through each IISWebServer under IIS://localhost/w3svc
2010/05/14 21:33:36    current server binding: IIS://localhost/w3svc/1, 192.168.16.2:80:
2010/05/14 21:33:36    current server binding: IIS://localhost/w3svc/1, 127.0.0.1:80:
2010/05/14 21:33:37    current server binding: IIS://localhost/w3svc/2, :6345:
2010/05/14 21:33:37    current server binding: IIS://localhost/w3svc/3, :8081:
2010/05/14 21:33:37    current server binding: IIS://localhost/w3svc/4, 192.168.16.2:80:companyweb
2010/05/14 21:33:37    found virtual server, server path is: IIS://localhost/w3svc/4/root
2010/05/14 21:33:37    get single property: IIS://localhost/w3svc/4/root,AppPoolID
2010/05/14 21:33:37    get single property successfully
2010/05/14 21:33:37    current virtual server is using app pool: DefaultAppPool
2010/05/14 21:33:37    get single property: IIS://localhost/w3svc/apppools/DefaultAppPool,AppPoolIdentityType
2010/05/14 21:33:37    get single property successfully
2010/05/14 21:33:37    identity of current virtual server's app pool is: 0
2010/05/14 21:33:37    not using network service to run current virtual server

That last line in the log was the key: For whatever reason, MSKB 961143 will bomb out if the DefaultAppPool is not using the NETWORK SERVICE identity. I opened up IIS Admin, expanded <server> | Application Pools. I right-clicked on DefaultAppPool and selected Properties. I then went to the Identity tab on the app pool properties page, and sure enough – my DefaultAppPool was running under the LOCAL SYSTEM identity. I changed the identity from LOCAL SYSTEM to NETWORK SERVICE, and clicked OK to save the changes. Back in IIS Admin, I right-clicked on the DefaultAppPool again and selected Recycle to stop & restart the app pool. After recycling the DefaultAppPool, I re-ran the KB 961143 installer and the update installed successfully.

Killing off ISA

cgross — Mon, 12 Oct 2009 04:31:08 GMT

Earlier today Susan blogged about upgrade season in her office, and getting ready to migrate from SBS 2003 to 2008. In that post, she talked about uninstalling ISA and mentioned a post that Kevin has on that subject. I thought I’d take a moment to expand a little bit on Kevin’s post and add a few thoughts from my own battle scars with removing ISA.

First and foremost – Kevin mentions removing the ISA firewall client from all of your PCs before you remove ISA from the server. I cannot overstate how crucial this step is. The ISA 2004 firewall client uninstaller wants access to the original installation MSI, which lives in a share on your SBS box. This share is actually the Clients folder in the ISA installation directory. So what happens when you remove ISA from your SBS? You guessed it – the mspclnt share with the firewall client installation files is removed, which means any firewall clients still installed on PCs are not going to be happy when you try to remove them and they can’t find the MSI.

Since the Clients folder under the ISA installation folder is typically only about 5MB, I copy this folder to a safe spot on the server – usually my Tech directory where we keep various utilities and scripts. Here’s why – more and more, customers are backing up their workstations whether via Acronis / StorageCraft / Windows Home Server. We may find ourselves at a point in the not so distant future after removing ISA that we need to restore a PC from an image taken before ISA was removed, and need to remove the firewall client again. Or we may discover a forgotten PC / laptop that we missed removing the firewall client from. There’s all sorts of scenarios – but by keeping the Clients folder in-tact, we can share that out with the original mspclnt share name at any time and be able to uninstall the firewall client just like ISA was still installed on the server. Without the mspclnt share, you have a very VERY ugly path in front of you, and it is safe to say that you may end up facing the decision of living with the firewall client still on the machines, or wiping & re-installing the OS . . .

Second – Kevin also makes a brief mention about proxy settings. When you uninstall the firewall client from a PC, it will automatically disable proxy settings for the user account that is running the uninstall, but not for any other users on the machine. So if you have a PC that multiple users log in to, or if you are running a terminal server, be prepared for some proxy pain. I actually have a little VBScript that disables proxy settings for the current user by changing the value of the HKCU\Software\Microsoft\Windows\CurrentVersion\InternetSettings\ProxyEnable key from 1 to 0. I modify my login script to call the VBScript, in effect ensuring proxy gets disabled for each user when they log in to each machine.

The other aspect with proxy settings to keep in mind are your server-side applications. Unless you modified your ISA firewall policy to allow unauthenticated outbound http access from the server itself, you most likely specified proxy information for apps like Trend Micro’s Worry-Free Business Security or even WSUS – so that they can download their updates automatically. After removing ISA, you no longer have a proxy server, which means apps configured to use a proxy aren’t going to be able to get out to the internet. As a result, you stop getting automatic updates for things like A/V. So you will need to manually update the connection settings in these apps to remove the proxy settings previously defined.

So – here’s my quick checklist for removing ISA from your network & installing a hardware firewall:

Prep your hardware firewall in a lab setting. Enter in all public IP info, disable DHCP, and create all of our inbound rules. It’s best to do this while ISA is still installed & working, so you can refer to the rules in ISA to make sure you don’t miss any necessary inbound rules for your environment.
Backup your ISA configuration. While we’re moving away from ISA permanently, if we do encounter an issue with the new hardware solution where something isn’t working that was working with ISA, the ISA backup is an XML file that is relatively easy to read to see what rules you had and what they did without having to reinstall & restore ISA on your SBS.
Open up your outbound access in ISA by creating the proverbial ALL/ALL/ALL rule. In other words, create a new access rule in ISA allowing All outbound traffic via all protocols for all users/computers. Much of the internet access in ISA on SBS is dependent on users being members of the Internet Users security group. The firewall client on the PCs is what actually passes user info to the ISA server so it can check group membership. Once we remove the firewall client from PCs, ISA isn’t going to be getting user info and some stuff that worked before isn’t going to work now. If you only have 5 PCs and are moving from ISA to your hardware firewall on a Sunday when no one is working, you might be able to skip this step. But if you have a larger number of PCs, etc. this helps to insure you don’t disrupt users’ internet access too much while removing the firewall client . . .
In my case, I update my domain login script to call my DisableProxy.vbs script at this point.
Uninstall the firewall client from ALL PCs. Again – see my notes above. Your life will be MUCH simpler if you insure the firewall client is completely removed from all PCs before removing ISA from your server.
Copy the contents of the mspclnt share (%programfiles%\Microsoft ISA Server\Clients by default) to a safe location on the server, and plan to keep this folder safe for some time
Follow Kevin’s steps 3-9 to remove ISA from the server.
When you re-run the CEICW, it should automatically update the DHCP scope option on the server to use the internal IP of the new hardware firewall as the default gateway setting. If you have any devices that are using static IP addresses, you will need to manually update those with the new gateway. (HINT: Take a few extra minutes to create DHCP reservations for each device using a static IP, and change those devices to DHCP – so if you have another network reconfiguration in the future, all you have to do is reboot those devices instead of reconfigure . For all of your other DHCP devices, you will want to run an ipconfig /release followed by an ipconfig /renew to update their IP settings so they pull the new gateway, or you can reboot them as well. HINT 2 – PSTools are your friend. Create a batch file with the two ipconfig commands, and use PSExec to push & execute the batch file on all machines in the domain from the server. 5 minutes tops to update the IPConfig on all domain machines (that are online) instead of sneakernetting . . .
ALSO – if you followed Jim Harrison’s steps to configure auto-detection of proxy settings on your SBS LAN, you want to remove the wpad A record from your internal AD domain forward lookup zone in DNS – otherwise you may have devices pulling proxy settings for pointing to your non-existent proxy server via auto-detect.

So that’s my addendum to Kevin’s excellent post.

P.S. . . . and if you haven’t decided on a hardware firewall yet, I highly recommend Calyptix devices. These are the standard devices we are implementing when migrating customers to SBS 2008.

