Marcus Hass' [MS] Blog

Microsoft Online and SBS 2003

mhass — Wed, 03 Jun 2009 05:16:00 GMT

I have been working with the Microsoft BPOS aka Microsoft Online guys in Enterprise accounts for a while to help big companies migrate to BPOS dedicated. Don’t know what that is? Check out www.microsoftonline.com. To sum it up, it is hosted Exchange, SharePoint, OCS, LiveMeeting, and a few other offerings. For bigger businesses, Microsoft sets up dedicated hosting servers, for small it is multitenant.

I help out a small company from time to time because they have 15 employees and a Small Business Server 2003 environment. They are constantly running out of space on their 5 year old server because mail boxes keep growing because of attachment sizes. These guys are the perfect scenario to migrate to Microsoft Online!

So, I setup a free trial and started loading some of the coexistence tools like email sync and dirsync onto the Small Business server. Well, that was the plan. Turns out, dirsync can’t be run on a domain controller and will only run on Windows Server 2003. I think the BPOS guys missed the Small Businesses aren’t going to have an extra server lying around. How can you miss this scenario when building your tools, especially a segment of the market so perfect for BPOS?

So, they will have to forgo the coexistence and migrate mailboxes in one fell swoop over a weekend, which won’t be pretty over the small network connection they have.

I am sure there are technical reasons, and that's what will be used as an excuse. It just disappoints me when we have really smart guys that miss such a big opportunity to help small businesses.

Windows XP/XPe and Remote Desktop Services Single Sign On

mhass — Thu, 16 Apr 2009 18:03:00 GMT

This week I was working with a retail customer that has plans to place HP Windows XP Embedded devices at their many retail stores. Applications will be served up either locally on the XPe device, through a remote desktop, or through Remote Applications.

There is a slight challenge with this setup because technically Microsoft supports this configuration, but doesn’t give you great tools to setup Single Sign On (SSO). When Vista was first introduced, Microsoft created a new credential manager that could handle SSO for Terminal Server as well as products such as HyperV. Fortunately, the product team also back-ported the credential manager (CredSSP) functionality to Windows XP. While Vista has an easy enough local Group Policy you can edit, Windows XP never got the same treatment. In order to get it to work in XP and XPe, you have to make a bunch or registry edits, which are also not provided in an easy to copy .REG format.

Well, as a service to the public, I have included a text copy of my .REG file below. The information below is provided as-is, no warranty, no support, please don’t cry to me. But, I have tested it pretty thoroughly and it seems to work.

A couple caveats:

If you use a smartcard to authenticate to Windows, no matter how hard you try you won’t be able to get an RDP session to honor your Windows credentials, you will always be prompted for credentials when running MSTSC or a .RDP file. This is counter-intuitive as you would think 2 factor authentication would be more trusted than simple username/password, but it is a known limitation in Windows XP. Citrix does provide their own credential manager that can add functionality here.
One of the registry entries is in hex so you can’t see what it is. It is one of two entries that require you to APPEND the necessary settings for CredSSP to work. If you have other entries for GINA’s or other credential providers, please be careful as this will overwrite them with the default+CredSSP entries

Many thanks to Olga and Sergey on the product team as well as Kevin Martin from HP for their help this week.

References:

http://support.microsoft.com/default.aspx/kb/951608

http://blogs.msdn.com/rds/archive/2007/04/19/how-to-enable-single-sign-on-for-my-terminal-server-connections.aspx

Here is my .REG file, I hope to create an ADM file at some point that I can share. You can go ahead and cut/paste the rest of this blog entry into a text file and rename it to a .REG file.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, credssp.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Security Packages"=hex(7):6b,00,65,00,72,00,62,00,65,00,72,00,6f,00,73,00,00,\
00,6d,00,73,00,76,00,31,00,5f,00,30,00,00,00,73,00,63,00,68,00,61,00,6e,00,\
6e,00,65,00,6c,00,00,00,77,00,64,00,69,00,67,00,65,00,73,00,74,00,00,00,74,\
00,73,00,70,00,6b,00,67,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation]
"AllowDefaultCredentials"=dword:00000001
"ConcatenateDefaults_AllowDefault"=dword:00000001
"AllowDefCredentialsWhenNTLMOnly"=dword:00000001
"ConcatenateDefaults_AllowDefNTLMOnly"=dword:00000001
"AllowFreshCredentials"=dword:00000001
"ConcatenateDefaults_AllowFresh"=dword:00000000
"AllowFreshCredentialsWhenNTLMOnly"=dword:00000001
"ConcatenateDefaults_AllowFreshNTLMOnly"=dword:00000000
"AllowSavedCredentials"=dword:00000000
"ConcatenateDefaults_AllowSaved"=dword:00000000
"AllowSavedCredentialsWhenNTLMOnly"=dword:00000000
"ConcatenateDefaults_AllowSavedNTLMOnly"=dword:00000000
"DenyDefaultCredentials"=dword:00000000
"ConcatenateDefaults_DenyDefault"=dword:00000000
"DenyFreshCredentials"=dword:00000000
"ConcatenateDefaults_DenyFresh"=dword:00000000
"DenySavedCredentials"=dword:00000000
"ConcatenateDefaults_DenySaved"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowDefaultCredentials]
"1"="TERMSRV/*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowDefCredentialsWhenNTLMOnly]
"1"="TERMSRV/*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowFreshCredentials]
"1"="TERMSRV/*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowFreshCredentialsWhenNTLMOnly]
"1"="TERMSRV/*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowSavedCredentials]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowSavedCredentialsWhenNTLMOnly]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\DenyDefaultCredentials]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\DenyFreshCredentials]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\DenySavedCredentials]

On the bench with back problems

mhass — Tue, 05 Aug 2008 02:19:55 GMT

I had been working on a great project with the State of Minnesota (more on that in a future post), when on July 3rd my right leg stopped working. Well it worked, I just couldn't move it without screaming at the top of my lungs.

