SBS 2008 - Licensing Forefront Server Security for Exchange on Open Value

We have decided to keep Forefront as part of our network protection topology. So far, in our spam protection experiment Forefront Server Security for Exchange is doing a fantastic job of filtering out all of the garbage.

To go beyond the trial period and license Forefront Server Security for Exchange SP1, we will be setting up an Open Value Agreement for our clients that do not already have one.

The part number is: 9SG-00069. This is the first year part number. If our client already has an agreement in its second or third year, we would either purchase using the SKU for the year, or set up a new agreement depending on what else would need to be licensed.

This SKU is for a monthly subscription which is very inexpensive. When ordering from the distributor, the order quantity will be 12 (12 months) per user being licensed.

It is well worth the minimal cost per year per user.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SBS 2008 - Production WSUS DB Size after 3 months

On our "production" SBS 2008 network that has been up and running for our SBS 2008 Blueprint book the one thing we have been keeping an eye on is the size of the WSUS databases:

WSUS Db at 12GB

This particular SBS 2008 is RTM and has been around since we obtained the RTM bits via our TechNet Plus subscription which was in mid-August sometime.

Now, there are a few considerations to keep in mind when it comes to this particular WSUS database:

• Windows desktop clients are XP Professional, Windows Vista Business and Ultimate.
• Service Packs were delivered via network share before connecting them to the SBS domain.
• IE 7 is the standard browser on all desktop clients.
• Office 2007 is not set up to be delivered by Group Policy yet. So, no Office updates included as OWA is the primary e-mail client at this point. Office 2007 SP1 will be placed in the Updates folder prior to delivering Office to the desktops via GP scripts.
• .NET in its various versions is installed on all desktop systems.
• SBS 2008 is stand-alone until we have the time to install the Premium server and install and configure the Terminal Services Role along with RemoteApps via RWW.
• Forefront Server Security for Exchange is providing the filtering for Exchange (and doing a pretty impressive job of it too).

With the above in mind, it is quite possible that the WSUS databases will exceed 20GB or more once we have the full production environment up and running.

As a result, using the Move Windows Update Repository Data wizard to move that data to a separate partition from the OS C: would be a good post OS install step once the server's partitions have been configured and formatted.

Storage Tasks Wizards

Be careful when using the Move Data Wizards. In some cases, if the data has been moved to one partition, the wizard may not allow for that data to be moved back to the System partition (OS).

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SBS 2008 Lab Test - Spam Filtering

The primary purpose of this post is to present our SBS 2008 lab users' e-mail addresses to the world as a spam trap.

Let's see just how good the Forefront and LiveOneCare for Server setup is.

• Norm Hasborn
• Barry McKechnie
• Melinda Overlaking
• Linda Briggs
• Bob Bountiful
• Tom Benkert
• Norm Hasborn Jr.
• David Lalberson
• Elvis Haskins
• Bob Easter

Just in case you are wondering, the above users are setup in the SPRINGERS SBS domain as part of the book I am co-authoring with Harry Brelsford of SMB Nation fame tentatively called the SBS 2008 Blueprint.

Once we get things rolling along pretty good, we might even setup a couple "Out of Office" replies just to spice things up a bit! :)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SBS 2008 - Top 10 Wow and Top 10 Learning

Susan talks about her top 10 Wows for SBS 2008: The top ten wow's of SBS 2008 as inspired by a blog post by Dana Epp: Top 10 WOW Features on SBS 2008 which will make me switch from SBS 2003.

For those of you who have heard me talk about SBS 2008, you know I am pretty excited about it ... just ask Constanza and Satish! ;)

There are two aspects to the Wow: Features and Learning.

