eXtreme. tech. : Microsoft

Forefront Protection (vs Online) for Exchange – FPE vs FOPE

David Tesar — Tue, 25 Aug 2009 00:52:00 GMT

In this interview with Mike Chan, I help clarify when you might want to utilize Forefront Protection for Exchange versus Forefront Online Protection for Exchange – or use both. Most of the video is spent white boarding out how things work between FPE / FOPE and Exchange 2010’s security.

Remove Active Partition

David Tesar — Thu, 06 Aug 2009 19:10:00 GMT

I couldn't find any good search results on how to remove an active partition on a Windows system (and this is not in the disk management GUI) and eventually figured this out on my own, so I thought I'd share. Of course, this is only useful if you have a drive which no longer contains an operating system / boot files and you just want to remove the flag. The solution is simply the command-line tool "diskpart" which resides in the windows\system32 directory and the Inactive command. the active command marks it for active, which can also easily be done in the disk management UI.

DISKPART> help inactive

On disks with master boot record (MBR) disk formatting, marks
the partition with focus as inactive.

Syntax: INACTIVE

    The computer may start from the next option specified in the BIOS such as a
    CD-ROM drive or a Pre-Boot eXecution Environment (PXE)-based boot
    environment (such as Remote Installation Services (RIS)) when you restart
    the computer.

A partition must be selected for this operation to succeed.

Caution:

        Your computer might not start without an active partition. Do not mark
        a system or boot partition as inactive unless you are an experienced
        user with a thorough understanding of Windows storage management.

Save TechNet Library content offline

David Tesar — Fri, 31 Jul 2009 03:15:00 GMT

Ever wanted to not have to scroll through endless expansions of bite-sized content on the TechNet library and just download a document of only the content you want instead? I know this has been frustrating for me in the past and when I brought it up to a TechNet manager he said “you can already do this”. To my shock, I asked how since it isn’t visible anywhere within the TechNet library…

The ”Package This” tool is a piece of software you can download from CodePlex which will allow you to accomplish this. You have to make sure you have the .Net 2.0 framework and MS Help installed, but it is well worth the time to have offline searchable files.

This is a picture of the user interface where you select the content you want to package:

After you select what you want, you can then Export it into a CHM file!

XP-Mode vs App-V vs Med-V vs VDI

David Tesar — Fri, 24 Jul 2009 02:32:00 GMT

There are so many virtualization options available from Microsoft, which one do you use when? We cleared this up in a short interview and addressed how these options might help you remediate your legacy applications over to Windows 7. Also, we just launched the XP to Windows 7 Migration process guide with the announcement of Windows 7 and Server 2008 R2 RTM yesterday which will further clarify these options and give you links to deeper resources on each subject.

Visit the original post on TechNet Edge which has links to the other 4 videos in the series

ADMX policy missing or blank - bug

David Tesar — Sat, 11 Apr 2009 02:48:00 GMT

When you create a policy with a custom ADMX template which uses a registry key outside of the standard 4 recommended locations (below) and open up your group policy editor using gpedit.msc, the policy will not be listed and you will get no error. The workaround is to use the group policy editor which comes with the group policy management console (i.e. right click on a policy in the GPMC.msc and choose edit). This one wasted a bunch of my time wasted, so hopefully you don’t have to go through the same.

Recommended Group policy locations:

HKLM\Software\Policies (computer settings, the preferred location)

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies (computer settings, an alternative location)

HKCU\Software\Policies (user settings, the preferred location)

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies (user settings, an alternative location)

One other note - this bug appears to have already been fixed in Win7 & Server 2008 R2.

Silverlight Installation Switches

David Tesar — Fri, 03 Apr 2009 01:55:00 GMT

Below is a list of all of the Silverlight 1, 2, and 3 installation switches available and their description. This will be included in the Silverlight Enterprise Deployment guide v2 which I’m writing - to be released soon. In the mean time, here they are for your assistance:

The Silverlight install executable file has a number of different switches to customize the installation. The syntax of the setup file is as follows:

Silverlight<version>.exe

/q = quiet install or upgrade. This installs or upgrades Silverlight without seeing the GUI. When Silverlight is installed quietly, by default privacy related features such as DRM protected media playback and the Silverlight auto-update feature will be configured to prompt the user for permission on 1^st use of the respective features. The Silverlight auto-update feature requires administrative rights so non-admin users will not be prompted.

