SSL Certificates: CSR Decoder to Verify Settings

When it comes to creating a certificate request sometimes we can miss a character or typo something.

If the processing takes longer than expected and the certificate provider does not provide much more than a "Processing" status it may be a good idea to verify the settings in the CSR file.

The CSR Decoder site can do that:

• CSR Decoder – Check CSR to verify its contents

We hit a snag with a CSR that was taking too long and sure enough there was a typo in the common name that caused it to hang up.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

ZoneEdit: How to add a Tertiary DNS Server

We needed to add another DNS server to the default two that come with the ZoneEdit DNS service.

Figuring out how was a bit of a rat’s nest.

After a note to support we have:

1. Add a new record.
2. Subdomain: @
3. Type: NS
4. TTL: 7200
5. Hostname: Choose the tertiary DNS server.
• Note: Make sure the tertiary is in a different geographical location than the other two.

Note that adding an extra DNS server is 1 credit per month.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Windows Live Writer

SBS and RDS – Big Picture How To Set Up RDS On An SBS Network

Original posted to the SBS2K Yahoo Group. This list has been tweaked and updated a bit. :)

A quick overview of how to set up Remote Desktop Services and RD RemoteApps on an SBS network:

1. Win2K8 R2 SP1 OS install
2. Server drivers
3. Updates
1. Windows Server Updates (we group 6-10 at a time).
2. Windows Server Security Updates (again 6-10 at a time).
3. Others.
4. Manufacturer’s Server Management.
• Configure management settings.
5. Enable the RDS Role (RDS + Licensing).
• Leave mode for later.
6. Install Office 2010 with SP1 integrated.
7. RemoteApp deploy needed apps including Office, QB 2011, etc.
8. Create RDP Files in RemoteApp Manager
• We create an internal RDP file set to deploy to local user’s desktops.
• We also create an external RDP file set that includes RD Gateway setting.
• We customize each file name once created.
9. Create folder under SBS RWW/RWA called RDPs.
• C:\Program Files\Windows Small Business Server\Bin\WebApp\RemoteAccess\RDPs
10. Copy RDG enabled RDP files into this folder.
• Must be done from Windows Explorer on SBS.
11. Make MIME changes for .RDP (Charlie's SBS 08 book has this)
12. Edit RWW/RWA Links in SBS Console
• Example RWW/RWA URL: https://remote.domain.com/remote/rdps/winword.rdp
• Description: RemoteApp – Word

When users connect to RDS or RemoteApp they will get a certificate warning. Coach them to tick the "Don't bug me again" box near the bottom left of the window.

Done.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Transitioning From SBS At the 75 User/Device Limit How-To

The link came via the SBS2K Yahoo List.

Chris Puckett of Microsoft provides an excellent big picture view of how one would go about removing SBS from the picture once a client has grown past the 75 user/device limit.

• Microsoft TechNet Forums: Best way to expand past SBS 2008, 75 users, and a limited network

The post by Chris:

SBS 2011 Standard still has a 75 user limit, so if you're already approaching 75 it might make more sense to go to Windows Server.  You can migrate away from SBS 2008 by adding new server(s) running Windows Server 2008 R2 as domain controllers to the domain.  Then add Exchange Server 2007/2010 server to migrate your mail to and a Sharepoint Server for that data.

There is no single document for this scenario, but you can treat SBS 2008 as Windows 2008 DC and Exchange/IIS server. The steps would not be much different. The only caveat is once you move the FSMO roles you have 21 days to complete the rest of the migration process and you would have to take care of licensing requirements
A basic outline would be

1. ADprep SBS 2008 with the 08 R2 schema.
2. Join WS08R2 DC as a secondary domain controller in the SBS 2008 Domain
3. Install Exchange 2k7/2k10 on same server or different server.
4. Move mailboxes/public folders, address book generation etc to the new server.. (there should be a guide on migrating exchange 2007 to 2010 on technet)
5. Migrate any IIS websites they wish to keep
6. Migrate any data they wish to keep to the new server (Sharepoint)
7. If folder redirection/roaming profiles configured move that stuff over to the new server by updating the user account/group policy settings.
8. Move FSMO roles and GC to WS08R2 (Might want to wait a few days to make sure everything is remaining operational as you have 21 days from this point).
9. Uninstall Exchange 2007 from SBS 2008
10. DCPromo down SBS 2008
11. Remove the SBS 2008 server from the network

We have not run into this situation with any of our clients yet, but there are a few that are growing at a rate that may place them in this situation in the next year or two.

