2008 Scripting Games, Solution 3

# Advanced Event 3: Instant (Runoff) Winner
# http://www.microsoft.com/technet/scriptcenter/funzone/games/games08/aevent3.mspx

# Load all votes from the file
$allvotes=type c:\scripts\votes.txt

# While-true in lack of a real do-loop construct
while ($true) {
    # Pick up the first name from each line
    $votes=$allvotes | ? {$_} | % {$vote,$null=$_.split(","); $vote }
    # Save the count
    $count=$votes.count
    write-verbose "count=$count"
    # Use Group combined with select and a calculated property to get percentages
    $result=$votes | Group | Select Name,@{Name="Percentage";Expression={$_.count / $count * 100}}
    # Do we have a winner? If a percentage is larger than 50, we do
    if (($result | measure-object -Maximum Percentage).Maximum -gt 50) {
        # Get winner, only one can be returned
        $winner=$result | ? {$_.Percentage -gt 50}
        # Format output as requested
        "The winner is $($winner.name) with $($winner.percentage.tostring('##.#'))% of the vote."
        # Exit while
        break
    }
    write-verbose "Winner not found"
    # Find candidate that needs to be eliminated
    $fewestVotes=$result | sort Percentage | Select -First 1
    write-verbose "Fewest votes $fewestVotes"
    # Modify votes by removing candidate with fewest votes
    # Each line is turned into an array, the array is converted back into
    # a comma-separated line excluding the candidate
    # Note how -ne can be used to remove values from a collection/array
    $allvotes=$allvotes | % {
        $votes=$_.split(",")
        [string]::join(",",$votes -ne $fewestVotes.Name)
    }
}

2008 Scripting Games, Solution 2

# Advanced Event 2: Skating on Thin Ice
# http://www.microsoft.com/technet/scriptcenter/funzone/games/games08/aevent2.mspx

# Construct a hash table for skater,score combinations
$skaters=@{}
type c:\scripts\skaters.txt | % {
    # Split line into name and an array of results
    $name,$results=$_.split(",")
    # Calculate the sum, max and min
    $measure=$results | measure-object -sum -max -min
    # Get the result that counts by excluding max and min scores
    $result=$measure.sum - $measure.maximum - $measure.minimum
    # Calc the average score
    $score=$result / ($results.count-2)
    # Save in assoc array
    $skaters.$name=$score
}
# Get the 3 highest values, GetEnumerator must be used to get name-value properties
$skaters.GetEnumerator() | sort -desc value | Select -first 3 | % {
    # Metal values
    $metal="Gold","Silver","Bronze"
    # Index into metal
    $c=-1
} {
    # Increament metal index
    $c++
    # Write-out winner
    "{0} medal: {1}, {2}" -f $metal[$c],$_.name,$_.value
}

    

2008 Scripting Games, Solution 1

Here's my solution -

# Advanced Event 1: Could I Get Your Phone Number?
# http://www.microsoft.com/technet/scriptcenter/funzone/games/games08/aevent1.mspx

$number=read-host "Enter phone number"
# Combine a pipeline with the foreach statement
# This is necessary as only the first match is needed and break is then used
# to abort the loop
# The pipeline picks words 7 characters long
foreach($word in type c:\scripts\wordlist.txt | ? { $_.length -eq 7 }) {
    # Convert letters to numbers
    if (($word -replace "[abc]","2" -replace "[def]","3" -replace "[ghi]","4" `
        -replace "[jkl]","5" -replace "[mno]","6" -replace "[prs]","7" `
        -replace "[tuv]","8" -replace "[wxy]","9") -eq $number ) {
        # Emit result in uppercase
        $word.toupper()
        # Exit foreach loop
        break
    }
}

Using Live ID (a.k.a Passport) on your own site - for free!

Suddenly, it seems like you can do that now. I checked it out when Passport first came out and at that time you had to pay a lot to use the service. Now it seems to be free! I wonder whether you can integrate it directly into IISv6 - could be nice for customer access to our site and I could also see it used in combination with hosted Sharepoint (that I'm running for a small club - no more messing with passwords and email).

Benefits of Web Authentication

The benefits of incorporating Windows Live ID into your Web site include:

• The ability to use Windows Live gadgets and controls to incorporate authenticated Windows Live services and data into your site.
• An HTTP-based, platform-neutral interface for implementing Windows Live ID authentication in your existing site, even if it is hosted by a third-party.
• Freedom from the technical details of authentication! The Windows Live ID authentication service handles this for you.
• A huge user base: any of the millions of users who have a Windows Live ID can become a user of your site.

Read more in the SDK and get it here.

As soon as Live Id starts to support CardSpace (formerly Infocards) (seems like it is in progress), things are both easy for as well the administrator as the user.

Want to Crash PowerShell?

Try -

$x=1; $x.$y=1

 

It seems like any indirect property reference, when the referencing variable is $null, will crash PowerShell. Consequently, you can do it on any built-in variable like this -

$input.$null=1

 

I will report it to Microsoft. I do not know whether it has been reported or not as my connect.microsoft.com connection to PowerShell does not work :(

2008 (Winter) Scripting Games

Microsoft Script Center has started their yearly Scripting Games February 15 - March 3, 2008.

If you are new to scripting, need a brush-up or are breathing scripts, I encourage you to join.

I will attended the Advanced Division in PowerShell myself. Why do it in VBScript, when you can do it much easier with PowerShell? ;) And Perl I do not know.

I'm planning to publish my solutions as the deadlines have passed.

