Tangent Thoughts

Review, Refresh and Revitalize your Group Policy Skills - Updated for Server 2012

2013-02-03T00:19:00Z

Ever since the first time I went to TechEd....a really, really long time ago, the first presentation that really impressed me for both content and presentation skills was on Group Policies. As a hint to when this was, Group Policies were just being released! For about another 10 years after that, I taught Group Policies at a well known computer training company. You would think at least from an Academic perspective, I would have been at least at a 400 level of knowledge; and at the time I was, but the wheels of change just don't stop! Later, I worked on an Active Directory migration project from Windows Server 2003 to 2008R2. While many things were the same, quite a few things in Group Policies had changed. Even later, I was fortunate to be part of the Windows Server 2012 (Server 8 beta then) Rapid Deployment team at Microsoft. Although I did not directly work on Group Policies on that project, I realized that there were enough significant changes throughout Server 2012, that surely the Product Groups had listened to our customers and made a few changes under the hood. They did, and so I started talking with folks in the product groups for both Active Directory and the Group Policy team. They were kind enough to share their tips and tricks which I wrote down ferociously! I also found on the web a nice old download called the Group Policy Documentation Survival Guide. With all the changes in Server 2012, I thought it could use a little refresh, so here is my first try at it. I took what was still applicable from what existed out there, and added all the tips and tricks that I got from the real experts on the subject for Server 2012 plus other Gems that many people often miss!

For part II of this blog, I will list out many of the subtopics related to this handout I made, that I will be speaking on soon! Additionally, as questions or comments are shared/learned during my presentations, I will post those findings here as well. I hope this information is useful for you as it has been for me, whether you are new or experienced with Group Policies, there is something for everyone to learn! Enjoy.

Mark

Upgrading Active Directory W2K3 to W2K8

2012-05-21T23:01:00Z

Keeping in the spirit of my blog title "Tangent Thoughts" this is another Tangent to my recent post "Known Issues for Upgrading Active Directory to Windows Server 2008R2 from Windows 2003". This post has two parts: 1. Everything you ever wanted to know about troubleshooting Windows Server 2008 R2 (First 5 links) and 2.A "Notes from the field" collection of errors discovered before, during and after an actual AD upgrade from Windows Server 2003R2. The table below is a trace record of Event IDs discovered as well as a collection from MS Support of general AD upgrade errors with KB links for remediation. The focus is primarily on the Errors and Warnings from the Applications and Systems logs on the Windows 2003 and 2008 Servers.

NOTES FROM THE FIELD :)

THE Kit and Kaboodle! "Troubleshooting Windows Server 2008 R2 Includes :

Directory Service Event ID /Note	Source	Comments
10009	Source: DCOM	Additional Reference
1006, 1030	Microsoft-Windows-GroupPolicy	The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). KB929852
1015	Microsoft-Windows-Wininit	KB976586 Error in Windows 7 or Windows Server 2008 R2 when unlocking a computer or switching users
1058, 1129	Microsoft-Windows-GroupPolicy	Event ID1058, Event ID 1129
1202	SceCli	Support KB
1396 Logon Failure		DCDIAG reports that the Active Directory Replications has failed with error “1396: Logon failure: The target account name is incorrect."
1533	User Profile Service	KB2661663 Stale user profile folders are not deleted completely in Windows 7 or in Windows Server 2008 R2
1722		KB2102154 Troubleshooting Active Directory operations that fail with error 1722: The RPC server is unavailable
4106	Group Policy Registry	KB2386730 An item-level targeting security group filter in Group Policy preferences settings does not work on a computer that is running Windows Server 2008 R2 or Windows 7 in a disjoint namespace
5		error code when you perform a system state backup operation
5136 Directory Service Changes	Microsoft-Windows-Security-Auditing	The Account Name, Account Domain, and Security ID fields are not populated in event ID 5136 for "Directory Service Changes" on a computer that is running Windows Server 2008 or Windows Server 2008 R2
53528	Source: MSDTC
5788, 5799	NETLOGON
8028, 6016		DFSR SYSVOL Fails to Migrate or Replicate, SYSVOL not shared
8524	Microsoft-Windows-ActiveDirectory_DomainService	KB2021446 Troubleshooting Active Directory operations that fail with error 8524: The DSA operation is unable to proceed because of a DNS lookup failure
948690	Access Encrypted Files after upgrade. How to Backup the EFS Recovery Agent should be done 1^st to preserve the EFS Recovery Agent	If the 1^st DC from the source forest no longer exists, you cannot recover the EFS Domain Recovery Agent! PSGetSID This sysinternals utility will quickly help you to identify what the first DC was in the source domain. RIDs are created sequentially, so the lowest number of all DCs will be the first.
Event 7030	McAfee ePolicy service account	Based on error seems that the service account needs interactive logon on the DCs
Import GPO fails	Message = “The Version Option is invalid”	Forum Post Must use same GPMC version for exporting and importing e.g. if Exported with GPMC 1.0, must import with the same.
Active Directory Administrative Center	FIPS-140 policy	In our test lab, we had a group policy for FIPS-140. Once it was applied, the administrator could open Active Directory Users and Computers, but not the newer AD Administrative Center. Removing the policy allowed the ADAC

