Friday, February 13, 2009

Thursday, February 12, 2009

My Favorite Windows 7 Features

image

Windows 7 has been getting some good press.  I won’t lie.  I definitely like it.  I’ve upgraded 3 of my 4 primary working machines from Vista to Windows 7 Beta.  Two of those three machines are super powerful 4gb of RAM machines that ran Vista really, really fast.  They are even faster with Windows 7, and a clean install (I haven’t tried an upgrade yet) has all of the drivers detected, and there was very little thought on installing it. 

The 3rd machine that I installed Windows 7 on was actually a NetBook.  One of those new fancy machines that is ultra portable, designed for running a browser and not much else.  I have the Acer Aspire One, It ships with Windows XP Home edition installed on it.  I have to say when I first booted it up, I was thinking “Wow! I forgot how old Windows XP was!”.  Anyways, I backed it up via my HP Media Smart Server, attached a USB DVD drive with Win7 Beta in it, and hit GO!  It’s Blaaaaazing fast, and has all the drivers (minus the Wi-Fi driver) detected out of the box.  The good news is the Wi-Fi Driver is a known issue that should be fixed before RTM.  The other good news is installing the XP driver seems to work perfectly fine, and hey, it’s a beta anyways right?

Ok, so now for the part where I tell you my few favorite features, that drive me NUTS when they aren’t there on my last remaining Vista box:

  1. Win+P shortcut – This brings up the *built in* external monitor control applet, allowing you to choose how to present on your laptop, or just use the external monitor as an additional screen
  2. Libraries – built right into Windows Explorer, allow you to show more than one directory in the same view.  If you’re like me and store some documents on your Home Server, and some documents on your local PC, you wont’ be able to live without Libraries!  The local PC is the default save location, but you can choose any location you like. Here is a handy screenshot: libraries
  3. The new Windows Task bar – Place the icons in the quick launch where you want them.  Like Outlook for instance, I always like having it to the left most.  Now no matter what order I open programs in, Outlook is always on the most left, and if I close it, the quick-launch button is right there to re-open it.  And along with quick view, you really can’t go wrong.  I haven’t seen this thing not be snappy either! taskbar

I can’t wait to see what they do after the Beta!  And don’t forget, if you’re trying out the Beta, and you run out of time you can extend it a little bit, yes it works with Win7 too!

Wednesday, February 11, 2009

Installing a GoDaddy Standard SSL Certificate on SBS 2008

Many providers offer inexpensive SSL certificates for domain-only validation. GoDaddy seems to be a popular choice given just how inexpensive the certificates are. GoDaddy’s inexpensive cert is called Standard SSL certificate.

Before we dive in, let’s recap the certificate story in Windows Small Business Server 2008. There are two "types” of certificates and four “states” your certificate can be in. Those are defined on TechNet in the Managing Certificates section of the SBS documentation. The two types are “Self-Issued” or “Trusted”, and by default, SBS 2008 ships using a self-issued certificate infrastructure, which is used to authenticate the server to the client, and encrypt the traffic between the remote client and the server. The obvious downside here is there is extra work with the certificate installer package on your remote/non-domain joined clients, and Windows Mobile devices. At some point there are enough of these to warrant the low cost to upgrade to a 3rd party Trusted certificate. With a 3rd party trusted certificate, the client computers and mobile devices already trust the root of the 3rd party certificate, as these are maintained by Microsoft Update (and various other solutions for non-Microsoft based clients/devices).

As you probably read when you learned about the Internet Address Management Wizard, we have a number of domain name providers, eNomCentral, GoDaddy, and Register.com. All three of these providers are very well equipped to sell you and facilitate installing a trusted certificate for your small business network, so feel free to shop around!

I’ll be going through the steps for GoDaddy today as they are the only provider that requires intermediate certificates, which is a bit more challenging. The process is the same for all the providers, except for eNomCentral and Register.com, you can skip the intermediate certificate steps, and naturally the UI would be different. On a final note, I have not had luck with the GoDaddy certificate and Windows Mobile 5 (Update Below), if you have Windows Mobile 5 devices, you may want to consider one of the other partners, but the best thing to do here is open the certificate store on your WM5 device and validate the root cert for the provider you’re going with is available in the certificate store.

