Network Administration & Consulting Services

• KB930809 Update Rollup 1 for Exchange Server 2007 (KB930809)
• KB935490 Update Rollup 2 for Exchange Server 2007 (KB935490)
• KB935999 Update Rollup 3 for Exchange Server 2007 (KB935999)
• KB940006 Update Rollup 4 for Exchange Server 2007 (KB940006)
• KB941421 Update Rollup 5 for Exchange Server 2007 (KB941421)

This update rollup does not apply to Exchange Server 2007 Service Pack (SP1). For a list of update rollups applicable to Exchange Server 2007 SP1, refer to the section Update rollups for Exchange Server 2007 Service Pack 1 in the Knowledge Base article KB937052.

Source: www.microsoft.com

As many of you know, Microsoft released Windows Vista Service Pack 1 and Windows Server 2008 to Manufacturing RTM ! So, it's a time to take a last Windows Automated Installation Kit (Windows AIK). The Windows Automated Installation Kit (Windows AIK) is designed to assist corporate IT professionals customize and deploy the Windows Vista and Windows Server 2008 families of operation systems. The Windows Automated Installation Kit (Windows AIK) is a set of tools and documentation that support the configuration and the deployment of Windows operating systems. By using Windows AIK, you can perform unattended Windows installations, capture Windows images with ImageX, create Windows PE images and much more.

Download WAIK1.1 here

If you are planning to deploy Windows Server 2008 - Server Core installations, I think you should use the following tip, that I've found few days ago on very good blog, blogs.technet.com/aralves.

Think about you have more than one Windows Server 2008 - Server Core box and you are connecting to them by using the Terminal Services Remote Programs. What you get? Just a simple prompt. By using following tip you can change the default prompt and add at least the servername. To do this, simple open the registry editor and navigate to the following key:

    HKLM\System\CurrentControlSet\Control\Session Manager\Environment

Find a key called Prompt, if it's not there create one using the following settings.

Value Name: Prompt
Data Type: REG_EXPAND_SZ
Value Data: $_Server:[%servername%]$_Username:[%username%]$_$T$_$p$g

With this value you get the prompt as shown in the picture.

Here are some of the special codes you can use:

    * $A - & (Ampersand)
    * $B - | (pipe)
    * $C - ( (Left parenthesis)
    * $D - Current date
    * $E - Escape code (ASCII code 27)
    * $F - ) (Right parenthesis)
    * $G - > (greater-than sign)
    * $L - < (less-than sign)
    * $N - Current drive
    * $P - Current drive and path
    * $Q - = (equal sign)
    * $S - (space)
    * $T - Current time
    * $_ - Carriage return and linefeed
    * $$ - $ (dollar sign)

Now you will always know on which server you are working :) 

The Infrastructure Planning and Design Beta Release for Windows Server 2008 Active Directory Domain Services and Windows Server 2008 Terminal Services are available as an open beta download.

To download, please follow this link:
https://connect.microsoft.com/Downloads/DownloadDetails.aspx?SiteID=14&DownloadID=7925

As many of you know, it’s possible to create a “Lite” version of operating system by using well know program vLite. But, recently Microsoft said in an e-mail to CNET News.com:

“Microsoft does not recommend using any tool to strip out applications from Windows Vista prior to installing it on your system, as it may affect your ability to download future Windows updates and service packs, and may cause your system to become unstable,” 

So, think twice before you creating Vista ‘Lite’

These Release Notes provide important information you should know prior to deploying and using the Windows Vista SP1 operating system, including known issues. You should familiarize yourself with all of the known issues listed here prior to installing the software.

Source: www.microsoft.com

Yahoo Inc confirmed on Friday that it had received an unsolicited bid from Microsoft Corp to acquire the company and that its board of directors would consider the $44.6 billion deal.

Yahoo said in a statement that its board would evaluate the proposal "carefully and promptly in the context of Yahoo's strategic plans and pursue the best course of action to maximize long-term value for shareholders."

Source:Bink.nu

Today I received a call from one of my friends who was trying to map network drive in Vista Business (with no Service Pack 1). His account was not administrator’s account and he was not able to see mapped network drive in Explorer though it applied through the Domain Group Policy.

The issue is that by default, Windows Vista uses NTLMV2 for authentication when attempting to map network drives. To allow NTLMv1 or LM challenge-response operations do the following:

1. Control Panel -> System Maintenance -> Administrative Tools (run as administrator) -> Local Security Policies -> Local Policies -> Security Options

2. Find the Policy Key named Network Security : LAN Manager Authentication Level

3. Set the value to "Send LM and NTLM responses" or - and it seems to make the most sense -"Send LM & NTLM - use NTLMv2 session security if negotiated"

This also can be done by making a change in the Windows Vista registry

1. Run the registry editor and open this key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

2. If it doesn't already exist, create a DWORD value named LmCompatibilityLevel

3. Set the value to 1

4. Reboot

Source: http://youradmin.ca/

For installing Server Roles & Features on Server Core we can use an OCSetup.exe (OptionalComponentsSetup).  To identify all installable and/or installed roles and features we are using other tool, OClist.exe. However, at times some of those roles are not available by default (such as Hyper-V, …).

