Lijin's Blog!

MOSS 2007 vs. Oracle Intranet Portal - Product Comparison

lijin_l@hotmail.com (Lijin Nair) — Fri, 05 Sep 2008 16:56:00 +0000

MOSS 2007 vs. Oracle Intranet Portal - Product Comparison
	MOSS 2007	Oracle Portal 10g
Product Overview & Features	Microsoft Office SharePoint Server 2007 is an integrated suite of server capabilities that can help improve organizational effectiveness by providing comprehensive content management and enterprise search, accelerating shared business processes, and facilitating information-sharing across boundaries for better business insight. Office SharePoint Server 2007 supports all intranet, extranet, and Web applications across an enterprise within one integrated platform, instead of relying on separate fragmented systems. Additionally, this collaboration and content management server provides IT professionals and developers with the platform and tools they need for server administration, application extensibility, and interoperability.	Oracle Portal 10g Release 2 offers out of box portal solution as a part of its Fusion Middleware bundled with 10g Oracle Application Server. Oracle Portal lets the enterprise employ a single portal framework to manage Organization's entire Web presence. It is based in the Oracle's implementation of J2EE containers or Oracle Containers for J2EE (OC4J). Besides providing standard functionalities of an enterprise portal Oracle Portal also allows integration with the E-Business suite enabling organizations to provide dynamic content to employees, Partners and vendors. This integration with enterprise applications extends itself to non Oracle Applications like SAP also.
	Key Features:	Key Features:
	-Portal -Content Management The content management features in SharePoint 2007 fall into 3 categories: · Document management (Control documents through detailed, extensible policy management) · Records management · Simplify Web content management -Search Integration (ability to index and search (LOB) Line of Business Applications) -Business process forms (XML based electronic forms that integrate with the Microsoft family of applications and Pluggable (SSO) Single Sign-On) -Business Intelligence (BI provides to every employee; allowing them to share, control, and reuse business information in order to make better decisions) -Collaboration suites and Integration with Other in-house products (Microsoft Exchange, Mobility Solutions and File/Print Services etc) -Business Data Catalogue (Provides integration features with ERP applications like people soft, Seibel Etc) Top 10 Benefits -Provide a simple, familiar and consistent user experience -Boost employee productivity by simplifying everyday business activities -Help meet regulatory requirements through comprehensive control over content -Effectively manage content to increase business value -Simplify organization-wide access to structured and unstructured information across disparate systems -Connect people with information and expertise -Accelerate business processes and maintain control of your electronic forms environment -Share business data while preserving its consistency and protecting sensitive information -Facilitate better informed decisions by presenting business critical information in one central location -Provide a single, integrated platform to manage intranet, extranet, and internet applications across the enterprise	-Ability to implement Single Sign On by integrating with Oracle Internet Directory -Oracle Portal offer in built portlets which can be used with Other Oracle Business Intelligence tools like Discoverer -Oracle Portal also offers interaction with the business process engineering tools like BEPL. -Apart from the dynamic content and integration with other enterprise applications Oracle Portal also allows for convenient publishing of content through the desktop -Oracle Portal also comes with an inbuilt Portal Development Kit (PDK) which allows developer to do custom development. -SOA Enabler -Portal Integration With Oracle Applications Oracle continues to make the Portal environment a very attractive one for developers, Web designers and administrators. Some of the major enhancements in Portal 10g includes: • Installation/Upgrade • OmniPortlet • Web Clipping • The Portal Development Kit (PDK) • Integration Solutions • Page design and content management • Search, Workflow and Export/Import functionality
Scalability	Microsoft.com is the 5th most visited Web site on the Internet, hosting hundreds of thousands of pages of content. Running our site on Office SharePoint Server 2007 goes a long way in demonstrating to customers worldwide that the product is reliable and provides an effective solution for managing vast amounts of content.	The successful e-business needs to take advantage of the potential for being connected anywhere, from the phone that surfs the Web, and the DBA who checks the database with a Palm Pilot, to the laptop user that orders on the Web.
	SharePoint is the first and foremost an exercise by Microsoft to extend their monopoly of Office. SharePoint is part of the Office group	To this enterprise level infrastructure Oracle adds a powerful set of facilities to support the development, deployment and management of e-business applications
	Messaging and Mobility Integration (Active Sync wireless and Outlook Integration)	The Oracle Interconnect architecture allows a business to model, monitor, and manage the integration of separate applications (including external applications such as SAP or PeopleSoft).
High Availability	MOSS 2007 supports Various server farm Topologies for SMB and Enterprise platform with enhanced and proven load balancing application server with high-end database Active/Passive clustering, through "business critical" model. -Limited server deployment (one or two server farm) -Minimum level of availability (Four/Five server farm) -Maximum level of availability (Six Server Farm)	- Supports Multiple Middle-Tier Configurations with a Load Balancing Router. - These features include automatic connection rerouting, death detection, and automatic restart, as well as the ability to integrate with the Oracle Database Transaction Application Failover (TAF). -This configuration also supports Session State replication and Application Failover for both servlets and Enterprise Java Beans
High Availability	Database mirroring offers three modes of implementation. The choice you select depends on how you want to handle failover processing. • High availability This operating mode option allows you to synchronize writing transaction logs to both servers and enables automated failover. For this option to work, you must also have a witness server. • High protection This option allows you to synchronize writing transaction logs to both servers, but failover is manual. Because automated failover is not part of this option, a witness server is not used. • High performance This option does not synchronize writing transaction logs to the servers, and therefore offers some performance gains. When using this option, you are just assuming that everything is going to complete successfully on the mirror. This option only allows manual failover, and a witness server is not used.	Oracle Application Server meets this requirement by internally coordinating the use of available memory and CPU resources through load-balancing and connection routing/pooling. The state failover capability makes it possible to run the same application on single CPU machines or high end SMP-clustered systems without changing the application.
Manageability	Managed Centralized, As Microsoft is known for the operational flexibility in Administration and end user usage. -Easy to Index -Easy to Manage Portal -Easy to find information -Easy to Brand	The new release as made administering Oracle Portal instance effectively, including the areas of installation, monitoring, security and migration.
	Supports Ad-hoc self service w/ Life cycle management	Export/Import Portal Pages
	-MOSS 2007 supports MOM and Operation Manager 2007 integration for Alert and Event Management -MOSS 2007 Site recovery and restore made simple supporting VSS features	Event Management and Alerting supported by 3rd Party Monitoring Tools
Reference Links	http://office.microsoft.com/en-us/sharepointserver/FX100492001033.aspx http://technet.microsoft.com/en-us/library/cc262868(TechNet.10).aspx	http://www.oracle.com/technology/products/ias/portal/index.html

High Availability or Disaster Recovery on Blackberry Enterprise Server with Failover Software

lijin_l@hotmail.com (Lijin Nair) — Sun, 17 Aug 2008 21:06:00 +0000

Blackberry devices are quickly growing in popularity for both business and personal uses (Browsing over BIS (RIM proxy) is fast enough for the mobility and its economical too, in all ways managing the Blackberry Enterprise Server is also a business critical in compare to any corporate messaging systems (Like Exchange or Lotus Domino).

This article examines how high availability can be accomplished using failover software, however a single server running on standalone mode is always a night mare to any level of administration and it's also a disaster threat to the entire organization mobility services, How can we have the 99% uptime, Let's see how we can achieve this:

Here by there are two solutions to overcome these issues:

Options -1

This only feasible, If you already have 02 BES licenses , then the best thing for you to do would be to split 50% of users on BES-1 other 50% on BES-2 and make sure they are in the same BB domain, same subnet with your messaging systems and sharing a common SQL DB (Recommended to have SQL cluster in place), as this will work when one of your BES goes down you can eventually move the affected users from one BES to the other and they would be all set to function in minutes.

Note: Make sure you have good backup solution in place.

Putting half your user on server 1 and half on the other is NOT a very smart failover solution. If one of those servers were to fail then half your users are down without any backup plan, during the failure the Half of users would be still remain down until you initiate the BlackBerry manager to move from one BES to the other.

As this is one of the failover solution posted across KB/forums (Not recommended as a DR), which doesn't make sense as a failover solution.

Note: The disadvantages for SMB (Small, Medium, Business) is it required 02 licenses and it makes management to think twice on the license cost, However SMB still as the Options-2 to opt.

Options-2

Here is the smart and intelligent failover solution, which follows the RIM article KB04647, if you are currently running BES 4.0 or higher or follow KB05032 if running 3.6.

Basically what you are doing in a nutshell is having 2 boxes with a mirror image BES, for example you currently have a 4.0.6 BES named BES-1. What you would need to do, is install the EXACT same version of BES on the new box (BES-1 as your previous box) **VERY IMPORTANT**

Then depending on what types of database you use, as follow the below:

1) Remote SQL - you simply point the new server to the database running the remote SQL server

2) local MSDE/SQL - you need to create a backup of the database from your old server and then restore it onto the new server (if using the server and it goes down then all you would need to do is create a backup from the new server, copy it to the failover server and restore it there) (follow RIM article KB03112 for proper commands)

Basically all you need to do is make sure you are constantly upgrading/updating both at the same time, like wise:

- If you decide to upgrade your new 4.0.6 server to 4.1.2 then perform the same on secondary node as well.

- This applies even for OS/security patches as well. If you've added 20 new users on the new server then make sure you copy that database over to the old server to reflect the same changes.

All you need to do having an environment like this is to keep the services on one server stopped, This way if you have a server down issue all you need to do is start the services on the failover server (secondary server) and your users don't notice anything other than a possible short 10 minutes delay during the time you started the failover server.

This is one of the cost cutting Implementation BES failover scenarios, if you are limited with budget. Using the Disaster Recovery Guide (for Exchange) from Blackberry. However this is a point to be considered that there is a transactional database replication and snapshots between the primary and stand by servers and not just a database recovery (only possible if using full SQL - not MSDE).

The servers are installation/configuration are recommended to installed using the same SRP identifier (ensure the stand by instance BES services remains disabled and not using the same SRP at RIM or else it will be deactivated as a security threat) and make sure you specify the same BES server name (the physical machine/Host name is independent).

Option-3

These options will achieve the High Availability on BES using Failover Software "Neverfail" as this product will allow you to deploy an active/passive BES cluster. As this software basically clones your existing BES on a secondary BES, The secondary severs will act as hot standby and it takes over failover automatically and transparently, when the primary BES fails.

Best of all, the Neverfail for BlackBerry solution is priced for the small and mid-size market, and its manageability is awesome, which can be deployed locally or across the WAN.

This product as captured the market very quickly, even while competition with other brand "CA" XOsoft High Availability (formerly CA XOsoft WANSyncHA).

Neverfail is the leading technology in providing continuous high availability and operation to the Blackberry and Microsoft environment. For more details on Neverfail BES data sheet and case study, please find the links below:

• A link to RIM website where Never fail is the only High Availability and DR solution approved by them.

• A link to Vodafone website and the existing partnership between them and NeverFail.

Who are the leading ISV's (independent software Vendors) in this segment?

Hello, Happy Reading! Please value your reading to post the poll. Thank you!

What is role based administration in BES

lijin_l@hotmail.com (Lijin Nair) — Sun, 17 Aug 2008 18:25:00 +0000

Details

BlackBerry Manager uses pre-defined roles that correspond to common organization administrative roles in order to limit access to sensitive data. The following table shows the pre-defined roles and their functions:

Role	Functionality
Security Administrator (rim_db_admin_security)	These administrators can perform all tasks. They are the only administrators who can manage role membership or change sensitive security properties, such as licenses and encryption keys.
Audit Security Administrator (rim_db_admin_audit_security)	This role can view the same options as the Security Administrator but cannot change or update any of these options.
Enterprise Administrator (rim_db_admin_enterprise)	These administrators can perform all tasks relating to BlackBerry device users, services, servers and global application data. This role can control the services in the BlackBerry Enterprise Server, but cannot view role membership, licenses, or encryption keys.
Audit Enterprise Administrator (rim_db_admin_audit_enterprise)	This role can view the same options as the Enterprise Administrator but cannot change or update any of these options.
Senior Help Desk Administrator (rim_db_admin_sr_helpdesk)	These administrators can perform all BlackBerry device user management tasks, including deleting BlackBerry device users, changing IT policy assignments, and issuing IT administration commands.
Audit Senior Help Desk Administrator (rim_db_admin_audit_sr_helpdesk)	This role can view the same options as the Senior Help Desk but cannot change or update any of these options.
Device Administrator (rim_db_admin_handheld)	These administrators can perform all tasks that relate to BlackBerry device users and BlackBerry device management. This role is designed for administrators who support new BlackBerry device users and deploy BlackBerry devices.
Audit Device Administrator (rim_db_admin_audit_handheld)	This role can view the same options as the Device Administrator but cannot change or update any of these options.
Junior Help Desk Administrator (rim_db_admin_jr_helpdesk)	These administrators can perform user account management tasks, including creating and sending wireless enterprise activation passwords, and resending service books or IT policies. These administrators cannot add, move, or delete user accounts or send certain IT administration commands. If administrators need view-only access to their role (for example, when training new administrators), the security administrator can assign an audit version of the role to them.
Audit Junior Help Desk Administrator (rim_db_admin__audit_jr_helpdesk)	This role can view the same options as the Junior Help Desk but cannot change or update any of these options.

