SMB Nation Fall: Taking My IT Support Business to the Next Level

It's official, I will be at SMB Nation's fall conference in Las Vegas.

• SMB Nation Fall Content

The following blog posts are an outline of the planned discussion:

• A little SBS History Lesson. What SBS Has Been, Is, and Always Will Be 
• SMB Solution Sets Going Forward 
• One Little Feature Where In-House/On-Premises Kills Cloud 
• The SMB Market - The Astute Small Business Owner 
• The SMB Market - IT Commodity or IT Contact?
• Small Business Owners Take Risks - Huge Life Changing Risks

Believe me when I say that we have been going through a lot of soul searching in the last six to nine months. We MVPs were just as much in the dark about the goings on around SBS and the product group's directions as all y'all out there.

As of today we see a lot of opportunity for us in the current SMB IT environment for those that have honed their skillset and are continually working on them.

We see an even larger opportunity for the IT Support Shop that provides a consistent On-Premises IT Solution experience for their clients. Let's talk about that.

Let's talk about the real-world experience of Cloud, Hybrid, and On-Premises IT Solutions for our clients. While our client's preferences at this time are for On-Premises we do have a number of clients that are Hybrid and a few that are almost completely in the Cloud.

The goal for the session will be to have a fairly solid understanding of what our client's options are, what our options are as the IT Solution Provider, and to have a big to medium picture road map in place for us going forward.

• On-Premises, Hybrid, and Cloud Solutions
• What are they and how do they work for our clients and us?
• Vehicles to specialize
• Training, Certification, More
• Business Plan
• 1 Year, 3 Years, 5 Years
• Where do I want my clients to be in 5 years?
• Where do I want to be in 5 years?

With all of the angst over the changes, the Cloud being pushed really hard, and uncertainty all around we need some hope. And hope is what we intend to bring about in this session.

Thanks for reading! :)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

A little SBS History Lesson. What SBS Has Been, Is, and Always Will Be

This post is my reply to John773 on the Spiceworks Forum.

***

John773: . . . The roadmap is about options, and SBS was synonymous with limits.

John,

Yeah, there were limits, but to the small business those limits were relatively _unseen_.

What small business did see was a server setup that gave them complete agility. They could be mobile, they could be in-house, they could be both. They could use any device they could throw at SBS to gain access to their e-mail, calendars, and so much more at that time.

SBS was _the_ platform to build a small business on. Period.

To folks out in the Enterprise and SME Space the "limits" of SBS could indeed be seen as such.

But realistically, to the small business owner the exact OPPOSITE was the case. SBS enabled them.

In 2003 with the release of the Remote Web Workplace we garnered attention from Enterprise because RWW was a Killer App. And it was. Now the business owner could have their cake and eat it too.

ISA for SBS 2003 Premium RTM/R2 was the cat's meow for dealing with many of the outlying threats of the day. All of our clients ran Premium with ISA providing needed edge protection.

Yeah, by 2008 that platform was indeed long in the tooth, but SBS 2008 gave us everything we already had plus access to our newly deployed RemoteApps via RemoteDesktop Gateway that was built-in to SBS 2008.

For 2008 RD Gateway was the killer app tied into the ability to deliver LoBs via RemoteApp.

Business owners liked the simplicity of one shortcut to open their bookkeeping anywhere or via link in the RWW portal. They liked RemoteApp for keeping data in-house while users were out and about.

For 2011 we gained the Folder Share feature in the newly branded Remote Web Access portal. We still had all of the goodness of the previous generations plus we could now download and upload files as required.

Now, here we are in 2012 and change is afoot.

What does that mean?

Well, it means that we can get Remote Web Access on a number of different platforms now (BBbyGramps for one).

We can virtualize the DC (Windows Server 2012 Essentials or Standard) and Exchange on two VMs to give us our 1 box solution but keeping things discrete.

No more BESx (if they are still around a few years down the road ;) ) blowing up the _entire_ platform! Or any other LoB running interference or hogging memory on the one box setup for that matter.

MOST IMPORTANTLY: It means _nothing changes_ for our clients!

We still provide the best IT solution that we can to enable them and their businesses! This whole situation is about our clients. That is why we do what we do. So, any Microsoft stack solution will need to address all of the features that our small business clients have been used to on the SBS platform but also incorporate some of the new ones like DirectAccess.

