Now Available:

Featured Resource:

line

Newsletter

Email Address:


line

Ask the Expert

Have a question for our resident expert? Email your questions to Greg.

July 11, 2008

Microsoft Draws Line in the Sand with Vista Haters

Looks like Microsoft is finally bringing forces to bear in dispelling the Vista vitriol that I've been blogging about on this site and elsewhere in my personal Give Vista a Chance campaign for many months now. From Mary-Jo Foley's blog earlier in the week:

Microsoft wants its partners and customers to know that it's done letting its competitors and critics walk all over Windows Vista.


"We know our story is very different from what our competitors want us to think," Brad Brooks, Corporate Vice President of Windows Consumer Product, told attendees of Microsoft's Worldwide Partner Conference in Houston during a keynote address on July 8. "Today we are drawing a line and are going to start telling the real story" about Vista.

This is a key turnabout, and one that I've known was coming for a while from my contacts inside Microsoft. If you aren't aware, Microsoft has engaged with reknown marketing group Crispin Porter + Bogusky to design a marketing campaign to counter Apple's staggeringly successful one.

Foley continues with news from the Worldwide Partner Conference:

At the Microsoft partner show, Brooks reiterated the same messages that Microsoft has been attempting to get out to the market over the past few months. He acknowledged that partners stopped believing that Microsoft would ever manage to ship Vista and thus didn't prepare adquately for the launch of the operating system. He admitted that many of the feature changes, especially those in the security area, broke a lot of hardware and software apps. And he emphasized that the Vista that Microsoft first shipped nearly two years ago is very different from the Vista that's out in the market today. Microsoft is using Windows Update to ship updates to Vista users every week in order to continue to improve and hone the product, he added.


Brooks also re-emphasized that because Windows 7 won't veer widely from Vista's hardware requirements and core set of features, partners should encourage customers to move to Vista today in so they will be well-prepared for Windows 7. (Windows 7 is due to ship in late 2009, last anyone from Microsoft said.)

Here at Realtime Windows Server (and in those other locations) you've seen me holding the banner for Vista's relevance as a compelling desktop upgrade. Some examples you can use to help others Give Vista a Chance:

If you're a fellow Vista fan, feel free to use any of the fodder in these articles as ammunition against the anti-Vista arguments in your own organization.

June 24, 2008

Understanding Vista's Native EXE Files

The first two parts of my MCPmag.com series on Vista's native EXE files has been a pretty big hit with the readers. You can read both parts here and here.

What's interesting are the sheer number of EXEs available in the System32 folder. My research with Vista showed that "...out of 390 EXE files in a default RTM Vista installation, 234 can be invoked by a user to accomplish some task. Eighty of those will launch a GUI-based tool, while the remaining 154 are command-line tools." After pulling that information together, I felt it necessary to just pull all the commands into a little cheat sheet for my own use. You'll be surprised at some of the commands that you never knew existed, many of which haven't changed since Windows XP!

Part 3 comes out this week, where I explain the 80 commands that launch some sort of GUI tool. As with the command-line tools, I was impressed at the GUIs available that I'd never seen before.

June 23, 2008

Understanding the Migration from FRS to DFS-R in Server 2008

Over at the Concentrated Technology blog this morning I post a how-to summarization of the process you need to complete to migrate your domain from FRS (ick!) to DFS-R (yea!).

A little backgrounder before the jump: Just like with the previous versions of Windows Server, the domain migration process requires all DCs to be upgraded to the new OS version before you can upgrade the Domain Functional Level. Once all DCs are upgraded, navigate to Active Directory Domains and Trusts, right-click the domain, and select Raise Domain Functional Level.

Once you complete this step you'll begin enjoying the benefits of the upgraded domain. What's interesting, however, about the FRS -> DFS-R changeover is that upgrading the Domain Functional Level only enables DFS-R for use. It doesn't directly complete the conversion for you. In order to complete the conversion, you'll need to complete a few additional steps using the DFSRmig.exe utility.

Click through for the details.

June 6, 2008

Windows Server 2008 Step-by-Step Guides

I've already blogged before about the Hyper-V and the Server Core step-by-step guides released by Microsoft that give you detailed directions on how to use Microsoft's new technologies. But were you aware that Microsoft currently has over 25 of these guides available on their web site?

