SBSDiva Mobile

One person's bsod does not mean that all of us will get bsod's

While I'm a person who recommends that you don't have to be first to install a Service pack, lately I've seen a little bit of a disturbing trend where someone will get a bad install or a BSOD and they will roll back to pre service pack without doing more investigation.

First some rules when it comes to the worse case scenerio of a BSOD.  That to me is not necessarily the worse thing you can happen to your system.  Worst case is that the system doesn't boot and provides no clues at all.  A BSOD with a dump file left on the box means that you can debug what freaked out the system.  A BSOD on one system doesn't mean that you'll get a BSOD on another system.

http://blogs.technet.com/petergal/archive/2006/03/23/422993.aspx

BSOD's 99.999999999% of the time are a third party driver.  Firing up the debugger and running it more often than not will point you in the right direction of what needs to be tracked down.

Do take a backup.

Do plan.

Do consider a Service pack a time that you need to also update the bios on the server, the nic drivers and in general look over the other "stuff" of a server that may need updating.

Don't willy nilly install it without planning.  But one person's story of a bad or failed install may not be indicative of the experience you have.  Not all servers are alike.  Not all systems have the same drivers.

So a story about one person's incident may not be signs of across the board issues.

Notes from the Seattle SBS build day

Listening to the gang in Seattle at the SBS build day and found a "I didn't know that" tidbit in Tyler's slide deck:

If you use group policy preferences to map drives AND the vista workstations are local admins still, the mapped drives won't 'take' unless you put in this registry key.  This key, aka the enable linked connections (that Chad's blogged about as well) will only impact you when your Vista's are local admins.

Create EnableLinkedConnections DWORD registry key:
HK_LM\Software\Microsoft\Windows\Current Version\Policies\System\EnableLinkedConnections = 1


Drive Mapping via Group Policy Preferences not working for Vista clients - Aimless Ramblings from a Blithering Lunatic . . .:
http://msmvps.com/blogs/cgross/archive/2009/03/25/drive-mapping-via-group-policy-preferences-not-working-for-vista-clients.aspx

Some other key take aways that I talked about:

Tattoo this blog post to your forehead:
The Official SBS Blog : SBS 2008 Migrations from SBS 2003 – Keys to Success:
http://blogs.technet.com/sbs/archive/2009/02/19/sbs-2008-migrations-from-sbs-2003-keys-to-success.aspx

Don't install a patch that needs WGA UNTIL you've put the proper key in the box:
MPECS Inc. Blog: Ack! SBS 2008 Not Genuine!:
http://blog.mpecsinc.ca/2009/05/ack-sbs-2008-not-genuine.html

Philip's Checklist:
MPECS Inc. Blog: SBS 2008 Setup Checklist V1.2.0:
http://blog.mpecsinc.ca/2009/05/sbs-2008-setup-checklist-v111.html

This not fixed in Win2k3 sp2:
The Official SBS Blog : Cannot resolve names in certain top level domains like .co.uk.:
http://blogs.technet.com/sbs/archive/2009/01/29/cannot-resolve-names-in-certain-top-level-domains-like-co-uk.aspx

This is included in Win2k8 sp2 so if you install SP2 you'll get this needed fix
New AFD connections fail when software that uses TDI drivers is installed on a Windows Server 2008 or Windows Vista SP1 system that is running on a computer that has multiple processors:
http://support.microsoft.com/default.aspx?scid=kb;en-us;961775

Does OpenDNS impact surfing speed?

http://msmvps.com/blogs/bradley/archive/2009/05/29/so-what-do-i-block.aspx

So I was asked if the use of OpenDNS makes a noticable slow down in surfing.  Not that I've seen.  And actually I think it speeds it up.  Like I said I do have little weird page issues only because I choose to block doubleclick.net but that's my choice.  (For example the final checkout page at Amazon has ads that are blocked by Opendns so as you 'exit' the store it will warn you that some content is not ssl protected.  Since I'm exiting the store anyway, it makes no impact to the security of the transaction.

Impact on surfing?  None that I can see.

Ability to instantly block bad sites across all networks?  Including my Dad's?  Priceless.

Server Fault: Calling All Lusers

Coding Horror: Server Fault: Calling All Lusers:
http://www.codinghorror.com/blog/archives/001269.html

I'm sad to say....

a. No

b. Yes

c.  Yes

d.  Yes

e.  Yes and I look for the new ones each year

And unasked question f.  Did you already go to ServerFault and see if there were SBS questions and how well they were being answered?

Guilty as charged.

New forum from the StackOverflow gang.  Check it out.

