churchIT

Project Updates

Since it has been a while I just wanted to update my last post that listed our current projects with the progress that has and hasn’t been made.

We are now in the 2008-2009 budget year.  Due to us changing Internet providers we have reduced our budget needs for the current fiscal year.  The big project that we’ve received funds for is replacing Shelby with a new ChMS system!  (My early favorite is Shelby Arena but this is just my opinion without a team of staff talking to multiple vendors.)  This promises to be another busy year ahead of us!

We did finalize ISP bids and moved to Phonoscope from Data Foundry.

Microsoft Forefront Client Security tested well and we have migrated to the full product. This is not the easiest product to implement. I am hoping for big benefits in the future as this is further integrated with MOM and SCCM.

We have deployed Windows Server 2008 in a DC and File Server role and a Terminal Services Gateway.  Server 2008 is an excellent upgrade.

Microsoft System Center Configuration Manager, has been deployed but not fully utilized.

Still preparing for staff Office 2007 training.  I am very nervous about this deployment and all of the helpdesk calls because of the interface change.  Will look to do training after promotion Sunday in late August.

Prepared, tested and deployed new 8 core HP DL360 G5 for use as our third VMWare Server but now this server has Windows Server 2008 Enterprise x64 Server Core installed and is being setup as a member of a Microsoft Hyper-V cluster.

We’ll deploy Exchange 2007 after the Hyper-V cluster is operational.

After Exchange is virtualized, upgrade and re-purpose physical server as a Microsoft System Center Virtual Machine Manager 2008 server to manage VMs and Hyper-V servers.

Windows Server 2008 SP1?

I've known for a while that Vista SP1 would bring Vista the same kernel as Windows Server 2008 but I never though of Windows Server 2008 including SP1.

I didn't know what to expect when I saw the blog subject: "Windows Server 2008 is called SP1. Adventures in doing things right." from Paul Thurrott's blog.

Paul links to a blog post that explains how and why Server 2008's first service pack will be SP2.

Terminal Services Gateway

I must admit that Windows Server 2008 is a product release that I have looked forward to for a long time.  Terminal Services, Hyper-V, Group Policy Preferences, RODC, Server Core and other features really make this a great upgrade from a technology standpoint.

One of the technologies that I wanted to test right away was Terminal Services Gateway.  This has been available through 3rd party software like Citrix for years.  At Sagemont, our use of Terminal Services is limited to thin clients and access to Shelby V5 for our user that that office outside our main campus.  I also allowed a few test users RDP access to Terminal Services outside the firewall but this is not very secure.

I am starting to get more feedback from staff that want to be able to work from home.  Especially when they found out about our test RDP users.  Now with Terminal Services Gateway (TSG) I can securely and easily deploy Terminal Services to all employees.  It allows an employee to access Terminal Services over the Internet via RPC over HTTPS.  RPC/HTTPS is the same technology that Outlook uses for Outlook Anywhere.  What is great about TSG is that you can create policies that control user access to specific resources.  There is a Connection Authorization Policy (CAP) that specifies what users and or computers can connect to the gateway and what type of Device Redirection is allowed.  For us we will probably just allow printer redirection for users connection from non-trusted computers.  For users that connect from a church issued laptop that is a domain client then we could allow drive redirection.  Then Resource Authorization Policies (RAP) are created to allow users access to Terminal Server groups.

So far TSG has tested out very well and I will have several users test it out this week.  The next steps will be to activate Windows Server 2008 on the gateway server.  Then I will be acquiring a certificate from a well known CA to make things easier on the staff when they connect.

Windows Live Writer Test

Now that Windows Live Writer supports Vista x64 I figured I'd try it out.

So far I like it.

New Feature in Windows Server 2008 RC1

I downloaded Windows Server 2008 RC1 yesterday and had a chance to play with it a couple hours last night. A feature that is new to Server 2008 and is now available in RC1 is Group Policy Preferences. Well this feature is not new to us at Sagemont since we've used it for about 3 years now. Last year Microsoft purchased DesktopStandard the maker of PolicyMaker Standard and PolicyMaker Share Manager. Since then I have been anxiously awaiting word on Microsoft's intentions for the product. I was told that Microsoft would either integrate the product in the base code or it would make it available to customers with Software Assurance. Microsoft announced yesterday that they would make Group Policy Preferences available in the base product which is great news for everyone.

