eXtreme. tech. : Server 2008

Windows Server 2008 R2 features

David Tesar — Wed, 29 Oct 2008 03:24:00 GMT

Microsoft disclosed Windows Server 2008 R2 today at PDC for the 1st time today. Here is a short summary of some of the new cool features in 2008 R2:

Virtualization

R2 Hyper-V - client virtualization when used with Virtual Desktop Infrastructure (VDI), improved management via PowerShell 2.0 cmdlets, enhanced admin console, and integration with SCVMM
Live Migration – No downtime to migrate VHDs between Hyper-V servers
Presentation virtualization - remote apps look exactly the same as running locally, web page login for RAD (RemoteApp and Desktop), RAD control panel to connect to multiple machines

Windows 7 & Windows Server 2008 R2 better together

Direct Access – no longer will you have to use VPNs, a seamless experience when transitioning between intranet and internet
Improved RAD (RemoteApp and Desktop) experience – original high-quality audio redirection, multi-mon, video synced, and audio input recording
Branch Office - BranchCache™ server significantly reduces bandwidth by caching frequently used content
Bitlocker on removable drives – keep the data on your USB flash or eSata drives secure

Management

PowerShell 2.0 – easily remotely run scripts on multiple machines
More options for power management – Automatically and dynamically reduce the number of processor cores used (Core Parking) and/or their processor speed / power consumption
AD updates – easily recover deleted objects, easier to perform common tasks
Best Practices Analyzer (BPA) - built-in for each server role to help ensure proper & optimal configuration

Web

Full .NET support on Server Core
Easier administration – manage your SQL databases within IIS, integrated powershell task automation, built-in configuration editor
FTP enhancements – FTP over SSL support, IPv6, virtual FTP sites

Scalability & Reliability

64 physical Core Support – and 256 logical cores support for a single OS instance
DNSSEC – verify authenticity of a response from DNS

View the Windows Server 2008 R2 homepage at: http://www.microsoft.com/windowsserver2008r2
Download Windows Server 2008 R2 reviewers guide (Beta) for granular details on the changes.

DFSR and Bitlocker work together + performance tests

David Tesar — Thu, 17 Jul 2008 22:42:34 GMT

As far as I can tell, there isn't anywhere on Microsoft's sites or documentation which state DFS + Bitlocker is supported or works in Windows Server 2008. The DFSR FAQ mentions DFSR does not work with EFS, but does not mention Bitlocker. This is the case more than likely due to Bitlocker being so far below any user-mode application that the applications (such as DFSR) simply do not know that it exists. Consequentially, testing is not needed for every single scenario of Bitlocker + <app>. Microsoft does officially support the DFSR + Bitlocker combination on Server 2008.

Ned Pyle, a Microsoft enterprise support engineer, volunteered to do some performance testing of Bitlocker + DFSR. The net result was Bitlocker+DFSR worked great. However, there was a ~%25 degraded performance in replication time with Bitlocker turned on. This is to be somewhat expected due to the overhead of encryption, however, having a faster disk subsystem than what was tested with will more than likely significantly improve performance with Bitlocker enabled and reduce this gap. Again - please keep in mind this is a worst-case scenario considering the given hardware and configuration.

Here are the detailed results from the testing:

Environment used:

Win2008 Enterprise
Hardware - 2.4Ghz Quad Core, 4GB RAM, single 250GB non-SATA IDE drive
Default DFSR config, no antivirus realtime scanning running
Effectively worst case from disk perspective (very slow IDE disks shared with OS (%systemdrive% only))
Replication time based on delta between event 4102 and 4104 on downstream.
Between each pass the RG's are deleted as is the replicated folder data
1GBit NIC’s (Intel 82566DM-2 WHQL inbox driver 9.12.17.0)
Switched 1GB network, probably under fairly high load as it’s the NC test lab and is usually moving a lot of multi-cast imaging data all the time.
No hops, same Ipv4 subnet.

