The Lazy Admin

Windows Vista Springboard: Discover

daniel.nerenberg — Mon, 28 Apr 2008 12:38:00 GMT

I posted a few weeks ago about some Vista Springboard. Continuing that series of posts, I wanted to talk about the first part of Springboard program which is: Discover. Now I'm sure many of you have already "Discovered" Vista, I thought I had too, but the great thing about the springboard site is it concentrates a great deal of information into nice digestible categories.

So as most readers have probably already discovered the technical aspects of Vista, I wanted to highlight some of the great tools that are provided. If you have ever been asked to deliver a report on how much is something is going to cost, and to figure out its ROI, and TCO, and all those non technical acronyms that our favourite accountant is concerned with, If your like me your eyes gloss over, and your brain starts hurting.

Fortunately Microsoft know's that we're all lazy admins, so they made us a great tool: Microsoft Windows Vista Cost and Benefit Estimator.

First the calculator starts out by asking some simple questions. For instance how many computers do you have in environment. Then what the current OS distributions are.

Once you have entered in your information a highly detailed report will be generated that also includes a laundry list of benefits. These are the kinds of numbers that impress decision makers, and that can take hours to generate. Now a big Disclaimer that most of the data is generated based on the information you enter in to the tool. This means you need to be confident in the information so that the report generated is going to accurate.

example of benefits:

So take a look at the tool: http://www.microsoft.com/technet/windowsvista/ROItool/Default.aspx

And don't forget to discuss your Vista deployment issues in the Forums. To encourage some lively discussions, the best posts, answers and contributions (as decided by a qualified panel of qualified judges, err.. Lazy judges) will receive a copy of Windows Vista SP1, You have to post to win!

Guest Post Essential Business Server: Coming soon to a mid-sized company near you!

daniel.nerenberg — Fri, 11 Apr 2008 12:00:00 GMT

MVP, MCT, and Blogger Mitch Garvis has posted the first in a series of articles about new server solutions for small and mid sized businesses.

Essential Business Server: Coming soon to a mid-sized company near you!

For years I have been saying that Small Business Server was the best solution for small businesses that did not have huge IT budgets; it allowed them to take advantage of the same enterprise-level tools such as Microsoft Exchange Server, SQL Server, and SharePoint Server without having to purchase several servers with tens of thousands of dollars of software, not to mention a full-time IT department.

Several people and groups have challenged me with 'what if' scenarios intent on debunking the applicability of SBS to their specific business network scenario, and I have always been glad to address these challenges because most of them were based on myths. The truth is that to date I have not heard of any scenario where SBS could not be deployed in a small business as the backbone infrastructure, with one exception: The Hard Ceiling.

of course I am referring to the two great licensing limitations of SBS:

You can only have a single SBS server in your network environment; and
You were limited to (on SBS 2003) seventy-five CALs (Client Access Licenses). Once you hit that ceiling you had to transition off SBS onto the enterprise packages.

Of course the first limitation is also a myth; although it is a true enough statement, that does not mean that you are limited to having a single server, rather that only one of them - the primary Domain Controller that hosted all operation master roles (commonly referred to as FSMO, or Flexible Single Master Operation roles) - could be running SBS. You could add as many servers (up to ____) to your network, they just could not hold the operation master roles.

The second limitation is real. If your company grew past seventy-five users (let's not get into the device CALs versus user CALs discussion) you had no choice but to leave the safety and comfort of the SBS world.

The allure of SBS was (and continues to be) not only the power of the tools offered, plus the fact that they could all be run from a single box (My first SBS which I ran from home for two years ran very reliably on an IBM Pentium III workstation with 1GB RAM)... but also the fact that everything was configured and managed by very intuitive wizards and tools. Creating a user was a single process which would include all permissions for everything from Exchange to SQL to SharePoint Services. Transitioning beyond SBS meant leaving those wizards - and the revered Remote Web Workplace - behind.

Enter Essential Business Server.

A year ago I saw Windows Server Codename: Centro for the first time and fell in love. It was the solution for mid-market companies up to 250 computers, and it was in a word everything that SBS was not. Not only did it break the seventy-five user limit, but it also addressed most (if not all) of the actual and perceived limitations of SBS... while maintaining the cohesiveness of the single package.

We could easily steal for SBS the motto from the US Dollar Bill, E pluribus unum - from many, one. That is because SBS integrates a number of servers that in the enterprise are generally separate and hosts them all on a single server. The Standard Edition of Essential Business Server installs on three independent servers: the Management server, the Security server, and the Messaging server. (the Premium Edition of EBS adds a fourth for the Database server).

Now that Microsoft has lifted much of the veil of secrecy from both EBS and the next release of SBS (Windows Small Business Server 2008, formerly codename Cougar) you will find that I have a lot to say about both of these products. I see four distinct groups to whom this series of articles should be of interest:

IT Professionals with an eye toward small and mid-sized businesses;
Small Business IT Professionals who have been working with SBS;
Small business owners or managers who need to make informed decisions about their IT and do not necessarily want to pay for consultants; and
People interested in becoming IT professionals.

