Tool To Create Fixed VHD Files _Fast_ – VHD Tool

This tool is awesome!

Creating a fixed size VHD in Hyper-V Manager can be a painfully slow process as it creates the disk. The larger the VHD, the more painful things get.

The following tool eliminates that:

• MSDN Code Gallery: VHD Tool

We downloaded the tool and copied it onto the local workstation. We then ran through and created a 10GB fixed VHD using the tool. The creation process was virtually instantaneous!

The creation process:

• vhdtool /create TestVHD.VHD 10737418240
• Creates a 10GB fixed size VHD file.

We then opened the created VHD via Windows 7 Disk Management console, formatted it and ended up with:

Note that the file size needs to be in bytes. So, here is a handy converter:

• Speed Guide.net: SG Bits/Bytes Conversion Calculator

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Intel Modular Server – Compute Module Xeon Processor 5600 Series Compatibility Caveat

The newly released Intel Xeon Processor 5600 Series CPUs with up to 6 cores will need a refresh product code for the IMS compute modules.

Current MFS5520VI compute modules will require a firmware update to be compatible with the new CPUs.

• IMS: Intel Server Compute Module Overview
• Intel Xeon Processor 5000 Sequence Technical Documents
• PDF: Intel Xeon Processor 5600 Series Product Brief
• PDF: Intel Xeon Processor 5600 Series Specification Update March 2010

The technical documents link will have the most current version of the PDF files.

From the Overview page:

◊¹ . . . Out of the box support for the Intel Xeon processor 5600 series will be indicated by the addition of the letter "R" at the end of the product order code. For boards and systems currently supporting the Intel Xeon processor 5500 series, a BIOS update is required before installing the 5600 series processors. Select the support tab above for more information.

Note that when it comes to the Intel Modular Server, we are currently at CMM firmware version 5.5. So, we should be seeing a firmware update in the next little while to allow the existing MFS5520VI compute modules to accept the new Intel Xeon Processor 5600 Series CPUs.

It is recommended that any new Intel Modular Server quotes and orders be placed using the new compute module product code.

• MFS5520VIR

Intel Modular Server documentation:

• IMS: Intel Compute Module MFS5520VI Support Page
• IMS: Product order codes and configuration guide
• IMS: Intel Compute Module MFS5520VI Technical Product Specification Page

The first link to the product support page should contain the more recent links to the various bits of information on the product once they change.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

NIC Binding Order On Server Core or Hyper-V Server 2008 RTM/R2

For those of us that have worked with SBS 2003 Premium in a 2 NIC setup, we know the importance of having the binding order correct for those 2 NICs are things really don’t work right.

The same is true for our Hyper-V implementations. There is a need to have the correct binding order for all of the NICs on a server that will be utilized by the host OS, cluster heartbeat, the Hyper-V virtual switches, and if needed iSCSI.

So, what order do we need to have those NICs in and how do we figure out which NIC is which?

Have a look at the following screenshot taken from the first node in a four node Hyper-V Server 2008 R2 cluster:

The images in order from top to bottom (numbers to the right of each one):

1. HKLM\System\CurrentControlSet\services\TCPIP\Linkage
   1. Bind: Contains NIC GUIDs
   2. Export: Contains NIC GUIDs
   3. Route: Contains NIC GUIDs
2. NIC report via the Hyper-V Server 2008 R2 menu
   • The Intel Modular Server compute modules have a maximum of 4 NICs as indicated here.
3. NIC GUIDs in each Linkage key
   • Bottom most GUID is _first_ in the binding order.
4. wmic nicconfig get Description,SettingID [Enter]
   1. WMIC command gives us a GUID to NIC name association.

So, to change the binding order on Server Core and Hyper-V Server 2008 RTM/R2, one moves the order of the GUIDs in each registry key:

1. Bind
2. Export
3. Route

Once the GUID orders have been changed, reboot the server to get the changes to take affect.

The binding order we put the NICs in:

1. NIC 0: Management
2. NIC 1: Cluster Heartbeat
3. NIC x: iSCSI (if needed)
4. Microsoft Virtual Network Switch Adapter
5. NIC 2+: Bind the MS Virtual Switch.
   1. NICs disappear from the binding keys after the Virtual Switch is bound to them and the host OS no longer has access.
6. Microsoft Failover Cluster Virtual Adapter

Please make sure to take a screenshot of the default settings as above along with an export of that registry key just in case! A backup might be a good thing too.

