SANS Top-20 Internet Security Attack Targets

SANS just updated their yearly report. Good stuff to be oriented about and a must read for anyone working with security. Especially interesting is the fact that new - and most likely less mature - technologies like VoIP are being attacked. E.g. Asterisk, the soft-PABX, had four vulnerabilities reported! As always, keep up your defenses!

EV SSL Certificates

They used to be called High Assurance certificates but now the name seems to be Extended Validation (EV).

Anyway, according to this entry in the IE blog EV SSL Certificates are Coming in January. Let us hope this will improve the trust in the web by the common user.

Daemon tools 4.06 x86/x64 with full Vista support

FYI: Daemon tools has been released in a new version that fixes the problems with the old version of daemon tools on Vista (It couldn't install).

Vista available on MSDN

FYI: Vista is now available on MSDN and Office 2007 has been there a couple of days (Vista has also been available on the Volume Licensing site for a couple of days now).

I'm still dualbooting though as my Logitech Quickcam Notebook Pro Camera is missing drivers for Vista, some of my LCS utilities doesn't work in Vista and LiveMeeting still isn't to stable.

PowerShell RTM'ed

According to the keynote this morning at TechEd IT-Forum in Barcelona, Spain by Bob Muglia, PowerShell is ready for manufacturing as of today. Cool!

I just found that it went public in the PowerShell blog.

Give me the RTM bits now please !

I'm really frustrated here ... I use the RSS reader in Outlook 2007 Beta 2 TR and it stopped working a few days ago so I can't read my RSS feeds. I also run Vista RC2 (A.k.a. a legacy OS or at least a legacy build ;-) and knowing that both products has RTM'ed I don't want to fix the problem - I want the Bits so I can reinstall my machine (Or at least my dual boot Vista partition).

Even though I'm a member of the Office 2007 TAP and member of the Vista Beta I have to wait like everyone else for the release on my MSDN. What is this - don't you know who I am (If you do please send me an e-mail and Cc. my shrink) ... I WANT THE BITS NOW .... please ;-)

Anti-exploit in Vista

Read this Michael Howard article that focuses on explaining what Address Space Layout Randomization in Windows Vista is all about but also covers other security mechanisms. The whole idea is to make a system more unpredictable to the attacker making the attack much harder to make. Hopefully, it will take a while before the bad guys catch up.

Protocols used when accessing Sharepoint in Explorer View

I have always thought, that accessing Sharepoint in Explorer View used WebDAV to do the work. But that is not always the case. WebDAV is actually quite restricted in how it can be used: It is limited to port 80 and consequently it can also not be used with SSL. So what is used instead? A protocol called FPRPC - FrontPage Server Extensions Remote Procedure Call. This protocol - designed before the standard WebDAV protocol was defined - is being used in all other situations. How can you tell the difference? Well WebDAV is a built-in network provider in Windows XP and you can map network drives to a WebDAV URL. Any Windows program can use WebDAV to access data. FPRPC on the other hand is a shared library only being used by programs taking advantage of it. This is typically the Office products. Windows Explorer is able to use both protocols, and in Explorer View you can tell the difference by looking at how Windowish it looks. 3D-icons and all the normal choices in the new menu signals WebDAV. A more flat view is FPRPC (this may be different in Vista).

Find you more in the whitepaper - Understanding and Troubleshooting the SharePoint Explorer View.

Consolidating security event

Finally, a decent solution seems to appear in SCOM (System Center Operations Manager - got to learn those acronyms) for this.

I learnt it here.

Live Meeting Console fix for Vista

I'm regularly using Live Meeting and due to problems with stability on Vista / Office 2007 I always dual boot in to my XP for presentations etc. (Actually the only time I use XP since I switched to Vista during my summer vacation).

Microsoft has now released an update that fixes some of the problems with Vista / Office 2007. Find it here

PowerShell RC2 Released

Finally, the RC2 release is here. I havn'nt tried it yet but plan to do so soon - very soon.

You'll find it for XP x86 here.

How to plan for and deploy certificates in Live Communications Server 2005 Service Pack 1

One of my contacts at Microsoft, Shawn Mahan, who is an expert in PIC issues and many other LCS subjects is presenting a webcast on the use of certificates in LCS on Thursday, September 21, 2006 10:00 AM Pacific Time.

This Support WebCast discusses the purpose of certificates in Microsoft Office Live Communications Server 2005 and describes how to appropriately deploy certificates for common scenarios. These scenarios include Remote Access, multiple pools, Director or Access Proxy arrays, Microsoft Office Communicator Web Access, and public instant-messaging (IM) connectivity (PIC).

