Search results for 'app:weblogs' matching tag 'sbs 2008'

Killing off ISA

cgross — Sun, 11 Oct 2009 05:00:00 GMT

Earlier today Susan blogged about upgrade season in her office, and getting ready to migrate from SBS 2003 to 2008. In that post, she talked about uninstalling ISA and mentioned a post that Kevin has on that subject. I thought I’d take a moment to expand a little bit on Kevin’s post and add a few thoughts from my own battle scars with removing ISA.

First and foremost – Kevin mentions removing the ISA firewall client from all of your PCs before you remove ISA from the server. I cannot overstate how crucial this step is. The ISA 2004 firewall client uninstaller wants access to the original installation MSI, which lives in a share on your SBS box. This share is actually the Clients folder in the ISA installation directory. So what happens when you remove ISA from your SBS? You guessed it – the mspclnt share with the firewall client installation files is removed, which means any firewall clients still installed on PCs are not going to be happy when you try to remove them and they can’t find the MSI.

Since the Clients folder under the ISA installation folder is typically only about 5MB, I copy this folder to a safe spot on the server – usually my Tech directory where we keep various utilities and scripts. Here’s why – more and more, customers are backing up their workstations whether via Acronis / StorageCraft / Windows Home Server. We may find ourselves at a point in the not so distant future after removing ISA that we need to restore a PC from an image taken before ISA was removed, and need to remove the firewall client again. Or we may discover a forgotten PC / laptop that we missed removing the firewall client from. There’s all sorts of scenarios – but by keeping the Clients folder in-tact, we can share that out with the original mspclnt share name at any time and be able to uninstall the firewall client just like ISA was still installed on the server. Without the mspclnt share, you have a very VERY ugly path in front of you, and it is safe to say that you may end up facing the decision of living with the firewall client still on the machines, or wiping & re-installing the OS . . .

Second – Kevin also makes a brief mention about proxy settings. When you uninstall the firewall client from a PC, it will automatically disable proxy settings for the user account that is running the uninstall, but not for any other users on the machine. So if you have a PC that multiple users log in to, or if you are running a terminal server, be prepared for some proxy pain. I actually have a little VBScript that disables proxy settings for the current user by changing the value of the HKCU\Software\Microsoft\Windows\CurrentVersion\InternetSettings\ProxyEnable key from 1 to 0. I modify my login script to call the VBScript, in effect ensuring proxy gets disabled for each user when they log in to each machine.

The other aspect with proxy settings to keep in mind are your server-side applications. Unless you modified your ISA firewall policy to allow unauthenticated outbound http access from the server itself, you most likely specified proxy information for apps like Trend Micro’s Worry-Free Business Security or even WSUS – so that they can download their updates automatically. After removing ISA, you no longer have a proxy server, which means apps configured to use a proxy aren’t going to be able to get out to the internet. As a result, you stop getting automatic updates for things like A/V. So you will need to manually update the connection settings in these apps to remove the proxy settings previously defined.

So – here’s my quick checklist for removing ISA from your network & installing a hardware firewall:

Prep your hardware firewall in a lab setting. Enter in all public IP info, disable DHCP, and create all of our inbound rules. It’s best to do this while ISA is still installed & working, so you can refer to the rules in ISA to make sure you don’t miss any necessary inbound rules for your environment.
Backup your ISA configuration. While we’re moving away from ISA permanently, if we do encounter an issue with the new hardware solution where something isn’t working that was working with ISA, the ISA backup is an XML file that is relatively easy to read to see what rules you had and what they did without having to reinstall & restore ISA on your SBS.
Open up your outbound access in ISA by creating the proverbial ALL/ALL/ALL rule. In other words, create a new access rule in ISA allowing All outbound traffic via all protocols for all users/computers. Much of the internet access in ISA on SBS is dependent on users being members of the Internet Users security group. The firewall client on the PCs is what actually passes user info to the ISA server so it can check group membership. Once we remove the firewall client from PCs, ISA isn’t going to be getting user info and some stuff that worked before isn’t going to work now. If you only have 5 PCs and are moving from ISA to your hardware firewall on a Sunday when no one is working, you might be able to skip this step. But if you have a larger number of PCs, etc. this helps to insure you don’t disrupt users’ internet access too much while removing the firewall client . . .
In my case, I update my domain login script to call my DisableProxy.vbs script at this point.
Uninstall the firewall client from ALL PCs. Again – see my notes above. Your life will be MUCH simpler if you insure the firewall client is completely removed from all PCs before removing ISA from your server.
Copy the contents of the mspclnt share (%programfiles%\Microsoft ISA Server\Clients by default) to a safe location on the server, and plan to keep this folder safe for some time
Follow Kevin’s steps 3-9 to remove ISA from the server.
When you re-run the CEICW, it should automatically update the DHCP scope option on the server to use the internal IP of the new hardware firewall as the default gateway setting. If you have any devices that are using static IP addresses, you will need to manually update those with the new gateway. (HINT: Take a few extra minutes to create DHCP reservations for each device using a static IP, and change those devices to DHCP – so if you have another network reconfiguration in the future, all you have to do is reboot those devices instead of reconfigure . For all of your other DHCP devices, you will want to run an ipconfig /release followed by an ipconfig /renew to update their IP settings so they pull the new gateway, or you can reboot them as well. HINT 2 – PSTools are your friend. Create a batch file with the two ipconfig commands, and use PSExec to push & execute the batch file on all machines in the domain from the server. 5 minutes tops to update the IPConfig on all domain machines (that are online) instead of sneakernetting . . .
ALSO – if you followed Jim Harrison’s steps to configure auto-detection of proxy settings on your SBS LAN, you want to remove the wpad A record from your internal AD domain forward lookup zone in DNS – otherwise you may have devices pulling proxy settings for pointing to your non-existent proxy server via auto-detect.

