Revelations of a Confused Mind : Windows Server 2003

Microsoft Deployment Toolkit - Your First Stop for Deployment

shawnt — Tue, 04 Nov 2008 03:41:09 GMT

The Microsoft Deployment Toolkit (MDT) 2008 was released a couple of months ago with little fanfare. But, I believe this rather mundane sounding solution accelerator is actually a diamond that deserves being put on display, at least a little bit. Although being described on the Microsoft download page as simply "the fourth generation deployment accelerator," it is actually a pretty exciting tool that can give IT Pros of small and medium businesses everywhere a HUGE leg up on their deployment process. In fact, if you are stressed about an upcoming refresh cycle, downloading the MDT 2008 Update 1 may just make you want to stand up and cheer. Let me explain...

You see, what we've done with the MDT is to finally capture and combine all of our knowledge of deploying Windows clients AND servers into one, free, easy to use download. So, you can get pretty much everything you need to know on deployment in one place, rather than digging around for days or weeks trying to find it. And, if the MDT doesn't have it, you can be darn sure that the MDT links to it. Essentially, we've made it so that if you are an IT Pro tasked with deploying Windows, the MDT is the first thing you should grab. In it you'll find whitepapers, sample surveys, timelines, compatibility assistance, and a whole gob of additional documentation Microsoft has amassed over years of working with customers and OEMs. We know how to build Windows images and we know the process to deploy them, and now you will too.

And before you say it won't work for your deployments because you're still working on the previous OS, let me politely stop you, and say the MDT works for Windows XP SP2 or higher and Windows Server 2003 R2 and higher, as well as, of course, Windows Vista and Windows Server 2008. Not only that, but it explains how to do Zero Touch Installs (aka ZTI - essentially, no administrator input required on the target machine), as well as the familiar Lite Touch Installs (LTI) from the old BDD 2.0.

Again, in short, what the MDT does is put everything regarding deployment in one place. It's that "in one place" thing that we don't see nearly often enough as IT Pros, and it makes me want to smile a quirky little comforting smile whenever it does. So, get it now and save yourself a whole lot of headaches later.

Microsoft Deployment Toolkit (MDT) 2008 Update 1

New "Wormable" Exploit Discovered Affecting Windows OS's...

shawnt — Thu, 23 Oct 2008 21:51:50 GMT

There was a new critical vulnerability announced today that could lead to remote code execution against Windows Operating Systems. (Specifically, Windows 2000, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008.) And, unless you are running Windows Vista or Windows Server 2008*, this exploit even works for non-authenticated users - remotely!

In short, this means that this exploit could be turned into a new Internet Worm. In fact, consistent exploit code has already been discovered in limited, targeted attacks, which is precisely why this update is a "zero day" update. It needs to be patched now, folks. Don't delay. Again, the vulnerability can be exploited consistently, remotely, and without authentication. These three factors are not good in combination.

Needless to say, this kind of exploit is potentially very damaging, and the wise administrators among us will reduce their exposure immediately - either by applying the update, or, if updating is not an option due to a lengthy testing and deployment process, then by disabling the computer and server browser services temporarily. Check out this bulletin for more details on how to perform these actions.

For more information and to download the update (Select your OS version): http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx

To get the Update directly from Microsoft Update (US Site): http://update.microsoft.com/microsoftupdate/v6/default.aspx?ln=en-us

* If you are running Windows Vista or Windows Server 2008, the update severity is mitigated by the likelihood that the exploit will only work for authenticated users, even with UAC turned off. Plus, improvements like ASLR (Address Space Layout Randomization) further reduce the ease of exploit. It's nice to see the security investment we made in Windows Vista and Windows Server 2008 paying off in situations like this.

How to Use the Powershell 1.0: A Beginner's Guide

shawnt — Tue, 18 Dec 2007 04:13:00 GMT

If you're already convinced that the Powershell is right for you, skip ahead to the section: "Getting Started with the Windows Powershell". However, if you still need some convincing, read on. So, in case you haven't had a chance to use the Windows Powershell yet, I'm here to tell you - It is a nice powerful tool for automating repetitive tasks in Windows. If you find yourself doing many of the same tasks day after day via the GUI and it's starting to wear you down, you will almost certainly benefit from spending a few minutes learning the Windows Powershell, or at least stealing the scripts from the repository (See Step 5 below)! You don't have to get deep to start saving yourself a lot of clicksteps - just spend a few minutes going through my walkthrough and download one of the sample scripts. I think you'll find you'll be able to give yourself back several hours a week. Check out steps below on how to get started with the Windows Powershell...

Did you know?

The Windows Powershell 1.0 can....

perform what-if analysis (to help you decide if you really do want to run a certain command or script)
perform "do while" and "do until" loops
accept runtime input via the command line. So, for example, you could create a tool to give you information about a specific Windows Service, and it would ask you which Windows Service you were interested in via the command line interface.
autoComplete using the Tab key (so you don't have to remember every noun-verb command - just tab 'til you find the right one.)

The Windows Powershell 1.0 uses...

It's own scripting language. That's right, it's not VB Script, C# or any of the others. It's new. If you want to know why, read the documentation linked to in step 3 below.
the .NET object model, so all output from the Powershell is treated as an object which can be manipulated and piped into other methods
or, actually, is used by the Exchange Management Console. The Exchange functionality in the EMC is just an add-in to the Windows Powershell. It adds Exchange related tasks, like move-mailbox, to the Powershell.

