Using the Windows Credential Manager to Store Server Credentials in Windows 8.1 (and on Surface!)

My wife got a new laptop, first one in 10 years.  I’m very proud of her.  She’s the opposite of me, and pretty much doesn’t like change on her computer.  This is most likely due to the fact she touches a computer for less than 1/2 an hour a day, and doesn’t want to spend 10 minutes of the 30 figuring out where the “File” menu went (yes, the IE7 upgrade just about killed my wife).  She went with the Lenovo Yoga 2 Pro. It’s an amazing laptop, but doesn’t have a TPM chip, so I can’t use it for work (otherwise I’d have one too!)  The screen is breathtaking, but I digress.

We have a Home Server 2011 in our house (obviously), but it doesn’t back up UEFI machines (not that I know of anyways) via the Client Backup.  So installing the Launch Pad seemed a bit of overkill so she could just go to \\server.  Her Windows Explorer has a link to the root of the Server share so she can get to the pictures, the videos, the TV shows, and so on.  I’m a big fan of security, and she has her own account on the server, but I couldn’t get her username and password to save for the server through a reboot.  And as you can probably guess, it has to be easy for her (a click to get access). 

I ended up simply saving this into her Windows Credential Storage (details below).  Worked like a charm.  It got me thinking, does this work on my Surface 2?  Sure enough it did!!  This means that I can simply access the server without providing credentials every time.  Now when I’m in my home, my Surface can just access an additional 4TB of data, right from inside the Metro Apps (more on this in my post "Adding Server Shares to Modern Photo App"). 
Let me tell you how to use the credential manager first. 

1. Hit the Start key or swipe out the charm bar and press the Start button
2. Type in Cred to search the start menu for the Credential Manager.
3. Launch the Credential Manager, and select the Windows Credentials button. 
4. Under that button, simply click the Add a Windows credential.
5. Fill out the wizard with the name of your server, in my case “SERVER”, my credentials
6. Notice it’s in the list and then close the Credential Manager

Now you may try this instantly and it might not work.  This is most likely because you’ve already tried to connect to this server and stored the fact that you don’t need a username or password.  A reboot or sign-out/in will fix that as long as the item stays in the Credential Manager.  You can also open the command prompt and type in “net use * /d” to delete all active connections which will force Windows to re-open new ones, using the Credential Manager.

For reference, here is the official Windows Help topic on this.

Read More

The Basics of Local DNS for Small Business Server 2011 Essentials

[Post idea courtesy of Robert Pearman, MVP]

If you’ve used Windows Small Business Server in the past, you’ve probably figured out exactly how DNS works. With the SBS 2008 and SBS 2011 the Connect to the Internet Wizard would analyze your network and determine a static IP address to use, and then ensure you like it before making it the server’s IP address. Then as we all know, the DNS server runs on SBS and resolves local network addresses, like “domain.local” or “server” or the internal fully qualified domain (FQDN) “server.domain.local”

Since SBS 2008 and SBS 2011 are DHCP servers by default, that means they hand out IP addresses, and the server’s IP as the DNS server. DNS works flawlessly in such an environment. Internet based addresses (such as Microsoft.com) are first sent to the SBS box for resolution, and then forwarded on to the ISPs DNS servers for name resolution.

Ultimately SBS is a middle man in the peer to peer DNS infrastructure and gives the full power of DNS to the local network

So how is SBS 2011 Essentials Different?

SBS 2011 Essentials doesn’t assign itself a static IP address, and it doesn’t have a Connect to the Internet Wizard. Essentials will automatically connect to the Internet just like any client computer, using the DHCP assigned address. It does however use its local DNS server to resolve both local and Internet based names by overriding the DHCP assigned IP address to 127.0.0.1 (localhost). If you dig into the DNS settings, you’ll notice that the DNS Server picks up the routers IP as a forwarder. Routers by default will hand out their own IP as the DNS Server and proxy DNS out to the WAN configured (usually DHCP but sometimes services like OpenDNS) DNS servers. This means that if the server were to ask for an Internet based address, like technet.com, it would forward that request to the router, which would intern forward it to the ISP, which could hopefully resolve it for you.

Clients on the network also still need to use the SBS DNS Server in order for Active Directory to work, or to resolve the server and other services on the network (for example, client backup doesn’t work unless DNS is operating correctly). Clients *also* get their IP and DNS Server from the DHCP server, which in Essentials, by default, is the router. This means that the DNS server is the router, essentially skipping the SBS name resolution step. Once the client goes to http://server/connect, a service is installed called LAN Configuration Service. This service monitors client IP address changes, when the client gets a new IP (ie, it turns on, or it changes locations) it immediately sends out a UPnP query looking for the server (note, this only works on single subnet environments). If a server is found, the DHCP assigned DNS address is overwritten by the server’s IP address (obtained in the return call from UPnP). If no server is found, the DHCP DNS assigned address is kept.

This means that client computers get the SBS DNS address within the SBS network, but the DHCP assigned address at a place like StarBucks. Clients can always resolve the Internet, and inside of the SBS network, they can also resolve the SBS server and Active Directory domain.

Now, for those paying attention, you’ll have recalled that the SBS server’s address is also DHCP assigned, which means it can change if the router deems it necessary. There is a similar service on the SBS server that will broadcast when it’s IP address changes, the clients on the network pick this up and update DNS, the clients off the network will just re-do the process above to get the right IP address.

A side-effect/pro of this design over the SBS 2008 or 2011 Standard design is that if the server is down for patching (we all know how long those reboots take), or another reason, the client will revert back to the DHCP assigned address after a short period of time and can continue to resolve the Internet until the server comes back online.

Can I set things up the old way?

Of course you can. SBS 2011 Essentials is still a full blow copy of server, and all the power that you’re familiar with is there. You can just jump into the NIC settings on the server and give it a static IP address of your choice. No problems there.

Additionally, if you absolutely wanted to run DHCP on the SBS Essentials server, no problems there either, simply open up the Server Manager, install the roll and configure DHCP. Don’t forget to turn off DHCP on your router, and away you go. If you’re not familiar with DHCP settings though, I suggest you leave it the way it was.

Read More

Looking to Migrate to Small Business Server 2011?

If you’re looking to migrate to Windows Small Business Server 2011, and aren’t completely sure where to get started, you have your choice of migration options from Microsoft. 

The migration solutions provided are well documented and tested by Microsoft, but do require extra hardware, and do require you to change the computer name of your server.  Additionally, these migration whitepapers are free of charge for you to use.