Enabling a small business was what SBS was all about and it hit a home run consistently for _ten years_ running! How many products can we look at in recent years can say that they have had a 10-15 year run of success?

In conclusion, in today's IT world I do in fact agree with you. SBS 2011 is limiting. There are just too many opportunities for customizing a stack based solution for our small business clients that were not there even three years ago.

However, historically I flat out disagree with you. From the moment SBS 2003 began to be deployed right through to the moment the last SBS 2011 Standard server is retired SBS will have more than met the small business owner's business needs built on IT Solutions.

***

Small Business Server met a specific need and met it very well. :)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

It's Official: SBS Standard Is No More

It looks as though we will not be seeing a Standard version of SBS or the SBS product moniker anymore:

That document is available here:

• Windows Server 2012 Release Candidate
• Click on the FAQ link to get a copy of the PDF.

We have a copy of the current PDF that contains the above information on our own site as well.

• Windows Server 2012 Licensing and Pricing FAQ PDF

More to come on this subject! ;)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

SBS - Trend Worry Free Business Security Event ID 537

Over all, we have been quite happy with the Trend Micro Client/Server/Messaging SMB product.

It installs fairly smooth on the server and relatively smooth to the clients.

In one case, we have upgraded our client's SBS server and the client machines to the new version of the product called Worry Free Business Security.

This is the first SBS box that we have done this on with others to follow.

Since the upgrade, we are seeing the following in the morning reports:

Security Event ID 537: An error occurred during logon.

Notice that there are a lot of them.

The only indication that we are dealing with a Trend problem is from the Microsoft SBS newsgroup here: Failure Audit 537 in Event Log. Our circumstances are identical to the newsgroup poster.

So, we too have opened a trouble ticket with Trend to further investigate the problem.

For now, we will not be upgrading any further SBS boxes.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SMB Nation Toronto and SMB Nation Fall 2008 Conference

This post is a long time coming and an apology to Harry Brelsford for taking such a long time to get it together!

In April, I received an invitation and a complimentary conference pass from Harry Brelsford of SMB Nation to attend the SMB Nation event in Toronto (Previous blog post).

With the approval of my wife and business partner Monique, I setup the flights, lodging, and any other travel needs for the trip.

SMB Nation Toronto was my first venture into a full scale conference event that was not put on by Microsoft, Intel, or other vendors and that required a fee for entrance.

The contacts that were established at the SMB Nation Toronto event are priceless. Here were people who were serious about I.T, about their I.T. businesses, about sharing their experiences during the various sessions, and the attendees developing their skill sets both in the sessions and out.

A few of the presenters and their sessions that I attended:

• Calvin McLennan SBS MVP
• Calvin gave us a deep dive into the new Small Business Server 2008.
• His presentations were matter of fact and involved all of us who were a part of the sessions. Calvin welcomed questions and worked through many of them as well as he could given the beta nature of SBS 2008 at that time.
• Keith Benedict
• Keith gave us an excellent and in-depth look into the inner workings of Windows SharePoint Services 3.0.
• Have a look at his company's SharePoint 3 site to get an idea that he really knows his stuff!
• Joe Schurman
• Joe presented the new Response Point Service Pack 1 product features to us. Wow!
• The product rocks and Joe did a great job on showing us the simplicity in managing RP's very advanced features.

Other presenters included Microsoft SBS and EBS Product Manager Constanza Zalba, Stuart Crawford, and Gavin Steiner.

When it comes to the people attending the event, there was a really neat thing: There was no need to sift through all of the attendees to discover the gems. Everyone there was passionate about what they do and the products they work with. The friendships that I established at the SMB Nation Toronto event have carried on to this day.

It is important to note that the time spent at an event of this magnitude and expense was seen as an investment by those who went. That, to me, is the key to the quality of the presenters and attendees that I met.

This fall, SMB Nation will be having their annual conference in Seattle:

SMB Nation - Fall Conference 2008

For those with the opportunity to travel to the conference, I highly recommend it. It will be an excellent opportunity to meet, speak, build business relationships, and friendships with your peers as well as build up the knowledge foundation.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Microsoft Group Policy Team Survey - SBSers let your voice be heard!

Courtesy of Jeremy Moskowitz: Microsoft Survey: How Do You Use Group Policy on Your Servers?.

The Microsoft Windows Group Policy team is interested in your feedback on how your organization uses Group Policy to manage your servers. Thank you in advance for taking a few minutes out of your busy schedule to provide feedback.

