Updating Windows Defender Beta 2 using WSUS

Posted on By Mark Wilson

Last year I blogged that Microsoft were pushing updates to their Windows AntiSpyware Beta, to extend the expiry date past the end of July 2005. Since then, there have been a number of updates (including renaming the product to Windows Defender) and even though Windows Defender is included in recent Windows Vista builds, my XP clients have still been running Windows AntiSpyware Beta v1.0.701 (which expires at the end of July 2006).

That started to change tonight, when one of my XP machines updated itself to Windows Defender Beta 2, and although the product is now at v1.1.1347 (engine v1.1.1303.0), the definitions went backwards from update 5841 (5 May 2006) to a new definition numbering scheme (v1.0.0.0), dated 25 January 2006. Strangely, checking for updates reported that there were no updates available for download.

Microsoft knowledge base article 915105 describes an issue with Defender does not download updates but the resolution didn’t work for me; however, I did discover that Windows server update services (WSUS) now supports Windows Defender (Microsoft knowledge base article 915597 has more details of the update delivery mechanism).

After enabling Windows Defender updates in WSUS and synchronising, I found that there were three definition updates waiting for me to approve – v1.14.1408.8 (25 April 2006), v1.14.1410.10 (27 April 2006) and v1.14.1436.4 (3 May 2006). A few minutes later, checking for updates resulted in a successful download from WSUS.

Windows Defender seems to be in an extraordinarily long beta program (considering the original Giant Company product that Microsoft bought was so well regarded), but it seems pretty solid to me. Let’s hope that the US DOJ and the EU don’t force Microsoft to unbundle important security features like this from Windows.

Refreshing the CD-ROM drive in Virtual Server

Posted on By Mark Wilson

I’ve been installing Exchange in a virtual machine this evening and ran into an interesting issue with Virtual Server and CD/DVD access. The virtual machine in question had a virtual CD/DVD drive was attached to the host computer’s CD-ROM drive but each time I switched CDs, the guest seemed unaware of the change.

I found a workaround on the microsoft.public.virtualserver newsgroup. It’s clumsy, but by releasing the guest’s virtual CD/DVD drive (connect to no media) and reconnecting to the host’s physical CD/DVD drive I was able to force the virtual machine to recognise the new disk (Virtual PC users can release and recapture the CD drive within Virtual PC).

Duplicating virtual machines using SysPrep

Posted on By Mark Wilson

One of the joys of virtualisation is the flexibility afforded by the ability to copy virtual machine files around the network for backup purposes or just to create a new machine (especially with Microsoft’s new Virtual Server licensing arrangements). Unfortunately, just as for “real” computers, simple file copies of Windows-based virtual machines can cause problems and are not supported (see Microsoft knowledge base article 162001).

All is not lost though, as Microsoft does support the duplication of virtual hard disks using the system preparation tool (SysPrep) and Megan Davis has written about sysprepping virtual machines on her blog. I tested it today and it works really well – basically a 3 step process of:

  1. Install and configure a source virtual machine as required (i.e. operating system installed, virtual machine additions installed, service packs and other updates applied), making sure it is in a workgroup (i.e. not a domain member).
  2. Locate the appropriate version of the Windows deployment tools (I used the ones from the \support\tools\deploy.cab file on a Windows Server 2003 CD) and create an answer file (C:\sysprep\sysprep.inf). Then copy the sysprep.exe and setupcl.exe deployment tools to C:\sysprep.
  3. Run SysPrep to reseal and shut down the guest operating system, then copy the virtualmachinename.vhd file to a secure location (make it read-only to prevent accidental overwrites, but also apply appropriate NTFS permissions). This file can then be duplicated at will to quickly create new virtual machines with a fully-configured operating system.

For anyone who is unfamiliar with SysPrep, check out Killan’s guide to SysPrep (which, despite claiming not to be written for corporate administrators or OEM system builders, seems like a pretty good reference to me).