IMS Ethernet Switch Ports To Node NICs

And one more thing when it comes to the IMS Ethernet Switch port structure relative to the NIC order listed in Hyper-V Server 2008 R2 or any other Server Core OS for that matter.

There is no direct correlation between which NIC comes in at 0, 1, 2, and 3 in the Hyper-V OS listing and the physical NIC to node NIC port in the IMS Ethernet Switch setup.

This is important to know since we already went ahead and set the NIC binding order according to the list in the Hyper-V OS but the _wrong_ NIC went down when we changed the VLAN setting in the IMS Ethernet Switch port management for port 1 on SWM 1!

In the screenshot below, we have VLAN 98 set up to be the heartbeat and migration network on physical NIC 2 on each node.

However, when we do an IPConfig /release && IPConfig /renew on the nodes the NIC assigned a 169.x.x.x IP was actually NIC 0!

As a result, we leave all of the node NICs connected to the management network to pick up an IP from the SBS VM. We can then change the VLAN setting to figure out which NIC in the OS belongs to which physical port in the IMS Ethernet Switch.

UPDATE: The proper binding order has finally been found! According to Chris Adams of Microsoft:

• Chris’s Blog: Real World Example of Troubleshooting R2 Live Migration using CSV’s

Now we have a pretty conclusive answer as to what order we need to put those NICs in:

1. Microsoft Failover Cluster Virtual Adapter
2. NIC 0: Management
3. NIC 1: Cluster Heartbeat
4. NIC x: iSCSI (if needed)
5. Microsoft Virtual Network Switch Adapter
6. NIC 2+: Bind the MS Virtual Switch.
   1. NICs disappear from the binding keys after the Virtual Switch is bound to them and the host OS no longer has access.

Thanks Chris!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

 Subscribe in a reader

Using CCH Taxprep to Prepare T1s? CCH Scan Is the Tool For Your Accounting Firm

We just finished setting up a dedicated fairly high performance workstation for an accounting client that wanted to implement the CCH Scan product.

Initially we were a bit sceptical due to the specifications of the product that it would help them gain some efficiency. It turned out that the specifications sheet we were initially working with was way out of date.

An overview of all of the steps is to be found at the end of this post including the How-To for the firm’s CCH Scan users.

CCH Support

During the process of getting things up and running we were in touch with the CCH Canada support folks on a number of different occasions to troubleshoot some issues or gain some insight into the way the product worked that the documentation did not cover.

The support people we worked with were top notch and knew the product through and through.

CCH Scan’s Productivity Improvements

Now, how can CCH Scan help an accounting firm processing this year’s personal T1 returns?

Based on our experiences with the product once it was up and running, a firm will be able to scan and OCR (Optical Character Recognition) as many returns as the Kodak i1220 scanner (product page) can process pages.That is the first thing.

The second thing was once the CCH Scan plug-in was installed and activated in CCH Taxprep T1 2009, it would automatically bring up the client’s scanned content when the firm user opened the client’s actual T1 file.

They could then automatically import the scanned content and maintain the original scanned documents _in the T1 file_. No manual entry required for much of the return documentation.

How much of a time savings is that? When it comes to processing a large number of returns in a given tax season, the time savings alone would be very substantial.

Productivity for the firm users processing the actual returns would be significantly improved, while the firm would be able to save on the reduction of data entry clerk positions.

CCH Scan Install And Configuration

CCH had recommended the Kodak scanner. Now that we have worked with it, we can see why. It is a single pass full duplex scanner capable of over 30 duplex (two sided) pages per minute. It is _fast_!

The CCH Scan product needs to be installed on a dedicated workstation. There are quite a few services that get installed into that Windows XP Professional OS:

Once the scanning is complete, the OCR processing can max the CPU so a Core 2 Duo would be the minimum requirement. Keep in mind that the faster the CPU, the faster the OCR process is accomplished. So, spend the extra couple of hundred on the faster CPU as it will pay for itself in the long run.

CCH Scan Administrator

Once CCH Scan is installed, a folder structure, either on the local machine (set up by default by CCH Scan) or on a network server, needs to be in place so that everyone’s CCH Scan plug-in enabled Taxprep T1 2009 software can access the scanned data.

This is the CCH Scan Administrator setup we put in place with the scan output and OCR processing being done on a network server:

Note that the Import folder will be the destination for all TIFF files scanned by the Kodak i1220 scanner.

CCH Scan Dedicated Domain User Account

We set up the Kodak with a profile to simplex (single sided) scan at 300dpi into a single TIFF file with absolutely no prompts. We also set up a profile for the same settings but with the duplex setting. The Kodak has the ability to have up to 9 different scan profile types.

