The Lazy Admin

Virtual PC in Windows 7

daniel.nerenberg — Fri, 22 May 2009 12:33:00 GMT

A few weeks ago Rodney wrote a great post about the new XP mode in Windows XP. This is based on a new version of Virtual PC. I wanted to take a moment to talk about the new version which was released in beta along with the Windows 7 RC.

First this version of Virtual PC will only work with Windows 7, so earlier versions of Windows will have to stick with Virtual PC 2007.

Second, you can run Windows Vista and windows 7 in a virtual PC, what is really cool is that you can get full Aero glass compatibility in a virtual PC environment after you install the integration features. (notice that in Virtual PC it’s integration features not integration components as it is in Hyper-V) Notice the transparency effect in the screenshot below.

Another change is the integration of the virtual machine interface into Windows Explorer

Some additional things to keep in mind, in order to run Virtual PC for Windows 7 your CPU, chipset and BIOS need to support hardware virtualization.

Here is the link to download virtual PC

Windows 7 App Locker

daniel.nerenberg — Thu, 21 May 2009 12:31:00 GMT

Window 7 RC has been out for a few weeks now the TLA team has been busy learning and testing all the great new features. Your tip for today is on Windows 7 App Locker. Many of you know about Software Restriction Policies. They allow you to block the execution of a program by file name or hash calculation. Many of you probably also know how it was a race to block applications in our network with these methods. Users could change the name of the file, or applications updates so frequently that you would constantly need to generate new hash files.

Windows 7 introduces a great new feature called App Locker. App locker works under the premise that it’s easier to allow the applications you want and block the rest. If you’re running a Windows 7 machine you can see App Locker by typing gpedit.msc into your search bar and pressing enter.

You can define policies based on Executables, Windows Installers, and scripts. Creating a new policy is really simple. right click on any of the 3 categories and click new.

You can create a policy to allow or deny an executable. You can also select witch groups the rule will apply to.

You can choose to create a rule based on a publisher (the program needs to be signed) or a program path, or a file hash (usually a good choice if the program isn’t signed)

For this example I chose publisher. the Rule wizard uses the information stores application signing certificate to learn about the application. You can adjust what level of information you’ll allow for an application.

In the above example I set the level to allow any version of Internet Explorer. (regardless of the file name used or the version)

You can use the same steps to create exceptions for specific applications. One of the best features is the ability to automatically generate rules.

This scans your applications in the program files directory and creates permissions for those programs to run. Perfect for quickly creating a baseline set of rules for a gold image.

Using XP Mode in Windows 7

rodney.buike — Fri, 01 May 2009 00:36:29 GMT

One of the major challenges with moving to a new OS is dealing with older applications. This was an issue with the release of Windows Vista and in order to mitigate that with Windows 7, Microsoft has released a feature called XP Mode, which runs a Windows XP SP3 virtual machine in the background that can be used to run legacy applications. What is really interesting is that as a user, you only see a shortcut on the desktop or start menu and interact with the application as you would any other application. Launch an application and the VM wakes up (by default it hibernates when not in use) and presents the application, close the app and the VM hibernates!

There are two components that need to be installed, Windows Virtual PC which is the successor to Virtual PC 2007, and the XP Mode VM. Once they are installed there is a simple set up process to turn on Automatic Updates, set a username and password for the XP VM and you are on your way. The VM can be joined to AD and act as any other domain member.

There are the typical Virtual PC settings such as memory, disk, networking etc… but the addition of Auto Publish allows applications that reside in the XP VM to appear in the Windows 7 start menu.

So to the end user they access the applications just like any other.

Any application that is installed in the XP VM can be published simply by dropping the shortcut to launch it in All Users –> Start Menu As an example I placed the IE6 shortcut in All Users\Start Menu and launched it on Windows 7 next to IE8.

You can also mount any USB device in the XP VM as Windows Virtual PC now supports USB devices!

If you are looking to use this to solve an enterprise wide app compat issue you can use this same technology with the addition of a management suite with MED-V, or Microsoft Enterprise Desktop Virtualization, which is currently in beta (as is XP Mode and Windows 7 at the time of this writing) or the Application Compatibility Toolkit which we wrote about previously.