Note: This information is an overview of the types of administrative roles for the BlackBerry Enterprise Server. For detailed information, see the Role Matrix section of the BlackBerry Enterprise Server: Administration Guide.

Original role matrix is based on RIM Doc ID : KB04889

http://www.blackberry.com/btsc/articles/946/KB04889_f.SAL_Public.html

How to add user in BES administrative roles?

Click on Blackberry Domain > Expand Servers > Servers > Role Administration (on right side pane as seen in above snapshot)

Can we customize the ROLE accordingly? Yes we can, how?
Below are the requirement:
- Any webserver (I will post the Html code in my next post)
- Create a BES DB SQL read only credential.

How To: Create, Assign, View, and Send IT policies

lijin_l@hotmail.com (Lijin Nair) — Fri, 15 Aug 2008 17:53:00 +0000

This applies to BlackBerry Enterprise Server™ software versions 3.6, 4.0, and 4.1 for Microsoft Exchange.

Getting Started...Happy reading!

The BlackBerry Enterprise Server uses an IT policy to control the behavior of the BlackBerry devices assigned to it. IT policies cover a wide range of BlackBerry device functions (for example, passwords, attachment viewing, and available browsers). Administrators can create custom IT policies in addition to the IT policies already present on the BlackBerry Enterprise Server.

Creating IT Policies

To create an IT policy, complete these steps:
BlackBerry Enterprise Server software versions 3.6 and 4.0

Depending on your version, open the BlackBerry Enterprise Server Management console or BlackBerry Manager.
Right-click the BlackBerry Enterprise Server name, then click IT Policy.
Click New, then create a name for the IT policy.
Select the check box beside each IT policy you would like to assign. A description of the IT policy will appear.
To enable the selected IT policy, in the description window, click TRUE. You can select FALSE but you will have to enable the IT policy at a later time.
Click Apply, then click OK.

BlackBerry Enterprise Server software version 4.1

In BlackBerry Manager, select Servers, then click Global tab.
From the Tasks menu, click Edit Properties.
Select IT Policy, then double-click IT Policies.
Click New, then create a name for the IT policy.
Select an IT policy group to view the associated IT policy rules.
Select the appropriate IT policy rules.
Click Apply, then click OK.

Assigning IT Policies

To assign an IT policy to a BlackBerry device user, complete the following steps:
BlackBerry Enterprise Server software versions 3.6 and 4.0

Depending on your version, open the BlackBerry Enterprise Server Management console or BlackBerry Manager.
Right-click the BlackBerry Enterprise Server name, then click IT Policy.
Select an IT policy, then click Edit User List.
Click Add Users to This Policy.
Select a BlackBerry device user, then click Add.
Click Close, then click OK to close the Edit IT Policy Userlist window.
Click OK again.

BlackBerry Enterprise Server software version 4.1

In BlackBerry Manager, select Servers, then click the Global tab.
From the Tasks menu, select Edit Properties.
Select IT Policy, then double click IT Policy to User Mapping.
Select a BlackBerry device user, then click the radio button associated next to the appropriate IT policy.
Click OK to close the IT policy to User Mapping window.
Click Apply, then click OK.

Viewing IT Policies

To view IT policies on the BlackBerry Enterprise Server, complete these steps:
BlackBerry Enterprise Server software versions 3.6 and 4.0

Depending on your version, open the BlackBerry Enterprise Server Management console or BlackBerry Manager
Right-click the BlackBerry Enterprise Server name, then click IT Policy.
Select an IT policy, then click View to see the BlackBerry device and Desktop Policy Settings that have been applied.
Click OK to close the View Policy window.
Click OK again.

BlackBerry Enterprise Server software version 4.1

In BlackBerry Manager, click Servers, then click the Global tab.
From the Tasks menu, select Edit Properties.
Select IT Policy, then double-click IT Policies.
To view the IT policy rules, click Properties.
Click OK.

To view an IT policy on a BlackBerry device, complete these steps:

From the Home screen, select Options.
Select Security Options > General Settings.
The IT policy Name, Last Updated, and Time Stamp fields will be listed. Note: Depending on the BlackBerry device and BlackBerry Device Software version, the instructions for viewing the IT policy on the BlackBerry device may vary. For example, on the BlackBerry 7100 series, the BlackBerry device user must select Settings or Tools, then select Security.

Sending IT Policies

To send an IT policy to a BlackBerry device user, complete the following steps:
Note: By default, when you assign an IT policy to BlackBerry device user, the IT policy is automatically sent to the BlackBerry device user.
BlackBerry Enterprise Server software versions 3.6 and 4.0

Depending on your version, open the BlackBerry Enterprise Server Management console or BlackBerry Manager
Select the BlackBerry Enterprise Server name, then right-click a BlackBerry device user name.
Click Properties.
On the IT Admin tab, click Resend policy.
Click Apply, then click OK.

BlackBerry Enterprise Server software version 4.1

In BlackBerry Manager, select the BlackBerry Enterprise Server name.
Select a BlackBerry device user, then click the question mark ( ? ) symbol beside IT Admin.
From the menu that appears, you can resend the IT policy or assign an IT policy to a BlackBerry device user.
Click OK.

What's RAID 10 And Why Should I Use It?

lijin_l@hotmail.com (Lijin Nair) — Tue, 05 Aug 2008 20:41:00 +0000

RAID is, of course, a Redundant Array of Independent (or Inexpensive) Disks. It is a method of storing information on multiple hard disks for greater protection and in some cases performance. Under the RAID umbrella are a number of different storage methods, called levels and numbered from 0 to 9, some of which are more useful than others.
Each level is a distinct method of organizing storage, but some of them can be combined which produces a two-digit RAID level, such as RAID 10, sometimes identified (and more appropriately so) as RAID 1+0. In general, each RAID level has its own advantages and disadvantages.

RAID 10, for example, is fast, it's crashproof and it eats disk space. If you need more protection for your storage, or faster storage performance, RAID 10 is a simple, relatively cheap fix.

To implement RAID 10 you need at least two physical hard drives; just using two partitions on the same hard drive is inadequate. You also need a disk controller that understands RAID.

RAID 10 works by striping and mirroring your data across at least two disks. Mirroring, or RAID 1, means writing your data to two or more disks at the same time. Even if one disk fails completely, the mirror preserves the information. Striping, or RAID 0, means breaking your data up into chunks and writing the chunks to different disks in succession. It improves performance because the computer can get data off more than one disk simultaneously. (For the purists out there: RAID 0 technically isn't a RAID level at all because it doesn't provide any redundancy to protect information. However, it is commonly referred to as a RAID level anyway.)

Before we go on, here's one important caveat about backup and RAID 1. Although data is written to two disks simultaneously, the data is not being backed up. Should your system, rather than the hard disk, suffer an error erroneous data could be sent to both disks at the same time, corrupting both drives simultaneously. You still must have a backup strategy in place, even if you use RAID 1. (For greater protection against data corruption, use a RAID level that includes a parity drive, but that's a different story.)

Put RAID 1 and RAID 0 together and you get RAID 10. RAID 10 is secure because mirroring duplicates all your data. It's fast because the data is striped across two or more disks, meaning chunks of data can be read and written to different disks simultaneously.

The drawback to RAID 10 is that it cuts your effective disk space in half. Since everything is mirrored (duplicated), two 60 GB disks give you a total system capacity of 60 GB. And remember, always use identical disks when creating a mirrored array. The disk geometry (number of heads, cylinders, etc.) is critical, and using disks that are different is discouraged in the strongest terms.

Given the cost of disks, storage space is much less of a problem than it was a few years ago. It's cheap enough to add additional disks to support your RAID 10 array and if the disk controller on your motherboard doesn't support RAID 10, you can get an add-in disk controller card for less than $50.

RAID 10 is also slightly more complex to set up than conventional storage, but it isn't particularly hard. The system or disk controller software includes install routines that will walk you through the process. It usually takes just a few minutes to install a RAID 10 array.

How to install BlackBerry Manager remotely

lijin_l@hotmail.com (Lijin Nair) — Wed, 16 Jul 2008 17:59:00 +0000

Note: This KB is the originally posted in BES technical support and administrator guide, this is listed here as a ONLY reference to my next blog.

Doc ID : KB13090
Last Modified : 2007-10-01 (RIM)
Document Type : How To

Environment

BlackBerry® Enterprise Server software version 4.1 for Microsoft® Exchange
Microsoft® Outlook®
Microsoft® Windows®

Procedure

Complete the following steps to install BlackBerry Manager remotely:

Make sure that one of the following Microsoft Windows operating systems is being used on the computer where BlackBerry Manager is to be installed:
- Microsoft Windows 2000 Service Pack 4 (Professional, Server or Advanced server edition)
- Microsoft Windows Server 2003 Service Pack 1 or later
- Microsoft Windows XP Professional Service Pack 2 or later
Verify that the operating system is installed in one of the following languages: English, French, German, Italian or Spanish.
Install Microsoft XML Parser (MSXML) 4.0 Service Pack 2 or later. Note: This program can be installed during the BlackBerry Manager installation.
Install Microsoft .NET Framework 1.1 Service Pack 1 or later. Note: This program can be installed during the BlackBerry Manager installation.
Install one of the following:
- Microsoft Exchange Version 5.5 Administrator
- Microsoft Exchange 2000 System Manager
- Microsoft Exchange 2003 System Manager
- Microsoft Outlook 2000 (Corporate or Workgroup installation)
- Microsoft Outlook 2002 (XP) (Corporate or Workgroup installation)
- Microsoft Outlook 2003 (Corporate or Workgroup installation)
Enable Named Pipes and TCP/IP network protocols for the remote Microsoft® SQL Server™ or Microsoft SQL Server Desktop Engine (MSDE). For more information, see article KB04147. Note: Running BlackBerry Manager over a virtual private network (VPN) may cause issues due to limitations for the Named Pipes protocol.
For BlackBerry Enterprise Server sofware version 4.0 or earlier, assign Microsoft Exchange permission for the account which will be used to run the BlackBerry Manager. See KB05035 for more information.
Assign the administrative role for the account which will be used to run BlackBerry Manager.

Open BlackBerry Manager as a BlackBerry Enterprise Server administrative account.
Click on the BlackBerry Domain and go to the Role Administration tab.
Select the role you would like to assign the account to.
If this account is already set up as the Microsoft SQL Server login account, click on the List Administrators option and select the check mark next to it.

If this account is not already set up as the Microsoft SQL server login account, and would like to create one, click the Add Administrators option and type the account name. Enter a password on the next screen. Note: Microsoft SQL Server authentication will need to be used for this account.
For more information about Role Based Administration, see KB04889.
Enable printer and file sharing in Windows in order to activate the BlackBerry smartphones. Note: To enable printer and file sharing in Windows, please search for this information at the Microsoft home page.
Install BlackBerry Manager.
1. Log in to the account which will be used to run BlackBerry Manager.
2. Run setup.exe from the BlackBerry Enterprise Server installation package.
3. Select BlackBerry Manager on the setup type screen.
4. Follow the instructions.
5. When prompted to create a Messaging Application Programming Interface (MAPI) profile, specify the user mailbox name for the account which is being used to run the BlackBerry Manager.
Note: For more information please check the BlackBerry Enterprise Server System Administration Guide.

Database specified has a version that is not supported by this BlackBerry Manager error

Doc ID : KB11855
Last Modified : 2007-06-11
Document Type : Support

Environment

BlackBerry® Enterprise Server software version 4.0 and later

Problem

When attempting to install and configure BlackBerry Manager on a remote computer, the following error message is displayed:

Database specified has a version that is not supported by this BlackBerry Manager, Please upgrade BlackBerry Enterprise Server first then run the upgrade again

The serverdbversion table displays the version information for the BlackBerry Configuration Database, such as 4.1.2.