The SBS 2008 features not necessarily in order:

1. Security: The simplicity of adding a third party certificate makes managing Remote Web Workplace access, Outlook Mobile Access, and Outlook Anywhere access a dream. A huge time savings for our clients and us.
2. Security: The new Windows Server 2008 Event Log setup allows for finely tuned filters and things like e-mails being fired off when a certain event happens.
3. Security: NAP ... NAP ... NAP! Yeah! Talk about the killer app for tightening up that ship! No more rogue systems that are unpatched and have out of date A/V or no A/V at all!
4. Terminal Services Application Serving: Lots of goodness here ... first place we will go with our setup is publishing our book keeping to eliminate the need for a dedicated RDP desktop! We can see so much potential for our clients here ...
5. SharePoint V3: The more we use it the more we want it! Top it off, between CompanyWeb SPv3, Windows Vista, and Office 2007 integration we are talking about serious workflow streamlining here!
6. Mobile Access: Getting ISA off the same box means no more fights with Windows Mobile Exchange integration!
7. Group Policy: The new Win2K8 OU/GPO structure along with Preferences and so much more give us such a great amount of flexibility and granularity when it comes to setting up our user and computer environments!
8. Security: The integrated Windows Firewall gives us a breath of fresh air ... no more third party apps breaking things or completely cutting our servers off from the world on install or updates.
9. Security: ForeFront and Live OneCare for Server: A one source, one stop shop for our server and client protection needs. Just check out the number of AntiSpam and Block List updates we receive in a day! Microsoft looks to be getting on top of their game when it comes to server/client malware protection.
10. Management: The splitting up of the SBS Consoles is refreshing. The Windows SBS Console is the console we will be using the most. It is simple, has an at-a-glance status page, and enables us to access needed features quickly and simply. Very refreshing. We also get the Windows SBS Native Tools Management Console with the native server component snap-ins for those times we need to get granular.

I don't know about you, but one of the things I really enjoy about our industry is the constant challenge to learn new things ... to stay on top of the products and technologies we work with.

With the advent of so many different products, it has forced me to make a choice: Remain a Jack of all Trades and Master of None, or focus in on something and get really good at it.

I am pretty sure the choice I made is fairly obvious, though I am no where near as good at working with the SBS product as others are ... yet! ;)

Top 10 things to learn on SBS 2008:

1. How to publish a TSApp through the Remote Web Workplace!
2. Windows Server 2008 Group Policy changes and implementation structures ... especially the Central Store. Jeremy Moskowitz's books on the table for this one.
3. Figuring out the XML structures for customizing things like the SBS Console itself or custom alerts.
4. Network Access Protection (NAP): Learning the ins and outs along with tying it into existing SBS 2008 features.
5. SQL Server 2008: Database migration techniques for existing LoB applications. Maintenance and Disaster Recovery.
6. Deployment: Windows Server 2008 setup techniques. Especially Windows Deployment Services for working with Win2K8, SBS 2008, and Vista WIM image deployments.
7. SBS 2008 Migrations: We are getting ready to migrate our own SBS 2003 R2 Premium setup to SBS 2008. We already have the stand-alone ISA box in place and waiting for production. Going to be the big one! :)
8. IPv6. At some point we need to sit down and learn this one ... soon!
9. Pass the SBS 2008 Exam! Not too sure about the status of the Beta I wrote three weeks ago.
10. How to design a SharePoint Web site from scratch without breaking the whole thing in the first place!

Those are the ones that come to mind at this point. There are a lot of SBS features that are pretty neat and need to be learned.

Another side to SBS 2008 for us: It will be the best way to setup our hosting environment for SPLA. The ability to limit on a per user basis what network resources, features, or desktops a user can access when the log onto the Remote Web Workplace makes this product perfectly suited to providing hosting services for small companies that do not want to spend on a network setup.

The bar was high with SBS 2003, it certainly has been raised with SBS 2008. Good on you SBS Team!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SBS 2008 - ForeFront and Exchange Enterprise AntiSpam and BlockList Updates

Anthony and I have been having a good discussion over this particular topic: SBS 2008 - WSUS Synchronizations and Exchange.