Known Issues for Upgrading Active Directory to Windows Server 2008R2 from Windows 2003

2012-05-19T19:56:00Z

During an Active Directory Upgrade project, I have collected many links and reference articles around upgrading Active Directory from Windows Server 2003 R2 to Windows Server 2008 R2. Since these types of projects have now been around for awhile, there have been many lists compiled by Microsoft professionals collecting this information. Therefore, this is only a collection of those findings and another reference to those that did the initial hard work for us all! The first link is the most comprehensive collection from internal discussion throughout Microsoft internal DLs.

Keep in mind, that before you dive into these links and articles, support professionals should do their due diligence of checking event errors and logs first, as many of these will reference some of those known Event IDs. Sometimes I would search the entire string of the error message to find related posts on other forums of Blogs on BING!

Another related Blog post from this project was Comparing Windows Server 2008 R2 Server and Core Roles and Features, as the customer wanted a side-by-side listing of what you might not gain if you only installed Server Core versus a full installation.

TARGET /Support Level	TITLE	DESCRIPTION
PRE/POST UPGRADE L1/2/3	W2K3 to W2K8 and W2K8R2 Active Directory Upgrade Issues	A large collection from Microsoft internal DL discussions. One of the most complete lists!
POST UPGRADE L1/2	Some of the 2008/R2 AD Upgrade Compatibility Issues	Short List of known issues
POST AD UPGRADE L3	Migrate Server Roles to Windows Server 2008 R2	After AD is upgraded, resources for migrating specific roles
POST UPGRADE L2/3	Description of Microsoft Server Applications supported on Windows Server 2008
PRE UPGRADE L3	How to Delete DLT Objects	In cases where are large number of DLT objects have been found, this will help to clean this up before a migration
POST L3	Migrate Stand Alone Root CA 2003 to 2008R2	Issues and a link
POST L3	DC Strict Replication Mode	May halt AD replication for up to 12 hours
POST L3	Event ID 1388 or 1988 – Lingering Object Detected	Use Repadmin to remove
POST L3	Application Servers Fail to Authenticate	Tips from MSIT

Maneuvering through Metro! Shortcuts to getting around Windows 8

2012-03-21T15:38:00Z

Here are a few tips and tricks to help you maneuver around the new Windows 8 Metro Interface !

Change can be good, but most of us resist it! Face it; we are creatures of habit. Once we get used to something, it is sometimes frustrating when our familiar desktop icons and start menu have all been changed. I will be the first to admit; at first I was a bit frustrated! But I always keep this one thing in mind…they must have done this for a reason. I would also believe or hope, that some user studies had been done to redesign my world of comfort. So after I got over the frustration, I shared this with others who made the switch and quickly learned a few things. It actually is a quicker and easier to maneuver around, if you just know a couple of quick tips. Also, I quickly learned that since I have long known several quick Windows Keyboard Shortcuts, they all work from the Metro interface as well!

So in case you can’t read this all right now and just want to try a few, here are my favorite new top windows 8 shortcuts: ÿ + i, ÿ + C, ÿ +W, ÿ + Q, and ÿ +F. To learn more and see additional tips, please read on!

Note: since I can only admire from afar the tablets that I wish I had, or will have someday soon, the tips below are for mere laptop mortals like me, that just want to maneuver metro quickly and easily with keyboard a couple of quick keyboard shortcuts! There are many more tips and trick at the flip of a finger. Well, if you only have a laptop, your arrow keys will do the same in the metro interface!

I will start with a couple of my quick discoveries and short cuts to get you quickly maneuvering through Metro.

FIRST: Finding Programs that you used to get from the “All Programs” menu.

When you are at the Metro interface (as shown above), just start typing! Hopefully, you got used to this in Windows Vista or Windows 7. In both of those OSs, if you just started typing, the search window took over. It works even faster and better with Windows 8. So if you know the name of the Program, like Word, just type WORD. Or if you know the Microsoft Console name, like COMPMGMT.MSC for Computer Management, just type that.

In this first example, I just started typing WO and you see it quickly finds Microsoft Word

Next, I am going to type the shortcut COMPMGMT.MSC for Computer Management. But I will admit, before I could even type all that, typing just comp got the result even faster!

Also notice in the screens above, that there are three categories of search results: Apps, Settings, and Files. Therefore, if it is a file you are looking for, you’ll need to click on Files.

Also notice on the results window above, that beneath Files on the left side, you can further break down the search by Documents, Videos or Other. You will find more shortcuts for searching for Files, Settings, & Apps further below.