The information you provide will be anonymous and confidential.

Thanks
Microsoft Windows Group Policy Team

Please get in there and help the GP team out with some SBS related Group Policy usage!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Books: Group Policy and Creating the Secure Managed Desktop by Jeremy Moskowitz

One of the first things we discover when we are searching about for answers on any Group Policy related issues is the name Jeremy Moskowitz. Jeremy is a Group Policy MVP, runs GPAnswers.com, and does a lot of in-person training on Group Policy. He knows his stuff!

Keeping up to date on the changes in Group Policy (GP) from RTM/Gold products through Service Packs can be a challenge. Structuring our OUs and GPs appropriately can also be a challenge, especially for the new GP structures introduced with Windows Vista and now Server 2008.

There are two fantastic book resources by Jeremy Moskowitz available to us:

1. Group Policy: Fundamentals, Security, and Troubleshooting
2. Creating the Secure Managed Desktop Using Group Policy, SoftGrid, Microsoft Deployment, and Other Management Tools

A nice touch for those who order from his Web site is they come autographed.

Given that we are currently in a major learning mode for Small Business Server 2008 and Essential Business Server 2008, picking these books up to facilitate our knowledge building on the new Group Policy structures is a good idea.

They are well written with a plethora of real world examples. Whenever a new edition of the books is available we make a point of picking them up. They are really that good.

For us, providing a secure and properly structured Group Policy setup is mandatory for our clients. Thus we make a point of learning the GP guidelines that are available to us.

From securing Terminal Servers to setting up OUs with computers or users with specific GPs defined for them, we need to understand how the various policy settings affect those OUs and any OUs nested within them. Jeremy's books provide one of the better ways to do so.

Also, the GPAnswers.com Web site is another great resource. There is a user community of very helpful folks to work with when it comes to Group Policy related questions and issues. Check it out, it will be well worth your time.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Jason Miller Presents: First Technical Look at SBS 2008

As mentioned in yesterday's post, I was in Calgary all day for the First Technical Look at SBS 2008.

It turns out that our presenter was Jason Miller SBS MVP.

The presentations were excellent as were most of the demos other than a few typical VM glitches.

Jason gave us a pretty thorough walk through of the SBS Console and the various features controlled and monitored there. The event size was small enough, roughly 25 of us, that we were able to ask questions and work with Jason through the demos. Since all present were mostly focused on SBS, we spent most of our time on SBS. He did give us a good overview of EBS and its features though.

Jason's presentation skills were excellent and I appreciated the fact that he made a good effort to keep us involved and things interactive. Well done Jason! :)

The time spent watching and listening to Jason, as well as the attendees and their questions/input, was well spent. The general consensus at the end of the event was very positive ... we all enjoyed ourselves and learned a lot.

Microsoft put in a good effort into providing us with a venue that worked with the tasks at hand along with a full breakfast and lunch. The food was excellent as was the service provided by the hotel. The event, venue, and catering was consistent with previous free Microsoft sponsored Partner Training events. This is good to see.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

First Technical Look at SBS 2008 and EBS 2008 - Calgary

By the time this gets posted using Blogger's Scheduled Post feature, I will be registered and getting ready to start the day at the Partner Learning Event: First Technical Look at Small Business Server 2008 and Essential Business Server 2008 (MS Partner Site authentication required).

The event is being held at the Calgary Four Points Sheraton on Bowridge Crescent.

I am looking forward to the day as I have been invited to write an SBS 2008 technical article for SMB Nation's SMB Partner Community Magazine. The Partner Training should put a good depth to the already intensive amount of time that I have personally spent with the Release Candidate version of SBS 2008.

There may be a few more of the First Technical Look events so have a look in the Partner Learning Center to see if there are any available in your area.

I personally receive a lot when I listen and watch. While reading a technical manual/book and doing is my primary learning method (especially since things get broken ;) ), spending time with knowledgeable people demonstrating a product's abilities is a very close second. Having someone knowledgeable in the room facilitates thought flow and almost always initiates a whole series of questions ... some good and some not so good. But, they get asked, and we all learn!

And, if you can, register and download the RC0 version of SBS 2008. Check it out. It only takes 30-90 minutes to install from scratch. You can use a consumer router to protect it for testing purposes and run the setup using an Answer File (previous blog post) so that there is only about 10 minutes worth of initial babysitting that needs to be done!