For ease of use, we created a restricted domain user account that the firm will use to sign into the CCH Scan workstation. Once into that profile, CCH Scan and the Kodak are configured to work together so that the user need only drop the stack of documents into the scanner and press a button.

Prior to dropping the documents in though, they need to create a Cover Page and if necessary some Target Sheets. This is done in the CCH Workstation component that can be installed on as many seats licensed.

CCH Scan Workstation

If the scanner icon is not in the system tray, the first time the user clicks on the CCH Scan Workstation icon to start the program all that will happen is the starting of the service and the tray icon appearing.

Double click on the system tray scanner icon and we get:

Click on the Print menu item and then Cover Pages/Target Sheets option:

We then get:

The cover page is used to set the client’s information in place. It is placed at the beginning of the client’s to be scanned tax documents.

Since we want the user’s name and social insurance number in the PDF file created by the OCR process, we do the following:

• Input the name and SIN and click Add.
• Repeat for each client document set.
• Print out the cover pages.

This is the resulting cover page:

During the CCH Scan OCR process, that cover page tells CCH Scan that all scanned content behind it belongs to the indicated client name and SIN.

Target Pages are generic in that they can be reused once a batch of client documents are scanned. They are used to segment the content within the client’s documentation.

Place a Target Sheet in front of a group of documents of the same type so that Taxprep T1 2009 will know where to put them.

For example:

• Medical Expenses Content

There are a lot of different categories for the Target Sheets. They essentially make it easy for the T1 import process as the scanned and OCRd documentation then appears under the appropriate tax form in Taxprep T1 2009.

The person working with the client’s T1 file can then input the needed numbers and references quickly into their tax file.

Ultimately the process is quite simple for the user.

CCH Scan Process Overview

Installation Needs:

• Adobe Acrobat Standard or Premium
• CCH Scan
• CCH Taxprep T1 2009
• Kodak i1220 or equivalent high performance document scanner
• Dedicated Core 2 Duo workstation with Windows XP Professional
• Intel X25-M SSDs in RAID 0 for ultra high volume OCR needs.
• Intel i7 9xx Series CPU with 4GB RAM for high volume OCR needs.

Installation Process

1. Dedicated Workstation
1. Install Acrobat and update.
2. Install PDFFlyer.
3. Install CCH Scan.
4. Configure CCH Scan Administrator.
2. Firm Workstations
1. Install CCH Scan Plug-in into Taxprep T1 2009.
2. Activate the plug-in using the CCH code within Taxprep T1 2009.
3. Install CCH Workstation from the share location.
4. Add shortcut to All Users’ Startup folder to auto start it when the user logs on.

Firm User CCH Scan Process

1. On the user’s workstation:
1. Start CCH Scan Workstation.
2. Open the Cover Pages/Target Sheets dialogue window.
3. Create all of the needed client Cover Pages and print.
• Cover Pages can be reused for the following year’s return.
4. Create all of the needed Target Pages and print.
• Keep an accordion file folder for the printed Target Sheets to be reused with the next batch of scans.
5. Sort the Cover Pages and Target Sheets into the client documentation.
• This was a step that would be done whether manually inputting the data or not.
2. On the Dedicated CCH Scan Workstation
1. Log on using the generic CCH Scan user ID.
2. Place documents to be scanned face down in the scanner.
3. Make sure the number displayed on the scanner is 1.
4. Press the scanner’s scan button.
• OCR processing can take a few minutes depending on the number of clients and their documents scanned.
• Scanner creates one multi-paged TIFF file, but the OCR process will create the PDF using the name and SIN indicated in the Cover Sheet.
• The created PDF file will reside in the Export folder indicated in CCH Administrator. Do not touch this file as it is needed by Taxprep T1 2009.
5. Pull scanned documents and prepare them for the client or shredding.
• Accounting Firm policy needed here.
3. On the firm user’s workstation:
1. Open Taxprep T1 2009
2. Open the client’s T1 file.
3. CCH Scan will prompt to import the scanned content into the client’s return.
1. Assisted = step through process or each page imported.
2. Automatic = pull all content in automatically.
4. Once the content is important, make sure to verify each scanned document and its Taxprep T1 2009 equivalent page.
5. Taxprep T1 2009 with the CCH Scan plug-in will automatically move the client PDF file into the Archive folder.

Data Security Implications

As with any client data that displays or contains a person’s or company’s private identifying information, considerations need to be made on the how and where that data gets stored.