The View from the Dark Side

cgross — Fri, 11 Jul 2008 23:46:15 GMT

I have a confession . . . I took my first step moving to the dark side three months ago. You see, my beloved Treo 700w had finally died for the last time - it had lived a long, hard life of just over 2 years and had been dropped countless times. I was looking for a Windows Mobile 6 device that had a touch-screen and a vertical orientation like the Treo (I for one dislike the slide-out keyboards because it requires two hands to type). I was surprised at the lack of options available for those three criteria. As a matter of fact - Verizon did not have a single device that met all three criteria - they still had the Treo 700w with a touch screen, but running WM5. They had the new Moto Q with WM6 and the vertical orientation, but no touch-screen. Or the Samsung isomething that had a touch screen and WM6, but had the horizontal slide-out keyboard.

So on a whim, I did an abrupt face and bought myself an iPhone. This was back in March, and I admit that what finally pushed me over the edge was the announcement of the iPhone 2.0 software update that would include support for push email via Microsoft ExchangeSync. Admittedly, there are days that I still miss my Treo (I still prefer a physical keyboard over the iPhone's on-screen keyboard - but I eventually discovered the trick to fast composition on the iPhone is to just get close and trust its auto-correct to fix your typos - and 98% of the time it gets it right). The biggest pain over the past 3 and half months has been the lack of over-the-air calendar and contact sync. After having that for over two years with my Treo, having to dock my iPhone every few days or remember to look at my Outlook calendar before I ran out the door was getting old.

But anyway, today was d-day - when the iPhone 2.0 upgrade was officially available to the masses. I didn't get a chance to really try the upgrade until late this afternoon. I started earlier this morning, but I could not get iTunes to backup my phone prior to the upgrade (unknown error -43). Of course, it gave me the option to continue without a backup - I would just lose little things like my text messages, favorites, mail accounts, etc. - basically anything that wasn't sync'd with my PC. So I stuck it out and eventually tracked the issue down to iTunes not playing nicely with folder redirection in a domain environment. My music lives in a redirected folder and syncs ok, so I'm assuming the issue is with a redirected Application Data folder. But anyway . . . ) So late this afternoon I finally got the phone backed up and initiated the upgrade. The entire process took about 30 minutes to download, install, restore & activate. Luckily, I did not run in to the mess this morning where Apple's activation servers were overwhelmed and couldn't be contacted, leaving a lot of people with a nicely upgraded phone that could not activate and thus had no service . . . but again, there's a reason it's called the bleeding edge . . .

But the big news for me is the Exchange integration. I removed my previous IMAP account, and set up my Exchange account. Biggest surprise for me: the iPhone will sync with Exchange over the air if you're using a self-signed SSL certificate on your SBS / Exchange server. It complains a bit that it can't authenticate the certificate when you're setting up the account, but you can acknowledge the warning and it will start synchronizing. Naturally, if you select to synchronize your contacts and calendar, any contact & calendar data on the phone itself will be overwritten by data on your Exchange server. For me this was no big deal as I was manually synchronizing this data anyway.

I still have to play around a bit, especially with installing some of the new apps, but so far the Exchange integration is working just as I would have expected. The contacts feature even handles multiple contact folders in your Exchange mailbox very nicely - even additional top-level contacts folders, and even allows you to search the GAL

Anyway, I'm off to go play on the dark side a little more . . .

Using your SQL in SBS R2 Premium as a back-end for WSS 3.0

cgross — Mon, 28 May 2007 18:23:56 GMT

I have been getting this question a lot recently, so I decided I should probably blog it.

When you install Windows SharePoint Services 3.0 using the published document from Microsoft, Windows SharePoint Services is set up as a stand-alone server. This configuration results in Microsoft SQL Server Embedded Edition (SSEE) being installed as the SharePoint v3 data source.

For SBS Premium customers who want to use their version of SQL Server as the data store for SharePoint v3, you need to deviate from Microsoft's published installation document. Specifically, on page 7 under step 4b select "Front-End Server" instead of "Stand-Alone Server" This will result in the setup process not installing SSEE on the server.

When you run the SharePoint Products and Technologies Configuration Wizard after the install finishes, you will be given the option of either joining an existing SharePoint farm, or creating a new farm. Select to Create a new SharePoint Farm, and you will be able to specify the SQL server instance you want to use as your data store. The wizard will then complete the SharePoint configuration and you will then be running SharePoint 3.0 with a full SQL data store instead of SSEE.

Companyweb & Sharepoint v3 - Part 1

cgross — Thu, 25 Jan 2007 06:18:00 GMT

This is the first in a short series of running Windows Sharepoint Services v3 on your SBS 2003 / R2 server.

First the caveat: Upgrading and/or running your companyweb site with Windows Sharepoint Services v3 is not supported - neither by Microsoft nor myself. Just because I'm blogging about it doesn't mean I'm supporting it. Microsoft does support installing WSS v3 in parallel with v2 on your SBS - but only supports the companyweb site running as a WSS v2 site. Microsoft's official document on installing Windows Sharepoint Services v3 on SBS can be found here.

What's the fuss?

The first thing to talk about is why you want to move up to WSS v3. Being a long-time Sharepoint junkie, there are some impressive features in v3 that address many of the complaints and wishes we all had with previous versions. The key items:

Recycle Bin    All most WSS admins can say is FINALLY! No more juggling with multiple stsadm or smigrate backups to allow for individual item restores. And when you need to restore, no more needing to restore those backups to parallel sites. Granted it worked - but was cumbersome and painful.   WSS v3 gives us a dual-layer Recycle Bin. Each user gets their own Recycle Bin which allows them to easily recover anything they may have deleted (a document, a photo, or even a list item). In addition to the individual user recycle bins, there is a site-level recycle bin as well. So even if your users delete something from the site, and then empty their recycle bin only to come to you the next day to ask if there is any way of getting that item back - well now there is. The administrator can access the site collection recycle bin and restore items that users have deleted even if they have deleted their recycle bin. This is configurable so you can specify how long you want to keep deleted items in the recycle bin, so you don't have to manually empty the site collection recycle bin.

Offline Access to Document Libraries     Yes, you read that right. So you're finally getting your users to store their documents on your Sharepoint site - but you've still got those roaming users who are keeping files on their laptops so they can have access to them anywhwere, even if they don't have an internet connection. Well now you can have the best of both worlds. With Outlook 2007 and WSS v3, you can now keep a copy of your document libraries within Outlook - so your users can have offline access to their Sharepoint files.

Mobile Access.     Do you have users who are out of the office a lot? Do they have internet-enabled phones? WSS v3 includes a mobile page format optimized for web-enabled PDA's & smart phones - which presents an experience somewhat similar to OMA. Regardless, you can now access your Sharepoint site, including documents and lists right from your phone.  I only migrated our companyweb a few days ago, and I'm already finding myself taking serious advantage of this mobile access on a regular basis.

Tighter integration with Office.     WSS v3 and Office 2007 are a match made in heaven. With WSS v2 & Outlook 2003, we could link Sharepoint calendars and contact lists with Outlook. However, anyone who used this functionality realized this was a one-way connection: you could only view the calendars and contacts in Outlook. Any additions or changes had to be made via the Sharepoint web interface. Not any more - with WSS v3 and Outlook 2007, you have full two-way integration, allowing you to add/edit appointments or contacts from either the Sharepoint web interface OR from within Outlook. And an added bonus - if you delete a Sharepoint contact or appointment from within Outlook, it actually gets sent to your Recycle Bin within Sharepoint.

Improved Versioning.     WSS v2 allowed us to keep versions of items stored in document libraries. WSS v3 allows us to keep track of both major & minor versions within document libraries, and even allows us to keep track of versions of list items. So you can now see version histories within your lists, and just like with document libraries, restore any previous version at any time.

Improved Security.     WSS v3 gives us true item-level security on documents and even list items. So for you somewhat Draconian admins out there, you can control what your users can see, change & delete at a granular level.

There's a lot going on with WSS v3 - both on the surface and under the hood. So far our migration has met with positive results from our users - it's cleaner, quicker, and just flat out prettier. But now that you know why you want to migrate, in the next segment we'll address how to plan such a migration and what gotchas and pitfalls to avoid.