Where did the Power Button go? That was the first one I noticed. It’s been in the same place for about the past 6 operating systems! KNOW THIS SHORTCUT “ÿ key+ C”. C stands for CHARMS. Charms are the little icons hidden on the right side of the window. Another way to make them magically appear is to move your mouse to the right side of the screen. But whenever I have a choice between taking my hand off the keyboard to move the mouse, and a quick keyboard shortcut, I’m lazy…I’ll take a keyboard shortcut please! So here is what the charms look like …

If you click on Settings, you will get: Network Connections, Volume, Brightness, Notifications, Power, and Language. There is another shortcut below, to take you straight to the window below! Read on.

Click on More PC Settings above, and you get a much improved Metro interface to Control Panel Settings. It is very contemporary looking and clean. Later, you will find another shortcut to get you to the Power button with only one click!

Once you access an application from the Metro interface, you can simply toggle back and forth between the application and the Metro screen by pressing the ÿ key.

The nice thing about the “ÿ key+ C” Charms shortcut is that it works even if you are on the Desktop, which looks just like Windows 7. In either case, it will pop up a nice digital clock, that visually challenged guys like me can read, as well as the battery and network connections.

Additional Windows 8 Keyboard Shortcuts

Just to make sure we’re on the same boat, “ÿ “ is the Windows Key at the bottom of your keyboard. It is your Windows best friend J

Windows Keyboard Shortcut	What it Does	What is looks like
ÿ +i	Opens the Settings Charm! A quick way to get to your POWER. Note, by Default, More PC Settings is selected. So if you then press Enter, you will go to those PC Settings as shown above in Control Panel.
ÿ + Tab	This flips through the applications on the left side of the screen. Unlike “Aero Flip 3-D” from Windows 7, the applications show on the left side of the screen. This is designed for the tablet users, as they can just touch portions of the screen. If you “Right click” on any of the tiles, you get the Snap feature. This will “Snap” the window to the left or right of the screen. This also works the same as Windows 7 did. If you drag the top of any window all the way to the left or the right, it will “snap”.
ÿ + F	Opens File Search window, with search history included
ÿ + W	Opens Setting Search
ÿ + Q	Opens Apps Search window. Additionally, you will see ALL of your applications in the main window. Think of this as “All Programs”.
ÿ + P	This is the Second Screen option. If you didn’t know this one from Windows 7, this connects you to another monitor or projector.
ÿ + X	This is kind of a catch all menu for other options you would have found either on the Start Menu or else Taskbar. Additionally, it gives a few basic admin tools that are useful!
Ctrl + Shift + Esc	OK, its not a Windows shortcut, but just had to show the new improved task manager, which now shows much more information than before!
ÿ + K	Opens the Connections Charm
ÿ + "+" Or ÿ + "-"	That one is tricky to type! Windows key + the plus or minus symbol to zoom in or out with the Magnifier.
ÿ + Enter	This is the Narrator. You just gotta try this for the FUN factor. Navigate around. It is much improved from before! If you Press “ÿ + Alt + F1”, you will get a a plethora of more shortcuts for Narrator

Finally, keep in mind, MOST of the traditional Windows Keyboard Shortcuts will still work. The exceptions will be as shown above, plus others yet to be tested that may be updated or modified.

For more of what’s new, with walkthroughs and Videos, see the Windows 8 Consumer Preview. This will particularly show all of the merits for those lucky new tablet users too!

I hope this helps you Maneuver through Metro in Windows 8!

Windows 8 Direct Access (Beta) Installation - Simple Scenario

2012-03-19T13:37:00Z

DISCLAIMER: These are the features and functions available in the Windows Server 8 "Beta" Preview. All items are subject to change or removal by Microsoft and are not considered to be final until release of Windows 8.

Traditional VPNs require user intervention to initiate a remote connection to an intranet. In contrast, DirectAccess automatically establishes a bi-directional connection from client computers to the corporate network. This improves the overall user experience by making connecting to a corporate network from outside the workplace, as seamless as if a user was working from the office!

DirectAccess is based on a deperimitization model that uses advanced encryption, authentication, and authorization technologies that enable all points on a network to securely exchange information and data over the Internet. It is built on a foundation of proven industry standards such as Internet Protocol version 6 (IPv6) and Internet Protocol security (IPsec). DirectAccess supports a range of network scenarios, including pure IPv6 and IPsec environments (end-to-end) non-IPsec intranets with IPv6 application servers (end-to-edge), or IPv4-only application servers.

This article is to provide a walkthrough from the Beta to show just how easy it is to setup. At the end of the article, additional resources will be provided. For an overview of the requirements, roles and features for the scenario walkthrough below, see Simplified Remote Access with DirectAccess: scenario overview. For a lab manual walkthrough, which was used to base the screen captures below, see Test Lab Guide:Demonstrate Direct Access Single Server Setup with Mixed IPv4 and IPv6 in Windows Server "8" Beta.