I was in St. Paul, MN for most of that week and had some minor lower back pain, which started to creep down to my right leg during the week. I flew home Wednesday afternoon, and hung out with neighbors in the evening as the kids rode bikes, etc. I couldn't walk much or stand without wincing in pain. I figured a good night of sleep in my own bed with some Tylenol is what I needed.

I woke up the next morning and couldn't put any pressure on my right leg. My wife rushed me to the Emergency Room where they had to wheelchair me in. Despite the fact that I couldn't walk, the ER doctor looked me straight in the face and said there was nothing wrong with me other than some pain.

The only reason I didn't rip Mr. ER DOC a new one, was that amidst the pain in the car, I called a neighbor of mine who happens to be a radiologist, Dr. Chris McClaughlin. Chris prepared me for the fact that the ER would help me manage the pain, but would not run an MRI which would be required to diagnose what was happening. While I was getting my fix from my dealer, Chris arranged through my doctor to have an MRI that afternoon.

Turns out that after running 3 half marathons and many smaller races, working on a deck, and the rigors of travel, I had a herniated disk. To be specific a herniated L5 disk with Radiculopathy. For those not attending med school this semester, this means that a disk in my spine bulged out and is laying on one of my nerves that go to my right leg. In the figure to the right I circled where the hernia is extended out of the disk (big oval shaped thing above it).

Chris consulted with the on-call Radiologist and my primary doctor on the diagnosis from his home. After a few days of heavy duty pain medication and a dose of steroids to reduce the size and affect of the disk, Chris showed me some of the technology that allows him to do view these from home as well as the extent of my injury. He typically doesn't diagnose things from home, and is usually in an office with very expensive, high end monitors and speedy networks. They are all digital, so they can read images from multiple hospitals at once.

To allow him to see it from home, he uses a SSL based portal that he helped create since he is one of the IT guys in his practice. He selects the patient records, and then can view the MRI from different angles. It takes longer from home because the MRI's are broken down into a series of high resolution images that need to be cached. Once they are cached he flips through them with a trained eye to look for abnormalities. As he does it, I can't make heads or tails of it, and it reminds me of many of us (geeks) as we scan code or scripts. Once he saw the troubled area, he slowed down and explained to me all about my spine, the disks, how the nerves in your leg work, etc. I am really appreciative that he could explain what was going on at this level of detail. I learned long ago that I have a lot more anxiety about health issues if I don't understand what is going on, and what the goals might be to resolve them.

I have a choice; Physical Therapy or Surgery. After discussing these options with my doctor and Chris, and the outcomes are generally the same, physical therapy was the only choice. Physical Therapy takes longer, but is affective in shrinking the disk back into shape. Surgery is quicker, but much more risky.

I am doing physical therapy, and have made a lot of progress. I don't have pain anymore, and tried to get off the heavy duty medication as quickly as I could. We are working on getting all the tingling and numbness in my pinky toe to go away. This involves exercise pretty much every hour, and hanging from an inversion table several times a week. Once I have 10 full days where I don't have symptoms from the nerve, I can start traveling and lifting small objects.

So, I am here locally in Denver, trying to work on what I can. Unfortunately, I was let go from a great project in Minnesota because my role required customer face-to-face interaction. I wish them the best of luck.

My iPhone 3G Review

mhass — Thu, 31 Jul 2008 18:57:00 GMT

Call me a traitor. Call me weak minded to the Apple Jedi mind trick. Yes I have a 3g iPhone, the cheapest one of course.

My Treo 750, which I really liked, was starting to have some battery fade. In addition, I was using the IE browser on my Treo more frequently, with more and more contempt for IE on the phone. I had loaded an experimental browser on it a while back called Deepfish, and it was great (very similar to the abilities of Safari on the iPhone). But, Deepfish was canceled as a standalone project and will probably be incorporated in a future version of Windows Mobile.

So, I was stuck using the "diet" version of IE on my phone, which made me want to pitch it for distance at times.

I was indoctrinated to the iPhone during a charity event for the Leukemia and Lymphoma society where I took many pictures using people's iPhones as proof they made it to a checkpoint along a race. I had to fumble into menus on the iPhone, and was instantly hooked by its interface and most of all its Safari browser, even though it was the Edge version at the time.

The stars aligned and I ordered one. Below are a few observations (please note that I don't care about iPod functionality because my Zune is way, way better).

Pros:

Now with Exchange Active Sync (EAS), see cons section for some quirks with EAS
EAS means security policy pushed from Exchange server, ability to remote wipe if lost
Safari browser rocks!
Overall Interface is excellent
GPS and Google maps integration
Camera is pretty good, interface for pictures is excellent
Good Facebook application add-in
Haven't had issues with it unlocking keys randomly in my pocket like I did with a "key locked" Treo
Better interface to read emails than on the Treo, especially expanding the reply list.

Cons:

Battery life, can't make it an entire day even with Wifi turned off
I miss Voice Command!!! I got used to not taking my phone out of my pocket/holster and using voice to call someone and it telling me who was calling. This might be coming in the near future from the application store.
Can't sync individual folders with EAS, it is "last 200 of items". I have a folder with all my travel plans and it usually isn't in the "last 200 items"
Calendar sync is screwy. Even though I accept an appointment in Outlook, the phone insists on me accepting it again.
Can't query other's calendars
Attachments aren't automatically downloaded, only when you click on them
Some applications from the application store are deemed "too big" so you have to use iTunes to download them. I have an all-you-can-eat data plan, why can't I use my 3g connection?
Smudges, grease spots, makeup (not mine of course). All inherent with a touch screen, reminds me of the old TMo XDA
One handed navigation was a Treo trademark, and still is. Apple can't match its one-handidness
Can't flip things like email on its side for reading. Only browser and camera seem to flip on their side.
GPS isn't real GPS. I believe it must use cell towers or something because it isn't nearly as accurate as my Garmin. Probably a fix in the future...

Verdict:

The browser alone is worth it, I can live with all the quirks
Apple needs to actually pick up a Windows Mobile phone and use it like millions of WinMo customers have been for years. Take some notes, and refine the experience more on the iPhone.
Where can I get an extended battery? Oh wait....