The above gives us an idea of how to go about keeping the core SBS features, but there are a few others that need to be considered when transitioning away from SBS:

1. Replacing the TS Gateway services setup to maintain remote connectivity to internal desktops and RDS services.
2. Replacing the Remote Web Workplace/Access portal with the Win2K8 R2 RDWeb application along with customizing it to meet a similar functionality to RWW/RWA.
• Microsoft KB 2276908: Windows Server 2008 R2 - RDWeb Access and RemoteApp Configuration.
• Microsoft TechNet: Overview of Remote Desktop Web Access (RD Web Access)
• Microsoft TechNet: Overview of Remote Desktop Connection Broker (RD Connection Broker).
3. Utilizing an MMC structure much like the SBS Native Tools to start with but possibly looking to System Center for an SBS Console like management experience.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Video – An Introduction To The SBS 2011 Remote Web Access Portal

The following video gives an overview of the various features to be found in the new SBS 2011 Remote Web Access portal (formerly Remote Web Workplace in SBS 2003 and 2008).

SBS 2011 RWA has the following features:

• Outlook Web App (OWA) for full Outlook like access to our e-mail, contacts, calendars, and more.
• Access to the Companyweb SharePoint site.
• Access to shared folders hosted _on_ the SBS server.
• This new feature allows us to upload and download data as well as work with folders within the share.
• Connection to any desktop, laptop, or other Windows machine that we have been given permission to access.
• Of course that machine needs to be on for access!

The new version of RWA also allows us to customize the portal by adding Web links to various Internet based resources. We can also move the feature access boxes around to suit our tastes.

Please feel free to comment and critique any of the videos we put out.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

SBS 2011 – Remote Web Access (RWW) Shared Folders Upload With Easy File Upload Tool

When we first saw and started to use the Shared Folders access feature in the Remote Web Access portal (formerly Remote Web Workplace or RWW), we did not see it as being too useful except for spot file access.

Today definitely confirms that the Shared Folders feature is indeed useful especially when it comes to getting many large files uploaded onto our network.

The screenshot above shows a ZIP archive of two ProcessMonitor files that were created a few minutes ago.

One of those files contains the ProcessMonitor results of a successful QuickBooks 2010 open while connected using Remote Assistance while the other contains the ProcessMonitor results of the QB 2011 crash when the user opened it without any remote connections.

Yes, we are _still_ fighting to get QuickBooks 2011 and now QuickBooks 2010 to run at a client’s site:

• Blog Post: US QuickBooks 2011 R1 – Third Party Components Install Error Plus Error on MSVCR90.DLL And More

To get the 65MB file to our own site is now quite simple as we no longer need a third party service or VPN (bandwidth soak) to get the file.

While preparing to upload the file we saw the option to install the Easy File Upload Tool in the portal. So, we clicked the link and installed the ActiveX control that was needed:

Once we clicked the Install button our Upload page now looked like:

Now we no longer need to use the cumbersome Browse button method to add each file that we need to upload into the folder.

The folder access feature has become quite important to us because it is so simple to use especially once we have the Easy File Upload Tool installed!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

TS RemoteApps – Disable Printer Redirection For Branch Offices

In most cases branch offices will have a site to site hardware based VPN. In some cases where the branch office is large enough there may be a local DC or RODC installed there.

In either case we are probably joining the remote PCs to the SBS 2008 domain so that we can manage them, their updates, their mapped drive letters, and more.

So, when the remote users are connecting to their needed application via TS RemoteApps they will not need to have printer redirection enabled. If they do, then they may end up with multiple copies of the local printer being served by the TS session thus causing confusion.

So, to eliminate any possibility of confusion for the user we edit the TS RemoteApp’s RDP file that we created to disable printer redirection.

