Symantec Endpoint Protection SBE 12.x Updates

We are just getting a newly migrated network online with their virus protection. In this case they are too large for Microsoft’s Security Essentials product so we ran with SEP.

This is what FileConnect looked like today:

Note the posting date for most files as being November 16th.

As with previous versions if any clients are resident on the current user machines they may need to be manually removed prior to delivering the new client to them.

We will be configuring the Windows Firewall to allow for remote delivery of any and all client updates. So, hopefully we will not need to go through the manual remove and replace process.

We run with Symantec over other products because the name is known to our clients and it does a relatively decent job of protecting the network.

We also mandate UAC via Group Policy and in more security conscious environments utilize Group Policy Preferences to disable all local admin accounts except a restricted domain account that is delivered via Group Policy Preferences into the local admin group. We then keep control over that user account’s password to allow for some change control.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Server Core and UAC

We have just finished replacing our file server that was running on Windows 2008 Standard Core.

Replacing that server was not high on the priority list until after our migration to SBS 2011 RTM when we had a Group Policy setting that enabled UAC for the OU that contained our Core and Hyper-V Server installs. We restructured our GP scopes and OUs to eliminate UAC on our Core based servers.

By default, UAC is disabled on Server Core. All of our Core, Hyper-V Server, and cluster node servers took the settings changes that disabled UAC without an issue. But, the file server for whatever reason decided to ignore the GP settings and keep UAC enabled.

Try as we might we ended up with a Group Policy Tattoo for UAC thus rendering the server in a bad state.

We decided to cut and run so we reloaded it with Windows Server 2008 R2 Standard Full.

The benefits of having the full install are huge. We now have access to the Windows Search service which allowed us to key in all of the shares on the file server into the Windows 7 Libraries feature and thus local search results.

We were able to mount the original server’s backup and attach the backup VHD to recover the needed folder share data.

It also allowed us to gain access to the File Resources management features which will help us to clean up our file stores:

The above screenshot was from a folder specific to Windows 95 . . . yeah, I actually said “Windows 95”! :)

The utility is the Enhanced Print Troubleshooter developed by the Decision Theory Group at Microsoft Research and Microsoft Product Support Services (PSS).

From the ReadMe.txt:

The Enhanced Print Troubleshooter is a diagnostic tool developed by
the Decision Theory Group at Microsoft Research and Microsoft
Product Support Services.  The Enhanced Print Troubleshooter uses
probabilities and costs associated with different faults to generate
a list of recommended troubleshooting steps.  When you run the
Enhanced Print Troubleshooter, the list of recommendations is
regenerated after each question is answered, based on what the
system knows about the problem you are having and the printing
configuration.

We will now be able to create and run reports that will allow us to see the big picture on all of those dormant files as well as other files and their usage on the server. Since we have well over a Terabyte of data to sift through we are anticipating freeing up a lot of storage space!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Can’t Download Hyper-V Update Rollup Package 2264080 from Update Catalogue

We saw this update go by on one of our freshly installed Hyper-V Server 2008 R2 nodes:

• Microsoft KB2264080: An update rollup package for the Hyper-V role in Windows Server 2008 R2: August 24, 2010

Now, because the update is available through MU (Microsoft Update), we need to go to the Windows Update Catalogue site to download it separately.

• Microsoft Update Catalogue

Note that an ActiveX component will need to be installed in the browser in order for the site to work.

We input the KB number in the search and get the following result:

Click on the view basket (1) link to download the update or updates if additional ones were selected.

In our case, we ran Internet Explorer 32-bit as a Standard User on Windows 7 Enterprise x64.

After clicking the Download button we should have seen the following IE window pop up:

But, we did not. We saw a similar window in the already existing IE session that would not allow us to do anything. We could not choose a folder at all so things came to a full stop.

We ended up trying to start Internet Explorer in an elevated session (Start –> Internet Explorer –> Right click and credential UAC).

Once we did so we were able to choose a directory to drop the update into:

But, when we clicked the Continue button:

With IE in an elevated session we were still getting stuck.