Note: If you have solutions to any of the issue or quirks, please post a comment.

Update: Added Con about querying calendars and con about attachments.

New Role for Mhass

mhass — Tue, 22 Apr 2008 08:09:59 GMT

So I finally rolled off my last gig, which had occupied me for the last 18 months. In the last 18 months, I learned a lot about how my customer did business, and thanks to a great account team, learned how Microsoft does business.

I liked the business aspect of the job a lot, enough to inspire me to move to a new team. I have moved onto the West Architecture team and will be working with customers throughout the Desert, Mountain, and SoCal parts of the US. It includes working with CIO's and VP's at numerous customers and helping account teams figure out how Microsoft can help them solve customer problems. I hope to be involved in a lot of sales cycles from initial talks all the way to implementation, ensuring that out technologies are deployed the best possible way.

Sounds kinda like a sales guy, sorry about that....

Automated install of Outlook Conferencing Addins

mhass — Wed, 13 Feb 2008 23:59:00 GMT

My customer (Mike Vrabel) and I got completely frustrated today in trying to find a way to deploy the Outlook Conferencing Addin for Live Meeting 2007 via SMS. The Office web site gives you a ConfAddins_Setup.exe which is neither an MSI or provides you switches for automated install or answer file.

Some digging turned up a solution:

1. Copy confAddins_Setup.exe to a local directory on your test PC
2. Open a command prompt (if Vista make sure the command prompt is administrator elevated)
3. Using the command prompt navigate to the directory where confAddins_Setup.exe resides
4. Type the following command line - "confAddins_Setup.exe -out <drive>:\<folder path>"
5. Step 4 should have extracted the LMAddinPack.msi file
6. From the directory that contains LMAddinPack.msi install the Addin from the command line using the following command line "msiexec /i <filename.msi> /qn"

You can then use the normal MSI command line switches to deploy silently, just make sure to kill Outlook on the target machine first:

msiexec /I LMAddinPack.msi APPCONFLICT=IGNORE /qn

Sony is brilliant, PS3 may surpass Xbox 360 in the future

mhass — Mon, 04 Feb 2008 20:44:00 GMT

The reason has nothing to do with games. Pretty much, all games are available on all platforms.

The reason is Blue-ray. Is Blue-ray the best technology? No. Is it the cheapest? No. Is the PS3 a cheaper and better Blue-ray player than stand alone players? Yes. Not only is it the cheaper or the same price as stand alone players, but it is easily upgradeable as new Blue-ray standards come about.

The reason that Sony is brilliant is that they concentrated on incentives to the film distributors rather than low price. By securing content via incentives, they crushed HD-DVD, and no price cuts on Toshiba players are going to salvage HD-DVD. Game over, nice try.

This also means that over the next year or two, people will be buying a PS3 as their HD content player. There is a perfect storm brewing as analog TV signals are phased out, people are upgrading to HD TV's, and at the same time picking up a Blue-ray player.

Oh yea, that Blue-ray player also plays some games....

[Update] Fixed an auto spell correct error.

CES: Tuesday

mhass — Wed, 09 Jan 2008 08:28:27 GMT

I got a chance to walk through most of the show today, my frackin' feet still hurt and my shoes have been off for a few hours.

If you are still at CES, check out the Neonade booth, free massages. I don't know what they do, but I saw the massage chairs
Dolby had a massive replica of Bumblebee the Transformer, I am going to get a picture tomorrow
Oh, about pictures. The CES web site says Media cameras only. Not true. Everyone and their grandma has their digital cameras and camcorders out
Vantage point was kinda cool, it is to help you hide all the wires behind your flat screen and audio screen. They also had an oxygen bar.
I want a Windows Home Server
The big thing at CES this year is the ultra thin LCD, just remember that the tuner and stuff isn't integrated into the display
Dbox is totally cool. It is motion simulator for both couches and for car simulators. Both the stuff for furniture and the race car is cool. I got to do a few laps in the cars and liked it, would be nice if they could get it to work with consoles like Xbox
Every single flat screen demos their screens using Blue Ray, no mention of HD-DVD. See my previous post about the death of HD-DVD.
THX isn't as impressive since they were sold from Lucas Film. They were showing a cool way for input displays to pass metadata between so the display automatically adjusts to the appropriate format. Let's hope someone notices.
The SYNC stuff that Fords are using in their cars is totally cool. I hope that more manufacturers adopt it.
People should not text and walk. Please pull over and text/read email.
I think my next major purchase will be either a Sharp Aquos or Panasonic 50" LCD

I wish I could post some pictures, but I don't have a CF reader with me. I will post some as soon as I can.

HD-DVD going the way of Beta Max?

mhass — Tue, 08 Jan 2008 10:23:00 GMT

It is starting to feel like HD-DVD has lost. With Transformers only available on HD-DVD, I thought there was a glimmer of hope, but I am pretty sure the fat lady is singing.

Why? Disney.

I think Disney was the camel that broke the straw back. It is really frustrating that I can't buy my kid's movies on HD-DVD since I only have an Xbox 360, and have to "waste" money in an older format. Buying a Blue Ray player is still not feasible, while HD-DVD players head towards $100.

I could care less about which technology. They only thing that erks me a bit is that it is Sony's proprietary technology.

One walk around CES and it is pretty clear, which one is hyped and winning. HD-DVD may be relegated to "Beta Max", special use status.

CES: Monday Afternoon

mhass — Tue, 08 Jan 2008 03:44:39 GMT

So, I am here at CES 2008, I got a last minute push to come out for some meetings.

I don't plan on doing a blow by blow like Engadget, but I might post some cool stuff I see. I am not actually at the show yet as I have some meetings to attend after flying in just now (4:40 pm).

So far the highlights have been:

Seeing Wee-man from MTV notoriety at the Denver airport
Listening to "The Rocket" secretly tape record his buddy that accused him of being injected with steroids, thank Frontier Airlines for the DTV
The Coke machines take American Express at the LV Hilton!
Walt Mossberg standing on the other side of the glass here at the Hilton

I am headed to the BlogHause tonight, hopefully some pictures tomorrow.