As we move our accounting clients over to Windows 7, we are implementing Software Assurance for all new OEM Windows Desktop OSs that we install to gain access to Windows 7 Enterprise.

We can then run through and BitLocker all laptops with Windows 7 on them. Our clients can then be reasonably assured that any client data contained on those machines is secured.

From there, BitLocker To Go would be used to encrypt any external devices used to move client data about the firm or while at their client’s site.

On the server side of things:

• All servers should be in locked rooms or a locked cabinet.
• An appropriate password structure should be in place for users.
• Data encryption should be used if possible.
• Strict guidelines on company computer use are a good place to start when looking to secure that data.

Conclusion

Now that we have worked with the product, the CCH Support Team, and our client, we see a significant benefit to our accounting firm clients that utilize the CCH line of personal tax prep products.

Disclaimer: There is no need for one. Other than our contact with CCH for support purposes, this review and instruction set comes as a direct result of working with the product.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Intel Modular Server Hyper-V Server 2008 R2 Cluster Set Up Guide v1.0.0

This first post is essentially a cut and paste of our set up notes to date. It will be updated and reconfigured _a lot_ as we run through the cluster set up process on the IMS we have here in the shop.

The layout is essentially according to the flow of the required steps. Though, on first glance this particular guide is quite unruly in its presentation.

Standalone Management Server

We prefer to have an additional standalone server in our clustering setup. Even if the server is temporarily there as part of the set up process, we find it a lot easier to get things going with it around.

For full power outage cluster restart purposes, it is a good idea to have that standalone server online as a DC or Read Only DC to provide the needed authentication services for the cluster nodes when they boot up.

We actually install a Windows 7 VM on the management server with the RSAT tools installed and enabled so that we can manage things on the cluster and the SBS network without the need to log onto the SBS or DC VMs.

Assumptions

An assumption made in this post in that the terms used in reference to the various IMS components, Hyper-V components, and others will be known by you our readers.

This means that it is important to pick up the various needed documentation to gain familiarity with the terms and overall procedures for managing the IMS components, Hyper-V OSs, etc.

IMS Chassis Component Set Up Procedure

1. Set up the hardware and bring up to date.
2. Set BIOS settings on each module.
3. Register the Paper Pack ID and Serial Number on Intel’s site to obtain the LUN Key (Intel’s site).
4. Input the LUN Activation Key.
5. Creating the base storage:
   • MFSYS25 User Guide Page 79: If the Intel® Shared LUN feature is activated, the “Assign to multiple servers” check box is displayed. When the check box is selected, the Intel® Shared LUN feature allows a virtual drive to be assigned to two or more servers. This feature requires operating system support for sharing LUNs.
6. Create a Storage Pool of 2 (2x 146GB 15K SAS in this case) drives.
   1. 25GB/Hyper-V OS Node (75GB for three nodes).
   2. 60GB or thereabouts to be CSV for VM Config and Memory Files.
   3. Do not attach any subsequent VDs to any of the Hyper-V Nodes until after the OSs are installed.
7. Creating the switch layout:
   • Internal:VLAN not mapped to External
   • External: VLAN mapped to External.
     1. Create a VLAN for each port to map properly.
     2. VLAN for cluster heartbeat: VLAN 99
     3. VLAN for VM external access: VLAN 1
8. Node Storage
   • Create Storage Pool 1
   • Create Storage Pool 2
   • Create Storage Pool 3
   • Create Virtual Disks (VD) 0, 1, 2, 3 etc.
9. Node Storage Assignments
   • Once all Nodes are properly configured, shut them down.
   • Assign the VDs to each Node.
   • Use one Node to initialize.
   • Then format NTFS.
   • Set Offline in ALL Nodes.
   • Close the MMC (Not necessarily needed step).
   • Reopen then Rescan disks in next Node.
   • Set to Offline and repeat for each Node.

Standalone Server Setup

We name the standalone server TD-Management and refer to this server as the Management server. TD is usually the domain name’s initials or acronym brought down to two letters.