• Migrate to Windows Small Business Server 2011 Standard from Windows Small Business Server 2003
• Migrate to Windows Small Business Server 2011 Standard from Windows Small Business Server 2008
• Migrate Windows Small Business Server 2011 Standard to new hardware
• Move all SharePoint Foundation 2010 databases for Windows SBS 2011 Standard to another server
• Migrating Windows SBS 2003 to Windows SBS 2011 Essentials
• Migrating Windows SBS 2011 Essentials to New Hardware

There are other solutions that you can choose such as the Swing Migration, which at an additional fee you can get a customized migration paper, and access to the Swing migration forums.  Both are valuable resources and you need to determine which is best for your customer’s business.  Both solutions get you from point A to point B, the better place on SBS 2011 Essentials or Standard

Read More

Going “Pro” using Proxure’s KeepVault Pro for Windows Home Server 2011

If you read my post from Tuesday of this week, on using Proxure’s KeepVault for Windows Home Server 2011 or Windows Small Business Server 2011, and when you got to the bottom, you thought to yourself.  Heck yeah I’m going Pro! Then this I post is for you. 

If you are running Windows Small Business Server 2011 Essentials, then this post will simply show you the features before you buy, because you had to get KeepVault’s pro version for your version of Windows Small Business Server. 

First, the upgrade process: If you have Windows Home Server 2011, and you’ve been enjoying the standard features KeepVault has to offer, but want to upgrade because one or more features in my previous blog post were appealing, here is how you do it:

1. From the Launchpad, click on the Dashboard link and type in your Home Server Password to load up the Dashboard.
2. Navigate to the KeepVault tab already installed in your Dashboard
3. On the My Online Backup Job tab, click the link your account name.  For me it’s my email address to go to KeepVault’s website.
4. Log into KeepVault’s website (you’ll need that subscription ID again) and follow the instructions to upgrade to Professional.
5. Now you have to make the software aware that you’re running pro.  I remembered that the “Restore Files” link had an upgrade option, so I used that:
6. Since I already did the upgrade on the web, I just clicked Apply Upgrade, but you could also skip the first few steps and  have the Purchase Upgrade take you to KeepVault’s website.  When you’re finished upgrading the back end, you get this: 
7. Wow, I don’t even have to close the File Recovery wizard, I instantly have another option to selectively download from other computers I might backup.
8. I cancelled the above wizard, and I’m still in KeepVault Pro

You’ll now notice little changes throughout the UI like the above recovery option, for example, if you flip over to the My Local Backup Job tab, you’ll see in the drop down list that you can add a network drive to backup locally to:

Sub Users and roaming backups

In addition, the Pro account now gives me access to add “Sub Users”.  Brilliant!  So now I can just install the Windows 7 version of KeepVault on my wife’s computer, and have her files and folders backed up directly to the cloud while she roams around with her laptop.  Or better yet, in Windows Small Business Server 2011, you often have roaming sales people or people who are away from the office for long periods of time (perhaps even satellite offices?) you can simply install KeepVault on their PC, sign them up as a sub-account and have them back up directly to the cloud.  Need a file from them? Then simply restore it to the server. 

Accessing your Backup through the Web Portal

When you click on your account name (in my case my email address) in the My Online Backup Job and log in with your subscription ID, you can click on the Web Access tab.  It’ll prompt you for a web access password (I skipped this because I was so excited about Sub Users, If you’re like me, simply disable web access and enable web access and it will prompt you again).  Once you have your password in place, you can click the Open Now web link to jump right into your online backup.

If you don’t want to log in with your Subscription ID, there is a quick jump to http://web.keepvault.com, which will jump you right to your web view of your backup.  Which by the way is raging fast, even though it’s reading encrypted files.  For example, if I wanted to download files from my 2006 User SBS Group Tour, I can simply browse to the folder, click the file and download:

Retention Policy

As mentioned in my previous post on KeepVault, you also get a retention policy of 5 versions of files.  To restore previous versions of the files, simply do a Selective Restore, and when you get to the file, right-click it and choose the version of the file you want.  If there is no context menu, you only have one version (the latest) backed up.

From the Web Access, if you click on a file (screenshot above), you see all the versions of the file available to download.  You should keep in mind the following:

• If you delete a protected file from KeepVault, it deletes all versions
• File versions younger than 48 hours are never deleted (if you save a word document 10 times for example in the same day and backup is configured to “automatic”
• The oldest 5 versions of a file are pruned (read recovered storage space) after the 10th version of a file is successfully uploaded

So as it turns out, it’s pretty easy to go Pro, if that suites you, and Small Business Owners, now you have details of all the Power Pro gives you at your finger-tips.

Read More

Online Backup using Proxure’s KeepVault for Windows Home Server 2011 and Windows Small Business Server 2011

As I’ve mentioned before, being a photographer, my photos are my most critical piece of data that lives on my Home Server.  When using Windows Home Server v1, I had found an Online Backup solution that I previously reviewed on this blog.  While I still think it’s a good solution, it has some draw-backs depending on the Amazon S3 back-end.  Like the cost of Amazon S3 is about as expensive as it gets, and signing up for Amazon S3 was probably one of the more confusing processes I have ever done.

While at SMB Nation 2010 in Las Vegas, I had ran into a company called Proxure who build a solution called KeepVault.  I watched a demo of their solution run and it seemed reasonable, at least to check out.  I thought it was pretty cool that they offer versions for Windows XP, Vista, Windows 7, Standard Server (03 & 08 via their Professional version), and most importantly for me: Windows Home Server.

While this blog covers KeepVault on Windows Home Server 2011 (codename “Vail),  the same add-in offers cloud storage to both the Windows Small Business Server 2011 Essentials (codename “Aurora”) and the Windows Storage Server 2008 R2 Essentials.  However, for these business products, you need to get KeepVault Pro.  The steps and UI, aside from the color of the dashboard, is identical.  KeepVault Pro can also be used on Windows Small Business Server 2011 Standard (codename “SBS7”), although that UI is not shown in this blog post.

Back to the review: The first thing I notice was KeepVault doesn’t bill you for what you use, they bill you for storage space in chunks (40Gb, 80GB, 130GB, 200GB … 3.5TB!).  So if you’re only backing up a very small amount of data, you could end up over paying, but if you compare to Amazon’s 15cents/GB (up to the first TB), you really see a cross over at about 15GB.  Once you get over 15GB, Proxure seems to win hands down on cost.  Plus when you hit the top mark, you click a link and you can bump up your storage. 