While I am not promising to answer all of your questions, I do hope to introduce both products to you so that when they do release to manufacturing (RTM) there will be not only a proper and comprehensive understanding of the products (and often of the reasons behind certain decisions and the like), but also a complete library of information that will be available, from an interested and connected (and mostly objective) IT Professional who does not actually work for Microsoft.

Strap yourselves in... because here we go!

About Mitch Garvis:

Mitch is an IT Trainer with a passion for community. Having founded and led two major Canadian user groups for IT Professionals he understands both the value and rewards of helping his peers.

After several years as a consultant and in-house IT Pro for companies in Montreal, he now works with InFront Consulting Group creating and delivering training for Microsoft to its partners and clients around the world. He has contributed to the creation of several exams for Microsoft Learning. Mitch holds numerous Microsoft certifications and has lectured on the value of the program.

He is a Microsoft Certified Trainer, and has been recognized for his community work with the prestigious Microsoft Most Valuable Professional award.

Mitch also blogs at www.mitchgarvis.com

Guest Post By Chris Sanders: WSUS FAQ

daniel.nerenberg — Wed, 09 Apr 2008 19:14:00 GMT

Regular TLA reader Chris Sanders has contributed the following list of frequently asked questions about WSUS.

Windows Server Update Services Q&A

I have deployed several WSUS servers in networks of all sizes. This Microsoft technology is one that I believe is a necessity for any network that includes Microsoft servers or clients. Unfortunately, I still see a lot of network admins who don’t deploy it just because they have misconceptions about it. The purpose of this Q&A is to address some of the most common answers I get from those who are looking to deploy WSUS.

Q: What is WSUS?

A: Windows Server Update Services, known as WSUS, is a technology that runs on Windows Server 2003/2008 and allows network administrators to distribute and manage updates to Microsoft products.

Q: How much does it cost?

A: WSUS is provided FREE of charge. However, it does require a server operating system to run, so you must have a valid license for that operating system, as well as Client Access Licenses (CALs) for each computer being updated by the WSUS server.

Q: What products will it update?

A: WSUS will manage updates for virtually every Microsoft product. This includes the Windows Server 2000, 2003, 2008, and Small Business Server operating systems. Client operating systems that can be managed include Windows 2000, XP, and Vista. Also included are Exchange 2000, 2003, and 2007, Forefront Security, Internet Security and Accelerate Server (ISA), SQL Server 2000 and 2005, Systems Management Server (SMS), and Microsoft Office 2003 and 2007. For a complete listing, check the official WSUS website, at http://technet.microsoft.com/en-us/wsus/default.aspx.

Q: What are the server prerequisites for WSUS?

A: WSUS must run on Windows Server 2003 SP1 or Windows Server 2008. The other components that are required include Internet Information Service (IIS) 6.0, .NET Framework 2.0, MMC 3.0, and Microsoft Report Viewer 2005.

Q: Do I have to have a dedicated server for WSUS?

A: Although isolation of services is always recommended, this isn’t a requirement. As a matter of fact, in smaller networks most people piggyback WSUS off of an existing file server or backup domain controller. WSUS is pretty flexible so you can typically place it where you see fit. It is also not uncommon to see WSUS running within a virtual machine.

Q: How much disk space does WSUS require?

A: If you are storing the downloaded updates locally on the server, then you will need at least 6 GB of free space. Depending on the products you will be updating you may need as much as 30 GB of space.

Q: My network spans multiple locations. How can I effectively use WSUS?

A: WSUS was designed with this in mind. It provides the ability to utilize upstream and downstream servers in order to fit most any network topology. Using this model, you can configure multiple downstream servers to synchronize with a locally housed upstream server. This removes administrative burden and conserves bandwidth.

Q: Can I use WSUS on a network that is disconnected from the Internet?

A: Yes. You can export the updates from a WSUS server that is connected to the Internet and import them into an offline WSUS installation. Doing this, you can manage update approvals just as you would with an online WSUS installation.

Q: Where can I get WSUS?

A: WSUS can be downloaded directly from Microsoft. The latest version, WSUS 3.0 SP1 can be downloaded here: http://www.microsoft.com/downloads/details.aspx?FamilyId=F87B4C5E-4161-48AF-9FF8-A96993C688DF&displaylang=en#Requirements.

Q: Where can I get support for WSUS troubleshooting issues?

A: Since WSUS is so widely used, the community support for it is quite large. One of the best WSUS support sites is http://www.wsus.info, which is run by a Microsoft MVP in software deployment. I also write about WSUS quite a bit on my personal blog at http://www.chrissanders.org. You can stay up to date on new release information at the official Microsoft WSUS team blog at http://blogs.technet.com/wsus/.

I’d say about 90% of the WSUS related questions I receive in my inbox can be answered by reading this FAQ. There really is no valid reason why your network shouldn’t be running some form of software update distribution, and unless you are running some type of managed services software or SMS, then WSUS is the best way to do that.

About Chris Sanders:

Chris Sanders is a Senior Support Engineer for KeeFORCE, a technology consulting firm in western Kentucky. Chris writes and speaks on various topics including packet analysis, network security, Microsoft technologies, and general network administration. His personal website at www.chrissanders.org contains a great deal of information, articles, and guides related to these topics.