Sample data:
5.05 GB (5,432,323,831 bytes)
Data set made up of: 2008 platform sdk, office 2007, visual studio 2008, r2 sdk, vista sdk directories 51,614 files, 5,680 folders

Bitlocker off:
baseline1 - 0h:50m:29s
baseline2 - 0h:49m:51s
baseline3 - 0h:50m:44s
avg - ~50m

Bitlocker on:
bitlocker4 - 1h:05m:14s
bitlocker5 - 1h:07m:25s
bitlocker6 - 1h:06m:10s
avg - ~66m (~25% slower)

Windows Server 2008 – AD Auditing Enhancements

David Tesar — Thu, 29 Nov 2007 03:50:00 GMT

I hope this post will act as a good reference point to be able to quickly understand the good and bad about new AD auditing enhancements and then enable you to dive deeper at will using the links in this article.

There’s nothing more exciting than auditing right? Well, check this out and hopefully it will spark some interest.

In Windows Server 2003 R2 and prior, the auditing of active directory certainly has not been a strong point. You would enable or disable global AD auditing for success or failures, set a SACL on the objects you wanted to monitor, and then typically one or both of the following would happen:

Your security event log fills up with way more security events than you’d ever hoped for, possibly wrapping or ballooning the size of the security log.
Auditing doesn’t actually provide enough information for you to make any use of the events which are recorded in the security event log. i.e. it only says who was successful at modifying the object, but nothing on the details of the value(s) which were changed.

In Server 2008, we are on a good path to fix this pain. Some of the key improvements to AD auditing are as follows:

You can limit the number of attributes which are audited for object types. For instance, you only want to know if the Employee’s Pay Level attribute is modified for all user accounts and nothing else.
Auditing is now broken into four categories: Access (same as 2000/2003), Changes, Replication, and Detailed Replication. The most interesting come from the new changes category:

AD DS logs the previous and current values of the attribute. If the attribute has more than one value, only the values that change as a result of the modify operation are logged.
If a new object is created, values of the attributes that are populated at the time of creation are logged.
If an object is moved, the previous and new location (distinguished name) is logged for moves within the domain. When an object is moved to a different domain, a create event is generated on the domain controller in the target domain.
If an object is undeleted, the location where the object is moved to is logged.

What are the downfalls?

You have to modify the schema in order to limit the number of attributes which are audited per object type. This isn’t really difficult, but it would be nice if there were some friendlier type way to do it.
You cannot view or modify the audit policy subcategories with the Local Group Policy Editor (GPedit.msc). You can only do this with the command-line tool Auditpol.exe.
As far as I can tell, you can’t limit auditing to different specific attributes for a subset of the same type of object. For instance, you would like to audit attributes X, Y, Z for all admin user accounts, but only attribute X for all regular user accounts. Of course you have some control over this with your SACLs…

Get Started:

A screencast on How to enable granular AD auditing in WS08 (coming in the future from me
Windows Server 2008 Auditing AD DS Changes Step-by-Step Guide
TechNet - AD DS: Auditing
Windows Networking Site AD enhancements overview
MS Directory Services Team Blog Posts on:
WS08 Auditing Enhancements and Cool Auditing Tricks in Vista and 2008

Please comment on the same post on TechNet Edge.

Technorati tags: Windows Server 2008, AD, Active Directory, Auditing

IT Pro Momentum Program (like a TAP or RDP)

David Tesar — Tue, 27 Nov 2007 02:21:00 GMT

Would you like to learn about or use Windows Server 2008, SQL Server 2008, or the next version of Forefront Edge? If you're based in USA and 'fit the bill', I'll get you an invite to the IT Pro Momentum portal. If you're in Ireland - contact Dave Northey. You can profile a project which uses one of the above mentioned technologies in your company's environment and receive benefits as your project moves along from Evaluate, through Plan and Pilot. Details below:

And as soon as you're ready to share your experiences with the wider community, let me know and I can help you make that happen (include you in our TechNet newsletter, post details about you on my blog, help you find an attentive audience to listen to you, whatever).

Also, if you have a great story about how your company is already using one of the above mentioned technologies - please let me know and I can help you out too. You can see a quick video of what some existing customers have already done here: Stories of IT Pros adopted new technologies through Momentum.

Please email me if you are interested.

Thanks,

Dave.

Analysis of Windows Server 2008 – AD Snapshot Viewer

David Tesar — Thu, 18 Oct 2007 18:36:00 GMT

This feature is currently known as the “Database Mounting Tool” (DMT), which is better than the previous name of “Data Mining Tool”. Who knows what we’ll end up calling this at RTM, but I like the previous name “Snapshot Viewer” the best so this is what I entitled the post.