For more information see:

Microsoft Enterprise Desktop Virtualization

Download MED-V Beta 1

Microsoft Springboard Portal

Windows 7 Password Vault

daniel.nerenberg — Tue, 10 Mar 2009 00:31:00 GMT

Oh boy is this a feature designed for lazy admins. When I’m not writing and keeping the site up to date I’m usually onsite working for clients. Often I’m required to have multiple emails accounts active when working with various partners.

Now this isn’t usually a problem except as many know you can’t have multiple exchange accounts open in outlook at the same time. This means that you need to create separate profiles for each Exchange account. This also means that you need to type in a password every time you change profiles. Being that retyping passwords can be a drag on productivity, (fat finger errors and typos) wouldn’t it be great if you could have Windows remember your different accounts associated with your already logged on user account?

In the control panel choose Users Accounts and Family Safety

Then click on Credentials Manager

You can now see credentials that you have already entered in for various sites. If you check “Save Username and Password” in the checkbox the information will be stored here.

Once a credential has been added and stored here it will automatically be supplied when you next access the resource in question. In my case each time I open Outlook and choose a different profile I will skip having to re-enter the password for the specific Exchange account.

IMPORTANT NOTE: Your default Windows account should be secured with a strong password, and ideally it should also be secured with multifactor authentication.

Sync DSRM and Domain Admin Passwords

rodney.buike — Fri, 27 Feb 2009 14:00:00 GMT

Setting a password for Directory Services Restore Mode is something that is done during the setup of Active Directory. As a best practice it has always been recommended to change that password on a regular basis, as you would with any other password. The challenge was the process to do this was complicated and required you to use NTDS in Windows 2003.

This has been addressed in Windows Server 2008 where we can now sync the DSRM password with a Domain Administrator account. There is a hotfix that needs to be installed which you can download here. (Note: You do need to request the hotfix and it should be included in SP2) After it is installed and the server is rebooted, you can run the following command to sync the passwords.

ntdsutil "set dsrm password" "sync from domain account <DomainAdminAccountName>" q q

Recovering Deleted AD Objects in Server 2008 R2

rodney.buike — Tue, 24 Feb 2009 14:00:00 GMT

In a previous entry, guest blogger Sean Kearney shared a new feature in Windows Server 2008 R2 directory services called the Active Directory Recycle Bin. Sean is back to show us how to recover those deleted objects.

-------------------------

So you’ve done it. We all have. Deleted a user, group, OU by accident but thankfully you have 2008 R2 in place and the AD Recycle Bin enabled. To recover now is a breeze! Start by launching Powershell V2 on Server 2008 R2 and run the following command

GET-ADOBJECT –filter {name –like “missingitem*”} –includedeletedobjects | RESTORE-ADOBJECT

That’s it. Nothing harder than that. Was that so hard? The great thing, is as long as it’s an object in Active Directory, it’s protected by this new feature for 180 days. Also, this just does restore the object. It’s restores the object, its security, its trusts!

If you’d like to learn more about the Active Directory Recycle Bin, Check out these great resources on Technet.com

Active Directory Recycle Bin - Instructional Video on Technet Edge

What’s New in 2008 R2 – Active Directory Recycle Bin

rodney.buike — Mon, 23 Feb 2009 15:33:41 GMT

I’ve done it, I know people who have done it, and I bet you have done it before as well. Right-click an object in Active Directory Users and Computers and instead of clicking the properties link you accidentally hit delete. Boom, gone and the only way to get it back is via a restore from backup. Restart the DC, boots into Directory Services Restore Mode (DSRM), restore the system state backup and apply either a authoritative or non-authoritative restore.

Guest author, Sean Kearney, covers this new feature in Windows Server 2008 R2.

-------------------------

One of the fantastic features provided in Server 2008 R2 is the new Recycle Bin for Active Directory.

I recognize that nobody here is going to intentionally mess up their own Active Directory. But problems can happen. A Junior technician misheard the phrase “Disable” with “Delete”, a malicious Administrator leaving the company, dumb luck. Any number of problems can occur and this feature will save the day.