Windows Vista Springboard

daniel.nerenberg — Mon, 24 Mar 2008 18:13:31 GMT

Windows Vista Springboard is a micro site on the Microsoft Web site dedicated to helping IT Pros get Vista deployed into their environments.

Now before going any further with regards to Vista Springboard, I want to say that I am a strong supporter of Windows Vista. Their are some big benefits, and some big steps forward with Vista. The most important aspect of Vista is that it helps me be a lazy admin.

Now I'll also be honest and realistic, there are a lot of people that don't like Vista. There are many reasons why people won't like Vista, some of the reasons are legitimate, however most reasons tend to be rooted in a haze of bad perception. What I mean by that is Vista has a perception of lacking value, or in other words people will ask "What is my compelling reason for upgrading to Vista?" This goes for Home users, Office users, IT pros, and especially IT managers and decision makers.

This is where the Vista Springboard program comes into play. IT people are busy people, and even though we would all like to be Lazy Admins, in reality my guess is that your not really that lazy at all. The problem with Vista is that there isn't one feature that people say WOW I need that! There are a few features that come close (I'm thinking BitLocker, Windows Search, UAC, Windows Imaging) But not of these features by themselves really sell the idea of Vista. I like to say that when you start looking at all the features, and starting to figure out how each little feature saves time, resources, the benefits start to add up. As the benefits add up, you start to realize that there isn't one compelling reason to install Vista, but a few hundred small reasons soon add up to a conglomerated compelling reason!

Now all that being said I still don't feel I have said anything really new, I can hear you all yelling at the monitors YES, WE KNOW THERE IS LOTS OF COOL STUFF, but where to do I start to get a handle on all this??

This is where Springboard comes into play. The site is designed to provide information about Vista at the right detail level, based on where you are in your considerations for, and hopefully deployment of Vista.

The site breaks down into 4 sections, which align with how IT environments will typically approach a new set of technologies.

Discover Windows Vista: Windows XP is good enough. Why should I care?

Explore: How do I learn what's in it for me and if it's worth the effort?

Pilot: Will it work in our environment; how do I prepare?

Deploy: What best practices can we get to minimize our risk?

Over the next few weeks I'm going to focus on some of the cool articles, and talking point that we can find on the Springboard site. You can check it out too, just follow the link below. In the efforts to create a conversation around these articles, I have created a new forum to talk specifically about all things Vista, and especially around the Vista Springboard program. To motivate the conversation I have some great giveaways for TLAers who participate in the discussion/debate. Just remember, I am always up for a great debate, however formal debate rules apply, argue against the idea, not person. Also keep it clean, we can be passionate without the colourful metaphors.

Check out SpringBoard: http://go.microsoft.com/?linkid=8418918

Discuss Springboard in the forums: http://thelazyadmin.com/forums/25/ShowForum.aspx

So What has the Lazy Admin been up to?

daniel.nerenberg — Mon, 17 Mar 2008 14:19:00 GMT

The Lazy Admin has not been as lazy as he seems.

I have been hard at work writing on all sorts of projects that unfortunately take away from my TLA writing time. I just wanted to let everyone know that a good deal of the stuff I have worked on is now available!

Here are some of the projects.

1) The Microsoft Solutions Accelerator team has been hard at work writing amazing guidance documents about Windows Servers architectures . They are just the sort of compact to the point document Lazy Admin's everywhere will appreciate.

You can check out the guides online at: www.microsoft.com/ipd or download them at http://www.microsoft.com/downloads/details.aspx?FamilyId=AD3921FB-8224-4681-9064-075FDF042B0C&displaylang=en

The guides also come with a nifty PowerPoint presentation so after you finish learning about architecture of these services you can present them to all your great new knowledge to your colleagues.

2) I have also contributed on a book about Microsoft Forefront technologies: now available on Amazon and books stores

3) I have also been involved with The Vista Spring Board program, This is a really great resource for ITpros looking to get information about Windows Vista. The site is organized so that you can get the information you need at the right level you need it. So if you just haven't had time to even look at Vista check out the Discovery section. Then once you have a good handle on the basic elements of Vista check out the wealth of information in the Explore section including dozens of hands on labs to get you up to speed on all the new stuff in Vista. Finally there is deep dive content available on how to pilot Vista, and finally role it out. Wether you manage 5 PCs or 50 000 this site has something for you!

Now that we are all caught up, The TLA posts should be picking up. If you have any new tips, or ideas for a post please email them to tlatopic@thelazyadmin.com. For the most part I'm going to cover that new Server operating system this little company called Microsoft just released :)

Have a great Week.

Daniel

Configuring the Vista NAP Client

rodney.buike — Fri, 22 Feb 2008 04:32:40 GMT

The other day I posted a tip on how to enable the Network Access Protection client on XP SP3. The client is also built into Vista (RTM and SP1) and is a little easier to configure. Although the same command line from the XP SP3 config can be used, there is a MMC console as well.

Again before we configure the client we must set the Network Access Protection Agent service to start automatically, then start it.

Then we can launch the MMC console with the following command

napclcfg.msc

Once this opens up click on Enforcement Clients and then simply right-click the agent you wish to use and choose enable!

If you are a command line junkie or wish to script this you can also run the following command:

netsh nap client set enforcement ID = "#####" Admin = "ENABLE"

Just replace the ###### with the enforcement ID. One last hint, you can see the enforcement ID circled as well if you forget and need to enable the client using Netsh.

Configuring the NAP Client in XP SP3

rodney.buike — Mon, 11 Feb 2008 14:52:00 GMT

With the recent launch of Windows Server 2008 you are no doubt spending all your free time playing around with everything new. One thing you might be playing around with is Network Access Protection. There is a great document on getting a DHCP based NAP lab set up but one thing the document is missing is how to configure the NAP client in XP SP3. In Windows Vista you simply start the service then enable the client through the NAP Client Configuration MMC (napclcfg.msc) but XP SP3 does not include the MMC. So how does one configure the NAP Client without a Nap Client configuration tool? Netsh, that is how!

To enable the NAP Client on XP SP3 you need to do the following:

Start --> Run --> Services.msc
Change the Network Access Protection Agent service to start automatically
Start the Network Access Protection Agent service
Start --> Run --> CMD.exe
Type netsh nap client set enforcement ID = ##### Admin = "Enable"
Start --> Run --> GPEdit.msc
Drill down to Computer Configuration | Administrative Templates | Windows Components | Security Center
Enable the Security Center
Start --> Run --> Services.msc
Start the Security Center service

You will need to replace the ##### with the ID based on whichever enforcement method you are using. You can use the following IDs for the various enforcement methods:

DHCP = 79617
RAS = 79618
IPSec = 79619
TS Gateway = 79621
EAP = 79623

For more labs and information see:

Step-by-Step Guide: Demonstrate IPsec NAP Enforcement in a Test Lab

Step-by-Step Guide: Demonstrate 802.1X NAP Enforcement in a Test Lab

Step-by-Step Guide: Demonstrate VPN NAP Enforcement in a Test Lab

Windows Server 2008 and Windows Vista SP1 Have RTM'd

rodney.buike — Mon, 04 Feb 2008 21:35:00 GMT

You have probably heard this bit of news already but in case you haven't we thought we'd share it with you. Vista SP1 and Server 2008 were both released to manufacturing today and will become available in the near future. That is unless you have a TechNet or MSDN subscription in which case you can start downloading now :) Below is the official press release with links for more information.

What: Windows Vista Service Pack 1 (SP1) was released to manufacturing today and will start being available to customers in March, starting with Microsoft Volume Licensing customers. Windows Server 2008 was also released to manufacturing today and will be available for purchase to new customers on March 1. Microsoft Volume Licensing customers with active Microsoft Software Assurance coverage or an Enterprise Agreement will be able to download the server software toward the end of February as part of the joint Microsoft SQL Server 2008 and Visual Studio 2008 “Heroes Happen Here” launch event.

Where: http://windowsvistablog.com/blogs/windowsvista/default.aspx

http://blogs.technet.com/windowsserver

http://www.microsoft.com/presspass/features/2008/feb08/02-04WS2008.mspx

How: Windows Vista SP1 includes quality improvements that help enhance reliability, security and performance. Windows Server 2008 builds on the success and strengths of past server solutions and helps give organizations a solid foundation for their information technology (IT) infrastructure. Organizations using Windows Vista SP1 and Windows Server 2008 together can see a number of improvements for IT professionals, including benefits in security and manageability, overall system performance, and streamlined planning and deployment.

Windows Server 2008 Certification

daniel.nerenberg — Fri, 28 Dec 2007 13:30:00 GMT

Windows Server 2008 is just around the corner. With Major launch events announced in all around the word on or around February 27th It's time to get geared up and ready to answer those tough questions. I'll be honest with all you lazy admins out there, it looks like 2008 is not going to be a very lazy year.

First of all there is a bunch of new certifications coming our way. So the first thing we'll have to get ready for is updating our skills! Microsoft has all sorts of material, and of course the writers here at TLA are going to be working double time to make up for all the slow number of posts for 2007.

Here is a quick road map on 2008 certs.

Upgrading from MCSE you will want to get to you local testing canter and write Exam 70-649: TS: Upgrading Your MCSE on Windows Server 2003 to Windows Server 2008, Technology Specialist. This will let you pass the 3 major Technical Specialist exams in one shot.

70-640: TS: Windows Server 2008 Active Directory, Configuring

70-642: TS: Windows Server 2008 Network Infrastructure, Configuring

70-643: TS: Windows Server 2008 Applications, Configuring

Once that is out of the way you can complete Exam 70-647: Pro: Windows Server 2008, Enterprise Administrator which certifies you as a Microsoft Certified IT professional (MCITP). In order to get the MCITP though you'll also have to certify on Vista either 70-620 or 70-624 will be sufficient.

If your coming from MCSA you'll want to look at Exam 70-648: TS: Upgrading Your MCSA on Windows Server 2003 to Windows Server 2008, Technology Specialist This covers 2 TS exams.

70-640: TS: Windows Server 2008 Active Directory, Configuring

70-642: TS: Windows Server 2008 Network Infrastructure, Configuring

The next exam is Exam 70-646: Pro: Windows Server 2008, Server Administrator Which again gives you a MCITP but the focus is more on servers as apposed to larger enterprises issues.

Finally if certification hasn't been one of your priorities until now, I can't think of a better time to get onboard. Certification can be a great career building tool and with Windows 2008 certification has become even more meaningful because each Technical specialty is highly focused to a specific job role.

Of course the Lazy Admins are hard at work working on new features and articles to help all the lazy admins out there get more done in less time, keep your eyes out on the RSS reader for news on 2008 and other exciting technologies.

Windows PowerShell: Screencast on JAMS

marco.shaw — Mon, 29 Oct 2007 16:29:00 GMT

This is my first screencast (ever!), and I am hoping to do more on PowerShell, and anything related to PowerShell. In this first screencast, I'm going to do a demo of JAMS: JAMS (Job Access & Management System) is a commercial software product that provides job scheduling for Windows, OpenVMS, UNIX and Linux systems. As of a few months ago, it now provides full PowerShell support

The idea of doing a screencast came to me a few months back, Jeffrey Snover blogged about JAMS on the Windows PowerShell team blog. He mentioned that he would like to see some kind of video demo of how JAMS worked. Since nothing was available, I decided to do a screencast on it, and here it is in Flash format: JAMS screencast.

If there's anything in particular related to PowerShell that you'd like to see a screencast on, leave a comment here or post something in the scripting forum, and I'll add it to my list of things I'd like to cover in the future.

I hope you enjoy it!

What's New in Vista SP1

rodney.buike — Sat, 27 Oct 2007 15:00:07 GMT

Windows Vista SP1 is set to hit the market in early 2008 and there are some cool new features, along with the inclusion of hotfixes. Some of these new features are:

Secure Sockets Tunneling Protocol (SSTP) allows for easier setup of VPN connections due to the way it works with firewalls, NAT devices etc....
Bitlocker Drive Encryption has been enhanced to support encrypting additional volumes besides the current limitation on the C: volume. It will also support three factor authentication (i.e. TPM + Pin + Dongle)
Disk Defragmenter has also been improved to give administrators additional control over what and when volumes get defragmented with the scheduler
Support for Extensible Firmware Interface (EFI) booting on x64 based machines
Support for the ExFAT file format used in flash memory
Support for SD-Advanced DMA
Improved network diagnostics
Performance improvements

We will be covering some of these as the release date gets closer......

Transitioning from Exchange 2000 to 2007 (Part 3)

rodney.buike — Mon, 01 Oct 2007 12:34:00 GMT

Now after checking the entire pre-installation components, if we start the setup we will get some error messages such as this one:

Setup encountered a problem while validating the state of Active Directory: Domain Controller Operating System version is 5.0 (2195) Service Pack 4. The minimum version required is 5.2 (3790) Service Pack 1.

This a common issue actually, the reason behind this is that the setup is checking all the DCs that they must be 2003 sp1 as well as the GCs, because of that we have to point the setup to the specific 2003 dc.. This issue will be fixed in exchange 2007 sp1. So, I am going to start the setup in an unattended mode starting by prepare the forest by running the mentioned switches previously but with specifying /dc: parameter to point to the windows 2003 DC. The first thing we need to do in deploying Exchange 2007 into a legacy Exchange Organization is to run

Setup.com /PrepareLegacyExchangePermissions

•After that we have to prepare the schema, this can be done by running the following command

Setup.com /PrepareSchema /dc:NameofWindows2003DC

Prepare AD, by typing the command:

Setup.com /PrepareAD /dc:NameofWindows2003DC

Note: you can run the Setup.com /PrepareAD command before running /PrepareLegacyExchangePermissions and /PrepareSchema, this will run the /PrepareLegacyExchangePermissions and /PrepareSchema commands automatically.

Now we can start the setup, but we have to start the setup in an unattended mode as we said, by combining a couple of switches with the setup command, depending on your needs:

setup /m:Install /roles:M,HT,C,MT /dc: /EnableLegacyOutlook /LegacyRoutingServer: /t:"d:\program files\Microsoft\Exchange Server"

This command will install the management tools, Hub Transport role, Client access role and the Mailbox role.

That is it, exchange 2007 had been installed, and now we have to move the mailboxes to the new exchange 2007 and finally decommission the old 2000 server. For more details, you can follow up with Henrik article on moving the mailboxes and decommissioning the old exchange server.

For More Information:

Transitioning from Exchange 2000 to 2007 (Part 1)

Transitioning from Exchange 2000 to 2007 (Part 2)

Thelazyadmin.com Exchagne Category

Transitioning from Exchange 2000 to 2007 (Part 2)

rodney.buike — Fri, 28 Sep 2007 12:26:00 GMT

Before we get started with the installation of Exchange 2007 it is recommended to run the latest version of Exchange Best Practice Analyzer tools now, and choose Exchange 2007 readiness check, in my case, the tool gave me the following report:

So, my exchange organization is in mixed mode, it must be changed to native mode. In general, there is three prerequisites that must checked before installing exchange 2007, they are:

Active Directory forest:
- the domain functionality level must be windows 2000 or Windows Server 2003
- the domain controller that is the schema master is running Windows Server 2003 SP1 or higher
- the Global Catalog server is running Windows Server 2003 SP1 or higher

There are some switches that you can run them to prepare the environment by preparing the permission required for exchange 2007, preparing the schema, preparing active directory, and preparing domain. Those switches are:

Setup.com /PrepareLegacyExchangePermissions
Setup.com /PrepareSchema
Setup.com /PrepareAD
Setup.com /PrepareDomain or Setup.com /PrepareAllDomains

Note: you can run the 32-bit version of Exchange 2007 from the trial CD to prepare you environment.

Exchange organization
- it is a must to run the exchange organization in native mode
- because of this all Exchange servers running Exchange 5.5 or earlier must be removed

In my case I have to change the organization mode simply by opening the exchange system manager, right click exchange organization, choose properties then choose the change mode button you will get a warning message, click yes, as simple as that.

Server requirements:

.Net framework 2.0
Update KB926776
MMC 3.0
Windows PowerShell 1.0
HotFix for Windows x64 (KB904639)

Also, there are some additional components that you have to install on the server depending on the role you are planning to implement, those are:

For Mailbox server role, you need the following components:

Enable network COM+ access
Internet Information Services
World Wide Web Service

For Client Access Server, you need the following components:

WWW
RPC over HTTP proxy
ASP.NET 2.0

For Hub transport server role, no more components are needed but be sure that the SMTP AND NNTP is not installed. Finally if you are going to use the Edge Transport Role you will need to install ADAM and again make sure that SMTP and NNTP are not installed. In the next article we going to start the setup........

For More Information:

KB Article 904639 - An access violation may occur when you try to run a 64-bit program that uses the interface remoting component of MDAC 2.8 on a computer that is running Windows Server 2003

KB Article 926776 - Microsoft .NET Framework Upgrade

Transitioning from Exchange 2000 to 2007 (Part 1)

Transitioning from Exchange 2000 to 2007 (Part 3) Coming Soon

Transitioning from Exchange 2000 to 2007 (Part 1)

rodney.buike — Wed, 26 Sep 2007 12:11:00 GMT

Mueed Al-Enzi sent us an email about a series of posts he wrote on transitioning from Exchagne 2000 to 2007. What was interesting about his article was that his Exchange 2000 server was also his DC and was on Windows 2000. He had a lot more work to do than normal but since this is a common setup we decided to accept it and post it here. You can see more of his posts as he works on getting his blog up and running.

Transitioning from exchange 2003 to exchange 2007 is easy and straightforward, and there are many articles on the web describing the process. Henrik Walther wrote one of the best articles on this topic at MSExchange.com, but what about transitioning from Exchange 2000 to Exchange 2007 in a situation where you have a single box (Windows 2000 DC and Exchange 2000). This scenario is different and needs a little bit more concentration and preparedness. In this article series (3 parts), I am going to show you my real experience on this issue, enjoy it!

The setup is as follow:

Two Domain controllers running windows 2000 advanced server.
Exchange 2000 is installed on one of the domain controllers.
The FSMO roles had been moved to the domain controller that is not running exchange.

Well, the first thing we have to think about it is to upgrade the domain controllers to windows 2003 before we go through the installation of Exchange 2007, since this is one of the requirements for exchange 2007. Regarding to MS KB325379, there is certain attributes in the schema must be changed before we run the /Forestprep , /Domainprep of the windows 2003, those attributes are:

CN=ms-Exch-Assistant-Name
CN=ms-Exch-House-Identifier
CN=ms-Exch-LabeledURI

These attributes must appear as msExchAssistantName, msExchHouseIdentifier, and msExchLabeledURI. In order to do such change, we can create a script that modifies these attribute in the following way (quoted from KB article:

Log on to the console of the schema operations master by using an account that is a member of the Schema Admins security group.
Click Start, click Run, type notepad.exe in the Open box, and then click OK.
Copy the following text including the trailing hyphen after "schemaUpdateNow: 1" to Notepad.

dn: CN=ms-Exch-Assistant-Name,CN=Schema,CN=Configuration,DC=X
changetype: Modify
replace:LDAPDisplayName
LDAPDisplayName: msExchAssistantName
-
dn: CN=ms-Exch-LabeledURI,CN=Schema,CN=Configuration,DC=X
changetype: Modify
replace: LDAPDisplayName
LDAPDisplayName: msExchLabeledURI
-
dn: CN=ms-Exch-House-Identifier,CN=Schema,CN=Configuration,DC=X
changetype: Modify
replace: LDAPDisplayName
LDAPDisplayName: msExchHouseIdentifier
-
dn:
changetype: Modify
add: schemaUpdateNow
schemaUpdateNow: 1

-

Confirm that there is no space at the end of each line.
On the File menu, click Save. In the Save As dialog box, follow these steps:

In the File name box, type the following: \%userprofile%\InetOrgPersonPrevent.ldf
In the Save as type box, click All Files.
c. In the Encoding box, click Unicode.
Click Save.
Quit Notepad.

Run the InetOrgPersonPrevent.ldf script.

Click Start, click Run, type cmd in the Open box, and then click OK.
At a command prompt, type the following, and then press ENTER: cd %userprofile%
Type the following command: c:\documents and settings\%username%>ldifde -i -f inetorgpersonprevent.ldf -v -c DC=X "domain name path for forest root domain"

Syntax notes: DC=X is a case-sensitive constant. The domain name path for the root domain must be enclosed in quotation marks. For example, the command syntax for an Active Directory forest whose forest root domain is TAILSPINTOYS.COM would be: c:\documents and settings\administrator>ldifde -i -f inetorgpersonprevent.ldf -v -c DC=X "dc=tailspintoys,dc=com"

Note You may need to change the Schema Update Allowed registry subkey if you receive the following error message: Schema update is not allowed on this DC because the registry key is not set or the DC is not the schema FSMO Role Owner. For more information about how to change this registry subkey, click the following article number to view the article in the Microsoft Knowledge Base: 285172 Schema update require Write access to schema in Active Directory “

Now we have to verify that previous attributes had been modified, this can be done through ADSI edit tools (installed as a part of the support tools), under the schema find the attributes (CN=ms-Exch-Assistant-Name CN=ms-Exch-House-Identifier CN=ms-Exch-LabeledURI). Double click each of them, on the attributes tab in the "Select which properties to view" drop down, select either Mandatory. In the next drop down "Select a property to view" select lDAPDisplayName. Then at the text in the box next to value, make sure that the three attributes same as the attribute name without the CN= and the dashes i.e. msExchAssistantName).
Now we can safely run adprep on the schema operations master. To do so, Log on to the console of the schema operations master with an account that is a member of the Schema Admins security group.

Click Start, click Run, type cmd, and then click OK. Where X:\I386\ is the path of the Windows Server 2003 installation media.

X:\I386\adprep /forestprep

Verify that the adprep /forestprep changes have replicated on all the domain controllers in the forest. After that, Run adprep /domainprep on the Infrastructure master. To do so, click Start, click Run, type cmd, and then on the Infrastructure master type the following command:

X:\I386\adprep /domainprep

Verify that domainprep completed successfully, and a replication had been initiated between the DCs. In my scenario, I had a new server (windows 2003 SP1) which I promote it successfully to be the first domain controller running windows 2003, after preparing the schema. After that I had transferred the FSMO roles to the new DC and set it as a Global catalog, then upgrade the old DC to windows 2003 (the one that it is not running exchange).

For more information:

KB Article 325379 - How to upgrade Windows 2000 domain controllers to Windows Server 2003

Transitioning from Exchange 2000 to 2007 (Part 2) Coming Soon

Transitioning from Exchange 2000 to 2007 (Part 3) Coming Soon

Encrypting Additional Drives with BitLocker

rodney.buike — Mon, 24 Sep 2007 12:32:00 GMT

As you may know, BitLocker Drive Encryption only encrypts the C:\ drive. If you have additional drives in your PC, or use an external USB hard drive with your notebook, you can't encrypt that drive with BDE. Officially that is :)

While Vista SP1 will bring support for encrypting the other volumes in your system you can do it today using the command line tool manage-bde.wsf. Now before we get started I must inform you that this is in now way supported by Microsoft. I've tried it, it worked for me, but I highly recommend taking a backup of the data before proceeding!

With that out of the way launch the Command Prompt as Administrator and run the following command to encrypt additional drives:

cscript manage-bde.wsf -on X: -recoverykey Y:\ -recoverypassword

In this example X: is the drive you wish to recover and Y: is the drive the recovery key will be saved to. Remember to backup the recovery key and store it in a secure location. You can store this key on the C: drive (which is encrypted) and it will make things easier when you need to unlock the drive.

Once that is complete you will need to run a command to "unlock" the drive in order to access the data. With the drive plugged in run the following command:

cscript manage-bde.wsf -unlock X: -recoverykey C:\WO97N74A-A99A-9923-C798-45FF0139DDE9.BEK

If you lose the key you can unlock the drive with the recovery password with the following command:

cscript manage-bde.wsf -unlock X: -recoverypassword 846295-102210-220394-001294-333982-001923-094856-223451

Too make it easier I suggest creating a batch file and dropping it in the startup folder.

Encrypt Drive with BitLocker

rodney.buike — Sat, 22 Sep 2007 16:09:00 GMT

We've done a few post on BitLocker around some of the more advanced features and controls. The one thing we haven't touched yet is just how easy it is to encrypt your drive with BitLocker. Before we get started on the procedure a little review of the options you can choose is in order.

TPM Only - This is the easiest to deploy and use. Everything happens in the background invisible to the user.
Dongle Only - This is used with systems that do not have a TPM 1.2 chip. Rather than store the ket in TPM it stores it on a USB key which must be insterted prior to booting the PC
TPM + PIN - This is more secure. In effect it is a form of two factor authentication, what you have (the TPM chip with the key) and what you know (the PIN)
Dongle + PIN - This is another form of two factor authentication again for older systems with no TPM 1.2 chip

Personally I prefer TPM + PIN as I usually store my USB keys in my notebook bag. Should that ever get lost or stolen the person has all they need to get access to the system (at least to a password prompt).