The updates showing up in WSUS and being automatically approved are indeed the Enterprise level AntiSpam and BlockList ones.

So, for clarification, an e-mail was sent out to our favourite SBS Team Member Sean Daniel, and this is his reply:

This is my understanding of how all this works. Exchange is definitely weird, because all of the “Enterprise” stuff is in there, but you’re not licensed to use it all, without Enterprise CALs and PIDs.

So, with Exchange 2007 std, you have rights to download spam updates every 10 weeks or so via MU only. With the addition of FSE license, that gives you the right to override the 10 weeks and enable the automatic updates, this happens a few times a day.

Now, the details:
a) WSUS is configured for once a day, so the anti spam service is checking and checking, but will only get updates once a day. I think you’ve got this part
b) If FSE expires, the EULA says you have to disable the automatic anti-spam updates.

So I believe the short answer is, as long as you have FSE, you’re eligible for daily updates.

Pretty neat eh? We SBSers get to sneak under the wire on the licensing of those updates with ForeFront installed and licensed! ;)

So, the earlier blog post recommendation of changing your WSUS synchronization schedule still applies!

Thanks to Sean Daniel for taking the time to get back to us!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SBS - Event ID 537 NTLM Logon Errors Solved - Sorta

This was the last post on the subject among many since we began to see the errors: SBS - Event ID 537 NTLM Logon Errors - 0x80090308 and Trend.

Robert Crane has the fix: Login errors after Trend upgrade.

As per the comments also in our above post:

1. In ADUC: Create a new User: Trend and set password: 0hReally?
2. Add the user to Internet Users for SBS 2003 Premium to allow access through ISA.
3. Set the username and password to Trend's Web Reputation proxy settings.

The errors should stop. The big thing is to make sure that both the user name and password do not combine to more than 14 characters. We cannot even do this: domain\Trend since the domain characters will also count.

We have all seen all manners of code slip by with some pretty funky bugs. This has to be one of the better ones to have slipped by the "quality control" people over at Trend.

For us, this situation, the lack of support, and the fact that one of our clients who was virus free until we installed Trend A/V on their systems pretty much puts the final nail in the coffin.

We will go back to Symantec for the time period between now and when our clients have SBS 2008 installed. From there we will run with ForeFront and Live OneCare on SBS 2008.

We are also in the process of proposing ExchangeDefender to all of our clients too. It is a very minimal cost per month, provides great protection for all incoming and outgoing e-mail, and provides a little extra monthly revenue for us.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SBS - Event ID 537 NTLM Logon Errors - 0x80090308 and Trend

As we go along with this problem on our client's SBS 2003 box, Trend is seemingly helpless to correct the problem.

The e-mail support was horrendous. Unfortunately, things did not work out at all.

From there, an escalation was made and we were put in touch with B. who was somewhat helpful via telephone ... though her script only went so far before we were asked to send the entire server log set to Trend.

We have not heard back since ... though it has only been since late last week.

Here is our initial post on the problem from July: SBS - Trend Worry Free Business Security Event ID 537.

We have been hearing from others about this problem on their SBS box or their client's SBS boxes too.

The error:

Security 537 2/10/2008 4:44 AM 16,044 *

Logon Failure: Reason: An error occurred during logon
User Name:
Domain:
Logon Type: 3
Logon Process: Èù
Authentication Package: NTLM
Workstation Name:
Status code: 0x80090308
Substatus code: 0x0
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -

And, something that came to us via one person who contacted us as a result of the first post on this issue that causes us to pause:

Dear XXXXXX,
This is an update.
According to RD, the event ID 537 is caused by TMUFE, which is our Web Reputation service engine.
The behaviour of TMUFE will be as follows:

1. Connect to Proxy Server without authentication.
2. Proxy server return access denied (Event ID 537) and request authentication.
3. Connect to Proxy Server with configured user name/password.

