The Windows Server Essentials and Small Business Server Blog

How to Manually Create the Windows Small Business Server 2011 Standard and WSUS Group Policies Objects

2013-04-24T15:47:00Z

[This post comes to us courtesy of Charanjeet Singh and Rituraj Choudhary from Microsoft Commercial Technical Support]

Certain Group Policy Objects (GPOs) are created and configured by default during the installation of Windows Small Business Server 2011 Standard. This blog post will cover how to create these GPOs manually in the event that they are missing or have been accidentally deleted without a backup.

Note: If one or more of these GPOs are missing as the result of a failed install, you should not follow this procedure. We recommend that you call Microsoft Product Support as other components are likely to be broken.

The steps have been broken down into two types of Group Policies.

Update Services Policies:

Update Services Client Computers Policy
Update Services Common Settings Policy
Update Services Server Computers Policy

Windows SBS Policies:

Windows SBS Client – Windows 7 and Windows Vista Policy
Windows SBS Client - Windows 8 Policy
Windows SBS Client – Windows XP Policy
Windows SBS Client Policy
Windows SBS CSE Policy
Windows SBS Users Policy
Small Business Server Folder Redirection Policy (Optional)
SharePoint Psconfig Notification Policy

We do not cover the steps to create the Default Domain Controllers Policy or the Default Domain Policy in this post. Either restore these policies from backup or contact Microsoft Product Support Services for assistance.

Create the three Update Services Policies

Open Start > Run and enter gpmc.msc to open the Group Policy Management Console.
Expand Forest: <SBS Forest>\Domains\<SBS Domain>\Group Policy Objects.
Right-click the Group Policy Objects key and choose New.
Enter Update Services Client Computers Policy as the name.
Select OK.

*** The name must be entered exactly as shown, DOUBLE CHECK the spelling before selecting OK.
Create the two remaining WSUS policies in the same way.

Update Services Common Settings Policy
Update Services Server Computers Policy

Configure the Update Services Client Computers Policy

Right-click Update Services Client Computers Policy and choose Edit. On the Group Policy Management Editor, open Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update
Configure the settings as shown in the report below

Configure the Update Services Common Settings Policy

Right-click Update Services Common Settings Policy and choose Edit. On the Group Policy Management Editor, open Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update
Configure the settings as shown in the report below

Important: The Set the intranet update service for detecting updates and Set the intranet statistics server policies are specific to your server and must be configured with http://<YourServerName>:8530

Note: The above report for this GPO shows the “enabled” and “disabled” policy settings only. Any policy that does not appear in the above report should be set to “Not configured” on your server.

Configure the Update Services Server Computers Policy

Right-click Update Services Server Computers Policy and choose Edit. On the Group Policy Management Editor, open Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update
Configure the settings as shown in the report below

Configure the scope of the new Update Services Policies

Update Services Client Computers Policy

Leave “Links” empty
Remove any object under “Security Filtering”
Set “WMI Filtering” to <none>

Update Services Server Computers Policy

Leave “Links” empty
Remove any object under “Security Filtering”
Set “WMI Filtering” to <none>

Update Services Common Settings Policy

Leave “Links” empty
“Authenticated Users” must be listed under “Security Filtering”
Set “WMI Filtering” to <none>

Link the new Update Services Policies

In the Group Policy Management Console, right-click on your SBS domain and select Link an Existing GPO
Select the following 3 policies
Click OK

Once the WSUS policies have been updated and applied, Security Filtering on the Client Computers and Server Computers GPOs will begin populating with the machine accounts of your domain joined clients and servers. This is done automatically by SBS every 5 minutes.

Create the Windows SBS Policies

Create the Small Business Server Folder Redirection Policy (Optional):

This is an optional GPO. Follow these steps only if you wish to use folder redirection.