The Setup Process

Using the AWIECO Drive Info add-in, I determined I wanted to back up my Pictures and Documents, the things that I really care about.  That came out to about 117GB, so I signed up for the 130GB plan from Proxure.  You don’t need the AWIECO add-in, but it made it a “glance” to compute.

Installing the add-in is just as painless as installing any add-in.  Just double click on it on the server, or on any server-joined client, read and accept the EULA, and then Install it.  You’ll have to re-start the Dashboard to have it appear in the global tabs.

The initial page doesn’t look intimidating at all.  Simply click on the Order a KeepVault Backup for Windows Home Server Subscription Now button and sign up. I thought it was pretty slick you could pay via PayPal or with a standard credit card. I’m all for yearly payments too, so I got to save my 10%!! Within 5 minutes I was emailed my subscription ID. Typing that in, with my email ID and I’m good to go.

Choosing an encryption key I can type one in myself, or KeepVault will randomly generate one for me.  If you generate one yourself, you have a risk that you forget your key and now your cloud backup is useless.  If you’re like me, you’ve installed WHS 2011 on new hardware and it’s probably a while before that fails, so you might forget it.  If you don’t want this cumbersome task, you can let KeepVault choose one for you.  The interesting thing here is that they generate the key based on your ID and subscription numbers (as its computer agnostic).  To me that means that someone at KeepVault *could* decrypt your backup.  Although my suspicion here is that you are still safe because our data is stored in blobs and because KeepVault has more than one customer, it’ll be hard for the lay-man IT person at KeepVault to match this up to your backup.  For what it’s worth, I went with “Let KeepVault choose one for me”.

I like how KeepVault really focused on the simplicity of the solution.  With the previous solution I reviewed I could create multiple backup jobs and multiple schedules, which was nice, because parts of my collection barely every change, I just wanted them backed up.  But it was overwhelming at first.  KeepVault’s “Always/Real Time” schedule by default and the single “Job” configuration removes any daunting thoughts you might have.  The only confusion on the whole page for me was enabling the protection on the shares.  I didn’t realize the grey bar across the page were actually buttons, as most of the WHS 2011 console they are just “headers” of columns.  So once you realize that you can just click on Enable Protection to add that shared folder to the cloud backup, it was all good.  As any good add-in, you can also right-click on a Share in the list and select to enable or disable it from the context menu.

Using the Add button you can also add any folder you wish on the system, so it doesn’t have to be shared out to the network in order for you to back it up.  You’ll also notice in the screenshot above that I have changed the schedule to be between midnight and 6am.  This is because I am uploading 115GB of data, and I work from home, so from 8am-6pm I use my bandwidth for work, and from 6pm-midnight, I use it for entertainment.  By default, KeepVault will Encrypt and Compress your data on the box before it sends it over the wire.  Nifty…

The only feature that I think is missing from the Job scheduler is the ability to run 24/7 but use less bandwidth during the day, and all of it at night.

Looking at the other options, you can always pause the backup, view and delete your protected files online (ie. if you want to permanently delete some files, you can delete the file locally, and use this task to delete it from the cloud as well), view the protection/upload history, configure a proxy if your ISP requires one, and most importantly (the reason we all do backups), Recover Files.

The Event Log is KeepVault’s own list of events (like service start/stop, etc events).  Messaging (while somewhat confusing of a name, maybe “Job Notifications” or “Job Alerts” might be better, is actually really well done.  You can receive emails or SMS alerts (via your carriers E-Mail to SMS service) based on your backup failure rates.  KeepVault obviously has some mail service on the back-end that they allow you access too, because unlike the WHS 2011 Built-in Alerts, they don’t ask you to configure an SMTP service.

When the backup eventually kicks off, if you’re backing up as much data as I am, even with the 1900kbps as advertised in my standard version of KeepVault, I’m in for a long wait…  This is the same with every cloud solution the first time you back-up.  The progress is good, you get both global progress as well as file level progress

From 5pm to 9am (~16 hours) on a Thursday night over my cable connection, I backed up 5.1GB to KeepVault’s cloud.  Not quite as fast as the Amazon S3 solution, but then again, I don’t have a Pro account with KeepVault.

Once your data is uploaded, it lives in Proxure’s Data-Center, encrypted for only you to download in the event of a disaster.  Fingers crossed that this is just an insurance policy, and never used.

KeepVault Local Backup

You may have noticed in the above screenshots there was another sub-tab called My Local Backup Job.  Yes, KeepVault can back up to a local disk.  In the Standard version, it’s similar to the built in WHS 2011 Backup in the fact that it can only backup to hard drives attached to the system (the recommendation is still for USB for offsite storage).  If you have KeepVault’s Premium version, you can also back up to SMB Share (i.e. \\NAS\Share), so if you have another device on your network, you can back up to another share on your network.

Also, you’ll notice that this tab also allows you to compress or encrypt.  So if you’re taking that disk offsite, the encryption piece might be something you want to consider for safe storage of that disk should it be compromised.  If you don’t encrypt it.  Files are stored in “explorer friendly” format so a restore on any computer without KeepVault installed is possible.  In comparison, WHS 2011 backup is stored in VHD format, which requires you to first mount the VHD before you can actually do the restore of files.

Recovery of Files

The One-Click Recovery, really is just that.  Let’s say that you have a little child at home, and their favorite past time was to go into your prized photo library and use the delete button, just randomly through your collection.  Or maybe you were searching for your favorite files, and then miss-clicked and deleted your favorite files across your 100GB collection.  Restoring that can be painful.  This One-Click Recovery makes that a breeze.  As *soon* as you click next (i.e., one click), the service will compare the cloud to the local box, and recover all missing files.  If the file exists, the restore will be skipped, preferring the local file over a recovery.  So you can recover all those files our child deleted randomly, yes with one-click.  Obviously this is how you would go on a new server, because none of the files exist.

The Selective Recovery is more of the natural way we think about recovering.  You get your standard tree-view and you can drill into your cloud backup and select different files to recover.

This way is not a single-click restore, but a selective restore.  On the left-hand side if you select a folder, you can select files and folders on the right-hand side for restore.  So if you’re restoring a whole folder, select the folder above it, and then check the box next to the folder you want to restore. If you’re restoring all but a few files in a folder, that can take a few extra clicks.  Thankfully you can use the CTRL or SHIFT Keys to multi-select as you need (similar to Windows Explorer). Before moving on, you need to select if you want to over-write existing files.  This was weird to see on this dialog, because I figured it would be a sub-option on the recovery location which is next.