Toshiba PX1223E-1G32 320GB External Hard DiskIncidentally, there are major performance gains to be had by moving virtual machines onto another disk (spindle – not just partition). Unfortunately my repurposed laptop hard disks were too slow (especially on a USB 1.1 connection), so I had to go out this afternoon and buy a USB 2.0 PCI adapter along with a decent external hard disk (a Toshiba 320GB 7200 RPM external USB 2.0 hard drive with 8MB data buffer) – that speeded things up nicely.

Problem adding a virtual machine to Virtual Server 2005 R2

Posted on By Mark Wilson

I’ve just been struggling to add a virtual machine back into the Virtual Server administration website (after I changed the search path). Each time I tried, Virtual Server highlighted the .VMC file as a known configuration file but then reported that:

The virtual machine configuration could not be added. A configuration with this name already exists.

Luckily enough, I found Mohammed Adenwala’s problem adding a virtual machine in Virtual Server 2005 blog post which described my problem exactly. After deleting C:\Documents and Settings\All Users\Application Data\Microsoft\Virtual Server\Virtual Machines\virtualmachinename.lnk I was able to add the virtual machine to the administration website and run it.

Today is National Work from Home Day

Posted on By Mark Wilson

Recently, with the introduction of new flexible working legislation, there has been more and more attention paid to the subject of home-based working and on the way home this evening I heard that today has been designated National Work from Home Day by Work Wise UK.

As someone who frequently works from home, I don’t need to be convinced of the benefits for me personally (less time commuting; less money spent commuting; less money spent on snacks at work; potential reduction in waistline measurements by not buying up large sections of the Marks and Spencer food hall each lunch time; and actually getting to see my family for a short time each day) but there are also benefits for employers (I’m more productive when I work from home; they don’t need to provide as much office space – just some “hot desks” for the days I am in the office; and my travel expenses are reduced) as well as for the nation as a whole (fewer commuters means less congestion).

Working from home is not for everybody though and some people may find it difficult (particularly if away from the office for long periods, or even on a full-time basis). When my wife left a busy public relations consultancy, to set up her own business working from home, she missed the office “buzz” at first (although now she finds the flexibility to be a major advantage). Personally, I find a quiet environment more conducive to work. What can be difficult though is remaining highly motivated and disciplined to keep up the work momentum when you are on your own all day. Some days I find that I can’t get going – more often I find myself putting in extended hours because I’m “on a roll”. Indeed, whilst the break from distractions is initially welcomed, without the movement of others around it is all too easy for the hours to slip by and it can become hard to separate work and private lives. This can be hard enough in a demanding job, but can be even more difficult when home is also the work place so its still important to plan breaks away from work.

One way to compensate for a lack of human contact whilst spending all day working at home can be making a conscious effort to get out after work (using all that commuting time that has been regained, perhaps taking up a hobby or sport).

It’s also possible to keep in touch with colleagues or clients by phone and email on a regular daily basis but this contact cannot replace face to face contact – a lot of information gets passed on informally when people bump into each other in the office and so it’s important to make an effort to keep in contact with the right people.

Of course, some jobs just cannot be done from home, but as the UK moves from a manufacturing-led economy to a service-led economy there are more and more opportunities for home-working – especially with the expansion of in broadband Internet connectivity and consequential growth in associated technologies like voice over IP.

Unfortunately (for those who have dinosaur managers who insist in staff being present at their desk for a fixed number of hours and at certain times each day) and fortunately (for those who could finish work at the end of the day without spending hours in traffic), we had a mini-heat wave in the UK today and I’m sure not everyone would have heeded the message from Work Wise UK that:

“National Work from Home Day is not intended as a holiday, or an extension of the weekend. Its aim is to let staff, and employers, see just how it could work – how productive we all can be.”