Cause

The software version of BlackBerry Manager that is being installed is older than the version of the BlackBerry Configuration Database.

Resolution

Install the same software version of BlackBerry Manager as reported in the serverdbversion table of the BlackBerry Configuration Database (such as 4.1.2) or later

Script for Virtual Host Servers to backup Virtual Machines.

lijin_l@hotmail.com (Lijin Nair) — Tue, 17 Jun 2008 20:24:00 +0000

Do you have Backup solution in place for all your virtual needs? We have something to share with you to overcome backup issues on virtual environment; we enabled the Backup script on all virtual Host Servers for virtual Machines, How ever this script uses the shadow copy logic from Jeff Trumbull's backup script. Jeff's vshadow.exe scripting logic was spot-on, so I decided not to reinvent the wheel and this script is enabled to take once in a week currently (As I have limitation on storage in LAB environment, every Friday at 4AM the backup will trigger as of now and later will change to “daily” once we have enough storage in place).

Please find the script details below:

Objectives and Summary of the Script:
One good thing in Virtual Server 2005 R2 SP1 features is the included VS Writer, which leverages the Volume Shadow Copy Service (VSS) to back up running virtual machines.

In order to take advantage of VS Writer, we have two options:
• Use backup software that supports VS Writer (note that support for shadow copies does not guarantee support for VS Writer).
• Write a script that creates the shadow copy of the virtual machine files and then backs them up.

VS Writer does some great things when it is called, For instance, if the guest OS, such as Windows Server 2003, supports VSS, then VS Writer can talk to VSS inside a VM guest OS to properly prepare its applications for a shadow copy.
In the past testing of normal NT backup, we had to manually suspend and resume all VMs to successfully create a reliable shadow copy. This approach was used by Microsoft Virtualization MVP in Jeff Trumbull's excellent script using volume shadow copy. However our environment had a latest edition of the Virtual Server VM additions installed inside the guest OS, which benefited to the shadow copy backups for virtual machines to work successfully.
Backup software that supports VS Writer can back up running virtual server VMs by creating a volume shadow copy that contains each of the VMs' open files and then backing up the VM files associated with the shadow copy.

However our backup software does not support VSS and VS Writer, so we can still reliably back up Virtual Server VMs from the physical host using a vbscript. To back up running virtual machines, while writing the script my intention is to perform the following tasks:

1. Create a snapshot of server's volume that stores the virtual machines.
2. Mount the snapshot to a temporary drive letter.
3. Copy the virtual machine files to your preferred backup location -- either a locally mounted drive or a UNC path.
With that in mind, let's look at implementing a scripted solution. Steps 1 and 2 are the toughest, and rely on vshadow.exe to create and manage the shadow copy. Vshadow.exe is included in the VSS Software Development Kit (SDK). So, to script a live backup solution, you will first need to download the VSS SDK.
Once the download completes, the VSS SDK can be installed by following these steps:
1. Run Setup.exe to install the VSS SDK.
2. When the Install Shield Wizard opens, click Next.
3. Click the "I accept the terms in the license agreement" radio button and click Next.
4. Modify the software installation location, if desired, and click Next to continue.
5. Click Install to start the installation.
6. When the installation completes, click Finish.

I have created a folder on the virtual server system to store the script and its dependent vshadow.exe file. For example, in our LAB I created a folder on the C drive named "scripts." (On Virtual Host Machine) Once the C:\scripts folder is created, I copied the vshadow.exe and vshadow.pdb files from the "C:\Program Files (x86)\Microsoft\VSSSDK72\TestApps \vshadow\bin\release-server" folder to the "C:\scripts" folder.

Next is copy the vsbackup.vbs (s) script to the C:\scripts folder.

Script Code:
The vsbackup.vbs script is shown in the code below here:
*********************************************

Set objShell = CreateObject ("WScript.Shell")
'Load current date (formatted as mm-dd-yyyy)
'into variable strToday
strTime = Month(Now) & "-" & Day(Now) & "-" & Year(Now) &_
"_" & hour(now) & "-" & minute(now)
' Backup target folder or UNC path
strBackupDir = "d:\VSBackup\" & strTime & "\"
'Drive containing Virtual Machines
strVMdrive = "D:"
'VM folder path
strVMfolder = "Shared Virtual Machines"
'available drive letter used to mount shadow copy
strTempDrive = "X:"

'Prepare shadow copy commands
sExCmd = "CreateVSS.cmd"
Set oFileSys = CreateObject("Scripting.FileSystemObject")
if oFileSys.FileExists(sExCmd) then oFileSys.DeleteFile(sExCmd)
set oExCmd = oFileSys.CreateTextFile(sExCmd, CopyOverwrite)

'create backup folder
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFolder = objFSO.CreateFolder(strBackupDir)

' Create Shadow copy of VM drive
oExCmd.WriteLine "vshadow.exe -script=setvar1.cmd -p " &_
strVMdrive
oExCmd.WriteLine "call setvar1.cmd"
oExCmd.WriteLine "vshadow.exe -el=%SHADOW_ID_1%," &_
strTempDrive
oExCmd.Close
Result = objShell.run(sExCmd,vbMinimized, TRUE)

'Copy the virtual machine files from the shadow copy
strSource = strTempDrive & "\" & strVMfolder
objFSO.CopyFolder strSource , strBackupDir, TRUE

' Delete created shadow copy instance
if oFileSys.FileExists(sExCmd) then oFileSys.DeleteFile(sExCmd)
set oExCmd = oFileSys.CreateTextFile(sExCmd, CopyOverwrite)
oExCmd.WriteLine "Echo y | vshadow.exe -da"
oExCmd.Close
Result = objShell.run(sExCmd,vbMinimized, TRUE)

'Backup complete!
wscript.echo("Backup complete!")

*********************************************

To use the script in our environment, I have modified and specified the following variables:
• strBackupDir
• strVMdrive
• strVMfolder
• strTempDrive

strBackupDir should be set to the target location for the backup files. In our case, I have set to UNC path such as " d:\VSBackup\."
Note as the remaining portion of the variable definition is used to append a backup folder to the folder path that is named after the current date and time.

strVMdrive is the drive letter of the drive that stores the VM files. Since shadow copies occur at the volume level, it's most economical to back up all Virtual Server VMs on a given drive at the same time.

strVMfolder should represent the complete folder path to the VM files. For example, on our LAB/QA systems, the following folder structure was used during the initial build as a standard configuration, For Example:
D:\Shared Virtual Machines
|----- TESTBSGS01
| TESTBSGS01.vmc
| TESTBSGS01.vsv
| TESTBSGS01.vhd
|
|----- TESTBSGS02
| TESTBSGS02.vhd
| TESTBSGS02.vmc
| TESTBSGS02.vsv
|
|-----TESTDNSS02
TESTDNSS02.vhd
TESTDNSS02.vmc

So in my example, D is used for the strVMdrive variable and strVMfolder is set to “Shared Virtual Machines." If I had wanted to just back up the QA01DNSS02 VM, I can set the strVMfolder variable to “Shared Virtual Machines\TEST01DNSS02.”

strTempDrive is used to designate an available drive letter that will be used to mount the shadow copy during the backup. By default, the drive letter X is used.
The script creates a backup folder named after the date and time of the backup. The folder's contents will be identical to the source virtual machine file.
For example, a recent backup generated the following folder tree:
D:\VSBackup\4-24-2008_18-8\Shared Virtual Machines
|----- TESTBSGS01
| TESTBSGS01.vmc
| TESTBSGS01.vsv
| TESTBSGS01.vhd
|
|----- TESTBSGS02
| TESTBSGS02.vhd
| TESTBSGS02.vmc
| TESTBSGS02.vsv
|
|-----TESTDNSS02
TESTDNSS02.vhd
TESTDNSS02.vmc

The date/time naming of the folder allows the backup files to be automatically organized by the backup date and time.
This script will back up all files in the VM folders to the designated backup target folder, any time we can restore backedup VM to the time of the previous backup by copying the files in the VM's associated backup folder to their original source folder. Alternatively, we can mount a VM's virtual hard disk (VHD) file using VHD Mount in order to recover a single file.

While I wrote this script to solve a specific virtual server backup challenges without any downtime, as the same can be used to back up any application that supports VSS and this is currently serving all my virtual backup challenges.

Windows 2008 RC1 on Virtual Server

lijin_l@hotmail.com (Lijin Nair) — Wed, 26 Dec 2007 11:11:00 +0000

Great News for Microsoft Technology Professionals,Windows Server 2008 RC1 with Hyper-V Beta is now available.

Windows Server 2008 RC1 with Hyper-V Beta, the official name of what I've been previously referring to as Windows Server virtualization, has just gone live on Microsoft.com. The Beta has many improvements over the preview or CTP release - Jeff's got more information of the details on our team blog.

You can download a copy from http://www.microsoft.com/downloads/details.aspx?FamilyId=8F22F69E-D1AF-49F0-8236-2B742B354919&displaylang=en

More information on the presspass site http://www.microsoft.com/presspass/press/2007/dec07/12-13EarlyBetaPR.mspx
IMPORTANT: When you install, you should select English US only, otherwise you may see error 87 when the Virtual Machine Management Service (VMMS) starts. The only workaround in these instances is to start the installation again.

If you recall back to our Community Technology Preview (CTP) release a few months ago, you had to run a couple of packages before the role was present in Server Manager. This is no longer necessary - the Hyper-V role will be present automatically.

Finally, if you have Windows Server 2008 guests built in the CTP, you should move to freshly installed VMs with this build running as the guest. You'll notice now that you no longer have to install the Integration Components in a Windows Server 2008 guest - they will be installed automatically with the OS install.

Configure RBLs in Exchange 2003

lijin_l@hotmail.com (Lijin Nair) — Wed, 05 Dec 2007 07:10:00 +0000

An RBL being a "Real-time Block List" (or "Black List" - those terms are interchangeable and I have yet to see a common trend). A very general description of how they work is that an e-mail message comes into your server, the server then queries an RBL server with the information in that message. The server then responds with good/bad and then your mail server can decide how to act on it from there (in the case of Exchange 2003 it will not deliver it to the end user and return an error message to the sender).

Some RBLs are setup not for known spammers, but instead of servers that are configured in a way so that they could be exploited for spam - in the case of these RBLs, you might want to edit the message that gets sent to the person sending the e-mail so that they are aware of their server configuration.
In order to set this up, follow these steps:
1. Go into your Exchange 2003 System Manager.
2. Go to the Global Settings -> Message Delivery
3. Right click on Message Delivery and select "Properties" from the drop down menu
4. Go to the "Connection Filtering" tab.
5. In here click on the "Add" button.
6. For "Display Name" you can add whatever you like, but usually the name of the RBL server is what you want to put in there.
7. For "DNS Suffix of Provider" you will want to put the url to the server - for example the one for Spamhaus is "sbl.spamhaus.org"
8. If you think you want a custom error message, then fill out that field with whatever you want it to be (like I said, perhaps in the cases of when your RBL is not blocking spam, but instead servers that may potentially be spamming due to their incorrect setup).
9. I personally don't use the "Return Status Code" field, so I can't give you too much info on that one.
10. Then click OK and that RBL is setup.
11. As you can see on that main screen there is the ability to have a global accept and deny list with IP addresses, as well as an exception list - this is where you can whitelist/blacklist people in if you like. (the times I have seen this are usually when a client will call in complaining that their mail is getting bounced)
12. After you are done adding you’re RBLs, click on OK for the main menu and then you will likely get a popup reminding you that you need to activate these rules.
13. Just like that popup says, you need to activate them - so if this is your first time setting up a connection filter, then go into the System Manager -> Administrative Groups -> and then to the server that you want to activate this on
14. Once in the section for your server, then go to Protocols -> SMTP -> Default SMTP Virtual Sever and then right click on that and select "Properties" from the menu that comes up.
15. In there, under the General tab, click on "Advanced"
16. In there, select the port 25 identity and click on the "Edit" button.
17. In that screen check the "Apply Connection Filter" and then select OK all the way out until you are back at the System Manager.

The two RBLs that we use are Spamhaus and SpamCop. Their urls to use in the filter manager are:
Spamhaus: sbl.spamhaus.org
SpamCop: bl.spamcop.net
If you want a wider selection of RBLs on the net, then just do a Google search - but be very careful that you know how the RBL chooses what to add to the blacklist. Depending on where your mail is coming from, choosing the wrong RBL can make a lot of your clients unhappy (spoken from personal experience - fortunately it is very easy to disable and/or delete these rules in Exchange once they are in if there is a problem).