Click past the fold for the entire list, but know that through these guides Microsoft is making it easy for you to understand and use the new products and technologies that arrive with the release of Server 2008. I myself recently used the Network Access Protection one to success to help me understand this new technology in the context of DHCP enforcement. It was well-written, and going through the process with a set of virtual machines helped me truly understand how to set it up.

Get your copy of the guides at: http://www.microsoft.com/downloads/details.aspx?FamilyID=518d870c-fa3e-4f6a-97f5-acaf31de6dce&DisplayLang=en#filelist

Click past the fold for the list...

 
Continue reading Windows Server 2008 Step-by-Step Guides...

DNS Even Gets Improvements with Server 2008

DNS has been around so long, that its hard to think of how it could get improved. DNS has always been one of those set-it-and-forget-it technologies, that unless you're an ISP or the host of a major zone you probably rarely think about it in your environment.

With Server 2008 come a number of improvements to DNS the majority of which are underneith the covers. All of these improve the performance and/or extend the functionality of DNS. David Tesar, in a recent blog post, talks about some of the new functionality and provides a few links to where you can get more information. He discusses DNS on Server Core and the changes to the primary read-only zone that are necessary to support read-only AD-integrated DNS. He talks about background zone loading and how this new functionality speeds the process of bringing large zones on-line. He also introduces the global names zone for single-label names (think WINS), as well as support for IPv6. Lastly, he talks about some of the updates to the DNS client that are worth reprinting below:

For Vista clients or WS08 servers, the DNS client has a few good changes:
  • Periodic check to make sure the client is authenticating with a local DC (configurable via group policy). Previously, a client would only fail back to the closer DC when forced.
  • Locate the nearest domain controller using the defined Active Directory sitelink costs instead of searching randomly. This is disabled by default, but good to enable when you have clients across slow site-links.
  • Use link-local multicast name resolution (LLMNR), also known as multicast DNS or mDNS, to resolve names on a local network segment when a DNS server is not available.

Read his analysis along with links to detailed descriptions at: http://blogs.technet.com/extreme/archive/2008/04/25/windows-server-2008-dns-enhancement-nuggets.aspx

May 29, 2008

Dealing with IPv6 Before you Need to Deal with IPv6

Over at MCPmag.com, I pen some great info on how to deal with IPv6 when you haven't yet implemented it in your network. There, I talk about the new "-4" switch used with ping to ensure that you're getting a IPv4 response as well as the registry key you can set to disable it completely on your Server 2008 & Vista computers.

...there are two things you can do that can assist with keeping IPv6 out of the picture for now, at least until global warming speeds IPv6's glacial melt-off. The first is the "-4" switch used with the ping command. IPv6 responses to ping requests can be confusing, so this switch forces ping to use IPv4 for the query. To use this switch, simply enter it before the hostname you want to ping, as in:


ping -4 {hostname}

Another option is to disable IPv6 functionality entirely. This can be done by editing the registry. In the location HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ create a registry DWORD value titled DisabledComponents. Set the data for this value to FF in hex to disable all IPv6 components except for the IPv6 loopback interface. This setting also configures the computer to prefer IPv4 over IPv6. Restart the computer for the setting to take effect.

Later on, when you implement IPv6 in your network, simply reset this value's data to 0 and reboot again and you're merrily on your way to the networking of tomorrow.

Windows 7 to be More Evolutionary than Revolutionary

image-01-052908.jpg

If you're one of the many who are giving Vista a bye in the hopes that Windows 7 will revolutionize the Windows OS, you might consider rethinking your position. Microsoft this week has finally given us the littlest of peeks into what we can expect out of Windows 7. From Lee Pender over at Redmond Channel Partner:

Windows 7 will not have a new kernel; the kernel will build on those of Windows Vista (hmm) and Windows Server 2008. There will be a 32-bit version and a 64-bit version, and Windows 7 should debut sometime around January 2010 -- although Ballmer mentioned late 2009 at the D show -- give or take a few months (or years, if we know Microsoft, but that's our little added comment).