There are a few caveats to using this

You must have the Domain functional level in Server 2008 R2 mode.
You must enable the feature by using LDP.EXE or Powershell.
It is managed and used 100% by Powershell. There is no GUI version presently.
Once enabled, you cannot disable it. This is a one way trip folks
The enabled Recycle Bin has a 180 day retention policy.

That’s it. In Server 2008 R2, select the new Active Directory Powershell under Administrative Tools and type in the following command

GET-ADOPTIONALFEATURE –filter {name –like “*”}

You will be presented with a screen showing you

FeatureScope       : {Forest}
Name               : Recycle Bin Feature
RequiredForestMode : Windows2008R2Forest
IsDisableable      : False
ObjectGUID         : 0599c1a6-6f8f-42d4-b9a0-ab2791d4719e
ObjectClass        : msDS-OptionalFeature
FeatureGUID        : 766ddcd8-acd0-445e-f3b9-a7f9b6744f2a
EnabledScopes      :
RequiredDomainMode :
DistinguishedName : CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=energized,DC=energizedtech,DC=com

Looking at the information above, there are no enabled scopes which confirms that the AD Recycle Bin is presently disabled. So to make all this useful, I guess we should turn it on. So in the same Powershell Window key in this command

ENABLE-ADOPTIONALFEATURE ‘Recycle Bin Feature’ –score forest –target ‘domainfqdn’

You will get a prompt warning you that it will make the change. Choose “Yes” if you wish to enable this feature or CTRL-C to abort. Once you’re done, it’s active. To confirm, run the following command again

GET-ADOPTIONALFEATURE –filter {name –like “*”}

And you’ll get a similar response but note

FeatureScope       : {Forest}
Name               : Recycle Bin Feature
RequiredForestMode : Windows2008R2Forest
IsDisableable      : False
ObjectGUID         : 0599c1a6-6f8f-42d4-b9a0-ab2791d4719e
ObjectClass        : msDS-OptionalFeature
FeatureGUID        : 766ddcd8-acd0-445e-f3b9-a7f9b6744f2a
EnabledScopes      : {CN=Partitions,CN=Configuration,DC=energized,DC=energizedtech,DC=com}
RequiredDomainMode :
DistinguishedName : CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=energized,DC=energizedtech,DC=com

You’ll see the “Enabled Scopes” is now covering the domain.

For more information see:

Active Directory Recycle Bin Step-by-Step Guide

Virtual Server to Hyper-V Migration

rodney.buike — Tue, 17 Feb 2009 15:25:31 GMT

A lot of people are making the switch from Virtual Server to Hyper-V lately. I’ve done it on my home network and Thelazyadmin.com servers are in progress of moving to Hyper-V as well. While you can simply copy over the VHD and create a new VM in Hyper-V and mounting that VHD there is a tool that can help you with this task. VMC2HV is a free tool that can be used to import a Virtual Server (or VirtualPC) based VM into Hyper-V. It is a pretty simple tool to use, specify the name and credentials for your Hyper-V server, choose the VMC file of the machine you want to import and click Create Virtual Machine.

A few things to note when using this tool…

Once the migration is complete you will have to uninstall the VMAdditions and install the Integration Components.
Installing the Integration Components will update the HAL so going back to Virtual Server/PC will be difficult
Hyper-V will not boot from virtual SCSI so you will have to move the VMs boot drive to the virtual IDE bus
You can run this tool on X86 and x64 installs of Windows Vista and Server 2008, locally or remotely from the Hyper-V server.

You can download VMC2HV here!

Powercfg and Power Efficiency Diagnostics Reports

daniel.nerenberg — Mon, 16 Feb 2009 14:00:00 GMT

One of the new command tools introduced in Windows Vista was powercfg. Essentially it’s a command line tool that enables users to control power settings. There are a lot of very granular setting that can be configured. To get an idea of what you can do with it just run the following command from the command line:

powercfg –Help | more

You’ll need to pipe that help output to a “more” because the standard command prompt settings won’t buffer the entire help output!

A really cool new feature for Windows 7 is the Power Efficiency Diagnostic Reports. This will allow power users and administrators understand and optimize their systems for maximum power efficiency and by virtue maximum battery life for laptops. In large environments the cumulative effect of optimizing power usage over thousands of computers can result in tangible power and money savings!