DMT allows you to quickly take snapshots of your AD database at any point in time and view those snapshots using the LDP viewer of your choice. At first I was extremely excited about this feature, but after realizing the command-line action you have to go through in order to do this (see below), it killed my buzz a little bit. If you compare this to automating ldifde/csvde backups of your AD, I can see these advantages to snapshots:

You can mount a snapshot and attach GUI LDP tools to it. Ldifde/csvde method doesn’t do this.
You can “backup” the entire database in one shot. Ldifde/csvde only allows a single DN or partition per shot.
The ldifde/csvde dump of your entire partition is in clear text and snapshots are not. However, from a security standpoint there’s not much difference considering if someone has the snapshot file they can also open it up but not as easily.

Below is a general process flow for recovering deleted object(s) more quickly using DMT (see step-by-step guide for more details):
1) Create a snapshot of your AD database using the ntdsutil snapshot sub-context menu system.
Note: This can be automated if you so choose.

2) Mount the snapshot of your choice by using ntdsutil snapshot sub-context menu system again.

3) Make this snapshot readable by LDP, ADSIedit, AD Users and Computers (ADUC or dsa.msc), or other LDAP viewers using dsamain.exe (new tool included with WS2008 by default)
Note: At this point, you can view any object/attribute/etc of the snapshot to use for comparison.

Two paths to restore objects (using only MS tools):
4) Export/import the information from the snapshot to recover objects using ldifde/csvde:
a. Utilize the tombstone reanimation process (same as in Server 2003) to recreate the object(s) which were deleted. The ADRestore tool also helps here. b. Restore metadata such as back-links, attributes, etc for those objects by utilizing ldifde

5) Do an authoritative restore of a portion of the objects using NTDSutil (same way as you would in Server 2003). You can restore objects which haven't been already deleted from a DC (i.e. replication hasn't come to this DC yet) via using the restartable AD feature.

Bottom line: DMT is a nice feature to be able to view previous snapshots of your AD, but overall our restore story still doesn't help as great as some of the 3^rd party tools do with AD object recovery (see below).

GET STARTED:
Database Mounting Tool Feature Overview
Step-by-Step Guide for Using the Active Directory Database Mounting Tool in Windows Server 2008
Ntdsutil snapshot command line syntax
Dsamain command line syntax
Microsoft Sysinternal ADRestore tool

Quest’s AD recovery tools
Scriptlogic's Active Administrator

Windows Server 2008 Virtualization released at RC0!

David Tesar — Thu, 13 Sep 2007 19:49:00 GMT

What does this mean? You'll be able to try out using hypervisor. The biggest advantage of hypervisor is that you can run multiple virtual machines on the base hardware (not on top of the OS). For more information about hypervisor, check out this webcast: http://msevents.microsoft.com/CUI/WebCastEventDetails.aspx?culture=en-US&EventID=1032284286&CountryCode=US

for more information on the anouncement, go to: http://blogs.technet.com/canitpro/archive/2007/09/13/wanna-get-your-hands-on-windows-server-virtualization-viridian.aspx

Also, check out an overview screencast on Keith Comb's blog at: http://blogs.technet.com/keithcombs/archive/2007/09/13/windows-server-2008-screencast-virtualization-10-minute-tour.aspx

Server 2008 "Longhorn" Component Architecture diagrams downloads

David Tesar — Tue, 11 Sep 2007 02:29:00 GMT

I finally went through all of the stuff I got at TechEd 2007 and came across a soft copy of those cool Server 2008 color diagrams or posters you may have seen around. I tried searching for them on Microsoft's site, but couldn't find them. So, you can download them from the links below. I must say they make a nice addition to your cube or office wall and it's a GREAT use of that color plotter you have sitting there on idle.

Longhorn AD Component Architecture 2.0.pdf

Windows Server 2008 Active Directory Components.pdf

Longhorn Server Component Architecture 2.0.pdf

One last thing: I know it's lame to say it's been a long time since I've posted... BUT I feel the need to say I was gone for nearly three weeks on vacation to support why I've been so incommunicado. I'm also a strong believer in quality, not quantity of blogs - but if you can have both, of course that's the best.

