SBS 2008 - Group Policy Object and Settings Commenting

Something new to Windows Server 2008 Group Policy is the ability to add comments to both the Group Policy Object itself and any Group Policy setting under the Administrative Templates.

Group Policy Object Comments

The above screenshot shows the comment placed on the default SBS 2008 Windows SBS Client - Windows XP Policy that can be found under the SBSComputers OU.

We have noted the date and the setting change we made to the GPO for later reference.

For the GPO setting itself:

GP Setting for XP to wait for the network enabled

We have enabled this particular setting because we were getting ready to distribute Office 2007 via Group Policy scripting. When we first started doing GP software installs with Office 2003, we ran into the problem where XP Pro clients would not install unless we enabled this setting.

Note the ability to add a comment to the setting. Talk about handy. Keep in mind that only those GP settings under the Administrative Templates node can be commented on.

This new ability will facilitate keeping track of the how/why/when a GP setting was enabled for those who may be troubleshooting a problem down the road.

GP Commenting was discussed during the recent Tech Days event. However, some further understanding was gleaned from reading up on GP Commenting in Jeremy Moskowitz's book on Group Policy Fundamentals.

Some further reading:

• TechNet: Software Installation changes do not apply after logon.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Microsoft Software + Services Partner Training and Info Site

This link: Software + Services Partner Evolution Interactive Guide came to us via LinkedIn:

Software + Services Microsoft Partner Site

You will need a Live ID to sign in.

So, what is the big deal with Software + Services anyway?!?

There are so many very passionate voices about how good or how bad the S+S model will be for us Microsoft Partners ... especially us small I.T. shops.

For us, the equation is quite simple. While Microsoft and others may be able to delve into our client's realm with their products and services to some degree, they do not have the resources to be the face behind everything.

For the ultra small businesses, S+S makes sense since there is very little contact with a primary I.T. services provider in the first place. Retail tends to be the only contact when the hardware fails or the software needs to be upgraded.

For those businesses that have a Trusted Advisor for their I.T. needs that may also provide the infrastructure components such as hardware and software, the idea of transitioning their payments to Microsoft or other S+S providers may be good sense, or may not be. The key in this equation is the Trusted Advisor.

Part of the reason we are trusted in the first place is the fact that we have put our client's I.T. needs before ours. The deeper the business relationship grows and the longer in duration, the more that trust builds between business owner/contact and the Trusted Advisor. This is a natural progression in any relationship.

The key to all of this is how to maintain that trust with the business owner. If we do not keep our heads about is, get caught up in the emotional and painful vision of what we see coming (whether that perception is correct or not is another story), we very well could lose that Trusted Advisor status.

We need to remember that our clients as small business owners may not be totally technically savvy, but they have a head on their shoulders that is very keenly tuned to the needs of their business on all fronts. That is a prerequisite for a small business owner. We all need to be conscious of all aspects of how our business is doing.

If that business owner sees their Trusted Advisor losing perspective on the whole Software + Services situation - remember, the business sense is tingling in the business owner's mind at this point - there very well could be a falling out between the two. In the end, this situation is a lose-lose.

The business owner loses because the Trusted Advisor knows their business and can learn how to tie into the new S+S model to meet their business needs.

The Trusted Advisor loses a client and may take a serious hit against their reputation and referral business among other pain points.

As difficult as this situation may be, we need to delve into discovering just what S+S can do for us and our I.T. services company. We need to see just how we can incorporate S+S into our solutions toolbox to provide the best solution for our client's needs.

One of the most difficult lessons those of us that run a small I.T. business need to learn is, "It is not about me". It is about "us". That "Us" is a combination of our clients and the small team of people within the I.T. business (in our case it is Monique, my dad, and myself along with some freelance technical help) along with the vendors and others who support the Partner in their abilities to provide solutions based on their technologies.

Change is afoot folks.

With the economy doing wacky things, and everything seemingly hanging in a precarious balance, we need to be looking out for the best interests of our clients. If their business is threatened by the current volatile business climate, then we need to be a part of the solution that keeps them afloat. S+S may indeed provide an avenue for that to happen.