Moving to QuickBooks 2007

cgross — Sat, 16 Dec 2006 19:51:00 GMT

Anyone who has spent any time with me is familiar with my complete and utter loathing of everything Intuit. But instead of ranting about how it's an inferior, bloated, poorly-coded application that ignores both IT and accounting best practices, I'm going to provide some hopefully useful information on how to get QB 2007 to work in a network environment when you're moving up from QB 2006.

Like most of us in the SMB space, we have a lot of customers running QuickBooks. We were eventually able to get virtually all of our SBS customers who purchased QB2006 running with the data living on their server. Of course, this required installing the complete QB2006 app on the server - which I wasn't exactly thrilled about. As you may know, with QuickBooks 2007 Intuit has actually started making some progress towards a network friendly app. Now, I don't know if someone at Intuit started thinking - or if maybe Susan's 2x4 finally hit home. Regardless - with QuickBooks 2007 it now has a server install option (we no longer need to install the full app on the server), and it also supports running as a non-admin. Who'da thunk?

So, I've now moved three different clients from QuickBooks Pro 2006 to QuickBooks Pro 2007. Since I didn't like having the full QB app on the server, and I now no longer have to - I decided to completely uninstall QB2006 from the server, then run the server install of QB2007. However, when I installed QB2007 on the clients, they couldn't open the company files on the server. After digging around for a little bit - I found the culprit: Intuit. Believe it or not, the QuickBooks 2006 uninstall routine did not remove the QuickBooksDB service. Of course, QB2007 installs its own new data service (QuickBooksDB17) - so I was left with two QB data services running and not playing nice with each other. Since I've seen this with every upgrade I've done so far, I figured there is a chance someone else might run in to it

The simple solution is to stop both services, remove the old QuickBooksDB service, then start the new QuickBooksDB17 service and you're good to go.

If you need a refresher on removing Windows services - download the Windows 2003 Resource Kit Tools here. Once you've installed the reskit tools on your server, click on Start | Programs | Windows Resource Kit Tools | Command Shell then enter the following command:

INSTSRV QuickBooksDB REMOVE

Start the new QuickBooksDB17 service and voila!

Vista RC2, IE7 and SBS Self-Signed Certs

cgross — Tue, 24 Oct 2006 01:34:54 GMT

Yes Virginia - there is a Santa Claus . . . oh wait, wrong story . . .

So as I mentioned in my previous post, I took the plunge and installed Vista RC2 on my primary production machine, and so far it's going well . . . granted a bit of a learning curve - but well worth it.

Like a lot of SBSers out there, we're making extensive use of self-signed SSL certificates for accessing RWW, OWA, ActiveSync, etc. Well, if you're being a good little tech and running Vista as a non-admin, and you haven't had much experience with IE7 yet, you might be trying to figure out just how to get those certs installed . . .

The first thing you notice when browsing to a site using a self-signed certificate, is that you don't get to see the site right away - rather, IE7 gives you a full page warning insted of the old Security Warning pop-up. So, you click to continue to the website, and you'll notice that your address bar has changed to a deep red indicating the security risk with this site. If you click on the 'Certificate Error' in the address bar, you can view the certificate. But viewing the certificate - you notice one minor problem . . . you don't have an option to actually install the cert!

The thing is, you need to have administrator permissions to install your cert. So here's the trick . . . click on Start | Programs. Right-click on Internet Explorer and select 'Run as Administrator.' When prompted, enter admin credentials, and IE opens. Navigate to your site, on the warning page select to continue to the site, then click on the Certificate Error in the address bar, and then view the certificate. Now you have the option to install the cert. But slow down there, young grasshopper . . . if you just click through the add cert wizard like you do in XP, it's not going to work for you. You see, by default the add cert wizard is going to install the certificate for just the current user - and since we're running IE as Administrator - you guessed it - the cert gets installed for the Administrator account - not yours. So how do you get around this? When you're running the import cert wizard, you're going to want to specify a location for the certificate:

Click Browse, the click to select 'Show physical locations' - then scroll up in the list, expand Trusted Root Certification Authorities and select Local Computer.

Click OK, then finish the import certificate wizard. Close IE (after all, you don't want to be browsing as an admin)

Open IE, navigate to your site and voila! There you go . . .

The Winds of Change . . .

cgross — Sun, 22 Oct 2006 22:30:47 GMT

Can you believe that this Wednesday, October 25th - marks the 5 year anniversary of the launch of Windows XP? 5 years! Wow, no wonder things have been pretty comfortable and cozy on the help desk front - work with an OS for that long and you're bound to know it inside and out.

But alas, progress marches on and we're in for a whole new learning curve on the desktop (or more accurately, our users are in for a whole new learning curve, and we're in for a completely revamped traning ciriculum)

First, IE7 RTM'd last week - and there's a bit of a learning curve there as well (honestly, how many of you cussed like a sailor the first time you tried to install a self-signed cert?) I've been running the beta for several months now, and have become addicted - especially with the full-screen functionality when using web apps. And I will admit that yes, IE is not only my primary browser, it's the only browser I currently have installed. Sure, I've read Vlad's rants - but what can I say, I actually like IE (yeah, I know - I'm sick & twisted).

With IE7, Microsoft has been pushing out tons of add-ins, and free little applications, all using the Windows Live branding. One of which being the Windows Live Writer, that I am actually using for the first time to compose this post. So far, I have to admit that I'm impressed with this. If you want to take a look, you can get it here - or read Vlad's thoughts on it here (after all, we all know that Vlad has a clear-cut opinion on EVERYTHING )

And then we have Office 2007. Of course, with what I do on a daily basis, Office for me is pretty much defined by Outlook, with Access and FrontPage (oops, SharePoint Designer) being a distant second & third . . . I've also been running the Office beta for several months - and was totally sold until a few hiccups with the Beta 2 Technical Refresh (B2TR) - which resulted in Outlook crashing when I tried closing it, and getting a corrupt OST every time I opened Outlook . . . this has been resolved - but more on that later. So far the built-in RSS capability in Outlook, combined with the new kick-ass shared calendars view, the To-Do bar, and ease of adding Exchange accounts (users only have ONE choice to make - then it automatically detects the username, email address, and finds the Exchange server on the LAN - no more having to walk users through typing in the internal FQDN of their Exchange, blah, blah blah . . . (at least, it worked that slick on a domain PC on the LAN) Of course, there's much more to Office 2007 - but those are the tidbits that affect me on a daily basis

Finally, our biggest change right around the corner is Vista. Again, I've been running beta builds for quite some time - but admittedly on my home PC that I rarely ever use for anything besides the occasional web browsing. Well, I was a few builds behind, and decided to take a serious plunge into the Vista experience - so I reinstalled my primary machine (Acer TravelMate C314XMi tablet) with the Vista RC2 bits yesterday . . . I did download & run the Windows Vista Upgrade Advisor before starting the process - which was great for identifying what hardware and software I might have issues with. So far, I have to admit that based on my previous experience with various Vista beta builds, I am very impressed. The installation was painless - with all of the required information being entered up front, and the rest of the process being completely automated - reboots and all.

After having lived through the migration experience from Win98 to 2000 Pro, and then from 2k to XP - I'm still scarred from application incompatibility, and driver issues (most notably a glaring lack of drivers) . . . But, that doesn't appear to be the case with Vista. So far, I'm only having a couple hardware issues - most are pretty insignificant, but one - while not necessarily a show-stopper, is close. My integrated Intel 2200BG wireless adapter is not cooperating. Vista includes drivers for this wireless adapter, and it is installed, and when enabled it detects available wireless networks. However - it refuses to connect to any secured network (WEP or WPA-PSK) - and while it will connect to an unsecured network - the connection only holds for ~5 minutes until it's dropped and the adapter reports that there is no signal for that network any more. Tad bit annoying . . . especially since I only ever work wirelessly at home. But on the flip side - my Verizon Wireless aircard works flawlessly. As for the minor hardware issues - my function buttons to enable / disable things like WLAN & Bluetooth, or shortcuts to email, web, etc. are not working - neither is the On-Screen Display for these buttons, or my generic function keys (so I need to figure out how to disable NumLock when I'm in a remote assistance session ) And finally, while my sound worked - Vista kept complaining that the audio drivers were not compatible with Vista - so I downloaded the Vista beta drivers for AC'97 audio from Realtek's website - and I'm good to go. (Of course, dealing with Realtek's slow download site was a bit annoying in itself - almost 2hrs to download 26MB)

What really surprised me was that there were drivers for our printers here at the office. Granted, they aren't anything overly special or bleeding-edge - but again, I remember the issues obtaining print drivers in the past. Adding our HP LaserJet 4200tn was a snap - I entered its IP, and Vista did the rest - queried the printer, determined the make/model and selected the appropriate driver and voila! Now, it wasn't quite that simple installing our Okidata C5150n color laser - Vista tried querying the printer - but wasn't able to get the info it needed - so I had to select the driver the old-school way. Now, the driver list didn't include a driver for the Oki C5150n - but it was available via Windows Update - so all is well.