While Matt Williamson’s Installing GoDaddy SLL Certificates on IIS7 talks generically how to install the GoDaddy SSL certificates, it isn’t detailed enough for SBS 2008. The steps below should provide detailed steps, specific for SBS 2008:

  1. In your Windows SBS Console on the server, navigate to the Network tab and the Connectivity sub-tab and launch the Add a Trusted Certificate connectivity task
  2. Click Next on the welcome screen and choose I want to buy a certificate from a certificate provider and click Next.
  3. Verify this information is correct. This information will be encoded in the request to the certificate provider, and cannot be changed without buying a new certificate. Additionally for some certificate requests this information could be used to contact you to validate the ownership of the domain name. Then click Next.
  4. Once you get to the screen below, you are now going to deal with only the certificate provider, with the encoded certificate request shown in the gray box. Since most providers have you paste this into a web browser, you should click the Copy button to place this into your clipboard. image
    1. IMPORTANT: It’s important not to click back or next-back on this page, as it will re-generate a new encoded string, which will not match the request you make to your cert provider.
  5. Once the encoded string is copied safely (I paste it into Notepad so I don’t loose it during the process) Let’s close the Trusted Certificate wizard for now to get it out of the way and prevent errors now that we have that encoded text in the clipboard (and hopefully in Notepad). Let’s click Next and then select My certificate provider needs more time to process the request, and click Next again, the wizard will show a warning that it could not import the certificate into Remote Web Workplace.
    1. You will also notice after you click Finish, that the console now shows Request Submitted and you have an option to Remove this Certificate, which we don’t want to do unless we want to go back to the beginning.
  6. At this point, go to your providers website and follow the instructions for purchasing a certificate. The provider will most likely ask you to purchase the certificate before they collect the certificate information (encoded text above) from you. Notes:
    1. The provider may try to sell you other services, feel free to browse, but the server doesn’t require additional services
    2. The server does not require a wildcard certificate, port numbers (such as 987) are used to save you the cost of purchasing a wildcard certificate
    3. You should get a confirmation email with instructions on how to install the certificate. My particular email has this section in it, stating to log into the website to obtain my cert: image
  7. Once I log into my account, It’s abundantly clear that I have a certificate set up waiting for me: image
  8. I log in to my account using the ID and choose to use your certificate credit image
  9. Next you will want to go to the Manage Certificate Control Panel: image
  10. In the control panel, select your certificate credit and click Request Certificate image
  11. Now you are prompted to insert the CSR, or Certificate Signing Request, which is all of the information you copied out of the trusted certificate wizard (and put into Notepad right?)
    1. IMPORTANT: Make sure you select the server software to be Microsoft IIS.
    2. Note: the actual domain name you are requesting for is encoded in the string from within the Trusted Certificate wizard
  12. Validate the information in the cert is correct, once you confirm it, it’ll cost more money to do this over again, and then click Confirm.
  13. Once you confirm, an email gets sent to the email account on file for that domain name, once you get that email, there is a verification link inside that email that needs to be clicked. Click it and approve the request, some more email will come into that account you just checked. One to tell you that it was approved, and one to give you the link to go and get the encoded text.
    1. One thing to note here is there are two things to download, the signed certificate itself, and the intermediate certificates which must also be installed on the website.
  14. Validate the install type is IIS and click Continue, then proceed to the Download Signed Certificate link and save the certificate to the desktop of the server.
  15. Then click the IIS Installation Instructions link to open up the installation instructions. It’s important to use these instructions for installing the Intermediate Certificate Bundle. You can follow the Installing the SSL certificate steps as well, but it will change the flow through the Trusted Certificate wizard shown later in this instruction set.
    1. So follow the steps from GoDaddy.com, but I’m going to paste and modify them for SBS 2008 here for you as well… These are of course subject to change without notification!!!
      1. Select Run from the start menu; then type mmc to start the Microsoft Management Console (MMC). Agree to the UAC prompt
      2. In the Management Console, select File; then "Add/Remove Snap In."
      3. In the Add Standalone Snap-in dialog, choose Certificates; then click the Add button.
      4. Choose Computer Account; then click Next and Finish.
      5. Close the Add Standalone Snap-in dialog and click OK on the Add/Remove Snap-in dialog to return to the main MMC window.
      6. If necessary, click the + icon to expand the Certificates folder so that the Intermediate Certification Authorities folder is visible.
      7. Right-click on Intermediate Certification Authorities and choose All Tasks; then click Import.
      8. Follow the wizard prompts to complete the installation procedure.
      9. Click Browse to locate the certificate file (gd_iis_intermediates.p7b). You’ll have to change the file filter at the bottom right to PKCS #7 Certificates.
      10. Choose Place all certificates in the following store; then use the Browse function to locate Intermediate Certification Authorities. Click Next.
      11. Click Finish.
  16. Once this is imported, we can go back to the Trusted Certificate wizard in the product
    1. Click Add a Trusted Certificate in the console to re-launch the wizard if you closed it (as recommended above), and click Next on the welcome page.
    2. Click I have a certificate from my certificate provider and click Next.
    3. Since GoDaddy provided me with a file, I’m going to browse to the file (alternatively if the provider gave back encoded text, that could be pasted into the wizard too) that matches my domain name, in this case, remote.seandaniel.net. and clicking Next. image
    4. We’re finally done, click Finished! Now remote clients will get the benefit of a trusted certificate, and the console reports Trusted as the certificate type.