The other alternative is to sign the SPLA and design solutions around it and the services offered in the Cloud.

A fellow I once worked with when very young in my days and ways once told me, "Struggle and Change are Opportunities". I did not get it then, but the saying stuck with me.

Today, as a small business owner watching world events unfold around us along with the massive changes happening within our industry of choice, the saying is a huge Pearl.

We have an opportunity of untold magnitude lying before us. How things pan out based on how we leverage that opportunity is totally up to us.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SBS 2008 - Licensing Forefront Server Security for Exchange on Open Value

We have decided to keep Forefront as part of our network protection topology. So far, in our spam protection experiment Forefront Server Security for Exchange is doing a fantastic job of filtering out all of the garbage.

To go beyond the trial period and license Forefront Server Security for Exchange SP1, we will be setting up an Open Value Agreement for our clients that do not already have one.

The part number is: 9SG-00069. This is the first year part number. If our client already has an agreement in its second or third year, we would either purchase using the SKU for the year, or set up a new agreement depending on what else would need to be licensed.

This SKU is for a monthly subscription which is very inexpensive. When ordering from the distributor, the order quantity will be 12 (12 months) per user being licensed.

It is well worth the minimal cost per year per user.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Need Visual Studio 2008 Pro & MSDN? We have an NFR to give away!

We received a full version copy of Visual Studio 2008 Professional with MSDN Library while at Tech Days.

The copy is NFR. So, we cannot sell it.

Click the link for Blog Questions, leave the subject line, and e-mail us a short blurb about why you should get it and we will mail it out to you. We will pick the best story, in our opinion, and announce it here.

If anything, a couple of minutes of your time and you will have a software pack worth approximately $1,000 Canadian.

UPDATE: Fixed the e-mail link! Momentary lapse of grey matter. ;)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SBS 2008 - Group Policy Client-Side Extensions compatibility update for Vista, XP, and Win2K3 Server

There is a lot to learn about in the new Windows Server 2008 based features in SBS 2008. While at Tech Days, one of the sessions was on Group Policy and it was phenomenal.

One Group Policy feature we learned about was the Group Policy Client-Side Extensions (GP CSE):

Group Policy Client-Side Extensions

Notice the huge number of settings that are available to us.

GP Client-Side Extensions enable us to deliver settings updates such as changing the local admin password company wide, a software package, make registry settings changes, and more using a "suggestion" model. That is, the settings can be pushed to the client system once if the Apply once and do not reapply setting is checked in the above screenshot, or every time the system is booted up if that setting is not checked.

GP CSEs give us some flexibility in our Group Policy settings deployment structures in that it allows the user to utilize the GP settings, ignore them, or remove them altogether if the settings do not reapply on boot.

To make full use of GP CSEs, Windows desktop clients (with the exception of Vista SP 1 with the RSAT installed) as well as Windows Server 2003 systems need an update: Information about new Group Policy preferences in Windows Server 2008. There are links in the Knowledgebase article to the updates for each respective operating system.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Tech Days - Neat!

Just got back from the Tech Days event down in Calgary. Vancouver is the last city on the tour January 21 and 22 in 2009.

The brain is overflowing with information.

Not only that, the creative juices are really flowing due to the large number of product demonstrations and the ideas they triggered.

Some myths that I had were busted too ... especially about AppV Application Virtualization (Formally SoftGrid which is included in the Microsoft Desktop Optimization Pack).

We had some excellent presenters with more to come on them and their content.

Now, it is time to give the grey matter a rest to allow things to sink in! ;)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Vista and Blu-ray and the LG GGC-H20L Optical Drive needs updates

For the last Intel Channel Conference we paid for the afternoon desktop build session to work with Intel engineers on their new desktop technologies.

The system build was to be a Blu-ray and HD-DVD capable system. No OS was included in the session. We opted for Windows Vista Ultimate x64 SP1.