Have fun

Get Active Directory object GUID one-liner

[guid]((([directoryservices.directorysearcher] "(samaccountname=theuser)").findall())[0].properties.getenumerator() | ? { $_.name -eq "objectguid"}).value[0]

Comments -

• Construct a DirectorySearcher with an LDAP search filter



• Surround expression with parenthesis to use the returned value (this technique is used multiple times)



• Find all objects



• Take the first (and only) by indexing with [0]



• Get the properties



• Convert to an enumerator, so they are available in name-value pairs



• Filter out anything but objectGuid using Where-Object (?)



• Get the first value, as the value is always a collection



• Convert the value - it is a byte[] to a guid, by type-casting it with [guid]

Code Snippet plugin for Windows Live Writer

Update: It actually tested this layout on my test blog, but formatting is definitely not the same: On msgoodies, only the example without alternating and without container is pretty. I will look into this and do another update.

Thank you Leo Vildosola! You just made me a very happy blogger :)

I found his plugin for Windows Live Writer and it works great with PowerShell scripts (as well as Blogger). Inserting well-formatted, color-coded PowerShell code is now as easy as selecting 'Insert Code Snippet', pasting the code and pressing ok (and can even be easier, see the end of this entry). There are only two drawbacks -

1. It is not copy-friendly (see below), as there are no line breaks. But my current method does not have that either
2. The formatting is called MSH and not PowerShell, but I think I can live with that ;)

If you choose a layout with either line numbers or alternate formatting, it becomes copy-friendly.

Some examples

With line numbers and a container (not copy-friendly)

   1: # Set-SMSCacheSize

   2: param([int]$newSizeInMB=2000)

   3:  

   4: $sms=new-object -com UIResource.UIResourceMgr

   5: $ci=$sms.GetCacheInfo()

   6: if ($ci.TotalSize -ne $newSizeInMB) {

   7:     $ci.TotalSize=$newSizeInMB

   8:     "Size set to $newSizeInMB"

   9: }

  10: else {

  11:     "Size $newSizeInMB already correct"

  12: }

Alternating lines, no container, no line numbers (copy-friendly)

# Set-SMSCacheSize

param([int]$newSizeInMB=2000)

$sms=new-object -com UIResource.UIResourceMgr

$ci=$sms.GetCacheInfo()

if ($ci.TotalSize -ne $newSizeInMB) {

    $ci.TotalSize=$newSizeInMB

    "Size set to $newSizeInMB"

}

else {

    "Size $newSizeInMB already correct"

}

No line numbers, no container (not copy-friendly)

# Set-SMSCacheSize
param([int]$newSizeInMB=2000)

$sms=new-object -com UIResource.UIResourceMgr
$ci=$sms.GetCacheInfo()
if ($ci.TotalSize -ne $newSizeInMB) {
    $ci.TotalSize=$newSizeInMB
    "Size set to $newSizeInMB"
}
else {
    "Size $newSizeInMB already correct"
}

No line numbers, no container, alternating lines (copy-friendly)

# Set-SMSCacheSize

param([int]$newSizeInMB=2000)

$sms=new-object -com UIResource.UIResourceMgr

$ci=$sms.GetCacheInfo()

if ($ci.TotalSize -ne $newSizeInMB) {

    $ci.TotalSize=$newSizeInMB

    "Size set to $newSizeInMB"

}

else {

    "Size $newSizeInMB already correct"

}

No line numbers, container, alternating lines (copy-friendly)

# Set-SMSCacheSize

param([int]$newSizeInMB=2000)

$sms=new-object -com UIResource.UIResourceMgr

$ci=$sms.GetCacheInfo()

if ($ci.TotalSize -ne $newSizeInMB) {

    $ci.TotalSize=$newSizeInMB

    "Size set to $newSizeInMB"

}

else {

    "Size $newSizeInMB already correct"

}

In the future, I'll probably stick with the no container, alternating lines style, although I would be glad to get rid of the alternation. I do not like how the container behaves when the browser is resized - YMMV.

BTW: It seems like the copy-friendliness is depending upon whether the generated HTML contains a single <pre> or multiple ones. Alternating lines and line-numbers uses a <pre> per line; without, a single <pre> is used.

Silent Mode

The plugin has another smart feature. You can enable silent mode. With silent mode, your clipboard is inserted with the lastest settings, just by clicking the 'Insert Code Snippet'. If you want to disable silent mode and do something else, simply ctrl-click the link. This is a great productivity feature.

Exchange/OWA/Outlook/WDS search

This will give you the overview in a few seconds - worth a read.

Shame it did not include Sharepoint, but I think a good starting point is here.

WinSxS and Format-Sddl

While cleaning up on my harddisk - how come that I always run out of space not matter how big it is? - I came across the 5 GB in \Windows\winsxs. So could I get rid of these? Surfing the net, I found this article, and no, this seems to be yet another internal Windows folder that you just have to live with. Well the article showed the security of the folder in SDDL format and I liked that format, so why not create a PowerShell script, that could format an SDDL string in the same, readable way? And while I was at it: Why not translate SIDs to account names? As thought, then done -

# Format SDDL strings in a more readable format
# If -TranslateSid is present, Sids will be translated to their account equivalent
param([switch]$translateSid)
process {
    $sddl=$_
    if ($sddl -is [string]) {
        # Simply use the value
    }
    else {
        # If input is any thing else, pick up SDDL property
        # This makes it possible to pipe in the output from Get-Acl or Select
        $sddl=$_.sddl
    }
    # Insert linefeed before G: D: or S: blocks
    # Insert linefeed and indent values in ()
    $sddl=$sddl -replace "([GDS]):","`n`$1:" -replace "(\([^\)]+\))","`n   `$1"
    if ($translateSid.isPresent) {
        # Match all SIDs and translate them to NTAccount format
        [regex]::Matches($sddl,"(S(-\d+){2,8})") | sort index -desc | % {
            # Save value in case translatation fails
            $name=$_.value
            $sid=[system.security.principal.securityidentifier] $name
            # Remove matched value
            $sddl=$sddl.remove($_.index,$_.length)
            # Translate, suppress non-translatable exception
            trap [System.Management.Automation.MethodInvocationException] {continue} `
                $name=$sid.Translate([system.security.principal.ntaccount])
            # Insert translated name
            $sddl=$sddl.insert($_.index,$name)
        }
    }
    $sddl
}

 

The script shows a couple of techniques -

• Testing the type of pipeline input and using it accordingly



• Use of regular expressions for replacement and picking up values from the matched values ($1)



• Use of the regex object to walk-through the matched values. This is necessary in cases where the new value needs to be calculated.