Using Facebook for socializing at work

mhass — Mon, 08 Oct 2007 22:34:00 GMT

I have been reluctant to jump on MySpace, Twitter, etc because it seemed to be so personal focused. I honestly didn't have much I wanted to share with public or even friends that they weren't getting from me and my family directly.

There has been so much buzz about Facebook and it's ability to cater to both it's original college crowd as well as appealing to corporate users. To add to the buzz, there are the constant rumors of Microsoft investing in Facebook. I decided to try it out after some hallway conversations with product team people who said they use Facebook all the time.

So far, I have found it to be addicting at times and completely non-intrusive other times. Here are a few things I would like to highlight.

I like "my wall" as it shows me what is going on with friends, even though they throw in some advertising.
I think Facebook has completely missed the boat on groups as you have to navigate into groups and then "see all". They need to have an RSS feed or "wall" of posts for your groups. I would participate a lot more in my groups if I didn't have to drill into each to figure out they added a discuss or posted on the group wall.
Watch your "security settings". The entire world of Facebook or even my Networks don't need to see everything about me. I limit my profile to friends only, and have very little about me available to the public or even Networks I am in.

I got dinged a bit this year in my yearly review because as a senior person in our group, I should be fostering a sense of community. It's hard to do this if you aren't in the office, you have a family (like most in our group do), or if techies are somewhat anti-social to begin with. Other groups at Microsoft do a lot of stuff together because they all sit in the same hallway/building, but us field people only visit the office to drop off expenses or grab a soda from the fridge before heading to our paying customers.

So, it dawned on me: Why not use an electronic medium to create community? I looked at MOSS 2007, and MySites have a bit of this as well as blogs and wikis. But we would all need to VPN to corporate to have access, and some customer sites don't allow VPN. I also wanted something that is flexible enough for those coworkers that really want to participate, and those that want to "sip".

So, I sent the email below to my group. We have gotten okay participation, and it has been more popular than most of our happy hour turnouts. I have gotten to know a few people that I normally wouldn't, and they can see things about me that they normally wouldn't know from hallway conversations. Feel free to use it as a template if needed.

A (virtual) sense of community

I know, I know, every year we talk about getting to know others in our group better especially those in our particular city. And, every year we start by having a few happy hours that are poorly attended, or host a poker party that 6 people show up for (not holding a grudge or anything).

After 7 years at Microsoft, I have resigned myself to believe that this is part of our culture. Especially for MCS (Microsoft Consulting Services), we are individual consultants working for a great company, but rarely get to work with each other or on a cohesive team. When we are asked to attend a party or happy hour it takes time out of our lives normally reserved for family, customers, exercise, hobbies, Xbox, etc.

That said, we are happier employees when we have a sense of what others are working on and their personalities. In our case, there doesn’t seem to be a direct correlation between camaraderie and revenue, so there isn’t a large investment into making us a closer group. I think a sense of group is more important for employee retention as well as having a network of people to bounce ideas off, answer questions, and have diverse points of view.

We all are unique, and whether we are single, married, divorced, young, old, male, female, goth, or love Hello Kitty, we have different amounts of time to dedicate to getting to know people in our group at work. I think what might work for our group, and groups similar to ours is a type of “RSS feed” of community. The great thing about RSS feeds are:

· You get to pick whether you subscribe to the feed or not

· You get to pick when and how you read it

· You can ignore it for a week, but pick it up later

So, in thinking about how we could create an “RSS Feed”, something hit me in the “face”. Facebook! What is Facebook? It is kinda like MySpace, but it feels much more mature and focuses on companies as well as individuals. There are currently 13,971 Microsoft employees on Facebook and that number has grown 3,000 users in the last few weeks. Facebook uses Networks to determine company affiliation and you must have an @microsoft.com to be in the Microsoft Network. Once you are in a network, you can browse people in the network and request to add them as friends. Once they are a friend you may select to describe how you know them. Your customer might have a network as well, so you can get to know them as well as they get to know you.

I only joined Facebook a few weeks ago, but have already reconnected with many consultants I have worked in projects over the years as well as one or two people that I went to High School with. In fact, I discovered that some of the people that I work with at my customer went to the same High School, so I can leverage those relationships to move things forward. The more you use it, the more addictive it becomes because you realize you have a lot in common with coworkers and customers.

You can set permissions as to how much information is revealed to people in or out of your network, as well as how much your friends can see. There are a bunch of groups on Facebook that have discussion groups, which I don’t think that Facebook has done a great job of integrating into the experience of your “wall” yet. Your “wall” is your homepage that is a lot like an RSS feed that shows things that have changed about your friends. To participate in groups, you have to go into that group page which I think could be integrated much better in to your overall wall.

Other cool things about Facebook is that people are constantly writing applications that do some cool things. I have added the “Cities I’ve Visited”, “My Questions”, “Locations” and “Texas HoldEm Poker” applications which let me compare things with my friends or play against them (outside of work hours of course).

So, why am I telling you about a product that runs on competing platforms and goes directly against some of our properties such as MSN Spaces? Because Microsoft doesn’t have anything that is even close to this integration, and because I think we can all benefit by having a virtual community. The real benefit here is that we can start to see each other’s interests, and leverage our diversities when we need too.

Facebook is one of the biggest users of Microsoft’s advertising engine, and there have always been rumors that we might acquire or invest in them. Why not use SharePoint? Because it doesn’t have the same flexibility, features and you have to VPN to it.

It’s up to you, but if you want to see what the Internet is buzzing about, and have a peak into your coworkers, check out Facebook. Just make sure and keep confidential things where they belong, on Microsoft assets not on Facebook.

Update: I have been getting a few requests for friends on Facebook from strangers, I assum are from this post. Please don't take it personal if I limit my profile to you or ignore your request. Like I said above, I don't want the world to see my profile but am happy to add people that I know.