To generate the power Power Efficiency Diagnostics Report open an administrative command prompt and run:

powercfg -energy

The system will observe the behaviour of your devices and settings for 60 seconds. Once complete the following output will be generated:

The output file is dropped into the current working directory. Open the report in IE to get a detailed list of the information. Also keep in mind that the PowerProfile you’re using will have an impact on the report.

Notice that the errors in the above screenshot are all related to the fact that I have set High Performance enable while on battery. Some may not agree that it is an “error” but the thing to keep in mind is that this is in the context of creating maximum power efficiency. When I change my power profile to one that uses speed step and lowers the performance on my laptop this error will resolve and go if I run the report again.

Some other errors that can be generated relate to drivers or peripherals that won’t enter a low power mode. If you ever dealt with a laptop that won’t sleep a bad driver that doesn’t support advanced power management can often be the problem. This report can help isolate these issues.

Near the bottom of the report is information about CPU utilization, processes, and this little gem (screen shot above) This report can help troubleshoot battery usage and charge capacity. This gives admin’s a great way to decide when a battery should be replaced. If the last full charge is consistently dropping from the design capacity it may be time to replace the battery.

With this report Admins can tweak power profiles to realize the maximum benefits of new power efficient computer platforms. Happy efficient computing!

PowerShell Integrated Scripting Environment

rodney.buike — Fri, 13 Feb 2009 14:00:00 GMT

PowerShell 2.0, included in Windows 7 and Server 2008 R2, includes a new Integrated Scripting Environment (ISE) which provides you with a GUI based tool to write your scripts and learn PowerShell. To launch PowerShell 2.0 ISE simply drill down to Start –> All Programs –> Accessories –> Windows PowerShell.

Once that is launched you’ll see the ISE load and you are ready to begin.

The top portion, aka the Script Pane, is your scripting environment which allows you to write PS scripts. The play and stop buttons are used to start and stop the running of a script. The middle portion, aka the Output Pane, is where the script is executed and the results displayed. Finally at the bottom is the Command Pane, where you can run individual Cmdlets and “one-liners”. So besides a nice GUI editor why do I like the PowerShell ISE?

· ISE Features - Tab completion, line numbering, indenting and the always useful search and replace.
· Customizable ISE - You can change the color, location and size of the various panes to suit your style.
· Colored Syntax – Like other scripting environments different colors are used to highlight variables, strings, objects and Cmdlets.
· Support for Unicode - The PowerShell ISE supports Unicode.
· Debugging. I always make mistakes and the ability to set breakpoints, walk through the script step by step really helps find those errors.

If you are using Windows 7 or Server 2008 R2 give the ISE a try! Compared to Notepad it is a dream to work with :)

Create a “Bootable” Windows 7 VHD

rodney.buike — Wed, 11 Feb 2009 00:48:00 GMT

A few weeks back we posted an entry on how to boot from a Windows 7 or Server 2008 R2 VHD. Booting from VHD is new to Windows 7 and Server 2008 R2 but one of the caveats was you needed a “clean” VHD to boot from. There is a very simple way to create this VHD using an open source tool available on the MSDN Code Gallery called WIM2VHD.

WIM2VHD is a command line tool that converts the WIM image into a VHD you can use to boot off. It does have a few requirements…

The prep machine has to be running Windows 7, Server 2008 R2, either of which could be running in a Hyper-V VM
A Windows 7 or Server 2008 R2 installation media
The Windows 7 Automated Install Kit Beta

There are a number of switches you will need to know as well in order to create the VHD file…

/wim: specifies the path to the WIM file
/sku: which version (ServerStandard, Ultimate etc…) You can also use the SkuIndex if you retrieved that with the ImageX tool
/vhd: specifies the path and the name of the VHD to be created
/size: specifies the size of the VHD in MB
/disktype: specifies the type of disk, Dynamic or Fixed

There are some additional switches which you can find on the WIM2VHD documentation that allow you to further customize the VHD to be created.