It’s important to use the Trusted Certificate wizard for the last step, to ensure that the certificate is bound to the correct IIS website, as well as TSGateway for remote desktop access. If you followed all the steps from GoDaddy to install the certificate, simply run the Trusted Certificate wizard and choose I want to replace the existing certificate with a new one, and you’ll get shown the trusted certificate and the self-issued certificate for your domain name, just choose the appropriate one based on the type and the expiration date:

image

On a final note, renewing your certificate after the year, just click that Add a Trusted Certificate link in the console but this time through choose I want to renew my current trusted certificate with the same provider, and follow the instructions!

I did want to call out that NetoMeter.com has a 4-step video process on how to do add GoDaddy SSL certificates to your SBS 2008 server, but a $30 monthly subscription is required to view it, which might be worth it depending on how much help you need with your SBS 2008 server, or might not be worth it if this is your only challenge.

Update – Windows Mobile 5

GoDaddy has e-mailed me regarding support for Windows Mobile 5 devices. WM5 devices older than the AKU2 update only need to have this patch installed. If it is an older WM5 device it needs to be unlocked to allow certificate installation. Once you meet all of these criteria, GoDaddy has provided steps to install the required certificates on your Windows Mobile 5 device. I will copy them here for convenience, although as a reminder, always check with GoDaddy for the latest steps!!

To install the root certificate on your Windows Mobile 5 device:

  • Download the root certificate to your PC in DER format with a .cer file extension (i.e., valicert_class2_root.cer"). The root can be downloaded from the Go Daddy repository.
  • Copy the downloaded root certificate to your device using ActiveSync.
  • On your mobile device, locate the imported file using File Explorer and click on it.
  • The device will display the following prompt: "You are about to install valicert_class2_root.cer certificate issued by http://www.valicert.com/. Do you want to continue?" (If you saved the root under a different name, that file name will show up in the prompt.)
  • Accept the prompt to install the root certificate on your device.
Update: This post also applies to SBS 2011 Standard. But it does not apply to SBS 2011 Essentials

Wednesday, February 04, 2009

A Perfect Small Office Server?

In many cases, a small office makes a decision about a server solution that isn’t actually what they need.  Windows Standard Server will meet their needs, but it’s an expensive solution with generic features not specifically designed for a small office.  In some cases, a simple client computer (Windows XP or Windows Vista) dropped into a corner, to act like a server, can provide a file sharing solution for a small office, but there is lack of security, throughput and simplified management.

There are certainly a lot of things to consider for a small office server.  NetworkComputing.com has an article on all server hardware you should be thinking about. But what server solution do you use to take advantage of all this hardware?  One not extremely well known solution is Windows Small Business Server

Windows Small Business Server includes a simplified management experience, On Premise e-mail and web sharing content, as well as exceptional remote access functionality, all for close to the same price as that Generic Windows Standard Server, perfect for a small office wanting to centralize on a server.  Small Business Server is specifically designed to provide a a simple solution for Small Offices (of less than 75 computer users), and provides plenty of features for end-users, administrators, and new with the 2008 version, customers via Office Live.

Not sure about where to start? try contacting one of the Small Business Specialists. Small Business Specialists dedicate their lives to putting servers into small offices. In fact, Dana Epp, one of the security focused specialists, and also a Most Valuable Professional, as a blog and discusses the top 10 reasons to get SBS 2008.  Some great features include:

  1. Managing rooms and equipment in your company providing a simplified scheduling technique
  2. Remote access to your desktop in the company securely
  3. Simplified user management through templates
  4. Directory quota’s to ensure company data on company
  5. Centralized data storage
  6. Secure and private email solutions

… and many more items.

Windows XP and Windows Vista, while able to share files, aren’t set up for performance access to shares for a small office, and Windows Server Standard server doesn’t provide simplified management, on premise email and easy to understand remote access for your office workers.