1. Create the RDP file in TS RemoteApps manager.
2. Edit the RDP file by doing the following:
1. Right click on the file and left click on Open With.
• 
2. Uncheck Always use the selected …
3. Click the Browse button.
4. Navigate to %windir%.
5. Vista/Win7: Type Notepad in the Search Windows field
• 
6. Double click on Notepad.exe found in C:\Windows
• 
7. Make sure Notepad is highlighted and click OK.
• 
• Again, make sure that Always use the selected program … is not checked.
8. Change the following setting from “1” to “0”:
• OLD Setting: redirectprinters:i:1
• NEW Setting: redirectprinters:i:0
• 
9. Save the file by clicking File –> Save.
10. Close Notepad.
11. Distribute the RDP file.

Once the above process has been done once, the Open with menu will show Notepad as an option:

We now have a RemoteApps session that will no longer show the Printer Name (Redirected) as their default printer along with (Redirected) copies all of the other standard Group Policy deployed printers that would be on their SBS 2008 domain.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Remote Desktop Services Web Access on Windows Server 2008 R2

In an e-mail list conversation a while back, my fellow MVP Dana Epp of Scorpion Software made mention of a new ability in Windows Server 2008 R2 that would give the SBS Remote Web Workplace a run for its money.

That new feature is called Remote Desktop Web Access.

This is what the logon page looks like:

Once logged in, we will see a list of applications that have been published via RDS RemoteApps:

The above applications are installed on our Windows Server 2008 R2 Remote Desktop Services server and are served to the Internet via our SBS v7 TS Gateway.

A neat aspect to this setup is that the page can be customized much like the Remote Web Workplace can . . . though with a little coding involved. So, besides the above applications, we can have links that connect users to their own office computers, or other internally based resources . . . not unlike the way we can customize the Remote Web Workplace on SBS 2008 and now SBS v7.

RD Web Access Publishing

First, we would need to create a new DNS A record for remotewebapps.mpecsinc.ca (example URI), and then purchase an SSL certificate using the IIS CSR on the RDS Web Access site.

Then, with our new Cisco SA 520 Security Appliance gateway we would bind (alias) an additional ISP IP to the WAN interface and create an HTTPS publishing rule to redirect HTTPS traffic on that IP to our RD Web Access server.

It would be pretty close to that simple.

Remote Web Workplace Links

Here are the hyperlinks to the RDP files we have configured for application access via the Remote Web Workplace:

RDP File Links

We used the RemoteApp Manager on the Remote Desktop Services server to first publish the applications.

Once the applications were published, we could then right click on each one and generate an RDP file. From there, we would copy the RDP file into a subfolder under the /Remote application folder on the SBS v7 server (can be done on SBS 2008 too).

Users can then click on the Outlook link, authenticate, and use the Outlook application on their remote system. All the while, Outlook is actually running on the Remote Desktop Services server.

Or, users can right click on the link and save the RDP file to their Desktop for later quick application access.

Note that we need to add the RDP extension to the MIME Types setting in IIS for the link to fire up the application as expected. Charlie Russel covers this in his book on SBS 2008:

• Windows® Small Business Server 2008 Administrator's Companion (Amazon.com)

AuthAnvil (AuthAnvil demo video), Scorpion Software’s two-factor authentication product, is an excellent way to provide additional security for both the Remote Web Workplace and RD Web Access.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Essential Business Server – Is Discontinued

Perhaps not a lot of folks have really delved into the product, or perhaps there was not a large adoption of the product out of the box. Whatever the root reason, Essential Business Server is no longer.

• Microsoft: EBS Offers (has the announcement)
• EBS Blog: New IT Trends Bring Change to Mid-Market Product Line

We realize that this was a _huge_ decision on their part and probably a very painful one within the product groups and the company overall.

Being an SBSer since way back when, it is actually quite disappointing to see that Microsoft has decided to cut their losses and stop development on EBS.

The disappointment stems from our belief that the EBS product was _good_ for businesses that fell in the required seat range of ~75-300. There are just so many “killer app” type features, found in SBS and then EBS, that the Small to Medium Enterprise (SME) will no longer have access to.

The number one killer application for SBS and EBS is the Remote Web Workplace. Bar none, having a one stop Web based portal for users to gain access to their network resources including their own workstation makes the administrator’s and the user’s life so much simpler.