1. Windows Server 2008 RTM/R2 OS install.
2. Local admin password change:____________________
3. Driver install.
   • Chipset
   • NIC
   • Video
   • TPM
4. Set IP:____________________
5. Set name:____________________
6. Configure Storage.
   1. OS:____________________
   2. SwapFile:____________________
   3. NetworkData:____________________
      • DiskPart may be needed for NetworkData to get a Primary.
7. Set SwapFile and reboot.
8. Role Install : Hyper-V
9. Hyper-V Nehalem Hotfix (MS KB Site).
10. Unbind host OS from VM NIC(s).
11. SBS 2008 OS VM set up.
    • Min HDD: 60GB
    • Use Answer File on a 128MB VHD created in Win7 or Win2K8 R2.
    • Attach the Answer File VHD via SCSI so that it is hot removable.
12. Standalone server domain joins after SBS 2008 set up is complete.
    • Our SBS 2008 Set Up Guide.
13. In Hyper-V Manager, set SBS 2008 to auto start.
14. Add Feature: Failover Clustering Management
    • Nodes must have the Failover Clustering Service installed.
    • Nodes are connected to domain run Validation Wizard.
15. Post Node Install: Make the necessary AD CIFS permissions changes if ISOs reside on a standalone Win2K3/8 Server for Constrained Delegation access.
    • NTFS: Node-01$, Node-02$, Node-03$, etc = FULL
    • Share: Node-01$, Node-02$, Node-03$, etc = FULL
16. Post Node Install: Create MMC
    • Computer Management for all Nodes
    • Windows Firewall with Advanced Security for all nodes.
    • Cluster Failover Management
    • Hyper-V Manager
17. Firewall exceptions for Disk Management on local management machine.

Node Setup

The following can be used to map the NIC’s IP Addresses:

NODE	INTERNAL IP ADDRESS
Node 1
Node 2
Node 3
Node 4
Node 5
Node 6

NODE	HEARTBEAT IP ADDRESS
Node 1
Node 2
Node 3
Node 4
Node 5
Node 6

 

The set up procedure goes as follows:

1. OS install via USB Flash is best.
   • In IMS Management unbind NICs 2 and 3 by setting to internal VLAN for each one on IMS before installing Hyper-V Server 2008 R2 OS.
   • Note that NICs 0 and 1 will be configured for the Internal and Heartbeat networks.
   • In IMS Switch management, we use VLAN 98, 97, etc
2. Set local admin password.
3. Name nodes.
   • Reboot
   • Drivers needed on USB flash if going to install here.
4. Domain join using netdom command.
   • netdom join TD-* /Domain:TestDomain.local /OU:OU=SBSServers,OU=Computers,OU=MyBusiness,DC=domain,DC=local /userd:administrator /passwordd:*
   • Format above for your setup.
5. Set IP and DNS Server addresses for primary NIC.
   • DNS1: SBS
   • DNS2: Standalone Server
6. Set IP address for heartbeat NIC.
   • DNS1: SBS
   • DNS2: Standalone Server
7. Configure remote management
   1. MMC.
   2. PowerShell – Reboot required.
   3. Allow Server Remote Management.
8. Enable the RDP feature.
9. Date & Time.
10. Load the following drivers in the order listed below:
    1. Chipset (maybe)
    2. NIC
    3. Video (No Need)
    4. TPM
11. Turn off the Page file before setting up VDs.
    • Needed when the primary OS volume is too small for RAM. Swap file will start jumping into the VM’s VDs during their set up.
    • wmic computersystem where name=”<computername>” set AutomaticManagedPagefile=False
    • shutdown –r –t 0 [Enter]
    • Turn on after VDs set up.
12. Install IMS MPIO driver.
    • Reboot required. Run the swap file off command then reboot to set it in place here.
13. Install the Failover Clustering Feature.
    • Firewall exceptions are installed. Wait about 5 minutes before trying the wizard.
14. Run updates.
15. Change VLAN back to external setting for NICs 3 and 4.
16. Bind External NIC’s 3 and 4 to virtual switches for each Node.
    1. Use Hyper-V Management
    2. Name them the same across all nodes.
    3. External NIC 1, External NIC 2, Etc.
17. Delete DNS and DHCP records for each Node’s NIC 3 and 4 on DC if needed.
18. Add users to local admin group if they are to manage VMs.
19. Turn Nodes off and Assign the VDs that will be used by the HA VMs.
20. Set CIFS Delegation in AD.

Cluster Setup

1. Need DNS A Record and IP for Access Point in Wizard.
   1. If DNS update errors for the Cluster Name appear, then delete the DNS A so the cluster can update the A record itself.
2. Run Validation Wizard’s All Tests once everything is configured.
3. Set the heartbeat network to not allow clients in FCM.
4. Clustered Shared Volumes
   1. In FCM – create the CSV
   2. On Node: CSV = C:\ClusterStorage\Volume1
5. Need a Volume for VM Config and Memory Files on CSV.
6. Configure each Node’s Hyper-V settings for the storage locations to the appropriate CSVs.
7. Create a VM in H-V Manager on Node 1.
   1. Make sure to select the Cluster Virtual Disk.
   2. Need a VD for CVD.
   3. Must be enabled on each Node.
8. Set the auto start settings and time sync settings on the new VM.