The configuration:

• Intel DG45FC Mini-ITX
• Intel Core 2 Duo Desktop Processor E8500
• 4GB Kingston 800MHz DDR2 RAM
• 320GB Seagate Momentus 7200.3
• LG Super Multi Blue GGC-H20L
• In-Win BM-639 Mini-ITX Case
• USB based wireless (don't have yet).

When it comes to the motherboard, we made sure to install and update all of the relevant drivers from the CD that came with it along with updates via Intel's Web site.

For the LG optical drive, we were not going to run with any of the software on the accompanying CD because the OEM version of software products tend to be missing some key component or other that we would subsequently be directed to the software manufacturer's Web site to purchase.

Since Windows Vista does not support Blu-ray out of the box, we needed to run with third party. We decided to check out the included OEM PowerDVD product which is version 7 after all. Of course, this is a special edition for the OEM packaged product while CyberLink's site shows version 8 as current.

One of the installation options on the LG CD was a utility to check for any firmware updates applicable to the LG optical drive. Given the newness of the technologies in the optical drive, checking for firmware updates was a good idea.

Sure enough, there was one to bring the new drive's firmware up to 1.03:

LG Optical Firmware

The download was somewhere around 6MB in size and a reboot was not requested once installed. Just in case, we rebooted the box.

The CyberLink PowerDVD product required an update to 7.3 that was about 103MB in size.

Once we had the two updates in place, we ran a Blu-ray of Kung-Fu Panda and it looked astounding on our 22" shop wide LCD. It will look even better when tied into a wide screen LCD television via HDMI which is built into this motherboard.

Note that PowerDVD version 8 does not support HD-DVD decoding: Does PowerDVD 8 support HD DVD playback? From the link:

After Toshiba made their announcement that it will no longer develop, manufacture and market HD DVD format discs and the fact that there will be limited new title releases in HD DVD format, CyberLink has decided to remove HD DVD support from PowerDVD 8. However, CyberLink will continue to support and maintain HD DVD movie playback in PowerDVD Ultra (version 7.3).

Now, after a bit of research as a result of the above, we came up with this gem from the We Got Served blog: How To: Play Blu-ray and HD DVD Movies from Vista Media Center.

The suggested products are a software player that integrates with MCE which PowerDVD also does not do:

• Blu-ray/DVD Archiving to Disk: SlySoft’s AnyDVD HD
• Blu-ray/HD-DVD Payer: ArcSoft’s TotalMedia Theatre

We will be purchasing the above software to round out our new home theatre PC.

And, at some point in the near future we will put together a Windows Home Server to sit beside our home SBS 2003 R2 Premium server! :)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Canadian and Other Non-US Currency Quoting Cautions

With the economies of the world struggling and in some cases dropping in the tank, we have seen a roller coaster ride of ups and downs for our product pricing.

This is what our Canadian dollar looks like against the United States dollar today from XE:

The Canadian Dollar Today

Ouch. :(

Prices in the distribution channel have only started increasing in the last two to four weeks for us. In some cases, we received price increase warning letters from manufacturers that we are registered resellers for. In others, Synnex Canada has been pretty good about e-mailing us with price increase warnings.

Pricing volatility has played havoc on our quoting which we normally allow 30 days for. Lately, we have reduced that to one business week.

As a result, we end up needing to buffer the quote up 5-10% (divide not multiply) to cover any immediate increases.

If prices remain relatively static, then when the time comes to issue an invoice for the deposit on the project, we will let our client know that we can pass along a 5-10% savings to them due to our pricing levels.

The tough spot was about three weeks ago when we saw the Intel Xeon E5440 Quad Core CPUs jump by close to $300 cost per processor and the RAID controller jumping another $150 in cost. Other components in the server build also saw some significant steps upwards in price.

We were able to talk to our clients and prospective clients about a compromise on our existing quotes. They understood that the economic situation was making things difficult for us. We ended up absorbing 50% of the cost increase for that situation. Another ouch, but at least they were happy that we took the time to explain the situation and split the difference with them.

For those of you in the United States, this situation may not be impacting your business, but for those of us outside of the U.S., we are, in some cases, being hit quite hard with the currency fluctuations.

Be cautious in quoting folks. Given the situation in the world, now is not the time to start losing on projects due to missed margins.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Tech Days 2008 in Calgary starts tomorrow!

Are you going to be in Calgary for Tech Days starting tomorrow?

I will be barring a massive white-out and driving down becomes impossible. The weather here has been a bit challenging with the snow and cold.

Hope to see you there!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SBS 2008 Remote Web Workplace Password Reminder

Now, how about this little message after logging onto the SBS 2008 Remote Web Workplace:

RWW Password Expiry Reminder

Is that kewl or what?!? :)

This is especially true for those of us that are hosting SBS environments for our clients via our SPLA agreements.

Once the user has logged onto the RWW, they can click the Change Password link found near the top right corner in the portal:

RWW Change Password

For many of our clients that do spend most of their time on their laptops outside the office and connected via RWW, this message saves them from trying to figure out why their Outlook Mobile Access or Outlook Anywhere has stopped working ... at least until they tried to log onto the SBS 2003 RWW and received the change password prompt.

A very nice touch on the SBS 2008 development team's part. Not only that, the user can initiate a password change from within the RWW portal. Well done folks. :)

This little password warning will save a good chunk of time, both our clients and our own, not having to answer those "things have stopped working" support calls when the user was off-site.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SBS 2008 - Production WSUS DB Size after 3 months

On our "production" SBS 2008 network that has been up and running for our SBS 2008 Blueprint book the one thing we have been keeping an eye on is the size of the WSUS databases:

WSUS Db at 12GB

This particular SBS 2008 is RTM and has been around since we obtained the RTM bits via our TechNet Plus subscription which was in mid-August sometime.

Now, there are a few considerations to keep in mind when it comes to this particular WSUS database:

• Windows desktop clients are XP Professional, Windows Vista Business and Ultimate.
• Service Packs were delivered via network share before connecting them to the SBS domain.
• IE 7 is the standard browser on all desktop clients.
• Office 2007 is not set up to be delivered by Group Policy yet. So, no Office updates included as OWA is the primary e-mail client at this point. Office 2007 SP1 will be placed in the Updates folder prior to delivering Office to the desktops via GP scripts.
• .NET in its various versions is installed on all desktop systems.
• SBS 2008 is stand-alone until we have the time to install the Premium server and install and configure the Terminal Services Role along with RemoteApps via RWW.
• Forefront Server Security for Exchange is providing the filtering for Exchange (and doing a pretty impressive job of it too).

With the above in mind, it is quite possible that the WSUS databases will exceed 20GB or more once we have the full production environment up and running.

As a result, using the Move Windows Update Repository Data wizard to move that data to a separate partition from the OS C: would be a good post OS install step once the server's partitions have been configured and formatted.

Storage Tasks Wizards

Be careful when using the Move Data Wizards. In some cases, if the data has been moved to one partition, the wizard may not allow for that data to be moved back to the System partition (OS).

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Beta Exam 71-653 TS: Windows Small Business Server 2008, Configuring - Passed :)

While many folks around me seemed to have found out quite a while ago that they had passed their attempt at the 71-653 SBS 2008 exam (note the MS Learning link indicates 70-653), I heard nothing.

After talking to someone at Microsoft and Prometric about the results, they indicated that most beta exam results in Canada would not be released until sometime this month.

71-653 SBS 2008 Exam Passed

So, every once and a while I checked into my transcript at the MCP site. Today, I found the above notation that I have indeed passed the exam! :)

At that time, I had not put any time into the SBS 2008 migration documentation, so I know I messed up on a few of those questions.

On the Microsoft Learning site as per the above link the exam number is referred to 70-653. This is the RTM version of the exam. It looks as though the 71- means Beta.

The official exam release article: Small Business Server 2008 Gets New Exam.

Beta Exams: Microsoft Certification Beta Exams.

Thanks for your support and for reading! :)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Working with Untangle (OSS Firewall) as a Hyper-V Guest

There are some caveats when working with non-Windows OSs as Hyper-V guests.