On the SBS 2011 Console, select the Shared Folders and Web Sites tab
On the Right hand side, under “Tasks” select Redirect folders for user accounts to the server
Complete the wizard

Create the remaining SBS GPOs

These steps will create the following GPOs:

Windows SBS Client – Windows 7 and Windows Vista Policy
Windows SBS Client – Windows XP Policy
Windows SBS Client – Windows 8 Policy
Windows SBS Client Policy
Windows SBS CSE Policy
Windows SBS Users Policy

Copy the file GPOFix11.txt from the following link and save it to an easily accessible path, such as c:\windows\temp, on the SBS 2011 server:

http://cid-d5fe25afb6c3615f.skydrive.live.com/self.aspx/.Public/GPOFix11.txt
Right-click on the Command Prompt and select Run as Administrator.
Run the following command from the Administrator Command prompt, substitute the path to the gpofix.txt file as needed (We recommend that you DO NOT copy & paste the command directly from the blog post):

“C:\Program Files\Windows Small Business Server\Bin\GPOTask.exe” /config:c:\windows\temp\gpofix11.txt
The task will take a few moments to complete, after which it will return to the command prompt.
Verify that the GPOs have been created in the Group Policy Management Console.
Run and complete the Internet Address Management Wizard from the SBS 2011 Console to complete the configuration.

Running DHCP Server on Windows Server 2012 Essentials

2013-04-22T18:58:00Z

[This post comes to us courtesy of Rituraj Choudhary from Microsoft Commercial Technical Support]

Windows Server 2012 Essentials is enabled to run on a network with the DHCP Server service running on the router. This blog post describes the method to configure DHCP Role on the Windows Server 2012 Essentials, if you prefer so.

The first step in this process is to assign a Static IP to the server.

On a Command Prompt, type ipconfig, and make a note of the IPv4 address, Subnet Mask and Default Gateway.

Open the Network Card properties. Click Internet Protocol Version 4 (TCP/IPv4), and then click Properties.
To assign a Static IP, click to Use the following IP address, and enter the same details that were noted down earlier for the IP Address, Subnet mask and the Default Gateway.

At this point, stop and disable the DHCP Server service running at the existing computer or device. Please note that during the process of migration the network clients will not be able to obtain IP address; if you have business critical servers on the domain, assign them a Static IP.

Let’s now install the DHCP Server role on the Windows Server 2012 Essentials.

On the Start screen, type Server Manager, and open it from the results displayed.
On the Server Manager window, click Manage on the Title bar, and then click Add Roles and Features.

It will open the Add Roles and Features Wizard. On the Before you begin page, click Next.
On the Select installation type page, choose Role-based or feature-based installation, and then click Next.
On the Select destination server page, verify that the Windows Server 2012 Essentials is chosen, and then click Next.
On the Select Server Roles, click to select DHCP Server. After this option is selected, you may see a pop up to add additional features.

Click Add Features on this popup window. It will redirect back to the Select Server Roles page. Click Next.
On the Select features page, do not select anything and click Next.
On the Confirm installation selections, click Install. Do NOT select the option Restart the destination server automatically if required.
On the Installation progress page, or click Close.

Once the installation is complete, the same is notified under the Notification icon on the menu bar of the Server Manager window. If the installation went fine, you will get a successful message as:

To complete the DHCP deployment, click on Complete DHCP configuration on the Post-deployment Configuration under the Notification icon.

The DHCP Post-Install configuration wizard is quite straight forward.

On the Description page, click Next.
On the Authorization page, verify that Use the following user’s credentials is selected and the Administrator user name is put there.
On the Summary page, check the status of the post install configuration and then click Close.

Here is the final status that you should see on the Server Manager.

It is now time to configure the DHCP Server.

On the Start screen, type DHCP, and click to open DHCP console.
On the DHCP console, expand the Server name, and then right-click IPv4. Click New Scope…

It will open New Scope Wizard. Follow this wizard to name the Scope conventionally, e.g. Scope [192.168.1.0] fabrikam.local. Add the IP Address Range for the client computers, e.g. 192.168.1.3 to 192.168.1.50. Add the Default Gateway (IP of the router), DNS Server (IP of the Server itself), and activate the scope.

Your server is now ready to lease out new DHCP addresses to the network clients.

More Information:

There is a service named as Windows Server LAN Configuration that gets installed on a computer when it joins Windows Server 2012 Essentials. The purpose of this service is to detect the presence of the Windows Server 2012 Essentials, which by default, has a DHCP Server assigned IP.

