The other steveb - Steve Banks' Blog on SBS, EBS, and other Small Business Technology Topics

Mark's Rules for Successful Replacement Mode - MR4SRM. RM = replacment mode

steveb — Fri, 06 Nov 2009 19:50:00 GMT

Second in the Mark Stanfill EBS 2008 tweet series (check out his TMG series here), we have Mark's latest on Rules for Successful Replacement Mode. As before, I'll be updating this post with new tweets as Mark sends them out. Be sure to check back for updates.

#EBS08 New Series - Mark's Rules for Successful Replacement Mode - MR4SRM. RM = replacment mode.

#EBS08 MR4SRM Rule #1 - Make a complete server backup first. No exceptions.

#EBS08 MR4SRM Export config to XML using http://bit.ly/2jlxkE. Pay special attention to all IP addresses . Make sure they're corrrect.

#EBS08 MR4SRM You need 2 functional EBS servers for Replacement Mode. If not, restore one server from backup.

#EBS08 MR4SRM Always back up CALs on Mgmt server before RM.

#EBS08 MR4SRM Mgmt server needs CALs reinstalled or restore post RM.

#EBS08 MR4SRM Mgmt Server RM will pull down all WSUS data again - many GB. Export & import - http://bit.ly/4DUxtN. Backup data drive

#EBS08 MR4SRM All servers are going to need patching. Expect many reboots, considerable time.

#EBS08 MR4SRM Security & Msg can pull updates from WSUS rather than MU. Deselect optional updates during RM. Critical updates come from MU

#EBS08 MR4SRM Make sure AD is healthy before RM. Always run IT Health Scanner first - http://bit.ly/Od1uH

#EBS08 MR4SRM Never, ever delete computer accounts or run metadata cleanup before RM. http://bit.ly/Cwsrr

#EBS08 MR4SRM All DCs need to be online and contactable before RM.

#EBS08 MR4SRM Make sure IIS is healthy, started, listening on port 808 for /remoting directory on all servers before RM.

#EBS08 MR4SRM Run "dnscmd /config /enableglobalqueryblocklist 0" for wpad autodiscovery - http://bit.ly/3NceQm

#EBS08 MR4SRM Management Server restore - repair all SCE clients underAdministration node.

#EBS08 MR4SRM RM on Messaging obviously does not restore mailboxes & PFs. Make backups first - online, offline, PSTs. Belt and suspenders.

#EBS08 MR4SRM To get Security Server to report back to SCE after RM - "net stop fweng /y", repair SCE client, restart services

#EBS08 MR4SRM Remove UM (if present) from Exchange before RM of Messaging Server to avoid setup failure.

Hey, I know this guy! :-)

steveb — Thu, 29 Oct 2009 05:26:00 GMT

Get to know the Windows Home Server Team: Video interview with Jonas Svensson, Community Program Manager

Today the Windows Home Server Blog, tomorrow your own TV series! ;-)

Windows Server 2008 R2 ebook - Get yours now!

steveb — Thu, 29 Oct 2009 05:05:00 GMT

Thank you Charlie and Craig for writing it, and Microsoft for offering it up. Get your own copy of the Introducing Windows Server 2008 R2 ebook for free!

MS Partner Licensing Information and SKU lookup

steveb — Mon, 26 Oct 2009 17:52:00 GMT

Looking for the SKU for Microsoft Server 2008 Remote Desktop Services by chance? The US price list, in addition to the License Configurator tool are at https://partner.microsoft.com/US/licensing/licensingchoices/licenseconfigurator. Get there by logging into your MS Partner account and clicking on the URL in the last sentence, or from the licensing tab, then expanding "Making Licensing Choices" on the left (at least at the time I wrote this post).

Karl Palachuk is Seattle Bound!

steveb — Mon, 26 Oct 2009 15:31:00 GMT

Here's a quick advertisement for Karl's next Seattle visit. I've already bought my ticket, so I'll see you there. - Steve

Meet Karl in Seattle on Tuesday, November 3rd

6:30 PM – 9:00 PM
Introduction to Project Management and Zero Downtime Migration Strategies

$10 discount available instantly. Just use discount code SEA200911 at checkout.