In the case of the Untangle VM, there is no way to install the Hyper-V Integration Services into the VM. As a result, there is no mouse capture in the VM when opened via the Hyper-V Manager (gives console access) if connected to the Hyper-V management system via a RDP session.

For some systems, keyboard shortcuts may suffice to get about the OS and its management features. In the case of the Untangle VM we were not able to do so. Thus, we needed to be at a physical workstation whenever we needed to manage the VM directly.

The Untangle product does allow HTTPS connectivity to the machine for management purposes once everything has been set up though. This management will need to be accomplished via a workstation as the security settings in IE on the SBS box will not allow the Untangle management features to initialize.

The other caveat when setting up the Untangle product in a Hyper-V based VM is the NIC setup. We set up static MAC addresses for both NICs with the intent of setting the External NIC MAC address up with a static IP reservation in our own SBS server's DHCP.

During the Untangle setup routine and subsequently the Untangle Setup Wizard the NICs were reversed. How the setup routine decides which NIC is Internal and which NIC is external is not known. But, once the NICs were reversed in the Interface Management post OS install, the correct Internal static IP was set in place and DNS was set to the SPRINGERS' SBS VM everything fell into place nicely.

For the book we were working with version 5.x of the Untangle product. Untangle has just released version 6 of the product. From our conversations with Untangle the step up to version 6 is quite significant.

BTW, if you are used to working with ISA and its rule structures, Untangle and its management features should come fairly natural when it comes to the learning curve.

Yesterday's article: Installing Untangle (OSS Firewall) as a Hyper-V Guest

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Installing Untangle (OSS Firewall) as a Hyper-V Guest

As part of our SPRINGERS methodology for our new SBS 2008 Blueprint book, we were able to work with a number of different security vendors while looking at alternatives to ISA 2004/6.

One of the vendors we have looked at was Untangle. Their product is based on Debian Linux and is a fairly robust firewall and filtering product. Subscriptions are involved for Active Directory connectivity and more.

This is the error we saw on one of our attempts to install Untangle as a Hyper-V guest:

Untangle Hardware Requirements Warning (Dialogue OKd)

While the 512MB of RAM is not critical, the fact that the install routine did not find any NICs is a showstopper.

When we setup the VM, we setup two NICs using the Hyper-V built-in NICs.

So, we shut down the VM and removed the two Hyper-V based NICs and added two Legacy Network Adapters. We set one of the Legacy Adapters to the SBS 2008 network and one to connect to our internal network (Our ISA server has a rule published to allow the Untangle IP address a direct connection to the Internet along with a DHCP Reservation for the VMs' MAC address).

We also increased the RAM to 1024MB (1GB) to eliminate the warning against the amount of installed RAM.

Once we ran through the complete install, we were greeted with:

Untangle Successfully Installed

After clicking OK in the above dialogue box the VM shut itself down. We then changed the boot order in the Hyper-V manager for that VM to hard disk first, released the Untangle ISO, and powered the VM up.

Untangle successfully ran the post install setup wizard once it booted up providing us with the ability to scope the product out. More to come on that in future posts...

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

IE 7 - Add-on Disabled for RDP via RWW

When connecting to the RWW and subsequently attempting to connect to a desktop on the SBS network, you may see:

Windows Internet Explorer
This portion of the Remote Web Workplace requires the Microsoft Remote Desktop ActiveX Control. Your browser's security settings may be preventing you from downloading ActiveX controls. Adjust these settings, and try to connect again.

Note that in this case we have already added the RWW site to IE's Trusted Sites zone.

To deal with the issue:

1. Click OK on the ActiveX warning dialogue box.
2. Double click on the Gear with the red circle with the strike through near the bottom middle of the IE window (The yellow info balloon points to it).
3. Click on Microsoft Terminal Services Client Control (redist).
4. Click on Enable in the Settings box at the bottom left hand corner.
5. Click OK.
6. You may get a "For changes to take effect, you might need to restart IE" warning. Click OK.
7. IE will restart itself and bring up the RWW portal menu.
8. Click on the Connect to my computer at work link again and the list of available computers should come up.

This situation seems to be relatively new, but easy to solve.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.