So that’s my addendum to Kevin’s excellent post.

P.S. . . . and if you haven’t decided on a hardware firewall yet, I highly recommend Calyptix devices. These are the standard devices we are implementing when migrating customers to SBS 2008.

SBS/EBS 2008 Remote Web Workplace not working for you?

steveb — Mon, 21 Sep 2009 05:00:00 GMT

Having trouble getting to your SBS or EBS 2008 Remote Web Workplace (RWW) from your remote computer? Check to make sure you have the certificate package installed on your client computer.

SBS Links to learn more:

http://technet.microsoft.com/en-us/library/dd353115(WS.10).aspx
http://blogs.technet.com/sbs/archive/2008/09/30/how-do-i-distribute-the-sbs-2008-self-signed-ssl-certificate-to-my-users.aspx
http://blogs.technet.com/sbs/archive/2008/10/03/receiving-certificate-errors-when-connecting-to-clients-servers-with-ts-gateway-or-remote-web-workplace-on-sbs-2008.aspx

EBS Links to learn more at:

http://technet.microsoft.com/en-us/library/cc463553(WS.10).aspx
http://technet.microsoft.com/en-us/library/cc463480(WS.10).aspx

So what's your applicationhost.config file like?

bradley — Fri, 11 Sep 2009 05:00:00 GMT

Sometimes the error messages you get on a server point you in exactly the spot to debug something. Working on the blog up here for the last few years has gotten me more used to dealing with XML files and what not and in each SBS 2008 is an XML file you might want to learn more about.

It's called applicationhost.config and it's located at c:\Windows\system32\inetsrv\config\applicationhost.config.

Tonight in the partner forums someone hit an issue that pointed to a specific line in this file. This is also a prime plug as to why you want to ALWAYS have at your disposal a Virtual PC/HyperV/or VMWare version of SBS 2003 and SBS 2008. So that at any point in time you can compare an "in production" box to a clean one.

Like did you know the section on httpcompression actually calls for a dll from WSUS? So for those of you that use a third party patching tool and uninstall WSUS, if that doesn't cleanly uninstall, you may jeopardize your running web sites.

http://msmvps.com/media/p/1722706.aspx I uploaded my raw, clean, VMware copy of my applicationhost.config file so you can see what it does. Open it up in notepad and scroll around. The good news is that these get backed up with shadow file copies... but it wouldn't hurt opening up one (after making a copy of it of course) and just seeing how each of your SBS 2008 servers compare to one another.

So what's your applicationhost.config file like?

Anonymous — Fri, 11 Sep 2009 05:00:00 GMT

It's called applicationhost.config and it's located at c:\Windows\system32\inetsrv\config\applicationhost.config.

Adjusting your VPN in SBS 2008

bradley — Sat, 05 Sep 2009 05:00:00 GMT

When you set up the VPN connection for SBS 2008 there is one thing to keep in mind if you use it a great deal in your business... out of the box it only allows 5 vpn connections

So you run the wizard from the networking section...

And that pretty much does everything you need to set up the VPN -- you can read more about the nuts and bolts of what the wizard is doing from here:

SBS 2008 series : VPN setup in Small Business Server 2008 « Wintivity ™:
http://wintivity.wigital.net/?p=879

Once the wizard is finish it is ... BY DEFAULT set up for only 5 vpn connections at a time....

To increase this value, click on start, go into the administrative tasks and find the Routing and Remote access section

Inside the RRAS find the Ports section, find the WAN Miniport (PPTP) and right mouse click on properties.

Adjust the maximum ports to whatever amount you feel is needed.

Adjusting your VPN in SBS 2008

Anonymous — Sat, 05 Sep 2009 05:00:00 GMT

When you set up the VPN connection for SBS 2008 there is one thing to keep in mind if you use it a great deal in your business... out of the box it only allows 5 vpn connections

So you run the wizard from the networking section...

And that pretty much does everything you need to set up the VPN -- you can read more about the nuts and bolts of what the wizard is doing from here:

SBS 2008 series : VPN setup in Small Business Server 2008 « Wintivity ™:
http://wintivity.wigital.net/?p=879

Once the wizard is finish it is ... BY DEFAULT set up for only 5 vpn connections at a time....