/doNotRequireDRMPrompt = turns off the 1st use prompt allowing DRM Playback without requiring any end-user intervention. This setting is automatically included when the quiet install switch is used. By default, DRM Playback is set to prompt on 1st use.

/ignorewarnings = non-fatal warnings will not be reflected in the quiet installer return code but will instead return zero indicating success. This is useful if in testing or custom installation software requires a zero return code.

/noupdate = disables the Silverlight internal auto-updater. The Silverlight auto-updater requires administrative rights, so in environments where users have admin rights this switch may be used to prevent administrative users from being prompted to install updates if you want to control when updates to Silverlight are distributed. Group policy can also be used to implement this setting via a custom ADMX (see Silverlight Deployment Guide)

/qu = quiet uninstall. This uninstalls Silverlight without seeing the GUI. Note: This will only uninstall the exact same version that it installed, so is typically only useful for testing scenarios.

Note: The /doNotRequireDRMPrompt and /ignorewarnings switches are only available with the version of Silverlight 2 GDR 2 (KB 960353 / 2.0.40115.0) or later.

IE 8 ClickJacking and security PM interview

David Tesar — Mon, 30 Mar 2009 21:27:00 GMT

I interviewed Kymberlee Price, IE security PM responsible for future research with ClickJacking. She gives us insight into what research the team is doing in this area as well other great insights into IE security.

For a complete breakdown of the contents of the interview, please view this post on TechNet Edge. Also, you can check out a great post Kymberlee wrote about ClickJacking on the IE blog.

Internet Explorer 8 event for IT Pros and Developers

David Tesar — Fri, 13 Mar 2009 20:19:00 GMT

Attend the Internet Explorer 8 FireStarter event on Thursday, March 26th and learn the core of what all IT Pros and Developers need to know about IE 8. You will gain a deeper understanding of the new features, security, deployment best practices, compatibility and migration, and where IE stands with the competition.

Get the breakdown of the speakers and agenda at the following registration links:
Register for the local event in Redmond, WA or Register for the virtual event

You can also check with your local user group affiliated with INETA or Culminis (with support via User Group Support Services) to see if they will host a live streaming of this event of or host a re-delivery sometime after the event. Virtual attendees for the live event will be able to ask questions to the speakers through Live Meeting.

If you're able to attend the event in Redmond, there are plenty of things to give away for each of the attendees:

- Thrive Voucher/Card – Valid for one Microsoft Certification OR 1 TechNet Subscription
- IE8 Mug
- IE8 Sticky Notes
- Expression Blend Copies (Trial)
- TechNet Edge tee shirt
- TechNet Edge Sticker
- Pen

Also, we will be raffling off:
- (1) Zune
- (20) IE 8 Fleeces

This event has a limited number of seats and virtual attendees, so register now to reserve your spot!

NOTE: on the day of the event, please visit Mithun's blog if you desire to have an interactive chat session outside of Live meeting.

IE 8 on Windows 7

David Tesar — Tue, 10 Mar 2009 18:35:00 GMT

Wonder why you can't independently update Internet Explorer 8 on Windows 7? We discuss this and a number of other interesting topics with Jane Maliouta, program manager at Microsoft who is responsible for setup and deployment of IE8. View the detailed breakdown of the topics covered, download the video, or comment on the original post for this video on TechNet Edge. Note: the Windows 7 Beta (Build 7000) has a beta IE 8 build from ~October 2008.