Configure Direct Access in a Single Site with the Express Wizard

1. Configure DirectAccess using the Express Wizard from Remote Access Management. NOTE: to quickly access this console, go to the Start menu home screen and just start typing "Remote Access Management" and the search feature will make it appear!

a. Select Configure using Express Wizard

2. Choose to Deploy BOTH Direct Access and VPN, ONLY Direct Access, or ONLY VPN

3. In this example, I am only setting up Direct Access, so Deploy only DirectAccess was selected on the screen above.

After checking the prerequisites an doing some initial configuration, the following screen is presented. The three options (Edge, Back topology, single network adapter) are determined by the location of your Direct Access server. The machine can be either on the Edge of the network, exposed to the internet, behind a firewall, or only on the internal private network. For the first two options, they will require two network adapters: 1 private to the internal network and 1 public, exposed to the internet or firewall. The last option only requires one adapter card for the internal network. For my lab, I chose the "Edge" topology. The FQDN of the edge machine will be used for clients to connect. If a certificate for that machine exists in the computer store, it will be used. If not, a self signed certificate will be used.

4. On the last screen, you are presented with an option to review and modify settings where the screen says "please click here." Here you will see the configuration settings that were made for GPO Information, Remote Clients, Remote Access Server -Direct Access configuration, and Infrastructure Server - DNS suffixes used by clients. You can modify any of these settings by clicking on Change and/or you can Save to a file at the bottom of the DirectAccess Review screen to save all of your settings. By default, the DOMAIN\Domain Computers group will receive all of the configured settings. If you want a smaller subset of users\computers to have direct access, remove that group and create a special Global Group for only the clients that you want to have these policies applied. For example, I made a Global Group called DirectAccessClients and added that to the configuration.

5. If you modified any setting above, simply click OK, and then Finish on the "Configure Remote Access window". The configuration settings will be applied and you will get a confirmation window as below. Click Close to complete this simple setup!

6. After clicking Close above, you are presented with a nice topology diagram below, which allows you to easily go back in and modify any of the configuration settings that you may want to change now or later.

The final step for this simple scenario is to update the policy applied to the client, and then monitor the client connections from the Direct Access Server.

7. Do a gupdate from the new Windows Powershell ISE while connected to your corp connection. Not that you have to use this over a command prompt, but you should definitely explore this greatly enhanced tool with Intellisense, syntax coloring and visual debugging! If you are running a client in a test lab, you will then will want to disable your "public" interface to the corp domain and enable the "private" connection, which simulates a user connected from home to test your connectivity. In my test lab, I did two validation tests to confirm DirectAccess was working: I accessed an internal website on the corporate network as well as a file share on the corp server.

8. Finally, returning back to the Remote Access Management console, we can observe the results of the connection and view statistics as shown below. Click REMOTE CLIENT STATUS in the console on the left, and then your client should appear in the center. Double-click on the client machine, and you will see detailed client statistics. In a virtual lab environment, this may take a couple of minutes to refresh, so be patient.

There you have it! Direct Access has been greatly simplified to administer and deploy with Windows Server "8" Beta. Later I hope to blog on the Advanced Deployment Scenario, as it currently exists in the Beta Form.

Additional Resources

Understand and Troubleshoot Remote Access in Windows Server "8" Beta

Windows Server "8" Beta Test Lab Guides

Technical Scenarios for Windows Server "8" Beta

Comparing Windows Server 2008 R2 and Server Core Roles and Features

2012-03-01T22:45:00Z

There are many links out there that that will tell you what features or what roles you can get on either the full edition of Windows Server 2008 R2, OR on Windows Server 2008 R2 core only. But what I, and my customer wanted, was a nice list to compare the two side by side! So I made one. Later, I will update this for WIndows Server 8, if there are any notable differences. The future will tell!

Here are the sources I used ..

Then I looked at the installed help files for WIndows Server 2008 R2 and compared the two. Here is your side-by-side conmparison now!

WINDOWS SERVER 2008 R2 ROLES AND FEATURES

Role Name	Exist on Core?	Description
Active Directory Certificate Services	YES	Active Directory Certificate Services Active Directory Certificate Services (AD CS) provides customizable services for issuing and managing certificates in software security systems that use public key technologies. You can use AD CS to create one or more certification authorities (CA) to receive certificate requests, verify the information in the requests and the identity of the requester, issue certificates, revoke certificates, and publish certificate revocation data. Applications supported by Active Directory Certificate Services include Secure/Multipurpose Internet Mail Extensions (S/MIME), secure wireless networks, virtual private networks (VPN), IP security (IPSec), Encrypting File System (EFS), smart card logon, Secure Socket Layer/Transport Layer Security (SSL/TLS), and digital signatures.
Active Directory Domain Services	YES	Active Directory Domain Services (AD DS) stores information about users, computers, and other devices on the network. AD DS helps administrators securely manage this information and facilitates resource sharing and collaboration between users. AD DS is also required to be installed on the network in order to install directory-enabled applications such as Microsoft Exchange Server and for applying other Windows Server technologies such as Group Policy.
Active Directory Federation Services	NO	Active Directory Federation Services (AD FS) provides Web single-sign-on (SSO) technologies to authenticate a user to multiple Web applications that use a single user account. AD FS accomplishes this by securely federating, or sharing, user identities and permissions, in the form of digital claims, between partner organizations.
Active Directory Lightweight Directory Services	YES	Organizations that have applications which require a directory for storing application data can use Active Directory Lightweight Directory Services (AD LDS) as the data store. AD LDS runs as a non-operating-system service. Therefore, AD LDS does not require deployment on a domain controller. Running as a non-operating-system service allows multiple instances of AD LDS to run at the same time on a single server, and each instance can be configured independently for servicing multiple applications.
Active Directory Rights Management Services (AD RMS)	NO	Active Directory Rights Management Services is information protection technology that works with AD RMS -enabled applications to help safeguard digital information from unauthorized use. Content owners can define exactly how a recipient can use the information, such as who can open, change, print, forward, or take other actions with the information. Organizations can create custom usage rights templates such as "Confidential – Read-Only" that can be applied directly to information such as financial reports, product specifications, customer data, and e-mail messages.
Application Server	NO	Application Server provides a complete solution for hosting and managing high-performance distributed business applications. Integrated services, such as the .NET Framework, Web Server Support, Message Queuing, COM+, Windows Communication Foundation, and Failover Clustering support improve productivity throughout the application life cycle, from design and development through deployment and operations.
Dynamic Host Configuration Protocol Server	YES	The Dynamic Host Configuration Protocol (DHCP) allows servers to assign, or lease, IP addresses to computers and other devices that are enabled as DHCP clients. Deploying DHCP servers on the network automatically provides computers and other TCP/IP based network devices with valid IP addresses and the additional configuration parameters these devices need./these are known as DHCP options, which allow them to connect to other network resources, such as DNS servers, WINS servers, and routers.
DNS Server	YES	Domain Name System (DNS) provides a standard method for associating names with numeric Internet addresses. This lets users refer to network computers by using easy-to-remember names instead of a long series of numbers. Windows DNS services can be integrated with DHCP services, eliminating the need to add DNS records as computers are added to the network.
Fax Server	NO	Fax Server sends and receives faxes, and lets you manage fax resources such as jobs, settings, reports, and fax devices on this computer or on the network.
File Services	YES	File Services provides technologies for storage management, file replication, distributed namespace management, fast file searching, and streamlined client access to files, such as UNIX-based client computers.
Hyper-V™	YES	Hyper-V provides the services that you can use to create and manage virtual computing environments and their resources. Virtual computers operate in an isolated operating environment. This lets you to run multiple operating systems at the same time. You can use a virtualized computing environment to improve the efficiency of your computing resources by using more of your hardware resources.
Network Policy and Access Services	NO	Network Policy and Access Services delivers many different methods to give users local and remote network connectivity, to connect network segments, and to allow network administrators to centrally manage network access and client health policies. With Network Access Services, you can deploy VPN servers, dial-up servers, routers, and 802.11-protected wireless access. You can also deploy RADIUS servers and proxies, and use Connection Manager Administration Kit to create remote access profiles to let client computers to connect to the network.
Print and Document Services	YES	Print and Document Services enables you to centralize print server and network printer management tasks. With this role, you can also receive scanned documents from network scanners, and route the documents to a shared network resource, a Windows SharePoint Services site, or to e-mail addresses.
Remote Desktop Services	NO	Remote Desktop Services provides technologies that enable users to access Windows-based programs that are installed on a remote desktop server, or to access the Windows desktop itself, from almost any computing device. Users can connect to a remote desktop server to run programs and to use network resources on that server.
Web Server (IIS)	YES	The Web Server (IIS) role in Windows Server 2008 R2 lets you share information with users on the Internet, an intranet, or an extranet. Windows Server 2008 R2 delivers IIS 7.5, a unified Web platform that integrates IIS, ASP.NET, and Windows Communication Foundation.
Windows Deployment Services	NO	You can use Windows Deployment Services to install and configure remotely Windows operating systems on computers that have Pre-boot Execution Environment (PXE) boot ROMs. Administration overhead is decreased through the implementation of the WdsMgmt Microsoft Management Console (MMC) snap-in that manages all aspects of Windows Deployment Services. Windows Deployment Services also provides end-users an experience consistent with Windows Setup.
Windows Server Update Services	NO	Windows Server Update Services allows network administrators to specify the Microsoft updates that should be installed, to create separate groups of computers for different sets of updates, and to obtain reports on the compliance levels of the computers and on the updates that must be installed.

WINDOWS SERVER 2008 R2 FEATURES

Feature	Exist on Core?	Description
.NET Framework 3.5.1	YES (subset)	The .NET Framework 3.5.1 builds incrementally on the features added in the .NET Framework 3.0, such as enhancements to Windows Workflow Foundation * (WF), Windows Communication Foundation* (WCF), Windows Presentation Foundation (WPF) and Windows CardSpace. LINQ* Window PowerShell*
Background Intelligent Transfer Service	NO	Background Intelligent Transfer Service (BITS) asynchronously transfers files in the foreground or background, throttles the transfers to preserve the responsiveness of other network applications, and automatically resumes file transfers after network connection failures or computer restarts.
BitLocker Drive Encryption	YES	BitLocker Drive Encryption helps protect data on lost, stolen or inappropriately decommissioned computers by encrypting the volume and checking the integrity of early boot components. Data is only decrypted if those components are successfully verified and the encrypted drive is located in the original computer. Integrity checking requires a compatible trusted platform module (TPM).
BranchCache	NO	BranchCache, available on both Windows Server 2008 R2 and Windows 7, enables client computers in a branch office to retrieve content securely and locally, instead of retrieving it from a central office server. Because branch offices are typically connected over slower WAN links, BranchCache reduces WAN traffic, and increases application responsiveness on the client computer.
Connection Manager Administration Kit	NO	Connection Manager Administration Kit (CMAK) generates Connection Manager profiles.
Desktop Experience	NO	Desktop Experience includes features of Windows® 7, such as Windows Media Player, desktop themes, and photo management. Desktop Experience does not enable any of the Windows 7 features by default. You must manually enable them.
Direct Access Management Console	NO	Direct Access Management Console provides direct access setup and monitoring.
Failover Clustering	YES	Failover Clustering allows multiple servers to work together to provide high availability of services and applications. Failover Clustering is frequently used for file and print services, database and mail applications.
Group Policy Management	NO	Group Policy Management makes it easier to deploy, manage, and troubleshoot Group Policy implementations. The standard tool is Group Policy Management Console (GPMC), a scriptable Microsoft Management Console (MMC) snap-in that provides a single administrative tool for managing Group Policy across the enterprise.
Ink and Handwriting Services	NO	Ink and Handwriting Services, new for Windows Server 2008 R2, provides support for handwriting recognition in multiple languages, together with support for using a pen or stylus with a pressure-sensitive computing interface, such as a tablet computer.
Internet Printing Client	NO	Internet Printing Client enables users to connect and print to printers on the local network or over the Internet by using Internet Printing Protocol (IPP). You can use the Internet Printing Client and IPP to connect to the shared printer by using a Web browser (if the print server has the Internet Printing role service installed), or by using the Network Printer Installation Wizard.
Internet Storage Name Server	NO	Internet Storage Name Server (iSNS) provides discovery services for iSCSI storage area networks. iSNS processes registration requests, deregistration requests, and queries from iSNS clients.
LPR Port Monitor	NO	Line Printer Remote (LPR) Port Monitor allows users who have access to UNIX-based computers to print on devices attached to them.
Message Queuing	NO	Message Queuing provides guaranteed message delivery, efficient routing, security, and priority-based messaging between applications. Message Queuing also accommodates message delivery between applications that run on different operating systems, use dissimilar network infrastructures, are temporarily offline, or that are running at different times.
Multipath I/O	NO	Multipath I/O (MPIO), together with the Microsoft Device Specific Module (DSM) or a third-party DSM, provides support for using multiple data paths to a storage device on Windows.
Network Load Balancing	YES	Network Load Balancing (NLB) distributes traffic across several servers, by using the TCP/IP networking protocol. NLB is especially useful for ensuring that stateless applications, such as a Web server that is running IIS, are scalable by adding additional servers as the load increases.
Peer Name Resolution Protocol	NO	Peer Name Resolution Protocol (PNRP) allows applications to register on and resolve names from your computer, so that other computers can communicate with these applications.
Quality Windows Audio Video Experience (qWave)	YES	Quality Windows Audio Video Experience (qWave) is a networking platform for audio and video (AV) streaming applications on IP-based home networks. qWave improves AV streaming performance and reliability by ensuring network quality-of-service for AV applications. It provides admission control, run time monitoring and enforcement, application feedback, and traffic prioritization. On Windows Server platforms, qWave provides only rate-of-flow and prioritization services.
Remote Assistance	NO	Remote Assistance enables you (or a support person) to offer assistance to users who have computer issues or questions. Remote Assistance lets you view and share control of the user’s desktop in order to troubleshoot and fix the issues. Users can also ask for help from friends or co-workers.
Remote Differential Compression	NO	The Remote Differential Compression (RDC) feature is a set of APIs that applications can use to determine whether a set of files have changed, and if that is the case, to detect which sections of the files contain the changes.
Remote Server Administration Tools	NO	Remote Server Administration Tools enables remote management of Windows Server 2008 and Windows Server 2008 R2 from a computer running Windows Server 2008 R2 by allowing you to run some of the management tools and snap-ins for roles, role services, and features on a remote computer.
RPC Over HTTP Proxy	NO	RPC Over HTTP Proxy is a proxy that is used by objects that receive remote procedure calls (RPC) over HTTP. This proxy allows clients to discover these objects even if the objects are moved between servers or if they exist in discrete areas of the network, usually for security reasons.
Services for Network File System	NO	Services for Network File System (NFS) is a protocol that acts as a distributed file system, allowing a computer to access files over a network as easily as if they were on its local disks. This feature is available for installation in Windows Server 2008 R2 for Itanium-based Systems only; in other versions of Windows Server 2008 R2, Services for NFS is available as a role service of the File Services role.
Simple TCP/IP Services	NO	Simple TCP/IP Services supports the following TCP/IP services: Character Generator, Daytime, Discard, Echo, and Quote of the Day. Simple TCP/IP Services is provided for backward compatibility and should not be installed unless it is required.
SMTP Server	NO	Simple Mail Transfer Protocol (SMTP) Server supports the transfer of e-mail messages between e-mail systems.
SNMP Services	YES	Simple Network Management Protocol (SNMP) is the Internet standard protocol for exchanging management information between management console applications—such as HP Openview, Novell NMS, IBM NetView, or Sun Net Manager—and managed entities. Managed entities can include hosts, routers, bridges, and hubs.
Storage Manager for SANs	NO	Storage Manager for Storage Area Networks (SANs) helps you create and manage logical unit numbers (LUNs) on Fibre Channel and iSCSI disk drive subsystems that support Virtual Disk Service (VDS) in your SAN.
Subsystem for UNIX-based Applications	YES	Subsystem for UNIX-based Applications (SUA), together with a package of support utilities available for download from the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkID=139521), enables you to run UNIX-based programs, and compile and run custom UNIX-based applications in the Windows environment.
Telnet Client	YES	Telnet Client uses the Telnet protocol to connect to a remote telnet server and run applications on that server.
Telnet Server	NO	Telnet Server allows remote users, such as those running UNIX-based operating systems, to perform command-line administration tasks and run programs by using a telnet client.
Trivial File Transfer Protocol Client	NO	Trivial File Transfer Protocol (TFTP) Client is used to read files from, or write files to, a remote TFTP server. TFTP is primarily used by embedded devices or systems that retrieve firmware, configuration information, or a system image during the boot process from a TFTP server.
Windows Biometric Framework	NO	Windows Biometric Framework (WBF) allows fingerprint devices to be used to identify and verify identities, and to log on to Windows. WBF includes sub features that are required to let you use fingerprint devices.
Windows Internal Database	NO	Windows Internal Database is a relational data store that can be used only by Windows roles and features, such as AD RMS, ADFS, Windows Server Update Services, and Windows System Resource Manager.
Windows Process Activation Service	NO	Windows Process Activation Service (WAS) generalizes the IIS process model, removing the dependency on HTTP. All the features of IIS that were previously available only to HTTP applications are now available to applications hosting Windows Communication Foundation (WCF) services by using non-HTTP protocols. IIS 7.5 also uses WAS for message-based activation over HTTP.
Windows Server Backup Features	NO	Windows Server Backup Features allow you to back up and recover your operating system, applications, and data. You can schedule backups to run one time each day or more frequently, and can protect the complete server or specific volumes.
Windows Server Migration Tools	NO	Windows Server Migration Tools lets an administrator migrate some server roles, features, operating system settings, shares, and other data from computers that are running certain editions of Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2 to computers that are running Windows Server 2008 R2. For more information about Windows Server Migration Tools and migrating roles, features, or other data to Windows Server 2008 R2, see the Windows Server Migration Portal (http://go.microsoft.com/fwlink/?LinkID=128554).
Windows System Resource Manager	NO	Windows System Resource Manager (WSRM) is a Windows Server operating system administrative tool that can control how CPU and memory resources are allocated. Managing resource allocation improves system performance and lowers the risk that applications, services, or processes will interfere with one another to reduce server efficiency and system response.
WinRM IIS Extension	NO	Windows Remote Management (WinRM) IIS Extension enables a server to receive a management request from a client computer by using the WS-Management protocol. WinRM is the Microsoft implementation of the WS-Management protocol. This helps secure communication between local and remote computers by using Web-based services.
Windows Internet Name Service Server	YES	Windows Internet Name Service (WINS) Server provides a distributed database for registering and querying dynamic mappings of NetBIOS names for computers and groups used on the network. WINS maps NetBIOS names to IP addresses and solves the problems arising from NetBIOS name resolution in routed environments.
Windows PowerShell Integrated Scripting Environment (ISE)	NO	Windows PowerShell ISE is a graphical host application for Windows PowerShell. Windows PowerShell ISE lets you run commands, and write, edit, run, test, and debug scripts in an environment that displays syntax in colors and that supports Unicode.
Windows TIFF iFilter	NO	Windows Tagged Image File Format (TIFF) iFilter uses optical character recognition (OCR) software to enable users to search for TIFF documents based on textual content in the images.
Wireless LAN Service	NO	Wireless LAN (WLAN) Service configures and starts the WLAN AutoConfig service, regardless of whether the computer has any wireless adapters. WLAN AutoConfig enumerates wireless adapters, and manages both wireless connections and the wireless profiles that contain the settings required to configure a wireless client to connect to a wireless network.
XPS Viewer	NO	An XML Paper Specification (XPS) document is a document format that you can use to view, save, share, digitally sign, and protect your document’s content. You can use XPS viewer to view, search, set permissions for, and digitally sign XPS documents.