On the application front - so far just about everything is behaving itself. Naturally, Office 2007 B2TR is playing very nicely with Vista - but the latest versions of other necessities like Adobe Reader, Java engine, Flash player, etc. all installed and ran without a hitch. Notably, some of the little things that I use and depend on daily are working without issue. The AutoTask for Outlook add-in installed and is running perfectly (which is a huge relief since that would have been a show-stopper for me if it didn't) - and the AstTapi driver (that let's me dial out from Outlook using our Trixbox phone system) is working nicely as well.

A few applications required a workaround to cooperate - most notably the Firewall Client for ISA 2004, and the connectcomputer wizard for SBS 2003. You can get the details on getting these to work over at Sean's blog - here and here . . .

The only application that is throwing me a bit of a fit is QuoteWerks - which is throwing an error when it tries to log in to its back-end SQL database - so I can't really do anything . . . but if I absolutely need to access a quote, QuoteWerks is installed on our Terminal Server - so I can get to it there.

Finally, performance-wise - I have to say that this machine boots up and shuts down WAY faster than it did with XP Pro - and overall performance seems to be right on par, if not better than XP Pro.

So, here's to change !

A companyweb by any other name . . .

cgross — Sat, 16 Sep 2006 22:00:00 GMT

So, one question that I get asked regularly is if you can use a different name to access your companyweb. For whatever reason, it appears SBSers have their own ideas of what URL / name they want for their individual intranets The good news is that this is very simple to do . . .

1) Pick a name you want to use - for the purposes of this post, let's say we want to use http://intranet (yeah, real original, I know . . . )

2)   Add and entry to your DNS. First and foremost, we have to make sure that intranet resolves correctly to your server's IP.
     a) So open your DNS snap-in, expand <servername> | Forward Lookup Zones | <domain name>.
     b) Right-click on <domain name> in the left hand pane, and select 'New Alias (CNAME)'.
     c) Enter 'intranet' for the Alias name.
     d) Enter the FQDN of your SBS in the target host field (e.g. sbs.company.local)
     e) Click OK and close the DNS snap-in

3) Edit the host-headers for your companyweb site. Now we have to make sure that IIS knows how to route traffic properly. You see, when IIS receives a normal http web request, it looks at the header of the request to get the URL that the user entered (in this case, http://intranet). IIS then looks at the websites to see if there is one that wants this traffic (has a host header present that matches the request URL). If it can't find a site with a matching host header, then it sends the request to the default web site. Since we want these requests to go to the companyweb site instead of the default web site, we need to add host headers to the companyweb site.
     a) Open IIS Administrator snap-in
     b) Expand <servername> | Web Sites
     c) Right-click on companyweb and select Properties
     d)  On the web site tab, click the Advanced button
     e) Click the 'Add' button on the top half of the page.
     f) Change the IP address from (All Unassigned) to the internal IP of your SBS.
     g) Set the TCP Port to 80
     h) Set the host header value to intranet (or whatever name you want to use)
     i) Click OK
     j) Repeat steps e thru i, only this time use the FQDN value in step h (e.g. intranet.company.local)
     k) Click OK |   Click OK | Close IIS Admin snap-in

4) Re-extend Windows Sharepoint Services to the web site. Just like IIS needs host headers to know where to route requests, Sharepoint central config keeps track of the sharepoint sites in its database. Therefore, we need to re-extend WSS to the site in order to update the config database so it knows that we're using an alternate name to access the site.
     a) Open Sharepoint Central Administration
     b) Click 'Configure Virtual Server Settings'
     c) Click 'companyweb'
     d) Click 'Remove Windows Sharepoint Services from Virtual Server'
     e) Verify 'Remove without deleting content databases' is selected, and click OK
          (when this finishes, you will return to the Sharepoint Central Administration main page)
     f) Click 'Extend or upgrade virtual server'
     g) Click 'companyweb'
     h) Click 'Extend and map to another virtual server'
     i) In the Server Mapping field, select 'companyweb'
     j) Select to 'Use and existing application pool'
     k) Select 'DefaultAppPool (NTAUTHORITY \ NETWORK SERVICE)' for the app pool to use.
     l) Click OK
     m) Close Sharepoint Central Administration.

Now, open IE and browse to http://intranet (or whatever name you used) and verify that it opens up your companyweb. Note that after following these steps, you will still be able to access the site by browsing to http://companyweb. This is because the native SBS functionality relies on the Sharepoint site answering to http://companyweb. As a result, you can have your users use the new name you specified, but all of the SBS functionality (including the wizards in the SBS Admin Console and the companyweb links in RWW, etc.) will work just as before . . .

Swinging Your Companyweb

cgross — Wed, 07 Jun 2006 02:44:00 GMT

So, with my last post I talked about using smigrate to backup and restore your SharePoint sites. With this post I'm going to go one step further and attack a specific scenario that I seem to be getting more and more questions on - migrating your companyweb SharePoint site from on existing SBS 2003 installation to a new one. This may be because you're swinging your SBS to new hardware, or just starting over for whatever reason.

The idea is quite simple - you have a working companyweb on your current SBS, complete with tons of documents in various document libraries, a few custom lists, maybe a forms library, etc. - you're moving to a new server and you want to move that site completely in tact . . . it's not an unreasonable request by any means - and luckily enough it is rather simple to accomplis - provided of course you know how to do it. That's where this post comes in :^)

Obviously, the first step to making this happen is to backup your existing companyweb site using smigrate as I've outlined in my previous post. The restore part is where everyone seems to be stumbling, so here's what you need to know:

First, it is important to understand part of what the smigrate restore does. When it connects to your SharePoint site to perform the restore, it is going to set the site template for the site based on the template that your backed up site was using. Now, with SharePoint - setting the template for a site is a one-time thing - once you've set a template for the site you can't reset it. The only time a Sharepoint site is clean (e.g. does not have a template assigned to it) is right after Windows SharePoint Services has been extended to a website. The first time you access your new WSS site, you have to choose your template before you can begin using the site.

Most people who try to migrate their companyweb site using smigrate (or FrontPage) run in to this problem - their restore fails because the site is already in use. Specifically, the smigrate restore process cannot set the site template for the new companyweb site because it already has a template set. Sure, it's the same template as the one you want to use - but the restore process still needs to set it to be sure. As a result, the restore fails before it ever gets started.

So - how do we get the restore to work? Simple - we take the new companyweb site back to a clean state (where no template has been set). To do so, we simply need to remove WSS from the companyweb virtual server, then re-extend it. Now, before we remove WSS from the companyweb virtual server (on the new SBS server) - you need to be aware that this process is going to destroy this site (and all content). Most of the time this should be an empty companyweb - but just in case you have some content in there, either extract it or back it up first :^). So - your step-by-step process to get your new companyweb in a state that will allow an smigrate restore: (all steps are on the new SBS - assuming you have already completed the smigrate backup on the old server and moved those files to the new server).