Once you’re comfortable with the set of files you’re going to restore (and if you want to over-write files), you next choose if you want to restore the files to the original location, or another location.  Unless I’m restoring a completely new server, I’d probably always choose another location to make sure that I’m getting what I expected.  Once you’ve chosen the folder for the location of the restore, I hit “Recover”, and just wait for the software to download the files and put them in the appropriate place.

The restore is in fact pretty painless, and yes, my photos came down in-tact…

Why Go Pro?

As you saw above, KeepVault has two versions, Standard (which they just call “KeepVault”) and Professional (or “KeepVault Pro”).  As a home user, you  might not ever need the Pro version, but it’s certainly something you need for businesses.  So what do you get if you go Pro?

• Support for Server solutions (aside from the WHS).  For example, the Windows Small Business Server 2011 Essentials, Standard and Windows Storage Server 2008 R2 Essentials.  Also, if you have additional servers in your environment, you can back them up to the same account (Standard Server 2008 and Standard Server 2003).
• A much faster upload rate (5250kbps instead of 1900kbps).  This comes in handy with that first backup.  The faster you get the files to the cloud, the sooner you are protected!
• Local Backup to UNC share.  Meaning you can back up your server to a local server share as well.
• Higher encryption levels (256-bit encryption can be chosen instead of 128-bit)
  • This reminds me.  If you backup a file with the pro version, and then downgrade, your standard client can’t understand the 256-bit encryption and thus can’t restore the files.  It does work the other way around though.  So just be careful which way you go!
• More Access to your data (Web Access, cross device access for restore) and other administration features.  Notice my screenshot under “Restore” above, if I had the pro version, I could backup files and folders from other computers, right to this single computer.  This means I could support cloud backup on my client computers, and then restore this to the server in the event that the client was dropped while out on a trip!  Another brilliant business feature.
• If you’re using a management solution, error notification includes system events, so you can track errors in your online backup with your monitoring tools.
• 5 version retention policy.  If you are with KeepVault standard, you only have the latest version stored on the internet, with Pro it keeps up to 5 versions so you can go back in time when you wish to restore.

As a business user, you’ll have to use the Professional version to get the add-in installed.  As a Home User, you should review the features above and gauge how critical they will be for you. 

If you’re still debating having a Cloud Backup solution for your most prized data, you should approach it like an insurance plan.  You have one for your house, you have one for your car.  You cross your fingers every day that you don’t need to use it, but when you do, it’s there for you.  If your hard-drive fails, recovery of such drives can often cost $1,000s, with no guarantee you can get your data back.  If you’re house burns down, like my uncle’s, this sort of thing is priceless.

I’m using KeepVault, what are you using?

UPDATE: Want to learn more about KeepVault Pro? Check out my Going Pro with Proxure’s KeepVault blog post.

Read More

Windows MultiPoint Server 2011 has RTM’d!!!

I’ve mentioned Windows MultiPoint Server 2011 on this blog before, like how well it works with Windows Small Business Server 2011, or how it fits into your small business, and how you can leverage it to simplify your client story.  Or if you were at SMBNation Fall 2010 in Las Vegas, or attended the VICE(?) UG talk on SBS 2011 you had ability to actually hear me talk to you about it.

You’ve been patient, you’ve been waiting.  And now the wait is over.  Windows MultiPoint 2011 Server has RTM’d!!

Product Unit Manager of MultiPoint, Dean Paron, and Director of Marketing Sandrine Skinner announced today that MultiPoint is available (get the eval at the download center)!  MSDN and Technet subscribers are expected to receive it in the next week.  With the release of RTM, the hand off to the OEM partners happened earlier this month.

Dean Paron, Product Unit Manager, demos Windows MultiPoint Server 2011, source Brandon LeBlanc on the Windows Blog

More Details on the WMS Blog and SBS blog, but here is a snippit of that:

Volume License(VL) customers will be able to download and purchase Windows MultiPoint Server 2011 on March 1, 2011. Broader, public availability through partners will start mid-April 2011.

And by the way the evaluation version available on the Download Center today can be turned into a full production version when you purchase your VL license of Windows MultiPoint Server 2011- so there is no need for re-installation.

We also would like to take this opportunity to thank all of our beta testers for providing feedback and helping us refine and enhance the experience for this new product release.

There has been a lot of discussions around Windows MultiPoint Server 2011 over the last few weeks: it started at the BETT show, the largest tradeshow of Education technology, that took place in London early January where we first had the opportunity to showcase face to face Windows MultiPoint Server 2011 to customers and partners from around the world.

In our previous blogs around the Beta , we mentioned what’s new in Windows MultiPoint Server 2011 versus the previous release of Windows MultiPoint Server (WMS 2010) in terms of features and functionality.

We would like to also mention what’s new in terms of channel availability and SKU availability for Windows MultiPoint Server 2011:

	Standard	Premium
Channel	OEM VL Open Commercial	OEM (pre-install and ROK) OEM Academic VL Open Commercial VL Academic
Number of simultaneous connected sessions you can run	10*	20*
Domain Join capability	Not supported	Supported
Hyper-V capability	Not supported	1+1 licensing model

*Actual number of connected sessions is based on host computer hardware capacity (CPU, memory, etc.), station hardware configuration (RemoteFX, PCI-E or USB) and usage workloads

As you can see in the table above, we now have 2 editions, Standard and Premium which have the same features and functionality except for the ability to join a domain, and ability to run as Hyper-V host or guest, which are only available in the Premium edition. Also the Premium edition is broadly available to customers and resellers through OEM and OEM Academic as well as through Volume Licensing Open Commercial and Academic.

Again VL customers will have access to Windows MultiPoint Server 2011 on the VL download site on March 1, 2011.

Also worth mentioning, we even had our own famous internal Windows 7 blogger, we’re sure you know him already, Brandon LeBlanc, who’s blogging about his experience with Windows MultiPoint Server 2011: check it out here at this link: http://windowsteamblog.com

We’re so excited about this release as in the WMS team we’re super passionate about delivering technology to help our Teachers and Students thrive and providing them with a Windows 7 experience, even as their school’s or campus’ IT budgets have been slashed.

Here’s the link to the Download Center for your convenience- Happy Windows MultiPoint Server 2011!!!!

Read More

How to Enable TimeMachine Backup for your MAC to your Windows Small Business Server 2011 Essentials or Windows Home Server 2011

Well, I don’t often dabble around with a MAC, I just can’t get used to the single mouse button and pressing a key on the keyboard for a simple context menu.  I’ve quite possibly been assimilated to Windows.  However,  protecting your data is important, even if you are on a right-click less product.