SharePoint 3.0 WSP Deployment Scripts

mhass — Mon, 20 Aug 2007 22:03:00 GMT

I have been working with a customer over the last few weeks to come up with a mechanism that their Configuration Management (CM) team can use to deploy custom WSS code. Fortunately, WSS allows our developers to wrap up their code into a Solution (WSP files). The solution can have things like templates that go on the file system, web.config changes and features. Features are cool little things that can do things on WSS as well as have additional tasks on the server or file system, all defined by the developer through and XML file. Not all solutions will have a feature.

The trick here was to make it very simple for the CM team to deploy different versions of code to different environments such as Dev, Test and Prod. So, I looked at some of my old WSS 2.0 scripts that would deploy web parts out to EVERY INDIVIDUAL box in the farm by draining the application pools, deploying the DLL and GAC'ing them, restarting the web site (iisapp.vbs), and running a warm up script to fire up the ISAPI filters. This was a pain for the CM teams, especially in Internet facing properties that you wish to have as little service interruption as possible. You had to really watch the logs to ensure each box updated successfully, restart the site, etc.

WSS 3.0 makes this a lot easier by having a solution database that can store those solutions that you want to deploy, and then can either use a timer to deploy them across the farm or you can force them. You deploy the solution to a single web server in the farm, it is stored in the solution database, and SharePoint takes care of installing them on all the web boxes. In my scripts below, we decided that we would rather have the solutions deploy immediately so that we could troubleshoot any problems right away.

I further wanted to simplify the CM groups deployment by having all deployment scripts and logs on a central server. They basically "push a button" for the particular solution package they want to deploy and it fires off a remote task to the web server.

The last BIG bonus about this is disaster recovery. Since we do SQL backups regularly, we are able to bring up a new SharePoint farm, restore our DB's, run our WSP files, and we are back in business. This is how MSIT does it, BTW.

Here is how it works, pay attention, it gets a little tricky as to what server is running what:

Basically, a script is kicked off on the deployment server with parameters for the environment, it fires SchedTaskWebSolDeploy.cmd, which fires a WMIC command to the web server based on name in WMICSolMachines.txt. This wakes up a scheduled task on the web server, which is set to only run once in 1978 (ensuring that it doesn't fire automatically), and runs the WebServerDeploySolutionwithFeature.cmd. All of these output log files on the deployment server so that the status can easily be checked from a central place.

Below are the scripts, I posted them as text to have the search engines crawl them for reference. If you want to skip to the good stuff, it is in the WebServerDeploySolutionWithFeature.cmd section. Please NOTE: Thes scripts are intended to overwrite the existing Solutions and Features, so be sure you know what they do before you get them up and running. Also, the normal rules apply here around the fact that these are examples, please use at your risk and support them yourselves, the last thing I need is any midnight phone calls.

The names of the innocent servers have been changed to "deploymentserver" or "mossdev" to protect their identity:

DeployWebPartsFeature.cmd

://////////////////////////////////////////////////
:// Author: Marcus Hass (mhass@microsoft.com)
:// Version: 2.0
:// Date: 08.01.2007
://
:// Notes:
://
://   Runs a remote task via WMIC to deploy a SharePoint 2007 Solution
://   THIS SCRIPT MUST BE RUN FROM THE deployscripts DIRECTORY (assumes the \CORE is below current direcotry)
://   Assumes all necesary infrastructure exists for Sharepoint on all boxes
://   Assumes that the remote scheduled tasks exist
://
:// Inputs:
://
://   LogFile(%1) - Path to centralized log file (i.e \\endor\deployscripts$)
://   WebSiteName(%2) - The name of the web site that will be deployed to, also used on log file name (Tntranet, ProdMOSSWeb1)
://   PathtoScripts(%3) - UNC path to scripts (i.e. \\endor\deployscripts$)
://   SchedTaskName(%4) - Name of the scheduled task on the remote box
://
://////////////////////////////////////////////////
echo Starting DeployDeployIntranetSiteDefWSP.cmd

\\deploymentserver\deployscripts$\dev\core\SchedTaskWebSolDepoly.cmd \\deploymentserver\deployscripts$\dev\logs \\deploymentserver\deployscripts$\dev DeployWebPartsFeature

SchedTaskWebSolDepoly.cmd

@echo off
://////////////////////////////////////////////////
:// Author: Marcus Hass (mhass@microsoft.com)
:// Version: 2.0
:// Date: 08.01.2007
://
:// Script File:
://
://   SchedTaskWebSolDeply.cmd
://
:// Notes:
://
://   Runs the local sched task to deploy a MOSS solution
://   THIS SCRIPT MUST BE RUN FROM THE deployscripts DIRECTORY (assumes the \CORE is below current direcotry)
://   Assumes all necesary infrastructure exists for Sharepoint on all boxes
://   Assumes that the remote scheduled tasks exist
://
:// Inputs:
://
://   LogFile(%1) - Path to centralized log file (i.e \\endor\deployscripts$, etc)
://   PathtoScripts(%2) - UNC path to scripts (i.e. \\endor\deployscripts$, etc)
://   SchedTaskName(%3) - Name of the scheduled task on the remote box
://
:// Outputs:
://
:// Environment variables referenced:
://
:// Runs in:
://
://   N32, N64
://
://////////////////////////////////////////////////

:Main

:// Validate the input parameters to make sure they exist.

if NOT "%1"=="" goto :LogFileOK
    echo ERROR: Empty LogFile parameter. Aborting.
    set RETSTS=1
    goto :usage
:LogFileOK

set PathtoScripts=%2
set SchedTaskName=%3
set LogFile=%1\Status%computername%%WebSiteName%_DeployServer.txt

:// Sending script info to log file

echo. >> %LogFile%
echo Running script SchedTaskWebSolDeploy >> %LogFile%
Date /T >> %LogFile%
Time /T >> %LogFile%
set username >> %LogFile%