So what do I block

After this morning's presentation on "Stupid users and Attackers" I've been asked what categories and sites I block using OpenDNS.  One nice thing about OpenDNS is that I can manage several networks just from one console.  So the sites I block on one network can be different from another.

For example at the office I found that I had to reopen the "proxy-anonymizer" as there was a site we used (I forget now which one) that was being blocked. I also have uploaded a custom logo so that when people know they've been blocked, they know we mean it to be blocked.

But you may need to play around with the settings and not use the high and choose custom settings based on the needs of the firms.

I've also added some specific urls and blocked domains that I feel don't add anything but risk.  This is where my choice to block doubleclick comes in. Does is slightly make Amazon.com give off a weird message when you check out?  Yes it does, but if you tell people what to expect, it's not an issue.

And if the top things blocked are stuff like this?  I don't think it needs to be in my networks in the first place.

Group policy Defaults for SBS 2008

Links to to detailed pages that show the group policy settings

• Default Domain Policy
• Update Services Client Computers Policy
• Update Services Common Settings Policy
• Update Services Server Computer Policy
• Windows SBS CSE Policy
• Windows SBS User Policy

Under Domain Controllers
Default Domain Controllers Policy

Under MyBusinessOU, Computers, SBSComputers

• Windows SBS Client - Windows Vista Policy
• Windows SBS Client - Windows XP Policy
• Windows SBS Client Policy

Under MyBusinessOU, Users, SBSUsers
Small Business Server Folder Redirection Policy

An entire zip file of the raw (as in no wizards run) Group policy settings of a freshly built SBS 2008 box if you need to do any comparisons for any reason.

Get your UAC Defense in Depth Slider shirts here!

If you want to make your own Windows 7 Tshirt - you can download the images from here:
http://cid-c756c44362cd94ad.skydrive.live.com/browse.aspx/Windows%207?uc=2  They are in various image types and sizes for your use.

You can print out the images (some of them are large for good resolution) and then print them with a color printer on iron on transfer paper --examples include the products below:
http://www.avery.com/avery/en_us/Products/Crafts-%26-Scrapbooking/Fabric-Transfers/T_Shirt-Transfer_08938.htm
http://desktoppub.about.com/od/transfers/a/IronOnTransfers.htm
http://www.proworldinc.com/
http://www.mcgpaper.com/tshirt1.html

If you want to get a more "professional" image of the UAC pull up your Defense in Depth Slider - I've uploaded the image to CafePress.com so that you can buy shirts from them:
http://www.cafepress.com/windows7

Remember to bring your UAC slider bar all the way to the top

That's what the shirt is all about.  Zip your slider up for best protection!

So what's the real default policies?

http://msmvps.com/blogs/bradley/archive/2009/05/28/so-what-s-the-default-group-policies-for-sbs-2008.aspx

Ignore that post.  I forgot and picked the server that was in the middle of migrating from SBS 2003 to SBS 2008 and it has 2k3 leftovers still in it.

Stay tuned for the RIGHT default policies on a clean box (formatted nicer as well)

So what's the default group policies for SBS 2008?

Starting off with the first policy - Default Domain Policy

Webcast on risk and threats tomorrow

Tomorrow I'll be doing a presentation that while it has SBS 2008 in the title, isn't just about SBS.  It's really about Risk assessment.

If you attend I'll be giving away to one lucky random attendee, a copy of Mark Minasi's Securing your Windows Systems CDrom - http://www.minasi.com/seccd/

Who knows, I may throw in a bonus Windows 7 tshirt to a lucky viewer!

Which is the bigger threat to a small firm? External attackers or Stupid Users? Perhaps both? Join Susan Bradley, Patch Watch author for Brian Livingston's Windows Secrets as she guides you down the resources and tools she uses to secure and protect a small firm from both kinds of attackers. Along the way she'll point out the security features of SBS 2008 and resources to keeping both the server and users safe and secure on the Internet Highway.

https://training.partner.microsoft.com/plc/details.aspx?publisher=12&delivery=259640

How many of you have found rogue antivirus programs on workstations?

How many of you have found enough IE toolbars to sink a ship on a workstation?

Is Google a risk to use as a search engine?

How many of you get calls from clients that have to deal with users going to twitter, facebook, and have you considered what the impact of these social sites have on the security and privacy of the employees of the network?

What proactive steps are you doing to ensure that you are balancing the needs of the business with the needs to secure the business?

Do you need to worry about Zero Day attacks?

What's the best way to secure a Windows XP machine?

Does Cloud offerings help or do they bring risks as well?