A screenshot of the SBS 2003 RWW:

In SBS 2003, we had immediate access to OWA, our desktop via RDP, and our Companyweb SharePoint site. All with the click of a link in the portal.

The same is true of the SBS and EBS 2008 RWW but with critical additional features.

The SBS 2008 version:

RWW in SBS/EBS 2008 also has the ability to utilize the TS Gateway service to publish Terminal Services RemoteApps via a link posted on the RWW page among other new features.

These features, along with the integration of the various server components into the products are what make SBS and EBS great.

So, perhaps the death of the EBS product will bring about the rise of another?

Since RWW was introduced in SBS 2003, we have had many conversations with SME/ENT level support folks about the need for an RWW like solution for them.

It is our hope that somewhere in the midst of all of the shuffling about that is going to happen, that the Remote Web Workplace development team gets the opportunity to put the RWW product into a box so that it can be installed on a SME/ENT network.

It may be too complicated to be accomplished, but we can only hope!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Scorpion Software AuthAnvil Authentication Keyfob Tokens Have Arrived

While at the SMB Nation Fall Conference we took advantage of Scorpion Software’s bundled special.

We had a package arrive not long after we did that with five AuthAnvil tokens in it. Though they are not on the integration To Do list yet.

Once we have migrated our SBS to 2008, we will get in touch with Scorpion to schedule an installation training session that they are providing as part of the package.

Once we have done that, we will then have two factor authentication in place for our own network.

We will then begin to talk to our clients about augmenting their security setup with the AuthAnvil.

Scorpion Software has a good demonstration video here:

• Scorpion Software AuthAnvil Demo Video

Check out some of the auditing features that are demonstrated near the end of the demo video. For folks that have one username for many tasks, AuthAnvil can actually track which user logged in using that account and from where.

This is a pretty neat product and should be a serious consideration for any organization dealing with sensitive client data.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

“We need 3 PCs Networked Please.”

While in Las Vegas a lady left a voicemail asking us to help them out with networking together 3 PCs.

A quick call back to them late last week to let them know we received the message but were getting caught up and would get back to them led to another call last Friday and a chat with the general manager (GM).

They had spec’d out a Dell server at $8,000 for their needs!

Okay, so we needed to see what was going on so we arranged for an appointment that ended up happening this morning.

To date, none, none of the other I.T. service providers had called them back besides us.

Think about that for a second.

No one bothered to call back to even ask them what it was they were looking for. No one thought about how 3 users connected to Exchange and SharePoint hosting (OWN) resold by them would add that little bit more to the bottom line.

The icing on the cake was the actual visit.

It seems that the lady that put out the feeler call to all those I.T. shops including our own had somehow managed to interpret the GM’s instructions about getting things networked together to mean her machine, the QuickBooks user’s machine, and the GM’s machine connected to a server.

In reality, there were about 10 seats with a couple of laptops needed in the mix. From there, they need at least two new workstations, Remote Web Workplace connectivity was a must once demonstrated for key folks, Office 2007 licensing was needed for most of their desktops and laptops, AntiVirus, a firewall, and more.

So, where does that leave us? At a very distinct advantage to put together an awesome solution around Small Business Server 2008, Intel Server Hardware, Intel Workstation Hardware, a Microsoft Open Value Agreement for their licensing needs, and more!

Lesson to be learned?

• Always be prepared to take the necessary extra steps to look into any opportunity that comes our way.

Sometimes those opportunities may seem like they are “not worth it”, but even the smallest of deals can be that seed sown that later pays off in the way of strong business relationships and business referrals.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

SBS 2008 Remote Web Workplace Plus Its URL DNS Requirements

Perhaps one of the more common questions seen on various forums are around the Remote Web Workplace or accessing the SBS server domain via some sort of remote access method.

The simplest out of the box way to access the SBS Domain is via the Remote Web Workplace.

The portal was put in place for SBS 2003 and was and is the Killer App for SBS and small business.

When the user first hits the SBS 2008 RWW site, they will see the following:

A username and password request with the requisite visual cues indicating that the site is as secure as their banking site (third party trusted certificate installed).

As a side note, there is no reason to run with the SBS self-issued certificate anymore. The administration grief involved with maintaining remote connectivity via Windows Mobile, Windows desktop OSs and Outlook is too costly in the long run. A GoDaddy certificate is absolutely inexpensive to purchase and install.