Move the SBS/Primary DC from Management to Cluster

1. Make sure to IPConfig /all to get MAC or check Hyper-V Management.
2. Set up existing MAC in new VM settings on cluster.
3. At the least, a temp DC is required for the move (Standalone server) to provide AD authentication.
4. Set all nodes and server VM’s secondary DNS to the temp DC if not already done.
5. Note that SBS on Cluster may lose its IP address. Do not remove secondary DNS settings until IP is verified in the VM.
6. Run the Fix My Network Wizard to clean up the old NIC settings.
7. Note that DHCP reservations are lost after the FMN finishes.
8. Reinstall Integration Services.

The above is it in a nutshell. Now, there are a bunch of links to the various sources that need to be done up yet, but that will have to wait as we are behind on our To Do list for today.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Clustering on the Intel Modular Server

We have a number of client related situations to take care of today and tomorrow.

We should be ready to run the IMS configuration and Hyper-V 2008 R2 OS install later this week in a Webinar.

More to come on that soon …

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Yet Another Attack Vector? LCD TVs As Zombies

Have a moment for some good reading?

• http://www.lg-hack.info/cgi-bin/sn_forumr.cgi?cid=2675&fid=2679&tid=2693
• http://lg-tv-lcd-firmware.wikispaces.com/
• http://www.gossamer-threads.com/lists/mythtv/dev/356287
• http://hackaday.com/2009/10/18/samsung-tv-firmware-hacking/
• http://samygo.sourceforge.net/

While the reading may not be “good” in the sense of reading a good Star Trek novel (yes I read them ;) ), the implications of the TV OS hack methodologies explained in the above links gives one cause for pause.

The PC industry, especially on the Microsoft side with Apple recently taking up their security slack with key personnel hiring, has the infrastructure in place to address vulnerabilities. But, it looks as though vendors/manufacturers of products that drop some sort of OSS distro on their boxes will need to learn the same _hard_ lessons.

Currently, it looks to be quite simple to get into the LCD TVs with full shell access. No security, no authentication, nothing. Depending on the horsepower driving everything underneath it all, there are lots of ways to work this situation.

With many of these new devices needing an Internet connection for whatever new features they are implementing, there will be a need for us to be aware of whether they are properly secured or not.

If not secured, then a serious decision needs to be made about whether that device should be purchased or if purchased then if it should be plugged in to an Internet connection.

The thought of a worldwide BotNet of LCD TVs is hopefully a fiction . . . at least today.

Links and thoughts courtesy of ObiWan a fellow MVP. Thanks for that and the insights Andrea!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

It Seems That Even USB Battery Chargers Are Vulnerability Deliverers?

The wonders of the human mind. :|

Ingenuity comes in many forms, with the old cliché being Necessity is the mother of all invention. The necessity for the bad folks is grabbing our banking information, identity, or anything else of value from our computer.

While Energizer has no idea as of yet as to how the Trojan software was planted in their device’s monitoring software package, it is now pretty much out in the open that their product did indeed deliver a Trojan to folk’s computers if they installed it.

A while back, USB based electronic picture frames were delivering some malicious software to folk’s systems too.

• ComputerWorld Security: Energizer Bunny's software infects PCs.
• ZD Net Zero Day: Energizer battery charger contains backdoor.

It is getting to the point where we need two systems, whether one physical and one virtual, or otherwise so that we can split off the extremely important things such as online banking to a Vista/Win 7 box with UAC enabled, Standard User permissions, and _NO_ e-mail or other browsing allowed.

Obviously, the VM OS would be used to run the daily tasks with the host being the exclusive banking and sensitive transaction machine.

• Jesper M. Johansson on TechNet: I Got Hacked. Now What Do I Do?

We flatten. We format and reset that drive to “0” leaving no sector unturned.

If the system’s owner refuses to allow for that and requires us to “clean” a Trojan or Rootkit infected machine we get them to sign a liability waiver that exonerates us before they walk out the door.

There are absolutely _NO_ guarantees when it comes to “cleaning” a system that had a backdoor in it. None. Nada. Zippo. Zilch.

The same goes for a compromised DC by the way.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

CCH Scan – XP Pro Only

We are installing the CCH Scan (|Product Info Site) product on a workstation we have just installed at one of our local accounting clients.