To increase this value, click on start, go into the administrative tasks and find the Routing and Remote access section

Inside the RRAS find the Ports section, find the WAN Miniport (PPTP) and right mouse click on properties.

Adjust the maximum ports to whatever amount you feel is needed.

How to get shared docs showing up in OWA

bradley — Fri, 28 Aug 2009 05:00:00 GMT

(keep in mind this works for Exchange 2007/SBS 2008, apparently Exchange 2010 doesn't do this)

To allow your RWW to have file access out OWA, go into the Exchange 2007 console...

Exchange Management Console

- Server Configuration

-- Client Access

--- Bottom pane, first TAB; Outlook Web Access

---- Listed should be owa(Default Web Site); Right-Click, select Properties on drop-down menu

----- In Properties dialog, select TAB Remote File Servers

------ Select Allow button

-------- Add hostnames of servers you want owa clients to access. (whatever the host name is of the SBS box)

ttp://social.technet.microsoft.com/Forums/en-US/exchangesvrclients/thread/5539dadc-211d-43d7-bca5-399db5dbc8d6

How to install Exchange Server 2007 Service Pack 2 on SBS & EBS 2008

steveb — Tue, 25 Aug 2009 05:00:00 GMT

BEFORE installing Exchange SP2 on your EBS network, read the KB article and the EBS Official Blog post! :-)

For SBS, check out the SBS Official Blog post.

Until you hear otherwise from Microsoft, do not install Exchange 2007 SP2 on EBS or SBS without following the guidance on their respective blogs and the KB articles.

How to Add 32-bit Print Drivers to SBS 2008 & EBS 2008

steveb — Tue, 18 Aug 2009 05:00:00 GMT

If you are dealing with a 64-bit print server and are looking for 32-bit drivers, this post is for you. Also works if you are on x64 clients and want to add the driver to a 32-bit server (SBS 2003 for example).

Check out the Official SBS Team Blog's post for screen shots and the full text.

Short version, is browse to the server from your 32-bit client PC while logged in with an account that has server admin rights, select the printers and faxes share, and then server properties from the file menu. Drivers tab, then add. You'll have it from there, or jump over to the SBS blog for screen snips and more details.

Terminal Server Access through RWW in EBS & SBS

steveb — Mon, 17 Aug 2009 05:00:00 GMT

Have had a few questions about Terminal Server through EBS and SBS RWW, so thought I would post a link over to the Microsoft KB on it and include the resolutions from the KB below. While not directly supported by design, here are the workarounds for both EBS 2008 and SBS 2008.

EBS 2008:

EBS 2008 does not support directly connecting to a Terminal Server through RWW. In larger environments, publishing a large number of connections through the Messaging Server's TS Gateway may cause a resource spike on the server.

In environments where it is desired to have connectivity through the RWW page, there are several workarounds available:

1. Publish the Terminal Server's RDP port (3389 by default) through TMG. See http://technet.microsoft.com/en-us/library/cc995085.aspx for more details.

2. Distribute .RDP files configured to use TS Gateway to end users.

3. Add a link for the Terminal Server in RWW. To do this, use the following steps:

Log on to the Messaging Server directly using an account with administrative rights.
Edit %ProgramFiles%\Windows Essential Business Server\Bin\webapp\Remote\App_Data\OrganizationLinks.XML in Notepad
Add a Link tag in the Gadget Section using the format:

<Link DisplayText="TS" Url=https://<REMOTEURL>/Remote/tsweb.aspx?targetMachine=<TSNAME> _locID="useTS" />

Where <REMOTEURL> is the FQDN of your RWW server and <TSNAME> is the host name of the internal Terminal Server you are trying to access. For example:

SBS 2008:

The Small Business Server 2008 (SBS 2008) version of RWW does support adding a registry key to reveal Terminal Servers in the domain (see http://technet.microsoft.com/en-us/library/cc527532(WS.10).aspx). This registry setting has no effect in EBS.

Example OrganizationalLinks.XML:

<?xml version="1.0"?>
<GadgetSection Name="Organizational" Enabled="true" DisplayText="">
  <_locDefinition>
    <_locDefault _loc="locNone"/>
    <_locTag _locAttrData="DisplayText">GadgetSection</_locTag>
    <_locTag _locAttrData="DisplayText">Link</_locTag>
  </_locDefinition>
  <Link DisplayText="How to use Remote Web Workplace" Url="http://go.microsoft.com/fwlink/?LinkId=115334" _locId="UseRWW"/>
  <Link DisplayText="How to configure Outlook to access your email over the Internet" Url="http://go.microsoft.com/fwlink/?LinkId=115339" _locId="ConfigureOutlook"/>
  <Link DisplayText="TS" Url=https://remote.contoso.com/Remote/tsweb.aspx?targetMachine=MyTS  _locID="useTS" />
</GadgetSection>