Spamhaus and SpamCop only block from known spammer company servers, so you are far less likely to have an angry client coming after you, but more likely to miss spam.
Also, this approach does essentially nothing at all about blocking "zombied" computers - the desktop computers running various versions of Windows that then get a virus/trojan/worm/spyware/malware that then sets up a server on their machine and sends out spam.

Because of this, you usually will want to combine the RBLs with another spam solution, but it does help cut down on the spam coming in to your users.
This page was one I found in a Google search that does a fairly good job of explaining the popular RBLs and how each one selects servers for their list.
Hopefully for those of you that admin Exchange 2003 box and are still working your way through it all, this helps speed up your understanding of that built in tool.
Perhaps combined with the Intelligent Message Filtering it can help you out (in that case, you will also want Outlook 2003 on all of your desktop machines).

How to configure connection filtering to use Real-time Block Lists (RBLs) and how to configure recipient filtering in Exchange 2003.
http://support.microsoft.com/kb/823866

Check out, How BlackBerry works?

lijin_l@hotmail.com (Lijin Nair) — Sat, 24 Nov 2007 12:54:00 +0000

The BlackBerry wireless e-mail solution is quite simple in design. Essentially when a message arrives in a user's Exchange mailbox it is picked up by the BlackBerry Enterprise Server which is constantly monitoring all BlackBerry enabled user mailboxes. That message is then retrieved, compressed, encrypted and subsequently sent via the Internet to the wireless network. The e-mail sent is not readable text and is only decrypted at the destination user's BlackBerry handheld. The e-mail is then sent to the handheld via the wireless network at which point it is decrypted, decompressed and then immediately available on the device. The BlackBerry Enterprise Server supports triple DES security (considered unbreakable) so confidential data is transmitted securely.

When sending e-mail from the BlackBerry device the reverse applies. Before an e-mail is sent it is compressed, encrypted and sent to the BlackBerry server over the Internet via the wireless network. The server then decrypts, decompresses and then places the e-mail it into the Outbox. In effect this message is no different from any message being composed from a PC using Outlook. A copy is even placed in the Sent Items folder!

The BlackBerry Enterprise server uses MAPI to communicate with the user's Inbox. One advantage of MAPI is the immediate notification of arriving messages. This is crucial for the "push" architecture that instantly sends (or pushes) a copy of e-mail that arrives in the Inbox. In contrast, the "pull" model requires the user to connect to a server and request messages to be downloaded on a regular basis, which is not a "real-time" solution.

Method to find, How many Virtual Server hosts are running in your domain?

lijin_l@hotmail.com (Lijin Nair) — Mon, 29 Oct 2007 10:00:00 +0000

Easiest Method to check how many domain-joined Virtual Server hosts are currently running in your organization. It takes advantage of the SCP (Service Connection Point) marker in Active Directory which was introduced in Virtual Server 2005 R2 SP1.
------------------------------------------------------------

On Error Resume Next
Const SCP = "MS Virtual Server"

' Add as many lines as needed for the domains in your org.
DoQuery "DC=yourdomain,DC=com", "YOURDOMAIN", SCP

Sub DoQuery(szDomainDN, szDomainShortName, szSCP)

Set oConnection = CreateObject("ADODB.Connection")
Set oCommand = CreateObject("ADODB.Command")
oConnection.Provider = ("ADsDSOObject")
oConnection.Open "Ads Provider"
oCommand.ActiveConnection = oConnection
oCommand.Properties("Page Size") = 99
oCommand.Properties("Searchscope") = &H2 'ADS_SCOPE_SUBTREE
oCommand.Properties("Chase Referrals") = &H60 'ADS_CHASE_REFERRALS_ALWAYS
oCommand.CommandText = "select distinguishedName from 'LDAP://" & szDomainDN & "' " & _
"where objectCategory='serviceConnectionPoint' " & _
"and cn='" & szSCP & "'"
Set oRecordSet = oCommand.Execute
If Err Then
wscript.echo "ERROR: Unable to find Domain Rooted at: " & szDomainDN
exit sub
End If

If Not oRecordSet.EOF Then
wscript.echo szDomainShortName & ":" & oRecordSet.RecordCount

' If you want to enumerate the machine names, uncomment this block
'oRecordSet.MoveFirst
'Do Until oRecordSet.EOF
' szNodeName = oRecordSet.Fields("distinguishedName")
' szNodeName = Mid(szNodeName, InStr(szNodeName, ",CN=") + 4) ' Trim "CN=,CN="
' szNodeName = Left(szNodeName, InStr(szNodeName, ",") - 1) ' Trim the domain DN
' wscript.echo szNodeName
' oRecordSet.MoveNext
'Loop

Else
wscript.echo szDomainShortName & ": 0"
End If

Set oRecordSet = Nothing
Set oCommand = Nothing
oConnection.Close
Set oConnection = Nothing

End Sub

------------------------------------------------------------
Save the above script as "FindServers.vbs". Edit the call to "DoQuery" at the top to put in the appropriate domains for your organization. If you want a list of the machine names as well, uncomment the code-block starting "oRecordSet.MoveFirst" and ending "Loop". To run the script, from a command-line, type "cscript FindServers.vbs".

Steps to configure Exchange 2003 to block unsolicited commercial e-mail (spam) with IMF.

lijin_l@hotmail.com (Lijin Nair) — Thu, 04 Oct 2007 11:57:00 +0000

Microsoft Exchange Intelligent Message Filter is a product developed by Microsoft to help companies reduce the amount of unsolicited commercial e-mail (UCE), or spam, received by users.

Intelligent Message Filter is based on Microsoft SmartScreen Technology from Microsoft Research. By using e-mail characteristics tracked by SmartScreen technology, Intelligent Message Filter can help determine whether each incoming e-mail message is likely to be spam. Based on this likelihood, you can choose to block e-mail messages at the gateway or at the mailbox store.
This is the integrated feature of Exchange, If you interested to have dedicated SPAM filtering servers, then I would prefer you to have look on Microsoft forefront server (formerly Antigen).

How it works?
When an external user sends e-mail messages to an Exchange server with Intelligent Message Filter installed, IMF evaluates the textual content of the messages and assigns the message a rating based on the probability that the message is UCE or spam. All incoming messages are marked with a Spam Confidence Level SCL rating, regardless of the rating threshold you set. This rating is saved with the other message properties and these properties are sent with the message to other Exchange servers.

In Gateway Blocking Configuration, select the rating in Block messages with an SCL rating greater than or equal to above which Intelligent Message Filter takes action on this message.

If a message has a rating higher than the gateway threshold, IMF takes the action specified. If the message has a rating below the gateway threshold, the message is sent to the Exchange mailbox store of the recipient. At the Exchange mailbox store, if the message has a higher rating than the mailbox store threshold, the mailbox store delivers the message to the user's Junk E-mail folder rather than to the Inbox.

Intelligent Message Filter does not need to be installed on Exchange mailbox servers. If Intelligent Message Filter is installed and enabled on the gateway SMTP virtual servers, Exchange mailbox servers receive the SCL rating with each incoming Internet message and take the appropriate action.

Note: The Intelligent Message Filter is not supported in a clustered environment. Therefore, Intelligent Message Filter updates are not offered to Exchange Server 2003 servers in a clustered environment.

System Requirements: Supports Windows 2000 Service Pack 3, Windows 2000 Service Pack 4, and Windows Server 2003. Requires Exchange Server 2003.
Exchange Server 2003 SP2 Update Note: IMF is now an integral part of Exchange Service Pack 2 (SP2). You can learn how to configure it on SP2 by reading Configure Intelligent Message Filter in Exchange 2003 SP2.

Read more about IMF in the Related Articles section below.
Installing IMF (without Exchange 2003 SP2)
If you still do not have Exchange 2003 SP2 (and why don't you?) you can d/l the IMF standalone tool from the link above and manually install it. Service Pack 2 users do not need to manually perform these steps.

After downloading IMF you can now install it on your machine.
1. Double-click the ExchangeIMF.msi file. In the Welcome screen click Next.

2. Accept the License Agreement, and in the screen, select to install both the Management Tools for IMF and the IMF Functionality.

3. Watch as the installation process completes, click Finish at the end of it. There is no need to reboot.

Note: After installation, the FTP Publishing service is not restarted. Intelligent Message Filter installation stops the IIS Admin service. The following services are restarted after installation has completed.
• Simple Mail Transfer Protocol service (smtpsvc)
• Network News Transfer Protocol service (nntpsvc)
• Microsoft Exchange Post Office Protocol version 3 service (pop3svc)
• Microsoft Exchange Routing Engine Service (resvc)
• Microsoft Exchange Internet Message Access Protocol Service (imap4svc)

The FTP Publishing service is not restarted. You must restart in manually.
Installing IMF (with Exchange 2003 SP2)
After downloading Exchange Server 2003 SP2 you can now install it on your machine.
Read the Installing Intelligent Message Filter with Exchange 2003 SP2 page for more info.
Once you've installed SP2, do not install IMF v1 again!
Configuring IMF
Configuring Intelligent Message Filter involves two settings:
Gateway Blocking Configuration - In Gateway Blocking Configuration, you establish a threshold based on a spam confidence level (SCL) rating above which the gateway server takes action on the message. You also define the type of action you want the gateway to take.
Store Junk E-mail Configuration - In Store Junk E-mail Configuration, you define the thresholds based on an SCL rating that Microsoft Exchange 2003 mailbox stores use to determine whether to deliver messages to a user's Inbox or Junk E-mail folder.
In order to configure IMF follow these steps:
1. Open the Exchange System Manager snap-in (ESM).
2. Expand your Organization object, expand Global Settings. Right-click Message Delivery and choose Properties.

3. Notice there is a new tab named "Intelligent Message Filtering". Click on it.
4. In the Gateway Blocking Configuration section enter the number you chose, based upon your own preferences. I use 7, but you may want to experiment with lower or higher numbers. Selecting a lower number for the SCL rating filters more messages, but also increases the likelihood of false positives, which are legitimate messages that appear to be UCE. Selecting a higher number for the SCL rating filters fewer messages, but also reduces the likelihood of false positives.
5. Now choose the action to perform when blocking messages. You can select Archive

6. In the Store Junk E-mail Configuration select your desired threshold. I use 5. but again, you may want to experiment with lower or higher numbers.
7. Click Ok.

After you configure Intelligent Message Filter, you must enable this filter on all inbound gateway SMTP virtual servers.

Exchange 2003 Service Pack 2 Note: IMF is installed as an integral part of SP2. Because of that, the IMF settings that need to be configured under the SMTP Virtual Server are no longer a subfolder node of the SMTP Virtual server (as displayed in these screenshots), but are part of the SMTP Virtual Server IP address advanced configuration.

Please read Configure Intelligent Message Filter in Exchange 2003 SP2 for more details.
For SP1 follow these steps:
1. Expand the Administrative Group folder, then expand the Servers folder, then expand each server that will be configured with IMF.
2. Expand the server object and click to expand the Protocols folder. Expand the SMTP folder.

3. Right-click Intelligent Message Filtering and choose Properties.
4. In the General tab click to select the check-box the SMTP virtual server.

5. Click Ok.

After the configuration of IMF, Make sure you monitor your Junk Mail folder. Test your e-mail software (it does not necessarily have to be Outlook) and make sure you don't have too many false positives. If you do, or if you see that legitimate e-mail is deleted or treated as junk you can always go back to the IMF configuration screen and lower your SCL rating. In order to view the SCL rating and understand how it works read the Display SCL Level in Outlook 2003, Display SCL Level in OWA 2003 SP2, Archiving the SCL Rating in Intelligent Message Filter and View Intelligent Message Filter Archive articles.

If you're running Exchange 2003 SP2 you can (and should) read the Updating Intelligent Message Filter in Exchange Server 2003 SP2 page.
Important issues and limitations of IMF

Here is a listing of important issues and limitations of IMF, things that you should consider before deploying IMF:
• The Intelligent Message Filter can only be installed on Exchange 2003.
• IMF is a heuristic text search engine, based upon simple text search. Skilled spammers have already found many tricks around this simple filtering method, thus making IMF obsolete even before it came out on the market.
• Updating IMF is a task that needs to be done regularly, yet currently, there is no apparent way to do it. Even if IMF works well for you in the beginning, it may not work as well a few months later, when major spammers find their way around it.
• IMF does not offer any granularity necessary for treating groups of users differently at the server level. Settings on the server side are the same for everybody.
• Although generally a good idea, IMF may in fact cause greater administrative effort than before. E-mail with higher SCL threshold will be either thrown away or archived before the client ever sees it, meaning that the administrator will have to search the central archive for false positives, rather than just leaving that task to the users.
• The features of IMF are fully available only for users of Outlook 2003 or Outlook Web Access, and although limited functionality is available with other versions of Outlook, companies that use other third party solutions will probably be disappointed by it's lack of features.
• No performance figures are yet to be published by Microsoft. We still need to see how IMF affects your server performance.
• IMF is not supported on Exchange 2003 clusters.