All of this and more will be answered on 5/29/09 at 9:00 AM Pacific.  Sign up here:  https://training.partner.microsoft.com/plc/details.aspx?publisher=12&delivery=259640

Why The Cloud is Perfect for SMB Companies: No Upfront Costs and No Risk

Cloud Computing Conference 2009 - Why The Cloud is Perfect for SMB Companies: No Upfront Costs and No Risk - Nuno Filipe Godinho:
http://msmvps.com/blogs/nunogodinho/archive/2009/05/28/cloud-computing-conference-2009-why-the-cloud-is-perfect-for-smb-companies-no-upfront-costs-and-no-risk.aspx
http://2009.cloudviews.org/site/?cat=4

A fellow MVP is obviously in attendance at a Conference that the headline for one session caught my eye.

Oh please.  While cloud computing can be perfect for SOME SMB companies, to say that there is No risk?  Give me a break.  There is always risk.  Life is full of risk.  The issue is that you have to mitigate risk.

Risk of internet connection speeds being non optimal.  Risk of not having line of business apps that are optimized for it.

Nothing is without risk, on premise solutions are not without risk and cloud hype is certainly not without risk.

When reality meets TechEd

Tonight at the partner group meeting I had a beta copy of Exchange 2010 to hand out.

And no one wanted it.

The reality of the "real world" is that no one has time to play with the betas and the stuff not yet out, they are dealing with the reality of the here and now.  Here and now is still getting up to speed on Exchange 2007.  It's realizing that the way to control/manage public folders in Exchange 2007 is not with a wizard or a GUI, but with a tool.  It's realizing that while many in the desktop world is waiting with baited breath for Windows 7 to come out as they skipped over Vista, as far as the Exchange and Server world is concerned, messaging and servers move a lot slower.  It is not trivial to move and migrate this stuff over. 

The reality is that we'll be supporting and maintaining Exchange 2003 and Exchange 2007 long after Exchange 2010 comes out.

Windows 7 - pull your slider up

Windows 7: User Account Control (UAC) overview:
http://www.neowin.net/news/main/09/01/07/windows-7-whats-up-with-the-uac

One of the issues I have with the much complained about UAC in Vista is that it got a bad rap.  For the bulk of the user population if you turned off UAC when you installed software and then turned it on right after, you never saw it again. 

Steve Friedl wrote a very good techdoc on how to set up a limited user account in Windows 7 http://unixwiz.net/techtips/win7-limited-user.html

But the point of this blog post is more about how I think people should be zipping up their Windows 7.  UAC should be up at the top of their defense in depth slider bar (In fact, I have a sushi food bet that by the time Windows 7 SP1 ships they will make the default of that UAC slider bar back up to the top.  Anyone who knows anything at all about me knows that I don't much like raw fish)

So here you have it, Susan's single handed marketing campaign to get you to slide your Defense in depth zipper up.

Boxers, Tshirts, Mugs, hats and other swag will be out shortly.

Cartoon is once again done by the brilliant Curtis of www.Curtoons.com

Links discussed at the Partner group meeting tonight

One of the videos we discussed at the meeting was this one:

Direct Access Simplified with Corey Hynes | Media | TechNet Edge:
http://edge.technet.com/Media/Direct-Access-Simplified-with-Corey-Hines/

This tool was discussed:  http://code.msdn.microsoft.com/HVRemote/Release/ProjectReleases.aspx?ReleaseId=2338

And recent posts about WHS and Kevin Royalty's upcoming presentation on it was discussed:

http://ncix.com/products/?sku=37196&vpn=PG%2ET170W%2E007&manufacture=Acer&promoid=1018

http://msmvps.com/blogs/kwsupport/archive/2009/05/27/whs-and-the-acer-aspire-easystore-h340.aspx

http://www.wegotserved.co.uk/2009/04/30/hands-on-acer-aspire-easystore-home-server/

Kevin's WHS presentation in June:
https://training.partner.microsoft.com/plc/details.aspx?publisher=12&delivery=259641 
Business Opportunities with Windows Home Server - Updated with Power Pack 2 Content

TechEd recap tonight at the Partner group meeting

TechEd recap.  Me and Ed Roberts talked about TechEd topics, we then showed off Win2k8 R2 RC, handed out Win7 dvds, and showed the new backup features, Direct Access, Branch Cache and in general talked about HyperV, specing of Servers.  A lot of show and tell tonight.

One of the things we were talking about that I couldn't get my head around is how to put the virtualization on a phyiscal server.  In a traditional SBS 2003 box you'd stick your OS on few smaller drives and then have your larger drives (raid 5 or raid 10) doing the data drives.  But in a virtualized HyperV base that you then put your SBS 2008 on, where should the separate "drives" go on that HyperV base?  Should the virtualized C: boot partition go on the real C: of the HyperV base or should it be on the faster RAID for more disk I/O? 

Lots of good discussions on how to setup and configure the system.

The Official SBS Blog : Error "Administrator Does Not Have Exchange Administrator Rights" When Creating or Deleting User in SBS 2008 Console

The Official SBS Blog : Error "Administrator Does Not Have Exchange Administrator Rights" When Creating or Deleting User in SBS 2008 Console: http://blogs.technet.com/sbs/archive/2009/05/27/error-administrator-does-not-have-exchange-administrator-rights-when-creating-or-deleting-user-in-sbs-2008-console.aspx

The Official SBS Blog : Windows 2008 and Windows Vista Service Pack (SP) 2 Available Now:

The Official SBS Blog : Windows 2008 and Windows Vista Service Pack (SP) 2 Available Now:
http://blogs.technet.com/sbs/archive/2009/05/26/windows-2008-and-windows-vista-service-pack-sp-2-available-now.aspx

You remember in the first part of the Disney Aladdin movie where the Narrator says "come closer, closer, come closer?"

I really need to tell you something, so you need to come closer.

Now that you are right here where you can really hear me really well....

MAKE SURE YOU MAKE A BACKUP BEFORE APPLYING SERVICE PACK 2!

It is not necessary to be the first one installing ANY service pack.  Always always always always have a planned maintenance window and in this day and age of vmware and hyperV, have your FIRST install be on a virtual box that you've made a snapshot of and all you are doing it for it just to understand the install process when you do it on a real live box.

Mini is 50 years old

A big Mini day out - thousands take to the road for Mini's 50th anniversary | Mail Online:
http://www.dailymail.co.uk/motoring/article-1183674/A-big-Mini-day--thousands-road-Minis-50th-anniversary.html

Mini owners unite across generation gap to celebrate birthday - The Irish Times - Wed, May 27, 2009:
http://www.irishtimes.com/newspaper/motors/2009/0527/1224247485583.html

No I didn't get to go to the UK for the big "50th" bash, but as you can see a lot of other folks did.

So far I have a Mini Cooper shirt, jacket, shoes, sweatshirt, badges....

The latest addition to the car is a temporary sticker that goes on the passing side that says "You just got smoked by a clown car".

A bit evil I know but so fun.

The inability to efficiently search for that EBS Prep wizard tool

....means that I just parked another domain name and a redirect.  Sometimes it gets annoying to constantly use Google to get to a needed resource.  And after all, http was built for a reason so we wouldn't have to remember all those numbers anyway.

http://www.ebspreptool.com/

That I can remember.

http://www.microsoft.com/downloads/details.aspx?FamilyId=E3906025-00E3-407D-BF5B-99D546021923&displaylang=en

That I can't.

So far we have short cuts to the SBS 2008 newsgroup courtesy of Russ -- www.sbs2008.com and the EBS newsgroup courtesy of Russ www.ebs2008.com

And I have short cuts for all the WHS community links - www.whs-community.com and SBS community links - www.sbs-community.com and EBS community links - www.ebs-community.com

Oh yeah and we have www.sbsbpa.com for the SBS Best practice Analyzer.

Maybe I should just park the domain of www.Susancan'tremembertheactualwebsitesurlssoheretheyare.com?

The Official SBS Blog : SBS 2008 Migrations from SBS 2003 – Keys to Success:

The Official SBS Blog : SBS 2008 Migrations from SBS 2003 – Keys to Success:
http://blogs.technet.com/sbs/archive/2009/02/19/sbs-2008-migrations-from-sbs-2003-keys-to-success.aspx

How the SBSBPA differes from the EBS Prep tools recommended in that post:

SBS BPA checks the health specifically for SBS 2003. 

In that list the only item that is specifically going to cause me issues is the Exchange functional level.

In the EBS Health scan tool, the main difference is that the EBS health tool checks for AD replication issus that the SBSBPA may not catch.  Then it checks DHCP, DNS, etc but it's checking general health of the network in potential replication issues.

Thus it's wise to run BOTH tools when preparing for SBS 2008 migrations.

And one of the first steps that BOTH tools tell you to do in order to migrate to Exchange 2007 is to flip the Exchange server to Native mode.

1. Start Exchange System Manager. Click Start, point to Programs, point to Microsoft Exchange, and then click System Manager.
2. Right-click the organization, and then click Properties.
3. Click the General tab, and then click Change Mode under Change Operations Mode. Click Yes if you are sure that you want to permanently switch the organization's mode to native mode.