We ended up logging into one of our Windows 7 VMs using a domain admin account and doing the following to get it to work:

1. Open Internet Explorer
2. Navigate to the Windows Update Catalogue site.
3. Add the site to the Trusted Sites list.
4. Close IE.
5. Open IE and navigate to the Catalogue again.
6. Search for our needed update.
7. Add it to the Basket.
8. Click the Download button.
9. Choose a directory for the download and click Download.
10. Click Continue for the UAC prompt.
• This is what was what was causing the hang.
• 
11. Click Close.

The reason we are downloading the update as opposed to obtaining it through MU is due to the Nehalem hotfix (KB975530) being included along with a fix for running Hyper-V on the new Westmere CPUs. Since we install the Nehalem update by default on all of our Hyper-V deployments we will now use this RU instead.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Windows 7 UAC IS Broken – Video Proves It

We posted about our concerns with the possiblity of the Windows 7 UAC setup being broken: Windows 7 UAC is Broken?

Well, the authors of that blog post have gone on and demonstrated the vulnerability in a video:

• i started something: Windows 7 UAC code-injection vulnerability: video demonstration, source code released

After watching that video, there is no real reason for an SBS domain to have the UAC setting in Windows Vista turned off and Windows 7 UAC slider turned down.

• MPECS Inc. Blog: SBS 2008 - Enable UAC by default in Group Policy

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

Windows Live Writer

Windows 7 UAC is Broken?

By default, we enable UAC to prompt for credentials on our SBS 2003 and SBS 2008 networks.

A while back we heard about the possibility of Windows 7 breaking UAC (User Account Control) due to the effects of the UAC Slider that allows for changing the how/when a user would receive the UAC prompt.

The default Windows 7 UAC Slider position is one stop below the “ON” position, “ON” being UAC turned on in Windows Vista, that allows certain types of elevation to pass by without user consent or notification that the elevation has happened.

Apparently, there may indeed be a vulnerability in the new UAC Slider:

• i started something: UAC in Windows 7 still broken, Microsoft won’t/can’t fix code-injection vulnerability

Tied into the above Group Policy mandatory UAC elevation settings is user training.

Putting a lock on the door does not stop the person inside from opening the lock and subsequently the door to someone or something on the outside.

Training involves letting the user know the how and why a UAC will prompt. Keeping it simple is the best way:

• If you are not installing a known software product, then Cancel.
• If browsing the Internet and a UAC prompt happens, then Cancel and close the browser window.
• If browsing the Internet and an AntiVirus message happens, save and close any work then Log Off. Do not go back to that site after logging back in.

By keeping the training simple and tying it into everyday analogies like the locked door above, users will get a pretty good idea of what is good and what is bad. We call that “Internet Street Smarts”.

Long’s article reaffirms to us that UAC needs to be enabled and set to “ON” by default, elevate with credentials required (we push a local admin account out to all domain enabled systems – Step 26 Part 3 – SBS 2008 Setup Checklist), and make sure that the elevation happens on the Secure Desktop.

Having a good lock on the door is a good start to tightening up SBS network security.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

Windows Live Writer

Windows 7 and QuickBooks – UAC Required

QuickBooks 2008/9 Multi-Currency Edition, which uses the legacy codebase that the non-multicurrency edition does not, elicits a UAC prompt when running on Windows 7.

The software will then run, but will not find the previous network mapped drive company file location.

We need to click the Open button which then shows us our company file and click through from there.

This is good news for us as we could not get our QuickBooks to run at all on Windows Vista in our own company domain due to the security policies in place here.

When we migrate to SBS 2008 and the new Group Policy structures available to us we may have had success with QB on Vista, but we will not go there anymore! :)

We did try to work with the Windows 7 Compatibility Mode for XP to see if that would resolve the UAC prompt but it did not.

Again, no complaints because at least it will run!

Once we migrate our domain to SBS 2008, it will be interesting to see how QB and Windows 7 work with the new GP setup.

If we have nothing but grief, there is always XP Mode on Windows 7.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

Windows Live Writer

SBS 2008 - Access Denied when adding a printer

That learning curve is still there! :)

Trying to add a network printer to an SBS box we get the following:

Add Printer - Access Denied

Okay, so it is late at night, and the above linked lesson may not have sunk in past the cranial matter yet! ;)

So, given the previous post linked, guess what we forgot to do when adding the printer?

That is right! Right click on Add Printer and then click on Run as administrator!

Okay, so we need to get into the habit of elevating on the server too!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.