1)   Open SharePoint Central Administration ( under Start | Administrative Tools )
2)   Click on 'Configure Virtual Server Settings'
3)   Click on 'companyweb'
4)   Click on 'Remove Windows SharePoint Services from virtual server'
5)   Click to select 'Remove & delete content databases'
6)   Click OK to acknowledge warning that you are deleting all content for the site
7)   Click OK
8)   When you return to the SharePoint Central Administration page, click 'Extend or upgrade a virtual server'
9)   Click on 'companyweb'
10) Click on 'Extend and create a content database'
11)  Select to 'Use an existing application pool'
12)  Verify that the app pool selected is 'DefaultAppPool (NT AUTHORITY / NETWORK SERVICE)
13)  Under the Site Owner section, enter the administrator email address for your domain
14)  Click OK to extend WSS to the companyweb virtual server.
15)  Once you see the page indicating the the virtual server was successfully extended, click OK to return the SharePoint Central Administration
16)  Navigate to http://companyweb, and verify that you get the Template Selection page. Be sure and close this window - DO NOT click the OK button as this will apply a template to the site and you will have to repeat these steps before you will be able to restore your existing companyweb site.

At this point, your new companyweb site is in a clean state, and you can use smigrate to restore your existing companyweb backup to the companyweb on your new server. Now, if you were using any 3rd party web parts on your old server, you want to be sure and install those on the new server before starting your restore. And if this is a swing migration, your original AD will be in-tact, and the smigrate restore will also restore all permissions for the site as well. Once the smigrate restore process has completed, there is nothing left to do - your companyweb will be back exactly how you left it - all permissions, settings, templates, etc. will all be there and you'll be good to go :^)

Making sense of Best Buy's push into the SMB space . . .

cgross — Wed, 15 Mar 2006 01:43:00 GMT

Ok, for those of you who are either outside North America or simply have been living under a rock lately, Best Buy is making a move into the SMB solution space. Specifically, they're rolling out a Best Buy for Business program, and naturally using their Geek Squad as their troops on the ground. Since it seems like just about everyone has an opinion on this topic, I figured I might as well dive in myself ;^)

Now I know that most of us SMB partners have the same initial reaction when someone mentions the Geek Squad - and it usually consists of a bit of a smirk, a shake of the head and a little laugh to ourselves. But before you shrug this off and discount this whole thing as a non-event, you need to sit back and take this seriously . . .

It is too early to be forecasting doom and gloom, as well as the utter demise of the traditional SMB var. However, you'd be very naive to think that Best Buy can't grab a piece of the market solely on their marketing might. And they are making a solid effort, with their techs going through an intensive 2 week training course on SBS. Of course, the providers this will affect at first are the part-time one man shops - the ones who have a couple clients that they work with at night and on the weekends. Not to generalize, but it has been my experience that the majority of these guys have skills on par with your average Geek Squad member. Basically, Best Buy will be able to capture the price-sensitive portion of the market without much effort. Will they implement ideal solutions that follow best practices right away? Probably not. But depending on how Best Buy manages this will depend on how much of a threat they become. If they implement their own internal knowledge base, have knowledgeable senior-level techs that support issues can be escalated to, and do simple things like training their techs how to plug into this amazing SBS community we have out here, they could easily move up the stack and start getting more business from the section of the market that isn't necessarily price sensitive, but isn't aware of their other options.

I don't doubt that the Geek Squad will never be as reliable as the SMB var, and will never enjoy the level of trust that we have with our customers. But just because they can't be as good as us, doesn't mean they can't take business from us.

So, what do you need to do now to ensure you successfully weather whatever storm this might generate? In all honestly - nothing that you shouldn't be doing already. You should be constantly working on your sales effort. The point here is to not only drum up new business, but to constantly increase your name recognition. Sure, most of the people you call today probably won't be interested in your services today . . . but the more they see your name around town, the more likely they're going to call when they are interested in your services. Next, review your SWOT analysis (Strengths, Weaknesses, Opportunities & Threats). What are your strenghts as a technician? as a business? What sets you apart from your competition? For example, with Best Buy we're different because first and foremost, we're service providers. We're not looking to sell a PC or a router, or a printer, or whatever. Also - we're often hardware agnostic - where the likes of Best Buy will be pushing what they have in stock. Our biggest strength is that we're small business owners ourselves - and can relate with our customers. Regardless - find what sets you apart and determine how you can exploit that. Then communicate that to your leads - maybe put together a sell sheet on what makes you different than the rest. You may also look at focusing on a few vertical markets, where you can provide experience & expertise on their needs as well as various LOB apps their industry uses.

So - take a look at your organization and what you need to do to grow your customer base and increase your name recognition, and try to stay one step ahead, and offering services that Geek Squad either doesn't or can't offer. One way you can stay ahead is by making the move to managed services. The bottom line is the last thing you want to do is sit idly by with your head in the sand thinking that Best Buy isn't a threat. Granted, they may not be a big threat to you today - but who knows what the landscape is going to look like in a couple years? Maybe SBS Longhorn will be super-simple to install & setup. And what if Best Buy hires more & more truly capable technicians? And what if they make the move in to the managed services realm - maybe even purchasing an MSP software company like Kaseya, Level Platforms or N-Able? Next thing you know there is a strategic alliance between Best Buy & Dell, where the Geek Squad provides Dell's onsite installation & warranty services. Best Buy also becomes a Dell partner - they get better-than-web pricing based on their volume, but they don't have to stock anything. They configure and sell Dell stuff on demand, and Dell keeps their direct model by only building machines when they're ordered . . .

And we all know that when it comes to SBS sales, Microsoft is focused on one thing, and one thing only - new sales. There is only a very small percentage of small businesses that currently have a server - and Microsoft is drooling when it looks at the tens of millions of small businesses without a server - a market waiting for them to conquer. It only makes sense that Microsoft would do a huge co-branding advertising campaign / blitz to drive small businesses to Best Buy, because next to the OEMs, Best Buy is going to be in the best position to push SBS.

So now in our hypothetical scenario, we're a couple years down the road with Joe the small business owner seeing newspaper, billboard & TV ads about Best Buy for Business. He also sees Microsoft ads pushing him to either Best Buy or a number of big-box retailers that have put in their own Geek Squad like service offerings. He can have a Best Buy Business Technology Consultant (BTC) come out to his business, assess his needs and provide a written proposal. If he wants Dell hardware, the proposal includes a link to a saved cart that the BTC has already configured. He signs the proposal to accept, pulls up the Dell cart online and plugs in his credit card number. The Geek Squad finishes the 15 minute OEM installation on the SBS, brings it out and installs it complete with their monitoring software. Their managed services agreement is automatically billed to Joe's Best Buy card every month, and they have a handful of data centers across the US where a team of engineers are watching the multitudes of monitored systems. When something comes up, they either take care of it remotely, or if it requires a visit contact the customer and either have the customer bring the system in (hey, it's still Best Buy ;^) - or for a higher fee, schedule a Geek Squad member to go out onsite.

You have to admit - it would be a little harder to sell against that offering . . . and it isn't much of a stretch of the imagination to see most of that hypothetical situation come to pass.

So . . . now about that sales effort of yours . . . :^)

For some interesting reading on the topic, check out these posts of Vlad's:

Best Buy for Business to End SMB IT Consultants?
http://www.vladville.com/2006/02/best-buy-for-business-to-end-smb-it.html

Best Buy vs. SMB IT Consulting: Part 2
http://www.vladville.com/2006/03/best-buy-vs-smb-it-consulting-part-2.html

Best Buy now Gold Certified Partner
http://www.vladville.com/2006/03/best-buy-now-gold-certified-partner.html

SBS, SSL Certs and Verizon's Treo 700w

cgross — Thu, 19 Jan 2006 23:34:00 GMT

So, there has been a decent amount of rumblings about the new Palm Treo 700w from Verizon Wireless (running Windows Mobile 5.0) - and it's apparent inability to sync with SBS.

Sean has a good post outlining how Windows Mobile 5.0 has changed how it handles certificates. The good news is that if you're using self-signed certificates with your SBS, you can get your Treo 700w to sync wirelessly with your Exchange server. As proof, I just did this myself - configured a new 700w for one of our internal users to sync with our SBS, and we're using a self-signed certificate.

The trick is to install both your self-signed certificate ( \\<your_sbs\ClientApps\SBSCert ) AND your CA certificate (publishing.company.local - check out \CertEnroll">\\<your_sbs>\CertEnroll ). Copy these two .cer files to your device using ActiveSync. Then on your device, use FileExplorer to browse to the folder where you copied the certs, and double-click to install each. Voila! You're good to go . . .