Problems accessing the Virtual Server administration website on a Windows Server 2003 domain controller

Posted on By Mark Wilson

Although I have several computers at home, most of my server roles are running on a single PC. That means Active Directory (AD) domain controller (DC), DNS, DHCP, RIS, WSUS, and print services are all on one box (file services are on my NSLU2) so I figured that adding Virtual Server 2005 R2 to the mix shouldn’t be too big a problem. It’s certainly not good practice, but it works.

Another bad practice is to run internet information services (IIS) on a DC, but I already have IIS installed for WSUS, so adding the Virtual Server administration website should have been reasonably straightforward. Following installation, existing websites on the server were working as expected but any attempt to access the Virtual Server 2005 administration website resulted in an HTTP Error 403 – Forbidden: Access is denied. message, despite entering the domain administrator credentials when prompted (and already being logged on as the domain administrator).

From checking the event log, I found that Virtual Server was logging the following event on startup:

Event Type: Warning
Event Source: Virtual Server
Event Category: Virtual Server
Event ID: 1130
Date: 01/05/2006
Time: 15:28:23
User: NT AUTHORITY\NETWORK SERVICE
Computer: SERVER1
Description:
The service principal names for Virtual Server could not be registered. Constrained delegation cannot be used until the SPNs have been registered manually. Error 0x80072098 – Insufficient access rights to perform the operation.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

I tried the steps in Microsoft knowledge base article 890893 but adding the appropriate SPNs to AD didn’t seem to make any difference.

A bit of Googling turned up a blog entry from David Wang which although not completely relevant, contained a reference to a similar problem in the comments. Sure enough, when I checked the IIS logs, the error code was 403 19, as shown below:

#Fields: date time s-sitename s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status
2006-05-01 21:29:39 W3SVC2 ipaddress GET /VirtualServer/VSWebApp.exe view=1 1024 domainname\Administrator ipaddress Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+SV1;+.NET+CLR+1.1.4322) 403 19 1314

I tried David’s advice of switching the IIS DefaultAppPool identity to LocalSystem and that worked (LocalSystem is a very highly-privileged account), but (despite my lackadaisical approach to co-hosting services and the probably security implications) I didn’t really feel that it was an ideal solution and I switched back to Network Service. I then set about trying to work out why the Network Service account (NT AUTHORITY\NETWORK SERVICE) didn’t have the appropriate permissions. Microsoft knowledge base article 332097 looked as if it might be relevant (Microsoft knowledge base article 842493 is similar) but didn’t seem to solve the problem (in any case the IIS_WPG group already had the correct permissions) so I fired up the Local Security Settings MMC snap-in and checked out the user rights assignment in the local security policy.

Because my IIS server is also a DC, many of the user rights normally associated with the Network Service account had been removed (and were overridden by the Default Domain Controllers Policy). NT AUTHORITY\NETWORK SERVICE was also missing from the IIS worker process group (IIS_WPG) membership (and could not be added as it is a local account) so I edited the local security policy and the Default Domain Controllers Policy (another bad practice – I should really have created a new policy for DCs running IIS) as follows:

  • Replace a process-level token (Default Domain Controllers Policy).
  • Adjust memory quotas for a process (Default Domain Controllers Policy).
  • Generate security audits (Default Domain Controllers Policy).
  • Log on as a batch job (Default Domain Controllers Policy).
  • Impersonate a client after authentication (local security policy).

The following user rights were already in existence:

  • Bypass traverse checking (inherited from Everyone).
  • Access this computer from the network (inherited from Everyone).
  • Log on as a service (Default Domain Controllers Policy).

