Virtual PC 2004 SP1.27 Upgrade Experiences

This is a follow-up to my earlier post.
So I tried to update. But the SP1.27 (as I now call it) said the software already was installed. I went into Add/Remove Programs and uninstalled SP1. Planning on rebooting later, I found that the uninstall made all my network adapters unusuable. Normally, the install disables networking temporary, but this time they simply did not work afterwards.
After rebooting, I realized that Virtual PC was completely uninstalled. I installed the RTM version again and applied SP1.27.
Now both Help, About and Add/Remove Programs, Support Information claims that I'm running 5.3.582.27 as expected.

Multiple Versions of Virtual PC 2004 SP1!

This is strange. My Virtual PC crashed. Although, that is rare - it is not strange. The strange part comes later. Well I reported the error to Microsoft as a good computer citizen and on the "upload done / thank you very much" box, I pressed the 'more information' link. Just for fun. You never expect that to take you anywhere useful. To my surprise I came to the Online Crash Analysis (OCA) web and it told me that there was an update to my problem. Surprised, as I was, I clicked the link for the download. Now, my expectations were fulfilled - the link was broken. I investigated this a little further, as it made me suspicious that the 'file not found' appeared in Danish. It turned out that the OCA site appends &displaylang=da to the URL as my regional settings are Danish. When I stripped off the language part, I came to the real download.

Now to the strange part. The download was SP1 - but I already upgraded to SP1 last year?? I took it one step deeper and came up with these version numbers:

• RTM report (build 582) - ORCA say 5.3.582
• My running SP1 is 5.3.582.23 - but Add/Remove Programs 'Click here for support information' says 5.3.582.24?
• I already had a saved, downloaded SP1 kit - it is 5.3.582.24. Obviously, I did not use this when I upgrade - or did I?
• The new download is 5.3.582.27

SP1 is not SP1 - I think I will upgrade again...

Exchange Best Practice Analyzer Tool update

The by now eminent ExBPA tool has been updated to version 1.6.7.1 this time with over 50 new rules including -

Missing Exchange binary files, presence of recovery storage groups, availability check for the primary DNS server, Exchange process TCP port conflicts, and checks for over 25 non-default settings.

Find it here

Junk e-mail Filter updates on Outlook, Entourage (and IMF?)

Microsoft has released updates for their Junk E-mail Filters on Outlook 2003 and Entourage - furthermore rumor has it that Microsoft will start providing updates to the by now outdated Junk E-mail Filter in IMF by the end of this month (In addition to the update to IMF expected in Exchange 2003 SP2).

Kit - Upgrading to Exchange 2003 in a Medium-Sized Organization

Microsoft has released a deployment kit that describes what they define as the "standard deployment method" for upgrading Exchange 5.5 to Exchange 2003 (including domain upgrade). The target is medium-sized organizations which they define as approx. 200 to 2000 mailboxes.
The kit contains three documents (and a small checklist); the first of these takes the reader through the high level deployment steps and a decision flowchart to check whether or not the readers organization is a candidate for the "standard deployment method" - the second document contains instructions for an in-place domain upgrade and the last document contains instructions for upgrading the Exchange environment.
IMHO one of the best features of this deployment kit is that it has an reasonable size (less than 80 pages) and that it gives the reader a very good overview of the steps in a standard Exchange/domain upgrade - whether or not the "standard deployment method" is a viable method for all readers is another case; but more important is that it gives the reader a good background for e.g. a discussion with their professional advisors regarding deployment methods.

Beat Hackers At Their Own Game With A Hackerbasher Site

This is great stuff from Marnie Hutcheson: Customize your ISA/IIS and trap all web requests using an IP address (probably some hacker/worm tool) in a dummy location. Much like a honeypot - but easier and cheaper. Quote -
In this article, I will present an easily implemented strategy that uses HTTP 1.1 host headers to divert port 80 attacks away from unsecured public Web sites into a dead end where they can't do damage.
Make sure to read the Hardening Your Web Server sidebar for further ideas.

MOM 2005 Performance and Sizing White Paper

First, happy 2005. Vacation is over and its is time to get back to work tomorrow.

Next, Microsoft ended 2004 by finally releasing a white paper on MOM sizing. It is going to be fun to see whether the systems I have implemented meets the requirements... ;)

Nice Little Tool To Kill Applied Group Policies

Ive been using a freeware tool for a while that I wanted to share with you - its developed by GanoTools is called KillPol and it removes and reapplies group policies for the currently logged on user (Needs username/password of a member of the admin group). Its especially useful when troubleshooting locked down environments like highly secure desktops or Terminal Services environments (Of course you could use runas on regedit and delete the registry keys yourself - but this is much easier and also provides an easy restore method).

CPU / Memory Scalability of Exchange 2000/3

Interesting article regarding the scalability of Exchange 2000 and 2003 in terms of memory and CPU.
The maximum amount of memory that Exchange can make use of is 4 GB (old news) but more interestingly is that the article recommends disabling the use of PAE (Physical Address Extension) on Enterprise and Datacenter versions of Windows with the use of the /nopae boot.ini switch (If using the /3GB switch) - as it puts unnecessary strains on the system.
New facts to me are the notes regarding the scalability of Exchange in terms of CPU's - on a 8 CPU system Exchange supposedly can fully utilize 900 MHz CPU's but it isn't able to utilize e.g. 8 1400 MHz Xeon CPU's (Unless you are running e.g. anti-virus products on the same boxes).