As has been mentioned here in the past, there is a lot to learn for this new version. The new SBS Console or the SBS Console in Advanced Mode (has links to the various server component MMC consoles) give us the ability to run virtually all of the basic server management needs at the big picture level.

But, if we need to fine tune the product, customize Group Policy (entirely new structure and policy distribution setup), user and computer settings, Exchange setup, Terminal Services configurations, and more then we need to understand how the SBS 2008 Wizards configure the installed server components.

This is not unlike the SBS 2003 Wizards and their interaction with the various server components. Knowing how they were intertwined with those components was an awesome way to establish a knowledge foundation on each server product installed on SBS. That foundation enabled us to develop a deeper understanding of Server 2003, Exchange 2003, SharePoint V2 & V3, and more. So far, it is looking like the same can be said of the SBS 2008 Wizards and their interaction with all that is installed on SBS 2008.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SBS 2008 - The Daily and Weekly Reports

There are two types of reports in SBS 2008 by default:

1. Daily Summary Report
2. Weekly Detailed Report

This is what the SBS 2008 Daily Summary looks like:

SBS Summary Network Report

The weekly report has a Details hyperlink on the right hand side that would break out all of the items under each heading:

Detailed Network Report

After clicking on the Details link:

Security Details

We will now have a lot more information given to us via the built-in SBS reports. Also, the Reports section in the SBS console also gives us the ability to generate any number of report types at a moment's notice. As a result, it will be a lot easier to get to know a particular SBS box and its regular behaviours.

The new reports will also give those of us who have not taken the step into Managed Services the ability to at least bill on a monthly basis for the reports monitoring ... if we are not already doing so! They can also provide the foundation from which to build a case for a product like System Center Essentials to provide a more detailed monitoring setup ... and thus more revenue.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Microsoft Event: Accelerate your Business - Calgary

We are currently on our way down to Calgary for the Microsoft Canada Event for Partners: Accelerate Your Business.

The focus of the afternoon will be on business opportunities in the new Small Business Server 2008 and Essential Business Server 2008 product platforms.

There will also be an exclusive MSBS Small Business Specialist Community session at 17:00 (5PM) that is something to look forward to.

This event will also be held in the following cities:

• Acclelerate Your Business: Montreal May 27, 2008
• Acclelerate Your Business: Mississauga May 29, 2008
• Accelerate Your Business: Vancouver June 3, 2008

If you have the time, please come on down and check it out!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SBS 2003 R2 - Setup steps and resources - Revised V2.1.1

This is a revision of the original post: SBS 2K3 R2 - Setup steps and resources.

It has been updated to include some new functionality as well as some available feature additions that can be installed during the various stages of the setup.

1. Install the base OS to the primary OS drive formatted leaving 10 GB unused on the drive during setup. All other drives/partitions should be left untouched at this time.
2. Stop the continuing setup after the reboot by cancelling it.
3. In between Phase 1 and Phase 2: Install relevant drivers, format the partitions and drives.
4. Install the following Windows Server Tools:
• Windows Server 2003 Service Pack 2 32-bit Support Tools
• Windows Server 2003 Resource Kit Tools
• Windows Server 2003 Service Pack 2 Administration Tools Pack for x86 editions
5. Move the Swap File over to the partition created out of the above 10 GB. This partition can be used for the ISA URLCache as well.
6. Verify all devices are recognized and happy.
7. Run Phase 2 setup via the Setup icon on the desktop.
8. We set the MSDE Engine, Users Shared Folders, Client Applications, and Sent Faxes to the same drive/partition.