Watch all of the TechNet Edge videos on IE 8
Download and Install IE 8

Server 2008 / Vista SP2 CPP released

David Tesar — Wed, 03 Dec 2008 03:39:00 GMT

Today Windows Server 2008 and Vista released Service Pack 2 (pre-RTM) through the Customer Preview Program (CPP). MSDN and TechNet subscribers can download the SP2 CPP now, everyone else will have access this Thursday 12/14.

What’s pretty interesting is for the first time the same single service pack files can be deployed across the server (Server 2008) and the client (Vista SP1). Will this capability add any value in your organization or is it only a “that’s neat” type of response?

My colleague, Joey Snow, wrote up a good summary of what’s included with it and links to resources – which you can view his blog post on Edge.

OR go straight to download and evaluate the Vista SP2 / Server 2008 CPP beta bits

Bing vs Google vs Yahoo Search

David Tesar — Sat, 22 Nov 2008 07:15:00 GMT

Want an easy way to know if Bing, Yahoo, or Google search will return better quality results? There is an easy way to do this using this site: http://www.mysearchoff.com. It’s great to get simultaneous results from all three engines in a single page. I found this very useful when doing search engine optimization for keyword terms – you can figure out the ranking and see what the page looks like without doing 3x the work. Also, you can vote on what search engine results you think "wins" by clicking on the green checkbox icon in the top right and see the results of peoples' votes.

Also, another site MS employees use to compare Bing to Google (side by side) is http://www.searchvote.com. Our internal one doesn't give any results for Yahoo and in my own opinion is not as good as the public - mysearchoff.com mainly because it has a voting/results feature and is more easy to display the results b/c you can resize the window.

Personally, I like the friendlier display output of Bing Search better than Google Search (i.e. do a search on Barack Obama). Typically Google will have a larger number of results, but IMO this doesn’t matter since you don’t ever really get past the first few pages of results and the Bing Search results are quality for those 1st pages the large majority of the time (and sometimes better than Google's). Try it out for yourself and see!

If you want to provide written feedback to Microsoft about Bing, you can send it via this link: https://feedback.live.com/default.aspx?productkey=wlsearch

On a side but related note, Bing Search gives you cash-based incentives to simply use their search engine (called SearchPerks!) and also cashback on products you purchase through Bing Search. I'm not sure if this will help increase Live Search's ~8% market share of the search engine business, but it's certainly worth mentioning!

Update 12/12/08 - you can check out the Fall 2008 improvements made to Live Search by watching the video on Channel 10.

Update 7/23/09 - updated this post to reflect the name change from "Live Search" to "Bing". Also, there is another comparison site between Bing and Google I became aware of: http://www.bing-vs-google.com/

Windows Server 2008 R2 features

David Tesar — Wed, 29 Oct 2008 03:24:00 GMT

Microsoft disclosed Windows Server 2008 R2 today at PDC for the 1st time today. Here is a short summary of some of the new cool features in 2008 R2:

Virtualization

R2 Hyper-V - client virtualization when used with Virtual Desktop Infrastructure (VDI), improved management via PowerShell 2.0 cmdlets, enhanced admin console, and integration with SCVMM
Live Migration – No downtime to migrate VHDs between Hyper-V servers
Presentation virtualization - remote apps look exactly the same as running locally, web page login for RAD (RemoteApp and Desktop), RAD control panel to connect to multiple machines

Windows 7 & Windows Server 2008 R2 better together

Direct Access – no longer will you have to use VPNs, a seamless experience when transitioning between intranet and internet
Improved RAD (RemoteApp and Desktop) experience – original high-quality audio redirection, multi-mon, video synced, and audio input recording
Branch Office - BranchCache™ server significantly reduces bandwidth by caching frequently used content
Bitlocker on removable drives – keep the data on your USB flash or eSata drives secure

Management

PowerShell 2.0 – easily remotely run scripts on multiple machines
More options for power management – Automatically and dynamically reduce the number of processor cores used (Core Parking) and/or their processor speed / power consumption
AD updates – easily recover deleted objects, easier to perform common tasks
Best Practices Analyzer (BPA) - built-in for each server role to help ensure proper & optimal configuration

Web

Full .NET support on Server Core
Easier administration – manage your SQL databases within IIS, integrated powershell task automation, built-in configuration editor
FTP enhancements – FTP over SSL support, IPv6, virtual FTP sites

Scalability & Reliability

64 physical Core Support – and 256 logical cores support for a single OS instance
DNSSEC – verify authenticity of a response from DNS

View the Windows Server 2008 R2 homepage at: http://www.microsoft.com/windowsserver2008r2
Download Windows Server 2008 R2 reviewers guide (Beta) for granular details on the changes.

Mark Russinovich : the future of Windows, security, sysinternals

David Tesar — Tue, 26 Aug 2008 19:39:51 GMT

I had the chance to interview Mark about the future.. One thing he answers is - do you think we should or need to just scrap the windows code base and start over? A breakdown of everything which was covered can be found on Edge.

Interview with Mark Russinovich: the future of Sysinternals, Security, Windows

Next operating system after Windows: codename Midori

David Tesar — Fri, 01 Aug 2008 03:12:39 GMT

The Midori I'm talking about is not an alcohol; it's an "incubation software project" at Microsoft research to try and address the upcoming trends with technology and inherent limitations with the current Windows code base. For instance, making the operating system more easily and automatically take advantage of a "common desktop of the future": 256 cores, 1 TB of solid state memory, and unlimited storage space and computing power in the cloud. The estimated time frame on when this project will be complete cannot be disclosed, but it certainly will be long after Windows 7 is released.

Of course I can't tell you any more than what was leaked about this project, but read David Worthington's article which is a summary and an interesting read.

DFSR and Bitlocker work together + performance tests

David Tesar — Thu, 17 Jul 2008 22:42:34 GMT

As far as I can tell, there isn't anywhere on Microsoft's sites or documentation which state DFS + Bitlocker is supported or works in Windows Server 2008. The DFSR FAQ mentions DFSR does not work with EFS, but does not mention Bitlocker. This is the case more than likely due to Bitlocker being so far below any user-mode application that the applications (such as DFSR) simply do not know that it exists. Consequentially, testing is not needed for every single scenario of Bitlocker + <app>. Microsoft does officially support the DFSR + Bitlocker combination on Server 2008.

Ned Pyle, a Microsoft enterprise support engineer, volunteered to do some performance testing of Bitlocker + DFSR. The net result was Bitlocker+DFSR worked great. However, there was a ~%25 degraded performance in replication time with Bitlocker turned on. This is to be somewhat expected due to the overhead of encryption, however, having a faster disk subsystem than what was tested with will more than likely significantly improve performance with Bitlocker enabled and reduce this gap. Again - please keep in mind this is a worst-case scenario considering the given hardware and configuration.

Here are the detailed results from the testing:

Environment used:

Win2008 Enterprise
Hardware - 2.4Ghz Quad Core, 4GB RAM, single 250GB non-SATA IDE drive
Default DFSR config, no antivirus realtime scanning running
Effectively worst case from disk perspective (very slow IDE disks shared with OS (%systemdrive% only))
Replication time based on delta between event 4102 and 4104 on downstream.
Between each pass the RG's are deleted as is the replicated folder data
1GBit NIC’s (Intel 82566DM-2 WHQL inbox driver 9.12.17.0)
Switched 1GB network, probably under fairly high load as it’s the NC test lab and is usually moving a lot of multi-cast imaging data all the time.
No hops, same Ipv4 subnet.

Sample data:
5.05 GB (5,432,323,831 bytes)
Data set made up of: 2008 platform sdk, office 2007, visual studio 2008, r2 sdk, vista sdk directories 51,614 files, 5,680 folders

Bitlocker off:
baseline1 - 0h:50m:29s
baseline2 - 0h:49m:51s
baseline3 - 0h:50m:44s
avg - ~50m

Bitlocker on:
bitlocker4 - 1h:05m:14s
bitlocker5 - 1h:07m:25s
bitlocker6 - 1h:06m:10s
avg - ~66m (~25% slower)