The Server Core installation option is a new option that we can use (i think it’s a best option) for installing Windows Server 2008.

A Server Core installation provides a minimal environment for running specific server roles, which reduces the maintenance and management requirements and the attack.
To achieve this, the Server Core installation option installs ONLY the subset of the binary files that are required by the supported server roles.

Right now, a server running Windows Server Core 2008 supports the following 9 server roles:

1. Active Directory Domain Services (AD DS) using dcpromo.exe
2. Active Directory Lightweight Directory Services (AD LDS)
3. DHCP Server
4. DNS Server
5. File Services
6. Print Services
7. Streaming Media Services
8. Web Server (IIS)
9. Hyper-V (Windows Server Virtualisation)

As i said, all Server Core server roles can be installed via OCsetup.exe, just with one exception of the Active Directory Domain Controller role. AD is done by using dcpromo and the Web Server which is done through the PackageManager (PkgMgr.exe).

Installing a specific server role follows the syntax below:

start /w ocsetup <serverrole-name>

1. Active Directory Domain Services (AD DS): dcpromo /unattend:<unattendfile.xml>
2. Active Directory Lightweight Directory Services (AD LDS): start /w ocsetup DirectoryServices-ADAM-ServerCore
3. DHCP Server: start /w ocsetup DHCPServerCore
4. DNS Server: start /w ocsetup DNS-Server-Core-Role
5. File Services: installed by default
6. Print Services: start /w ocsetup Printing-ServerCore-Role
7. Streaming Media Server: start /w ocsetup MediaServer (After copying the appropriate Microsoft Update Standalone package (.msu files) to your Server Core installation, and running the .msu file(s)).
8. Web Server: start /w pkgmgr /iu:IIS-WebServerRole;WAS-WindowsAc tivationService;WAS-ProcessModel
9. Hyper-V

Streaming Media and Hyper-V (and may be other roles) might be missing when looking through the Optional Component list (via OClist.exe).

To add updates/roles/features to the list, use the following command:  wusa <update>.msu /quiet

A typical example is the Streaming Media Server role, which only becomes available after copying the appropriate Microsoft Update Standalone package (.msu files) to your Server Core installation and running the .msu file(s).

Installing a specific feature follows the syntax below:

start /w ocsetup <feature-name>

start /w ocsetup BitLocker
start /w ocsetup BitLocker-RemoteAdminTool
start /w ocsetup FailoverCluster-Core
start /w ocsetup WINS-SC

When you connect to a new system you might be prompted for authentication or the access will fail. You can simply configure alternate sets of credentials to be used for various systems using the CMDKEY utility, as this example shows:

You can remove an entry using the cmdkey /delete: command.

With Hyper-V the world of networking is quite different than it was with Virtual Server. First to set the scene, with Windows Server 2008 installed on a system with one network adapter you will see this under Network Connections:

And your system is operating like this:

Once you install Hyper-V and create a virtual network your system now operates like this:

As you can see the parent partition (host operating system in Virtual Server lingo) is now using a virtual network adapter to connect to the physical network.  If you look at network connections on the parent you will now see the original network adapter and a new virtual network adapter:

The original physical network adapter now has nothing bound to it except the Microsoft Virtual Network Switch Protocol.  The virtual network adapter now has all of the standard protocols and services bound to it instead.

Some interesting things to note here:

• The virtual network adapter that appears under Network Connections will have the same name as the virtual network switch it is associated with.
  
  
• It is possible to create an 'Internal' virtual network - which will expose a virtual network adapter to the parent partition without needing to have a physical network adapter associated with it.
  
  
• Unlike with Virtual Server, Hyper-V only binds the virtual network service to a physical network adapter when a virtual switch is associated with the physical network adapter in question.  The advantage of this is that you avoid the performance overhead involved with having this service enabled on network adapters that are not associated with virtual network switches, the downside is that it means that networking gets disrupted on the network adapter in question when a virtual network switch gets created or deleted.

After two month of intensive using of the newest product from Symantec - Endpoint Protection (SEP) 11 - I am ready to make a statement: you want to wait at least till the first service pack before deploying SEP in production.

If you decide to try anyway, spend time to develop proper policies before clients installation. Turn off all features that you do not need at the moment. Pay close attention to Network Threat Protection and Outlook Auto-Protect features. May be it will be better to refrain from using them so far.