In addition, if you'd like to learn more, please check out the webcast I just delivered on the Windows Powershell 1.0. It should be available in streaming format here in the next few days. It's called "TechNet Webcast: Prepare Yourself for Windows Server 2008 (Part 7 of 8): Windows PowerShell and Manageability Improvements."

Getting started with the Windows Powershell:

DOWNLOAD: Download Powershell 1.0. (It's about a 5.0MB download)
INSTALL: Double-click the downloaded .msu to install the Powershell. There are different .msu's for Windows XP SP2, Windows Server 2003 SP1, and Windows Vista. Make sure you get the right one for your OS. (Windows Server 2008 has the Powershell built in.) The Powershell only runs on Windows, so if you need to run it on another OS, you'll need to build a Virtual Machine and install the Powershell into it.
READ: Read the Powershell 1.0 Documentation. The documentation is automatically installed along with Powershell and is very helpful, especially at first. If you've never worked with Powershell before, you'll want to read these. The first thing you should read is "GettingStarted.rtf", which is a nice, easy to follow, 32-page overview. Then, you can graduate to the 116-page "UserGuide.rtf". Finally, if you get past all of that, see the "Other helpful links" at the bottom of this post. If you want to read the documentation without downloading the Powershell, you can find it here: Download the Powershell 1.0 Documentation Pack.
PLAY!: Open a Powershell Command Window and try a few simple, interactive commands (e.g. "write-host This is a test." or "get-childitem <AnyFolderPath>"). It's really quite easy to get used to. I've typed a couple below that you might want to try.
HOW TO RUN SCRIPTS - THE EASY WAY: Now, take your Powershell experience to the next level by running scripts! And, if you ask me, the best way to run scripts is to start with someone else's scripts, and build from there. So, go get some sample scripts from the Microsoft Powershell sample script repository online. Of course, you can write your own scripts from scratch, but the sample scripts are so powerful and easy that I recommend you start there. Don't try to recreate the wheel when you don't have to.

------> Microsoft's Sample Powershell Scripts Repository <------

Alright, Shawn, but how do I run those blasted scripts? I keep getting error messages. Well, here's how...

First, change the executionpolicy setting. The default executionpolicy setting is restricted, and it will prevent all scripts from running, allowing you to run the Powershell only interactively. (If you want to know why we do this, check out the "go" link below just before step 2.) If you want to run scripts, even the ones you create, you'll need to change that setting. Here's how you do that:
- If security is NOT an issue and you want to run all scripts unsigned. (Not recommended):
- If security IS an issue and you want to run signed scripts (signed locally or remotely):
  - PS C:\Users\Administrator> set-executionpolicy remotesigned
  - Check out this TechNet article that talks all about how to properly sign your code and explains the executionpolicy settings in more detail - even gives you the commands you should use: http://go.microsoft.com/fwlink/?LinkID=106498&clcid=0x409
Then, just copy and paste the sample scripts directly from the Microsoft repository website into Notepad. Save the file with any name and a .ps1 extension (you'll need to get rid of the .txt extention as shown in the screenshot below.)
Run the script from the Powershell prompt. For example:

PS c:\Users\Administrator> c:\scripts\ListDesktopSettings.ps1 ****You must type the full path for the script to run****

Now that you've got one script under your belt, you can try some other examples of sample scripts from the website. Here is a list of the available sample scripts.

Active Directory - Sample scripts for managing Active Directory and Active Directory objects.
Applications - Sample scripts for managing software and applications on servers and client computers.
Desktop Management - Sample scripts for managing such things as desktop settings, computer startup and shutdown, and System Restore.
Hardware - Sample scripts for managing and monitoring computer hardware.
Logs - Sample scripts for managing event logs and plain-text log files.
Networking - Sample scripts for managing and monitoring network configurations and network applications.
Operating System - Sample scripts for managing and monitoring the Windows operating system.
Other Directory Services - Sample scripts for managing directory services other than Active Directory.
Printing - Sample scripts for managing printers, print jobs, print servers, and other parts of the Windows printing infrastructure.
Scripting Techniques - Sample scripts demonstrating a wide variety of scripting tips, tricks, and techniques useful to script writers.
Searching Active Directory - Sample scripts for searching Active Directory.
Service Packs and Hot Fixes - Sample scripts for retrieving information about service packs and hot fixes installed on a computer.
Storage - Sample scripts for managing files, folders, file systems, and storage devices.
Terminal Server - Sample scripts for managing Windows Terminal Server.

Well, that's it - by now you should be off and running with the Windows Powershell 1.0. I tried to go through all the basics here just to get everything working, as well as some of the gotchas you might run into. Still, it's a big world once you start to go deep into the Powershell, so here are some more helpful links that will get you to that next echelon. If you have any thoughts or questions, please feel free to post a comment.

Other helpful links:

The Windows Powershell Blog Team Site

The Windows Powershell Script Center

Windows Powershell Help on TechNet - Check it out!

Windows Powershell Owner's Manual - Highly recommend - there is a TON of information very easily accessible from here and it starts you off on the bunny slope.

Thanks!