churchIT

Terminal Services and Disk Management

I had the craziest problem the last 2 months. On one of my two Windows Server 2003 with VMware Server boxes I was not able to mount and format any volumes on our EqualLogic iSCSI SAN. I troubleshot this from every angle and Googled every possible phrase. I just could not figure it out. I finally broke down and called Microsoft Professional Support last week and spent 4 hours on the phone with Microsoft. They tried everything and could not figure out a solution. The tech finally suggested that I log on locally to the server and the problem was fixed. All drives mounted and formatted successfully.

I do 95% of my server management through the Terminal Services Client (MSTSC) and almost never at the console. I was told a couple times before that some operations could only be done at the console and not through MSTSC. I honestly thought those techs were full of crap and were trying pass on a tough service call. To get around this issue you can also run MSTSC with the /console switch "mstsc /console". You may also run the console switch if you were logged into a console session on a server and need to remote desktop to that session.

Today’s Church IT Podcast

In the Church IT podcast today I had mentioned a couple cool tools that I use quite a bit. Both are password generators that I use when creating or changing passwords for system or service accounts. The first one is found at http://www.pctools.com/guides/password/ and the other can be found at https://www.grc.com/passwords.htm . I hope this helps!

We also had a discussion about password policies and that had a tangent into locking out administrator accounts. I had made mention of the fact that the domain built-in administrator account could not be locked out. More information can be found in the "Administrator Accounts Security Planning Guide" but by default the administrator account cannot be locked out, even if your domain policies do specify a lockout policy. I would recommend reading the security guide since it has several good pointers. Some of those pointers are to rename the administrator account, create a decoy administrator account, make sure you are using strong passwords and change the passwords periodically. The document also describes how to enable lockout policies on your administrator account, if you are interested.

TechNet Spring Event

I'm sure most people know that Microsoft holds free quarterly TechNet IT events but if you don't, now you do. I had the opportunity to attend the Microsoft TechNet Spring Event last Thursday and found it to be very informative. This TechNet event covered Vista reliability and security, Server 2008 Core and Read-Only Domain Controller, and an introduction to Forefront Client Security, Microsoft's new enterprise desktop antivirus and spyware solution. Keith Combs was the presenter and he did a great job of presenting the material. If you can't make the Spring Event in your area, Keith has a screen casts of some of the material on his blog.

All of the topics are technologies that I will deploy or evaluate in the next 12 months, so this was time well spent.

This event also included a paperback copy of the Windows Vista Security Guide, it can be found in an online copy at http://www.microsoft.com/technet/windowsvista/security/guide.mspx. I've read through half of the book and it looks like a must read before deploying Vista. It provides recommendations that will make Vista more secure, in an Active Directory, Group Policy environment. In an added bonus, I won one of the Office 2007 Professional door prizes!

If you haven't been to a TechNet event, check it out. The current topics will run through June 2007 and there will be a series of topics this fall.

Automation and Office 2007

I just received the latest issue of Windows IT Pro and in the issue got the news about Office 2007 I had expected. Office 2007, effectively, cannot be installed using Group Policy. I have been trying to deploy 2007 via group policy since it was released a few months ago. I could never get it to install properly but I always thought that it was a problem specific to my environment.

This is a huge let down because, here at Sagemont we do not use Ghost images, we deploy the OS via Remote Installation Services (RIS). Our standard practice is to RIS a machine, drop the machine into the correct Active Directory OU, and then Group Policy will install our standard applications to the desktop. Currently, in most cases, this application set is Office 2003, Windows Media Player 11, CA Antivirus, Adobe Reader, and etc. This is a great setup and almost every desktop computer on our network has been deployed in this manner.

In case you haven't dug into Office 2007 much, Microsoft has redesigned the setup process in Office 2007. In a Group Policy scenario, gone are the Microsoft Transform (MST) files and welcome XML files. If you do not use Group Policy to deploy applications, an MST is needed to supply installation options. Now it looks like Systems Management Server (SMS) is the only option for pushing 2007 to my users. I've resisted SMS since Group Policy has done a great job of installing my applications and I haven't had a great need for its advanced features. This might not be such a bad thing since Microsoft is integrating several of their management products together and I've already had some interest in using Operations Manager (MOM).

