John Howard - Senior Program Manager in the Hyper-V team at Microsoft : Windows Server 2000

Malicious Software Removal Tool

jhoward — Thu, 21 Jul 2005 10:50:00 GMT

As much as a bookmark blog as anything else so I know where to find it. You may have seen the malicious software removal tool come down through WindowsUpdate/MicrosoftUpdate. What I didn't know was that a version with the latest updates is released on the second tuesday of every month, and can be run from a web-page here or downloaded and run more often.

The tool works for XP, 2000 and 2003. The KB describing the tool is 890830, also updated monthly, and if you are considering deploying the tool within your environment, you should read another KB article, 891716. This KB describes the mechanisms for deploying through WSUS, SMS and Group Policy. However, remember that this tool should be considered supplementary to another solution such as anti-virus. Lots of layers help though.

Understanding Active Directory in the Real World

jhoward — Thu, 23 Jun 2005 18:23:00 GMT

For those of you who are available on Monday (27th June), this is a reminder that there is an all-day Technet event running at Cavendish Conference Centre in London about how you can deploy, manage, migrate-to, secure and extend the value of your directory platform. Myself and two colleagues from Microsoft Consulting Services (MCS), Mark Cribben and Mike Brannigan, both Active Directory experts, will be on stage presenting. Demand has been very high for this, but there are still a handful (and I really do mean handful) of spaces left only.

To register for this free event and to find out more information, click here. Hope to meet you there.

Windows Server Update Services (WSUS) Release Candidate is now available

jhoward — Wed, 23 Mar 2005 11:32:00 GMT

Someone made a more appropriate choice of name (thankfully!) given some of the alternatives which have been on the table over the past few months. The next version of SUS (Software Update Services) will be officially called Windows Server Update Services (WSUS), or simply Update Services for short.

Updates services is a free of charge update for licensed users Windows 2000 Server and above, intended for all businesses from small through to enterprise to be able to update Microsoft Software. Here's the link to download the release candidate of WSUS which was made available for public download last night. There is also some great documentation at this link for deployment, operations and a step-by-step guide.

WSUS is a huge step forward over SUS and I cannot recommend enough that you take a look at this technology if you haven't already done so. One cautionary note to though currently on the older WSUS Beta 2 release - you should upgrade to the RC as soon as possible as Beta 2 is no longer receiving any new updates.

Account Lockout Tools for Active Directory

jhoward — Wed, 23 Mar 2005 04:21:00 GMT

I should have posted this previously, so apologies to those who attended my recent session on AD Troubleshooting, Diagnostics and Recovery. Relating to the demonstration for registering and using the AcctInfo.dll to add a new tab to the Active Directory Users & Computers tab for users, the account lockout tools can be downloaded from here. Once downloaded, you need to copy AcctInfo.dll to an appropriate place (such as \windows\system32) and register it (Start/Run regsvr32 c:\windows\system32\acctinfo.dll). Restart ADU&C, and open a user object. You will now see the new tab appear to assist in resolving account lockout issues.

Post domain migration - removing sidHistory

jhoward — Fri, 18 Mar 2005 16:50:00 GMT

After a successful domain migration, you may be in a situation where it is necessary to remove the sidHistory attributes from objects in your new domain. There are many ways to do this, and many migration tools provide that capability straight out of the box. You could of course use something like ADSIEdit to manually edit each object, but this can be time consuming if there are more than a handful of objects to update.

I've just been through the process of a domain migration on my home setup, and being a bit of a scripting junkie didn't want to go through a manual update process (even though there were only five accounts being migrated). I used a variation of the script in knowledgebase article 295758 which performed the job admirably. Admittedly, it took me longer than a manual migration would have done when there were only five accounts, but if you're in the hundreds or even thousands, this script could save you a lot of time.

Active Directory diagnostic event logging in Windows Server

jhoward — Sat, 12 Mar 2005 04:40:00 GMT

I mentioned at last nights "Active Directory Diagnosis Troubleshooting and Recovery" Technet session how to turn NTDS diagnostic logging on which causes the KCC to write events to the event log. All the information plus more besides is published in Knowledgebase article 314980.

Active Directory Database monitoring using ESENTPRF.DLL

jhoward — Fri, 11 Mar 2005 22:41:00 GMT

One of the demonstrations at last nights "Active Directory Diagnosis, Troubleshooting and Recovery" Technet session included the steps to install esentprf.dll to allow monitoring of performance counters for the extensible storage engine (ESE) database underlying Active Directory. The steps to complete this can be found in Chapter 9 of the Windows 2000 Server Active Directory Planning and Deployment Guide - post deployment monitoring of domain controllers. Although this document was written for Windows 2000, the procedure outlined works just as well for Windows Server 2003 as you saw. Here's the link.

Extending the Active Directory schema

jhoward — Thu, 10 Mar 2005 00:59:00 GMT

There are occasions when you need to extend the Active Directory schema for applications. Besides the best practice of test, test and test again, and the alternative of using ADAM (Active Directory in Application Mode) to avoid changes to your corporate schema, sometimes needs must. In these occasions, you should apply for unique OIDs (Object IDs) which can be done through MSDN at Microsoft where you can have OIDs registered guaranteed to be unique in the microsoft.com namespace. You can of course register OIDs in your own namespace too.