To explain, let’s say you have a laptop which is joined to a Windows Server 2012 Essentials domain. When this laptop is taken to a different network, it gets a new IP assigned by the new network’s DHCP Server to connect to this network and the internet. When the laptop comes back into its home domain, it again gets a new IP from the DHCP Server (Router) on the Windows Server 2012 Essentials domain. The Windows Server LAN Configuration service now comes to play; it detects the presence of Windows Server 2012 Essentials on the domain, obtains the IP of the server, and overwrites the DHCP Server assigned DNS Server address for the client, which helps this laptop resolve Active Directory.

After rehoming the DHCP Server at the Windows Server 2012 Essentials, it would have a Static IP. This DHCP Server IPv4 Scope Options would also carry the DNS Server information (which is the Static IP of the Windows Server 2012 Essentials). At this point, the services of Windows Server LAN Configuration is not required, and may be turned off. Leaving it turned on does not harm either.

Windows Server Essentials Integration Module for Windows Azure Backup is Now Available

2013-04-19T17:24:00Z

[Today’s post comes to us courtesy of Yang Cao and Ashish Sukhija]

Hello everyone, we would like to update you on an Add-In software that is now available for Windows Server 2012 Essentials. We have updated the Windows Server Essentials integration module for Windows Azure Backup and is now available for download from the link below:

http://go.microsoft.com/fwlink/?LinkId=288906

More Information

A reboot might be needed if you don’t have the Visual C++ redistributable installed because it requires the server to reboot. After reboot, please launch the add-in installer again.

If you already have an old version of the Add-in software installed, then you need to:

Uninstall the old Add-in from the Dashboard;
Uninstall the Windows Azure Backup agent from the Control panel;
Reinstall the new Add-in

NOTE: During step #3, we’ll automatically reinstall the new Windows Azure Backup agent.

Known Issue

If you update the Windows Azure Backup agent before uninstalling the previous Windows Server Essentials Integration module for Windows Azure Backup, the Dashboard will crash. This is because of the compatibility issue between the old add-in and the new Windows Azure Backup agent. To fix this issue, follow the steps below:

Open the Dashboard in safe mode.
Disable the online backup add-in.
Go to Dashboard to uninstall the add-in.
Reinstall the new add-in.

Visit the Windows Azure Backup Forum
http://social.msdn.microsoft.com/Forums/en-US/windowsazureonlinebackup/threads

Enterprise Hotfix Rollup for Windows 7 SP1 and Windows Server 2008 R2 SP1 Available Now

2013-03-20T20:15:57Z

An enterprise hotfix rollup for Windows 7 SP1 and Windows Server 2008 R2 SP1 has been released which contains 90 hotfixes released after the release of Service Pack 1. These hotfixes improve the overall performance and system reliability of Windows 7 SP1-based and Windows Server 2008 R2 SP1-based computers. We recommend customers to apply this hotfix rollup as part of their regular maintenance routine and build processes for Windows 7 and Windows Server 2008 R2 computers.

This hotfix rollup includes the following improvements:

Improves the Windows Client Remote File System components.
Improves the SMB Service and TCP protocol components.
Improves the processing of Group Policies and Group Policy preferences.
Improves the Windows Management Instrumentation (WMI) components to reduce the CPU usage and to improve the repository verification performance.

To view the list of hotfixes included in this hotfix rollup, please visit http://support.microsoft.com/kb/2775511/EN-US.

How to get the Hotfix Rollup

This update is available from the Microsoft Update Catalog. Type 2775511 in the search field that is located in the upper-right corner of the catalog webpage.

Update Rollup 1 for Windows Server 2012 Essentials Available Now

2013-02-28T23:53:22Z

Windows Server 2012 Essentials Update Rollup 1 has been released today and is available for download from Microsoft Update. You can read about the issues this rollup update addresses in Microsoft Support Knowledgebase 2781267.

In addition to the server-side update, a client-side update has been released as well. This update is documented in KB 2781268. The client-side package will be downloaded to the server along with the Update rollup. User does not have to go to the Windows Update website to obtain the package separately for the client machine.