:// Run script to envoke remote scheduled tasks

set cmd1=WMIC /node:@"%PathtoScripts%\WMICSolMachines.txt" PROCESS CALL Create "schtasks /Run /TN %SchedTaskName%"

echo.
echo.
echo Sending Deployment commands to remote computers.
echo.
echo Envoking remote scheduled tasks using the following command: >> %LogFile%
echo Envoking remote scheduled tasks using the following command:
echo %cmd1% >> %LogFile%
echo %cmd1%

%cmd1% >> %LogFile%

:// If error with command tell user and dump out of script

if "%ERRORLEVEL%"=="0" goto :Oktogotoend
    echo Error running the command: %cmd3%, please check log file located at %LogFile%. >> %LogFile%
    echo Error running the command: %cmd3%, please check log file located at %LogFile%
    goto :bigerror
:Oktogotoend

echo.
echo.
echo +-----------------------------------------------------+
echo Script is successful and did not return any errors
echo Log File located at: %LogFile%
echo +-----------------------------------------------------+
echo Please check log files for remote computers as status
echo is not reported in this deployment script
echo +----------------------------------------------------+
echo.
echo Script is successful and did not return any errors >> %LogFile%
echo Please check log files for remote computers as status >> %LogFile%
echo is not reported in this deployment script >> %LogFile%
pause

goto :end

:bigerror
echo !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! >> %LogFile%
echo. >> %LogFile%
echo A catastropic error has occured and the deployment can not continue, please check >> %LogFile%
echo error logs located at %LogFile% >> %LogFile%
echo The return status code was %RETSTS% %ERRORLEVEL% >> %LogFile%
echo. >> %LogFile%
echo !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! >> %LogFile%
echo.
echo.
echo.
echo !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
echo.
echo A catastropic error has occured and the deployment can not continue, please check
echo error logs located at %LogFile%
echo The return status code was %RETSTS% %ERRORLEVEL%
echo.
echo !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
echo.
echo.
pause
goto :end
://////////////////////////////////////////////////
://
:// Script end.
://
://////////////////////////////////////////////////

:end

set LogFile=
set PathtoScripts=
set cmd1=

WMICSolMachines.txt

webservername

Example of DeployWebPartsFeature Scheduled Task Command Line:

://////////////////////////////////////////////////
:// Author: Marcus Hass (mhass@microsoft.com)
:// Version: 2.0
:// Date: 08.01.2007
://
:// Notes:
://
://   Schedulede Task Name: DeploySolution
://   This is an example file that details what should be in the scheduled task on a remote box.
://
:// Inputs:
://
://   LogFile(%1) - Path to centralized log file (i.e \\endor\deployscripts$\logs)
://   PathtoCode(%2) - UNC Path to Code repository (i.e. \\endor\code$\prod)
://   AppVer(%3) - version of software to deploy (i.e., current, 1.0.0.0)
://   WebSiteName(%4) - The name of the web site that will be deployed to (i.e. Intranet, ProdMOSSWeb1)
://   SiteDefName(%5) - Name of the feature that will be activated/deactivated, Filename and solution names should match (i.e. IntranetSiteDef)
://   PathToScripts(%6) - Path to where the scripts are located (i.e \\endor\deployscripts$)
://
://////////////////////////////////////////////////

://Example of commandline:

\\deploymentserver\deployscripts$\dev\core\WebServerDeploySolutionWithFeature.cmd \\deploymentserver\deployscripts$\dev\logs \\deploymentserver\code$ dev\current mossdev WebPartsFeature \\deploymentserver\deployscripts$\dev

WebServerDeploySolutionWithFeature.cmd

@echo off
://////////////////////////////////////////////////
:// Author: Marcus Hass (mhass@microsoft.com)
:// Version: 2.0
:// Date: 08.01.2007
://
:// Script File:
://
://   WebServerDeploySolutionWithFeature.cmd
://
:// Notes:
://
://   This script is called by a scheduled task on a MOSS web front end server
://   THIS SCRIPT MUST BE RUN FROM THE deployscripts DIRECTORY (assumes the \CORE is below current direcotry)
://   Assumes all necesary infrastructure exists for Sharepoint on all boxes
://
:// Inputs:
://
://   LogFile(%1) - Path to centralized log file (i.e \\endor\deployscripts$\logs)
://   PathtoCode(%2) - UNC Path to Code repository (i.e. \\endor\code$\prod)
://   AppVer(%3) - version of software to deploy (i.e., current, 1.0.0.0)
://   WebSiteName(%4) - The name of the web site that will be deployed to (i.e. Intranet, ProdMOSSWeb1)
://   SiteDefName(%5) - Name of the feature that will be activated/deactivated, Filename and solution names should match (i.e. IntranetSiteDef)
://   PathToScripts(%6) - Path to where the scripts are located (i.e \\endor\deployscripts$)
://
:// Outputs:
://
://   LogFile=%1\SolutionDeployFeature%computername%%WebSiteName%.txt
://
:// Environment variables referenced:
://
://   ComputerName
://
:// Runs in:
://
://   N32, N64
://
://////////////////////////////////////////////////

:Main

:// Validate the input parameters to make sure they exist.

if NOT "%1"=="" goto :LogFileOK
    echo ERROR: Empty LogFile parameter. Aborting.
    echo ERROR: Empty LogFile parameter. Aborting. >> c:\DeploySolution.txt
    set RETSTS=1
    goto :end
:LogFileOK

if NOT "%6"=="" goto :BadParmsOK
    echo ERROR: Not All Paramters have been supplied. Aborting.
    echo ERROR: Not All Paramters have been supplied. Aborting. >> c:\DeploySolution.txt
    set RETSTS=1
    goto :end
:BadParmsOK

set PathtoCode=%2
set AppVer=%3
set WebSiteName=%4
set SiteDefName=%5
set PathToScripts=%6
set DepFeatureName1=ITWebParts
set LogFile=%1\SolutionDeployFeature%computername%%WebSiteName%.txt

set stsadmpath="C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\BIN"