As you probably know by now, the Release Candidate of both Windows Small Business Server 2011 Essentials, and Windows Home Server 2011 is now live. Which means you can download and install them!!  You should take a moment and do that now.  I’ll wait.

Once you have these installed, you can easily add your Windows based PC to the server and to the PC backup by simply going to http://server/connect on your client PC.  Click the install for Windows PC button and follow the instructions.  Windows PC’s are automatically added to the backup which takes place in a round robin style nightly.  When you’re on a Mac, it’s the same thing, but you click “Install for Mac”, you end up with a launch pad and access to the server, but no default backup.

It has to be possible right? I mean everyone knows that a MAC is really a *nix box with a really fancy UI (and no right-click).

Poking around on the Internet, you can find some steps, like how to get unsupported volumes to appear to the TimeMachine engine, with the help of a friend (thanks Fabian & Craig) we’ve managed to put together these steps, which work for both Home Server 2011, and SBS 2011 Essentials:

1. First, create an SMB share on your server using the share permissions wizard, let’s call it Mac Backups.  Make sure the users who are on a Mac have Read/Write access.
2. Change the Mac TimeMachine to show unsupported Network Volumes by going to Finder, then Applications, Utilities, Terminal.
3. Inside the Terminal, type this command defaults write com.apple.systempreferences TMShowUnsupportedNetworkVolumes 1.  This sets the showing of unsupported network volumes to TRUE.

 

1. Obtain the MAC’s MAC Address. A MAC Address is the hardware address of the local network card.  It’s important to choose the MAC address of the built in wired connection.  To obtain this, you can run the command from the terminal: ifconfig | grep en0.

 

1. Next (and this is the confusing part, so bare with me) we need to create a sparse file on the MAC and copy the server share.  A sparse file is a file that you define a CAP size, but it will probably take up much less (we’ll define it as 200GB in this example).  This file creation process is a little tricky.  To do this, type in to the same terminal above: command ‘hdiutil create –size 200g –fs HFS+J –volname “<CLIENT_NAME> Backup” <CLIENT_NAME>_<MAC_ADDRESS>.sparsebundle’ Where the MAC client is called <CLIENT_NAME> and the MAC Address on the primary wired connection to the MAC is <MAC_ADDRESS>.  This means if you’re client name was OSX, and your MAC address is 00:00:1F:12:82:92, then your command would be: command ‘hdiutil create –size 200g –fs HFS+J –volname “OSX Backup”  OSD_00001F128292.sparsebundle’  .  Here is what it looks like this client is called “macmini2” and has a MAC address of 34:15:9E:09:00:94

1. Copy this file to “\\SERVER\Mac Backups\” that you created earlier on the server. As you probably know if you are a MAC user, you have to mount the volume:

 

1. Load up the Time Machine settings from within System Preferences, and the sparse file you created above should be in the list.  Select this as the target for your backups.  This will have every TimeMachine backup backup directly to a share on the server:

 

1. Repeat for all your Mac computers on your network.

Once you have completed these steps, your MAC will start using the Windows Home Server 2011 or Windows Small Business Server 2011 Essentials as the backup TARGET.  This means it will back up over the network using the built in timeline functionality, on the schedule you define inside timeline.

What is also cool, is while the MAC won’t show a percentage complete like the PC does when performing the client backup, it will tell you the status right in the console, which of course falls through to the alerts.

Mac Backup Successful:

Mac Backup Unsuccessful:

So there you have it, How to backup a MAC to a Windows Home Server 2011 (aka Vail) or Windows Small Business Server 2011 Essentials (aka Aurora) Server.

For reference, here is the team reference for WHS v1

Read More

How to set the Default Printer for All Users in your Small Business Server 2011 Standard or Essentials Network

One of the biggest pains in a small business is setting up the default printer that everyone needs to use.  With these high powered printers that can handle pages per second and are often shared between a very high number of small business employees, if not all, setting the default printer can be a tedious task.

Before you can start, you need to make sure that the clients understand the new policy.  Windows 7 and higher have the GPO extensions needed to understand this policy, but they will need to be installed on Windows XP or Windows Vista clients.  If you are running SBS 2011 Standard, you can create a "Feature Pack” inside WSUS server and deploy it to all your clients without visiting them.  If you’re running SBS 2011 Essentials, you’ll have to manually install it on each client computer.

Next, we should get the Group Policy in place.  The Group Policy will apply to all users as they log in to change the default printer, should we set it up correctly.  To do this we’ll first create a Group Policy Object to work with.  It’s always good practice to create a new Policy that you can enable/disable per item you wish (although keep in mind that the more policies you add, the slower it takes clients to apply them all).  Here is how to create the default policy:

1. Click Start, Administrative Tools, and then Group Policy Management.
2. Expand Forest: <domain.local>, then Domains, and then <domain>.local
3. Right-click on domain.local and click Create a GPO in this domain and Link it here
4. Give it a friendly name, I called mine Default Printer Policy, leave the starter GPO to (None)

Now we have a policy to work with.  Next up we have to make this policy do something.  Right now it doesn’t.  As a test, I like to make sure it works for one user first, so let’s find a guinea pig and go from there:

1. With the new Default Printer Policy selected, remove Authenticated Users from the Security filtering and place in the guinea pig user. Select Authenticated Users, and click Remove.
2. Click the Add… button, type in the user’s alias and click OK.

This ensures that the policy only applies to the one user.  Now let’s set up that default printer within the GPO:

1. Right-click on the Default Printer Policy GPO and chose Edit…
2. The GP Management editor opens, expand User Configuration, Preferences, Control Panel Settings, and select Printers:
3. Right click on Printers, and choose New… and then Shared Printer.
4. Under the Action drop down, make sure it says Create
5. Under the Share Path: put the path to the shared network printer
6. If you want it to be the default printer, tick the Set this printer as the default printer.  In some cases, few people in the business have private/personal printers, you can exclude these if there is a local printer attached by checking the next box

This of course implies that the printer is installed on each client computer you want to use it on.  What I did was install the printer and share it off the server.  This had the x64 drivers on the server for handing out to the clients on the network.  So the MultiPoint 2011 server on my network automatically installed and configured the printer as the default one.  However, the 32 bit Windows 7 clients did not.  In order to do this, I had to add the x86 drivers to the printer.  Do do this:

1. Right-Click on the printer that’s installed on the server and choose Printer Properties
2. On the Sharing tab, choose Change Sharing Options and then click Additional Drivers
3. Select the x86 check box and click OK..  To install these you’ll need both the 32-bit drivers for your printer (usually downloaded or on a DVD), and a 32-bit disk of the operating system.  (If you have any Itanium hardware, you’ll have to repeat for this as well)

Once this is finished, the clients both x64 and x86 will install the drivers straight from the server instead of Windows Update.  Which is much faster! 