More Information

If you have Office 365 Integration feature enabled before installing Update Rollup 1 for Windows Server 2012 Essentials (KB2781267), after you apply UR1 and reboot the server, you may get below Health Alert when opening the dashboard:

One or more service are not running

The following important Windows services are not running. Windows Server Office 365 Integration Service (O365ProviderSvc) Note: Services can be stopped when software update are applied.

Run the following commands in an elevated PowerShell window and restart Windows Server 2012 Essentials Dashboard.

Set-Service -Name PwdSyncProviderSvc -StartupType Automatic
Set-Service -Name PwdSyncProviderSvc -Status Running
Set-Service -Name O365ProviderSvc -Status Running

For more information, visit this wiki.

My Server Windows App for Windows Server 2012 Essentials

2013-01-29T21:15:08Z

Hi, my name is Clinton Ho, lead program manager on the Windows Server Essentials team. I’m proud to announce the availability of the My Server Windows app, available as a free download in the Windows Store.

Similar to the My Server Windows Phone app, My Server Windows app is designed to help keep you seamlessly connected to your server resources on devices running Windows 8 and Windows RT. With My Server, you can manage users, devices, and alerts, and access shared files on Windows Server 2012 Essentials. In addition, the files that you have recently accessed with My Server will continue to be available to you even when you are offline.

Sound cool? Then head on over to the Windows Store, search for My Server, and install the app! Don’t forget to let us know what you think by rating it or writing a review.

Here are some more things you can do with the My Server app:

Browse, edit and search for files stored on your server
Copy files from your local computer to the server, or save files from the server to your computer
Access files from your server that were opened recently—even without an Internet connection; the changes made offline will automatically be synchronized to the server when you are back online
Transparently search for documents located on both your local device and your server’s shared folders
Play back media files stored on the server
If you are an administrator, you can also:

Manage users, devices, and alerts
Reset user passwords

Windows Server Solutions BPA Updated January 2013

2013-01-23T22:56:55Z

Update Rollup 4 for Windows Server Solutions BPA (KB2796170) is now available via Microsoft Update.

New Rules Added

DefWebSiteExtended - This rule checks whether the default website is extended correctly.
RemoteVDirAuthentication - This rule checks whether Anonymous Authentication is disabled.
SelfUpdateVDirSSL - This rule checks whether the SSL protocol is enabled or Anonymous Authentication is disabled in the SelfUpdate virtual directory.

How to get BPA Update Rollup

SBS 2011 Standard:

By default, Microsoft Update points to the WSUS service in SBS 2011 standard. This update will show up in Admin Console’s Update tab to allow you to apply this update. Then this update will be shown available in Microsoft Update to be installed.
You can also get this update by including Microsoft Update.

In SBS 2011 Standard, launch Windows Update and select the option to Check online for updates from Windows Update. Then click the option for "Get updates for other Microsoft products" and complete the process to opt-in for Microsoft Updates.

SBS 2011 Essentials, Windows Storage Server 2008 R2 Essentials and Windows Multipoint Server 2011:

Please go to Windows Update and find out more about free software from Microsoft Update, and click “Click here for details”. And follow the steps to get patches from Microsoft Update. If you already include the Microsoft Update, you can ignore this step.
Go to Windows update and click “Check for updates” to get the updates.

To find out more about the issues it fixes, please visit http://support.microsoft.com/kb/2796170

Web Services and Extensibility for Windows Server 2012 Essentials

2013-01-08T20:39:05Z

Hi, I’m Mike Chen, program manager for the Windows Server Essentials team, and today I would like to share with you the extensibility story for Windows Server 2012 Essentials.

I’ll start with an overview of the extensibility points across Dashboard, Launchpad, Remote Web Access, and Health Monitoring. As you know, Windows Server 2012 Essentials is a hybrid solution that connects your on-premises environment to the cloud service. We will use cloud service integration scenarios when we talk about the extensibility points; these extensibility points can also be used by non-service-integration add-ins.