9. After the final SBS reboot, enter the Domain Admin account into the DHCP Manager's properties.
10. Finish the install by completing the ToDo tasks.
• OPTION: Install Access Based Enumeration for greater folder security. Enable ABE by share as opposed to globally.
• OPTION: During the CEICW add the following attachment extensions to the Exchange exclusion list: .htm .html
• OPTION: Revise your user template Quotas as appropriate by right clicking your data drive --> Properties --> Quota --> Quota Entries and change the template volume.
• OPTION: Download and install .NET 2.0 in preparation for SyncToy.
• OPTION: Download and install the Microsoft copy utility: SyncToy 1.4.
11. Install the Premium Technologies with SQL Server 2005 Workgroup Edition followed by ISA 2004 SP1.
• Obtain and apply the latest SQL Service Pack
• Obtain and/or apply the latest SQL 2005 Post SP2 Hotfix for the common SQLVDI Errors (if SP3 is not released yet)
12. Install ISA 2004 via the Premium Technologies CD
• The CEICW will fail on the initial ISA install. ISA SP2 or later will fix that.
• Note that during the ISA CEICW one will need to recheck any extra settings at the Web Services Configuration step as it tends to pull them back.
• Make sure that the Create Certificate is also left at the setting it chooses.
13. Install the components and updates from the R2 Technologies CD.
14. Install IE7 for Windows Server 2003 (download link).
15. Complete the Post Exchange SP2 Must Dos (previous blog post).
16. Enable Exchange settings: "Display routing groups" and "Display administrative groups" by righ clicking on the Exchange "First Organization" --> Properties and tick both. Apply & OK.
17. If there are no pre-Exchange 2000 servers on the domain switch to "Native Mode" while in the above Properties.
18. Look at the client email Mailbox size limits. We tend to set the limit to 1GB out of the box.
• Under Advanced Management: MySBSDomain (Exchange) --> Administrative Groups --> first administrative group --> Servers --> MySBSServer -->First Storage Group --> Right click Mailbox Store (MySBSServer) and Properties --> Limits Tab.
19. Update the Exchange registry settings for the Greylist problem that Exchange seems to be having: Exchange may not be retrying! (previous blog post)
20. Impliment Recipient Filtering to protect against a Reverse NDR Spam Attack (previous blog post) and avoid an SMTP Queue Length error in the inbox.
21. Install WSS 3.x in side-by-side mode (official SBS blog post on the matter). Why? Because the WSS 3.x and Outlook two way functionality may be required for WSS hosted calendars, or the Recycle Bin may be for those who "accidentally" delete files.
22. Install WSUS 3.x afterwards (previous blog post on WSUS 3.x install experience).
• Note that WSUS v2 should be synchronized before installing WSUS v3.
23. At the command prompt, run the appropriate osql commands to tame SQL's memory usage (previous blog post explanation).
24. RipCurl the SBS R2 box for Vista and Office 2007 compatibility (previous blog post).
• ISA SP3 to follow the RipCurl Patch for ISA
25. Uncheck "Shutdown worker processes after being idle for (time in minutes)" under the Performance Tab for the DefaultAppPool in IIS.
• This reduces the first visit to Companyweb browser stall in the morning.
26. Setup any Software installs via Group Policy (previous blog post) making sure to modify the permissions on \ClientApps\.
27. Create and setup any custom Domain or OU level Group Policy Objects.
• We remove a domain user's ability to remotely shutdown any system as one example.
28. OPTION: (May not be needed if you plan to use WSS v3 as principle) Upgrade the Companyweb SharePoint MSDE instance to SQL 2005 (smallbizserver.net article) and enable Full Text Search.
29. OPTION: Backup the server using your preferred backup method. Ours is StorageCraft's ShadowProtect. Crash the drives. Restore from backup and then deliver.
30. OPTION: Enable users ability to change their password while working in Outlook Web access (OWA) (previous blog post).

In the case of the R2 Tech CD, verify that the Service Packs are still current before installing. If not, download and install the most current Service Pack.

Post Updates:

• 2008-01-18: Added steps 4a, 4b, and 4c above to download and install the appropriate support tools.
• 2008-02-15: Added the step to implement Recipient Filtering in Exchange to avoid SMTP Queue Length errors and protect against a Reverse NDR Spam Attack.
• 2008-03-24: Added IE 7 for Server 2003 download link and install recommendation. Also added the link to SyncToy 1.4 to download and install.
• 2008-04-19: Added the need to apply a SQL 2005 post SP2 Hotfix
• 2008-04-21: DHCP credentials required, SQL SP2 references, ISA not installing on more than 4 cores, and IIS setting for Companyweb.
• 2008-08-11: Added the note that WSUS v2 should be synchronized prior to WSUS v3 being installed.
• 2009-08-26: Added the option to allow users to change their password in OWA.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SBS - Top Ten (Plus One) Myths about Windows Small Business Server 2003

We came across this Microsoft site: The Top Ten (Plus One) Myths About Windows Small Business Server 2003.

Here are the myths in a nutshell:

1. I cannot add additional servers to a Windows SBS domain.
2. I cannot run Terminal Services in the Windows SBS domain.
3. Windows SBS doesn't scale.
4. Windows SBS requires different hardware than Microsoft Windows Server 2003.
5. I cannot upgrade my current server.
6. I'm going to outgrow Windows SBS.
7. The Exchange Server 2003 mail store limit is too small.
8. My applications are not supported on Windows SBS.
9. Windows SBS has scaled-down versions of applications.
10. I can't use the tools from Windows Server 2003 in Windows SBS.
11. Windows SBS isn't secure.

For those of us who design, implement, service, and support network infrastructure around SBS, we know these myths are a load of bunk.

If anything, it is a good 5 minute read to refresh and/or inform us of what SBS is not.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SBS - RWW Time Outs and Security

Quiz time folks! ;)

How many minutes before the RWW connection is killed when the "I'm using a public or shared computer" is checked?

How many minutes before it is killed with the box unchecked?

For all SBS users, there is nothing more important than having it trained into them over and over again to make sure that they always close and save their work and lock or log out of their workstation before walking away.

Even if it is for 5 minutes. That workstation and the data it accesses has to be protected.

Ever loose something because the program the data was residing in was closed due to an overnight forced reboot after an update?

Ever loose something because someone needed to remote into the workstation in the evening and nothing was closed or saved?

When it comes to remote access via the RWW, this little check box can mean the difference between the life and death of a company:

So, Internet Café, public library, public kiosk, or anywhere where there is a danger someone will mess with the RWW connected laptop/workstation (yes, even the kids) that check box should always be left checked!

And if there is a need to walk away from that remote session for whatever reason, lock it! From the Start Menu, click "Windows Security" if you see it and then click the Lock Computer button.

If the Windows Security option is not on the Start Menu, then it is up to us administrators to provide a way for remotely connected users to lock their workstations.

To do this create a shortcut on the desktop and type the following in the command line:

rundll32.exe user32.dll, LockWorkStation

Click Next, name the Shortcut and click Finish. If needed, one can change the icon to whatever via Right Click-->Properties-->Shortcut Tab-->Change Icon button.

Copy that shortcut onto the network so that it is accessible to all users who remotely connect to their workstations and send them a note to put a copy of it on their own desktops and use it.

Or, enforce the Windows Security item be on the Start Menu via Group Policy.

Answers to the quiz:

Time out for Public/Shared: 20 minutes.
Time out for Public/Shared unchecked: 120 minutes.

Two hours eh? See why it is so critical?

Managing Windows XP Service Pack 2 Features Using Group Policy: XP SP2 GP Word Document.

Group Policy Settings Reference for Windows Server 2003 SP1: W2K3 SP1 GP Excel Spreadsheet.

Group Policy Settings Reference for Windows Server 2008: W2K8 GP Excel Spreadsheet.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

SBS 2K3 R2 - Setup steps and resources.

We are running through some setup scenarios on SBS 2K3 Premium R2.

Here are some resources that come in handy:

• Completing Setup: Microsoft Windows Small Business Server 2003 R2 (Word document download).
• Release Notes for Windows Small Business Server 2003 R2

In our experience, to augment the Completing Setup document we do the following when installing SBS 2K3 R2 Premium:

1. Install the base OS to the primary OS drive formatted leaving 10 GB unused on the drive during setup. All other drives/partitions should be left untouched at this time.
2. Stop the continuing setup after the reboot by cancelling it.
3. In between Phase 1 and Phase 2: Install relevant drivers, format the partitions and drives.
4. Move the Swap File over to the partition created out of the above 10 GB. This partition can be used for the ISA URLCache as well.
5. Verify all devices are recognized and happy.
6. Run Phase 2 setup via the Setup icon on the desktop.
7. We set the MSDE Engine, Users Shared Folders, Client Applications, and Sent Faxes to the same drive/partition.


8. Finish the install by completing the ToDo tasks.
9. Install the Premium Technologies with SQL Server 2005 Workgroup Edition followed by ISA 2004 SP1.
10. Note that during the ISA CEICW one will need to recheck any extra settings at the Web Services Configuration step.
11. Make sure that the Create Certificate is also left at the setting it chooses.
12. Install the components and updates from the R2 Technologies CD.
13. Complete the Post Exchange SP2 Must Dos (previous blog post).
14. Update the Exchange registry settings for the Greylist problem that Exchange seems to be having: Exchange may not be retrying! (previous blog post)
15. Install WSS 3.x in side-by-side mode (official SBS blog post on the matter). Why? Because the WSS 3.x and Outlook two way functionality may be required for WSS hosted calendars, or the Recycle Bin may be for those who "accidentally" delete files.
16. Install WSUS 3.x afterwards (previous blog post on WSUS 3.x install experience).
17. At the command prompt, run the appropriate osql commands to tame SQL's memory usage (previous blog post explanation).
18. RipCurl the SBS R2 box for Vista and Office 2007 compatibility (previous blog post).