• How to translate a SID string to an account name using the .Net classes in system.security.principal namespace



• How to suppress a specific exception using a trap statement

 

Example of how to use it -

Have fun!

x64 Clients on Hyper-V

This is almost too easy. Just create a client - you do not have to specify 32 or 64 bit anywhere. Select a 64-bit installation image and on you go.

Here's a screenshot, the white PowerShell window is from the host, the rest from the virtual server.

 

Nice!

Importing Virtual Server guests into Hyper-V

As said, I was going to figure out why the import failed. I started off looking at the permissions of C:\ProgramData\Microsoft\Windows\Hyper-V. It turns out that a security identifier called Virtual Machines has full control. Naturally, I jumped to my c:\guest\psk10 folder at tried to add the security identifier. But the dialog box cannot find it and as it is not a local group on my server, it must be a new built-in security identifier - one that the brand-new WS08 GUI does not recognize!

Luckily, PowerShell exists, so it is quite easy to get rid of all that GUI translation stuff and get to the real deal -

I bet S-1-5-83-0 is Virtual Machines and a to confirm it, I went searching on MSDN -

• WELL_KNOWN_SID_TYPE Enumeration - nope
• Well-known SIDs - nope
• Well-known security identifiers in Windows operating systems - nope

So I have to prove my point myself -

> $acl=get-acl C:\Guests\psk10
> $acl.SetSecurityDescriptorSddlForm( ($acl.sddl + "(A;;FA;;;S-1-5-83-0)(A;OICIIO;0x101f01ff;;;S-1-5-83-0)") )
> set-acl C:\Guests\psk10 -AclObject $acl
>

Voila, its there -

Microsoft, get you documentation up-to-date!

After this, I tried the import. Looking in the eventlog, I found "Failed to find virtual machine import files under location 'C:\Guests\psk10\'." I wonder: Have I misunderstood "Import" and is Import simply an operation that adds an existing Hyper-V Virtual Machine? Is there not easy way to migrate Virtual Server guests? Maybe, I have to look at SCVMM.

I tried to find some information about this, but did not succeed. In my search, I found another interesting item - the team blog at http://blogs.technet.com/virtualization/

A first look at Windows Server 2008 and Hyper-V

After downloading the Windows Server 2008 RTM, yesterday, I upgraded my RC1 system to RTM. No problems what so ever - great.

Hardware

My system is a desktop, a Dell Dimension E520 with 4 Gigs or RAM and I am very satisfied with it: It is silent, uses only 130 W when idle and runs 10 Virtual Machines each having 300 GB without problems. If they all apply hotfixes or are running similar IO heavy activity at the same time, you feel the IO bottleneck but besides that, its quite fast.

Installation

Next, I was looking a how to get Hyper-V running, so I could get rid of Virtual Server. Even though I was quite happy with that, you know how it is: You have to try the latest and the greatest. When things starts to run well, it is time to change it...

Well, it turns out that the pre-release of Hyper-V is part of the RTM installation, so I simply added the Hyper-V role to the server and restarted it. After restart it is a matter of finding Administrative Tools and select Hyper-V Manager. You also have to accept a pre-release EULA.

Migration of Virtual Server guests

I started trying to import an existing Virtual Server guest, but got a badly written error message: The operation was passed an invalid parameter. I tried both with and with-out 'Reuse old virtual machine IDs' (whatever that means - haven't found a help topic yet). I also tried to give NETWORK SERVICE modify access to the folder, as I can see the Microsoft Hyper-V Image Management Service uses that account. Did not help either.

Snapshot

Next, I created a new Virtual Machine and liked a lot that I asked me about OS installation in the wizard. I selected a Windows Server 2003 SP2 ISO image and off it went. I started to play with snapshots and took one while the installation had copied 6% of the files. Then I waited until it reached 9% and applied the snapshot - and I was back in time. Very nice.

I also tried the other scenario, where you can create a new snapshot before applying one. Soon, I had a bunch of snapshots and it is very easy to jump back and forth between the versions - but I guess, it is also very easy to get confused and you have to take care if the server is a domain controller or your have some other kind of distributed system.

Mouse Control

A small warning: When you use the new remote control feature - called Virtual Machine Connection - your have to release your mouse using CTRL+SHIFT+LEFT ARROW. Well, I did not succeed in that across Remote Desktop. I had to visit the server (approx 60 cm behind me!) and do it from the console. It is configurable, but CTRL+ALT+SHIFT did not work either. I could only make it work in full screen or if I choose to send "Windows key combinations" to the remote server. For me, this is a bug.

But as I browsed the web trying to find something about the importing problem, I found out that this is actually already documented in the release notes. Quote "The use of Virtual Machine Connection within a Terminal Services session is not supported".

BTW: If you disconnect and re-connect, you can get your mouse activated outside of the Virtual Machine Connection window. If your server is farther away than mine, that may be an option.

Resume after restart of host

Another good thing: With Virtual Server you had to configure an account, to enable a Virtual Machine to start automatically. This is not the case with Hyper-V. Actually, "Automatically start if it was running when the service stopped" is selected by default.

Conclusion so far

Seems ok, but I have to look more closely at the importing problem and the scripting interface.