Let’s take a look at the Windows Azure Online Backup add-in (for more information, see the blog post Windows Azure Online Backup and Windows Server 2012 Essentials).

In the preceding screenshot, add-ins can be used in the Dashboard in four places:

Top-level tab. Usually, as a standalone feature, most add-ins will have a separate tab. We recommend that you use all capital letters for the names of your tabs to be consistent with other built-in tabs. A top-level tab will own its standalone content space in the content area.
Sub-tabs. To logically separate your features, you can have multiple sub-tabs under your top-level tab. If you own a separate top-level tab, you will naturally group sub-tabs together. If your add-in doesn’t create a top-level tab (for example, your add-in provides additional manageability for storage), you can add a sub-tab to the tab in question instead.
Main panel. Different add-ins typically have different requests. While you can build your main panel from a blank panel, you can also leverage the list view in the SDK if you’re managing a list of objects, such as users or folders.
Task panel. When you manage a list of items or a service, you usually need per item tasks and global tasks. When you leverage the list view, the Dashboard allows you to register per item tasks where you can perform tasks on a single item, such as removing a folder. It also allows you to perform global tasks, which apply to the entire add-in functions, such as registering your service.

In addition to these four options, the Dashboard also allows you to extend the built-in list view, wizards, and property pages by adding your own logic to the existing experience. An existing implementation of this is the built-in email solutions (including Office 365 and on-premises Exchange) that extend the list view, add a user wizard and user property pages that leverage the framework. We’re going to discuss this in depth in the upcoming blog for Hosted Email Add-in Framework.

Client-side integration is also interesting when you write an add-in to integrate with online services.

Launchpad. Most of the service integration, such as Office 365 Integration, provides value to end users where they need to have shortcuts to the new functionality they get from add-ins. In this case, you can extend the Launchpad by adding an additional shortcut.
Remote Web Access. Remote Web Access allows you to provide links on the Homepage, as well as provide your own page.
Health Integration. If the online service has dependencies on the client, such as agents running on the client or settings on the client, you can implement health monitoring rules on the client so that the monitoring results can be rolled up to the admin view. (Note that health integration is able to monitor the server as well.)

Web service platform

Anywhere Access is important for home and business environments today. To keep users more productive, they need to access files and folders anytime from their devices. In order to support this, Windows Server 2012 Essentials exposes a set of built-in web services for third-party developers to build applications on different devices that can access files and manage the server remotely. The built-in web services include file access, file operations, media access, and management tasks (including alerts, users, storage, devices). For a complete list of web services, see our MSDN page.

The following sample code demonstrates how to call the web services to access a folder from Windows 8 by using HTML and JavaScript. In HTML, we create a list view on your page to display the data. You will need to define the template of the item that defines how it’s going to be displayed.

In JavaScript, we use an HTTP request with your credential to get the information about items in the Company folder.

var url = "https://[serverName]/services/builtin/fileoperationservice.svc/items/index/0/count/10?path=\\\\[machineName]\\Company&filter=All&sortByField=Name&ascending=True";

WinJS.xhr({

url: encodeURI(url),

user: "[userName]",

password: "[password]",

headers: {

"AppName": "[appName]",

"Accept": "application/json"

}

}).done(function (response) {

var obtainedData = window.JSON.parse(response.responseText);

var fileList = new WinJS.Binding.List(obtainedData.Items);

WinJS.UI.setOptions(fileListView.winControl, { itemDataSource: fileList.dataSource });

WinJS.UI.processAll();

});

To learn more about the Windows Sever 2012 Essentials SDK, you can visit our MSDN site and download the SDK. We’re looking forward to your feedback in our forum.

Expanded Software Assurance (SA) grant for Windows SBS 2011 Standard

2012-12-20T18:56:37Z

[Today's post comes to us courtesy David Fabritius from Windows Server Marketing]

As part of the Windows Server 2012 announcements earlier this year, we shared the Software Assurance (SA) grant information for Windows Small Business Server 2011 Standard. Since that time, we have worked with many of our customers and partners to help plan the transition of existing SBS environments to the latest available server software. As part of this effort, we received feedback that the original SA grant was too limiting to provide the best deployment experience.