Now, there has been some talk that WM5 doesn't trust as many Certification Authorities (CAs) as regular ol' Windows. As a result, if you have purchased an SSL cert from a CA, there is a chance that CA may not be trusted by WM5. In that case, you're not going to be able to sync with your Exchange, since you won't have access to the CA cert to manually install it on your WM5 device. However, you could always convert to a self-signed cert and get it to work that way

Glutton for Punishment . . .

cgross — Mon, 28 Nov 2005 04:41:00 GMT

I love swing migrations - I really do. Admittedly, I haven't done too many - primarily since currently our oldest SBS installation won't hit the 3 year mark until this coming April, and an overwhelming majority of our installs are new installs / first server, versus migrations of existing servers / domains. Well, I just finished another swing this weekend, and as usual it is a great experience.

Ok, now those of you who are familair with the swing method and have caught Jeff's presentation on the topic are probably wondering why I finished a swing this weekend. After all, one of Jeff's primary talking in points is that the swing method allows you to regain your weekends and migrate during the week. So why was I swinging not only on a weekend, but on a long holiday weekend of all times? That's where the title of this post comes in: I'm a glutton for punishment.

Let me paint the picture for you: First, while this is a small company (4 PCs), this isn't any old client - this is family (cue blood-curdling scream sound effect ;^). Next, this isn't just family - this is the family business where I spent the better part of the last decade. Third - the family isn't exactly a full-paying customer - yet. I say 'yet' because we're working that way. It was just a little bit of a shift from having me handle all of the IT stuff in addition to my normal duties (I was the Controller - yep, I did accounting believe it or not :^), to paying by the hour. So I've done a lot of the basic maintenance stuff remotely after hours pro-bono. They've been paying for anything they need during normal business hours, with me just throwing in miscellaneous stuff after hours when I have time. While they haven't signed a contract yet, they've been asking about our Managed Services offerings, and should be on-board in the next few months. And the fact that they're asking about our Managed Services is a testament to the value they can bring to a small business. You have to realize that up until a little over two years ago, my uncle refused to use a computer - and hated having to spend money on anything IT related.

So, back to our swing. Their old server was in desparate need of being replaced, and I've been talking to them about this for a good nine months or so. That box was originally put into service 5 years ago - in early November 2000 as an SBS 4.5 box. In the spring of '01 it was upgraded to SBS 2000 (which we got as part of Microsoft's Technology Guarantee program). In the fall of '02 we bought another SCSI hard drive and reconfigured the RAID array from RAID 1 to RAID 5. Needless to say, the box had lived a good, long life, but was starting to show its age. I finally got the OK to build a new server a few weeks ago when the tape drive in the old server died.

Well, considering this is family - and considering that I wouldn't be where I am today without their support, not to mention the great real-world small business experiences I gained running their business - I gave them the hardware at cost and didn't charge anything for the install. Did I mention I was a glutton for punishment?

SO - the server got built on Monday, on Tuesday I built the RAID array, and did the initial Windows portion of the SBS install. Tuesday night on my way home, I stopped by, pulled out my laptop, fired up Windows 2003 inside of virtual PC, and did the initial steps of the swing (joined domain, installed DNS, dcpromo'd, made global catalog, verified AD replication, etc.). Wednesday afternoon I swung the AD onto the new box, and finished the SBS integrated install. Thursday I gorged myself on turkey with the fam :^). Friday I finished all of my usual post-SBS install configurations (To-do list, install Trend, WSUS, etc. etc.). I had a few other little projects that I worked on in the office on Friday (taking advantage of the peace and quiet being there alone without the phone ringing :). I left the office around 6:30 that night and decided to start the next phase of the process - taking the old server down, migrating data and bringing the new server online. I got to the family's building around 7, unloaded the new server, etc. and dug in. I disconnected the server from the internet, connected an external USB hard drive and started with an online backup of Exchange while I started unboxing the new server, etc. and getting ready for the migration. After I had unboxed the new server and checked the workstations to make sure everyone was logged out, etc. I got back to the new server and realized that after 45 minutes, my online backup of the 4gig Exchange store was only about half way done. Wow does USB 1.1 suck. So I started pulling data off the server across the network to the newest PC (that happens to have the largest hard drive). I pulled 14 gig of data off the server in a little over a half hour. Needless to say, I still beat the online backup of Exchange. When that finished, I stopped the Exchange services and copied the store databases to the workstation as well. From there I was able to write to the USB drive in no time as I powered the old server down, and put the new one in its place. Booted the new server and started restoring data. Once all data was restored, I mounted the original Exchange databases and logged in to one of the PCs . . . voila! Just like nothing had happened . . . redirected folders working wonderfully, Exchange mailbox is there, drive mappings via login script worked perfectly, printers are all there (and working), just perfect. (btw, THAT is what I love about swinging :^)

But if you know me - you know that nothing is ever truly that easy - something, SOMETHING always comes up and bites me in the arse. Well, this time that something was WinFax Pro. (I know, I know - who would have ever guessed in a million years that a Symantec product would throw a wrench into things?!? ;^) My aunt & uncle have a decent amount of fax traffic - sending 15 - 20 faxes per day - almost all being invoices. That's not enough to really justify a full-fledged fax server product (with that volume they're not even using a fax board - just a normal fax modem), but it's still enough that it's a PITA to have to print that stuff out and walk to the fax machine a few times every hour. As a result, they've been using WinFax's sharing feature. I had WinFax Pro installed on the SBS 2000 box and configured as the WinFax host, with the workstations sending & receiving faxes through it. Well, after I booted the new server, I could not get any of the workstations to connect to the new WinFax host on the new SBS box. After a relatively short search, I found where Symantec doesn't support WinFax on Windows 2003 - as WinFax is a consumer product, and Windows 2003 is not a consumer OS. (Consumer product? Is it just me, or do you not see a lot of home networks using WinFax sharing to handle their fax traffic???) Argh . . . faxing is one thing that really needs to work - the natives will be very restless come Monday morning is that isn't working. For multiple reasons I can't have one of the PCs act as the WinFax host - basically due to placement. The fax line is separate from the phone system - which means the only jack is in the server closet. So what now? MSN Search to the rescue - I downloaded a 30 day trial of FaxBack's NET SatisFAXtion 7.5 and installed it on the SBS. Went to the workstations and installed NET SatisFAXtion's WinFax integration piece, and the workstations can send using WinFax on the desktop like normal . . . woo hoo! (and no, don't ask me about SBS fax - that is completely not an option). So at this point, I look at the clock and about fall over when I realize it's 5am Saturday morning . . . so I decide to call it a night.

I returned early Saturday afternoon after what seemed like only a few hours sleep. Besides migrating to the new server, I'm also updating their wiring. The building is about 23 years old - and as such was not wired for networking. The front office was added on in 97 and was wired - but apparently the electricians used some cheap cat 5 as it has been going down hill for some time. Additionally, at the time we put the switch in the attic - again, for several reasons. Well, the time had come where the faulty wiring in the front office needed to be replaced, the switch needed to be replaced as well as relocated out of the drastic temperature fluctuations of the attic, and the other offices needed upgraded wiring beyond a cat 5 wire dropping down from a hole in the ceiling :) So, I started Saturday with mounting plywood to the wall in the server cabinet to give me something that could hold the wall-mount patch panel & switch, then mounting the patch panel & switch. Of course, I didn't have any plywood available when I realized I was going to need some, so I had to run to Home Depot to get the plywood, then run home to get some screws and my circular saw . . . I was able to run all new cable for the front office as well as the shop office - not only replacing existing jacks, but adding additional jacks as well (after all, you can never have too many network jacks!) So I called it a night and headed home about 3am Sunday morning.

I worked around home most of the day today, then went back around 4:30 this afternoon. I finished replacing the wiring going to the parts office, including adding a few new jacks. I then finished puting all of the covers on the raceways I had installed, cleaned up the patch panel so that all of the cables were nice and bundled and organized, and cleaned up my mess - taking all of the old cabling out to the dumster, etc., and left around 9:30. So here I am at home, showered and getting ready for bed, trying to figure out how in the hell tomorrow can be Monday . . . and not only Monday, a Monday where I have to be onsite with a client around 7 am to troubleshoot a printer issue so they can run payroll . . .