The use of certificates is often confusing to newcomers to LCS and Shawn is IMHO a very skilled Escalation Engineer, so if you are interested in the subject go watch his presentation here.

LCS 2005 Supportability Guide

Microsoft has released a new Supportability guide for Live Communications Server 2005.

This document identifies supported configurations for Microsoft® Office Live Communications Server 2005, Live Communications Server 2005with Service Pack 1 (SP1), and Microsoft Office Communicator Web Access.

It includes all sorts of info, coexisting LCS with other applications, Certificates required, SQL versions support (Now including SQL 2005 SP1), topologies, clients supported and you name it. You can find it here.

Office 2007 Beta 2 Technical Refresh has been released

Besides some (hopefully) useful updates, it also now supports Vista RC1

The update should be located here according to the Office Preview site and the mail I recieved from the Beta team and indeed all the other Office products and the now separate download for "Save as PDF / XPS" can be found here, but if you want the Office 2007 System TR you need to look here. Notice the following warning before installing

IMPORTANT: Please read the update documentation, referenced in the "To install this download" section on this page, BEFORE applying this Beta 2 Technical Refresh update. The documents list several steps that you must complete prior to installation to ensure a successful update. This is NOT a single click update.

CSTA and Reverse number lookup in Office Communicator

If you haven't worked with CSTA / 3PCC (Third Party Call Control) in Office Communicator, then Paul Robichaux has a nice write-up on how Office Communicator translates incoming phonenumbers to contact information (Retrieved from the AD or WAB) and also includes some information on normalization of phone numbers (That usually is a big deal

It also includes a nice little tip on how to forcibly update the locally downloaded Address Book (If you are using this). See more at his post.

Using LCS 2005 with multiple domains

Over at the new UCG blog there's a post on how to support multiple domains in LCS.

It will tell you how to use autoconfiguration of Office Communicator (Using DNS not Group Policies) in a multi-domain environment and it shows you how to enable Enhanced Federation for your primary domain, while allowing for Direct Federation for "secondary" domains in your company using Subject Alternate Names in your certificates.

Read more at Configuring LCS 2005 w/ SP1 for Multiple Domains.

I'm currently investigating where/if we can buy commercial certificates for the Access Proxies that support Subject Alternate Names and whose Root CA's are part of the standard Windows Server 2003 list of Trusted Root CA's. I chatted with a customer representative at Verisign and the answer was a firm no, but after some discussion she told me that they would get back with further info. The last time I looked I couldn't find anyone, but I've been told that some Microsoft customers have been able to do so - I will be back with further info.

Adding entries to visionapp Remote Desktop with PowerShell

Now that you have visionapp Remote Desktop as I wrote about, how do you populate it easy with all the servers you want? Easy! The configuration is stored as XML as one long string in the registry value hkcu\software\visionapp\vRD\Configuration. And as the registry and xml is native to PowerShell the choice was easy.

So here is my PowerShell scripts adding a test folder and a test connection -

# The registry key

$regkey = get-item 'HKCU:\software\visionapp\vRD'

# read the configuration value
$config = $regkey | get-itemproperty -name configuration

# save it to a file in %temp% - just in case (you can also use backup from the app)
$savedConfig = join-path $env:temp vRd.saved
$config.configuration > $savedConfig

# convert string to xml - cool huh!
$config = [xml] $config.configuration

# show part of the xml file
$config.vRDConfigurationFile
# and drill down into the ConnectionsFolder
$config.vRDConfigurationFile.ConnectionsFolder

# Create a Folder xml element
$newfolder = $config.CreateElement("Folder")

# Set its name
$newfolder.SetAttribute("Name","Test folder")

# and add it as a child to the ConnectionsFolder
$config.vRDConfigurationFile.ConnectionsFolder.AppendChild($newfolder)

# show the added folder
$config.vRDConfigurationFile.ConnectionsFolder

# Add some attributes - note that you can do this before or after
# adding the xml element - $newfolder is a pointer to the live value
$newfolder.SetAttribute("Description","Testing dude!")
$newfolder.SetAttribute("Sorted","false")
# Link folder to a credentials GUID (I checked this beforehand)
$newfolder.SetAttribute("Credentials","785dd5ed-c75a-48e1-bb31-0b47e1e75fc3")

# Create a Connection xml element with some attributes
$newconnection = $config.CreateElement("Connection")
$newconnection.SetAttribute("Name","server.test.com")
$newconnection.SetAttribute("ServerName","server.test.com")