Follow these links to find out more: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ad/ad/obtaining_an_object_identifier.asp and http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ad/ad/extending_the_schema.asp

Common mistakes when upgrading domains from Windows 2000 to Windows Server 2003

jhoward — Tue, 01 Mar 2005 22:34:00 GMT

In my line of work, I talk to lots of people about the "hows" of upgrading to the latest and greatest technology. Consequently, I've referred many people to the link below which is a great source of tips and links to other information worth considering when upgrading your domain from Windows 2000 to Windows Server 2003. It's had a recent refresh, so I recommend a re-visit if your upgrade is pending.

http://support.microsoft.com/Default.aspx?id=555040

Scriptomatic (revisited)

jhoward — Mon, 07 Feb 2005 16:42:00 GMT

The Scripting Guys released version 2 of their "Scriptomatic" tool a couple of weeks ago. Don't be put off by the somewhat frivolous name - it has some very true value. One such example I frequently use is for the WQL queries in WMI filters when building Group Policy Objects - this tool saves a lot of effort. The sequel is a completely new. However, this time, it doesn't write just VBScript, it can output in Perl, Python and JScript. Go take a look - you'll be glad you did. It works from Windows 98 right through to Windows 2000 (but you'll need to install WMI 1.5 Core for 98/NT). Oddly though, Windows Server 2003 isn't in the list of supported operating systems for Scriptomatic. I can confirm it works for me under WS2003 so far. Odd!

Here's the download link.

PKI and Certificate Management Information in Windows Server 2003

jhoward — Wed, 02 Feb 2005 22:16:00 GMT

While on the subject of Certificates/Encryption/IPSec/PKI in general yesterday, I was looking around for some good information on how PKI works to post up. One white paper which stuck-out from the pile was published in December last year (so it's reasonably up to date) by David B. Cross and Avi Ben-Menahem entitled "Key Archival and Management in Windows Server 2003". Now this isn't exactly going to be a best seller, but I found it very easy to read and understand, so all kudos to David & Ali. Joking aside, it is crucial to pay consideration to this subject if you are planning to implement or already have implemented a certificate authority within your organisation.

For further info on PKI in general, this link is a good starting point. The home page for Cryptography on Technet is here and information on EFS (Encrypting File System) in XP and Windows Server 2003 can be found here. Otherwise my colleague Steve Lamb will be able fill in the gaps.

Group Policy - Tips Tricks and Best Practices

jhoward — Mon, 24 Jan 2005 04:08:00 GMT

Following my session in Birmingham on 13th January, here's a list of the references I referred to. Apologies to all for the delay in posting this. Firstly, Jeremy Moskowitz's excellent book "Group Policy, Profiles, and Intellimirror for Windows 2003, 2000 and Windows XP" can be found on Amazon.

1	Redirecting the Users and Computers Containers in Windows Server 2003 (KB324949)
2	Group Policy Common Scenarios Using GPMC
3	Scriptomatic Tool
4	Staging Group Policy Deployments (Chapter 3, Windows Server 2003 Deployment Kit - Designing a Managed Environment Book) (URL Fixed 25/1/2005)
5	Monitoring and Troubleshooting the File Replication Support Webcast: DNS In the Active Directory Part 2: Best Practices, Common Problems and Troubleshooting
6	File Replication Service (FRS) – includes Sonar and Ultrasound
7	Group Policy Settings Reference Spreadsheet (with history)
8	Cross Forest Logon, Loopback and User Policy Logon (KB 823862)
9	Recommendations for Managing Group Policy Administrative Template Files (KB 816662)
10	Client, Service and Program Incompatibilities That May Occur When Modifying Security Settings and User Rights Assignments (KB 823659)
11	Threats and Countermeasures: Security Policy Settings in WS 2003 and XP
12	Adding Domain Groups to Local Machine Groups on Member Computers (KB 810076)
13	Troubleshooting Group Policy with Windows Server 2003

Windows Task Manager - Alternate View

jhoward — Mon, 10 Jan 2005 11:43:00 GMT

This is one of those small almost unheard of "things you can do in Windows" tips.
The left image below is a "normal" Windows Task Manager screen shot.
If you double-click anywhere in the graphical part of the tab, it changes appearance to the screen on the right.

Click image to enlarge.

You can also do this on the networking tab. Not sure how much mileage you'll make of it, but it may be useful.

ActiveSync 3.8 Download - new release now available

jhoward — Sun, 09 Jan 2005 17:06:00 GMT

ActiveSync 3.8 is now available for download

Of course, the official download page doesn't say anything about being supported under Windows Server 2003 (my main laptop OS), but it does work without any of the workarounds such as those I blogged about last month on an RTM build. At least it does quite happily sync to a Window Smartphone, the only working "syncable" device I have.

Download link: http://www.microsoft.com/downloads/details.aspx?FamilyID=d2645c21-8a85-45a2-8d13-653beb6cdddc&DisplayLang=en.

Found via Angus Logan

Do I have local admin rights? Find out how in three mouse clicks (or two keys plus a mouse click)....

jhoward — Fri, 07 Jan 2005 03:48:00 GMT

I use this quick-tip frequently to determine if I'm a local administrator. The trouble with some tips is that you just know them, they're so simple so you don't bother to tell people as you're under the assumption they "must have known that". This exact circumstance happened today in the office when a colleague was having problems installing some software. They thought they had local admin rights, but didn't.

Click 1: Right-Click My Computer
Click 2: Select Properties
Click 3: Select the "Computer Name" tab

If the "Change" box is available, you're a local administrator. If it's greyed out, you're not. It's that simple.

So as to combine one tip into two, if you didn't know, you could change Clicks 1 and 2 above with 2 keyboard hits: Windows Key + Break.