An important consideration for installing the product is the fact that it cannot be installed on Windows Vista or Windows 7.

The product install routine configures a number of services to run constantly in the background.

Now, when a scanner, in this case the recommended Kodak i1220 Plus, deposits a bunch of scanned documents as TIF files into the Import folder, the CCH Scan services automatically start picking them up and running through an OCR routine on each TIF file.

Given the CPU intense operations required for the OCR portion of the process, there is no real way to drop CCH Scan into a Windows XP Mode VM.

So, we have an Intel based Core 2 Duo E8500 series CPU on an Intel DQ45EK motherboard with 4GB of RAM. Once CCH Scan is installed and configured, we will be good to go . . . though we are nowhere near that yet.

We are currently on hold waiting for the CCH tech to pick up so that we can run through the setup we have put in place following the documentation. We are calling tech support because the service does not seem to want to automatically OCR any TIF files deposited in the Import folder.

Later . . . much later.

So far, the general implication is that since the CCH Scan services run as a local service, the workstation itself needs FULL rights on the share and at the NTFS level. But, that does not seem to fix the access problem . . . at least not initially.

After uninstalling and reinstalling the entire product group we finally managed to get everything working. But, we needed to delete all Folder Groups and recreate them then restart the CCH Scan services on the workstation.

We could then successfully process any TIF files deposited by the scanner into the Import folder on the network.

Note that to get the XP Professional OS to install on the new hardware, AHCI either needs to be disabled in the BIOS, or a floppy with the AHCI driver on it will be required for an F6 OS setup.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Outlook 2010 Contacts Missing On Windows Mobile Phone? Suggested Contacts Is the Culprit

By default, Windows Mobile will only synchronize the Contacts folder that resides in the user’s mailbox on Exchange.

Since installing Outlook 2010, any new contacts that were added in Outlook were not synchronizing to the Windows Mobile Phone.

It took a bit of time before this was discovered.

In Outlook a search for the contact’s name would turn up their contact properties. Not on the phone however.

A bit of hunting turned them up in the new Suggested Contacts folder in Outlook itself.

Now, the “why” as to their placement there has not come entirely clear as of yet, however, we do know how to turn this feature off for the moment:

Move the “missing” contacts that are in the Suggested Contacts folder to the Contacts folder.

After removing the check mark Automatically create Outlook… setting under the Contacts Options, we created a new contact and:

The contact was placed in the correct place.

No more issues with not having new contacts on the phone.

• Nod to: Black on Stuff blog: How to disable Suggested Contacts in Outlook 2010.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Essential Business Server – Is Discontinued

Perhaps not a lot of folks have really delved into the product, or perhaps there was not a large adoption of the product out of the box. Whatever the root reason, Essential Business Server is no longer.

• Microsoft: EBS Offers (has the announcement)
• EBS Blog: New IT Trends Bring Change to Mid-Market Product Line

We realize that this was a _huge_ decision on their part and probably a very painful one within the product groups and the company overall.

Being an SBSer since way back when, it is actually quite disappointing to see that Microsoft has decided to cut their losses and stop development on EBS.

The disappointment stems from our belief that the EBS product was _good_ for businesses that fell in the required seat range of ~75-300. There are just so many “killer app” type features, found in SBS and then EBS, that the Small to Medium Enterprise (SME) will no longer have access to.

The number one killer application for SBS and EBS is the Remote Web Workplace. Bar none, having a one stop Web based portal for users to gain access to their network resources including their own workstation makes the administrator’s and the user’s life so much simpler.

A screenshot of the SBS 2003 RWW:

In SBS 2003, we had immediate access to OWA, our desktop via RDP, and our Companyweb SharePoint site. All with the click of a link in the portal.

The same is true of the SBS and EBS 2008 RWW but with critical additional features.

The SBS 2008 version:

RWW in SBS/EBS 2008 also has the ability to utilize the TS Gateway service to publish Terminal Services RemoteApps via a link posted on the RWW page among other new features.

These features, along with the integration of the various server components into the products are what make SBS and EBS great.

So, perhaps the death of the EBS product will bring about the rise of another?

Since RWW was introduced in SBS 2003, we have had many conversations with SME/ENT level support folks about the need for an RWW like solution for them.

It is our hope that somewhere in the midst of all of the shuffling about that is going to happen, that the Remote Web Workplace development team gets the opportunity to put the RWW product into a box so that it can be installed on a SME/ENT network.