Sean Daniel even has a great blog post on how to install that GD certificate:

• SeanDaniel.com: Installing a GoDaddy Standard SSL Certificate on SBS 2008.

So, we have our brand new SBS 2008 (setup checklist post) or migrated SBS 2008 (Our Migration Guide) ready to fly into production.

One of the most critical steps to complete before any new or migrated server is put into production is the following:

1. The client’s Web domain registrar is sourced and the logon information for managing that domain is acquired.
2. The client’s Web domain host is sourced and the logon information for their Control Panel or other such domain details management is discovered.
3. The URL for the Remote Web Workplace on SBS 2008 is settled on with the client.
4. The DNS A record pointing to the SBS 2008’s gateway ISP IP is set in place in the domain hosting DNS management console or Control Panel.

Out of the box, SBS 2008 sets the following domain during the Internet Address Wizard (using one of our domains as an example):

• remote.sbshosting.ca

However, during the Internet Address Wizard we can click on the Advanced link and change the prefix “remote” to whatever we need such as “mail” or “smtp” if the DNS A already exists for the client’s external IP address.

Okay, so we have our client’s domain hosting all figured out, the next step is to take note of the various URLs used to access the various SBS server services using one of our own domains as an example:

• Remote Web Workplace Portal
• https://remote.sbshosting.ca/remote
• Logon: Username and Pass Phrase.
• Outlook Web Access (Exchange)
• https://remote.sbshosting.ca/owa
• Logon: Username and Pass Phrase.
• Outlook Anywhere (Outlook to Exchange RPC/HTTPS)
• https://remote.sbshosting.ca
• Wildcard certificate setting: msstd:*.sbshosting.ca
• Logon: SBSDomain\Username and Pass Phrase.
• Outlook Mobile Access
• remote.sbshosting.ca
• Logon: Username and Pass Phrase.
• Terminal Services Gateway in RDC 6.x+
• remote.sbshosting.ca
• Logon: SBSDomain\Username and Pass Phrase.
• Companyweb direct access
• https://remote.sbshosting.ca:987/
• Logon: \Username and Pass Phrase (previous blog post)
• SharePoint configured site collections:
• https://remote.sbshosting.ca:987/SiteName/
• Logon: \Username and Pass Phrase (previous blog post)

The RWW portal once logged in looks like:

For most users, the simplest way to gain access to their remotely accessible resources is to start in one spot. That is the RWW.

• Outlook Web Access
• Remote Desktop connection with the list of computers restricted to the user presented. No computers allowed? Then no list at all.
• Companyweb SharePoint site link.
• The ability to manage the additional links listed under the three standard RWW buttons.
• The user can change their pass phrase in RWW or Outlook Web Access.

For those that are a bit more advanced in their abilities to get around SBS remote access they can bookmark or save shortcuts for the various needs.

From there, we can explore the Office 2007 and SharePoint integration then get really into some of the efficiencies presented with both plus Windows 7 (previous blog post).

In our experience, once the business owner has seen the Remote Web Workplace and all of its remote access goodness in action SBS 2008 becomes a very easy sell.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

Windows Live Writer

Mobile High Speed Internet – 3G Cellular Modem

We are in the process of equipping all of our technician laptops with a 3G modem.

This enables us to have a laptop at a client site and not need to plug into the client’s network where there are dedicated remote desktops available. We can remote in via RWW and work on the network that way.

We have not completed any tests of Network Access Protection on our SBS 2008 networks yet, so, we do not plug our laptops into any client network unless it is absolutely necessary whether SBS 2003 or SBS 2008 based.

The unit is a Sierra Wireless USB 598. It has a built-in flash drive that kicks in when the unit is plugged in that allows us to install the modem software and drivers via AutoPlay.

If the software and drivers are already on the laptop, the modem initializes and becomes available for connection to the Internet when plugged in to the USB port.

The connection speed was 3.1Mb/Sec (Megabits not Megabytes) during our first test on an old Toshiba running Windows 7 RC x86.

We did not sign into any long term contracts since the main CDMA players here in Canada are promising to have their new HSPA 4G networks available in time for the 2010 Winter Olympics in Vancouver.