There are additional steps you can take to make parts of your network choose different printers as their defaults etc.  For those I’m going to send you directly to my two sources of information

The Windows Server Administration blog provided most of the information, with their blog post available here.

The Group Policy Center blog provided some reference info, with their blog here.

Read More

Windows Multi Point 2011 and How it Fits into Your Small Business

I’ve talked about Multi-Point before, and I mentioned it in my presentation at SMBNation in Las Vegas at the end of last year, but yet I still get the questions about education only, or can we use it in business? 

Well, it’s true that the current version of Multi-Point, 2010 that’s available today is out in the field for education only (or at least it’s hard to get or manage if you’re not in education).  If you’re in the market for it, because you like the idea of a single computer and multiple users, there were two major problems.  The OEM edition was non-domain joinable, and only supported 10 users.  The Academic version was only via volume licensing to qualified people, and supported 20 users and the beloved domain-join functionality.  So really, if you wanted something useful, really do have to be in the education field to even get your hands on it. 

Also, there are some features that are good for education, but kind of confuse users outside in the working world, like if you put a thumb-drive into one of the USB ports at a workstation, it appears to all the work stations.  Good for education, not so great for business.

Well, if you wrote off Multi-Point 2010 for business, you probably haven’t been paying attention to the new Multi-Point 2011, currently in Beta (obtain it here)

With Windows MultiPoint Server 2011, the licensing and purchase model has been simplified.  There are still two versions as before, with similar restrictions:

• Windows MultiPoint 2011 Standard – still cannot join a domain and still has a max of 10 work stations
• Windows MultiPoint 2011 Premium – CAN join a domain as before and can have up to 20 workstations

The most important piece of information to note in the SMB space, is that BOTH of these MultiPoint editions are offered in multiple Microsoft licensing channels.  So now you don’t have to be a large school to actually purchase the more useful edition of MultiPoint.

What’s better, is that USB issue mentioned above is fixed, a USB thumb-drive only appears to the session its plugged into, and not all the users on the server. 

Additionally, the 2011 version of WMS has support for thin clients.  Here is where I think the big win for Small Business lives.  If you have 12 XP workstations, you can simply obtain 1 copy of MultiPoint Premium and now each of those XP workstations have another 5 years of life but yet, they get a full Windows 7 experience when used as a WMS workstation over the network. 

What??

Yeah, that’s what.  WMS is essentially a turnkey TS server on steroids.  You can TS to it, or you can plug in USB based workstations, or use OS down-level desktops.  I’ve even seen old useless Linux based laptops, that have support for RDP be instantly turned into a powerful Windows 7 workstation.

If you’re a VAP, selling it should be a breeze.  Just show the business owner the console where you can get a thumbnail of each individual workstation.  Business owners will love that they can snoop on their employees desktops for when they are using Facebook, or other non-productive functionality, or even to just confirm employee behavior.

You can really tell that the Windows MultiPoint Server, and the Windows Small Business Server teams share the same floor in Building 43 at Microsoft, our consoles look similar.  Sadly, they do not completely integrate for this release.

I’ve installed WMS into my SBS 2011 Essentials (Aurora) network and it works great.  I haven’t tried on an SBS 2011 Standard network, but there is nothing to prevent it from not working.  I’m seriously considering having the standard version run at my house for when guests arrive and want to use a computer.  Even John Zajdler has tried it in his Aurora Network…

If you haven’t tried it yet, and it’s interesting to you get on it because the release candidate is already out.. which has gotta mean it’s close, right?

Read More

Happy New Year, what’s in store for you in 2011

First off, I wanted to wish all my followers a very happy new year.  2011 is shaping up to be a killer year for small businesses.  There is so much new Microsoft technology coming out to make business more efficient, it’s hard to keep tabs on it all.  I also wanted to apologize to my followers about my lack of posts.  I’ve just returned from a 5 week paternity leave and before that, I was getting my stuff in order.

First, Windows Small Business Server 2011 Standard edition as Released to Manufacturing (RTM!).  This release is pretty exciting and signifies a number of different milestones both internal to our team, and external to the public.  Let’s focus on the external. 

SBS 2011 Standard offers small businesses a completely on premise solution to run their business, including the new Exchange Server 2010 with SP1, SharePoint Foundation Services 2010, and the coveted Server 2008 R2 base operating system, bringing security to a new level.  If you’re familiar with SBS 2008, then you’re in luck, because this product brings a bunch of new functionality, but the learning curve will be super short for you, but it still has enough meat in the product to keep it interesting.

For example, the New and Enhanced features of SBS 2011 Standard are:

• Windows Server 2008 R2 Standard as the base OS, with it’s added security and speed over the 2008 base platform
• Exchange Server 2010, with SP1 brings greater reliability and performance to your small business.  In addition to many additional features like resource sharing (my personal favorite)
• SharePoint Foundation 2010 makes using SharePoint even easier!
• WSUS 3.0 with SP2 to help you manage patches with ease
• The new version of Remote Web Access (formerly Remote Web Workplace), with movable widgets.
• A redesigned http://companyweb
• Improvements into automated domain management
• An updated Best Practice Analyzer (BPA)

So it’ll be a few short weeks more before you can get your hands on this baby, just keep in mind the system requirements if you’re already procuring a machine for it.  Exchange needs more RAM than you’d probably think about it.

And coming the first half of this year, is the highly anticipated Windows Small Business Server 2011, which ties to Office 365, a true hybrid in the server market.  You can obtain the public beta for SBS 2011 Essentials here (with a new public preview coming soon!).

Also coming this year is Windows Storage server codename “Breckenridge”, which provides a client backup engine for your SBS 2011 Standard or SBS 2008 installs.  It’s like a win-win situation in 2011.

Finally, for media hounds, Windows Home Server “Vail” is coming as well, which uses Silverlight to stream videos and pictures out to the web, or DLNA 2.0 to stream it inside your home, backup your home PCs, your server.

All three of the above will also leverage an ecosystem of add-ins to extend the functionality of the server of your choice.  As I said, an exciting 2011.

Read More

Announcing Windows Storage Server 2008 R2 Essentials

Now that Kinect has stopped stealing all of our thunder around announcements (although I have to admit I can’t wait for mine, it looks awesome!), we can continue rolling out announcements in the Small Business space. This morning, building on the Windows Small Business Server 2011 Announcement, we are announcing a new edition targeted at Small Business called Windows Storage Server 2008 R2 Essentials.