So it is normal for the security warning to show up on event logs of the SBS server.
Thank you and have a great day!
Best regards,
Txxxx Cxxxx
Systems Engineer
Australia Technical Support Center
TrendLabs HQ, Trend Micro Incorporated

And, just tonight as this post was being written, the following showed up in our Experts-Exchange Inbox: SBS performance report displays thousands of event id 537 errors. Apparently the above note was sent to the person posing the question who has 5 SBS servers showing the problem.

The above mentioned services were indeed a part of our troubleshooting with B. Especially when it came to having ISA on the box. But, if there were authentication issues, updates too should fail which they were not.

This situation is going from bad to worse in a hurry. :(

Trend, better pull up your socks and get this fixed in a hurry, because right now we are on the edge of walking away ... as our clients that have the product installed are not impressed either ... especially this one: Trend Micro Worry Free Security is not so worry free?

ForeFront and Windows Live OneCare for Server on SBS 2008 are looking more and more attractive everyday ... with ExchangeDefender sitting in front!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SBS 2008 - The SBS Answer File Help File

This file can be found under DVD:\Tools\answerfile.htm on the SBS 2008 DVD 1 media.

If you do not have a beta copy of SBS 2008 yet, then this is your opportunity to get to know how to use the Answer File setup for SBS 2008 to streamline your server installs.

Staying consistent in our installs provides a good foundation for troubleshooting when issues arise.

Here it is verbatim (formatted for simplicity):

Tell Me More About Using Answer Files

An answer file serves the following purposes when you are installing the Windows® Small Business Server 2008 server software (Windows SBS 2008):

• Provides information that is automatically entered into the Windows SBS 2008 installation pages. You can use an answer for either a new installation or a migration to Windows SBS 2008.
• Helps value-add professionals build new servers before taking them to the customer site for final configuration.
• Note:If you are migrating from an existing server to Windows SBS 2008, you must perform all of the installation steps at the customer’s site.
• Note: The Getting Started tasks must be completed at the customer site.
• Triggers the migration process during Windows SBS 2008 installation.
• Note: You must use an answer file when you are migrating to Windows SBS 2008. You can also use an answer file for an unattended installation.

The Answer File Tool performs limited validation on the data in the answer file. Follow the instructions in this document to complete each field and to help the installation finish without validation errors.

An answer file automates the configuration of the Windows SBS 2008 installation in either attended or unattended mode for both a new installation and a migration to Windows SBS 2008.

• In a fully unattended installation, the user or technician interacts with the installation only if there is an error in the answer file.
• In an attended installation, the answer file is used to populate the fields on each configuration page, and then the user or technician verifies the information and can change any field before clicking Next.

Important
To fully automate the installation on a server that has a preinstalled operating system, you must also use the OOBE.xml answer file for the operating system phase of the installation.To fully automate a clean installation on a server, you must use the autounattend.xml answer file. When you use autounattend.xml, you cannot specify a drive letter other than the C drive. Windows SBS 2008 can be installed successfully only on the C drive. For information about creating an answer file using the Automated Installation Kit (AIK), see “Automated Installation Kit (AIK) for Windows Vista SP1 and Windows Server 2008” at the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkID=115680).

To create an answer file, complete the following steps:

1. Collect the information for the answer file (for either an installation or a migration).
2. Run the Answer File Tool.
3. Copy the answer file to the root of a drive on the new server or any removable media.

Step 1A. Collect the information for an automated installation answer file

If you are installing Windows SBS 2008 on multiple servers for different customers in your office before taking the servers to the customer sites, ensure that the DNS name is unique on your local network or that each server is connected to a separate network during the installation. You must also choose names that are unique to the customer site.

The following tables explain the information that you need to enter in the Answer File Tool for a new installation.

Clock and time zone settings

Clock and time zone settings

• If you choose to manually set the clock and time zone, the unattended installation stops, and then it prompts you to set the clock and time zone.
• If you choose to automatically set the time zone, you must manually set the clock in the server BIOS to the correct time. The system clock cannot be set automatically using the answer file.