The new network will be cross compatible with Rodger’s current network structures giving us access to the iPhone and other high speed goodies when this happens. :)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

Windows Live Writer

A DRAC, Or Any Other Remote Management Tool Will Only Get Us So Far …

Now, what happens if we have set up the server via baseboard level access to the server using the Dell DRAC add-in, or any other baseboard level management module for that manner, and the remote management module has died before we have run the SBS 2008 Getting Started Tasks?

This:

 

We are assisting with the SBS 2008 and Server Core with Hyper-V Role installs on behalf of an I.T. company at a remote client site of theirs.

So, the second option is to temporarily enable port forwarding for Terminal Services 3389 to the new SBS 2008 server so we can keep moving forward.

But, what happens if there was no one around to do that?

To pre-empt this kind of situation we would do one of the following:

• Ship a preconfigured router/firewall device with the USB flash drive that had the Answer File on it.
• Coach our contact through the port forwarding process on their firewall device.

It just goes to show us that there can be no fool-proof method of connecting to a server remotely without some sort of fall-back measure in place.

Once we had the server configured for Remote Web Workplace access the 3389 port forward would be deleted in the firewall device.

In this case, once we have tried a firmware flash to the DRAC, if things still do not work, then we will initiate a support incident with Dell and have someone come out and replace the defective unit.

The DRAC no longer shows up anywhere … it is toast. Warranty replacement time.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

Windows Live Writer

Check that Password Strength Tool

This is a neat little tool to help us educated users on password strength or lack thereof:

Since the dawn of the Remote Web Workplace in SBS 2003, we have been educating our client users to use pass phrases.

The above tool will be a very helpful part of that training.

• Microsoft Password Checker Tool.

Link comes courtesy of Sean Daniel: The Importance of a Strong Password.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

Windows Live Writer

SBS 2008 and the Self-Issued Certificate

When it comes to SSL certificates, the new certificate structure in SBS 2008 makes things a bit more difficult for the network admin.

To get things to work for our remote users, we need to get a certificate distribution package out to them:

For users that work in the office on occasion, this is not such a bad thing other than needing to coordinate getting the certificate to them so that their productivity is not impacted.

For those that work remotely all of the time, the worst thing we can do is to teach them to click through this warning:

For many of us that got our users used to passing through this warning on our SBS 2003 RWW self-issued certificate, this may have come back to bite us in the form of a compromised system as the user did not stop to think about clicking through a certificate warning at a “banking” site they went to via an e-mail.

If we try and connect to a system via HTTPS/RDP using the SBS TS Gateway service or via RWW, we get the following warning after a short pause:

To install the SBS self-issued certificate, double click on the InstallCertificate executable and:

Choose the destination for the certificate. In this case, we are installing the certificate on a laptop we use to manage client systems with. The third party certificate is not ready yet and we need to continue the SBS 2003 to SBS 2008 migration setup.

On this Windows 7 based laptop, a UAC prompt happened at the beginning of the certificate install.

Once installed, we were able to open the Remote Web Workplace on our new SBS 2008 box and log onto the server’s desktop via RDP to discover that our Exchange Mailbox move process had completed 100% successfully! :)

NOTE: It is not a good practice to place the certificate distribution package on a Web site or other public location for “ease” of distribution. The best and only method for distributing the SBS self-issued certificate is via USB flash drive.

Once the user has installed the certificate on their machine, they should delete the files from the flash drive.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

Windows Live Writer

SBS Migration DNS and Shaw’s Customer Phone Support = Huge Improvement

At least here in the Greater Edmonton Area.

In the past, trying to get through to Shaw Internet Support would cost at least half and hour to an hour of wait time. Once through, the folks on the other end of the phone would not necessarily follow through on the support request or not understand what was being asked of them.

We needed to make DNS changes to our client’s domain hosting setup to prepare for the migration we are doing today.

The call was on hold less than 5 minutes and the fellow that took care of all of the needed changes took care of them all without any problem.

• Redirect www.domain.ca to Shaw’s servers for hosting their site. It is currently hosted on their own internal server.
• Implement ExchangeDefender’s inbound MX record for their domain e-mail.
• Implement a DNS A record for remote.domain.ca to point to the new SBS 2008 server.

