• Running IIS 32-bit Applications on IIS 64-bit

    Do you have IIS on Windows 64 bit and want to run application that is for 32 bit. No problem. From the Inetpub admin scripts run the following:

    "cscript.exe adsutil.vbs set W3SVC/AppPools/Enable32BitAppOnWin64 true"

    Here are the details.

    Windows Server 2003TM, Service Pack 1 enables IIS 6.0 to run 32-bit Web applications on 64-bit Windows using the Windows-32-on-Windows-64 (WOW64) compatibility layer. IIS 6.0 using WOW64 is intended to run 32-bit personal productivity applications needed by software developers and administrators, including 32-bit Internet Information Services (IIS) Web applications.

    On 64-bit Windows, 32-bit processes cannot load 64-bit DLLs, and 64-bit processes cannot load 32-bit DLLs. If you plan to run 32-bit applications on 64-bit Windows, you must configure IIS to create 32-bit worker processes. Once you have configured IIS to create 32-bit worker processes, you can run the following types of IIS applications on 64-bit Windows:

    • Internet Server API (ISAPI) extensions
    • ISAPI filters
    • Active Server Page (ASP) applications (specifically, scripts calling COM objects where the COM object can be 32-bit or 64-bit)
    • ASP.NET applications

    IIS can, by default, launch Common Gateway Interface (CGI) applications on 64-bit Windows, because CGI applications run in a separate process.

    Before you configure IIS to run 32-bit applications on 64-bit Windows, note the following:

    • IIS only supports 32bit worker processes in Worker Process Isolation mode on 64-bit Windows
    • On 64-bit Windows, the World Wide Web Publishing service can run 32-bit and 64-bit worker processes. Other IIS services like the IIS Admin service, the SMTP service, the NNTP service, and the FTP service run 64-bit processes only
    • On 64-bit Windows, the World Wide Web Publishing service does not support running 32-bit and 64-bit worker processes concurrently on the same server
  • Enabling SSL in SQL 2005 cluster

     

    Did you tried to enable SQL encryption between the client and your SQL instance? I thought that configuring SQL 2005 cluster to encrypt its traffic is simple however I discovered that it is not that straight forward and you always get this error “The server could not load the certificate it needs to initiate an SSL connection. It returned the following error: 0x8009030d. Check certificates to make sure they are valid” to understand more about SSL in SQL 2005 & how to configure it read below.

    Microsoft SQL Server 2005 can use Secure Sockets Layer (SSL) to encrypt data that is transmitted across a network between an instance of SQL Server and a client application. The SSL encryption is performed within the protocol layer and is available to all SQL Server clients except DB Library and MDAC 2.53 clients.

    SSL can be used for server validation when a client connection requests encryption. If the instance of SQL Server is running on a computer that has been assigned a certificate from a public certification authority, identity of the computer and the instance of SQL Server is vouched for by the chain of certificates that lead to the trusted root authority. Such server validation requires that the computer on which the client application is running be configured to trust the root authority of the certificate that is used by the server. Encryption with a self-signed certificate is possible as the Credentials (in the login packet) that are transmitted when a client application connects to SQL Server 2005 are always encrypted. SQL Server will use a certificate from a trusted certification authority if available. If a trusted certificate is not installed, SQL Server will generate a self-signed certificate when the instance is started, and use the self-signed certificate to encrypt the credentials. This self-signed certificate helps increase security but it does not provide authentication or nonrepudiation. If the self-signed certificate is used, and the value of the ForceEncryption option is set to Yes, all data transmitted across a network between SQL Server and the client application will be encrypted using the self-signed certificate. Note that SSL connections that are encrypted by using a self-signed certificate do not provide strong security. They are susceptible to man-in-the-middle attacks. You should not rely on SSL using self-signed certificates in a production environment or on servers that are connected to the Internet.

    Note: Enabling SSL encryption increases the security of data transmitted across networks between instances of SQL Server and applications. However, enabling encryption does slow performance. When all traffic between SQL Server and a client application is encrypted using SSL, the following additional processing is required:

    • An extra network roundtrip is required at connect time.
    • Packets sent from the application to the instance of SQL Server must be encrypted by the client Net-Library and decrypted by the server Net-Library.
    • Packets sent from the instance of SQL Server to the application must be encrypted by the server Net-Library and decrypted by the client Net-Library.

    To configure SSL encryption to work with a certificate from a public certification authority follow the below steps:

    1. Generate a certificate with the following requirements
      • Certificate CSP should be “Microsoft RSA SChannel Cryptographic Provider
      • The certificate must be meant for server authentication. This requires the Enhanced Key Usage property of the certificate to specify Server Authentication (1.3.6.1.5.5.7.3.1)
      • The Subject property of the certificate must indicate that the common name (CN) is the same as the host name or fully qualified domain name (FQDN) of the server computer. If SQL Server is running on a failover cluster, the common name must match the host name or FQDN of the virtual server and the certificates must be provisioned on all nodes in the failover cluster
    2. Import the same certificate on both nodes into the following locations
      • Computer container
      • SQL services account personal container
    3. Add the SQL service account into the local administrator group of both cluster nodes
    4. Open the registry editor and add the thumbprint of the certificate into the following string key “Certificate” under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL.x\MSSQLServer\SuperSocketNetLib”
      • Using Certificate Mgr (MMC), double-click on the Certificate.
      • Select the Details tab
      • Scroll down to Thumbprint and highlight
      • Copy the Thumbprint numbers and paste into Notepad
      • Remove all the spaces from the string
      • Copy the string and paste in Registry in the value for Certificate string  at:
    5. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL.1\MSSQLServer\SuperSocketNetLib
    6. Restart the cluster node