More color commentary from the Ars Technica blog:

Now, Microsoft has settled the question of whether or not the operating system would come with a completely new kernel, or simply one that builds on what we already see in Windows Vista SP1 and Windows Server 2008: "Contrary to some speculation, Microsoft is not creating a new kernel for Windows 7. Rather, we are refining the kernel architecture and componentization model introduced in Windows Vista," said Flores. He went on to say: "one of our design goals for Windows 7 is that it will run on the recommended hardware we specified for Windows Vista and that the applications and devices that work with Windows Vista will be compatible with Windows 7."


It is important to note that these are goals, and won't necessarily be achieved, but it's great to see that Microsoft has set the bar high. This is in line with Gates' recent quote about Windows 7's performance, and my speculation that Windows 7 will be about performance as Windows Vista was about security.

Even more details, out of a CNet interview with Steven Sinofsky, Microsoft's Windows chief:

I know you said you don't really want to look back, so maybe looking forward a little bit...We haven't heard a lot about Windows 7, but we've heard about a couple of things discussed. The real areas I've heard a lot about are this idea of a new kernel, a minimum Windows kernel that came up in a speech, and then some stuff around new user interfaces. Can you tell us a little bit more about where those things fit in with how you guys are thinking about Windows 7?


Sinofsky: We're very clear that drivers and software that work on Windows Vista are going to work really well on Windows 7; in fact, they'll work the same. We're going to not introduce additional compatibilities, particularly in the driver model. Windows Vista was about improving those things. We are going to build on the success and the strength of the Windows Server 2008 kernel, and that has all of this work that you've been talking about. The key there is that the kernel in Windows Server 08 is an evolution of the kernel in Windows Vista, and then Windows 7 will be a further evolution of that kernel as well.

So, memory management, networking, process management, all of the security hardening, all of those things will carry forth, and maintain the compatibility with applications that people expect. Finally, we are going to make sure that the release is available both in 32 bit and 64 bit, which is an additional help for maintaining compatibility, particularly with device drivers. As the 64-bit ecosystem catches up, we expect more and more people, particularly enthusiasts, to be running 64 bit. For many people that's a great scenario today. I know I run 64 bit on most of my machines, including my primary laptop.

While the focus on Vista was definitely on security, Microsoft has said again and again that Windows 7's focus is in performance. Definitely read this last interview if you want to hear some interesting positioning on Microsoft's part. What they won't provide are any down-and-dirty details of what we can expect out of the new OS. But, this is a good thing. Vista's image suffered as much from its implementation as the delta between the implementation and the expectations in the marketplace prior to release. By not hyping the OS to the levels we saw with Vista, Microsoft does themselves a favor.

Underpromise and overperform is a great motto to live by, it seems.

May 28, 2008

For My SBS 2008 Review, They Mailed an Entire Server!

I've recently been engaged by the Small Business Server team at Microsoft to review and provide comment on the new SBS 2008. As part of that, last week I got a private demonstration of the updated product and information about Microsoft's roadmap and list of new and added features.

Today, they mailed an entire freakin server to my front door!

Major style points on the presentation, I'll admit. But, there's another reason why they chose not to merely point me to a download location for the software. This review of SBS 2008 is intended to be done from the perspective of the small business owner that purchases an OEM preinstalled version on workgroup-class server hardware. That preinstalled installation arrives with the OS and drivers already installed, and is intended to bootstrap the quasi-technical small business owner into server ownership.

I've merely got the thing out of the box at this point, so I haven't yet had the opportunity to see how the initial bootup configuration works. Once I get there, I'll report back with more information. What I can say is that from just the demos I've seen of SBS 2008, its console appears pretty slick.

May 21, 2008

Hands Down the Very Best Explanation of RODCs I've Seen to Date

Kurt Roggen puts together one of the best and most informative pieces I've seen to date on the internal processes that occur when you deploy a Windows Server 2008 RODC.

If you have remote site offices with physically insecure Domain Controllers, you must read this article and immediately upgrade them to become RODCs. The security benefits greatly outweigh the costs.

Read Kurt's excellent documentation at: http://trycatch.be/blogs/roggenk/archive/2007/08/01/active-directory-domain-services-rodc-read-only-domain-controller.aspx

May 12, 2008

BUMPED! Windows Server 2008: What's New / What's Changed Part #1 of 12: The Final Book is Now Available!

As you probably already know, my latest book Windows Server 2008: What's New / What's Changed is now available through SAPIEN Press and on Amazon. In support of its recent availability, this week I'm bumping all 12 of my original series with snippets from chapters in the book.

If you haven't taken a look at the book, its worth your time. Here's the blurb from the back cover to whet your appetite:

Microsoft has released its next server operating system - Windows Server 2008 - and you need to know more about it. But you don't need the basics and you don't need the step-by-step. You already know Windows 2003. You just need a quick and dirty review of what's new and what's changed from Windows Server 2003 to Windows Server 2008. Get it with this ultra-quick and highly-entertaining guide, written by Windows insider Greg Shields. Focusing tightly on what's new and changed in Microsoft technologies for installing, managing, and securing Windows Server 2008, this thin guide will quickly ramp up your skills. Save yourself some time and money by skipping the basics and using your existing skills to master Microsoft's new server O/S.


Automate server installations * More effectively manage servers through Server Manager * Gain insight with Reliability and Performance Monitor * Implement powerful new Group Policy * Reduce your attack surface with Server Core * Complete better Active Directory backups * Deploy apps using Terminal Services * Secure your servers with the new Windows Firewall * Secure branch offices with Read-Only Domain Controllers * Augment passwords with Fine-Grained Password Policies

A major part of Microsoft's new strategy for automated systems management is the new Windows PowerShell. So as a bonus to get you started, you'll also get nine full and complete chapters from Don Jones' and Jeff Hicks' Windows PowerShell v1.0: TFM, 2nd Edition. Learn to use PowerShell while you discover the new and exciting technologies in Windows Server 2008.

Get your copy directly from SAPIEN Press at this address: http://www.sapienpress.com/windows_server_08.asp

Or, if you're a fan of Amazon (and who isn't!), you can find it here: http://www.amazon.com/Windows-Server-2008-Whats-Changed/dp/0977659771/ref=sr_1_1?ie=UTF8&s=books&qid=1210015189&sr=8-1

May 8, 2008

Supported paths for upgrading from Windows Server 2003 to Windows Server 2008

In case you're considering an upgrade, Microsoft recently released KB951041 which discusses the supported ways to complete an upgrade. Note here that it is my personal opinion that upgrades should be only a stopgap measure until you can complete a full rebuild on any server. You flush out all your prior mistakes that way...

From the knowledgebase article:

From Windows Server 2003 Standard Edition Service Pack 2 (SP2) or from Windows Server 2003 Standard Edition Service Pack 1 (SP1), you can upgrade to the following versions of Windows Server 2008:


  • Windows Server 2008 Standard

  • Windows Server 2008 Enterprise

  • Windows Server 2008 Standard without Hyper-V

  • Windows Server 2008 Enterprise without Hyper-V

From Windows Server 2003 Enterprise Edition SP2 or from Windows Server 2003 Enterprise Edition SP1, you can upgrade to the following versions of Windows Server 2008:


  • Windows Server 2008 Enterprise

  • Windows Server 2008 Enterprise without Hyper-V

From Windows Server 2003 Datacenter Edition SP2 or from Windows Server 2003 Datacenter Edition SP1, you can upgrade to the following versions of Windows Server 2008:


  • Windows Server 2008 Datacenter

  • Windows Server 2008 Datacenter without Hyper-V

From Windows Server 2003 R2 Standard Edition SP2 or from Windows Server 2003 R2 Standard Edition SP1, you can upgrade to the following versions of Windows Server 2008:


  • Windows Server 2008 Standard

  • Windows Server 2008 Enterprise

  • Windows Server 2008 Standard without Hyper-V

  • Windows Server 2008 Enterprise without Hyper-V

From Windows Server 2003 R2 Enterprise Edition SP2 or from Windows Server 2003 R2 Enterprise Edition SP1, you can upgrade to the following versions of Windows Server 2008:


  • Windows Server 2008 Enterprise

  • Windows Server 2008 Enterprise without Hyper-V

From Windows Server 2003 R2 Datacenter Edition SP2 or from Windows Server 2003 R2 Datacenter Edition SP1, you can upgrade to the following versions of Windows Server 2008:


  • Windows Server 2008 Datacenter

  • Windows Server 2008 Datacenter without Hyper-V

From the following versions of Windows Server 2003, there are no supported upgrades:


  • Windows Server 2003 Web Server Edition SP2 and Windows Server 2003 Web Server SP1

  • Windows Server 2003, Enterprise Edition for Itanium-based Systems

  • Windows Compute Cluster Server 2003

Read past the fold for some special considerations for Server Core and a few additional notes.

 
Continue reading Supported paths for upgrading from Windows Server 2003 to Windows Server 2008...

May 7, 2008

The Essentials Series: Active Directory 2008 Operations

Hot off the press, my recent Essentials Series on Windows Server 2008 Active Directory Operations has been released here at Realtime. In this series, I talk about the needs and the step-by-step for auditing, disaster recovery, and RODCs, three topics in which you should definitely be interested.

Here's the breakdown for each of the articles in the series:

  • Article 1: Understanding Active Directory Auditing in Windows Server 2008. Active Directory auditing gains new granularity in Windows Server 2008, specifically through the breakdown of the traditional nine categories into 50 new subcategories. In this first article, Greg discusses the new subcategories, where they're useful, and the new processes for configuring them on Windows Server 2008.
  • Article 2: Understanding Active Directory Recovery in Windows Server 2008. Recovering Active Directory objects and whole Domain Controllers has traditionally been a complicated process. But in Windows Server 2008 that process gains a few new native tools to ease the pain while reducing downtime. The second article in this series will discuss the tools and steps necessary to restore objects and DC's now available in Windows Server 2008.
  • Article 3: Understanding the Security Implications of Server 2008 RODC's. Windows Server 2008 includes a new type of non-writeable Domain Controller called a Read-Only Domain Controller. This new class of DC has specific uses in branch offices and quasi-secured locations. In this final article, learn the best practices for implementing RODC's in your environment and the steps necessary to create your very own.

Download the entire series from this link: http://nexus.realtimepublishers.com/ESAD2K8O.htm

May 6, 2008

Designing OU Structures that Work

TechNet Magazine this month includes an article that discusses best practices in OU design. One great quote from early in the piece that I'm sure you've experienced yourself states, "A poorly planned OU structure tends to take on a life of its own."

So true. With a poorly planned OU structure, you spend more time looking for objects and troubleshooting Group Policy application than necessary. In every case so far in my own personal experience, the simpler the structure the more useable it is going to be. If you find yourself creating OUs for mere object separation without additional reasoning, you may find yourself with an end-result structure that's too complicated. The article breaks down the architecture determination process into three questions. Ask yourself these three questions when you're making decisions about when and where to create OUs:

  1. Does this OU need to be created so a unique Group Policy Object (GPO) can be applied to it?
  2. Does a particular group of administrators need to have permissions to the objects in this OU?
  3. Will this new OU make it easier to administer the objects within it?

If the answer to any of these questions is "yes", then likely the OU creation is a good idea. If you find yourself answering "no" to all, then the OU creation may be extraneous. The article then goes on to a deep discussion about the different object models typically used by successful environments.

Get your copy of this excellent article at: http://technet.microsoft.com/en-us/magazine/cc462797.aspx

May 1, 2008

Give Vista a Chance! (Episode 34985)

TechTarget asked me to pen an anti-anti-Vista analysis based on my recent Give Vista a Chance campaign. With this piece I'm presenting the why-you-should-stop-listening-to-the-pundits-and-just-install-it side of the argument. Another author will soon present the counter-point.

In that piece, I continue my argument why I believe in the long run it will be problematic for an IT environment to continue the anti-Vista drumbeat:

First and foremost, much of the blame is misplaced for Vista's initial driver and application compatibility problems. Vista is Microsoft's first desktop operating system fully developed under the guidelines of Microsoft's Trustworthy Computing Initiative, a focus that reprioritized security above virtually all else in Microsoft's software development processes. If you've hated the monthly patch cycle or have been hit hard by some security vulnerability in the past, the fruits of this focus over the long haul will help you sleep better at night.

But the real problem is with those conflicts themselves. Until the release of Windows Vista, Microsoft's operating systems were unlike virtually every other modern OS in that they allowed access by drivers and applications directly into "Ring 0," also known as the kernel itself. With this access, any application or driver could easily leverage the full power and resources of the core of Windows itself.