Like I said we've been using the product for about 3 years and was dreading the thought of managing our network without it. Here are some of the things we manage with it.

• Manage local Administrative Account passwords on all workstations. The admin password is the same on all workstations and can be changed in a few minutes via group policy.
• Manage local Power Users and Administrators group membership on workstations. No more rogue local admins.
• Centrally manage Task Scheduler. One uses is shutting down and restarting workstations at night so workstations run more stable, changed computer policies get applied and we can reduce our electric bill for 100 computers We also schedule nightly defrag jobs using the XP building defragmenter so workstations run better and IT has a cost savings in not needing to buy commercial software.
• Manage workstation shares. No workstation is allowed to share files so we wipe all non administrative shares. If you need to share it there are file servers that we backup that can share it much better since the file servers are faster than the local workstations and we do not backup local workstations.
• Push Exchange/Outlook settings to local workstations so local users and helpdesk never has to manually configure Exchange connectivity. Although it does look like this feature has been removed from the Microsoft product.
• Manage network drive mappings, registry settings, and copy files and folders to workstations without using a single logon script.

Now that these features will be deployed in Server 2008 it looks like we will be accelerating our plans on deploying Server 2008 domain controllers. My next task is researching the transition from PolicyMaker to Group Policy Preferences. You can find a whitepaper on Group Policy Preferences at DesktopStandard's website.

Terminal Services and Disk Management

I had the craziest problem the last 2 months. On one of my two Windows Server 2003 with VMware Server boxes I was not able to mount and format any volumes on our EqualLogic iSCSI SAN. I troubleshot this from every angle and Googled every possible phrase. I just could not figure it out. I finally broke down and called Microsoft Professional Support last week and spent 4 hours on the phone with Microsoft. They tried everything and could not figure out a solution. The tech finally suggested that I log on locally to the server and the problem was fixed. All drives mounted and formatted successfully.

I do 95% of my server management through the Terminal Services Client (MSTSC) and almost never at the console. I was told a couple times before that some operations could only be done at the console and not through MSTSC. I honestly thought those techs were full of crap and were trying pass on a tough service call. To get around this issue you can also run MSTSC with the /console switch "mstsc /console". You may also run the console switch if you were logged into a console session on a server and need to remote desktop to that session.

Microsoft Licensing and Charities

I have been doing a little bit research over the past few months about different Microsoft licensing programs. I was first intrigued about Microsoft SoftGrid software virtualization and its use in our environment. So I started researching the licensing options for this product and it turns out that this product is licensed as part of the Microsoft Desktop Optimization Pack. This pack includes Microsoft SoftGrid Application Virtualization, Microsoft Asset Inventory Service, Microsoft Advanced Group Policy Management, and Microsoft Diagnostics and Recovery Toolset; all of which are technologies Microsoft acquired through recent acquisitions.

According to the FAQ, It turns out that the Microsoft Desktop Optimization Pack is a non-perpetual offering that is tied to your Windows XP/Vista Client license with Software Assurance but only when that Software Assurance is licensed under an EA, EA subscription, Select, Academic Select, Open Value, Campus Agreement, and School Agreement volume license programs. You will notice that Open Charity, Open Business and Open Government programs are not listed. I assume that all churches acquire their Microsoft volume licensing through the Open Charity program. We do and I actually do purchase Software Assurance with all of my licenses and that helps me stay on current technology on all of my workstations. If you want to use any of the Desktop Optimization Pack you will have to purchase Windows Client Licenses with Software Assurance on the Open Value program. This means that you will lose Microsoft's charity pricing, because it is not offered with the Open Value program.

For those of us that want to deploy Microsoft's Forefront security products, those products are offered as non-perpetual, subscription services and are not offered under the Open Charity program. So to acquire Forefront Client or Server Security you will purchase those licenses through the Open Value program and charity licensing is not available.