FYI - Visio Stencils for OCS 2007

A set of stencils for OCS depicting the server roles and components can be downloaded from here.

Windows Server 2008 and SP1 RTM'ed

Quick note - Windows Vista SP1 has RTM'ed according to the Vista blog and Windows Server 2008 also RTM'ed check more about this in the press release.

Update - want to know more about SP1 and the availability then check Paul Thurrot's FAQ

Tips for upgrading to Exchange 2007 SP1

FYI - Rui Silva has produced a good checklist to use before upgrading to SP1 called Notes from the field furthermore Andy Grogan from telnet 127.0.0.1 has a tip for installing the management tool on XP, when you have problems with the Remote Registry service.

Table/Collection lookup with PowerShell

If you have to lookup data in a collection repeatedly, that can be quite slow.

Let us say you have two collections and want to update one collection based on some criteria from the other. You can do it like this -

$collA | % { $itemA=$_; $collB | ? { $_.key -eq $itemA.key} | % { $_.value=$itemA.value } } 

But in this scenario, you have to iterate $collB for each of the value in $collA. This is not efficient, especially not when you have plus 50.000 elements in both collections.

As a way to speed things up, you can build a lookup table. Note that this only works, if the key is unique in $collB. The best choice for this is an hash table. You create it like this -

$collB | % {$hashB=@{}} {$key=$_.key; $hashB.$key=$_}

Now you can use the hash in your code  -

$collA | % { $itemA=$_; $key=$itemA.key; $objB=$hashB.$key; $objB.value=$itemA.value }

The traversal of $collB is replaced by a much faster hash table lookup.

If you only need to know whether the value is in $collB, just do like this -

$collA | % { $itemA=$_; $key=$itemA.key; if ($hashB.$key) { "found" } }

I did a performance comparison (with only 500 items) so you can see the difference -

# Build two collections

1..500 | % { $collA=@(); $collB=@() } {
	$c=$_
	$collA+="" | select @{n="Key";e={$c}},@{n="Blah";e={$c+100000}}; 
	$collB+="" | select @{n="Key";e={$c}},@{n="Blah2";e={$c+200000}};
}


# Run 'normal' lookup

measure-command {
	$collA | % { $itemA=$_; $collB | ? { $_.key -eq $itemA.key} | % { $_.blah2=$itemA.blah+100000 } }
}
# It took 27,3 seconds

# Build hash and run hash lookup

measure-command {
	$collB | % { $hashB=@{} } { $key=$_.key; $hashB.$key=$_ }
	$collA | % { $itemA=$_; $key=$itemA.key; $objB=$hashB.$key; $objB.blah2=$itemA.blah+200000 }
}

# It took 0,1 seconds

Do I need to say more?

Problems Running the Certificate Wizard on the OCS Edge Role

when requesting certificates from an online authority (E.g. your own PKI server like smbex01.nwtraders.com\certsrv) ?

If you end up receiving this failure -

Then it may be because you didn't install the Root CA certificate \ Subordinate CA certificates - try this and try again - then it just might work (But anyway not always is my experience ;-)

"One Gateway equals one Medation Server"

This has been the mantra since the early betas of OCS . But now there seems to be a solution using SER made by the same author who also released the LCS / SER / Asterisk solution.

This is the current functionality -

• One OCS Mediation routing to Many SIP Gateways - Yes
  
• Outbound from OCS Call Completion - Yes
  
• Inbound into OCS Call Completion - Yes - Does not route through SER
  
• Far End/Telephone Disconnect/Hangup - Yes - Does not route through SER
  
• Near End/OCS Disconnect/Hangup - Yes - Does route through SER

And this is the author's own visual representation of the call flow-

Find the full description and ser.cfg configuration file here.

Troubleshooting Update Server for Tanjay devices a.k.a. Office Communicator Phone Experience ;-)

So I'm catching up on my RSS feeds after a hectic 2007 occupied with delivering boot camps all over Europe and supporting the attendees either directly or via our UC Boot camp forum.

Chad Lacy has a good post on Troubleshooting the Update Server that you can find here - it does answer some of the questions I've received, so even though it is from November I thought I would refer to it.

Also if you are interested in Tanjay's then remember to follow Jens Triers' blog.

Office Communicator/Call Button Integration Support Kit for LifeCam / LifeChat

Here's a nice little tool for Microsoft LifeCam's. It solves the problem we have in our UC boot camp labs, where pressing the hardware button on the webcam will cause Live Messenger to launch -

Microsoft headsets and webcams are optimized for Windows Live Messenger through the Call Button. Until now, there has not been a simple means to configure the Call Button to start Office Communicator. The goal of the Call Button Integration Support kit (the kit) is to change that.

Find the kit here. Seen here on Aaron Tiensivu's blog.

New Office Communications Server Blogs to watch

There are a few relatively new Microsoft blogs out there to watch that I wanted to point you to -

Jens Trier Rasmussen - Jens is an old seasoned Microsoft consultant (Also from Denmark) that has worked a lot with Exchange and OCS and lately have been supporting the Voice Partners during the beta's. He already has some good posts on OCS in his blog so go check it out here.

Flight Deck / Chad Lacy - Chad is a Microsoft engineer from Charlotte, North Carolina (Where some of my other good contacts are placed). His description says "Discussions about Unified Communication, LCS/OCS, VoIP, and more" and he is the first person, besides me, that I have seen holding both MCSE certification and a MBA degree ;-) Find his blog here.

Karsten Palmvig - Karsten is another Danish Microsoft consultant who used to be primarily a Exchange expert (Like Jens and I actually). His description says "Notes from the field on Exchange, OCS, UC and DPM..." find his blog here.

Windows Home Server Transport Service problem

Suddenly I started receiving the following error message from my WHS "Windows Home Server Transport Service encountered a problem" when logging in to the machine and I get the option to Send an error report. This would happen 5-6 times before stopping.