:// Sending script info to log file

echo. >> %LogFile%
echo Running script WebServerDeploySolutionWithFeature >> %LogFile%
Date /T >> %LogFile%
Time /T >> %LogFile%
set username >> %LogFile%

:// need to retract the solution so it can be replaced

set cmd2=%stsadmpath%\stsadm -o retractsolution -name %SiteDefName%.wsp -immediate

echo Running the following command to retract the solution >> %LogFile%
echo Running the following command to retract the solution:
echo %cmd2% >> %LogFile%
echo %cmd2%

call %cmd2% >> %LogFile%

:// If error with command tell user but DONT dump out of script

if "%ERRORLEVEL%"=="0" goto :retractok
    echo Error running STSADM retract command, please check log file located at %LogFile%. >> %LogFile%
    echo Error running STSADM retract command, please check log file located at %LogFile%.
    set ERRORLEVEL=0
:retractok

:// Executing the commands across the farm, this done after most commands

set cmd3=%stsadmpath%\stsadm -o execadmsvcjobs

echo Executing the commands across the farm using the command: >> %LogFile%
echo Executing the commands across the farm using the command
echo %cmd3% >> %LogFile%
echo %cmd3%

call %cmd3% >> %LogFile%

:// If error with command tell user and dump out of script

if "%ERRORLEVEL%"=="0" goto :execute1ok
    echo Error executing execadmsvcjobs1, please check log file located at %LogFile%. >> %LogFile%
    echo Error executing execadmsvcjobs1, please check log file located at %LogFile%.
    goto :bigerror
:execute1ok

:// need to delete the solution so it can be replaced

set cmd4=%stsadmpath%\stsadm -o deletesolution -name %SiteDefName%.wsp -override

echo Running the following command to delete the solution >> %LogFile%
echo Running the following command to delete the solution:
echo %cmd4% >> %LogFile%
echo %cmd4%

call %cmd4% >> %LogFile%

:// If error with command tell user but DONT dump out of script

if "%ERRORLEVEL%"=="0" goto :deleteok
    echo Error running STSADM deletesolution command, please check log file located at %LogFile%. >> %LogFile%
    echo Error running STSADM deletesolution command, please check log file located at %LogFile%.
    set ERRORLEVEL=0
:deleteok

:// Executing the commands across the farm, this done after most commands

set cmd5=%stsadmpath%\stsadm -o execadmsvcjobs

echo Executing the commands across the farm using the command: >> %LogFile%
echo Executing the commands across the farm using the command
echo %cmd5% >> %LogFile%
echo %cmd5%

call %cmd5% >> %LogFile%

:// If error with command tell user and dump out of script

if "%ERRORLEVEL%"=="0" goto :execute2ok
    echo Error executing execadmsvcjobs2, please check log file located at %LogFile%. >> %LogFile%
    echo Error executing execadmsvcjobs2, please check log file located at %LogFile%.
    goto :bigerror
:execute2ok

:// need to add the solution to the repository

set cmd6=%stsadmpath%\stsadm -o addsolution -filename %PathtoCode%\%AppVer%\%SiteDefName%.wsp

echo Running the following command to add the solution >> %LogFile%
echo Running the following command to add the solution:
echo %cmd6% >> %LogFile%
echo %cmd6%

call %cmd6% >> %LogFile%

:// If error with command tell user and dump out of script

if "%ERRORLEVEL%"=="0" goto :addsolutionok
    echo Error running STSADM addsolution command, please check log file located at %LogFile%. >> %LogFile%
    echo Error running STSADM addsolution command, please check log file located at %LogFile%.
    goto :bigerror
:addsolutionok

:// Executing the commands across the farm, this done after most commands

set cmd7=%stsadmpath%\stsadm -o execadmsvcjobs

echo Executing the commands across the farm using the command: >> %LogFile%
echo Executing the commands across the farm using the command
echo %cmd7% >> %LogFile%
echo %cmd7%

call %cmd7% >> %LogFile%

:// If error with command tell user and dump out of script

if "%ERRORLEVEL%"=="0" goto :execute3ok
    echo Error executing execadmsvcjobs3, please check log file located at %LogFile%. >> %LogFile%
    echo Error executing execadmsvcjobs3, please check log file located at %LogFile%.
    goto :bigerror
:execute3ok

:// need to deploy the solution from the repository

set cmd8=%stsadmpath%\stsadm -o deploysolution -name %SiteDefName%.wsp -immediate -allowGacDeployment -allowCasPolicies -allcontenturls -force

echo Running the following command to add the solution >> %LogFile%
echo Running the following command to add the solution:
echo %cmd8% >> %LogFile%
echo %cmd8%

call %cmd8% >> %LogFile%

:// If error with command tell user and dump out of script

if "%ERRORLEVEL%"=="0" goto :deploysolutionok
    echo Error running STSADM deploysolution command, please check log file located at %LogFile%. >> %LogFile%
    echo Error running STSADM deploysolution command, please check log file located at %LogFile%.
    goto :bigerror
:deploysolutionok

:// need to deactvate a feature before it can be updated

set Depcmd1=%stsadmpath%\stsadm -o deactivatefeature -name %DepFeatureName1% -url http://%WebSiteName% -force

echo Running the following command to unextend the http://%WebSiteName% Web Site: >> %LogFile%
echo Running the following command to unextend the http://%WebSiteName% Web Site:
echo %Depcmd1% >> %LogFile%
echo %Depcmd1%

call %Depcmd1% >> %LogFile%

:// If error with command tell user but DONT dump out of script

if "%ERRORLEVEL%"=="0" goto :deactivateok
    echo Error running STSADM deactivate command, please check log file located at %LogFile%. >> %LogFile%
    echo Error running STSADM deactivate command, please check log file located at %LogFile%.
    set ERRORLEVEL=0
:deactivateok

set RETSTS=0

:// Activate the feature

set Depcmd2=%stsadmpath%\stsadm -o activatefeature -name %DepFeatureName1% -url http://%WebSiteName%

call %Depcmd2% >> %LogFile%

:// If error with command tell user but DONT dump out of script

:// Executing the commands across the farm, this done after most commands

set cmd10=%stsadmpath%\stsadm -o execadmsvcjobs

echo Executing the commands across the farm using the command: >> %LogFile%
echo Executing the commands across the farm using the command
echo %cmd10% >> %LogFile%
echo %cmd10%

call %cmd10% >> %LogFile%

:// If error with command tell user and dump out of script

if "%ERRORLEVEL%"=="0" goto :execute4ok
    echo Error executing execadmsvcjobs4, please check log file located at %LogFile%. >> %LogFile%
    echo Error executing execadmsvcjobs4, please check log file located at %LogFile%.
    goto :bigerror
:execute4ok