Well, if nothing else, this weekend has reminded me of two things: the value of family, and why we subcontract our wiring jobs ;^) Oh yeah, and that I'm getting too damn old to be pulling all-nighters . . . :^)

The compromise of SBS . . .

cgross — Mon, 21 Nov 2005 02:58:00 GMT

I'm sure that most people here are aware that there are circles in the IT community where SBS is a punchline. One of the most common assertations is that ISA on SBS is a security compromise. So I figured it was time to address this head on.

Is ISA on SBS a security compromise? Completely - because the mere notion of a firewall on Windows is a security compromise at best . . . we should all be running a SonicWall or Cisco Pix if we really want security. Sorry, I couldn't resist a little jab :^)

Seriously - is ISA on SBS a compromise? Absolutely - because SBS itself is a compromise. Which is why it fits so well in the small business space, because each and every small business is a living, breathing example of compromise on a daily basis. You can't truly appreciate or understand Small Business Server if you don't understand small business. And you can't understand small business if you haven't experienced it.

I can't help but wonder if the people who look down on SBS with disdain have truly experienced small business. Have they laid awake at night worrying about making payroll - knowing that their employees have families to feed and mortgages to pay? Do they realize that for many small businesses, money could be spent in several different places - so that server upgrade often relates to not being able offer the raises or bonuses we'd like, or offering additional benefits. We have to take care of our employees and our customers, but we also have to invest in our businesses to insure our long-term ability to take care of our employees and our customers. We can't afford an imblanace either way - literally. So each day is a compromise.

Would I love to be able to follow 'best practices'? Absolutely. But look at the average small business with 25 users or less . . . how would I be helping them by deploying a DC, a secondary DC, an ISA server, a front-end Exchange box, a back-end Exchange box, a file & print server, a Sharepoint box and a LOB server? Not only would there be extensive cost at deploying that sort of solution, but extensive cost to maintain and administer that set up.

Let's face it - SBS customers aren't shopping for ISA server any more than they're shopping for Exchange. What they're looking for is a solution that let's the work smarter. Does the small business owner care about running ISA on their DC? Nope - not in the least. The fact is that it isn't realistic to sell that client a separate ISA server - simply put, the costs outweigh the benefits.

Is ISA on SBS a compromise? Sure - it's a compromise between the benefits of the full product and great pricing of an integrated bundle. I will be the first one to admit that in a perfect world ISA would always run on its own dedicated box. In the small business arena, that just isn't going to happen in an overwhelming number of cases. So the question facing most small businesses isn't whether or not they should run a dedicated ISA box in addition to their SBS, but whether they should run ISA on SBS or stick with their $39 Linksys router.

So what's the bigger security compromise and risk for the small business - running ISA on their SBS or sticking with a low-end nat-ing router? Because down here in the trenches - that's the reality.

SMBTN

cgross — Sun, 17 Jul 2005 18:10:00 GMT

So, it appears that everyone has survived the first SMBTN Summer Conference. I've got to take my hat off to Roger, Jim and everyone else who put in tons of effort to pull this off.

I thoroughly enjoyed the entire event - and the best part is being able to just sit down and visit with everyone else about what we're all doing, what we'd like to do better, and what sort of solutions we've done for our customers.

Several people asked me about Sharepoint resources - so here's the two sites I enjoy the most:

www.wssdemo.com
www.wssfaq.com

Also - if you've got a specific quesiton, don't forget Google & Google Groups!

SBS SP1 + ISA 2004 = No DHCP?

cgross — Wed, 22 Jun 2005 22:11:00 GMT

Last week, we were installing SBS SP1 for one of our SBS Premium customers. Naturally, we upgraded their ISA 2000 to ISA 2004, which went very smoothly. The only problem was that after the upgrade to ISA 2004 was complete, none of their workstations could pull an IP via DHCP. We verified that the DHCP Server service was running, and tried restarting the DHCP Server service, as well as rebooting the server - both to no avail.

Well, it turns out that this is at least partially my fault. You see, when I set up ISA 2000, I never let ISA build the LAT table for me - I always manually specified the internal address range I wanted. So for an SBS using the default IP of 192.168.16.2, I would specify a LAT of 192.168.16.1 to 192.168.16.254.

ISA 2004 varies from ISA 2000 in that it firewalls all network interfaces, including the internal interface. My DHCP problem was that DHCP requests happen via the broadcast address of .255 - since my LAT entry ended at .254 - ISA blocked the traffic, so the DHCP Server never received the client request, and the client thus was unable to pull an IP via DHCP.

SO - if you encounter this problem, open your ISA Management console, and expand <servername> | Configuration | Network. Select the Internal network, and edit it to include .255

SMB Technology Network

cgross — Mon, 13 Jun 2005 04:50:00 GMT

Susan has already blogged about this - but I wanted to make a point of mentioning it as well. In just about a month, I'll be in sunny southern California for the first ever SMB Technology Network Summer Conference! I'm still preparing for it, but I think it's a safe bet that I'll be talking a lot about Sharepoint that weekend. So, if you're interested - go ahead and register, and I'll see you there!

The SMB Technology Network® has opened registration for its Summer Conference 2005 to be held July 14-16, 2005 at Embassy Suites in Buena Park, CA. The goal of the event is to expose attendees to knowledge, products, and services that can either make them money or reduce their costs on Monday morning.

To register, go to http://www.clicktoattend.com/?id=103185.
We have a number of terrific speakers lined up, including

Harry Brelsford, noted author on SBS and SMB Consulting, presenting his 4-hour workshop on "Building the SMB Franchise" (a $99 value).
Susan Bradley, SBS-MVP
Chad Gross, SBS-MVP

We will also have a number of sponsors presenting and exhibiting, including:

Veritas
SonicWALL
Level Platforms
AutoTask
more to come...

ACCOMODATIONS
The Embassy Suites in Buena Park is located within walking distance of Knott's Berry Farm, Movieland Wax Museum, and Medieval Times. Disneyland is just a 15 minute drive. The hotel provides complimentary shuttle service to both Knotts Berry Farm and Disneyland. Embassy Suites is offering us their spacious, two room suites on a first-come, first-serve basis at a price of $129 per night. There are also many other hotels in the area, if you prefer to stay elsewhere. For reservations, call 1-800-EMBASSY and ask for the "SMB Tech" rate.

REGISTER TODAY!
The cost for this three-day event which includes admission to all events, including Harry Brelsford's 4-hour "Building the SMB Franchise" workshop on Thursday evening (valued at $99), presentations by Susan Bradley, Chad Gross and a host of SMB vendors, admission to the exhibitor area, complimentary breakfast and lunch on July 15th, as well as, breakfast on July 16th, is $179 for SMBTN members and $199 for non-members.

Members $179
Non-members $199

To register, go to http://www.clicktoattend.com/?id=103185.
You will be billed by PayPal within 48 hours of registration.
Regards,

Jim Locke
SMB Technology Network®

From the mailbag: SBS, Print Servers and Error 61

cgross — Fri, 29 Apr 2005 02:42:00 GMT

So I get an email this afternoon from Mitch regarding a problem he's been fighting:

“I have a HP laserjet setup on the network. It is using a castele print
server. It has an IP address and all the workstations have no problem
printing to it. Added to each workstation as a local printer using the
ip address. (added using generic card and ip address)

SBS Server refuses to print to this printer. I can ping it, It will let
me add the printer, and when i try to print to it it shows up in the
print queue, but then times out with the stupid error 61 I have been
reading about.“

Well, I personally haven't seen this issue before. As a pure shot in the dark, I suggested Mitch try disabling SMB Signing and see if that helped. Well, I happened to get lucky as Mitch confirmed that disabling SMB Signing resolved the issue. (And yes, that means that I have used my luck quota for this decade . . . so much for winning the lottery any time soon!) So if you see this - you should try disabling SMB Signing on your SBS and see if that helps. You can get step by step instructions from the M&M's site:

But Mitch's email raises another question: When you run across a problem that just has to stumped, where do you go for help? Blogs can contain several tech tidbits - but really aren't a good source of tech support . . . and as much as I enjoy helping SBSers, I really don't do email support. Well, OK - I do . . . for my own customers with service agreements . . . so if you want email support - just ping me and I'll fax over a contract for you to sign, and we can get started right after the check clears the bank . . . ;^)

But seriously - where do you find support for those tough, and downright weird issues? Well, in SBS land you have a plethora of choices . . . For community resources, you have:

Microsoft Public Newsgroups: microsoft.public.windows.server.sbs
http://www.microsoft.com/windowsserver2003/sbs/community/newsgroup.mspx

Grey's SBS2k Yahoo! Group:
http://groups.yahoo.com/group/sbs2k/

Mariette & Marina's Smallbizserver.net forms: (Registraiton required to access forums)
http://www.smallbizserver.net

Nick's SBS forum at Mark Minasi's site:
http://x220.minasi.com/forum/forum.asp?FORUM_ID=21

And don't forget that you always have official Microsoft support:

For Microsoft Partners - visit the Partner Managed newsgroups for free Microsoft PSS support:
www.microsoft.com/partner
Also - partners . . . you are aware of Business Critical Phone Support, correct? As a partner, you get a set number of Business Critical support incidents per year. You have to sign in to the partner site and register with Business Critical support - but then you're good to go. So if you have a client that has a problem that is impairing their ability to work (server down, etc.) - you can call for Business Critical phone support - which is FREE . . . (but you have to be registered :^)

If you find a Microsoft Knowledgebase article that indicates you need to contact PSS to obtain the hotfix, know that HOTFIXES are FREE . . . yep - they won't even ask you for payment info. Just follow the prompts when you call and one of your options will be '...to obtain a hotfix'
http://support.microsoft.com/contactus/?ws=mscom

If you have a problem as a result of applying a Service Pack - contact PSS. Just like hotfixes, SERVICE PACK support is FREE . . . yep - free. Just indicate when you call in that you are having a problem with Service Pack <whatever> and you'll be good to go.
http://support.microsoft.com/contactus/?ws=mscom

And finally - if you've exhausted all other avenues and are still having problems, call PSS for paid support. A lot of small businesses look at the $245 price tag and grumble - but I've got to tell you, that is one of the most undervalued bargins around. What does that $245 get you? A solution - and nothing less. No matter how many phone calls or emails it takes, no matter how many PSS engineers get involved, it doesn't matter - you *will* get the problem resolved.
http://support.microsoft.com/contactus/?ws=mscom

Luckily, I haven't had to contact PSS but 3 times in 4 years . . . the first was a bug with the SBS2000 Technology Guarantee media where setup didn't like the CD Key. Took two days and several dozen regenerated CD Keys before we found one it liked. But that's what I get for being on the bleeding edge and moving from SBS4.5 to SBS2k the day after I got the media :^) Second call was a Service Pack issue . . . applying SQL SP3a to an SBS2k box we acquired that was still at SQL GOLD . . . MDAC upgrade blew up (we later determined) and was causing all sorts of issues. Spent six hours with PSS on a Tuesday night working through that one. Last call was just a few months ago. Clean install of SBS2k3 that I was building in our shop. Finished the install and was patching the box. Applied the OWA gzip patch and Exchange SP1 and rebooted - and the box fell over - took an hour an a half to boot. Discovered that booting into safe mode and disabling Exchange services let it boot normally. That was another 6hr PSS call - working with two engineers no less . . . :^)

The point is that Microsoft PSS ROCKS! They are by and far the best vendor support I have ever experienced - and IMHO they set the standard for what Product Support should be. There's a lot of companies out there who charge less for support - but don't provide anywhere near the level of support that Microsoft does.

Sharepoint permissions on SBS

cgross — Fri, 15 Apr 2005 04:09:00 GMT

Ok - I've gotten this question enough that it is definitely time to blog it:

On SBS 2003, you grant your users specifc permissions within your companyweb site (let's say with Reader level access) - but you find that those users can still do anything they want with the site - add / edit / delete / design.

Why?

This is somewhat hidden - but by default, SBS adds the Domain PowerUsers security group as a member of the SharePoint Administrators security group - so if you used the Power User template when creating your users, they will automatically be Sharepoint admins regardless of the explicit permissions you grant within the companyweb site itself. In order to correct this, open Active Directory Users & Computers, expand <your_domain> | My Business | Security Groups and open the Properties pages for the Sharepoint Administrators group. On the Members tab, remove Domain Power Users and you should be good to go. Note that none of your users will be able to access your companyweb site until you grant them permissions within the site.

Using Windows Sharepoint Services as an Extranet

cgross — Sun, 03 Apr 2005 04:24:00 GMT

Ok - so recently I've been asked several times about using Sharepoint Services as an extranet to securely exchange documents with customers and business partners. The short answer is that this is very possible with Windows Sharepoint Services. However, you must be familiar with the licensing considerations, and how those apply to vanilla Windows Server compared to Small Business Server . . .

First, Windows Sharepoint Services is a free add-on to Windows Server 2003 - and as such, access to WSS is bound by Windows Server licensing for the product it is installed on. With vanilla Windows Server, we have two licensing modes - Per Server and Per User / Device. It is also important to note that while you can enable anonymous access to WSS sites and bypass licensing considerations, for the purposes of enabling a secure extranet, we're assuming that anonymous access will not be enabled.

With Per Server mode, you are using a concurrent licensing model - so you can have an unlimited number of users accessing the server (and thus any WSS sites) just as long as the maximum number of concurrent connections does not exceed the number of installed CALs.

With Per User / Per Device mode (formerly Per Seat mode), you must have a User or Device CAL for each unique User or Device that connects to the server. Therefore, if you wanted 100 separate users to access the server (and thus any WSS sites), you would need 100 User CALs.

Now, for vanilla Windows Server, you can also purchase an External Connector - which allows for an unlimited number of external users to connect to your server (and thus any WSS sites). Note that an external user is defined as “a person who is not an employee, or similar personnel of the company or its affiliates, and is not someone to whom you provide hosted services using the server software" - so you would still require the necessary CALs for internal users.

So - to use Windows Sharepoint Services as an extranet solution on vanilla Windows Server, the licensing structure that works best is dependant on the number of concurrent external connections that you are anticipating, as well as the licensing mode you're using for any other Windows servers in your domain. For a stand-alone server, you would probably be best served with a Per Server licensing mode and a smaller number of CALs - as you would only need to license the maximum number of concurrent connections (whether internal or external users). For a domain member server where the rest of the domain is using a Per User / Per Device mode, it makes sense to use the same Per User / Per Device mode on the WSS server, since your users / devices are already licensed. In this scenario, you would then need to purchase User CALs for each named external User. Once an organization is looking at more than 40 external users, then the External Connector makes sense (as Windows CALs are ~ $50 each, and the External Connector is ~ $2k). Again, the External Connector only licenses external users - so you would need CALs for internal users.

Now, things get a little less flexible when we start to talk about Small Business Server. First, remember that WSS is bound to the licensing mode / restrictions of the OS it's installed on. Second - we all know that SBS is always in Per User / Per Device licensing mode - we can't do Per Server licensing with SBS. As a result, we have to provide a CAL for each named User or Device that is going to be accessing (authenticating with) our SBS domain (we can't use a concurrent connections model). Third - there is no External Connector for SBS. So what does this mean? In simple terms, this means that if you want to use WSS on SBS as a secure extranet, you need an SBS CAL for each external user. And since SBS is limited to 75 CALs total - you're limited as to the number of external users who can access your WSS extranet (internal users + external users <= 75).

Does this suck for SBSers? Yeah - kinda. Although it is important to note that this wasn't an intentional restriction. Microsoft is aware of this restriction, and members of the SBS team have publicly stated* that they are going to correct this in future versions. While they haven't provided specifics on how they are going to correct this - I'm guessing we'll either have an updated EULA that explicitly allows external authenticated connections to WSS sites, or the addition of an SBS External Connector sku.

* Guy Haycock stated this during the Microsoft Partner Tour stop here in Omaha on 3/28