To address these concerns, Microsoft has expanded the grant to include two copies of Windows Server 2012 Standard and one copy of Exchange Server 2010 Standard. Also note that customers with active Software Assurance coverage on Exchange Server 2010 Standard are eligible to upgrade to and use Exchange Server 2013 Standard when it releases.

By granting two copies of Windows Server 2012 Standard, customers can choose to deploy their workloads onto two physical servers, or they can choose to take advantage of Hyper-V to run up to four virtual machine instances—which can be run on either a single physical host server, or split across two physical host servers. In addition, the downgrade rights for Windows Server 2012 have been expanded to include Windows Server 2012 Essentials. This provides customers access to the Essentials value‑added feature set, including Remote Web Access, Office 365 integration, the Dashboard, and client computer backup.

The expanded benefits will be available starting January 2013, and will be retroactively effective as of August 15, 2012. Software and product keys will be available through the Volume Licensing Service Center (VLSC) customer portal.

As always, we appreciate the continuous dialog with our customers and partners, and we very much value the passion and broad range of perspectives and experiences that help us offer the best solutions available in today’s market.

Also, many people often think of Software Assurance (SA) as being synonymous with just one of its many components: staying current with new product versions. But staying current is actually just one in a broad range of benefits, including:

Evaluating new software through TechNet
Getting help with 24x7 phone and web support
Reducing up-front costs through spread payments
Reducing costs, streamlining management with MDOP
Speeding disaster recovery with cold backups
Preparing employees with online training
Building technical skills with classroom training

As always, I’d like to encourage you to download the Windows Server 2012 Essentials evaluation and give us feedback via the Windows Server 2012 Essentials forum. We’d love to hear from you!

Managing File History in Windows Server 2012 Essentials

2012-12-17T17:04:00Z

[Today’s post comes to us courtesy of Yang Cao from Sustained Engineering]

One of the key values Windows Server 2012 Essentials offers is network-based computer backup. With client computer backup (a centralized, image-based backup), in the event of data loss, you can restore individual files or folders. If necessary, you can even restore the entire system from a successful backup on the server. If you have computers running Windows 8, the backup and restore experience becomes even easier and more natural thanks to the new File History feature in Windows 8.

Configuring File History in Windows 8

As a Windows 8 user myself, I turned on File History manually in the Control Panel. I selected a network share as the target drive, and from Advanced settings, I chose to save copies of files every hour and keep saved versions forever. After File History is configured, my files in Libraries, Desktop, Contacts, and Favorites are backed up every hour to an external drive. This works great for me because the backup happens transparently. And I feel safe that the data is protected. All I need to do afterward is to make sure that all the important files are either on the Desktop or in the Libraries.

Implementing File History for small businesses

For a small business owner who manages several devices on the network, it’s important that all the devices can be configured and managed centrally rather than locally.

With Windows Server 2012 Essentials, this becomes simple and worry-free. For all the Windows 8 clients connected to Windows Server 2012 Essentials, File History is automatically turned on, and by default, the data on the Desktop and in the Documents folder is backed up on an hourly basis, with the backup being stored on the server for a year. You can configure this setting in the Client computer backup settings and tools dialog box, launched from the Dashboard, Devices tab. For example, if you need more thorough protection of the user’s profile data, you can select All Libraries, Desktop, Contacts and Favorites in the Backup data field.

If there’s a Windows 8 client that needs a special setting rather than the inherited global settings, you can stop managing the File History setting in the client Properties (clear the Manage File History settings check box). If a Windows 8 client’s File History is not managed by the server, you can log on to the client and specify a custom File History setting.

Conclusion

File History is a good supplemental backup mechanism for client computer backup:

File History backs up a user’s profile data, while the client computer backup protects all the data (including apps) on the client computer.
A standard user can restore files from the File History backup directly without the administrator’s help.
It is easier to find the right version of the file to restore by using File History; however, if the entire client computer needs to be rebuilt, it is usually quicker to do a client computer restore to bring the computer back to its previous state.

We hope you enjoy this feature and we look forward to your feedback on the forum!