How virtualization is changing the IT

lijin_l@hotmail.com (Lijin Nair) — Wed, 26 Sep 2007 08:08:00 +0000

The year 2004 might very well become known as the year of virtualization. Initially, the market recognized the value of virtualization technologies in test and demo environments. However, with the advent of ever more powerful systems coupled with continued improvements in virtual machine (VM) technologies, virtualization has since become a production-level technology that enables server consolidation.
VMware was first to market in the virtualization space with the release of VMware GSX Server in 2001. In October 2004, Microsoft entered the virtualization market with Virtual Server 2005, sparking much interest, especially among customers who have come to rely on VM technologies. A comparison of these two titans of virtualization leads to a clear recommendation as to the product that can best address a particular organization's needs.

The VM Architecture

Both products install on top of the base OS and provide a software layer that emulates a physical system. You can install a guest OS on each emulated system, or VM, and you can run multiple VMs concurrently as if each were installed on a separate physical system.

Each VM owns its own virtual hardware, consisting of a processor, disk, memory, and network. VMs aren't aware of other VMs as anything other than networked systems. The virtual server product handles the task of virtualizing the hardware and sharing it with all the VMs. The virtual server also provides virtual networking services that can connect VMs together as well as giving them access to external network resources.

Review Criteria

Although both products possess similar overall functionality, they also have several significant differences. In evaluating the products, the first criterion I considered was the host and guest OSs they support. The host OSs are the OS platforms on which you can install the VM software. The guest OSs are the OSs that the virtual servers can run. I also compared ease of use and overall manageability, looking at the process of creating new VMs as well as the ability to manage the virtual server and the VMs.

Finally, I compared the performance of the VMs running under each product. To check the overall performance of the guest OSs, I used SiSoftware Sandra 2005 Lite benchmarking software (http://www.SiSoftware.net). I compared the results of tests run on the VM that I created on each virtual server—a vanilla installation of Windows Server 2003, Enterprise Edition—to the results of baseline tests I ran on the physical machine. I performed all tests on an HP ProLiant ML350 with dual Intel Xeon 3.2GHz processors, 2GB of RAM, and a dual-channel Ultra320 SCSI controller connected to four 36GB, 15,000rpm hard drives running Windows 2003 as the host OS.

Microsoft Virtual Server 2005

Microsoft makes two versions of Virtual Server 2005: Standard Edition and Enterprise Edition. Standard Edition supports host servers with up to 4 processors; Enterprise Edition supports host servers that have as many as 32 processors. However, the product doesn't provide SMP support for the VMs running on a Virtual Server 2005 server.

By using Physical Address Extension (PAE), Virtual Server can support up to 64GB of memory, and each VM can address up to 3.6GB of memory. Both versions support a maximum of 64 VMs per host. Microsoft supports Virtual Server for use only on 32-bit host platforms.

Unsurprisingly, Virtual Server supports only Microsoft host and guest OSs, as the feature comparison in Table 1 shows. Although I used the product to run other OSs, such as Linux, I don't recommend that you do so in a production environment because of the lack of support.

I'm accustomed to using Microsoft Virtual PC, but Virtual Server is a very different animal and took a little getting used to. Instead of using a Windows-based management console, you manage Virtual Server through the Administration Website console that you see in Figure 1. You access the management program either by selecting the Administration Website option on the Virtual Server 2005 server or by pointing a browser to http://server:1024/VirtualServer/VSWebApp.exe.

Although it took a while for me to feel comfortable with it, the console made it very easy to manage Virtual Server from across the network. The Administration Website provides a thorough overview of the status of the configured VMs, including current performance data and even a mini screen view. I appreciated the no-footprint management offered by the Administration Website, but unfortunately the price you pay for it is having to run IIS 6.0 on the host. The installation process automatically configures IIS, adds the Administration Website, and sets permissions for the site, but you still have an extra element to manage.

Unlike GSX Server, Virtual Server has no wizard to step you through the process of creating VMs. Instead, you need to use the links provided by the Administration Website to manually create a virtual hard disk (VHD), a virtual network, and a VM that utilizes the VHD and virtual network. After I became familiar with the process, I found the interface fairly easy to navigate, but it lacked some of the niceties that I've come to expect from a Windows application, such as the ability to browse the file system when creating VHDs. I like the Administration Website's ability to provide remote control for all the VMs. After you create a VM, you'll probably want to install the Virtual Machine Additions, software drivers that increase screen resolution by adding an SVGA driver and enable better mouse tracking and control.
Virtual Server supports four types of VHDs: dynamically expanding, fixed-size, differencing, and linked. The host OS sees dynamically expanding and fixed-size VHDs as a large .vhd file that contains the file system for the guest VM. Dynamically expanding disks start small and automatically grow as the guest VM requires additional storage. Much like a physical hard drive, a dynamically expanding disk can grow only until it reaches its predefined limit. As you'd expect, the guest VM experiences a delay when the VHD must be expanded. Fixed-size VHDs are allocated when you create them and don't grow.

Dynamically expanding, fixed-size, and differencing VHDs support using an optional undo disk. Undo disks let you reset all changes that have been made to a dynamic, fixed-size, or differencing disk. Undo disks store all configuration and data changes made to the VM during the session and prompt you to save or discard the changes when you shut down the VM. Differencing disks let you isolate changes that occur within a guest VHD; all changes that occur in the parent VHD are stored in the differencing disk. Unlike an undo disk, which is associated with the entire VM, a differencing disk is associated with a particular VHD. Compared with GSX Server's differencing disks, Virtual Server's built-in differencing disks are a snap to create.

Linked VHDs are different from the other types of VHDs. Linked disks convert an entire host file system's partition to a VHD. Afterward, the host can no longer access that portion of the file system. You can't use linked disks with undo disks or differencing disks.

You can configure virtual networking to use either the host system's NIC or a user-defined virtual network that only VMs can access. If you use the host NIC, any VM connected to the virtual network can access the network that the host is connected to. Otherwise, the VM can access only the internal virtual network. Virtual Server can also provide a virtual DHCP server, so you don't need to configure a guest VM on an internal network to act as a DCHP server.

One especially nice feature is Virtual Server's ability to configure shared SCSI VHDs, which lets you set up Microsoft Cluster service over two VM nodes. Another welcome feature is the ability to transfer VMs created with Virtual PC 2004 to Virtual Server. One annoying limitation of Virtual Server is that, like Virtual PC, it lacks support for USB devices. Although you can use USB keyboards and mouse devices, you can't plug in USB flash drives with Virtual Server and have them recognized in the VMs. Virtual Server also has a strong set of COM-based APIs that you can use in conjunction with VBScript to create your own custom management scripts.

Microsoft offers the Virtual Server Migration Toolkit (VSMT) as a free add-on to Virtual Server. Available for download at http://www.microsoft.com/widowsserversystem/virtualserver/evaluation/vsmt.mspx, the VSMT can convert physical machines to VMs and VMware VMs to Virtual Server–compatible VMs. VMware offers a similar product, called the VMware P2V Assistant, but you must purchase it separately.

VMware GSX Server 3.1
Now in its third release, VMware GSX Server offers two licensing levels: one for systems with one or two CPUs, and the other for systems with up to 32 CPUs. Like its competitor, GSX Server doesn't provide SMP support for the guest OSs and lets you run a maximum of 64 VMs concurrently on one host, depending on the resources the VMs require. GSX Server supports up to 64GB of memory on PAE-enabled Windows systems, and each VM can address up to 3.6GB of memory.

When I wrote this review, GSX Server officially supported only 32-bit hosts. However, the product also provides "experimental support" for 64-bit hosts, which basically means that they work but aren't recommended for use in a production setting. I expect VMware to announce official support for 64-bit host OSs after Microsoft releases Windows 2003 for 64-bit Extended Systems later this year.
GSX Server has a decided advantage over Virtual Server in the area of supported host and guest OSs. In addition to supporting all Windows OSs, GSX Server supports a variety of Linux systems as hosts, as you can see in Table 1. The product's client OS support is equally extensive.

If you've used VM Workstation or an earlier version of GSX Server, you'll find managing GSX Server to be a breeze. Figure 2 shows the Virtual Machine Console. Although it provides decidedly less information than Virtual Server's Administration Website, it's easier to use and noticeably more responsive.
Setting up new VMs under GSX Server is decidedly easier than using Virtual Server's piecemeal VM creation process. GSX Server's New Virtual Machine Wizard provides an easy-to-use interface that steps you through VM, VHD, and network creation. You'll probably want to install VMware's VMTools on all your VMs. VMTools provides a higher-performance video driver and enables cutting and pasting text between the VMs and the host.

VMware gives you several options for remotely managing GSX Server. The Windows-based Virtual Machine Console can connect to networked GSX Server systems. A Web-based management interface enables basic VM management functions, such as displaying and controlling VMs. You can also use a set of scripting APIs for Perl and COM, called the vmPerl and vmCOM APIs, respectively.

GSX Server supports two basic types of virtual disks: raw and virtual. Raw disks directly access a local disk partition. Virtual disks appear to the GSX Server host OS as a file. That file, which has an extension of .vmdk, stores the VM's entire file system. You can dynamically expand virtual disk files, or you can preallocate files when you create them.

GSX Server's undo disks let you save or discard all the changes in a VM at the end of a session, and virtual disks have a snapshot feature that lets you capture the current state of the virtual disk. GSX Server also supports differencing, but the associated process is manual and isn't nearly as easy to use as Virtual Server's differencing disk capability.

You have a choice of three types of virtual networking for GSX Server VMs: host-only, Network Address Translation (NAT), and bridged. Host-only networking restricts you to internal VMs that have no outside connections. The NAT option lets VMs connect to the outside network using the host IP address. GSX Server provides its own built-in DHCP server for host-only and NAT configurations. Bridged networking lets VMs access the outside network. Alternatively, you can choose None to disable the network hardware.

GSX Server lets you set up Microsoft Cluster service using shared SCSI VHDs. You can also transfer to GSX Server any VMs that you've created with VMware Workstation. One key advantage GSX Server has over Virtual Server 2005 is full support for USB devices—I could freely transfer data between GSX Server VMs and USB flash drives.
Performance

To test performance, I used the Sandra benchmarking software's combined performance index tests running on a fresh installation of Windows 2003, Enterprise Edition. I tested a variety of system performance factors, including basic display performance, memory access speed, and file-access and networking performance.
For Virtual Server 2005, I performed all tests on the local server that was running Virtual Server, using the Virtual Machine Remote Control Client running in full-screen mode. I configured the VM to use 384MB of RAM and used a fixed SCSI VHD so the test wouldn't be affected by dynamic expansion. The VHD was also on a different disk spindle than the drive on which the host OS was installed. To determine whether the Virtual Machine Additions made a significant performance difference, I first ran a set of tests without the Virtual Machine Additions installed, then ran another set after installing them.

In all the performance tests, the VMs running under Virtual Server were slower than those running under GSX Server. The CPU arithmetic test (Figure 3) shows Virtual Server lagging behind GSX Server by about 20 percent. The multimedia test (Figure 4) showed similar results. The other tests were closer, but GSX Server held onto a 17.5 percent advantage in file system performance (Figure 5) and a 5 percent edge in network performance (Figure 6). The presence of the Virtual Machine Additions gave a bigger boost to Virtual Server's file and network access performance than it did to the product's arithmetic and multimedia performance.

I configured GSX Server's VM to use 384MB of RAM and a preallocated virtual SCSI hard disk that was located on a separate physical hard disk from the host system's OS. I ran two sets of tests: the first without VMTools and the second with VMTools. As Figures 3 through 6 show, VMs running under GSX Server provide notably better performance than those running under Virtual Server. Considering that GSX Server is in its third release and Virtual Server is in its first release, it wasn't surprising that GSX Server is faster.

A Clear Choice
Both products are of excellent quality, and neither gave me any significant problem. If you need to run Linux or other guest OSs in a production environment, VMware GSX Server is the clear choice. VMware officially supports most popular Linux distributions. You can find more information about or download a 30-day evaluation version of VMware GSX Server 3.1 at http://www.vmware.com/products/server/gsx_features.html.
For those who have a Microsoft-only environment, however, Virtual Server 2005 is the better value. Significantly less costly than GSX Server, Virtual Server offers all the same capabilities for Windows guest OSs, albeit slightly slower performance. For more information about Virtual Server 2005 or to download a 180-day evaluation version, go to http://www.microsoft.com/virtualserver.

VMware GSX Server 3.1
Contact: VMware * 650-475-5000 or 877-486-9273
Web: http://www.vmware.com
Price: $1400 for two-CPU license; $2800 for unlimited-CPU license
Summary
Pros: Excellent support for multiple OSs; easy to use; good VM performance
Cons: High price; support for VMware P2V Assistant migration is an add-on
Rating: 4.5 out of 5
Recommendation: The only choice for shops that want to run heterogeneous OSs as VMs

Microsoft Virtual Server 2005
Contact: Microsoft * 425-936-8080
Web: http://www.microsoft.com/windowsserversystem/virtualserver/default.mspx
Price: $499 for Standard Edition; $999 for Enterprise Edition (Includes VMM 2007 Kit)
Summary
Pros: Web-based remote management; easy-to-use differencing disks
Cons: Limited host and guest OS support; no support for USB flash devices; requires IIS 6.0
Rating: 4.5 out of 5
Recommendation: The better value for Microsoft-only environments

How to Deny write access to USB mass storage devices?

lijin_l@hotmail.com (Lijin Nair) — Sun, 12 Aug 2007 11:27:00 +0000

As described in my previous post for disabling USB mass storage, this option is exceptional case were you need to allow USB mass storage for specific remote users. Below is the simple approach to deny write access on USB mass storage.
To prevent users from being able to write to USB disks follow these steps:

1. Open Registry Editor.

2. In Registry Editor, navigate to the following registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\StorageDevicePolicies
Note: This key might not exist. In that case simply create it as a new key under the parent key.

3. Right Click and Create the following value (DWORD):
WriteProtect
and give it a value of 1.

Note: As always, before making changes to your registry you should always make sure you have a valid backup. In cases where you're supposed to delete or modify keys or values from the registry it is possible to first export that key or value(s) to a .REG file before performing the changes.

4. Close Registry Editor.
Done!

Note: When you try to write something to any USB Disk and you'll get the following error as “Media Write Protected”

A method to find IS Maintenance calculation from ADSIEDIT?

lijin_l@hotmail.com (Lijin Nair) — Sat, 11 Aug 2007 21:34:00 +0000

How to find the IS Maintenance calculation from ADSIEDIT?

In Exchange 2003, by default, it will be in the form of Hexadecimal, decimal, octet and binary. The hexadecimal output looks like this:

00 07 ff ff f0 00 00 00 00 00 00 00
00 07 ff f0 00 00 00 00 00 00 00 00
00 07 ff f0 00 00 00 00 00 00 00 00
00 07 ff f0 00 00 00 00 00 00 00 00
00 07 ff f0 00 00 00 00 00 00 00 00
00 07 ff f0 00 00 00 00 00 00 00 00
00 07 ff ff f0 00 00 00 00 00 00 00

NOTE: The I have formatted the schedule above so every row represents a day of week. The first row is Sunday, followed by Monday and so forth and the last row is Saturday. Each row contains 12 entries of 2 numbers each. Every single number in the sequence represents one hour. Therefore, every row represents a 24 hour period.

The schedule above is in GMT time zone, and you can read it this way:

Since the data is a bit stream, you can represent it as this sequence: 0 0 0 7 f f f f f 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0. Every number in the sequence represents an hour. So in this example, for first three hours the maintenance is off. Now, 0x7 is 0111 in bit representation, that means that 3:00am is off, 3:15am, 3:30am and 3:45am are on. 0xF is 1111, so that means entire hour is on. Again, in this example, we get that 8am is on, 9am is off. So, we get that the schedule is 3:15am - 9am GMT. The data is in GMT time zone, so we have to convert it into local time zone.

How to disable only USB Mass storage on Microsoft OS

lijin_l@hotmail.com (Lijin Nair) — Sat, 11 Aug 2007 21:21:00 +0000

Folks, Lets keep our heads up for security audits,However disabling the entire USB port doesnt make sense, Which USB port is only universal port for all hardware accessories connectivity like Mice/Mouse, Modem, DigiCAM etc.

Hence the feseable option is to only disable USB Mass storage from desktops through AD GPO. Below are the steps, which will allow you to enable or disable the use of USB mass storage devices.

I have tested this in windows 2003 server (My virtual server) and seems to work well. It does not disable other USB devices, like USB keyboard, Mouse etc, so it is a better solution than just disabling USB ports all together.

Reference articles:
http://support.microsoft.com/default.aspx?scid=kb;en-us;823732
http://support.microsoft.com/default.aspx?scid=kb;en-us;555324

Plan Of Action:
1.) Take the following blue text, copy it, and paste it into a text document. Then, save it as USBSTOR.ADM

CLASS MACHINE
CATEGORY "Custom Policies"
KEYNAME "SYSTEM\CurrentControlSet\Services\UsbStor"
POLICY "USB Mass Storage Installation"
EXPLAIN "When this policy is enabled, USB mass storage device permissions can be changed by using the drop down box.

Selecting 'Grant Permission' will allow USB mass storage devices to be installed. Selecting 'Deny Permission' will prohibit
the installation of USB mass storage devices.

IF REMOVING THIS POLICY: Reset to original setting and let policy propegate before deleting policy."
PART "Change Settings:" DROPDOWNLIST REQUIRED
VALUENAME "Start"
ITEMLIST
NAME "Grant Permission" VALUE NUMERIC 3 DEFAULT
NAME "Deny Permission" VALUE NUMERIC 4
END ITEMLIST
END PART
END POLICY
END CATEGORY

2.) Open a group policy management console (gpedit.msc), and right click on "administrative templates" under "Computer Configuration". Select "Add/Remove Templates".

3.) Browse to the text document you just saved and click OK. You'll now see "Custom Policies" under "Administrative Templates". Right click on it, select "View", then select "Filtering". Uncheck the bottom box, labeled "Only show policy settings that can be fully managed".

4.) Click ok. Now you'll see the USB policy available for use under the custom policy heading. From there, you can enable or disable it just like any other policy.

Note: This is applicable for all version of Win2000, XP, 2003 & Vista.
If you need the ready ADM template, please free to mail me on lijin_l@hotmail.com.

How can I know what programs are running in another machine in the same network? Is there any software to run locally for monitoring other machines?

lijin_l@hotmail.com (Lijin Nair) — Sat, 11 Aug 2007 21:08:00 +0000

How can I know what programs are running in another machine in the same network? Is there any software to run it locally for monitoring other machines? Does Ethereal do this work?
There are actually a few tools that may allow you to see what processes are running remotely on another machine. All of these tools require at one point or another to have authorized administrative rights to the machine. Many companies use this technology to administer servers and help troubleshoot desktop issues remotely.
The first tool that comes to mind is SNMP. Mostly because there are so many tools out there that will allow you to report upon processes running on a machine if you have SNMP access to it. There are a lot of freeware, shareware, and commercial products that will utilize the flexibility of SNMP to manage servers in this capacity. The only requirement is that you have access to the device and it is SNMP-enabled. Do a quick search for server management SNMP on Google to find a list of products available.

Below are few open source and freeware tools recommended!
• Nagious
• HP SIM
• Big Brother
• MRTG

Depending on the operating system and platform, there are numerous remote management tools that will allow you to identify what processes are running on a client's workstation. Administration tools and resource kits (look at pstools) for Windows Operating Systems give you the ability through the Windows Management interface to connect via RPC to a client's workstation that you have administrative rights to. Similar functions exist for Unix and Linux platforms as well. They will list the processes in use, CPU, memory, and other diagnostic information for the device selected.
Unfortunately ethereal doesn't really give you this same information. Ethereal will certainly allow you to see the traffic passing through a device from one machine to the other off of a port mirror or capture on a host. But it won't tell you the actual processes that are running if it is not a network-based process. For things like HTTP, DNS, DHCP requests, ethereal will give you insight into those transactions. It is great at telling you what your packet level transactions are like for those various network services. Issuing the netstat command will also reveal information about the processes that have network connections to other hosts on the network. Using this information will allow you to troubleshoot issues regarding network connection problems. There are also several freeware tools out there that I will use for troubleshooting networking issues on a host like qCheck and TCPView.

Configuring Software Update Services (SUS) Client Settings

lijin_l@hotmail.com (Lijin Nair) — Mon, 16 Jul 2007 08:33:00 +0000

You can always configure AU Client settings thru Group Policy Settings, or manually via the Registry Editor; for the purpose of this illustration, we’ll focus on the configuration of update settings via a GPO.

Configuring AU Client settings via Group PolicyThe simplest (and arguably the best) way of configuring Automatic Update Client settings is by use of Group Policy objects in Active Directory Environments. This method allows greater granularity and control over how the Automatic Updates Client behaves, and to apply any changes to it. You will need to configure the AU client using a GPO if you want to get updates from your Local SUS server.

At this point, you’ll want to download the WUAU.adm Template from the Microsoft web site. See the direct link in RESOURCES Section at the end of this article.
Next, you will need to identify the target clients that will use your SUS Server to obtain critical patches. Here are the steps:
1. Open Active Directory Users & Computers.
2. Open the GPO from the target OU.
3. Add a new policy & expand the Computer Configuration container.
4. Expand the Administrative Templates container
5. Right click Administrative Templates in the MMC and import the WUADM template in to the Policy from \windows\inf directory or the \winnt\inf directory, depending on your OS.
6. Expand the Windows Components container
7. Click the windows updates container
8. In this container you will be able to configure
• Configure Automatic Updates
• Intranet Microsoft Update Service Location
• Reschedule Automatic Updates Scheduled installations
• No auto-restart for scheduled Automatic Updates installations.

Use the Resultant Set of Policies (RSOP), like Group Policy Management Console, GPMC, or GPRESULT.EXE to investigate if the policies are being correct applied to your client systems.

NOTE: Group policy is not the only way to deploy the AU Client Settings; you can edit the Registry manually to configure these settings on individual systems. For more information on the necessary Registry configuration changes, see Microsoft Technet articles for Manipulating SUS Settings through the Registry.

Are your Automatic Updates working with SUS?
Once SUS is installed and AU clients are configured, you’ll want to ensure that everything is working correct. To test, follow these simple steps:

TEST SUS: First, make sure it’s synchronizing with Microsoft Update Server daily, looking at its Synchronization and Application Event logs. Isn’t that simple?

Test Automatic Updates: This is more important for Automatic Updates, as SUS will only approve updates, which then have to be “pulled” from the server by the AU client. First, you have got to make sure AU gets appropriate settings via the GPO used to deploy them. To test this, just do a simple reg query from command prompt using the Reg query “HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate” /s command, as shown below:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
WUServer REG_SZ http://Your-SUS-Server-IP/Hostname
WUStatusServer REG_SZ http://Your-SUS-Server-IP/Hostname

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
NoAutoUpdate REG_DWORD 0×0
AUOptions REG_DWORD 0×3
ScheduledInstallDay REG_DWORD 0×0
ScheduledInstallTime REG_DWORD 0×3
UseWUServer REG_DWORD 0×1
RescheduleWaitTime REG_DWORD 0×1e

This is where normal troubleshooting should always start. If you happen to find any errors, reference the Error Codes mentioned in SUS Deployment Guide.

Windows crashs? Lets check, How to debug the dump?- Part2

lijin_l@hotmail.com (Lijin Nair) — Mon, 28 May 2007 17:04:00 +0000

Getting the debugger:
The debugger is free and available from Microsoft's Web site. At the site, scroll down until you see the heading, "Installing Debugging Tools for Windows." Select the link, "Install 32-bit version…” and then select the most recent non-beta version and install it. The most recent versions are about 12M-byte downloads. You can do the installation on a PC without restarting it (Don’t be surprised if the site has changed somewhat. Microsoft keeps improving the debugger with releases at least once per year.

This distribution includes KD.EXE, the command-line kernel debugger; NTSD.EXE, the command-line user-mode debugger; CDB.EXE, the command-line user-mode debugger (a variant of ntsd.exe); and WinDbg, the GUI version of the debugger. WinDbg supports kernel-mode and user-mode debugging, so WinDbg is the one we'll use here.

Setting up the debugger:
There are two ways to look at crash data: View what's in memory while the system is stopped (by linking it to a running PC with a null-modem cable, or invoking a product that you pre-installed on the system, such as SoftICE, which lets you step through the code in memory line by line)
Null-modem cables are serial cables that have been configured to send data between two serial ports. They are available at most computer stores. Do not confuse null-modem cables with standard serial cables, which do not connect serial ports.
Given that minimizing interruptions is the goal of most administrators, we opt for the second way: Restart the server or PC, launch the debugger, and open the dump file.

From the program group Debugging Tools for Windows, select WinDbg. After the debugger comes up, you'll immediately notice a lot of … nothing. A blank screen. That's because you have to specify a dump file to analyze and download symbol tables to use in the analysis. Let's take care of the symbol files first.
Symbol tables are a byproduct of compilation. When a program is compiled, the source code is translated from a high-level language into machine code. At the same time, the compiler creates a symbol file with a list of identifiers, their locations in the program, and their attributes. Some identifiers are global and local variables, and function calls. A program doesn't require this information to execute. Therefore, it can be taken out and stored in another file, reducing the size of the final executable.

Smaller executables take up less disk space and load into memory faster than large ones. But there's a flip side: When a program causes a problem, the OS knows only the hex address at which a problem occurred. You need something more than that to determine which program was using that memory space and what it was trying to do. Windows symbol tables hold the answer. Accessing these tables is like laying a map over your system's memory.

Windows symbol files are free from Microsoft's Web site, and the debugger can retrieve them automatically. To set up the debugger to do this, verify that you have a live Internet connection and set the symbol file path in WinDbg by selecting File | Symbol File Path. Then enter the following string:
SRV*c:\local cache*http://msdl.microsoft.com/download/symbolsSubstituting your own directory path for c:\local cache. For example, if you want the symbols to be placed in c:\symbols, then set your symbol path to
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
The location of the symbol table is up to you.

When opening a memory dump, WinDbg will look at the EXE/DLLs and extract version information. It then creates a request to the symbol server at Microsoft, which includes this version information, and locates the precise symbol tables to draw information from. If you have difficulty retrieving symbol files, check that your firewall permits access to http://msdl.microsoft.com.
If you restrict your debugging to memory dumps from the machine you are on, you will need relatively little hard-disk space for the symbol tables. In most cases 5M-bytes will be more than sufficient. But if you plan to look at dumps from other machines that have different Windows versions and patch levels, you'll need more space for the additional symbol files that support those versions.

System update workaround:
If you are trying to analyze mini dumps on a machine that had updates installed after the dumps were created (or if you're analyzing a mini dump file from another machine), the drivers found in your system root will be different (newer) than the ones present when the mini dump were created. To solve this, set the executable image file path by selecting File | Image File Path. Then enter the following string: c:\windows\System32; c:\windows\system\System32; http://www.alexander.com/SymServe.

Loading the dump file:
To open the dump file that you want to analyze, select File | Open Crash Dump. You'll be asked if you want to save workspace information. Click Yes if you want it to remember where the dump file is. WinDbg looks for the Windows symbol files. WinDbg references the symbol file path, accesses microsoft.com, and displays the results. Close the Disassembly window so you are working in the Command window.
NOTE: Don’t be surprised if the debugger seems rather busy following opening of the dump file, especially the first time you try it. It needs to retrieve symbols and, in the case of mini dumps, it needs to retrieve the binaries. This may take a few minutes. Also, the newer release of WinDbg seems to take longer retrieving driver data as well. Be patient. It is worth the wait!
At this point, WinDbg may return an error message, such as the following one, indicating it could not find the correct symbol file.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
If it does, one of the following three things is usually wrong:
• Your path is incorrect; check to make sure there are no typos or other errors in the symbol file path you entered earlier.
• Your connection failed; check your Internet connection to make sure it is working properly.
• Your firewall blocked access to the symbol files or damaged the symbol file during retrieval.

If your path and connection are solid, then it's likely that the problem is your firewall. If a firewall initially blocks WinDbg from downloading a symbol table, it can result in a corrupted symbol file. Unblocking the firewall and attempting to download the symbol file again does not work; the symbol file remains damaged. The quickest fix is to close WinDbg, delete the symbols folder (which you most likely set at c:\symbols), and unblock the firewall. Now, reopen WinDbg and a dump file. The debugger will recreate the folder and re-download the symbols.

If you see this message, "***** Kernel symbols are WRONG. Please fix symbols to do analysis.", WinDbg was unable to retrieve the proper symbols and it will resort to using the default symbol table. But as the warning suggests, it cannot produce accurate results. Remember that symbol tables are generated when programs are compiled, so there is a symbol table file for every Windows version, patch, hot fix, and so on. Using the wrong symbols to track down the cause of a crash is like trying to steer a ship into Boston Harbor with a chart for San Diego. You must use the right ones, so go back up to the section above and ensure you have the right path set, the connection is good, and it is not blocked.

Look through WinDbg's output. You may see an error message similar to the following that indicates it could not locate the symbols for a third-party driver.
*** ERROR: Module load completed but symbols could not be loaded for driver.dll
Unable to translate address bf9a2700 with prototype PTE
Probably caused by: driver.dll (driver+44bd)
This means that the debugger has found a driver is at fault but, being a third-party driver, there are no symbols for it (Microsoft does not store all of the third-party drivers). You can ignore this. Vendors do not typically ship drivers with symbol files, and they aren't necessary to your work; you can pinpoint the problem driver without them.

Analysis with lmv:
The next step is to confirm the suspect's existence and find any details about him. Typing lm in the command line displays the loaded modules; v instructs the debugger to output in verbose (detail) mode, showing all known details for the modules. This is a lot of information. Locating the driver of interest can take a while, so simplify the process by selecting edit | Find.
Here's an example of output generated by the lmv command:
kd> lmv
bf9b8000 bfa0dc00 VDriver (no symbolic information)
Loaded symbol image file: VDriver.dll
Image path: \SystemRoot\System32\VDriver.dll
Checksum: 00058BD5 Timestamp: Fri Sep 28 10:12:47 2001 (3BB4855F)
File version: 5.20.10.1066
Product version: 5.20.10.1066
File flags: 8 (Mask 3F) Private
File OS: 40004 NT Win32
File type: 3.4 Driver
File date: 00000000.00000000
CompanyName: Video Technologies Inc.
ProductName: VDisplay Driver for Windows XP
InternalName: VDriver.dll
OriginalFilename: VDriver.dll
ProductVersion: 5.20.10.1066
FileVersion: 5.20.10.1066
FileDescription: Video Display Driver
LegalCopyright: Copyright© Video Technologies Inc. 2000-2004
Support: (800) 555-1212
Use File | Find to locate the suspect driver. If the vendor was thorough, complete driver/vendor detail is revealed
The amount of information you see depends upon the driver vendor. Some vendors put little information in their files; others, such as Veritas, put in everything from the company name to a support telephone number! If a vendor is thorough, the results from the command will be similar to those shown here.
After you find the vendor's name, go to its Web site and check for updates, knowledge base articles, and other supporting information. If such items don't exist or resolve the problem, contact them. They may ask you to send along the debugging information (it is easy to copy the output from the debugger into an e-mail message or Word document), or they may ask you to send them the memory dump (zip it up first, both to compress it and protect data integrity).

Not aways easy:
Finding out what went wrong is often a simple process, but it isn't always so. At least 50% of the time (often 70%), the debugger makes the reason for a crash obvious. But sometimes the information it provides is misleading or insufficient. What do you do then?

Inconsistent answers:
If you have recurring crashes but no clear or consistent reason, it may be a memory problem. Download the free test tool, Memtest86. This simple diagnostic tool is quick and works great.
Many people discount the possibility of a memory problem, because they account for such a small percentage of system crashes. However, they are often the cause that keeps you guessing the longest.

The operating system is the culprit Not likely! As surprising as it may seem, the operating system is rarely at fault. If ntoskrnl.exe (Windows core) or win32.sys (the driver that is most responsible for the "GUI" layer on Windows) is named as the culprit, and they often are, don't be too quick to accept it. It is far more likely that some errant third-party device driver called upon a Windows component to perform an operation and passed a bad instruction, such as telling it to write to non-existent memory. So, while the operating system certainly can err, exhaust all other possibilities before you call Microsoft! The same goes for debugging Unix, Linux, and NetWare.

Wrong driver named:
Often you will see an antivirus driver named as the cause. For instance, after using !analyze –v, the debugger reports a driver for your antivirus program at the line "IMAGE_NAME". This may well be the case, but bear in mind that such a driver can be named more often than it is guilty. Here's why: For antivirus code to work it must watch all file openings and closings. To accomplish this, the code sits at a low layer in the operating system and is constantly working. In fact, it is so busy it will often be on the stack of function calls that was active when the crash occurred, even if it did not cause it. Because any third-party driver on that stack immediately becomes suspect, it will often get named. From a mathematical standpoint it is easy to see how it will so often be on the stack whether it actually caused a problem or not.

Little or no vendor information:
Not all vendors include needed information (not even their name!). If you use the lmv command and turn up nothing, look at the subdirectories on the image path (if there is one). Often one of them will be the vendor name or a contraction of it. Another option is to search Google. Type in the driver name and/or folder name. You'll probably find the vendor as well as others who have posted information regarding the driver.

Summary:
When systems crash your first objective is to get them up and running. Your second is to fix the problem to prevent future crashes. Be willing to use any tool that can help you — even the Windows debugger. It won't give you the cause of every crash event, but it can help you solve 50% or more with two simple commands.

Reference Article: http://support.microsoft.com/kb/315263

Windows crashs? What is the Reason Behind?- Part1

lijin_l@hotmail.com (Lijin Nair) — Sat, 26 May 2007 21:22:00 +0000

Till date, Windows has been used most commonly on the x86 processor. The x86 implements a protection mechanism that lets multiple programs run simultaneously without stepping on each other's toes. This protection comes in four levels of privilege or access to system memory and hardware. Two of these levels are commonly referred to as kernel mode and user mode.

Kernel mode is the most privileged state of the x86. Both the Windows OS and drivers are considered trusted, and, therefore, run in kernel mode. This ensures unfettered access to system resources and the ability to maximize performance. Other software is assigned to user mode, the least-privileged state of the x86, restricting direct access to much of the system. Applications, such as Microsoft Word, run in user mode to guard against applications corrupting system-level software and each other.
• Although kernel-mode software is protected from applications running in user mode, it is not protected from other kernel-mode software. For example, if a driver erroneously accesses a portion of memory that is being used by other software (or not specifically marked as accessible to drivers), Windows stops the entire system. This is called a bug check or a crash, and Windows displays the popularly known Blue Screen of Death (BSOD). About 95% of Windows system crashes are caused by buggy software (or buggy device drivers), almost all of which come from third-party vendors. The remaining 5% is due to malfunctioning hardware devices, which often prompt crashes by corrupting memory contents.

• Microsoft’s analysis of crash root causes indicates:
-70% caused by third-party driver code
-15% caused by unknown (memory is too corrupted to tell)
-10% caused by hardware issues
-5% caused by Microsoft code

• There are lots of third-party drivers! From online crash analysis database:
55,000 unique drivers – 24 new/day (28,000 in 2004)
220,000 total drivers – 98 revised/day (130,000 in 2004)
Many Devices
Over 1,263,300 distinct Plug and Play (PnP) IDs (680,000 in 2004)
1,600 PnP IDs added every day

Another little-known fact is that most crashes are repeat crashes. Few administrators can resolve system crashes immediately. As a result, they typically happen again and again. It's common to see weeks and months pass before the answer is found. By solving a crash immediately after the first occurrence, you can prevent time-consuming and costly repeat crashes.
We'll focus on solving crashes under Windows 2000, XP and Server 2003. The process is identical for Windows servers and desktops. With respect to the debugging and interpretation process, this information applies with remarkably little differences to other operating systems, such as Linux, Unix and NetWare.
Getting started
To resolve system crashes using WinDbg, you need the following:
• A PC with 25M bytes of hard-disk space, a live Internet connection and Microsoft Internet Explorer 5.0 or later.
• A PC running Windows Server 2003, Windows 2000 or Windows XP.
• The latest version of WinDbg .
• A memory dump (the page file must be on C: for Windows to save the memory dump file).

The memory dump is a snapshot of what the system had in memory when it crashed. Few things are more cryptic than a dump file at first glance. Yet it is the best place to go for information on a crash. You can try to get this data in other ways - a user or administrator may remember what the system was doing when it crashed, or that they installed a new hardware device recently, in which case you can check related drivers or hardware - but they could also forget, providing incomplete or inaccurate information.

Windows Server 2003, 2000 and XP create three types of memory dump files:

-Small or mini dump :
-Kernel dump :
-Complete or full dump:

Small or mini dump : A mini dump is a tiny 64K-byte file. One reason it's so small is that it doesn't contain any of the binary or executable files that are in memory at the time of a system crash. The .exes are needed for full and proper crash analysis, therefore, mini dumps are of limited value without them. However, if you are debugging on the machine that created the dump file, the debugger can find them in the System Root folders, unless they were changed by a system update (we'll provide a workaround for this later). XP and Server 2003 produce mini dumps by default, one for each crash event, as well as a full dump file. While it saves all mini dumps, the system only saves the most recent full dump. Windows 2000 can save mini dumps, but by default it is set to save only a full dump.

Kernel dump : This is equal to the amount of RAM occupied by the operating system's kernel. For an XP PC with 512M bytes of RAM, this is usually around 60M bytes, but it can vary. For most purposes, this crash dump is the most useful. It is significantly smaller than the full memory dump, but it only omits those portions of memory that are unlikely to have been involved in the crash.

Complete or full dump : This is equal to the amount of RAM in the box. Therefore, a machine with 512M bytes of RAM creates a 512M-byte dump file (plus a little). While a full dump contains all possible data and executables the memory has to offer, its sheer size can make it awkward to save or transfer to another machine for debugging. Windows 2000 produces a full dump by default.

Because XP and 2003 are set up to save a mini dump for every crash event, there should be a mini dump file for every crash the machine has had since it was turned on. This data can be extremely valuable, giving you a rich history to inspect.

Saving a memory dump
To resolve system crashes through the inspection of memory dumps, set your servers and PCs to automatically save them with these steps:

Right-click on My Computer
Select Properties
Select Advanced
In the Start up and Recovery section, select Settings; this displays the Startup and Recovery dialog box
In the Write debugging information section, select kernel memory dump
While still in the Start up and Recovery dialog box, ensure that the following options are checked in the System failure section:

Write an event to the system log
Send an administrative alert
Automatically restart
In the Write debugging information, you have the option to save only the most recent dump file or to have the system rename the existing dump file before it creates a new one. We prefer saving the dump files because previous dump files may provide additional or different information - however, space can be an issue, so set this option according to your needs.

The Write debugging information section also tells you where the dump file will be created. On XP and 2003 systems, mini dumps are located at %SystemRoot%\Minidump, or c:\Windows\Minidump; kernel and full dumps are located at %SystemRoot%\MEMORY.DMP or c:\Windows\MEMORY.DMP. For Windows 2000, memory dump files are located at c:\winnt\memory.dmp.

If you don't have a dump file on your machine, you can get one from another system or download one here. This kernel dump is about 20M bytes zipped and 60M bytes extracted. It was created using a testing tool that generates a system crash.

(More on debugging side, Check out Part-2)

Hung or Blocked Worker Threads in BES – Event 50020 (PART-1)

lijin_l@hotmail.com (Lijin Nair) — Thu, 22 Mar 2007 08:08:00 +0000

Hung or Blocked Worker Threads in BES – Event 50020 (PART-1)

What causes Blocked Worker Thread error messages is the one of the most asked question among the Blackberry Issues. Below are some few notes collected from the past Experience to clear of some of these questions? In order to communicate with Microsoft Exchange, the Blackberry Enterprise Server utilizes Microsoft's Messaging. Application Programming Interface (MAPI). Under certain conditions, it is possible that MAPI can achieve a deadlock state where all of the MAPI worker threads become hung and cannot recover. In the regular operations of the Blackberry Enterprise Server, a disconnect (i.e. Exchange Server taken offline) between the Microsoft Exchange Server and the Blackberry Enterprise Server can result in Microsoft's MAPI threads to enter a deadlock state. Once the MAPI threads enter a hung state condition, there is a possibility that the threads will not be released and all MAPI threads used by the Blackberry Enterprise Server will eventually reach deadlock. It is this deadlock state that results in the stoppage of the redirection of messages to and from the Blackberry handheld

There are multiple reasons for blocked MAPI worker threads.
• The Blackberry Enterprise Server attempted to contact a Blackberry device user's mailbox but could not initiate a connection with the Microsoft Exchange Information Store.
• The Blackberry Enterprise Server attempted to contact the Microsoft Exchange server and is still waiting for a response.
• The User Exchange mailbox having more Items or Corrupted entries will cause the mail delay on BB Handheld.
• The Microsoft Exchange server might be offline or another unreachable state.
• The Blackberry Enterprise Server attempted to contact the Microsoft Exchange server but did not receive a timely response. This could be due to issues such as packet loss on the network or complex calls to the Microsoft Exchange server (e.g. a bulk load on a Blackberry device user with more than 5000 calendar entries).
• The Microsoft Exchange server may be loaded too heavily and cannot handle the load.
After the cause has been determined, it will probably be necessary to restart the Blackberry Enterprise Server. After a pool of threads has crashed restarting the Blackberry Enterprise Server services will not release them, as they are part of the Messaging Application Programming Interface (MAPI) subsystem.
If only individual threads are hung, restarting the Blackberry Enterprise Server services will release those threads and reinitialize them without restarting the Blackberry Enterprise Server. However, since it is difficult to determine whether individual threads have crashed, or an entire pool of threads, it is better to restart the Blackberry Enterprise Server rather than restarting only the services.

Below are few referrence articles for the same:

http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB12870&sliceId=SAL_Public&dialogID=49124061&stateId=0%200%2024248295

http://www.blackberry.com/btsc/articles/907/KB04789_f.SAL_Public.html

How to resolve this? What are the Troubleshooting Steps involved? Will see in PART-2

What makes Blackberry Enterprise Server works? (Initially complex, But its sweet)

lijin_l@hotmail.com (Lijin Nair) — Mon, 05 Feb 2007 21:50:00 +0000

Pros: Tight integration with Windows AD; excellent technical support; robust security policies.
Cons: Pretty lengthy pre-installation procedure.

The Bottom Line: All-n-all I am very pleased with BES 4.1. Since I installed the server there has been no need to call RIM; the server works as advertised.

Full Review: RIM BlackBerry Enterprise Server For MS Exchange Server.
Research in Motion (RIM) and its much touted BlackBerry handheld line of smart-phones. Of course much the news of late has been about the Canadian based company’s legal problems, which thankfully have been cleared up since the U.S. government relies heavily on the BlackBerry device.

That aside the company I work for made a business decision to equip several higher level executive and others with BlackBerry 7130e and 7250 devices. And since I am the Microsoft Exchange Administrator I was given the task of installing, configuring, and administering the new BlackBerry Enterprise Server (BES). Our cellular phone service is through Verizon Wireless so we were able to the newest release of RIM’s product BlackBerry Enterprise Server 4.1 for Microsoft Exchange 2000/2003.

When I was handed the BES 4.1 project I knew next to nothing about the product, so I had to do a considerable amount of research in order to pull together the hardware and software requirements for our environment. RIM was very instrumental in this regard; their technical support department is top notch.

How It Works
At a very basic level BES 4.1 for Microsoft Exchange connects the BlackBerry device(s) to a company’s backend messaging system, allowing real-time access to the Outlook inbox, contacts, and calendaring events.
Via the BlackBerry management Active Directory (AD)-centric User ID BES 4.1 communicates with Exchange via direct connection because the server that hosts the application is integrated into the AD environment. BES 4.1 also communicates with the BlackBerry network via the Internet through a port in the internal networks’ Firewall. The BlackBerry devices then receive information from the BlackBerry network via a common wireless carrier like Verizon Wireless, Cingular, Sprint, etc. Using this system a BlackBerry user can receive and send email, gain real-time access to contacts, schedules, and the Internet.

Installation Notes:
We purchased a brand new HP DL380 G5 on which I installed BES 4.1. It is the only application on the server, save the various Microsoft-centric support applications. Installation of BES 4.1 is time consuming and somewhat complex; there are a lot of prerequisites RIM recommends you perform BEFORE you begin the installation process. Most of these prerequisites deal with the server and BlackBerry manager ID you will use to manage AD user ID’s / Mailboxes and the BlackBerry Server itself.

To make the process easier to follow I have broken the install into three sections:
Section (1) deals with the physical server requirements;
Section (2) deals with the BlackBerry Manager ID security requirements in AD, and;
Section (3) deals with BlackBerry Enterprise Server requirements.

Server Requirements:
- The server should be running Windows 2000 SP3, or Windows 2003; Note: SP1 for Windows 2003 need not be installed.
- Update the server with the latest Microsoft Security patches and updates.
- After the installation of the Network Operating System (NOS), install IIS 6.0 and make sure you include .ASP.NET (Active Server Pages), SMTP, NNTP.
- Make sure Microsoft .NET Framework 1.1 is installed.
- Install Microsoft Windows 2003 Server Administrator Pack
- Install Microsoft Exchange Server 2003 System Manager (ESM). Note: ESM has to be installed to at least the Service Pack level as the main Exchange installation.

BlackBerry Manager (BBManager) Account Security Requirements:
- Create the BBManager account as a standard AD user with a mailbox-enabled Exchange account (this account will need no special AD-related security requirements). Note: According to RIM BES 4.1 has a number of pre-defined administrative roles, ranging from full control to basic user management. Because all (BES) system configurations are stored in an SQL database, these roles can be tied to SQL logins for administrators, but Windows networks network users should associate these roles with established Windows users or groups to minimize the number of accounts to track. But that requires manually setting the permissions to give those Windows accounts access to the SQL database, the process for which will vary based on the database you use. It is a lot easier to create a BBManager account to manage both the SQL database and AD access for BES 4.1.

- Add the BBManager account the First Administrative Group of MS Exchange using the delegate control command. Grant the account View Only Administrator rights.

- Assign the BBManager account the following rights on the each exchange server: Receive As, Send As, Administer Information Store, and List Contents. Note: if you have a Front-end /Back-end Exchange topology these right need only be assigned on the Back-end servers.

- Place the BBManager account in the Local Administrators Group of the BlackBerry server.
- Assign the BBManager account “Password Never Expires” rights in AD. This account is used in the administration of the BlackBerry Manager software, so it is advisable to set “Password Never Expires” to the administrative account.

BlackBerry Enterprise Server 4.1 requirements:
- BlackBerry Enterprise Server 4.1 needs database storage and can use either SQL Server 2000/2005, or MSDE 2000. BES 4.1 will install MSDE if SQL 2000 is not available, or not feasible.
ü Open port 3101 on the PIX Firewall; the BlackBerry server only communicates through this port. Set up the port as Outbound initiated, Bi-directional. Use srp.us.blackberry.net, or spr.na.blackberry.net as a destination address.

Once BES 4.1 was installed I was ready to activate the first BlackBerry device. I called RIM technical support to ensure the server was seen by the BlackBerry network servers. This is an important piece; if your BlackBerry server cannot be seen by RIM all bets are off. If two way communications is established, you are ready to activate devices.
Once activated the devices are controlled by BES 4.1. From BES 4.1you can establish IT security policies, and customize individual devices or a group of devices together. BES 4.1 also allows you to monitor the status of attached administered devices as well as completely wiping the device for security purposes.
I did not install Mobile Data System (MDS), so I will not discuss the application add-on here. But I will state the MDS Studio is used to create BlackBerry applications, which can then be pushed to administered devices.
At first brush I will admit that I was reluctant to install BES 4.1 without someone with significant experience with the product; in other words a consultant. But Verizon was unable to provide such a person on-site, so I was on my own, but not really; RIM technical support was invaluable resource in setting up the server, both before and after I brought the server on-line. We received 120 days of free support with our BES 4.1, but RIM offer a panoply of support options to choose from, most of which offer free software upgrades.
All-n-all I am very pleased with BES 4.1. Since I installed the server there has been no need to call RIM; the server works as advertised. If you are installing BES 4.1for MS Exchange follow the pre-installation procedure I outlined and in a day or so you will up and running with you new BES 4.1environment.

Features Set:
- Distributed, "cradle-less" provisioning
- Improved Wireless Security
- Simplified Management and Tracking
- Improved Corporate Data Access and Simplified Application Development
- Completely Wireless User Experience
- Many Application Enhancements
- (Software, licensing and documentation will be electronically fulfilled)

Recommended hardware requirements:
• Pentium® IV 2GHz+,
• 1.5 GB RAM
• 30GB HD
• Windows 2000 Server (Server or Advanced Server Editions) or;
• Windows Server 2003 OS.

Recommended:
Yes