Server Information

Server name

• The name of your new server. This must be a unique name on the local network.
• Important: You cannot change this name after the installation finishes.

Internal domain name

• The NetBIOS name of the internal domain—for example, contoso.
• This must be a unique name on the local network. The domain name and the server name cannot be the same.
• Important: You cannot change this name after the installation finishes.

Full DNS name

• The DNS name of the internal (local) domain.
• You must provide at least two labels for the full DNS name. For example, you can use contoso.local, but contoso alone is not valid.
• It is recommended that you do not use a public top level domain name, such as .com, as the last label in the full DNS name. This is the DNS name of the internal domain.
• If you use Apple Macintosh client computers that are running Macintosh OS X 10.2.x or later on your network, see the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkID=121090) for more information.
• Important: You cannot change this name after the installation finishes.

Company Information

Company information (optional)

• The name and address of the business. This information is used for settings on your server and is not sent to Microsoft.
• You can edit the company information later. To edit it, in the Windows SBS Console, click the Help list menu, and then click Edit Company Information.

Certification authority name (optional)

• The name of the certification authority that you want to use. If you leave this field blank, Windows SBS 2008 uses the internal domain name and the server name (syntax -) to generate a self-signed certificate (for example, Contoso-Server1-CA). This is the name in the Issued By field when you view the certificate from the Internet.
• Important: Do not use the domain name as the certification authority name.

Network administrator account

Network administrator account

• This is the new administrator account name that is created when you install Windows SBS 2008. For a new installation, after the server restarts for the final time, you are logged on using this administrator account and password.
• First name: First name of the administrator.
• Last name: Last name of the administrator.
• Administrator user name: User name or alias for the new network administrator account. The user name must consist of the following:
• Can contain only valid characters: A-Z, a-z, 0-9, and the symbols _ # $ % & ’ - ^ { } ~ !
• Cannot begin or end with a period
• Cannot contain two periods in a row
• Cannot be a reserved name (for example, Administrator)
• Cannot be the same name as the computer or server name

Administrator password

• Password for the new network administrator account.
• The password that you provide must be complex. If you do not provide a complex password, the unattended installation stops so you can provide the complex password. A complex password is at least 8 characters long and contains at least three of the following:
• Upper case letters
• Lower case letters
• Numbers
• Symbols

Note: For a new installation, you can either specify the network settings or allow the installation wizard to configure them for you. If you are installing Windows SBS 2008 on multiple servers in your office before taking them to the customer sites, consider the following:

• If you specify network settings that are specific to the customer’s network configuration, you may not be able to access the Internet during installation to get updates from your own network.
• If you specify settings appropriate to your own network, you may need to change them when you deliver the server to the customer site.

If you want to specify the network settings, you need the following information.

Network Settings

IP address (optional)

• The IP address that you want to assign to your server. Ensure that the IP address is in the same subnet range as the IP address of the local area connection (LAN) on your router and that the IP address is not currently used on the network. If you select the Manually choose the network settings option and do not specify the IP address, the answer file cannot be saved.

Default gateway (optional)

• The IP address that is assigned to the local area connection on your router.

Try Windows Live OneCare for Server and Forefront Security for Exchange Server

Windows Live OneCare for Server

• You can choose to install a trial version of Windows Live OneCare for Server. OneCare helps protect against viruses, spyware, and other malware, and it provides other security, backup, and performance optimization services for your server. The trial version is a complete, fully functional version of OneCare with a 120-day trial period that begins after you complete the OneCare installation wizard.
• You can also install the trial version of OneCare on client computers. For information about installing OneCare on client computers, see the Windows Live OneCare home page at the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkID=121102).
• Important: You can install OneCare only if the language you are installing is supported for the full OneCare product. For information about which languages are supported, see “Frequently asked questions about Windows Live OneCare” at the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkID=121101).