Also, I did drum up a summary article on the next version of ISA coming out - unfortunately I can't post it yet due to it still being under NDA, but keep checking back for more updates on the product.

Server 2008 Password Policies - PSOs

David Tesar — Thu, 09 Aug 2007 03:06:00 GMT

In Server 2003 or R2 one of the major limitations was the ability to only have one password policy per domain. The product team realized this was a major pain point for many customers, so they hooked Server 2008 up with some new password policy functionality which is available in Beta 3.

In Server 2008, we’ve created the concept of password settings objects or PSOs. Every PSO contains all of the same password-related information you’re familiar with in server 2000/2003 such as lockout duration, minimum password age, etc.

A cool common use scenario: All domain administrators have a more complex password policy while the rest of the users in the domain have a less-restrictive password policy.

So what are some things you can do now with Password policies (PSOs)?
1. Create and link as many PSOs as you’d like
2. Link a PSO to one or more users or global security groups
3. Override a PSO applied to individual user(s) in a group with a different PSO via “ExceptionalPSOs”
4. Create a precedence for the PSO (so one will have a higher priority than another)
5. Delegate who can link or modify individual PSOs to specific users or groups. (Only Domain Admins can create PSOs.)
6. Hide the Password policy settings from the user
7. PSOs do not interfere with custom password filters

What are some of the downfalls?
1. No official Microsoft GUI to set up the policies. There is a 3^rd party tool to do this (link below), but otherwise you’ll have to use ADSIedit to create and manage PSOs.
2. Inability to assign a PSO to a computer or directly to an OU. However, you can assign a “shadow group” to the OU and then manually or script the addition/removal of members who reside in that OU to the shadow group.
3. You must be in Server 2008 domain functional level (all DCs running Server 2008 in the domain). Not surprising, but should be pointed out in case you were thinking you could roll this out in a mixed 2003/2008 domain.

GET STARTED

Step-by-Step Guide for Fine-Grained Password and Account Lockout Policy Configuration

Changes in Functionality from Windows Server 2003 with SP1 to Windows Server 2008 – Page 83

Video Screencast of editing the PSOs manually (no GUI tools)

Command Line Tool to create and manage PSOs (Joeware)

SpecOps GUI tool for PSOs

GUI tool which uses powershell comandlets to manage PSOs by Quest

Fine Grain Password Policy Tool - Another GUI Tool created by a Microsoft Employee

Blog post with Powershell examples on managing PSOs

Get Server 2008 Beta 3

IIS7 on Server Core

David Tesar — Fri, 06 Jul 2007 23:46:00 GMT

Server core is a capability included in Server 2008 which installs the bare minimum to have one or more roles function properly. There were 7 roles available for server core and at TechEd IIS7 was announced as an addition to the list. IIS7 in server core is available in the June CTP and in all future releases of Windows Server 2008. Note: the June CTP was released after Beta 3.

So, why should you care about IIS7 on Server core?
Gain the benefits of Server Core:

Uses less disk space and memory
IIS7 runs well starting at only 512 MB of RAM & the entire install takes up only ~1GB of disk space
Higher security due to reduced attack surface
Less frequent patching
Fewer things to manage

Gain the benefits of IIS7:

Choose only the components you want to install
Support for PHP, Fast CGI, ASP, HTTP(S), and FTP(S) with the version included in IIS7
Ability to edit the XML config files, use the IIS cmd-line tool, AppCmd.exe, and WMI and COM APIs
Web hosting shared configuration

What IIS7 features are NOT supported in server core?

GUI administration tools - this means no IIS manager or the IIS administration tool.
Remote administration – You can’t use the GUI remote admin capability since it relies on .net.
.NET Framework - which means no ASP.NET. This is something the .NET team wants to add and hopefully will be available soon.

For more information on managing IIS7 on Server Core, see the information below.

Get Started

Downloads:
The June CTP release of Server 2008 can be found within your MSDN subscription
If you don't have a subscription, you can play with server core in the Windows Server 2008 B3 public download.

Websites:
http://www.iis.net/iis7/servercore
Server Core Product Team Blog - http://blogs.technet.com/server_core/
Server Core Installation Option of Windows Server "Longhorn" Step-By-Step Guide

Webcasts:
The New Server Core Installation Option in Windows Server 2008 (Level 300) Server Management