Phishing - Paypal example

Read this one about Paypal - 'Your Account Will Be Suspended' - just to see how good the phishers are...

Phishing

As virus scanners, firewalls, anti-spyware etc. improves, phishing becomes (is?) the next big threat. Studies show that many will reveal their password when asked. Other people will send their credit card information by email or in the phone based on 'you won' ads. Read this excellent NGS whitepaper - The Phishing Guide - Understanding & Preventing Phishing Attacks. Is your web safe? I also stumbled across another interesting homepage - the Anti-Phishing Working Group.

Get in the Christmas mood ;-)

I just found a cute litte Christmas Theme complete with 3D screensaver, icons and background - it can be downloaded directly from Microsoft here (Don't expect to much in terms of design/graphic quality though ;-)

WINS Security Issue #3

Microsoft now has a patch ready - MS04-045 (thanks to the anonymous commentor informing me of this). Apply it right away.
Unfortunately, the original KB article does not say anything about the patch.

Exchange 2003 Operations Checklists

Microsoft has released a set of Exchange Server 2003 Operations Checklists that contains "guidelines for disaster recovery tasks, and for daily, weekly, and monthly maintenance tasks".

I would classify the content in these checklists as very good things-to-remember lists - as they by no means are complete. But they are indeed a good start when preparing the disaster recovery procedures and operational processes for an Exchange 2000/2003 deployment (and of course many of the checks on the lists could be implemented in e.g. MOM 2005 instead of doing it manually).

Protecting your administrative permissions #2

As a follow-up to my own post - and as Aaron closed his PrivBar blog for further comments - I want to offer an alternative that does not require any add-on software. Simply enter %userprofile% as address. This will show you the root directory of the user profile e.g. C:\Documents and Settings\user and tell you the user account being used. %userprofile% will switch the window into 'file mode'. Use 'back' or enter an HTTP URL, if you need to get back into 'internet explorer' mode.

WINS Security Issue #2

As a follow-up to my earlier post I have now looked at the proposed option 2 Run a script to automatically configure the IPSec filters. The provided script seems to do a pretty good job of blocking WINS replication traffic only - and have the option of specifying your replication partners as exceptions. Unfortunately the script does not take the current replication partner(s) (which are obtainable with netsh wins show partner) automatically nor does it allow you to specify multiple servers at a time - but the script can be called several times. For further details see the embedded readme file.
If you do not have an existing IPSec policy, I recommend that you deploy this method right away. The easist deployment may be to do it with psexec or modify the script as ipseccmd.exe can take a server name as the first argument.

Using a Dedicated AD Site for Exchange

Microsoft just released a new paper on this. When running Microsoft® Exchange Server 2003 or Exchange 2000 Server in larger environments, the frequency of queries to the Active Directory® directory service can be very high. Exchange Server uses its directory access component to communicate with Active Directory domain controllers and global catalog servers to perform tasks such as e-mail address lookups, distribution group expansion, Microsoft Outlook® client proxy, and referral services. With such a heavy load being placed on domain controllers, Microsoft IT optimized the performance of Exchange when communicating with Active Directory by creating a new Active Directory site and isolating domain controllers and global catalog servers just for Exchange. Get it here.

Protecting your administrative permissions

Surfing the web, reading email or testing software with administrative permissions is a risky business. Came across Aaron Margosis' blog and he addresses this problem in an interesting way. By using double-run-as he first logs on as local admin, stick himself into the Administrators group and logs on again this time having the required administrative permissions. Good solution, but only works when the user has the local administrator password.
Microsoft has an article called Browsing the Web and Reading E-mail Safely as an Administrator - which actually refers to Aaron's blog :). The article has a DropMyRights utility, which is able to remove your permissions while starting an application. This is also a useful approach - e.g. run Internet Explorer and Outlook with lower permissions.
Finally, there is work-around of how to start Windows Explorer as another user from runas - Aaron again. I used to start iexplore.exe to do this trick, but it seems that if only you start it with the /root argument, it will start in its own instance. Read about that here. You can also read about a useful toolbar, that shows the current credentials.

WINS Security Issue

Bad things happen. Very bad things happen when a widely-used piece of software can be buffer overflowed. This time it is WINS. Microsoft is still investigating the problem, but you can protect yourself by following the steps in the 890710 KB. Unfortunately, they only have suggestions, both being hard to implement: Block TCP/UDP port 42 and open it for your replication partners or get rid of WINS (as if that was easy).
Currently, there are no known incidents - and maybe WINS servers are too few worth attacking. If you do not implement one of the suggestions - after you have considered the situation carefully - at least follow the situation in the press and be ready to take action.

The Portable Script Center v3.0

has been released for download here. This nifty little .chm file contains all scripts included on the TechNet Script Center as of November 2004 - including an easy to use copy-and-paste feature. The content ranges from Active Directory (User, Groups, Sites etc.) to Hardware, Scripting Techniques, Software Update Services to Services For Unix and much more - check it out ;-)