In addition to Windows based solutions, you can consider other operating systems, like a small office Linux server. but you have to ask yourself, what’s the cost of ownership? The biggest problem I have with Linux is total cost of ownership.  Sure the solution is “free”, like a free puppy up front, and it seems like a good deal, but how much time do you want to spend on It versus running your business?  Small Business Server opens an easy to use, friendly console right when you log in.  on Red Hat, you have to type “control-panel” at a shell window?  I mean if you want to make a change to the server 2 years later, do you want to re-learn how to use the system?  Don’t get me wrong, I like Linux as much as the next person, but I have to re-learn it every time I touch it.  The article talks about cost, and it’s true they talk about hardware costs only, and no operating system cost, but costs are not calculated in money only, they are calculated in time.  Computer hardware is cheap compared to a salary for someone to manage a server.  I just don’t believe Linux works as a small office server since you essentially need to keep an IT person on staff to manage it.

Wednesday, January 28, 2009

Internet Explorer 8 Reaches RC1

If you haven’t already got IE8 installed, it’s well worth it, with tabbed browsing and all the like.  With Accelerators that quickly jump you to a map or a translation, you can browse a lot faster.

If you aren’t running Windows 7 yet, you can get it from here.  If you are, you’ll have to wait for a new Beta build of Windows 7.

Monday, January 19, 2009

Has Downadup, Conficker, or Kido got you?

Looks like another worm has poked it’s nasty head above water, time to double check and make sure your Anti-viruses are up to date.  The Worm jumps from PCs to PCs on the local network by brute force guessing passwords, installing an HTTP server and download malware onto the system. I mean really, don’t these computer “geniuses” (also known as hackers) have anything better to do with their time.  Imagine if they wrote productive software!

DailyTech.com has an article that you can learn about it’s infection of 8 Million Business PCs in 1 week.  But what you really need to know, is that Microsoft has released a patch for this already, and a security bulletin.  Ideally, you should make sure that MS08-67 is installed to prevent a Vulnerability in a service to allow remote code execution.

Get your worm shot.

Small Business Server 2008 Update Roll-up 1 Released Today!

Folks, as you saw over on the Official SBS Blog, the Update Roll-up 1 Released today!

This update has a few things included with it.  First, the security tab incorrectly displayed the spyware/malware status of clients with Vista SP1.  This is largely due to an API change that happened, and depending on the 3rd party solution you’re using for this, you may or may not have gotten correct status.  Now it should be fixed 100% of the time!  The second issue is not a security issue.  It’s when the Internet Address Management Wizard unexpectedly exists.  The problem here was a race condition when setting up the server for browsing to domain name providers website.

The update will be available on Microsoft Update, most likely starting tomorrow, if not, shortly there after.  It’s also noted as KB 958715.

Huge thanks to the SBS Sustained Engineering team for pushing this one through

Wednesday, January 14, 2009

More Troubleshooting & Repair documentation Live

The User Assistance folk are continuing to crank out some great documentation.  Live today are some additional repair documentation available on the Technet Website here.

Much more documentation is planned to go live as soon as it’s ready, so keep your eye on this location.

Friday, January 09, 2009

Recovering SBS 2003 data to SBS 2008

Once you make the jump to SBS 2008, you’ll wonder if those old .BAK files from NTBackup can be read.  I mean what if you want to recover some files from your 2003 backups to your 2008 server?

Never fear, the Windows NTBackup Restore Utility is here!  Yes it works for Small Business Server.

Brief Description

Utility for restoring backups made on Windows XP and Windows Server 2003 to computers running Windows Vista and Microsoft® Windows Server® 2008.

Thursday, January 08, 2009

Windows 7 Beta & Windows Server 2008 R2 Beta!

Looks like the public beta for Windows 7 has finally arrived, announced at CES yesterday.  The Windows 7 Public beta should be available for download tomorrow from the Windows 7 product page.

If you’re more into servers, like me, you’ll be happy to know that the Windows Server 2008 R2 Beta is here.  The 2008 R2 server product page is here.

Tuesday, January 06, 2009

Going Green and Paperless in Small Businesses

In today’s global economy, tied together with the pressure to stay green, what are the options for a paperless, more efficient, green office?  Is using technology greener that not using technology?  Sure each server or client PC you run increases your carbon footprint, at least according to an article on MSN called Green My Blog.  But also mentioned here is that using hosted services means you share that carbon footprint with the 1,000’s or 10,000’s of others using those servers.