In the case of the R2 Tech CD, verify that the Service Packs are still current before installing.

If newer Service Packs exist, do a bit of searching to verify their compatibility with your SBS installation before installing them. A good example of this is Windows Server 2003 Service Pack 2 as there are lots of caveats on SBS (KB 555912) .

Our partitioning schemes (previous blog post) come via experience trying to recover multiple partitions on one drive or array. That can be extremely difficult. Sometimes, KISS really works. :D

UPDATE 2007-09-06: Reversed steps 13 and 15 to set them in the correct order!

UPDATE 2007-09-07: Added the Exchange registry settings for its seeming difficulty with Greylisting and Tarpitting and the RipCurl step.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

SBS - Post Phase 2 SBS install MUST Do

One of the first things we do once we have finished the final steps of the SBS install ToDo list is change the administrator's logon via Group Policy.

This is why:


Imagine if the one trying out the default Admin username was able to work with it?

It wouldn't be too pretty if they actually managed to get in would it?

To do the name change, we create and link a new policy at the domain level that is called: Default Domain Security Policy:

From there, we set the Admin name to change:


This setting change is security critical. It greatly reduces your SBS server exposure.

Once you GPUpdate /Force the few dependent services like the DHCP Credentials will need to be updated.

This setting change must be done before setting up any scheduled tasks that will be dependent on the Administrator account.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

SBS - Backing up that laptop or workstation.

As mentioned yesterday, we have a client who used the built in Lenovo Rescue & Recovery utility (previous blog post) to make a backup image at the end of May.

The hard drive in that laptop crashed, with us able to recover the contents of the drive after much difficulty.

What are some of the ways to mitigate data loss in this kind of scenario?

1. Exchange integrated Outlook.
2. My Documents Redirection.
3. User training to store all data in My Documents.
4. When profiling a new laptop, default all client applications to save to My Documents .
5. User will back up the data.

The first two plus the training are an integral part of an SBS environment.

A simple SBS wizard gets the My Documents redirection setup done.

The last one though, is a variable that can make or break an organization. Despite training, and even the client application setup, the user may have data all across their hard drive.

Some even forget to make their backups on a regular basis.

So, despite the ability presented to the user via the Lenovo Rescue & Recovery utility, it is dependent on the user actually using it!

As administrators of multiple SBS domains across many SMBs, we have a huge gamut of experience with various user skill levels.

Here is one very important lesson to be gained with all of that experience: We must have a centrally managed, full backup of the client desktops and laptops.

We believe that we have found it in StorageCraft's ShadowProtect Server & ShadowProtect Desktop software.

We filled out the Reseller Application and received the welcome package with the products as well as the ShadowProtect IT Edition in it.

If the product works as advertised, we will standardize all of our backup solutions on it. We will be installing it into our lab environment and tearing it apart to see how it works. If we are satisfied, we will install it on all of our servers and workstations in-house and go through some failsafe testing there. Only once we are satisfied with our experiences in-house will we begin selling the solution to our clients.

Look for more posts on ShadowProtect and our experiences with it.

Thanks to Susan Bradley for pointing us to StorageCraft: Mark Crall on StorageCraft and Mark Crall Live.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

Mac on SBS - Going to get a Mac!

Well, we need to buy a Mac.

So, we searched around for an Intel based Mac and found an iMac that is about a year old for a reasonable price. Hopefully it turns out to be reasonable after all! ;)

Why do we need to buy a Mac?

Because a new client we are doing a Technology Assessment for is pretty much 100% Mac based. Their business systems are so tied into the Mac platform that it would be too painful to try and migrate them over to a Windows based platform.

So, we are buying a Mac so we can tear it apart and put it back together over and over again on our SBS network.

We need to make sure that the information documenting connecting a Mac to an SBS infrastructure will work. That along with testing VPN & RDP setups for connecting to remote desktops bring us to the need to have one.

We will make sure to chronicle our adventures in MacLand here! ;)

We will head our Mac posts here with the "Mac on SBS" title as well as tag to make them easy to find.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

SBS 2K3 Premium - ISP changes the static IP, now what?

As was mentioned earlier, our clients affected by the extended Internet outage had their static IP changed during the upgrade to DSL 2.0.

With SBS 2K3 Standard, all one needs to do is change the IP, Subnet, and Gateway on the second adapter (if installed). Or, the same changes would need to be made on the Router/Gateway box protecting the SBS network. Obviously this would have to be done on-site by someone with admin access, or via a service call by us.

The second thing common to both versions is to update the client Internet domain name's DNS settings for e-mail if the client has their domain e-mail coming to the SBS box via SMTP. This involves updating the IP associated with the MX and A record pointing to the old IP:

• MX 10 mail.mydomain.com
• A mail.mydomain.com 24.62.26.42 (old IP)

Updated to:

• A mail.mydomain.com 62.24.42.26 (new IP)

If any updates in WSUS were approved just before the connection went down and hadn't yet had a chance to synchronize and download, they will have errors beside them (shown by a red x in the WSUS Web console). One will need to approve them again in order to get them to download and install properly. In this case we were dealing with WSUS 2.0. Once should verify the WSUS 3.0 updates status as well.

Once the above steps have been completed, then on the Premium boxes, we need to make some changes to ISA as well.

1. On the second NIC (WAN=ISA), the IP, Subnet, and Gateway need to be changed to the new settings. Note that DNS on this adapter always points to the SBS IP!
2. ISA Services need to be rebooted:
• Click on Restart the service
• Click on "Yes" to the "Restart Other Services" warning dialogue:


• 


3. Verify the settings in ISA:
1. Open the ISA Manager
2. Click on Firewall Policy
3. Double click any one of the SBS Rules: SharePoint, OWA, etc
4. Click the Listener tab
5. Click the Properties button
6. Click on the Networks tab
7. Double Click the "External " (or click the Address button)
8. Note that the correct IP is now present: 62.24.42.26


• 


4. The server should be rebooted after hours.

The server reboot is a precaution. This is especially true for one of our client's servers since it was quite plugged up after not being connected to the Internet for 5 whole days.

One can log on later to reboot the server via remote connection, or one can schedule a reboot (previous blog post how-to).

As always, let your client know that the reboot will be happening later on in the evening, and check RRAS to verify that no clients are connected via VPN so that no files may be corrupted:


As a rule, if anyone was connected to their desktop via RWW/RDP at the time of the server reboot, they will be able to reconnect to their session after the server reboots. In the event that they are not able to, their workstation should remain locked with their work there for them in the morning. The exception to this rule is a workstation reboot forced by the overnight updates.

Thus the request for the server reboot in the first place! :D

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

Just a quick post... That Phone Company, Acer Laptops, and more

Things are absolutely nuts around here right now...

The Phone Company finally got their poop together, as did the ISP riding on top of their equipment so we finally got our clients back up and running in the city burrow taken down by the Phone Company. They came back on a totally different segment, so DNS records and more needed to be updated accordingly.

We had another funky issue with the four Acer laptops we merged the two FAT32 partitions and converted to NTFS. That will be blogged about hopefully tomorrow morning. Basically, they were refusing to accept GP security setting updates. Took a while to figure out where the problem was and the fix.

We are doing a Tech Assessment for a client that is pretty much 100% Mac. It is providing a challenge, as we have only sporadically worked with Macs. So, we need to burn some serious midnight oil figuring out how we are going to integrate them into an SBS environment. To complicate things, they have 5 locations.

Anyone have Mac on SBS experience? Let me know, because we could use some help in that area!

Off to the races! ;)

UPDATE 2007-06-20: Macs and SBS: After some searching the following resources have come up for adding the Mac, or at least gaining access, to the SBS domain.

A blog post on the Windows Small Business Server Documentation Blog with a link to a draft document on adding OS X 10.3+ Macs to an SBS domain.

Document link: Connecting Mac OS X 10.3 and Higher Clients to a Windows Small Business Server 2003 Network (Word document).

Check the comments on the above blog post for errata. There are some things to note there.

Links came via Susan Bradley: Connecting a Macintosh to SBS 2003 Server via SMB.

Eriq Neal: Connecting a Macintosh to SBS 2003 Server via SMB has what looks like the original list of steps for connecting the Mac to SBS shared resources (via Susan's post).

Eriq's Mac related posts on his blog: Lessons Learned - Things I wish I had known...(Mac tagged)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists