David Overton's Blog : SBS 2008, Windows 7, Vista and XP

It has been a while on the blog

David Overton — Wed, 22 Jul 2009 07:08:45 GMT

Well hello again,

I've been away for quite some time - work has been very time consuming and two members of my family have required some dedicated attention while they have not been feeling well (and no, no swine flu).

I'm hoping to start finding more time to "do" the blog and potentially a "tips and tricks" section for SBS 2008 based on my learning's to date. I do still have quite some work backlog, but I'll try to post some of the blog backlog too - I have hundreds of items to post!!

See you soon - and keep the questions coming.

David

Internet Explorer security vulnerability fix now available – think of it as an early Christmas present… now about Firefox’s 3 issues this week…

David Overton — Thu, 18 Dec 2008 09:25:00 GMT

I think everyone knows that an urgent security issue has arisen in IE this week and Microsoft has taken the (wise) decision to publish a fix outside the normal 2nd Tuesday release cycle. Some have said switch browser because of this issue, but not only can that be complex, but most browsers suffer security issues so once again the only real protection is to wrap in cotton wool and hide. Or, use the built in features of Vista and IE7/8 which means protected mode and NOT running as admin. You might ask why a Christmas present? Well, if this continued un-patched then your information is seriously at risk and that would make for a very bad Christmas if your credit card information was stolen!!

Either way, if you have IE on your systems then you will need to update your systems urgently. Of course, my Hyper-V server (or Windows Core for that matter) don’t have IE, so no updates for them!!!

Just for completeness, here is the information from the Technet newsletter

Internet Explorer Security Update
I wanted to update you on the Advance Notification of security update MS08-078 which will address a new vulnerability allowing remote code execution in all affected versions of Internet Explorer products. We plan to release this update on December 17th, around 10 a.m. Pacific Time (6pm UK time) through Automatic Updates and Microsoft Update. We encourage you to test and deploy this update as soon as possible. Our investigations of the known attacks have verified that they are not successful against customers who have applied the security update.
You may be interested to know, that in response to the threat we mobilized security engineering teams worldwide right away to develop, test and deliver a security update of appropriate quality for worldwide distribution in the unprecedented time of eight days. We also published the Microsoft Security Advisory 961051. Microsoft's teams worked constantly to identify more options for customers and updated this advisory 5 times in six days.
We remain committed to building secure products and we also encourage responsible disclosure of vulnerabilities. We believe the commonly accepted practice of reporting vulnerabilities directly to a vendor serves everyone's best interests. This practice helps to ensure that customers receive comprehensive, high-quality updates for security vulnerabilities without exposure to malicious attackers while the update is being developed.

Phil Cross
Technical Audience Group Manager

ttfn

David

Technorati Tags: if you only read one post today, Internet Explorer, Security, Windows, Windows XP, Windows Vista, Windows Server, SBS 2003, SBS 2008, Microsoft

Invalid certificate issued to localhost.localdomain when remotely access SBS 2008 from a Windows PC

David Overton — Wed, 03 Dec 2008 02:03:00 GMT

This is another question I was recently asked. One particular user noticed that the certificate they saw when accessing their server from the internet did not match that when accessing from the LAN. The certificate looked something like this:

This was a little strange as when the system was accessed from the intranet, all things appeared fine. The culprit for them was the SBS 2003 self signed certificate on the same machine. By removing the certificate and then installing the correct new one things got better.

To remove the old certificate, start MMC.exe and accept the UAC prompt. Now press Ctrl+M to add a new snap-in and select Certificates and when asked, add for the user account .

The do the same again, but select Certificates and Computer Account and hit OK to accept the current computer. Now expand out Personal Certificates and remove any SBS 2003 self signed certificates.

To load the new certificates open a browser inside your SBS 2008 network and point to http://companyweb/Lists/Announcements/DispForm.aspx?ID=3 which should give you instructions and the URL.

I hope that makes sense.

ttfn

David

Technorati Tags: localhost.localdomain, SBS 2008, Certificates, Tips

Connect Manager for VPNs into SBS 2008 …er, not really, with CMAK information too

David Overton — Wed, 03 Dec 2008 01:00:00 GMT

[updated with “roll your own” information and how to make a 32-bit version of the exe file]

I love it when people challenge me to solve a question and today’s prize goes to Simon (thank-you for the questions Simon) who asked me where Connection Manager was on SBS 2008? You remember Connection Manager right, to auto configure the VPNs…

Well, the instructions in SBS 2008 are a little less simple. Rather than downloading a pre-configured tool you now need to roll your own. The reasoning, which is quite sound, is that you can access almost everything via the Remote Web Workplace, but for some things, you want a VPN and the way to get it can be found here - http://technet.microsoft.com/en-us/library/cc513974.aspx

If you want to create a Connection Manager Install for SBS 2008 you need to add the CMAK to the SBS 2008 install. Go to Server Manager and click to add a feature.

Install the CMAK by pressing Next. To start the kit, go to the Start Menu, Administrator Tools and then select Connection Manager Administration Kit. Click next until you need to select the target OS.

Select to create a new profile and provide the name and filename (8 characters max)

Provide the domain or realm name and include the “separator” character – eg “mydomain\” without the quotes.

Select no profiles to merge and press Next

Embed the VPN Connection name (eg remote.myserver.com as that is what the SSL certificate will say) into the file and then accept the VPN entry

Remove the automatically update phonebook options and leave blank

Accept the default entries for VPN, Routing tables, IE Proxy, Custom Actions

Now accept the default graphics or add your own logo

Accept the default information on help files, support information, User EULA screen, additional files

Finally accept the answer and build the file:

You can now chose to put the EXE file somewhere your users can access and then they can download it.

One problem solved, more to come.

IF YOU ARE DEPLOYING TO A 32-BIT WINDOWS SYSTEM, YOU WILL NEED TO DO THIS:

Open an elevated command prompt (find in menu, right click and select run as administrator)
enter the command "CD \Program Files\CMAK\Profiles" (without quotes)
If this is a Vista build "CD Vista" otherwise "CD Downlevel"
Then move to the profile directory - "CD <profile name" - if unsure, type "dir" first
Find the .SED file - "Dir *.sed"
Type "\windows\syswow64\iexpress /N<SED File>.SED"
The built .exe file will work on 32-bit systems

ttfn

David

Technorati Tags: SBS 2008, VPN, Connection Manager, Microsoft, Tips, Partners, SBSC, Community

Important Microsoft security update – update your machines now!

David Overton — Thu, 23 Oct 2008 20:06:21 GMT

DavidOverton.com rebooted today due to an emergency security update – an “out of band” release from the normal “patch Tuesday” process. It is worth considering updating and reboot your computers and servers asap.

More information on this can be found at http://www.microsoft.com/technet/security/bulletin/MS08-067.mspx. Impacted systems below:

Operating System	Maximum Security Impact	Aggregate Severity Rating	Bulletins Replaced by this Update
Microsoft Windows 2000 Service Pack 4	Remote Code Execution	Critical	MS06-040
Windows XP Service Pack 2	Remote Code Execution	Critical	MS06-040
Windows XP Service Pack 3	Remote Code Execution	Critical	None
Windows XP Professional x64 Edition	Remote Code Execution	Critical	MS06-040
Windows XP Professional x64 Edition Service Pack 2	Remote Code Execution	Critical	None
Windows Server 2003 Service Pack 1	Remote Code Execution	Critical	MS06-040
Windows Server 2003 Service Pack 2	Remote Code Execution	Critical	None
Windows Server 2003 x64 Edition	Remote Code Execution	Critical	MS06-040
Windows Server 2003 x64 Edition Service Pack 2	Remote Code Execution	Critical	None
Windows Server 2003 with SP1 for Itanium-based Systems	Remote Code Execution	Critical	MS06-040
Windows Server 2003 with SP2 for Itanium-based Systems	Remote Code Execution	Critical	None
Windows Vista and Windows Vista Service Pack 1	Remote Code Execution	Important	None
Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1	Remote Code Execution	Important	None
Windows Server 2008 for 32-bit Systems*	Remote Code Execution	Important	None
Windows Server 2008 for x64-based Systems*	Remote Code Execution	Important	None
Windows Server 2008 for Itanium-based Systems	Remote Code Execution	Important	None

ttfn

David

Upgrade Windows Search to Version 4.0 and improve your PC (for Windows Vista, XP, Server 2003 and 2008)

David Overton — Sun, 08 Jun 2008 12:41:52 GMT

If you have have Office 2007 or a Windows Vista or Windows Desktop Search (WDS) then you probably have V2.6 or V3 of this fantastic search product. Version 4 has a wealth of updates, but most importantly, is more stable and faster. One of the things I love about this is that if you put this on a client and server, and then search a network share, if the contents are indexed on the server then WDS uses the remote index to search, making it super fast. It can even be used with SBS 2003 / 2008 to speed up access to the shares there too.

Description of Windows Search 4.0 and the Multilingual User Interface Pack for Windows Search 4.0

Windows Search 4.0
Windows Search 4.0 lets you perform an instant search of your computer. Windows Search 4.0 helps you find and preview documents, e-mail messages, music files, photos, and other items on the computer.
The search engine in Windows Search 4.0 is a Microsoft Windows service that is also used by programs such as Microsoft Office Outlook 2007 and Microsoft Office OneNote 2007. You can use this search engine to index a program's content and to obtain instant results when you search in a particular program.
Windows Search 4.0 includes the following improvements:

Support for indexing encrypted documents of local file systems
Reduced affect on Microsoft Exchange when you index e-mail in online mode, and there is no local cache (.ost)
Support for indexing online delegate mailboxes
Support for client-to-client remote query to shared indexed locations
Improved indexing performance
Faster previewer updates for Windows XP
Per-user Group Policy settings
Windows software updates for Watson errors
Support for the following new enterprise Group Policy objects:

Computer policies

Prevent adding Universal Naming Convention (UNC) locations to index from Control Panel
Prevent customizing indexed locations in Control Panel
Prevent automatically adding shared folders to the index
Allow for indexing of encrypted files
Disable indexer back-off
Prevent clients from querying the index remotely
Allow for indexing of online delegate mailboxes
Prevent adding user
Specified locations to the All Locations menu
Enable throttling for online mail indexing

Per-user policies

Prevent adding UNC locations to the index from Control Panel
Prevent customizing indexed locations in Control Panel
Prevent indexing certain paths
Default indexed paths
Default excluded paths

Windows Search 4.0 Administrator's Guide
http://technet2.microsoft.com/windowsserver2008/en/library/f98696ed-6e3e-47b7-ab38-511439bce7ae1033.mspx?mfr=true
Windows Search 4.0 Troubleshooting Guide
http://technet2.microsoft.com/windowsserver2008/en/library/84c1c305-baaa-4352-b55a-45daaebf18df1033.mspx?mfr=true
The following files are available for download from the Microsoft Download Center:

Download the 32-bit Windows Vista and Windows Server 2008 package now.

Download the 64-bit Windows Vista and Windows Server 2008 package now.

Download the 32-bit Windows XP package now.

Download the x64-based Windows XP package now.

Download the 32-bit Windows Server 2003 and Windows Home Server package now.

Download the x64-based Windows Server 2003 package now.

ttfn

David

Technorati Tags: Windows Vista, Windows Client, Windows XP, Windows, Windows Server, Windows Home Server, Windows Server 2003, Windows Server 2008, Desktop Search, Search, Windows Desktop Search, Support and Tools, Microsoft