This direct access was a boon for compatibility and is arguably a big source of Microsoft's widespread OS adoption. But it simultaneously is the source of huge operating system vulnerabilities, crashes and instabilities. With Vista, Microsoft made the long-range decision to eliminate direct access and align Vista's security model with those of the other major operating systems. The good news is that there is better security, less chance that an application can crash a machine and a more stable operating system. The bad news? Many applications and virtually every driver ever written needed a rewrite.

So with Vista, Microsoft may have kicked off the problem, but the real devil is in the details. Microsoft made known during Vista's multi-year development lifecycle that changes were coming, but many driver and application vendors ignored the warnings. Thus, when Vista was released, we Windows administrators ultimately saw an operating system that couldn't do what we need it to do.

Over the last year, much of those needed rewrites have been completed. And pretty much all managed desktop hardware now has the necessary drivers for a successful upgrade.

Read the full piece and come to your own conclusions at:

April 25, 2008

Updates! Get your Vista and XP Updates!

Effective this past Monday, Vista SP1 is now available via Automatic Updates. Also, Windows XP is officially RTMed.

Both are great updates that should get an early installation. So, get 'er going!

If you're interested in reading about the XP SP3 update, Paul Thurrott wrote an interesting FAQ on it at this site: http://www.winsupersite.com/faq/xp_sp3.asp.

What I didn't know was the list of the new features that arrive with SP3. Paul writes:

  • Network Access Protection compatibility. Announced years ago, this feature allows Windows XP machines to interact with the NAP feature in Windows Server 2008. This functionality is built into the RTM version of Windows Vista as well.
  • Product Key-less install option. As with Windows Vista, new XP with SP3 installs can proceed without entering a product key during Setup.
  • Kernel Mode Cryptographics Module. A new kernel module that "encapsulates several different cryptographic algorithms," according to Microsoft.
  • "Black hole" router detection algorithm. XP gains the ability to ignore network routers that incorrectly drop certain kinds of network packets. This, too, is a feature of Windows Vista.

April 17, 2008

Vista too Slow? Upgrade your RAM.

Mark Minasi gets interviewed by TechTarget in this piece on Vista SP1. Among a slew of other comments about the much maligned operating system, Mark suggests to everyone:

To make Vista "really sing," Minasi said four gigs of RAM is ideal...

He also recommends using the 64-bit OS version if your hardware can support it (which I agree as I've been running x64 for a year now). But, the upgrade to 4G is critcially important due to Vista's pre-caching in support of faster operations. This is functionality Vista does behind the scenes and is a common source of the other comment I hear a lot, "Why does it seem that Vista seems to get faster the longer I use it?"

One of the biggest anti-Vista threads I continually hear is towards the monetary cost needed in support of replacing for upgrading hardware . Poppycock! 4G of DDR2 SDRAM currently goes for as low as $100 through on-line retailers these days. And that's for the good RAM, too. Heck, I just recently purchased 4G of SORAM (laptop RAM) for slightly more than that directly off the shelves at Micro Center.

So, yes there is a hardware upgrade, but the cost is slight in comparison with the benefits.

April 16, 2008

Domain Controllers will be your First Server 2008 Upgrade: Here's Why...

This month's Redmond Magazine is on the shelves, and in it I throw up the idea why I think Domain Controllers might be your first upgrade. From the piece:

Microsoft's newest server OS will be ready by the time you read this. The manner in which you upgrade, though, probably won't be immediate. Here's my prediction: Your path to WS 2008 will happen faster than it did from Windows XP to Windows Vista, and upgrading your DCs will probably be your first move.

Think about the servers in your environment. Application servers typically have one or more third-party tools installed. This increases the likelihood of conflicts and complicates testing. Mail servers are exceptionally critical to your business, so upgrading these involves a lot of preparation and an equal amount of risk. Even file servers, often the least customized from the perspective of installed apps, are still cumbersome due to the potential for data loss.

On the other hand, DCs are the perfect storm of low customization, few installed apps and high redundancy thanks to Active Directory's peer-to-peer replication. The upgrade process is also relatively easy for WS 2008. Best of all, the benefits to your AD make it well worth the effort.

Read the rest at: http://redmondmag.com/columns/article.asp?editorialsid=2551