Windows 2003 SP1 RC - updated

The long and eagerly awaited SP1 for Windows Server 2003 has just been released in a RC version for both Intel and Itanium. The SP1 for Windows Server 2003 is essentially a follow up to the security initiatives that was first seen (in large scale) in Windows XP SP2.

It goes beyond this posting to describe the complete list of functionality changes and updates in SP1 but its sure that as consultants and system administrators we are most eagerly awaiting the release of the Security Configuration Wizard that promises to deliver role based lockdown of servers including the ability to -

• Disable unnecessary services.
• Disable unnecessary IIS Web extensions.
• Block unused ports, including support for multi-homed scenarios.
• Secure ports that are left open using IPSec.
• Reduce protocol exposure for Lightweight Directory Access Protocol (LDAP), LAN Manager, and server message block (SMB).
• Configure audit settings with a high signal-to-noise ratio.

Furthermore it uses an extensible XML knowledge base, which lets administrators import existing Windows security templates and lets developers extend the SCW to handle new user defined roles.

You can get access to the SP1 Technical Preview Program and the bits here - so while waiting for the final version of the SP1 - go ahead and test/play with the RC version ;-)

Update ! Remember to download the updated release notes and readme file for SP1 - it contains important information on problems/solutions for e.g. HP Insight Manager and Clustering.

Windows Based Hosting 3.0 & Webcast Series

Tahoma a.k.a. Windows Based Hosting (WBH) 3.0 was released in November and is available for download; so while waiting for the final bits on the Krakatoa release (Hosted Exchange) you can start by looking at the WBH 3.0 solution and the extensive information in the excellent new Documentation Viewer (Although the massive amount of documentation is a bit "scary" at first glance).

Furthermore Microsoft is kicking off a series of Windows Based Hosting Webcasts with the Experts from the Hosting Solutions Unit at Microsoft -

See live demonstrations of technical best practices on the full range of Windows-based Hosting topics, including interactive presentations, product overviews, and question-and-answer sessions. Each Webcast session will be hosted by one of the Windows-based Hosting Solutions program managers discussing how-to technical best practices and thought-provoking business perspectives.

Especially the "Active Directory Guidance for Hosting Service Providers" webcast looks interesting and this time they done something really friendly to us Europeans with 3 timeslots (Based on timezones) for each webcasts (Thanks MS - maybe I'll finally manage to see one of these webcasts ;-)

msgoodies - not an experimental blog anymore

We've been blogging for approx. 2 months now and have found it to be really fun to share some of our knowledge and experiences that we've until now only have shared with our customers and internally (and a bit in newsgroups).
We've already been mentioned on the MS Exchange blog (Thanks Chris ;-) and also our favorite MS bloggers at You Had Me At EHLO... has created a link to our blog (Check the front page under "Other Exchange Blogs") - so now we have decided to remove the "experimental" word from our about box, 'cause Per and I have decided to continue posting and enhancing the content and features of this blog.
Personally I'm finally back from my paternity leave (See my daughter Ida here) and will be back with more info on Exchange, IMF and ISA and updates to some of the topics I've been posting earlier (use our Atom Site Feed for subscription to new/updated posts) .
Per will continue to cover his main areas - from security, networking, AD over to management (MOM 2005 and SMS 2003).

Exchange 2003 IMF / VSAPI fix released for public download

On Exchange 2003 SP1 Servers with VSAPI 2.5 enabled antivirus scanners and IMF installed (On the same box) infected messages are deleted (if configured to do this) but a copy stays in the SMTP queue (until it times out) - Microsoft has publicly released the post SP1 fix for this and you can get further info about the problem and solution here.

Best practice guide for Offline Address Books

I just noticed that a new best practice guide for Exchange has been released. This one discusses "all you need to know" about the Offline Address Books used by Outlook 2003. It's primarily of interest for administrators of enterprise and/or complex Exchange environments - such as Hosted Exchange deployments that in the official HE2003 solution uses separate servers for generation of OAB's.
It also explains how to use the new SP1 OAB network bandwidth throttling option and how SP1 better handles mismatched SMTP addresses (Causing full instead of partial download on Pre-SP1 systems). Check it out here and don't miss out the add'l resources section in the appendix.

Re-released KB 817379 on ActiveSync and OMA errors that occur when SSL or FBA is enabled

This re-released KB discusses a problem (sometimes) occuring on a single server configuration (both Front-End and Back-End Exchange functions on same box). The problem it solves occurs when Forms Based Authentication and/or SSL is enabled on OWA - making the OMA/ActiveSync inaccessible.
The KB has gone through several iterations in both KB 817379 and later KB 822177 and they were both withdrawn from the web. KB 817379 appearently has been updated and re-released - I don't usually memorize KB's but as I can remember the now only 23 step procedure has been updated with both an export and an import (new step) of the Virtual Directory and a new solution (Setting up an FE server) has been introduced (And E2K3 SP1 fixes some of the problems we had with the old solution).

Improvements in Management of Dells

Seems like our job got a little easier.

Microsoft and Dell reports that Dell will deliver management software working with the Dynamic Systems Initiative (DSI) (what we in the real world call SMS and MOM). Read more at Dell Unites with Microsoft to Provide Better Management Solutions and at Dell, Microsoft make a patch pact for servers

Pass Phrases vs. Passwords - Parts 2 and 3

Or “Why you shouldn't be using passwords of any kind on your Windows networks . . .” as my first blog about this subject was called The discussion continues in part 2 and in part 3 of 3 – worth reading.