Google didn't find any solutions (Neither did connect - I was also beta tester of WHS) so I thought that I very quickly would summarize it here. Looking in eventvwr revealed several problems but this one quickly got my attention -

Event Source: DCOM
Event ID: 10016
User: NT AUTHORITY\NETWORK SERVICE
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {BA126AD1-2166-11D1-B1D0-00805FC1270E} to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20). This security permission can be modified using the Component Services administrative tool.

Follow the help link for detailed explanations on how to change DCOM security.

Finding the CLSID in registry revealed it was the "Network Connection Manager Class" but I couldn't find it in DCOMCNFG. I then Googled again and found that it is listed as "netman" and I gave the Network Service Local Activation rights and rebooted. Problem fixed ;-)

It looks like this is also a known SBS 2003 problem and if you didn't know WHS is partly based on SBS 2003 (Which you can see in the Help and Support Center as it states it is running "Microsoft Small Business Server 2003"

Enable Power Management on WHS (and thereby also Windows Server 2003)

I am playing with my newest toy, Windows Home Server (WHS), and I must say that this is by far the niftiest "little" piece of home software I have had my hands on (I may review it later - but if you don't know it then download the trial version and install, find your add-ins here and especially look at the Webguide for Windows Home Server and the Avast Professional Family Pack, which includes a WHS add-in).

To save power and space I have setup a portable computer with an external harddrive and now I was surfing around to find out how power management works with WHS.

There where different more or less clever solutions from shutting down at midnight and then using a timer device to turn it on again to more advanced solutions, but by far the best solution I found is using the built-in features of Windows Server 2003 together with a portable computer (In my Case a Dell D830 with 3 GB RAM, Core 2 Duo and 160 GB 7200 RPM disks). 

These built-in features are explained and detailed in the whitepaper How to Enable Processor Power Management in Windows Server 2003 and applies of course to all server versions (I have used it before on my Shuttle that I use for Virtual Server labs with standard Windows Server 2003).

Another add-in I used was Marcel Nouwens free AutoExit 2008 for Windows Home Server that can do Wake-On-Lan (Perfect for my Shuttle) and handle remote shutdown, reboots, send messages or even open a Remote Desktop session) - so now I almost have my perfect home network / WHS solution running (I'm still awaiting a few add-ins so I can remotely stream MCE recorded TV (Should release in late January) and a add-in for total Desktop Management, I need my 802.11n to run better and the list continues endlessly ;-)

OCS 2007 Security Overview Whitepaper

Microsoft has released a introduction to security in Office Communications Server 2007 and its related clients (Actually back in August 2007 - but I forgot to mention it).

Instead of re-writing the introduction here is a snippet from the whitepaper "Office Communications Server 2007 – Security Overview" published by Microsoft in Augusth 2007 -

"The use of the Internet for instant messaging (IM) technologies, audio/video, and Web conferencing has been evolving since the first widely used Internet and GUI-based product, ICQ, first entered the market in November 1996 (quickly followed by AOL, MSN, and Yahoo! as the largest competitors)....

The responsible IT or security administrator has in many cases sought to fight the infiltration of the consumer products, because many shortcomings exist in the use of these technologies in a business environment. Besides the security risks and disclosure of sensitive business information that we will discuss later, these technologies have associated shortcomings in central management, in compliance management and records retention, and as a target for thieves who use them to gain sensitive business information.

This whitepaper will discuss the security features in Microsoft® Office Communications Server 2007 (OCS 2007) as it relates to the Microsoft unified communications platform and how OCS 2007 handles these security challenges in a connected world, while still delivering on the promise of presence, IM, VoIP, audio/video conferencing, and Web conferencing capabilities."

The whitepaper then continues to discuss concerns around privacy, methods of traversing firewalls in Public Instant Messaging Products etc. For OCS it discusses security in different types of users/clients, security in autoconfiguration, Network and Data Security and lastly compliance and archiving.

IMHO it's worth a read if you are new to OCS and Security, but then again who am I to judge that ;-)

Find the whitepaper here.

Btw. If you wan't to find some Easter eggs in the whitepaper then take a look at the country code for phone numbers and the text part in the last screenshot (Remember I'm from Denmark and work in a company called Inceptio ;-)

Advanced Topologies for Microsoft Office Communications Server 2007 Networks

AudioCodes is conducting a interesting Web Seminar on the following topics -

Discover advanced topologies for integrating AudioCodes VoIP Gateways into OCS environments, enabling smooth and cost effective migration of existing TDM-based enterprise networks, including:

• Simultaneous Connection to both OCS & Exchange Server 2007
• Drop & Insert configuration for simple and cost-effective PBX connection
• Implementing Fax adapters with OCS
• Enabling connectivity to non-certified IP-PBX and Cisco Call Manager
• And more..

Probably also some marketing related stuff is included, but thats how it is ;-)

Find the links for registration here

Thursday, Jan 31^st, 2008, 10:00AM-11:00AM CET (Central European Time)
Thursday, Jan 31^st, 2008, 05:00PM-06:00PM SGT (Singapore/Hong Kong Time)
Click to register or copy the following url:
https://audiocodes-training.webex.com/audiocodes-training/k2/j.php?ED=2252547&UID=995195367&FM=1

Or

Thursday, Jan 31^st, 2008, 10:00AM-11:00AM PST (Pacific Standard Time)
Thursday, Jan 31^st, 2008, 1:00PM-2:00PM EST (Eastern Standard Time)
Click to register or copy the following url:
https://audiocodes-training.webex.com/audiocodes-training/k2/j.php?ED=2253242&UID=995196892&FM=1

cu there !