Forefront Security for Exchange Server

• You can choose to install a trial version of Forefront Security for Exchange Server. Forefront Security for Exchange Server provides a virus protection service for e-mail. The trial version is a complete, fully functional version of Forefront Security for Exchange Server with a 120-day trial period that begins after you complete the installation wizard.
• For more information about Forefront Security for Exchange Server, see the Forefront Security for Exchange Server home page at the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkID=121103).

Step 1B. Collect the information for the migration answer file

The following tables list the migration settings that you must define in the Answer File Tool.

Clock and time zone settings

Clock and time zone settings

• If you choose to manually set the clock and time zone, the migration stops, and then it prompts you to set the clock and time zone.
• If you choose to automatically set the time zone, you must manually set the clock in the server BIOS to the correct time. The system clock cannot be set automatically using the answer file.

Company Information

Company information (optional)

• The name and address of the business. This information is used for settings on your server and is not sent to Microsoft.
• You can edit the company information later. To edit it, in the Windows SBS Console, click the Help list menu, and then click Edit Company Information.

Certification authority name (optional)

• The name of the certification authority that you want to use. If you leave this field blank, Windows SBS 2008 uses the internal domain name and server name (syntax -) to generate a self-signed certificate (for example, Contoso-NewServer-CA). This is the name in the Issued By field when you view the certificate from the Internet.
• Important: Do not use the domain name as the certification authority name.

Source (Existing) Server Information

Domain administrator account name

• The user account name of a domain administrator in the existing domain.
• Note: This account must be a member of the Domain Admins, Enterprise Admins, and Schema Admins groups. When the first phase of the migration finishes, the server restarts and automatically logs on using this administrator account.

Password

• The password that corresponds to the domain administrator account name.
• Note: The domain administrator account password cannot be blank. If it is, you must either change it for migration or create a new domain administrator account that has a password.
• Note: It is recommended that you create a new domain administrator account on the Source Server instead of using the built-in Administrator account.

Source Server name

• The name of the server from which you are migrating settings and data.

Source domain name

• The full DNS name of your organization's internal domain—for example, contoso.local.

Default gateway

• The IP address that is assigned to the router on your network.

Source Server IP address

• The IP address that is assigned to the Source Server.

DHCP is running on the Source Server

• Select this box if the DHCP service is running on the Source Server. It is recommended that the DHCP service run on the Destination Server. If you are running the DHCP service on the Source Server, it is moved for you during Windows SBS 2008 migration. If the DHCP service is running on another server or device, you must manually disable it on that server or device.

Note: The domain administrator user name and password that you supply in the answer file are also set as the Directory Services Restore Mode (DSRM) password. If for any reason you need to log on to the server in DSRM, you must use the same user name and password that you specified during migration. These passwords do not synchronize automatically, so if you change the password for your administrator account on Windows SBS 2008, you must continue to use the old password to log on to the server in DSRM.

Destination Server Information

Destination Server name

• The name of the server to which you are migrating. You will install Windows SBS 2008 on this server. This must be a unique name on the local network. The Destination Server name cannot be the same as the domain name. Also, the Source Server name and the Destination Server name cannot be the same.

Destination Server IP address

• The IP address that you want to assign to the Destination Server.

Try Windows Live OneCare for Server and Forefront Security for Exchange Server

Windows Live OneCare for Server

• You can choose to install a trial version of the Windows Live OneCare™ for Server computer protection and maintenance software and services. OneCare helps protect against viruses, spyware, and other malware, and it provides other security, backup, and performance optimization services for your server. The trial version is a complete, fully functional version of OneCare with a 120-day trial period that begins after you complete the OneCare installation wizard.
• You can also install the trial version of OneCare on client computers. For information about installing OneCare on client computers, see the Windows Live OneCare home page at the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkID=121102).
• Important: You can install OneCare only if the language you are installing is supported for the full OneCare product. For information about which languages are supported, see “Frequently asked questions about Windows Live OneCare” at the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkID=121101).