PST Migrations for Exchange Online Services

2011-01-11T15:46:00Z

As I start my next venture, there is a new challenge in town. How to fully automate the migration of PSTs from Legacy Exchange into Exchange Online Services. At first glance, this solution is pretty straightforward if you want the user to only perform this as a manual process to import their PSTs into the online world. But, the out-of-the box "Migration Online Services Migration Tools" do not migrate the following:

Auto-archive settings
Conditional formatting
Content for shared folders, such as RSS feeds to which the user subscribes, and shared subfolders
Delegated access to user mailboxes and their associated Access Control Lists (ACLs)
Hidden messages
Profiles
PST files
Search folders and subfolders
Signatures
Sync Issues folders and subfolders
User-customized mailbox rules
Views

However,one of the key requirements for this project I am working on is to provide a seamless experience for the user so that they really don't have to do anything to make this happen. In other words, once their Mailboxes are migrated to Exchange online, their saved PST files from years back will also be brought i to Exchange Online . There will of course be exceptions that may need to be considered. For example, what if the user has more total space in PSTs than their Online MB size will allow. Many think of the online MB storage as "bottomless", but it there are restrictions made, say for example 5GB, it doesn't take long for a power user, or a user who has saved everything for many years, to reach those limits. All of the above concerns will be addressed throughout my current project and will be tracked through these postings as discovery leads to the solution design.

For a starter, I will give you what resources are out there to provide a baseline source of "everything you ever wanted to know about PSTs, but weren't afraid to ask". Additionally, for this solution design as it proceeds, we will be leveraging a third party product from C2C called PST Manager. Finally, to fully automate the process, there may be some need for custom PowerShell scripts to help futther automate the PST migration process. As details are progressively elaborated, they will be updated on this BLOG.

How to Manage PSTs in Outlook 2002, 2003 and 2007 This article will tell you HOW TO use PST files to backup your data

Microsoft Office (End User Friendly) - Create a file to save your information Describes to Users When and Why to use PSTs and OSTs as well as HOW TO

Reconnect your old Outlook Data File This is the follow up step for a user to bring their saved PST files back into their new version of Outlook

How to configure the SIZE limit for PST and OST files in Outlook 2003, 2007 and 2010 There are four registry settings that allow you to limit the size of PSTs and OSTs

How to repair an OST or PST file in Outlook If these files become damaged, you may be able to use Outlook's Inbox Repair Tool to fix them

Exchange Online Help and How-to I am providing this as a general resource for Exchange Online Help

How to Import PST files into MSOL?

Fully Deploy your Microsoft BPOS to maximize your user experience This also has a great link to a MUST HAVE download "Microsoft Online Services Deployment Guide"

NOTE: search the "Microsoft Online Services Deployment Guide" for PST and you wil run into this import message...

A common practice to reduce the size of the mailbox is to move mail items out of the mailbox to an archive (for example, a .PST file) either manually or with auto archive functionality. This practice is discouraged for two reasons:

 When the user moves the mail items back to the new Exchange Online mailbox after migration, the Exchange Online mailbox will not allow the user to reply to the mail.

....This is something we will be investigating, testing, and seeking remediation for.

MORE TO COME!

Just Getting Started

2010-11-11T22:37:48Z

I am Mark Grimes, a consultant with Microsoft Consulting Services. I have many interests and a few core competencies. So how did I come up with the Blog name? The same way my projects come to me. Even though I try to focus on a few core competencies, ir also seems to work at a Tangent to something else. So it is with this spirit that I will not only share lessons learning and other findings about my core competencies, such as OCS, Lync, AD, and SharePoint, but will also fill in the odd points of tangential issues that I seem to run into.

That's all for now! I soon will post my first tangential thought on using RSA USB smart cards for authentication and secure email.....in case you ever find yourself there too! I've had many lessons learned so far, but won't post them until my project is complete.

Here are my technical resources in the meantime to help out. Enjoy!

http://markbgrimes.com

http://temp.markgrimestrainingcom.officelive.com/default.aspx

Remember think BIG....it saves time!