For more info, see http://www.smbbooks.com/categories/seminars.htm

Mark's rules for TMG Firewall client (MRFTFC)

steveb — Thu, 08 Oct 2009 17:45:00 GMT

Mark Stanfill has started a great series, via his Twitter account, covering EBS rules for TMG. So good that I thought it a great idea to include them here. I'll add to this post as he adds additional rules. Following are the first sets, plus a bonus precursor:

#EBS08 New series: Mark's rules for TMG Firewall client (MRFTFC)

#EBS08 Never use 'route add' on TMG. Use the TMG getting started wizard instead. Look for startup scripts that do route adds,exclude admin

#EBS08 MRFTFC #1 - You probably don't need th FWC. 99% of apps can get by with SNAT and web proxy

#EBS08 MRFTFC #2 - Install from Management Server (not Security): C:\Program Files\Windows Essential Business Server\bin\ISA\client

#EBS08 MRFTFC #3 You only need the FWC if you have an APP that needs it or if you want to track access by user rather than by IP.

#EBS08 MRFTFC #4 Down-level FWC from ISA 2004/6 still works, but you should update it if you use it.

New #EBS08 TMG rule 1 - never, ever use "route add" - you will corrupt the IP stack

New #EBS08 TMG rule 2 - add routes via the getting started wizard only - TMG Console -> Forefront TMG -> Tasks

New #EBS08 TMG rule 3 - Only use TMG Console to configure VPN, never RRAS Mgmt console

New #EBS08 TMG rule 4 - Never, ever,ever, ever disable IPv6 on Security Server - you will never fix anything, but you will break RRAS

New #EBS08 TMG rule 5 - Networks under TMG Console\Networking\Networks must have an interface on TMG server itself or we'll drop traffic

New #EBS08 TMG rule 6 - deploy firewall client via gpo from MGMT server: c:\progra~1\window~3\bin\isa\client --- Exclude Servers from GPO

-Additional markstan comment: It depends on the app and the environment. Use FWC if you need user auditing, don't want to use default gateway, or know that you will have a lot of custom protocols. Undefined protocols = block for SNAT, access for FWC.

New #EBS08 TMG rule 7 - for WMI to work you must disable Enforce Strict RPC Compliance on all applicable access policies and system policies

#EBS08 TMG-if you are publishing TS 2 another server, TS 2 TMG will fail. Set the winstations regkey to 3390 on TMG,reboot cr8 access policy. Set the winstations regkey to 3390 on TMG,reboot create access policy for internal to localhost

#EBS08 TMG - Want to query RBLs 4 SMTP? Create an access rule for DNS (not dns server) from localhost to external. Not there by default.

#EBS08 TMG rule - TMG requires IPv6. Never disable via registry or uncheck from ncpa.cpl. This will lead to routing issues and application crashes. I've seen random blue screens, but never been able to repro.

#EBS08 TMG tip - you can copy rules via ctrl-c/ctrl-v, modify settings (like port #) to save time.

#EBS08 TMG tip - getting started wizard (for adding static routes) must be ran on Security Server itself (can't do from mgmt)

#EBS08 TMG TIP - slow web page load/dns name resolution - use the script from http://bit.ly/4tuT6u

#EBS08 TMG TIP 3 updates that need additional work on Security Server - http://bit.ly/3kD7na http://bit.ly/1IeVCM and http://bit.ly/2NypqT

#EBS08 TMG Tip - TMG comes with a 1yr AV subscription. TMG Console\Update Center\Highlight 'Malware Inspection'\Configure License details

#EBS08 TMG TIP - renew licensing for TMG - http://bit.ly/aCRtl To renew, contact your Microsoft Partner or Small Business Specialist.