    Note that after doing all of the above steps you will notice that the certificates is not listed in the SQL Server configuration manager - > Protocols for the instance. However the SSL is working & you can check by looking into the SQL logs. To get to know that your certificate loaded successfully try to search SQL Server Error log (in SSMS) for

    Source: Server

    Message contains: certificate

    Note: When Microsoft SQL Server 2005 is running under the Network Service account, you cannot enable encryption by using a certificate. If you provision a certificate for use in encryption, SQL Server will not start. Additionally, you may notice an error message in the SQL Server error log. To solve this problem compile the code in KB 900495 http://support.microsoft.com/?kbid=900495 

  • Ports required for external trust using ISA 2004/2006

    You want to establish an external trust between two domains where there is an ISA 2004 or ISA 2006 in between.  Establishing trust requires Kerberos, LDAP, DNS, CIFS & the big problem is the RPCs… one idea is to strict the RPC port on the DCs using registry and open this specified range on the ISA which will be not less than 100 port per the recommendations, other idea was to create an IPSEC tunnel between both DCs and open the IPSC ports only on the firewall however the cons of this solution is the complexity & the exposure of both DCs communication between each other. With ISA 2004 & 2006 the RPC filter will help you establish this, the filter listens for the RPC port maper 135 request and depending on the UUID the ISA sees which port is required to be opened for such service and dynamically open the port for the communication till the session ends. So based on this great cool feature only the below ports are only required to be opened on the ISA.

    PING (ICMP)

    DNS Query

    Kerberos-Sec (UDP)              88  UDP SEND/RECEIVE

    LDAP                                     389 UDP SEND/RECEIVE

    LDAP (UDP)                          389 TCP OUTBOUND

    Microsoft CIFS (TCP)            445 TCP OUTBOUND

    RPC (All interfaces)             135 TCP OUTBOUND

    Note: PING is required and don’t forget to establish a name resolution mechanism, I would recommend DNS conditional forwarding for both domains

  • Large Logical Unit Support and Windows Server 2003 SP1

    today I got a question about the maximum size for a partition that windows can see and that it is always known that it is limited to 2TB… This is no moreJ. Read this.

    This article describes changes in Windows operating systems that will support disk logical unit sizes larger than 2 TB.

    In past editions, Windows used 32-bit block numbers in the lower storage stack. This effectively limited support for single disk devices-which might be hardware RAID sets, sometimes called virtual disks or LUNs-to being no larger than 2 terabytes (TB). To get storage unit sizes beyond 2 TB, one had to combine multiple LUNs using the Volume Manager, leading to a volume limit of 64 TB with RAID0 or spanning or 62 TB with RAID5. RAID1 was also limited to 2 TB. The use of Volume Manager sets, however, imposes a performance penalty and can make some storage management scenarios difficult or impossible.

    In contrast, the file system uses a 64-bit signed byte offset. This means that the absolute file system limit is actually 254 512-byte blocks. However, NTFS reduces this, because it supports a 32-bit cluster number * 64K per cluster maximum, which equals 256 TB.

    Another complicating factor was the use of Master Book Record (MBR) partition types, which can only contain up to 232 blocks. GUID Partition Tables (GPT) can support a much larger number of blocks, but Windows only supported GPT on Intel Itanium machines.

    Note: Microsoft recommends that for Windows Server 2003, basic disks should use 512-byte sectors (dynamic disks will only work with 512-byte sectors). Windows Vista and later operating systems will support up to 4-KB sector sizes.

    With Windows Server 2003 Service Pack 1 (SP1) and Windows XP 64-bit Edition (x64), these limits have changed.

    Microsoft added support for 64-bit block numbers in the disk/class layer, using the new SCSI Commands included in the SCSI-3 Block Commands-2 command set. Microsoft also enabled GPT support for all Windows Server 2003 SP1 platforms. With this change, for example, a snapshot of a GPT partition on an Itanium-based machine can now be transported to a 32-bit machine for data mining or archiving purposes.

    The new limits are as follows:

    ·         Basic or dynamic volume size: 264 blocks = 273 bytes (too big to pronounce)

    ·         Maximum NTFS file system size that can be realized on Windows: 256 TB

    Note: Disk devices with more than 2 TB of disk space must be converted to GPT format for all of the disk space to be usable. If the device uses MBR format, the disk space beyond 2 TB will be unusable

  • Active Directory Performance for 64-bit Versions of Windows Server 2003

    If you are interested in AD performance on 64 bit you shoud read this great guide

    http://www.microsoft.com/downloads/details.aspx?FamilyID=52E7C3BD-570A-475C-96E0-316DC821E3E7&displaylang=en