For the past 4 years now, I have been on a mission to reduce the amount of paper that I use, and conserve as much as I can.  I am doing this at home, and at the office. Going green at the office is not only good for the environment, but it will save the business a lot of money!  This doesn’t just stop with paper, it rolls into saving money on power, and making employees more effective, saving you on payroll!  In fact, the CBS Early Show talks about saving money with green technology by cutting down on your power consumption, paper consumption and making employees more effective:

 
Windows Small Business Server can help you go green at the office by consolidating services.  And with a Dell PowerEdge Server, with the AMD Opteron Processor; you get a very eco-friendly server (using 25% less energy) to do so.  Windows Small Business Server can lessen power and paper usage with fax, by having the server answer the fax and email the fax to a fax secretary, lessening the need to keep a fax machine on as well as a server, and reducing paper usage in the office.  A standard fax machine is on 24x7, and uses paper for every outbound or inbound fax.  Or document printing to share with co-workers is a huge waste of paper (According to their study, an office worker on average uses 10,000 sheets of paper in a year! That’s 2 lbs of paper a day!).
 
Further, with Small Business Server, you can easily share files and store them securely, reducing the amount of file cabinets and folders needed around the office, saving space, and time for employees to find the data that they need.  Small Business Server provides SharePoint technology and file shares for the store method you need.  Additionally, easy to use backup and recovery technology keeps the data safe.
 
When on the road, there is no need to print out or bring pieces of paper, or a calendar with you, Windows Mobile seamlessly keeps updating with the server to bring you the latest email, calendar items and contacts.
image
So an investment in green technologies can and will save energy, money and make employees at a business more effective.
 
Why wait on going green at the office?  Think about saving money by investing in the right set of technology for your business.
 
What about at home?  Turn off, or sleep that PC when it’s not in use and store your files on the tiny, power friendly,  MediaSmart server from HP, running Windows Home Server.

Monday, January 05, 2009

Windows SBS 2008, Windows Media Center and the XBox 360

[This post courtesy of efforts by Matt Clapham and Adam DePue]

First of all, Happy 2009!  I trust the holiday season was fun for everyone.  It certainly was for Matt who finally got his XBox 360 working with his Media Center and SBS 2008 server at his house over the holiday’s.  We wanted to share his experiences to benefit the community.  While Windows Home Server is designed for this scenario, and no work-arounds are required, Small Business Server doesn’t expect a media center or XBox in a work environment. 

None the less, it will work should you choose to either run SBS 2008 in your home, or have a Media Center or XBox in the office.

Step 1: Ensuring the XBox 360 Extender can connect to the Media Center PC

To ensure that the XBox 360 can extend media from the media center edition for content *on* the media center itself, you need the media center to be classified as a server on the network.  To do this the media center must be located in the Server’s OU within the Active Directory.  This changes the group policies that apply to that machine, allowing the XBox to connect to the Media Center PC.  To make this change:

  1. Click Start, Administrative Tools, and open Active Directory Users and Computers, and agree to the UAC prompt.
  2. Expand <domain>, My Business, Computers, and click on SBSComputers.image
  3. Find the Media Center computer in the list of domain joined PCs (note, Vista Media Centers can be domain joined, but XP Media Centers cannot) and drag it from the SBSComputers OU into the SBSServers OU.
  4. To make changes take effect immediately, on the Media Center PC, run gpupdate /force.

At this point, your XBox extender should be able to access the media center, and play content from the Media Center PC.  This work around was also discussed on The Green Button.

Enabling the XBox 360 Extender to access content on the SBS 2008 server

Due to the fact that the XBox extender software creates new accounts on the media center (“MCX”), these accounts do not have access to the SBS 2008 server.  As a result, the XBox will fail to access content stored on the server.  While you could create these accounts in the domain, there is no hope to make the passwords match, because the MCX password is a randomly generated long password known only to the XBox and and the Media Center.  Instead, you have to create a logon script for these MCX accounts to map drives to the SBS server using a domain user account which has access to the content you want to access from the XBox.

To create the logon script for the MCX account, you’ll want to create a batch file with the following contents:

net use * /d /y

net use x: \\SBS\Shared_Videos /user:SBS-Domain\AccountA "Password"

Where “SBS” is the server name, “Shared_Videos” is an example share name, “SBS-Domain” is your SBS domain name, “AccountA” is the domian user account name and “Password” is the password for AccountA.  Once you’ve created this script, you need to edit the user account on the Media Center to tell it to run that script on logon.  The script would of course add the “net use” line multiple times for different shares you want to connect to.  For more detailed steps, see my previous post on this issue.