# Add it to the new folder
$newfolder.appendChild($newconnection)

# dump folder as XML
$latest=$config.vRDConfigurationFile.ConnectionsFolder.folder.count-1
$config.vRDConfigurationFile.ConnectionsFolder.folder[$latest].get_OuterXML()

# we have to do this several times, so a small function is easier
function addElement($xml,[string] $elementName, $elementText) {
$e=$xml.CreateElement($elementName)
$e.set_innerText($elementText)
return $e
}

# these values must be child elements - not attributes - to the connection element

# note the double-parenthesis - the inner is used to call the addElement function
# and return the value to the appendChild method
$newconnection.appendChild((addElement $config "SmartCard" "false"))
$newconnection.appendChild((addElement $config "ResolutionX" "1024"))
$newconnection.appendChild((addElement $config "ResolutionY" "768"))
$newconnection.appendChild((addElement $config "AutoSize" "true"))
$newconnection.appendChild((addElement $config "Description" "Test server"))
$newconnection.appendChild((addElement $config "Printer" "false"))
# Take credentials from parent folder
$newconnection.appendChild((addElement $config "InheritCredentials" "true"))
$newconnection.appendChild((addElement $config "Credentials" "00000000-0000-0000-0000-000000000000"))
$newconnection.appendChild((addElement $config "SeparateWindow" "false"))
$newconnection.appendChild((addElement $config "Console" "false"))
$newconnection.appendChild((addElement $config "Serial" "false"))
$newconnection.appendChild((addElement $config "LocalDrives" "false"))
$newconnection.appendChild((addElement $config "Audio" "false"))
$newconnection.appendChild((addElement $config "Port" "3389"))

# dump again
$latest=$config.vRDConfigurationFile.ConnectionsFolder.folder.count-1
$config.vRDConfigurationFile.ConnectionsFolder.folder[$latest].get_OuterXML()

# update configuration in registry

$regkey | set-itemproperty -name configuration -value $config.get_innerxml()

# folder and connection added!



PowerShell rocks! - did I mention that earlier...

A much better Remote Desktops

Remote Desktops - note the ending s - is a tool for collecting multiple Remote Desktop sessions in one console. I have used it a lot, but it has many drawbacks -

• You cannot see whether you already have connected to a server or not
• You have to change cached credentials for every entry
• It sometime crashes - especially after resume from hibernation (you learn the good old advice: When you have do so much work that you do not want to do it again, you save your data)
• And perhaps most annoying - you cannot sort/move/reorganize the entries

I have tried to figure out, how to either reorganize the entries or generate a new console based on data held in Excel - but failed so far pursuing this path.

One of my customers pointed me to an alternative: visionapp Remote Desktop from the German company visionapp. I have used it for a while now - and all the drawbacks are gone.

Thank you very much visionapp!

LCS and Windows Server 2003 R2 known issue

As you might know Live Communications Server 2005 SP1 is now supported on Windows Server 2003 R2 and SQL Server 2005 SP1. Besides SQL 2005 SP1 it is also a requirement that you install the hotfix documented in KB911996 (Note the quirky installation procedure and that uninstall equals reinstall of LCS!!).

This time I was scripting the complete installation of LCS using LcsCmd and LCServer.msi (It's way easier to document, than "screenshooting" the GUI installation) and I also had a clustered SQL 2005 installation as a Backend Server.

After the installation I wanted to launch the LCS MMC on the Enterprise Edition front-end server, but it only presented me a window with the orange "Live Communications Server 2005" logo on top and a text in the middle "Live Communications Server 2005" - but no navigation pane.

I suspected it was either the scripted installation or SQL 2005 SP1 that was causing the problem, so this was where my trobleshooting efforts went. Two hours and a keyboard later I tried to open the MMC snap-in and manully add the Live Communications Server snap-in and voila, the navigation pane was back ;-)

I later chatted with one of my few contacts at Microsoft that really know LCS (You know who you are - and I'll keep my promise ;-) and was told that this was a "known issue", which they are investigating (Which is fine with me - since that means that my clustered SQL installation and installation scripts work as expected).

Interested in Network Bandwidth Usage of Audio/Video in Office Communicator !?

Then you should look at the NetMeeting Resource kit as the technologies used by Office Communicator 2005 are thosed offered by NetMeeting (Mainly H.323 and T.120). Chapter 4 also looks at the Firewall configuration and ports used by OC.