What is this Windows Storage Server 2008 R2 Essentials? It’s an answer to what the community have been begging for. Today we see a lot of partners put WHS v1 into small business for the PC Backup integration. WHS v1 only backs up 10 of those computers, and is a stand-alone machine you have to manage on it’s own. Breckenridge fills this gap for businesses allowing you to Domain Join Breckenridge to your SBS 2008/SBS 2011 Standard domains to allow backup for up to 25 computers, and additional storage for up to 25 users.

As you can see, it looks a lot like the Windows Home Server Codename “Vail” Edition and the Windows Small Business Server 2011 Essentials Edition. That’s because it is! It shares the same underlying architecture, which means all the same add-ins work on WSS 2008 R2 Essentials, as they do on the other products.

So what is the differences?

Home Server “Vail”	WSS 2008 R2 Essentials	SBS 2011 Essentials
10 user limit	25 users limit	25 users limit
10 computer limit	25 computer limit	25 computer limit
1 CPU Socket	1 CPU socket	2 CPU sockets
8GB RAM Maximum	8GB RAM Maximum	32GB RAM Maximum
No Domain Join	Domain Join	Domain Controller

Aside from the ability to Domain Join, and the user limit increase, there are some subtle differences you’ll notice throughout the product that have more of a business “tint”, like if you choose to use WSS 2008 R2 Essentials for Remote Web Access, you’ll notice the same defaults you see in SBS 2011 Essentials, instead of what you see in Home Server. There are also some changes to HomeGroup defaults as well. The last thing to note is while you can install WSS 2008 R2 into an SBS 2011 Essentials, or WHS Vail environment, the client connector from each of these products cannot be installed on the same PC.

So why should you consider WSS 2008 R2 Essentials for your small business or customer?

• PC Backup for up to 25 PCs in your SBS 2008, 2011 Standard network. And yes, you can run multiple devices in the same network, and choose who has access via a domain group
• Server backup – backup those PC Backups and other critical data on the WSS 2008 R2 Essentials server. (no, you can’t include the backup of this into your SBS backup)
• Similar console management as our other products. But if you domain join, you don’t manage users from this console, and the password policy is inherited from the domain (even for local users left on the WSS 2008 R2 Essentials box)
• If you are installing it into a standard server environment, enjoy the Remote Web Access functionality
• Additionally, monitor the health of computers in your network
• Media streaming in the business (training videos, etc)

Windows Storage Server 2008 R2 essentials should be released in the first half (H1) of next year (2011). While it can work as a stand alone NAS device, it’s primarily targeted at Small Businesses with an Active Directory in place and the need for PC Backup and media streaming functionality. When it’s released, it will be available through multiple OEM channels with multiple form factors.

To see the official announcement on the SBS Blog, navigate here.

To learn more about Windows Storage Server, and the new addition, navigate to their blog.

Specifically if you want to read more from the Storage Server Family on WSS 2008 R2 Essentials, they have published a post here.

Read More

Small Business Server 7–Interview with Björn Levidow

Björn Levidow, Group Program Manager for SBS, tells us about some of the new enhancements in the next version of Windows Small Business Server 2008 (SBS 2008), currently called "SBS 7" for short. You can download the SBS 7 Preview by going to this Connect site.

Full video & comments on Technet Edge.

Read More

Windows Small Business Server “7” Released to Public Beta

This morning Microsoft released the Windows Small Business Server “7” release to Beta.  This marks yet another major milestone for the Windows Server Solutions Team, now releasing both the Windows Home Server “Vail”, and Windows Small Business Server Hybrid Edition “Aurora” into beta.

SBS 7 marks a major release in the *next* set of all-on-premise solutions.  Updates include:

• Base OS is updated to Windows Server 2008 R2
• Exchange is updated to Exchange 2010 SP1
• SharePoint is updated to Microsoft SharePoint Foundation 2010
• Windows Software Update Services is updated
• The new Remote Web Access (RWA) experience is newer (and matches Aurora!)
• Bug fixes
• etc

You can try out the new SBS “7” beta by pointing your favorite browser to the SBS Connect site, or jump straight to the downloads page.  Don’t forget if you need help, or find an issue to give us feedback, or talk about it in the Newsgroups.

More details can be found on the Official SBS blog.

Read More

Dana Epp – SBS MVP and Security Expert talks about Remote Access and security precautions to take

Dana Epp on Five by 5–Securing Remote Access

Dana covers important topics about what you can do to give your employees remote access, while at the same time ensuring the security to your network is maintained.  Learn more about Dana’s AuthAnvil program at Scorpion Software.

Read More

Discovering Windows Server Codename “Aurora”

HP has teamed up with Becky Och’s, one of our Senior Program managers on the team to talk about what’s in Windows Server Codename ”Aurora”, the new cloud integrated version of Small Business Server.  Becky recorded a short video with the HP Coffee Coaching team to get you up to speed.  As with all Coffee Coaching videos, this one is 4 minutes, which makes it a great video to get up to speed on “Aurora” while you’re wolfing down your morning coffee.

Jump into Coffee Coaching and get more great videos from HP and Microsoft on “Aurora” and other Small Business Products: http://www.facebook.com/CoffeeCoaching

Read More

Announcing the next releases of Windows Small Business Server

Today we (as in our fearless leader Kevin Kean) pulled the lid off what our team has been working on for the past few years. Two new versions of Windows Small Business Server. That’s right. TWO new versions.

From a traditional standpoint, we’ve continued the single-server mantra with Windows Small Business Server “SBS7”. This version includes updates to all the major products in SBS, such as Windows Server 2008 R2, Exchange Server 2010 SP1, SharePoint 2010 Foundation, WSUS 3.0, and SQL 2008 R2 (with Premium edition). These new versions provide our customers with security and management. We also included a brand-spanking new version of Remote Web Workplace! This version of SBS will continue to support the familiar 75 users

The second version, code named Windows Small Business Server “Aurora” is the new edition of SBS. It’s cheaper than SBS7, and is even a lighter weight “first server” option for small businesses as is a hybrid server delivering both on premise services, as well integrates with the cloud. It also includes PC Backup, and server backup/restore capabilities. The same new version of Remote Web Workplace! This version of SBS will support up to 25 users.