Office Communications Server 2007 Resource Kit

This must have and long-awaited book by Jeremy Buch, Rui Maximo and Jochen Kunert has now published. I know two of the authors and have seen some of the chapters including the OCS 2007 Resource Kit Sample Chapters published back in August and they are certainly worth reading for anyone who wants to go deeper than the wizards in OCS (Personally I learn best by reading, so I love these deep-dive resource kits).

There is one gotcha though that I saw some time ago. If you follow the Amazon link from MSPress on then you will end here -

It has a SRP of $59.99 and is already discounted to $35.99, which is not bad at all. But as you see in the top there's a small link to shopping at Amazon.co.uk (Which is interesting to save shipping costs), resulting in the following -

the SRP is only discounted with 5% instead of 40% resulting in a total pricing that is doubled to approx $71,00 (With the normal overpricing we always pay on US books that have pricing in €/£/$) - Not good enough Amazon !

Anyway I have been promised a free copy of the book, but if you are out to buy one then watch out (And do consider shipping from US as a viable option).

Group Policy Diagnostic Best Practice Analyzer

A new kid is in down: GPDBPA. Give it a spin and see if your Group Policies and associated infrastructure are in shape. Find it at MS Downloads using this search.

A simple and clever way to create a custom object

In BS on Posh I found a simple and clever way to creating a custom object. Personally, I have been using one of these method -

$obj=New-Object object

Add-Member -InputObject $obj NoteProperty Column1 $null

Add-Member -InputObject $obj NoteProperty Column2 $null

Add-Member -InputObject $obj NoteProperty Column3 $null

$obj.Column1="Value1"

$obj.Column2="Value2"

$obj.Column3="Value3"

or -

$obj=1 | Select-Object @{Name="Column1";Expression={$null}},`

@{Name="Column2";Expression={$null}},`

@{Name="Column3";Expression={$null}}

$obj.Column1="Value1"

$obj.Column2="Value2"

$obj.Column3="Value3"

As BS shows in Using Switch -RegEx to create Custom Object (Getting HBA Info), you can do it much simpler -

$obj="" | Select-Object Column1,Column2,Column3

$obj.Column1="Value1"

$obj.Column2="Value2"

$obj.Column3="Value3"

I am aware that you can assign a value to the columns in the first two methods directly and thus make that code shorter. But typically, this construct is used in a loop and you often do not have the column values directly available. In these cases, the elegant Select-Object Column1,Colum2,Column3 is preferable.

A warning

Do not get trapped by using this construct/pattern -

function DoubleNumbersTest {

    $obj="" | Select-Object Number,DoubleNumber

    1..10 | % {

        $obj.Number=$_

        $obj.DoubleNumber=$_*2

        $obj

    }

}

When you look at the output, it may seem fine, but if you use the output objects for something, you will realize, that you in fact only have a single object. An object must be created for each output. Try it yourself -

DoubleNumbersTest # seems fine

$numbers=DoubleNumbersTest

$numbers # what a strange output ;)

6 tips for reducing e-mail overload

New Year - a happy one I hope for all of you reading this - is often a time of year used to consider whether old habits should be changed.

I found this article very inspiring and I hope you will as well. Spent the few minutes it takes to read it and let us all help in using email as the productivity tool it is.

 

Lately, more people are declaring bankruptcy. No, they’re not financially insolvent. They just can’t keep up with e-mail. They empty their inbox, announce e-mail bankruptcy, and start over from scratch.

Don’t let it happen to you. Get a grip on the problem before it is too late.

Continue...

Microsoft Hotfixes can now be downloaded directly from the KB article!

Got the info from Under the Stairs, but decided to echo it here as it is so useful to know. Not all KBs are ready though. In the end, this is the link you want to have: https://support.microsoft.com/contactus2/emailcontact.aspx?scid=sw;[LN];1414&from=KBHotfix&WS=hotfix

 

And may I add: It was about time...

PowerShell Character Ranges

PowerShell has a range operator. I you want to express the numbers from 1 to 5, you can specify that as 1..5. 1..5 actually build an array (object[]). One question I had during training was: Can the range operator be used on characters? The simple answer is no, but you can achieve the same with a small work around. Say you want to check the drive letters between F and M -

[char]"f"..[char]"m" | Foreach-Object { "Checking " + [char]$_ }

 

if the numbers are not in a sequence, you can use on of these -

"fgmr".toCharArray() | Foreach-Object { "Checking " + [char]$_ }

"fgmr".getEnumerator() | Foreach-Object { "Checking " + [char]$_ }

"f","g","m","r" | Foreach-Object { "Checking " + [char]$_ }

 

BTW: The range operator is limited to 50,000 elements - try 1..60000 and see the error message. If you need to go from 1 to 100,000, you can either do a for statement -

for($i=1;$i -le 100000;$i++) { blah }

or

1..50000+50001..100000 | { blah }

 

 

 

 

Got inspired by Oisin / Nivot Ink.

Posters

In line with the Windows Server 2008 posters, there is also an Exchange Server 2007 Component Architecture poster available on MS Downloads.

OCS/Asterisk integration work in progress

FYI - if you are interested in creating a test environment with Asterisk PBX, then you should take a look at Ryan Newington post on this or better yet subcribe to his RSS feed to get the updates.

Office 2007 SP1 fixes for Office Communicator/presence

These are from the Office SP1 Whitepaper

• Microsoft Office Communicator 2007 now presents more accurate presence information and does so with consistent visual cues.
• The icons used to display presence are modified so that users who are red-green colorblind can determine people’s presence status.
• Office Communicator 2007 no longer causes presence icons to flicker when multiple people appear simultaneously.
• Presence information in Office Communicator 2007 and other Microsoft Office applications is consistent in all scenarios (So this applies to SharePoint to).
• Microsoft Office Outlook® 2007 no longer starts in the background along with Office Communicator 2007.
• Office Outlook 2007 no longer allows users to send instant messages to entire distribution lists when deployed in conjunction with Microsoft Office Communicator 2007.