#EBS08 TMG -Networking\Networks\Internal\Web Browser-'Directly access computers specified in the addresses tab' needs to be checked

#EBS08 TMG TIP - quick TMG backup - EBSAdmin console\Security tab\highlight Network firewall\Save network firewall settings

#EBS08 TMG TIP - Native TMG backup- right-click forefront TMG (servername) in TMG Console -> Export (Back Up)... - choose the defaults.

#EBS08 TMG : Reset TMG to day1 (all ebs services published) in Admin Console\Security\Network firewall\restore default network firewall set

#EBS08 TMG - TMG has a 1 GB limit on http downloads by default

#EBS08 TMG - tmg download limts = TMG Console\Web Access Policy\Configure Malware Inspection\Inspection Settings

#EBS08 TMG - Email a daily network usage report - TMG Console\Monitoring\Reporting\Create Recurring Report Job

#EBS08 - To run IT Health Scanner w/ TMG - create allow all access rule as rule #1, disable strict rpc checking there & on system policy\AD

- blog post: http://bit.ly/2nwQh3 - How to run the IT Environment Health Scanner in an EBS Environment

#EBS08 - Update to blog post - http://bit.ly/3oWBYO - Preparation Wizard/IT Environment Health Scanner fail with DNS WMI Provider error

Not labeled TMG by Mark, but worth having in this list:

#EBS08 browser access from security server itself - you must manually configure proxy, port 8080, set exclusion for local domain

#EBS08 - security server unable to get updates? Check the proxy exclusions list first.

#EBS08 MRFTFC - Address ranges, subnets, and computer set objects should not contain the TMG server’s IPs (rare exceptions).

#EBS08 MRFTFC - OWA HTTP 500/error 12217 = disable normalization on the OWA publishing rule

#EBS08 MRFTFC OWA "Could not connect to a directory server" error = disable link translation on OWA publishing rule. http://bit.ly/OXr0X

Need to tame TMG in EBS 2008? Here's your ticket!

steveb — Sat, 26 Sep 2009 13:37:00 GMT

After having a few weeks of close and personal time with TMG at one of our EBS sites, I had a chance to deploy and use this at another and it is awesome. If you run into a blocking issue that you need to deal with ASAP, you can drop down the overall level of TMG with the click of a button and alleviate your pain while you work on a new rule to drop into TMG to fix the original challenge. Or drop down the firewalling in TMG altogether and allow yourself the option of using a hardware firewall.

Chico and Sean Daniel get interviewed!

steveb — Tue, 22 Sep 2009 19:17:00 GMT

Check out Sean and Chico's Microspotting interview!

So when do I get to take a float plane ride with you up to your place? :-)

SBS/EBS 2008 Remote Web Workplace not working for you?

steveb — Mon, 21 Sep 2009 18:23:00 GMT

Having trouble getting to your SBS or EBS 2008 Remote Web Workplace (RWW) from your remote computer? Check to make sure you have the certificate package installed on your client computer.

SBS Links to learn more:

http://technet.microsoft.com/en-us/library/dd353115(WS.10).aspx
http://blogs.technet.com/sbs/archive/2008/09/30/how-do-i-distribute-the-sbs-2008-self-signed-ssl-certificate-to-my-users.aspx
http://blogs.technet.com/sbs/archive/2008/10/03/receiving-certificate-errors-when-connecting-to-clients-servers-with-ts-gateway-or-remote-web-workplace-on-sbs-2008.aspx

EBS Links to learn more at:

http://technet.microsoft.com/en-us/library/cc463553(WS.10).aspx
http://technet.microsoft.com/en-us/library/cc463480(WS.10).aspx

No, it's not an iPhone, it's a wPhone. ;-)

steveb — Tue, 01 Sep 2009 15:16:00 GMT

That's "w" for WIndows... and Wi-Fi!

Many thanks to Chris Rue for turning me onto this Engadget post with the awesome news that as of 9/14/09 AT&T is going to give Windows Mobile users unlimited access to AT&T Wi-Fi Hot Spots nationwide. And with WM 6.5 coming out in October, I feel a Fuze buring a hole in its EB Case, making way for a newer and cooler WM6.5 toy productivity tool.

How to install Exchange Server 2007 Service Pack 2 on SBS & EBS 2008

steveb — Wed, 26 Aug 2009 01:58:00 GMT

BEFORE installing Exchange SP2 on your EBS network, read the KB article and the EBS Official Blog post! :-)

For SBS, check out the SBS Official Blog post.

Until you hear otherwise from Microsoft, do not install Exchange 2007 SP2 on EBS or SBS without following the guidance on their respective blogs and the KB articles.

How to Add 32-bit Print Drivers to SBS 2008 & EBS 2008

steveb — Wed, 19 Aug 2009 02:03:00 GMT

If you are dealing with a 64-bit print server and are looking for 32-bit drivers, this post is for you. Also works if you are on x64 clients and want to add the driver to a 32-bit server (SBS 2003 for example).

Check out the Official SBS Team Blog's post for screen shots and the full text.

Short version, is browse to the server from your 32-bit client PC while logged in with an account that has server admin rights, select the printers and faxes share, and then server properties from the file menu. Drivers tab, then add. You'll have it from there, or jump over to the SBS blog for screen snips and more details.

Terminal Server Access through RWW in EBS & SBS

steveb — Mon, 17 Aug 2009 19:06:00 GMT

Have had a few questions about Terminal Server through EBS and SBS RWW, so thought I would post a link over to the Microsoft KB on it and include the resolutions from the KB below. While not directly supported by design, here are the workarounds for both EBS 2008 and SBS 2008.

EBS 2008:

EBS 2008 does not support directly connecting to a Terminal Server through RWW. In larger environments, publishing a large number of connections through the Messaging Server's TS Gateway may cause a resource spike on the server.

In environments where it is desired to have connectivity through the RWW page, there are several workarounds available:

1. Publish the Terminal Server's RDP port (3389 by default) through TMG. See http://technet.microsoft.com/en-us/library/cc995085.aspx for more details.

2. Distribute .RDP files configured to use TS Gateway to end users.

3. Add a link for the Terminal Server in RWW. To do this, use the following steps:

Log on to the Messaging Server directly using an account with administrative rights.
Edit %ProgramFiles%\Windows Essential Business Server\Bin\webapp\Remote\App_Data\OrganizationLinks.XML in Notepad
Add a Link tag in the Gadget Section using the format:

<Link DisplayText="TS" Url=https://<REMOTEURL>/Remote/tsweb.aspx?targetMachine=<TSNAME> _locID="useTS" />

Where <REMOTEURL> is the FQDN of your RWW server and <TSNAME> is the host name of the internal Terminal Server you are trying to access. For example:

SBS 2008:

The Small Business Server 2008 (SBS 2008) version of RWW does support adding a registry key to reveal Terminal Servers in the domain (see http://technet.microsoft.com/en-us/library/cc527532(WS.10).aspx). This registry setting has no effect in EBS.

Example OrganizationalLinks.XML:

<?xml version="1.0"?>
<GadgetSection Name="Organizational" Enabled="true" DisplayText="">
  <_locDefinition>
    <_locDefault _loc="locNone"/>
    <_locTag _locAttrData="DisplayText">GadgetSection</_locTag>
    <_locTag _locAttrData="DisplayText">Link</_locTag>
  </_locDefinition>
  <Link DisplayText="How to use Remote Web Workplace" Url="http://go.microsoft.com/fwlink/?LinkId=115334" _locId="UseRWW"/>
  <Link DisplayText="How to configure Outlook to access your email over the Internet" Url="http://go.microsoft.com/fwlink/?LinkId=115339" _locId="ConfigureOutlook"/>
  <Link DisplayText="TS" Url=https://remote.contoso.com/Remote/tsweb.aspx?targetMachine=MyTS  _locID="useTS" />
</GadgetSection>

HTC Fuze ROM Update- Version 5.11.502.2 WWE

steveb — Fri, 14 Aug 2009 18:38:00 GMT

Stumbled across this today on the HTC site. Downloading mine now. Looks like they have been listening to the "suggestions" out there from us Fuze users! Reassignable PTT button, quicker GPS startup, Music Player album art/info (although my 120GB Zune is now where I put all my music these days), better TouchFlo3D. Can't wait to try it out! Thanks HTC and AT&T!

Download the HTC Fuze ROM Update- Version 5.11.502.2 WWE

Release Date: 2009-05-28 Category: ROM Upgrade

Why Update: This ROM update is intended for the HTC Fuze for AT&T only and users should not load or attempt to load this version on any other device as it may cause serious issues/damage.

What’s included:

	Microsoft's Windows Mobile Adaptation Kit Update (AKU) 1.4.6
	Slide to Answer
	Push To Talk Button is now re-assignable
	FM Radio Application
	Enhanced MS Voice Command
	Call waiting indicator is now audible when using Speakerphone
	HTC Music player supports Album art/info
	Improved TouchFlo3D (TF3D) and User Interface performance
	A-GPS Update: Speeds up the time it takes the GPS to get a fix on your location
	Quick GPS is still recommended for the optimal operation of GPS based applications and services

Calyptix and Third Tier team up for a great support combo!

steveb — Thu, 13 Aug 2009 13:44:00 GMT

Congratulations to both Calyptix and Third Tier for a great idea in bringing in Third Tier as Calyptix's AccessEnforcer™ integration support team. From my personal experience with both companies and their respective key individuals, I see this as a win-win combination for everyone involved. Calyptix, Third Tier, Calyptix's partners and most importantly, Calyptix's end user customers. Check out the BusinessWire press release!

Very cool news indeed!

Steve

Exchange Hanging on your SBS or EBS 2008?

steveb — Mon, 03 Aug 2009 16:38:00 GMT

If you are running VSS snapshot backups of Exchange 2007, thank the folks over at StorageCraft and Microsoft for working together to come up with a fix. I'd recommend you get it installed sooner than later if you have had your Exchange Server hanging on you and you backup with StorageCraft ShadowProtect, Microsoft DPM, or other VSS based backups.

EBS Prep and Planning Tools REALLY need a bypass switch for Greenfield deployments.

steveb — Mon, 20 Apr 2009 22:36:00 GMT

With all due respect to the Essential Business Server team and the awesome job they have done with EBS, I would really like a bypass switch on the Planning and Preparation Wizard for fresh installs. Thank you Nicholas for your Blog post on how to get "around" it by running it on your laptop/Tablet PC, but at least the information we key in there could be used to populate the fields in the MGT configuration after it requests it. :-)

Microsoft CSS earned their award!

steveb — Fri, 17 Apr 2009 05:12:00 GMT

You all deserved the award! We were honored to present it to you!

Check out the Official SBS Blog for a picture of the Outstanding Community Supporter Award the SBS MVPs presented to them on behalf of the Small Business Server community. They earned it for the great work they have done over the past year, and past years! :-)

Trend Micro Best Practices

steveb — Thu, 26 Mar 2009 21:30:00 GMT

Below is a link on how to configure Trend Micro products for best protection against malware threats that I received from Trend today and thought I would pass along:

http://esupport.trendmicro.com/pages/How-to-configure-Trend-Micro-products-for-best-protection-against-malw.aspx

Steve

Response Point SP2 Demo this month at PSSBS' meeting in Bellevue

steveb — Fri, 06 Mar 2009 01:51:00 GMT

Rex Backman, Senior Business and Channel Development Manager at Microsoft Research, and long time friend and member of the Puget Sound Small Business Server group, Mike Iem, will be doing a presentation and demo this month on Response Point SP2, Microsoft's phone system for small business, at our March 19th PSSBS meeting. Be sure to attend and get a first hand look at Response Point SP2 . Meeting will be from 6 PM - 8:30 PM, with the Response Point presentation running from 6 PM - 7 PM.