After forcing a group policy refresh (using gpupdate /force) and issuing the iisreset command, I was able to access the Virtual Server administration website as expected; although the event 1130 warnings are still being recorded in the event log, along with event 1129 since I enabled the virtual machine remote control (VMRC) server:

Event Type: Warning
Event Source: Virtual Server
Event Category: Remote Control
Event ID: 1029
Date: 04/05/2006
Time: 21:19:18
User: NT AUTHORITY\NETWORK SERVICE
Computer: SERVER1
Description:
The service principal name for the VMRC server could not be registered. Automatic authentication will always use NTLM authentication. Error 0x80072098 – Insufficient access rights to perform the operation.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

I stress that running multiple services on a single PC (even with proper server hardware) is not a good idea; nor is running IIS on a DC; and neither is editing either the Default Domain Policy or the Default Domain Controllers Policy. If you need to do it though, hopefully these notes will help to work out why processes that rely on the Network Service account are not working as they should.

Does Windows Vista have more than just a pretty face?

Posted on By Mark Wilson

I’ve written a bit about Windows Vista on this blog previously but generally left the product reviews to people like Paul Thurrott (who has both the time to do a review justice and the readership to make it worthwhile). Yesterday, I saw yet another Windows Vista presentation and (with my corporate mindset) I’m still struggling to see why I should move from Windows XP. Maybe that’s because so much is being made of the new Aero interface and there’s not been much emphasis placed on some of the other functionality. At a first glance Windows Vista has lots of new features; but many of them fall into one of the following categories:

  1. Require modern graphics hardware and won’t make any real difference in a corporate setting.
  2. Implement a totally new interface (or at least new ways of working) and so will require additional end-user training (which most companies won’t invest in, so people will continue to use Windows as they have done since we first saw Explorer in Windows 95).

At least, that’s what I thought until I saw James O’Neill‘s presentation at the Microsoft Technical Roadshow. It turns out that there’s a lot of hidden functionality available in Vista (that doesn’t require new hardware) and the list below is probably just scraping the surface:

  • The startup/shutdown sequence is improved to allow for a more reliable sleep function/resume from hibernation.
  • There’s also an improved paging algorithm (known as superfetching) whereby the operating system learns the memory pages that are used frequently and keeps them in memory (avoiding the delay that occurs in Windows XP when returning from a meeting to find that Outlook takes a while to respond because an operating system process has swapped all of its memory out to disk).
  • Then there’s the ability to use a USB key as extra cache (faster than disk, slower than RAM, no problem if it’s removed suddenly because it’s just a cache, although there would be a slight performance hit for a cache rebuild).
  • The operating system is intended to be self tuning, with an API that allows PC components to be scored (opening up the possibility of warning users that they can run an application but it might run slowly due to the system having a poorly-specified processor or a lack of RAM).
  • The restart manager functionality allows a file to be unlocked (e.g. to apply a patch) without needing to restart the PC.
  • There are improved diagnostics (e.g. to report that a hard disk has bad sectors – often a sign that the disk is about to fail).
  • Security is a major area of improvement:
    • User account control/protection allows for least privileged user access, warning users where elevated privileges are requested. Unfortunately I have a feeling that most users will just ignore the warning (click the “yeah… whatever…” button) in the same way that firewall warnings are often not much help today.
    • There are anti-malware features provided through the integration of Windows Defender (it amazes me that so many of my clients are paranoid about virus protection yet don’t do anything about spyware).
    • Internet Explorer 7.0 is sandboxed (so malicious code is limited in its scope to do damage).
    • The Windows firewall is improved to allow for filtering of outbound traffic as well as inbound.
    • Client support for network access protection (NAP), allowing for quarantining of PCs when returning to the network.
    • Improved data protection (e.g. control over USB device connectivity).
    • BitLocker technology to encrypt the whole hard disk.
  • From a deployment perspective, everything that we know about unattended installation (which hasn’t changed much since Windows NT) changes with new file-based imaging tools that allow for compressed images with single instance storage of multiple build versions and non-destructive rebuilds.
  • Language support is handled via resource files (instead of multiple versions of the same DLL), allowing for creation of a singe worldwide operating system image.
  • The new Windows imaging (.WIM) format allows images to be mounted as a file system, then browsed and edited.
  • A new feature called Windows resource protection is provided to protect system settings. Meanwhile, the number of configuration items that can be controlled via group policy has increased from approximately 1800 to around 3000 (mostly control over printing, USB devices, and power management.
  • For legacy application support, the program files folder structure and the registry are virtualised. This means that programs that need (or assume) administrator permissions can still run as they have a virtual registry to write to.
  • The command prompt is also unprivileged by default, with the same user access control functionality as the GUI.
  • The “breadcrumb trail” that replaces an absolute path in Explorer windows allows me to jump straight to a particular folder in the path.
  • The ability to tag documents (including photos) and “stack” them based on the file metadata (e.g. view all documents by a particular author – although for many organisations the author will typically be something like “Any authorised user” or the company name because in my experience other people rarely set the document properties).
  • Within control panel, a shield next to an applet indicates that user access control applies.
  • The mobility center allows for quick application of different settings (e.g. turn of screensaver when presenting). There’s also easier file sharing with users on the same network and a new synchronisation engine for synchronising with mobile devices, or keeping files in sync with another PC (like backing up my work PC to a home file store).
  • Tabbed browsing in IE7 (something which, as a Firefox user, I now find very difficult to do without in IE6), RSS support and preview pages.

Even though I’m unimpressed generally with Aero, there are some UI features that I may find useful:

Microsoft is caught between a rock and a hard place. They get criticised for a lack of original new features; but we accuse Windows of being bloated. They get criticised for a lack of security; on the other hand when they add new features (improved client firewall, anti-spyware, etc.) they are accused of being anti-competitive. Windows Vista has been a long time coming and whilst many of the features originally planned have since been removed it does include some great new technology.

Will Vista be worth the wait? Probably. Will corporates be keen to adopt the new operating system? That remains to be seen but I suspect there won’t be a big rush if the marketing message continues with the “clear, confident, connected, ooh – doesn’t it look pretty” message.

Looking forward to the 2007 Microsoft Office System

Posted on By Mark Wilson

Microsoft Office

I think I’ve been attending too many Microsoft events recently. Not only do the presenters know me personally, but I’m not hearing much that’s new. To be fair to Microsoft, that’s because two of the biggest product launches this year will be Windows Vista (for which I’m a beta tester) and Exchange Server 2007 (for which I was extremely fortunate to spend two days learning about in depth last month). There are many other products planned for launch in 2007 but those two are the ones that will mean most to me. I spent yesterday at the Microsoft Technical Roadshow – an event that I’ve enjoyed in previous years (although the multiple-track format has been dropped this year due to budget restrictions) – and even though much I’d seen much of the content at previous events, I was particularly impressed with Paul Brombley’s session on the 2007 Microsoft Office System (Office 2007 – formerly codenamed Office 12).

I’ve not done anything with the new version of Office (and can’t think of much that I do with Office 2003 that I didn’t already do with XP, 2000, 97 or even 95 – except that 95 didn’t have Outlook and that I could do more with 2003 if my employer made better use of SharePoint products and technologies) but I had heard of the new ribbon user interface.

Now maybe my comments about a lack of new features in recent Office versions were slightly disingenuous – the new features are there but it probably means that I still work in the same way I did in 1995. Whatever my thoughts are on Office 2003, what I saw and heard yesterday has inspired me to install the latest Office 2007 beta, if only to look more closely at the following features (which are just the ones that grabbed my attention – there are many more too):

In Outlook:

  • A new To-Do bar, which brings much of the old Outlook Today functionality into a sidebar, including upcoming appointments, tasks, and flagged items.
  • RSS integration.
  • Enhanced calendaring functionality (e.g. the ability to overlay multiple calendars – not many of my colleagues maintain their Exchange calendars, but I do keep separate work and personal diaries).
  • Tasks linked integrated with the calendar and assigned a time of day (including those from Project Server).
  • Improved search including query hit highlighting.

In PowerPoint:

  • Server-based slide libraries that can be tagged for use by others and alerts issued if updated versions of the slides are available.

In Word:

  • A mini-bar (I do hope Microsoft changes that name), close to highlighted text, that provides shortcuts to common actions (e.g. increase font size).

In Excel:

  • A zoom slider on the bottom right of the main working area.
  • The ability to publish parts of a report and therefore protect the calculations.
  • Fast table formatting with automatically selected data, alternate shaded lines, frozen frames on the column names and auto-filters.
  • Simple pivot table creation with enhanced conditional formatting and data bars on values.

The new ribbon interface (or, as Microsoft like to refer to it, the “results-oriented user interface”), which provides:

  • Context-sensitive links to commands, expanding and contracting the visible functionality in accordance with window size.
  • A preview of the effects of a command before it is issued (saving many undo commands), e.g. when applying a new style.
  • The ability to insert a new section (e.g. a cover page) from a gallery as a single command.
  • A new graphics engine, which makes it easy to add and edit attractive graphics with impact (not clip-art).

Other changes include:

  • FrontPage is now called SharePoint Designer (possibly reflecting the fact that it’s useless for designing standards-compliant web pages for use on any other platform).
  • Support for Windows Workflow Foundation services to provide document approval workflow.
  • Integration with InfoPath forms to capture metadata as part of the document authoring process as well as InfoPath in a browser (and not just Internet Explorer) and within Outlook (e.g. as a custom form).
  • Windows SharePoint Services (WSS) integration:
    • The ability to create basic Gantt charts in WSS using a webpart and link back to Project Server.
    • Document repositories with records management.
    • The ability to publish Excel data in WSS and view it in a web browser, natively within Excel, or programmatically within a custom application.
    • Dashboards, personal report centres and enterprise-wide searches for business intelligence.
  • Integrated communications (i.e. Office Communicator).

Apart from the new interface, probably the most significant change is the new OpenXML document format. Despite being proposed as a royalty-free, open standard, OpenXML has been criticised by supporters of the competing open-source open document format (ODF). Compact and robust, the format is actually zipped XML, so can be easily integrated with many business applications. Microsoft will continue to support the binary formats but OpenXML is the way forwards, with migration tools for the new formats as well as free add-ins for Office 2000, 2002 (XP) and 2003 to allow legacy Office versions to use OpenXML files.Microsoft is currently predicting an October 2006 release date for Office 2007. That means that although volume licensing customers will be able to get hold of it sooner, general availability will be in early 2007. Initially available as a 32-bit product, there will be a 64-bit edition later (64-bit adoption on the desktop is still lagging behind servers). In the meantime, there’s a 2007 Microsoft Office system preview website with more information including a comparison between the various product suites.

More new product names under the System Center brand

Posted on By Mark Wilson

Two more Microsoft products in the management space got a new System Center branding last week. Whilst most of the System Center products have been new offerings, Microsoft announced that Microsoft Operations Manager v3 will be called System Center Operations Manager 2007 and Microsoft Systems Management Server v4 will become System Center Configuration Manager 2007 (these days, the acronym SMS is more often thought of in relation to the short message service in mobile telecommunications).

Introducing Exchange Server 2007

Posted on By Mark Wilson

Another new product name… bland as ever, but definitely preferable to something like Windows PowerShell is Exchange Server 2007. Actually, that one was pretty obvious back at the Exchange Server “12” Ignite training last month but as most of the information I was given there was protected by a non-disclosure agreement (NDA) I couldn’t say anything. At yesterday’s Microsoft Technical Forum event, the new product name was being used extensively (and Eileen Brown told me that my 4-week old E12 t-shirt was out of date… that’s Microsoft product names for you).

On a related note, I read on the Exchange team blog that Exchange Server is now ten years old. It seems like only yesterday I was one of the Microsoft partner representatives on the Exchange 4.0 Server UK launch tour (my first experience of working directly with Microsoft). Happy birthday Exchange Server.