danielvs : Infrastructure

Deploy SMS 2003 Inventory Tool for Microsoft Updates (ITMU) and WSUS

danielvs — Wed, 10 Aug 2005 15:09:00 GMT

Everyone who uses SMS 2003 SP1 should deploy the SMS 2003 Inventory Tool for Microsoft Updates!

Systems Management Server (SMS) 2003 SP1 uses the Inventory Tool for Microsoft Updates (ITMU) to determine the update compliance of managed systems. This tool provides integration with updates offered by Windows Update and Microsoft Update. The tool shares the same security update, update rollup, and service pack data as offered by Microsoft Windows Server Update Services (WSUS).

SMS 2003 SP1 is updated to incorporate WSUS technology for scanning and deployment with support for the following products:

Microsoft Windows XP Embedded
Microsoft Windows 64-bit edition (based on Windows Server 2003 SP1 code)
Microsoft Office XP and Office 2003
Microsoft Exchange 2000 and Exchange 2003
Microsoft Windows 2000 Service Pack 4 and later
All Windows components (such as MSXML, MDAC, and Microsoft Virtual Machine)
Microsoft SQL Server 2000 SP4 and SQL Server 2005
Additional products as published to the Windows Updates catalog

ITMU includes the following components:

Scan tool for Microsoft updates. Enables you to scan your Windows desktops and servers for installed and missing Microsoft updates similarly to how Microsoft Baseline Security Analyzer (MBSA) determines compliance for Microsoft security updates.
Synchronization of the Windows Updates Catalog. Downloads the WSUS scan catalog on a recurring schedule.
The latest Windows Update Agent. The Windows Update Agent version 5.8.0.2469 is installed on the Windows operating system to support Windows Update detection and deployment.
New SMS Advanced Client release and updated Distribute Software Update Wizard.

Important note: This inventory tool can be used only within an SMS 2003 SP1 site hierarchy with certain hotfixes applied! Check here for Obtaining Required Components for SMS 2003 Inventory Tool for Microsoft Updates with links to the needed components. The following list identifies the required Microsoft components:

Knowledge Base Article 901034.
Knowledge Base Article 900401.
Knowledge Base Article 900257.
Microsoft Windows Installer 3.1.
Windows Update Agent 5.8.0.2469.

See the SMS ITMU preinstallation guide for detailed instructions on how to deploy these requirements to your SMS environment.

Fortunately the Ohio SMS Users Group has already done some great work figuring out the bits and bytes, check out these great posts:

ITMU Pre-Installation Process Flow Chart. They created a flow chart of the pre-installation process of installing the ITMU, based on the ITMU Pre-Installation Guide. This flow chart will help you "visualize" the process of preparing your SMS environment for the ITMU.
Preparing for the Inventory Tool for Microsoft Updates (ITMU) – Updating Windows Installer. This post describes how to query for systems that need Windows Installer 3.1.
ITMU and the Windows Update Agent. This post describes which issues you can encounter when updating the Windows Update Agent to version 5.8.0.2469 and how to solve them.
Update 11-08: Products currently supported (and not supported) with the ITMU . This post describes the differences between the different patch tools SMS can use and which ones are still needed to patch certain products like Bizztalk server, Exchange 5.0 & 5.5, SQl 7.0 & 2000, etc.
Update 11-08: SMS 2003 Inventory Tool for Microsoft Updates (ITMU). This post contains links to help you get the ITMU installed properly. Here they link all new information.

Check it out, Suberb stuff!

Well, with all this information I hold my comment: Everyone who uses SMS 2003 SP1 should deploy the SMS 2003 Inventory Tool for Microsoft Updates!
SMS = Secure My System, Daniel.

Virus in Monad? Virus in Windows Vista?

danielvs — Tue, 09 Aug 2005 17:29:00 GMT

There’s been some commentary the past couple of days regarding a potential Windows Vista virus as posted by the Register: Hasta la Vista, baby.

Virus writers created 5 proof of concept viruses targeting the scripting language MSH (codenamed 'Monad') and it was uncertain if the new scripting tool would ship as part of Windows Vista or was shipped with the Windows Vista Beta 1. I already felt a headache developing; people concerned and/or pointing that Windows Vista is not secure, etc.

Well, I think Vista will be secure and now Microsoft has confirmed that Monad will not ship as part of the next version of its operating system, Windows Vista (headache is suddenly partially gone). Phew.

In the Security Response Centre's blog Stephen Toulouse, a program manager in a posting said: “Monad is not included in the beta release of Windows Vista or in Windows Server 2003 R2. Monad will not be included in the final version of Windows Vista and there is no relation between Monad and Windows Vista Beta 1.”

In the Windows Server Division WebLog there’s also a posting about this subject stating Monad is not planned to be in the release of Longhorn Server at this time.

The Register also released an article “Microsoft quells Vista virus concerns” to address this matter and ends it with the following line: "These, it's now clear, are not Windows Vista viruses but MSH viruses."

For all you folks out there being critical (like me) and thinking: Yeah, right! Monad is pulled from Windows Vista due to the virus story here is another post by Stephen Toulouse clarifying this is not the case.

Finnaly, I would like to point you to the post on Kevin Remde's WebLog called Vista Shmista. It basically has the same info but the animation with his post is super funny (headache totally gone, it’s a bright sunny day).

Vista Fever, Daniel

SyncToy v1 Beta for Windows XP : The Smart Way to Copy Files!

danielvs — Wed, 03 Aug 2005 14:00:00 GMT

Yes! It's finally there, The Smart Way to Copy Files! SyncToy v1 Beta helps you copy, move, rename, and delete files between folders and computers quickly and easily.

Increasingly, computer users are using different folders, drives, and even different computers (such as a laptop and a desktop) to store and retrieve files. There are new sources of files coming from every direction: digital cameras, e-mail, cell phones, portable media players, camcorders, PDAs, and laptops. Yet managing hundreds or thousands of files is still largely a manual operation. In some cases it is necessary to move files from one place to another; in other cases there is a need to keep two storage locations exactly in sync. Some users manage files manually, dragging and dropping from one place to another and keeping a mental card catalog in their heads. Others use one or more applications of one sort or another to provide this functionality for them.

Now there is an easier way. SyncToy is a free PowerToy for Microsoft Windows XP that provides an easy to use, highly customizable program that helps users to do the heavy lifting involved with the copying, moving, and synchronization of different directories. Most common operations can be performed with just a few clicks of the mouse, and additional customization is available without adding complexity. SyncToy can manage multiple sets of directories at the same time; it can combine files from two folders in one case, and mimic renames and deletes in another. Unlike other applications, SyncToy keeps track of renames to files and will make sure those changes get carried over to the synchronized folder.

I was in desperate need of this one. I use a tablet for my daily work, emailing, study, creating ppt's etc. For demo's/presentations I have a 2 GB RAM laptop with an external 250 GB hard drive in order to get all my demo's running at max speed in a virtual environment (I use both Virtual PC and Virtual Server). I end up syncing data between my tablet, laptop and external drive every week with robocopy. With robocopy you can use the -mir command to mirror a directory but it stil lacks a graphic interface. Internally some guys created an GUI for robocopy but I'll go for the SyncToy!

Enjoy SyncToy, Daniel.

Update: Here is the link to the Microsoft PowerToys for Windows XP which consists of the following tools:

RAW Image Thumbnailer and Viewer
Are you a serious photographer? Now you can organize and work with digital RAW files in Windows Explorer (much as you can with JPEG images). This tool provides thumbnails, previews, printing, and metadata display for RAW images.
ClearType Tuner
This PowerToy lets you use ClearType technology to make it easier to read text on your screen, and installs in the Control Panel for easy access.
HTML Slide Show Wizard
This wizard helps you create an HTML slide show of your digital pictures, ready to place on your Web site.
Open Command Window Here
This PowerToy adds an "Open Command Window Here" context menu option on file system folders, giving you a quick way to open a command window (cmd.exe) pointing at the selected folder.
Alt-Tab Replacement
With this PowerToy, in addition to seeing the icon of the application window you are switching to, you will also see a preview of the page. This helps particularly when multiple sessions of an application are open.
Tweak UI
This PowerToy gives you access to system settings that are not exposed in the Windows XP default user interface, including mouse settings, Explorer settings, taskbar settings, and more.
Power Calculator
With this PowerToy you can graph and evaluate functions as well as perform many different types of conversions.
Image Resizer
This PowerToy enables you to resize one or many image files with a right-click.
CD Slide Show Generator
With this PowerToy you can view images burned to a CD as a slide show. The Generator works downlevel on Windows 9x machines as well.
Virtual Desktop Manager
Manage up to four desktops from the Windows taskbar with this PowerToy.
Taskbar Magnifier
Use this PowerToy to magnify part of the screen from the taskbar.
Webcam Timershot
This PowerToy lets you take pictures at specified time intervals from a Webcam connected to your computer and save them to a location that you designate.

I mainly use Image Resizer and Open command Window Here. In explorer I can now select a picture and with the right click context menu resize it or select a folder and with the right click open a CMD box there. Handy!

Power! Daniel

Exchange/Outlook 2000 or earlier issue after you upgrade the Global Catalog (GC) to Windows Server 2003 (KB903295)

danielvs — Tue, 02 Aug 2005 15:08:00 GMT

I’m not an Exchange expert but I do know that in order to work properly the Exchange server needs a Global Catalog (GC) for name checking, etc. There seems to be an issue when you upgrade this GC to Windows Server 2003:
After you upgrade the global catalog to Windows Server 2003, you receive an error message when you use Outlook 2000 or an earlier version to resolve aliases or to connect to a server that is running Exchange Server (KB903295)

SYMPTOMS:
You upgrade the global catalog to Microsoft Windows Server 2003. When you use Microsoft Outlook 2000 or an earlier version to resolve aliases by clicking Check Names, you receive an error message that is similar to the following:
The name could not be resolved. Network problems are preventing connection to the Microsoft Exchange Server computer. Contact your system administrator if this condition persists.
Alternatively, when you use Outlook 2000 or an earlier version to connect to a server that is running Microsoft Exchange Server, you receive an error message that is similar to the following:
Exchange Server is unavailable.

CAUSE
This issue occurs because the Windows Server 2003 security templates are more secure than the Microsoft Windows 2000 security templates.

RESOLUTION
To resolve the issue, follow these steps:
1. On the global catalog that was upgraded to Windows Server 2003, click Start, point to All Programs, point to Administrative Tools, and then click Domain Controller Security Policy.
2. Expand Local Policies, and then click Security Options.
3. Set the policies as listed in the following table.

Policy Name	Status
Network access: Allow anonymous SID/Name translation	Enabled
Network access: Do not allow anonymous enumeration of SAM accounts	Disabled
Network access: Let Everyone permissions apply to anonymous users	Enabled
Network security: Do not store LAN Manager hash value on next password change	Disabled
Network security: LAN Manager authentication level	Send LM & NTLM response

4. Close the Domain Controller Security Policy console.
5. Click Start, click Run, type gpupdate /force, and then click OK.
6. On the Exchange server, click Start, click Run, type services.msc, and then click OK.
7. Locate the Microsoft Exchange System Attendant service, click Restart Service on the toolbar, and then close the Services console.

Greetings, Daniel

Animations do not work in Access 2002 Help running on Windows Server 2003! (KB816677)

danielvs — Wed, 20 Jul 2005 12:24:00 GMT

Ok, this recently updated KB article caught my attention: Animations do not work in Access 2002 Help running on Windows Server 2003

Basically, these are the symptoms:When you try to view an animation that describes new features in Microsoft Access you cannot play the animated help.

This issue occurs because the animation in Access 2002 Help requires that you first install Macromedia Flash Player. However, you are not prompted to automatically install the Flash Player because of the increased security that is introduced in Microsoft Windows Server 2003.

Well, so far so good, and the resolution is to install Macromedia Flash Player. Hmmm...and that makes me wonder, why would an administrator install the flash player on a server? Furthermore, why would an administrator install Office and/or Access on a server?? And what kind of administrator is in need of the animated help for Access on a server???

My resolution would be something like: Please remove Access and/or Office from your server, it's already difficult enough to secure this box, you do NOT want to be bothered with Office patches!

Can someone enlighten me?

Greetings, Daniel