Following are the KB articles referenced in the SP1 xls file

• KB936871 When you sign-in to Communicator, Outlook is started in the background. For example, when you check Task Manager, the Outlook.exe process is running. Additionally, Outlook-related items, such as meeting reminders, may appear.
• KB936871 To check for a missed conversation, you click the "Voice Mail" search folder in Outlook 2007. Or, you click the "Missed Conversation" notification in Microsoft Office Communicator. If you then check for a missed conversation in the same session of Communicator, you receive a notification that states that Outlook could not be started.
• KB937212 When a message is saved as a missed conversation in the Microsoft Office Communicator folder in Outlook 2007, the message indicator for the folder does not indicate a new, unread message.

Find SP1 on Microsoft Update or at the download site.

Select NULL from Addresses?

Well, sometime I feel like nothing, null, zip, empty - but do they have to remind me???

On the other hand: A null may need some eLearning...

Set-NotepadFontSize.ps1

Small, but useful if you like I do change the font size all the time (e.g. for presentations/training/old eyes) -

param($fontSize=14)
Set-ItemProperty HKCU:\software\microsoft\notepad iPointSize ($FontSize*10)

If only Notepad supported Ctrl + Scroll Wheel for zooming...

Disabling (bypassing) Group Policy

Group Policy settings - including Software Restriction Policies - can easily be disabled - even by a standard user. Terrible! Read the full story in Security UPDATE from WindowsITPro magazine this week. The article sums up the story so far and contain links to other relevant articles.

Some of those articles require an account to read, so if you want to get to the hard facts right away, see the GPCul8r tool. I exteacted this from the readme.txt -

============
How it works
============

In order to do its thing, GPCul8r.dll needs to be loaded into the process space of whatever program needs to bypass group policy.  Once loaded, GPCul8r works by detouring calls to the ZwQueryValueKey function to see if the program is querying one of the keys related to a group policy setting we want to bypass.  If so, GPCul8r returns STATUS_OBJECT_NOT_FOUND, thereby tricking the caller into thinking the key doesn't exist.

GPCul8r being a quick & dirty little tool is not configurable.  The targeted key names are hard-coded in the source.  They are:

- TransparentEnabled (controls software restriction policy settings)
- ProxySettingsPerUser (controls access to the IE proxy settings dialog)
- DisableRegistryTools (duh)
- DisableTaskMgr (duh)

For more on the technique that GPCul8r uses, see Mark Russinovich's original article on the subject:
http://blogs.technet.com/markrussinovich/archive/2005/12/12/circumventing-group-policy-as-a-limited-user.aspx

The consequence: Everything below User Settings\Administrative Templates - e.q. every policy user level (as compared to kernel level or system level) code pulls out of the registry can be bypassed! If you want to counter this - read Mark's comment -

The bottom lines is that full control of an end-user environment is possible only with strict lock-down of the programs users run, something that you can accomplish by using SRP in white-list mode, for example. It's also important to note that the ability of limited users to override these settings is not due to a bug in Windows, but rather enabled by design decisions made by the Microsoft Group Policy team.

I do not know, whether Vista improves this - but I certainly hope!

Exchange 2007 SP1 and OCS UM notes and gotchas !

So you've download Exchange 2007 SP1 and want to install it on your UM server that is integrated with OCS!?

If this is your first OCS integration then you should start is by downloading the documentation and if you've earlier downloaded the Office Communications Server and Client Documentation Rollup then you should go to the Office Communications Server 2007 Technical Library and find the documents updated to version 1.1 (Quite a few of the planning and deployment guides are updated to version 1.1 - not the Enterprise Voice Planning and deployment guide though)

Then the next place you should start reading is the SP1 Release Notes and especially the part covering Unified Messaging and "Issues related to the Unified Messaging server role"

In short the important general issues are -

• The Unified Messaging Server role must be installed on a dedicated role (Like in the Beta's)
• Configuration data is overwritten during installation !
• You must remove any language packs installed before installation of SP1

And most importantly when integrating with OCS the following issue apply -

• The Exchange UM server itself cannot request the MRAS credentials required to initiate an outbound call to a remote user (A user on the Internet External to the Edge), so for Play on Phone to work in this scenario the UM Server role needs to have cached credentials from a previous incoming call and reuse these !! (Read the full evasive explanation in the Release Notes)

There are a few other smaller issues applying to OCS/UM but the above is by far the most important one (And I guess hours could be spent troubleshooting if you are not aware of this issue)

Exchange 2007 SP1 available for download

As announced yesterday in the TechNet flashes Exchange 2007 SP1 is now available for download here.

Of course I'm most interested in the Unified Messaging enhancements, but there many other interesting improvements as the import/export of PST files which is very interesting for our migration projects (And we also look forward to better stability of the product due to all the included fixes)

Following is an overview of the changes from the download site -

Anywhere Access

• Integrated Exchange Unified Messaging functionality with Microsoft Office Communicator 2007 and Microsoft Office Communications Server 2007.
• Outlook Web Access additions, including public folder access, S/MIME support, personal distribution lists, and mailbox rules editor.
• Webready document viewer supports Microsoft Office 2007 documents in addition to Microsoft Office 2003 documents.
• Extended language support in Outlook Web Access with Arabic and Korean spell checking.

Operational Efficiency

• Support for Windows Server 2008 deployments, including benefits in flexible clustering, advanced networking, and simplified management.
• Additional tools in the Exchange Management Console, including public folder management and configuration options for clustering and POP/IMAP access.
• Improvements to the Exchange Management Shell syntax and import-export PST in the move-mailbox command.
• Wider variety of web services for application development, including public folder access, delegate management, and folder level permissions.