To enable PIN or Dongle capabilities you will need to edit the local computer policy first. We already wrote about that here and here so I won't cover that again.

To begin, the first step is to prep the drive. Prepping the drive creates a small partition, usually called S:, which will store the required boot files. To prep the drive is quite easy using the BitLocker Drive Preparation Tool, on Windows Vista Ultimate it is an Ultimate Extra which you can download and install from Windows Update. For Enterprise edition users it is downloaded from the EA licensing site. With the tool installed it is an automatic process that will reboot the system.

Once the drive is prepped launch the BitLocker Drive Encryption tool by searching for "BitLocker"

Next click on "Turn On BitLocker"

Choose the location of the drive recovery key. This is a crucial file that you will need if something ever need to recover data due to a failed BIOS, TPM chip, motherboard etc... I usually store one copy on a USB key and print one out and store it in a safe.

If you chose to use TPM + PIN you will also be asked to specify the PIN. Once complete drive encryption will begin and run in the background. You can shutdown, reboot, continue working while BitLocker encrypts the drive. Depending on the size of the drive it can take quite a few hours.

If you chose TPM + PIN the next time you boot you will be asked to specify the PIN. If you ever need to recover the data because the BIOS reset (i.e. during a BIOS upgrade) or something happens to the TPM chip (i.e. motherboard is damaged, hard drive moved to a different PC) you will need to either insert the USB key with the recovery key on it

Or click enter and type in the recovery password that you printed out. If you do not have the recovery password there is absolutely nothing you can do. Make sure you have a copy saved in a secure location, oh and the S: drive is not a secure location :)

Introducing Marco Shaw

marco.shaw — Fri, 31 Aug 2007 01:23:00 GMT

I think Windows PowerShell is one of the greatest things to have been released recently (yes, I am a poshoholic).

At TechEd 2007 last June in Orlando, a lot of people were talking about PowerShell. Ben Pearce put together a list of the top 5 questions he was asked while doing demos. I will leave it up to you to check out the questions, which have pretty detailed answers. I am going to start blogging on TLA about Windows PowerShell, and how it can make *your* world a ~~lazier~~ better place. I am hoping that, along the way, I can help you understand and appreciate the POWER of PowerShell, and help you automate your environment or even just help with your regular daily stuff. At any time, please post in the scripting forum, if you have any questions or comments on PowerShell. You can even post your own scripts in other languages, and ask "how do I do this in PowerShell?". I will help you find the answers...

I want you to be as excited as I am about this new technology.

Exchange 2007 was basically *built on* PowerShell, and as of Windows Server 2008 beta 3, it can be easily added to the OS. Come circa 2009, expect PowerShell to be in all Microsoft server products. Why not start to learn it *now*?

Feel free to visit my personal blog (http://marcoshaw.blogspot.com) where I post more general stuff all related to Windows PowerShell.

Manage BitLocker Via The CLI

rodney.buike — Mon, 27 Aug 2007 21:10:00 GMT

We have gone over the GPO settings for BitLocker recently and now we are going to cover the actual configuration of BitLocker on the computer itself. There are two ways, the GUI way, or the CLI way. Today we will focus on the CLI method.

There is one command that allows you to manage BitLocker via the CLI and that is manage-bde. Simply run this from an elevated command prompt and you will see the following output.

To determine the status of the volume simply run manage-bde -status

Before we go any further you will need to have preped the drive with the BitLocker Drive Prep tool. The next step is to initialize TPM. Again there is the GUI method that uses TPM.MSC or you can run the following command.

cscript manage-bde.wsf –tpm –takeownership -<password>

With everything ready you can run the following command to encrypt the drive.

cscript manage-bde.wsf –on –recoverypassword C:

Once complete you can run manage-bde -status again!

Free for a limited time: Windows 2008 e-learning courses

daniel.nerenberg — Fri, 20 Jul 2007 22:44:00 GMT

Hello everyone! it would seem the Lazy Admin is living up to his name :). I just wanted to post about some really cool e-learning course Microsoft is providing for FREE for a limited time only:

http://www.microsoft.com/learning/windowsserver2008/default.mspx#ELEARNING

I'm running through these to get to know the new features in Windows Server 2008. I have started a thread in the forums to discuss them If these courses inspire any cool tricks let us know and we'll post them along with full author credit we'll send you some cool TLA stuff!

Ok back to hybernation...

BDD 2007 Patch 1

daniel.nerenberg — Wed, 04 Jul 2007 12:30:00 GMT

Microsoft has released a patch 1 for BDD 2007. This patch fixes a bunch of bugs. ~~(I'm not sure if it fixed the XP partition bug that I mention in my earlier guides, I'll find out in the next few days as I test it out.)~~

Update 07/09/2007: After testing you still need to use the workaround found in Building a Windows XP Image in BDD 2007 Part 1

You can get the patch here:

http://support.microsoft.com/?id=937191

The link also provides additional information on what has been fixed.