WUS Open Evaluation program - updated

For those of you who hasn't noticed this yet - Windows Update Services has reached Beta 2 (finally - the last version of WUS that was publicly released was in March as I recall) so Microsoft has relaunched its evaluation program. Information on WUS and registration for Beta download can be found here.
The current version version of WUS will of course update Windows (As SUS already does), but more interestingly it will also update Microsoft Office, Exchange and SQL (Including MSDE) and will in the "near future" also include other Microsoft products.
It will still leverage the BITS (Background Intelligent Transfer Service) platform but now in an updated version 2.0 (As does Windows Update v5) and much more interestingly it will now have the targeting and reporting features that we missed so much from SUS (making it much more applicable for other than small to medium organizations).
I've played a lot with the earlier versions of WUS and it's a big step forward - so go ahead download and test it so that you will be ready for the final release (Check out screenshots of WUS in this article).

ISA Server 2000 Spoofing fix updated (890097)

As I reported earlier there we're issues with the first version of the security hotfix for the problems reported in the Microsoft Security bulletin MS04-039 - this is now corrected in a new version of the hotfix as reported in KB article 890097 "Multiple failures after you install Microsoft Security Update MS04-039" (Thank's to Per for noticing me about this update).

...files that are required for the package to install correctly on ISA Server 2000 Service Pack 1 (SP1) are missing. Additionally, the installer package included a setting that limited installation to Windows 2000 Service Pack 4 (SP4) only.

I haven't had the time to test this hotfix yet so do test the hotfix extensively (as always ;-) before applying it to your environment.

Detecting USN Rollbacks

While reading the Microsoft whitepaper about the support for domain controllers in virtual environments (see earlier post), I came across the KB 875495 article called How to detect and recover from a USN rollback in Windows Server 2003. If you ever setup operational procedures for rolling back your domain controller or your are afraid it could happen in your environment, go ahead and install the 875495 hotfix, so you at least can detect the situation. I recommend that you always install it - better safe than sorry.

Domain Controllers in a Virtual Environment

My normal strategy for handling failed domain controllers is to re-built it from scratch. This is a simple and safe strategy - restores are complex. Virtual environments (and imaging) increases at the risk of having a domain controller restored in an unsupported fashion. The 875495 hotfix is required by Microsoft, if you want support of your virtualized domain controller. If you have plans for virtual DCs, you must read the whitepaper, it also contains other important issues - e.g. remember that your virtual disk must be just as safe as a physical one.

RSS feed for Microsoft Downloads

Working with RSS feeds lately, I contacted Microsoft for an RSS feed for MS downloads. They do not have one, by dragged my attention to a third party one provided by ThunderMain. Very satisfying support from Microsoft. To give ThunderMain credit, I will not link you directly to the feed ;) - but select Resources on their site and find the link below Tools.

XP SP2 / OWA S/MIME fix for Exchange 2003 (KB883543)

I just noticed that Microsoft has publicly released a Post SP1 fix for Exchange 2003 - it corrects a problem that I've been experiencing with S/MIME since the SP2 beta's. It does this by updating OWA to be able to find the S/MIME control (Handles S/MIME and functions like drag-and-drop of files/attachments) on computers running Windows XP SP2. You can find the hotfix here - including a link to the KB (that hasn't been published as of yet).

Make USB Storage Devices Read-Only

A few feature in Windows XP SP2 enables you to prevent writes to these devices. Could be useful in high-security or public environments, when you want to keep data on your systems. Read more in the section called Controlling block storage devices on USB buses in this Micrsoft article.

ISA Server 2000 Spoofing fix (888258)

Just an early warning from me - I've just installed this security fix in two completely different customer environments (and different OS'es - Windows 2000 and Windows 2003) and both of them had to be rolled back. During installation/test there are no problems, but under load the Web Proxy will repeatedly terminate "unexpectedly" and no in or outbound web acces will work. The solution was to uninstall the hotfix on both systems (And one of them actually required me to visit the customer on-site at 04:30 AM) - for now I recommend you to test the patch extensively in your environment and/or use the workaround published at http://support.microsoft.com/kb/889189.

Script Tales - script debugger

Here’s an introduction to the script debugger. If you are running VS.NET use can use that as well. Anyway, the Tales from the Script articles are quite funny to read, so even though you may not learn that much, it’s entertaining.

Configure TCP/IP to use DHCP and a Static IP Address at the Same Time

Sometimes this could be useful - e.g. in a Virtual PC setup, you could have a server with a static address for server-to-server communication and a DHCP address (via NAT or whatever) for accessing the external network. The same could be configured using two NICs, but that typically gives other problems.

Microsoft PasswordUpdater.exe

The MOM 2005 Resource Kit contains a cool utility called passwordupdater.exe. This tool updates passwords (after you change it for the user in AD) on multiple servers in:
- Windows Services (Account Name)
- COM+ Applications (Identity)
- Task Scheduler (Run As)
- AT (Service Account)
- VDirs in IIS (Anonymous User & UNC User)

Force FRS replication from command line!

Finally – a pre Windows Server 2003 FRS update contains several fixes and an important new command argument to ntfrsutl called forcerepl.