“Aurora” also brings a key new functionality of add-ins to drive integration between new and existing on-line services with Aurora. Developers can find the SDK on Connect. We have been working with a lot of partners with SBS Aurora such as Symantec, Level Platforms and Disk Keeper are all making statements this week around plans to integrate products with SBS Aurora. HP is not only showing SBS Aurora in their booth at the Microsoft Worldwide Partner Conference, but has a sneak peek at http://www.facebook.com/CoffeeCoaching. And you’re sure to hear more as we get closer to releasing the preview.

You can sign-up to be notified when the Preview of these servers are available over on the SBS Connect website.

It’s nice to finally be able to talk about the products I’ve been working on for the last number of years!

[Official Blog Post on the Official SBS Blog]

[First discovered review of SBS7 and Aurora, by Paul Thurrott]

Read More

Dean Paron at Worldwide Partner Conference

Another video from WPC 2009 that comes courtesy of VarVid is Dean Paron, the (now former) Principle Architect of Windows SBS 2008.  You can watch his video from WPC below.

Dean Paron–Principle Architect Windows Server Solutions Group

Read More

Yours Truly at Worldwide Partner Conference 2009

Hey folks,  I just found this video that I did at Worldwide Partner Conference 2009.  Aaron Booker stopped by the booth with his VarVid camera and captured about 2 minutes of time with me.  I’ve been waiting to see this video, and I guess I just found it.  Pretty late. 

Sean Daniel–Senior Program Manager Windows SBS 2008

Read More

Understanding SSL Certificates for client to server encryption

Back in January I made a post, which I called Part 1 of Understanding Certificates.  In this post I talked primarily about how the server is authenticated to the client by using a “root” certificate that the client already trusts, thus establishing a trust relationship with a website you are at without actually having been there before.  If you haven’t read it, it’s a good overview on how that works.

In this Part 2, I want to talk about the encryption between client and server.

Part 1 was all about authentication of the server, this part (2) is going to talk about the encryption portion.  Encryption is important on many networks to prevent prying eyes from seeing the data being sent.  The larger and/or more un-trusted the network, the greater the need for encryption.  The Internet of course being the largest of all public and un-trusted networks.

First the easy stuff, when you go to an SSL based website, you’re using the prefix of HTTPS in your browser.  Additionally, many mainstream browsers such as Internet Explorer or Firefox will show a “Lock” symbol to show that your connection is locked, and safe:

(Internet Explorer)

(Fire Fox)

Each browser will show it differently, but I think most of the mainstream one will use a little lock icon.  You might also see different colours (Red means bad, white or Green mean good).  While we’re on the subject of colours.  Some SSL certificate providers will provide you with extra security and extra validation, which will make the address bar go green.  In the captures above it’s important to note that Firefox and Internet Explorer use a completely different certificate store.  Internet Explorer uses the built-in Windows Certificate store, while Firefox manages its own.  There are pros and cons to each approach, but both are just as secure.

So how secure are you?

Well, in the details of the certificate, you can check out the encryption level of the certificate by looking at the public key:

 

This certificate used here for passport is a 1024-bit encryption level.  This means that the keys used to encrypt or decrypt this traffic uses a 1,024 character key length.  That means that in order to decrypt this network traffic, you need 1,024 ASCII based characters in exactly the right order.  That’s a tall order to boot!!  Anything less than 1024 at the time of this printing is not considered industry standard encryption.  Hackers have horse-power to crack 512-bit certificates in just a few weeks, this isn’t new news, this has been done back in 2002!  It also states that even 1024 can be cracked, but it would take a lot longer, given the cracking method used is “Brute Force”. It would take a large number of years to crack this, and you’ll notice if you review your certificates, they are only used for 1 year, and then the key is changed with a new certificate, forcing your hacker to start over.

However, with the introduction of this, 2048-bit certificates are already shipping today.  The bigger the number, the harder it will be to decrypt. What’s the hold up?  Processor power.  Not necessarily in your PC, but on your phone, in your router, even on the server processor!!.  Using higher-level encryption, means that each packet sent over the internet needs to be encrypted on one side, and decrypted on the other.  Does your phone have the processor to deal with higher level of encryption? what about servers that process millions of requests per second, that would double the CPU load for decryption/encryption!  So don’t be surprised if you see 1024-bit for a while longer: it’s still considered industry standard.

You may notice that root or chaining certificates last longer.  This is because their public key is typically not out in the open for all to see, and potentially use to hack.  So it’s generally accepted for these higher certificates to have a longer lifespan.

But how does it work Technically?

Let’s dive into how it works.  When you buy a certificate from a 3rd party, they ask for a CSR (Certificate Signing Request).  The website generating the CSR generates two pieces of information:

1. The Public Key
2. The Private Key

The public key is encoded in this request, along with the final public public certificate.  The certificate provider validates that this is in fact the server it’s issuing a certificate for (the more expensive the certificate, the more validation is done).  The private key NEVER EVER leaves the website generating the certificate.  Think of a mailbox that the post office runs that sites outside the convenience store.  the public key is the slot in the top.  Anyone can get access to that to send stuff into the post office, but the key to open and get access to all this sent mail, only the post office has, and never leaves around anywhere.

Once the certificate request is signed, the public key is placed right on the website for all the world to see, and the private key is kept safe inside the certificate store, hidden from view and access only to administrators!

The private key is used to decrypt everything encrypted with the public key, and vice versa.  Additionally, a per-session key is established and everything is encrypted using that as well.  This prevents when the server sends something to the client encrypted with the private key, any listening clients from decrypting it with the very public “public key”. If you want to go deeper,  you can dive into the nitty-gritty details over on Wikipedia on Transport Layer Security.

What if something goes wrong?

If something goes wrong, or something changes, a certificate is revoked.  A client will check the CRL (Certificate Revoke List) embedded in the certificate to see if the current one is still valid.  If a website cert has been compromised, or a name changed, or anything changed, the certificate is revoked and another one issued.  Clients will know which one to use simply by checking the CRL distribution point.

Here we see that Verisign has their CRL hosted up online that anyone can go and see if this cert is revoked or not.  Clients will known not to trust or use a revoked certificate.

Remember, if you end up at a site that has a certificate that you don’t trust and your address bar in Internet Explorer is red (after you mistakenly continued onto the website), you’ll still get the encryption between the server and the client, BUT you won’t know for sure you’re talking to the right server.  So you should ALWAYS make sure you do not continue onto these types of servers.  Even if you *think* it’s going to the right place.  Imagine if it’s not, and you logged in with your username and password.  You just gave your username and password to some random site! 

Be careful out there, look for the lock icon (), look for the https:// in the address-bar, and be  weary sending personal information anywhere!!

Read More