So let’s say we wanted to create a Windows 7 Ultimate VHD on a 40GB fixed disk; we’d use the following command:

cscript wim2vhd.wsf /wim:X:\sources\install.wim /sku:ULTIMATE /vhd:C:\Win7Ultimate.vhd /size:40960 /disktype:Fixed

Or if we wanted to create a Windows Server 2008 R2 Standard VHD on a 40GB dynamically expanding disk we’d use the following command:

cscript wim2vhd.wsf /wim:X:\sources\install.wim /sku:SERVERSTANDARD /vhd:C:\ServerStandardR2.vhd /size:40960 /disktype:Dynamic

You can download WIM2VHD and the release documents here.

What’s New in 2008 R2 – Offline Domain Join

rodney.buike — Mon, 09 Feb 2009 14:00:00 GMT

For as long as we have had Active Directory domains, we have been required to to join client to the domain while they were online and connected to AD. Without that the join would fail. Now you always had the ability to join with a script using the NETDOM command but with Windows Server 2008 R2 we can now join a client to our AD domain while offline. The real benefit hear is that there is no need to supply or enter domain admin credentials. As you’ll see below a TXT file is created but just for fun open it up with notepad and see what you can make out :)

It is a simple three step process that requires you to run a new utility called DJOIN from an already joined Server 2008 R2 computer.

Create a text file with DJOIN that contains the required information for a computer to join AD
Import the text file using DJOIN on the target computer you wish to join AD
Once connected to the domain, reboot the computer and it will join AD

For joining a computer to the domain using DJOIN there are some switches you need to know about first.

/provision – used when there is no existing AD account for the computer
/reuse – if you already created a computer account in AD and would like to use it
/domain – specifies the domain to join
/machine – specifies the name of the machine, if the computer has a different name it will be renamed
/machineou – specifies the OU to join, if you omit this it will automatically be placed in the default computers OU
/savefile – saves the file to be imported.

A typical command would be…

djoin.exe /provision /domain thelazyadmin.com /machine client01 /machineou Desktops /savefile client01.txt

To join client01 to the domain we would next import client01.txt with the following command run with administrative privileges…

djoin /requestODJ /loadfile client01.txt /windowspath %systemroot% /localos

Reboot once the client is connected to the domain and the join will be made.

What’s New in 2008 R2 – .NET and PS in Core

rodney.buike — Fri, 06 Feb 2009 14:00:00 GMT

The one thing I missed with Server Core was PowerShell. While you can run PowerShell cmdlets and scripts remotely, at times it would have been nice to run it locally. The reason PowerShell was not included was due to the lack of .NET in Server Core. That changes in R2.

Windows Server Core 2008 R2 includes a subset of .NET which allows PowerShell, as well as other components like ASP.NET. Specifically Server Core R2 includes:

.NET 2.0
.NET 3.0 and 3.5

Windows Workflow Foundation (WF)
Windows Communication Foundation (WCF)
Language Integrated Query (LINQ)

Support for WoW64 if you are running 32 bit applications

Windows Presentation Foundation (WPF) isn’t included but then with no GUI in Server Core it doesn’t really matter much. There are a few commands you need to know to get it working in R2.

Install .NET 3.0 and 3.5

Start /w ocsetup NetFx3-ServerCore

Enable 32 bit support, run the above, then

Start /w ocsetup ServerCore-WOW64

Start /w ocsetup NetFx3-ServerCore-WOW64

Enable PowerShell

Start /w ocsetup MicrosoftWindowsPowerShell

Launch PowerShell

Start c:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe

What’s New in 2008 R2 – Core Parking

rodney.buike — Thu, 05 Feb 2009 14:00:00 GMT

Green IT, Green IT, everywhere you turn there is something about Green IT. With increased power and cooling costs a lot of people are using virtualization to reduce these costs but Windows Server 2008 R2 brings a new feature called Core Parking which helps as well. It does this by moving all processing to a core (or cores) and putting the other cores to “sleep”.

Image courtesy of Microsoft Corporation

As processing power increases more cores “wake up” and take on the additional processing. Considering Windows Server 2008 R2 supports up to 256 cores this feature can really provide some savings while not impacting performance.

Further to Core Parking, Windows Server 2008 R2 can also adjust the “P-State” to reduce the power consumption of a core. In a nutshell this is like Intel SpeedStep which can “slow” down the CPU on your notebook to conserve power when you run on battery.

Image courtesy of Microsoft Corporation

All of this can be controlled via Group Policy in an AD domain or via the Local Policy on a standalone server.

What’s New in 2008 R2 – Live Migration

rodney.buike — Wed, 04 Feb 2009 14:00:00 GMT

I can’t think of any feature we’ve been asked more in regards to Hyper-V has been around Live Migration, known as VMotion in the VMWare world. Hyper-V R2 now supports Live Migration, partly due to Cluster Shared Volumes.

Live Migration allows a virtual machine to be moved from one node in a cluster, to another node without any downtime.

Image courtesy of Microsoft Corporation

In a nutshell Live Migration accomplishes this by…

Using SCVMM 2008 (an update will be required) you initiate a Live Migration from the source host to another node in the cluster.
Once initiated, a virtual machine is created on the target host. Since the VHD(s) is stored on a CSV there is no copy of a VHD over the network.
Once the VM is created on the target host the data stored in the source hosts RAM is copied to the RAM in the target host. In essence Hyper-V is mirroring the contents of memory on both hosts.
Up until the memory “mirror” is complete, clients continue to be connected to the original VM on the source host.
Once the memory “mirror” is complete, clients are redirected to the VM on the target host.

Now one thing to remember is that both nodes of the cluster need to be online. This is not a DR solution, although the VMs can be made highly available. In a DR situation where the source node fails, the highly available VMs will be restarted on the other node(s) in the cluster.

Federated Search on Windows 7

daniel.nerenberg — Tue, 03 Feb 2009 14:00:00 GMT

Federated search on Windows 7 lets you search online repositories from within Explorer. Those repositories can be RSS feeds, or sites like you tube. It’s primary purpose is to provide easy access to search enterprise portals. fortunately people are already building providers for all sorts of services.

In the screenshot I was able to search the TLA blog for articles on Windows 7. To read any of these articles I just click on the results and then click open

You can find Federated Search connectors for all sorts of sites. For now of course you should download the TheLazyAdmin Federated search provider!

To install, First you'll need Windows 7, then download the zip file from the link above, open the zip file and double click the Thelazyadmin.osdx file.

That's it, open Windows Explorer or browse to C:\Users\<username>\Searches and search the your favourite Tech Tips site right from your desktop!

What’s New in 2008 R2 – Cluster Shared Volumes

rodney.buike — Mon, 02 Feb 2009 14:00:00 GMT

One of the challenges faced with clustered Hyper-V servers today is that for each VHD on a highly available virtual machine, you need to carve out a LUN on your SAN to place that VHD. While it might not be a monumental task to do so, it is a management nightmare. With less than 24 drive letters free you often end up using GUIDs.

Well that changes in Server 2008 R2 with the introduction of Cluster Shared Volumes (CSV). CSV allows you to place multiple VHDs on a single LUN while still looking like it is on its own LUN.

Image courtesy of Microsoft Corporation

There are a number of benefits to CSV including…

provides consistent namespace to all nodes in the cluster
they still use NTFS meaning deployment will note require you to reformat your SAN
also using NTFS means you can use a file system you are familiar with rather than s proprietary file system
no special management tools are required to create and manage the CSV

With all CSV volumes stored in the ClusterStorage root directory, it becomes easy to navigate the file system as well. As an example if the Cluster Storage folder is stored on the S:\ drive then the path to Volume1 would be S:\ClusterStorage\Volume1 and the path to Volume63 would be S:\ClusterStorage\Volume63. No running out of drive letters and no GUIDs!

Microsoft Deployment Toolkit 2010

daniel.nerenberg — Sat, 31 Jan 2009 14:00:00 GMT

Now that you have had a few weeks to test out the public Windows 7 beta, it’s time to think about how you’re going to deploy the goodness out to all your users. Fortunately the fine people at the Microsoft’s Solutions Accelerator group are on the ball. Microsoft Deployment Toolkit 2010 is already in beta. This edition of MDT will provide support for Windows 7 as well as Windows Server 2008 R2.

Some enhancements in MDT are:

Support for USMT 4.0. USMT or User State Migration Tools is like an extremely powerful user data migration tool. You can capture information from the hard drive, the registry, and other Windows data unique to specific users. Once the data has been captured a new OS can be deployed and then data can be restored. New in 4.0 is the ability to pull user data from offline media. This means that if something was lost, or the USMT state capture definitions change we can rerun the USMT capture against a backup image or even a Windows.old directory. A little known fact about the Vista/Win7 upgrade process is that the User state is first captured and then a clean installation of Windows is imaged to the computer. So for those who prefer to always “clean” install even upgrading provides a clean install experience now.

Support for the DISM (DISM.exe) tool. This tool combines the functionality of several tools. Including ImageX Package Manager (Pkgmgr.exe), the International Settings Configuration Tool (Intlcfg.exe), and the Windows PE command-line tool (PEimg.exe). With this tool you can mount WIM files, inject drivers and add in language packs, perform offline servicing, and many other useful tasks.

Finally the Windows Automated Installation Kit or WAIK has added the ability to create bootable VHD drives, (now that we can boot from a VHD drive we’ll need a way to make them bootable!)

Currently the only scenario being supported by Windows 7 is Lite touch deployment. As development on Windows 7 continues I’m positive will start to see the zero touch installation take shape around the SCCM (System Center Configuration Manager)

To download MDT 2010 beta you need to apply to the beta on Microsoft Connect: http://connect.microsoft.com

What’s New in 2008 R2 - DirectAccess

rodney.buike — Fri, 30 Jan 2009 14:00:00 GMT

VPNs are a thorn in the side of all admins. While the setup and management has improved they still lead to a number of calls from users on the road who have difficulties connecting. There have been a number of technologies along that way that have reduced the need for VPNs, like OWA, RPC over HTTPs, and secure SharePoint publishing but we still have VPNs because we need them. DirectAccess is a new feature in Windows Server 2008 R2 that aims to solve that problem.

Windows Server 2008 R2, used in conjunction with Windows 7, can reduce the need for a VPN as it provides a transparent connection to internal resources.

Image courtesy Microsoft Corporation

DirectAcces can provide this secure connection thanks to a few built in features.

Network Policy Server – Controls what clients have access to the internal network
Network Access Protection – Ensures clients are up to date before creating the connection
Access Control – Using AD clients can be given different levels of access to the internal network
Authentication – DirectAccess handles the authentication allowing the client to connect before the user logs in
Authentication Support – Provides support for smart cards and other forms of multi-factor authentication
Encryption – All communications are encrypted to protect the privacy of the data being transmitted
Routing – DirectAccess leverages “split tunnel” routing allowing only traffic destined for the internal network to pass while directing all other traffic to the WAN connection.

The best part about this is that as an admin, you have full management control of a client connected via DirectAccess. You can push updates, apply policies and manage the client without the need for a user to initiate a VPN connection or even log on.

What’s New in 2008 R2 – Branch Cache

rodney.buike — Thu, 29 Jan 2009 14:00:00 GMT

Do more with less? Ever hear that term? Probably around the same time your budget was cut! Bandwidth between the home office and the branches can be a rather large cost from the actual money spent on the connection to the user downtime when the connection is slow. Having worked in an engineering company that was always sending large CAD drawings back and forth, Branch Cache looks to help.

In a nutshell Branch Cache is very much like a DNS cache. For example, when you do a lookup of thelazyadmin.com via DNS the resulting IP address for the server is stored in your cache until the TTL expires. Branch Cache does the same thing only with data that you have transferred the remote site. There are two types of configurations, peer based and server based.

With peer based caching, User 1 copies Document1 from the file server at the head office to their PC at the remote office. When User2, located at the same remote office attempts to download Document1 from the file server at the head office they are redirected to User1’s computer and will download Document1 from there, saving bandwidth and speeding up the time it takes for the download to complete.

Image courtesy of Microsoft Corporation

A server based Branch Cache configuration works in a similar manner however a server is installed at the remote site and a centralized cache is created there. This is ideal for larger organizations.

Branch Cache works with both SMB and HTTP content and can be configured manually or via group policy.