Built-in Protection

• Addition of Standby Continuous Replication (SCR) for site resilient high availability deployments.
• Extended Exchange ActiveSync policies for mobile policy enforcement.
  Information rights management pre-licensing by the Hub Transport role.
• Secure Real Time Protocol (SRTP) support in the Unified Messaging role.
  Support for IPv6 when using Windows Server 2008.

Invoke-VbScript

Note: The script has been updated, see this post.

One of the best features of PowerShell is the ability to do the same on the command line as in a script. Even Command Prompt do not support than.

But as VBScript is not dead yet - I'm currently doing more than 3000-lines of it - this script is useful as it allows you to execute VbScript interactively. It has two uses: 1) Test VBScript details without having to run a huge script 2) Use VBScript features than you do not know how to do in PowerShell.

The script Invoke-VbScript.ps1

param($vbCode,[switch]$ExecuteStatement)

function PrepareVB {

    $vb=new-object -com MSScriptControl.ScriptControl
    $vb.language="VBScript"
    $vb
}

$vb=PrepareVB
if ($ExecuteStatement.isPresent) {
    $vb.ExecuteStatement($vbcode)
}
else {
    $vb.Eval($vbcode)
}

Execute command example -

PS> Invoke-VbScript -exe 'msgbox("hi")'

Evaluate expressions and return result example -

PS> $name=Invoke-VbScript 'InputBox("Enter your name","Test")'

Have fun!

VMRCplus v1.6

Just saw that VRMCplus that I wrote about earlier has been updated to v1.6. Get it here.

The changes are (taken from this blog post)

So what is new in 1.6.0?
First of all, the UI reflects Virtual Server terminology. Both Paul and I had used a mix of Virtual Server terminology and internal (SDK) terminology. To reflect the terminology used in the web administration UI of Virtual Server, the terminology of VMRCplus has been updated.
Second, VMRCplus now offers configuration of scripts on both the Virtual Server and Virtual Machine level. This was missing from the previous release.
Third, VMRCplus offers configuring promiscuous mode on the network so you can trace traffic in the virtual switch. This is something Virtual Server does not offer in the web administration UI.

Of course there have been minor enhancements like storage of Console Manager coordinates, conflict handling when a shortcut already exists (something Virtual Server fails to resolve).

The COM and LPT port assignment logic has been fixed (most of it did not work).
The x86 installer package no longer installs on x64. This has been done to prevent issues with 32-bit VMRCplus on 64-bit Virtual Server.

Error handling has been enhanced and several issues have been fixed.

Met MOW

I managed to meet MOW at Ask-the-Experts today. MOW is famous within the PowerShell community for his PowerTab function and he is running thepowershellguy.com blog.

If you haven't done so already - get a copy of Powertab now!

Well, it was fun meeting him and discuss some of the features I'm missing. On is -

• dir $folder\[tab] should expand into dir $folder\file

An I gave my regards for PowerTab as such and the new constructor feature - try it yourself -

• [system.diagnostics.process]:

Anyway, the PowerShell v2 CTP enables him to do a full tokenizing of the command line, so even better  intelligence will be possible.

Viridian becomes Hyper-V

Marketing is a strange beast. Server virtualization in Windows Server 2008 - e.g. the replacement of Virtual Server - will be called Hyper-V. I already hate that name! HyperV perhaps - but why the hyphen??

Anyway, Hyper-V will be a server feature that can be turned on. Microsoft is also planning a Hyper-V Server SKU.

Hyper-V is still expected to be delivered 6 months after Windows Server 2008.

On the management side, it was demoed at the keynote here in Barcelona, a virtual server manager that could manage Virtual Server 2005, Hyper-V *and* WMware server!

Teched IT-Forum Barcelona

(I apologize for these reposts. Windows Live Writer does not seem to be able to edit posts!?)

This is the first time I'm using the released Windows Live Writer to post here, so bear over with me if it does not work as expected ;) The new Windows Live Writer seems to support pictures and formatted PowerShell scripts, so it is much better than using the webpage.

In this year's Teched IT-Forum I'm going to focus on Windows Server 2008 and the System Center products - most ConfigMgr and OpsMgr. And then this is going to be a great PowerShell week. The CTP of V2 has been released and I hope to get in touch with some of the PowerShell staff as I have about 45 things I would like to discuss with them. I also hope to get in touch with some of the other people from the community.

Microsoft Quality of Experience Monitoring Server RTW'ed

After you've deployed OCS and enabled Enterprise Voice (Even works with PC to PC Communication) you will get calls from users saying that I had this & this conversation and voice quality was really bad.
During the OCS beta's the only answer was "hmmmm .... ok - can you try again" but then later the rescue came from the QoE Monitoring Server Beta, which has now RTW'ed -

The QoE Monitoring Server is a new server role for Microsoft Office Communications Server 2007 Standard Edition or Enterprise Edition. It provides the information that you need in order to better understand the media quality that your users are experiencing in your Office Communications Server 2007 deployment. With QoE Monitoring Server, you can do the following:

• Gather statistics on media quality of locations or based on a grouping of subnets
• Proactively monitor and troubleshoot media quality of experience issues
• Perform diagnostics to diagnose VoIP user complaints
• View trends which can help you with post-deployment growth and measure results against the service level agreement

The QoE Monitoring Server collects quality metrics at the end of each VoIP call from the participant endpoints, including IP phones, Microsoft Office Communicator 2007, the Microsoft Office Live Meeting 2007 client, and Microsoft Office Communications Server 2007 A/V Conferencing Server and Mediation Server. These quality metrics are aggregated and stored in a SQL database. The data can then be used to alert you to abnormal media quality conditions and also to generate routine media quality reports.

Find it here