Update: Microsoft states in documentation on Technet that you can deploy 2007 via Group Policy but after months of testing I have not been able to deploy it to any workstation without some manual intervention.  What is worse is that all the Group Policy deployment does is places a cached copy of the installation on the user's hard drive for installation when the next user logs in.  So my end user will have to sit idle while the software installs, instead of having the software already installed, when they log in.

If you are a Windows IT Pro subsriber, the article I referenced is here

WSUS 3.0 RTM

In case you haven't heard, Microsoft has released Windows Server Update Services 3.0. We've been using it since RC1 and I have really liked the product. This is not a review but a thumbs up from someone who has used the product for several months. Among the features that I really like:

1) A daily email status report of computers and updates (See screen shot below). No more logging into WSUS everyday to make sure computers are automatically updating!

2) WSUS administration is done through an MMC snap-in.

3) We now have fully customizable automatic approvals.

One problem I came across is, I use ports 80/443 and not the default 8530/8531 and when I upgraded, WSUS defaulted back to 8530. I had to go into IIS Admin and change the ports back to 80/443.

 

Status as of Wednesday, May 02, 2007 12:00 PM (GMT)

This e-mail message summarizes the status of the Update Services Server named WSUS.

Computer Status

Computer Group Computers Needing Updates Computers with Errors Unassigned Computers 0 0 Checkin 1 0 Staff 6 0 Servers 9 0 All Computers 16 0

Updates Status

Critical and security updates approved: 953 Critical and security updates needed: 6 Critical and security updates with errors: 0 Non-critical and non-security updates approved: 1308 Non-critical and non-security updates needed: 4 Non-critical and non-security updates with errors: 0

Synchronization Status

Last synchronization: Tuesday, May 01, 2007 8:18 PM Last synchronization result: Succeeded Next synchronization: Automatic

 

Blogging with Word 2007

Being a computer geek, I like trying out new stuff. I've been using Microsoft Word 2007 for several months now and I really like the interface changes. There are times when I pull my hair out looking for a command that I don't use often, otherwise it's a good change, that gets better as you use it. I figured, I'd try publishing posts with Word's new blog feature. Well as you can tell, it doesn't do hyperlinks all that well. Other than that, I've found it to work fairly well. The next thing for me to try is inserting a picture and some other features.

UPDATE: It seems that my past trouble with hyperlinks as been fixed! I'll be looking into this a bit further. Inserted a Word 2007 formatted picture.

 

Microsoft Open Licensing

We got a Software Assurance letter reminding me that SA on several of our server products would be running out in the next 6 months. Two of the products are Windows Server Standard and Exchange Standard and I thought wouldn't it be great if I could upgrade those licenses to Enterprise versions.

The difference between products seems to become more critical between version upgrades of Microsoft products, since with each version there seems to be more differentiating factors between levels. Like standard and enterprise versions of Windows and Exchange. So, with more releases of a product, your business may grow and the feature set of the premium enterprise product will grow, making the enterprise product more appealing.

I called Microsoft Volume Sales at 800-426-9400, to see if there was a way to upgrade to the higher end version and keep some of my investment, without throwing out a whole license. I got a real helpful gentleman who told me that there was a "Step-Up" license, which allows us to upgrade certain products. He pointed me to the Product Use Rights (PUR) document and said that would give me the details. After researching this and the "Step-Up Licenses Brief" it turns out that the Step-Up program was only available if I had SA and I were under a "Enterprise Agreement, Select License, and Open License Value customers have the option to acquire a Step-up License on or after the renewal of their previous agreements." So I called Microsoft Volume Sales to verify my facts and make sure that I wasn't missing anything. Well, it turns out that this is true. Organizations that buy Open Business, Charity, Academic, or Government with Software Assurance, don't get some of the same benefits as other licensing programs. I asked who I could send an email to in regards to this situation and she told me that I could send an e-mail to mswish@microsoft.com for any kind of want or suggestion.

So I am composing an e-mail and will give Microsoft my 2 cents on this issue. It seems to me like Microsoft should make the Open License Program a perpetual license only and a Software Assurance less program for businesses, governments or charities. Meaning that like retail, if you buy a license for that product, you can use it as long as you want, but without upgrade assurance. If you want Software assurance then you will be directed to an expanded Microsoft Open Value program, which would be open to governments, academics, and charities, in addition to businesses. This would give organizations better value for their SA benefits, such as the ability to spread payments over the 3 year lifespan of MSOV agreement.

Sorry about the long post, but I thought it was worth mentioning.