With these changes out of the way, we are now getting ready to remove ISA 2004 from SBS 2003 and restructure around 1 NIC. From there, we will install SBS 2008 in Migration Mode and go as we have done the preliminary health checks on our source server and everything looks to be good to go! :)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

Windows Live Writer

Allowing a Dell DRAC (Remote Management) Session through ISA

The Dell Remote Access Card (DRAC) requires a couple of ports to be opened up outbound through our ISA servers in order for the Console redirection function to work correctly on a remotely managed server:

• TCP Outbound: 5900 (Keyboard and Mouse)
• TCP Outbound: 5901 (Video)

Create a custom protocol with the above settings, we call it Dell DRAC, and then create an Access Rule that allows the custom protocol from Internal/Local Host to External for All Users.

Once the rule has been created we are able to remote into any Dell server that has a DRAC 5 installed.

For any client that we support remotely, we make sure to have a remote management capability in the box ahead of time. This gives us console access via an Internet connection for those times where an OS may have stopped responding and we need to power cycle the box. Or, for SBS updates that like to kill Exchange, IIS, and/or RRAS thus taking us out of our remote session via the Remote Web Workplace or PPTP VPN.

As a result, we no longer need to have a timed script in place to force the box into a reboot during updates which may not bring the box back up in some cases where an update chokes the NICs, RRAS, or even IIS.

An additional benefit to having a remote management capability is being able to watch the boot cycle from start to finish. We can see all of the BIOS, RAID controller, and other firmware messages on our screen prior to the OS loading. It is one more way for us to assess the health of the server.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

Windows Live Writer

Windows 7 Release Candidate RDP Supports Multi-Monitors!

Need we say more:

Use all my monitors for the remote session

What a huge leap ahead.

Most users that we work with have discovered the significant increase in productivity that two or more monitors can provide for them in their offices. Now they can have that same productivity from home.

The multi-monitor feature will make Windows 7 a very valuable upgrade option for those that connect to their in-house/office systems via the Remote Web Workplace and always have at least two monitors connected to the remote workstation.

It will be a great feature for those that manage networks via remote connections too.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

Windows Live Writer

Some Thoughts on SBS 2008 and Branch Offices

When looking to deploy SBS 2008 into a situation where SBS will reside in the main office and there will be a branch office or offices.

If there are only a few seats at the branch offices, then a simple solution is the have SBS 2008 Premium at the main office with either a Terminal Server serving remote desktops or a Hyper-V box serving desktop OS based virtual machines.

The catch would be the requirements of the Line of Business (LoB) applications that are needed.

Using the Remote Web Workplace in this manner, we can eliminate the need for a server at the branch office.

If the Line of Business applications allow for Terminal Services installation, then another option would be to publish the LoB via Terminal Services RemoteApps. The user can get to the Lob app via RWW or via an icon on their desktop.

In either case, Scorpion Software’s AuthAnvil should be seriously considered to protect those TS Gateway sessions with another layer of security. The expense is relatively minor compared to the peace of mind we would have knowing that our client’s TS Gateway is protected.

For larger installations where there are a number of users at the branch office or offices, then a hardware based VPN setup would be a consideration. Keep in mind that bandwidth considerations and ISP stability are important when looking to a VPN as part of the overall solution.

A Read-Only Domain Controller on Server Core along with the needed Roles could provide local users with authentication, file, print, and centralized backup services. Server Core provides the opportunity to really slim down the needed hardware, or even repurpose existing server hardware for the branch office.

Install the full Server 2008 install, then WSUS can be installed on the branch office server and Group Policy can be customized to facilitate the local clients getting their updates from the local WSUS. This setup can be tweaked for more than one branch office with a server in each too.

Ultimately, our solution direction would depend on the client’s industry their LoB needs, compliance, retention, and remote access needs. It is our preference to have remote users connect via RWW and work with all data stored on the main office’s network.

This preference is due to the reduction in complexity that happens as a result of keeping everything relatively centralized. KISS (Wikipedia) is the operating principle behind our preference.

However, ultimately the solution we tailor will be with the client’s best interests in mind.

We will run through some actual configurations in our upcoming SBS 2008 Advanced Blueprint book too.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

Windows Live Writer