Forefront Security for Exchange Server

• You can choose to install a trial version of Microsoft Forefront™ Security for Exchange Server. Forefront Security for Exchange Server provides a virus protection service for e-mail. The trial version is a complete, fully functional version of Forefront Security for Exchange Server with a 120-day trial period that begins after you complete the installation wizard.
• For more information about Forefront Security for Exchange Server, see the Forefront Security for Exchange Server home page at the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkID=121103).

Step 2. Run the Answer File Generator

Note: To run the Answer File Generator, you must have the Microsoft .NET Framework 2.0 or later installed on the computer that you are using to create the answer file. To install .NET Framework 2.0, see the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=81886).

To create an answer file for an automated installation

1. On a client computer or a server, insert the first Windows SBS 2008 DVD, navigate to the Tools folder, and then double-click SBSAfg.exe. The Answer File Generator opens.
2. Click New installation.
3. Type the information that you collected in Step 1A.
4. Save the answer file as sbsanswerfile.xml.

To create a migration answer file

1. On a client computer or a server, insert the first Windows SBS 2008 DVD, navigate to the Tools folder, and then double-click SBSAfg.exe. The Answer File Generator opens.
2. Click Migration from existing server (Join existing domain).
3. Type the information that you collected in Step 1B.
4. Save the answer file as sbsanswerfile.xml.

Step 3. Copy the answer file

Copy the answer file to the root of either a USB flash drive or a USB external hard drive. Connect the USB drive to the new server, or copy the answer file from the USB drive to the root of any drive on the new server. Then start either installing or migrating to Windows SBS 2008. If the Windows SBS 2008 installation wizard detects a migration answer file, the migration process starts automatically.

Warning: The answer file contains logon and password information that can be used to gain access to your server. To help protect your server, when you finish installing Windows SBS 2008, delete the answer file.

Troubleshooting the answer file

When running an installation (either new or migration) using the Windows SBS 2008 Answer File, you might encounter an error if the server cannot read information in the answer file. This can occur under the following circumstances:

• The Windows SBS 2008 Answer File Tool is not formatted correctly.
• The answer file contains corrupt data.

If you encounter an error when running the answer file, take the following steps to verify the contents of the answer file:

1. If possible, using the Windows SBS 2008 Answer File Tool, open the answer file.
2. Review the installation information, and then save the file.
• Note: If you receive an error that the file cannot save, close the file, and then recreate a new answer file with the same information.
3. Click Retry. If you did not continue past the Continuing Installation page, you can restart your server to try and read the answer file again.

Important: You should not open the answer file and edit it directly. Doing so can introduce errors in the file format.

Other general troubleshooting tips

If you cannot start the installation with the Windows SBS 2008 Answer File, check the following:

• Make sure that the removable media that contains the answer file is plugged into and is recognized by the server. If the server does not recognize the removable media, try using different removable media.
• Make sure that the answer file is saved with the file name sbsanswerfile.xml. If an error exists in the file name, rename the file to correct the error, and then restart the server.
• Make sure that the file sbsanswerfile.xml is located in the root of the removable media that you are using. If it is not, move or copy the file to that location and then restart the installation.

Copyright: This document supports a preliminary release of a software product that may be changed substantially prior to final commercial release. This document is provided for informational purposes only and Microsoft makes no warranties, either express or implied, in this document. Information in this document, including URL and other Internet Web site references, is subject to change without notice. The entire risk of the use or the results from the use of this document remains with the user. Unless otherwise noted, the companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted in examples herein are fictitious. No association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

© 2008 Microsoft Corporation. All rights reserved.

Microsoft, Forefront, OneCare, and Windows are trademarks of the Microsoft group of companies.

All other trademarks are property of their respective owners.
--------------------------------------------------------------------------------

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.