://The finish line

echo.
echo.
echo +----------------------------------------------------+
echo Script is successful and did not return any errors
echo Log File located at: %LogFile%
echo +----------------------------------------------------+
echo.
echo Script is successful and did not return any errors >> %LogFile%
echo SUCCESS SUCCESS SUCCESS SUCCESS >> %LogFile%

goto :end

:bigerror
echo !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! >> %LogFile%
echo. >> %LogFile%
echo ERROR ERROR ERROR ERROR >> %LogFile%
echo A catastropic error has occured and the deployment can not continue, please check >> %LogFile%
echo error logs located at %LogFile% >> %LogFile%
echo The return status code was %RETSTS% %ERRORLEVEL% >> %LogFile%
echo. >> %LogFile%
echo !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! >> %LogFile%
echo.
echo.
echo.
echo !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
echo.
echo A catastropic error has occured and the deployment can not continue, please check
echo error logs located at %LogFile%
echo The return status code was %RETSTS% %ERRORLEVEL%
echo.
echo !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
echo.
echo.
goto :end
://////////////////////////////////////////////////
://
:// Script end.
://
://////////////////////////////////////////////////

:end

echo. >> %LogFile%
Date /T >> %LogFile%
Time /T >> %LogFile%
echo COMPLETED COMPLETED COMPLETED COMPLETED >> %LogFile%
echo. >> %LogFile%
echo. >> %LogFile%

set LogFile=
set PathtoCode=
set AppVer=
set WebSiteName=
set SiteDefName=
set PathToScripts=
set cmd1=
set cmd2=
set cmd3=
set cmd4=
set cmd5=
set cmd6=
set cmd7=
set cmd8=
set cmd9=
set cmd10=
set RETSTS=

Transformers, go see it!

mhass — Thu, 05 Jul 2007 17:46:00 GMT

The red and blue cab of an 18 wheeler rolls into the center of the dark alley with led's and lights blazing, Autobot logo right on the grill. A bunch of spinning and servo sounds accompany the all too familiar whah-whah-whah-kuk sound of Transformer transformation. Everyone knows that it is Optimus Prime, but as soon as he stands up, the crowd erupts in cheers and wolf whistles. I get chills and get the tiniest bit emotional as I get to see a hero of my childhood, and get to see the look on my son Mason's face as he see the leader of the Autobots come to "real life".

Cheesy? Ya a bit. But, I was just young enough in 1984 to appreciate Transformers and have some of the original toys, including the die cast Optimus Prime and Soundwave, which my son now plays with.

This is one of the best movies I have seen in a long time, and am tempted to say I would put it in my top ten movies ever. Of course I have the emotional attachment to it, but it is very well done. It has a story, great acting by Shia LaBeouf, humor, teenage love story, and of course outstanding special effects. I really like that they kept Peter Cullen as the voice of Optimus Prime, the same as it was in the cartoons, it just added to the illusion that I was seeing my childhood buddy on screen.

Sorry for the spoiler Sean, but Jazz (the Solstice) has seen better days by the end.

ATT Internet problems, too many iPhones?

mhass — Tue, 03 Jul 2007 00:08:35 GMT

My customer just contacted ATT because their on-call phone hasn't been picking up email today via it's data connection. ATT said they are having nationwide Internet problems, but didn't specify the cause.

Anyone care to take a stab at the problem? My guess is that the surge of iPhone inter-tubbers that have never had a real browsers or Internet access has clogged everything up.

My Treo 750 hasn't been able to sync except maybe once today. I can't imagine what havoc this is causing for business folks that are relying on their data connection today.

Apple seems to have executed beautifully on deployment, but someone forgot to let ATT know that they might have a bunch of new users and data traffic.....

iPhone and ActiveSync, a security concern

mhass — Fri, 29 Jun 2007 17:44:00 GMT

A couple days ago, Mary Jo speculated that Apple has licensed Microsoft's Active Sync technology which allows iPhone to securely sync with Exchange servers (over its smoke signal speed, EDGE data connection). Will ActiveSync be out of the box today or an upgrade in the future? Will it be the reported implementation on the iPhone to connect with Exchange via IMAP? (IMAP isn't really a concern for most Enterprises since the IMAP service is usually disabled)

I have no details about this deal, and probably couldn't talk about them anyway if I had inside knowledge, but I am concerned about security.

Here are a few things to consider if Apple has licensed EAS.

Most enterprises that use Exchange leave the attributes in AD "on" for Exchange Active Sync (EAS) and Outlook Web Access (OWA) for all users. That means that if you have an ActiveSync enabled phone, you can usually point it at your Exchange server without any special help from IT. Typically, this is the same server name as the OWA URL.
Exchange and ActiveSync have the ability to push security settings down to the phone, as well as remotely wiping the phone in case of theft or loss. The first time you sync from the phone, you have to agree to allow the Exchange server to implement security policies. Most common security settings are to require a PIN or complex password to unlock the phone after 5-15 minutes of inactivity. In case you misplace your phone, after 15 minute it locks, and 5 wrong passwords wipe the device.
The implementation of ActiveSync is up to the licensee, in this case Apple. So, the question is: Will Apple implement security policy settings that allow administrators to lock down the phone and wipe them if they are compromised (also deleting potential music)? If they don't, we may all be writing ADSI scripts to turn off EAS attributes soon....

Guess we will have to wait and see.