In addition to these two instances, yesterday I called my sales representative with DesktopStandard. You see, DesktopStandard was acquired by Microsoft, October 2006 and its products are being integrated into Microsoft's portfolio. The DesktopStandard product I manly used was PolicyMaker and it is used to extend the functionality of Group Policy policies. It turns out that PolicyMaker will be integrated into the Microsoft Desktop Optimization Pack later this year. At that point, we will, most likely, have to choose to upgrade our client licenses to Open Value with Software Assurance ($$$) or migrate PolicyMaker's functionality to another product.

As you can see some of Microsoft's newest product offerings are not offered under any charity pricing program. Does this mean that Microsoft will increasingly offer advanced features that will be available to customers only under Software Assurance agreements? That is almost a certainty. As Microsoft adds value to Software Assurance, there will be more necessity in using Software Assurance. As that happens, us non-profits will see our Microsoft licensing cost skyrocket, unless Microsoft could offer us a charity licensing program under Open Value. Have you looked at the price difference between Open Business and Open Charity? According to Provantage.com it is about 7X more expensive to buy Office Professional with Software Assurance through Open Business versus Open Charity.

So, what do you think? Am a crazy? Is this relevant to your ministry? Do you have a different opinion? I'd just like to see some dialogue on this issue, so speak up!

TechNet Spring Event

I'm sure most people know that Microsoft holds free quarterly TechNet IT events but if you don't, now you do. I had the opportunity to attend the Microsoft TechNet Spring Event last Thursday and found it to be very informative. This TechNet event covered Vista reliability and security, Server 2008 Core and Read-Only Domain Controller, and an introduction to Forefront Client Security, Microsoft's new enterprise desktop antivirus and spyware solution. Keith Combs was the presenter and he did a great job of presenting the material. If you can't make the Spring Event in your area, Keith has a screen casts of some of the material on his blog.

All of the topics are technologies that I will deploy or evaluate in the next 12 months, so this was time well spent.

This event also included a paperback copy of the Windows Vista Security Guide, it can be found in an online copy at http://www.microsoft.com/technet/windowsvista/security/guide.mspx. I've read through half of the book and it looks like a must read before deploying Vista. It provides recommendations that will make Vista more secure, in an Active Directory, Group Policy environment. In an added bonus, I won one of the Office 2007 Professional door prizes!

If you haven't been to a TechNet event, check it out. The current topics will run through June 2007 and there will be a series of topics this fall.

Automation and Office 2007

I just received the latest issue of Windows IT Pro and in the issue got the news about Office 2007 I had expected. Office 2007, effectively, cannot be installed using Group Policy. I have been trying to deploy 2007 via group policy since it was released a few months ago. I could never get it to install properly but I always thought that it was a problem specific to my environment.

This is a huge let down because, here at Sagemont we do not use Ghost images, we deploy the OS via Remote Installation Services (RIS). Our standard practice is to RIS a machine, drop the machine into the correct Active Directory OU, and then Group Policy will install our standard applications to the desktop. Currently, in most cases, this application set is Office 2003, Windows Media Player 11, CA Antivirus, Adobe Reader, and etc. This is a great setup and almost every desktop computer on our network has been deployed in this manner.

In case you haven't dug into Office 2007 much, Microsoft has redesigned the setup process in Office 2007. In a Group Policy scenario, gone are the Microsoft Transform (MST) files and welcome XML files. If you do not use Group Policy to deploy applications, an MST is needed to supply installation options. Now it looks like Systems Management Server (SMS) is the only option for pushing 2007 to my users. I've resisted SMS since Group Policy has done a great job of installing my applications and I haven't had a great need for its advanced features. This might not be such a bad thing since Microsoft is integrating several of their management products together and I've already had some interest in using Operations Manager (MOM).

Update: Microsoft states in documentation on Technet that you can deploy 2007 via Group Policy but after months of testing I have not been able to deploy it to any workstation without some manual intervention.  What is worse is that all the Group Policy deployment does is places a cached copy of the installation on the user's hard drive for installation when the next user logs in.  So my end user will have to sit idle while the software installs, instead of having the software already installed, when they log in.

If you are a Windows IT Pro subsriber, the article I referenced is here

Update: Windows Server 2003 SP2

Microsoft has updated the Windows Server 2003 SP2 page to include the links to SP2 gold. One thing they've included that I've never seen before is a downloadable ISO CD image for SP2, no not really a big deal but a change.