It may be too complicated to be accomplished, but we can only hope!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Intel Channel Partner Program and Product Support

We have been a part of the Intel Partner Program since the incorporation of our company so many years back.

We have maintained the required Intel product purchase levels via proper distribution channels over the years as that enables us to speak with front-line support technicians when we run into a roadblock.

We have all experienced “support” calls where we are dealing with someone reading from a script.

With the Intel product support line however, it has been a very rare experience for us to connect with a technician that has not in some way worked with the particular product we are calling about.

We prefer to work with Intel “white box” servers for our regional clients as opposed to Tier 1 because we have a pretty good working knowledge of the server products we support.

The other benefit of having our own servers in play is the fact that we are essentially the front line for support, and if there is some sort of software conflict, we do not end up getting caught between Tier 1 support that blames the software and the software vendor that blames the hardware.

The other benefit, when it comes to desktops, is the ability to put together some pretty neat systems that are not available from Tier 1.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

AutoDesk Vault Requires IIS6 Management Compatibility

As we go through installing the AutoDesk Vault on a second Windows Server 2008 R2 box with SQL 2008 Standard installed on it, we are discovering the little bits and pieces that may not show themselves as obvious in the documentation.

The SQL database that was set up, as mentioned in another post on the AUTODESKVAULT instance name (previous post), requires Windows and SQL authentication.

A Windows domain user will need to be created for the AUTODESKVAULT SQL security setup too. We set up a user that is only a member of the Domain Users group with no mailbox in the SBS Console.

From there, we need to make sure that certain IIS6 components are installed and available.

From the AutoDesk Help:

Since IIS7 was already installed in preparation for this task, we needed to click on the IIS node and then click the Add Role Services link in the right hand column of the management console.

We select IIS 6 Management Compatibility and its subcomponents and click Next then Install:

Once installed, we go back to our AutoDesk install routine window:

If the Re-test fails on ASP.NET files, run an elevated command prompt and:

• iisreset [Enter]

Then click the Re-test button and it should run through successfully. Keep the command prompt window open for now as it will be needed again later.

Once the test completes, take note of the two warnings shown in the screenshot above. Make sure that HTTP is allowed in through the server’s firewall which it should be since IIS was installed so that warning can be ignored.

But, once the install routine has finished we will need to change the IIS Connection Time Out as indicated in the screenshot under warnings.

After changing the connection Time-out setting, run the IISReset command in the command prompt window before closing the command prompt window.

Once done, the Autodesk Data Management Server Console 2009 should open up after prompting for the Administrator password which is blank to start off with.

Note that the default libraries will require defragmentation out of the box:

Right click on the library and click on Defragment Library. It is best to do this before importing the production Vault database content since the process requires that the library be locked while performing the defragmentation.

From there, Vault user configuration, backing up the original Vault content (if needed), and restoring of the original Vault content will be required.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Sony PlayStation Network Connectivity Broken

This came by way of one of the e-mail lists that we are a part of here:

• Sony PlayStation Blog: Permanent Link to Latest info on PlayStation Network Status

Not being an avid gamer anymore, there are a lot of folks that we do know that are.

To be apprised of any updates regarding the issue:

• Sony PlayStation Blog

Some of the errors indicated in the first link:

• The date of the PS3 system may be re-set to Jan 1, 2000.
• When the user tries to sign in to the PlayStation Network, the following message appears on the screen; “An error has occurred. You have been signed out of PlayStation Network (8001050F)”.
• When the user tries to launch a game, the following error message appears on the screen and the trophy data may disappear; “Failed to install trophies. Please exit your game.”
• When the user tries to set the time and date of the system via the Internet, the following message appears on the screen; “The current date and time could not be obtained. (8001050F)”
• Users are not able to play back certain rental video downloaded from the PlayStation Store before the expiration date.

And, then this note:

…we advise that you do not use your PS3 system, as doing so may result in errors in some functionality, such as recording obtained trophies, and not being able to restore certain data.

That last little bit about not being able to “restore certain data” sounds quite ominous.

It might be good to unplug the unit for now until Sony indicates that they have a fix available.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Symantec EndPoint Protection – Temp Virus Update Files Not Deleted

This is a bit of an old issue, but it reared its head on one of our client servers that is not being managed in an ongoing basis by us.

This is what we found using the free utility called TreeSize Free:

Now, SEP on this server is not up to date yet, so we will temporarily delete the .TMP files until we can actually get in there and update SEP to the newest release.

MRU5 or later fixes this problem.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer