Windows Server Customer Engineering : Windows Server

Introducing Windows Server 2008 R2 - Free eBook

eschroed — Fri, 30 Oct 2009 18:53:00 GMT

Introducing Windows Server 2008 R2 - Free eBook

Fantastic new book hot off of Microsoft Press covering Windows Server 2008 R2.

Excerpt from the book:

“This book is targeted primarily at Windows server administrators who are responsible for hands-on deployment and day-to-day management of Windows-based servers for large organizations.”

Chapter breakdown is as follows:

Chapter 1, “What’s New in Windows Server R2”

Chapter 2, “Installation and Configuration: Adding R2 to Your World”

Chapter 3, “Hyper-V: Scaling and Migrating Virtual Machines”

Chapter 4, “Remote Desktop Services and VDI: Centralizing Desktop and Application Management”

Chapter 5, “Active Directory: Improving and Automating Identity and Access”

Chapter 6, “The File Services Role”

Chapter 7, “IIS 7.5: Improving the Web Application Platform”

Chapter 8, “DirectAccess and Network Policy Server”

Chapter 9, “Other Features and Enhancements”

And best of all a free electronic version is available here:

Scale testing the world’s largest PKI… all running on WS08R2 and Hyper-V

morello — Mon, 10 Aug 2009 23:50:00 GMT

This week, we've been in the Enterprise Engineering Center (EEC) doing our scale testing on a project to help build the world's largest PKI. When fully implemented over the next couple of years, this PKI will be the world's largest, issuing 100s of millions of certificates from 100s of CAs to devices around the world. The entire design is built on WS08R2 Hyper-V and WS08/WS08R2 CAs. Management is done using SCVMM.

In the EEC, we were able to simulate a portion of the hosting environment and drive load against it to find bottlenecks and optimize around them. To simulate one of the Hyper-V hosts, we used a similar machine to the ones being used the hosting facilities: a 2.4GHz, 4 socket, quad core machine with 64GB. We took a sysprep'd copy of the actual CA VM image used in the customer environment and loaded our host with 10 VMs, each assigned a single VCPU and 6GB. All 10 of these VMs were connected to an nCipher netHSM 2000. To generate load, each CA VM was paired with a single DC and 5 client machines, each assigned a single VCPU and 2GB and separated from the CA by a WAN simulator that added latency and throughput constraints based on the customer's actual network topology. We used an internal PKI test tool to have each client machine open 4 request sessions and requests 1000000 2K key certs per session.

After <24 hours, we'd issued >20 million certificates from this single physical chassis. During these tests, we found that:

Per VM CPU load was ~25%, total host CPU load was ~20%
Relatively little memory was required by the CA VMs, even at this high stress; thus we're optimizing the design to increase the density of CA VMs per chassis, to 30:1 (2GB per VM)
The performance bottleneck in this design is the HSM; as we increased the number of CA VMs being stressed, our requests per second per CA fell significantly, from >100 to ~18-20, giving a net issuance rate for the entire chassis of ~200 per second
When investigating the HSM, it became clear that it was the gating component (note that its 150 request queue on the left is persistently nearly saturated and CPU on the right is pegged at consistently at 85%)

Overall, this testing was a great validation of the performance of ADCS. Our software ran as fast as the HSM would allow and we gracefully handled response delays introduced by it. Also, the fact that we're able to run this configuration entirely on Hyper-V and get ~30 CAs per physical host provides an efficient scale story for even the very largest and most complex environments around.

Using the FREE network security tools you get in Windows (and who doesn't love free tools?)

pfetty — Fri, 20 Feb 2009 01:42:00 GMT

In my last post I talked extensively about the use of 802.1x for network authentication (wired or wireless) and talked about the benefits of the 2 common approaches to controlling machine access (VLAN vs. Port ACL). While 802.1x remains a very popular mechanism for controlling port based access for machines coming onto the network, it also has some significant requirements associated with it, primarily, having 802.1x capable switches and/or access points in place today. You would be surprised how many people think that their devices support this capability, but in reality, they may find that this is not the case. What this means is that if your hardware vendor tells you that what you have isn't 802.1x capable, be prepared for some sticker shock when you find out how much it will cost for an upgrade!

Given the state of IT budgets today, doing a massive hardware upgrade is probably not something you are prepared to do now, or any time in the near future. That being said, you still have the requirement of securing the endpoints that are on your network and ensuring that they are kept up to date with patches, AV signatures, Anti-Malware Definitions etc. These 2 efforts may seem to conflict, but they certainly don't have to.

Let me introduce you to Server and Domain Isolation (SDI) with IPsec, all built into Windows, all free of charge!

Now, as to not sound like a late night infomercial peddler of dodgy wares, I will explain what I mean by "free of charge". What this means is that if you have purchased Windows Server (any SKU or version) and a Windows Desktop OS (Windows 2000 or later) and an associated Client Access License (CAL) (you usually purchase a CAL when you buy a server from Microsoft), these technologies do not have any additional licensing requirements whatsoever.

Now that we have the cost definition out of the way, let's talk about what these technologies can do for you.

Server and Domain Isolation (SDI)

Simply put, SDI utilizes the IPsec (Internet Protocol Security) technologies that have existed in Windows ever since the days of Windows 2000. What SDI allows you to do is to create access policies based on Active Directory groupings that can require authentication between any set of machines in the network (or all machines). The tools for creating and distributing these policies are also built into Windows and policies are distributed via the Group Policy mechanism, meaning that yes, a machine must be joined to the domain to easily take advantage of SDI. Since we are talking machine and/or user authentication here, there are 2 options for credential use in SDI, they are X509 certificates, or a Kerberos ticket. There are advantages and disadvantages to the use of each of these credentials which I won't go into here, but the message is that there is flexibility here with both credentials being secure (i.e no passwords.)

Now, let's talk about one big option that 802.1x cannot offer you, and that is data encryption.

Many customers have never really ever considered doing any kind of encryption on their network because they probably never understood how easy it is to implement. Many think that there is some hardware requirement, or that their machines will come to a crawl performance wise, when in reality, neither are true. Granted, you have the option to create very stringent policies that require stronger encryption, but in many cases you simply won't need to do something like this, or may choose to bypass encryption all together.

Example

Here's a real world example of how SDI can be used:

The Microsoft network uses SDI technologies to protect our assets. Pat Fetty (aka me) is a known and trusted employee and is allowed to access the network from his office, or remotely every day. However, since Pat is not a Windows developer, pat is unable to access or even see or ping our source code servers. Pat is also unable to see things like our HR server, financial servers etc. How is that you ask, well, Pat is not in the proper security groups in AD to have the proper policy applied to him, or his machines, that allow this type of access.

Using this simple example, think of some of the other scenarios that you, or your customers may be faced with that you may be able to solve. Here are some others I have come across in my job in the WinCAT team:

- Allow only doctors to see patient records, and encrypt all traffic going to and from those servers

- Allow only attorneys to be able to see servers X, Y and Z

- Encrypt all traffic to and from an ATM machine to the banks home offices

- Encrypt all Active Directory synchronizations between servers where traffic is going over the Internet

- Authenticate all traffic from my Windows machines, but exempt traffic from my main frame machines and all Macintosh machines (we'll talk a bit more about this)

This is just a small sample list of real business problems that are out there that SDI can help to solve.

Now, getting back to the last item regarding mainframes (let's just say all *ix) and Macs. There are Ipsec stack implementations available for these platforms, but I have personally not seem them work. As previously mentioned, the Microsoft SDI set of technologies are based 100% on public RFC's so there is no reason to expect that any implementation that is RFC compliant wouldn't work with any Windows machine.

Another reason why this is important is because the tools to build and manage SDI policies allow you to create very simply policies to address this scenario. For instance, you can have a policy that looks like this:

If you are a machine in group A, and you are capable of negotiating IPsec, then negotiate IPsec with a (Kerb ticket or cert)

else

Allow traffic to flow in the clear

You may be asking yourself "what kind of security policy is that" and the answer is that it is one that doesn't disrupt the flow of traffic on the network, and yet will negotiate the security you dictate when possible. This is a very important concept since the reality is that your machines today are most likely not doing any kind of SDI today, so by having your policies based on AD group membership, and by having a "best effort" type of policy like this you can ease this type of technology into your network with little or no disruption!

SDI versus 802.1x

We talked about this at the beginning and I think that SDI is the hands down winner here given that if you are a Windows environment

Deployment

To do 802.1x means you will have to touch all the switches and AP's in your network and configure them to do 1x on their ports, and to then send all traffic to a back end authentication server. In many cases, the group that manages desktops and servers in your company is not the same group that manages the infrastructure, so you now are getting more people involved in the effort.

SDI utilizes Group Policy and other built in tools to distribute policies and credentials, and the best part about this whole thing, is that SDI will work across whatever hardware you have in place today!

Management

This is a bit of a toss up, but I'd give SDI an edge since you can use a variety of methods to manage who is on the network accessing resources. 802.1x usually requires an enterprise ready SNMP (Simple Network Management Protocol) solution either from our hardware vendor or from a third party

Security

This is the one that gets the networking guys feathers ruffled, but I give SDI the advantage here for a couple of reasons. First, SDI offers you the ability to encrypt traffic which is something that 1x cannot offer. Second, in 802.1x, once you get passed the switch you are on the network doing what you please until you either reboot, or the switch kicks you off the port. SDI allows you to control the credential that is given to that client so that if for some reason you need to remove the client from the network, you can more quickly do so via SDI than 1x.

Overall I feel that both technologies here offer up some nice benefits (we didn't even touch on Guest Access which I feel is better done with 802.1x than SDI), but in the end, you should evaluate what your business needs are and make your technology decision on that. Usually the second phase of that decision process is cost, and that is where using the tools we have built into Windows can save you loads of money down the road assuming you plan on running Windows for the foreseeable future (which we hope that you are of course!)

With budgets shrinking and/or disappearing I would encourage everyone to take a look at what you have purchased in the Windows platform and ask Microsoft how to best utilize it because we are definitely here to help you get the most out of Windows!

IIS 7: Extending Our Extensions Into Your Platforms

eschroed — Sat, 06 Dec 2008 07:06:00 GMT

With the introduction of IIS 7.0 in Windows Server 2008 the game has changed. IIS 7.0 is built using a modular architecture from the ground up. This means two very important things. The first is you only have to install/enable the core set of features YOU want to use, gone are the days of a monolithic design where you had "stuff" running/installed that you simply did not need or use. The same can be said of Windows Server 2008 but that is a post for another time. The second part which is key and brings the most benefit is the module/extension based architecture of IIS 7.0. Currently on IIS 7.0 we ship a handful of in-box modules on top of the core web server engine.

· HTTP Modules (Static Content, Default Document, Directory Browsing and HTTP errors)

· Security Modules (Request Filtering)

· Compression/Performance (Static Content Compression)

· Diagnostics and Health (HTTP logging and Request Monitoring)

· Management (IIS Management Console)

· Windows Process Activation

In addition to the in-box modules that come with IIS 7.0 on Windows Server 2008, the IIS team has teed up, out of box modules that will add new functionality and extend current functionality. All of these modules are available from IIS.NET. These modules fall under the following categories: Content Publishing, Deployment and Migration, Media Serving, Application Hosting, Request Handling, Server Management and Security. These extensions are built upon a new public Integrated Pipeline API which allows modules to be plugged anywhere into the request processing pipeline. The beauty of this design is that we no longer have to wait to ship new features or extend current ones between versions of the core Operating System platform. So in other words gone are the days of old where you the customer had to wait for new version of Windows Server/Client for new functionality in IIS. This makes the IIS 7.0 Web Platform adaptable and nimble to industry trends, empowers us to deliver new functionality for you at greater velocity and allows our customers to build their own modules further extending the platform.

Now that was the history part. Not everyone is going to build their own extensions/modules from scratch and for those that want to there are lots of online resources discussing in greater detail this scenario. A lot of customers use our shipping extensions in their production environments to solve some of their current technology problems or build platforms on top of our platforms. In this post I want to briefly discuss three extensions available today from IIS.NET that are extremely powerful individually but can be leveraged together to build a fairly complex solution for your environment. I will keep this conversation at a high level because I want these examples to stimulate conversation with you our customers as to how you are using these extensions today, where you plan on taking them tomorrow and where do you think we can move them forward.

The three extensions are:

· URL Rewrite

· Application Request Routing

· Web Deployment Tool

At the time of this writing Web Deployment Tool (WDT) is at Beta 2, Application Request Routing (ARR) is at RC (Release Candidate) and URL Rewrite is RTW (Released To Web - Final - Production Ready). They are available in x86 and x64 flavors. I won't go into the specifics or the command sets for each module as they are covered in great detail by the IIS team on IIS.NET, but I will briefly summarize each module's core feature sets.

URL Rewrite is an extension to IIS 7 that provides a rules based engine that uses regular expression pattern matching and wildcard analysis against URLs, server side variables and HTTP headers and can generate back to the requestor custom URLs, Redirects, HTTP Responses or stop HTTP requests based on these patterns.

· Rules-based URL rewriting engine.

· Regular expression pattern matching.

· Wildcard pattern matching.

· Global and distributed rewrite rules.

· Access to server variables and HTTP headers.

· Various rule actions including redirect and request abort.

· Support for IIS kernel mode and user mode output caching.

· Lower case conversion function.

· Rewrite maps to generate the substitution URL during rewriting.

· Failed Request Tracing support.

· Built-in rule templates.

· Integrated user interface for testing regular expression and wildcard patterns.

· Integrated user interface for managing rewrite rules and rewrite maps.

· Integrated user interface for importing of Apache mod_rewrite rules.

Application Request Routing (ARR) is also an extension for IIS 7.0 that leverages the engine in URL Rewrite to provide rules-based routing and load balancing of HTTP/HTTPS requests.

· HTTP based routing decisions built using rules that examine HTTP request information.

· Sophisticated load balancing algorithms to determine appropriate servers to service the HTTP requests.

· Health monitoring for live traffic and specific URLs to determine the health of servers with a set of configuration parameters provided to calibrate baseline server health.

· Client affinity to direct all requests from a client to a specific server by using cookies.

· Host name affinity to streamline administration for Web servers and to create additional business opportunities.

· Management of multiple server farms to enable pilot management and A/B testing scenarios.

· Management and monitoring of all configuration settings and aggregated runtime statistics through IIS Manager interface.

· Support for Failed Request Tracing Rules.

Web Deployment Tool (WDT) is an extension that can be installed on either IIS 6.0 (Windows Server 2003) or IIS 7.0 (Windows Server 2008) and provides simplified migration, management and deployment of Web Servers, Web sites and Web applications.

· Seamless integration into the IIS 7.0 Manager and Visual Studio 10 interface.

· Web server migration and synchronization:

· Ability to synchronize or migrate the entire Web server, a Web site or application.

· Synchronizes only the data that has changed.

· Ability to detect missing dependencies during synchronization.

· Automatically gathers content, IIS Configuration, Certificates and ASP.NET configuration when you sync a Web site.

· Web application packaging:

· Packages a Web application or an entire site, including the associated SQL database.

· Automatically packages ACLs, COM, GAC and Registry settings.

· Supports both live servers and zipped packages as a source or destination.

· Web application deployment:

· Administrative privileges are not required in order to deploy Web applications.

· Integration with the IIS 7.0 Web Management Service (WMSVC) for remote deployment by non-administrators.

· Server administrators have granular control over the operations that can be performed and can delegate tasks to non-administrators.

· In addition to the IIS Manager and Visual Studio 10, tasks can be performed using the command-line, PowerShell cmdlets or public APIs.

Now as I previously mentioned above each of these extensions are fully functional as standalone products within the IIS 7.0 Web Platform. Now imagine that you are an enterprise customer, hoster or even a developer managing a web farm of any scale. As a previous enterprise customer when faced with the age old question do I "Buy vs. Build", I would leverage these extensions to do the heavy lifting for me in the creation of an automated web deployment platform. How you say? There are public APIs that are and will be made available to interact with the extensions so you can glue them together to build your solution for a seamless user experience.

Without getting into the details of what the master console would look like, the base functionality I would want is to deploy content (server, site, application), pull content (server, site, application), and control the flow of traffic (remember we are keeping this basic and leveraging just three extensions for this solution). I would use WDT as the deployment/backup/synchronization engine for my Web Servers, Sites and Applications. It runs as a remote service so I can include WDT as part of my Operating System base build or image. One might even store the packages in SQL so you have a central store for all published content and site/server settings with some versioning control. Depending on the size of the farm I can also have SQL replicas around the globe serving as the package content distribution store. Out of the box WDT provides delegation so you can control what users can deploy and where they can deploy to (they do not have to be an administrator to deploy Web Applications). From my console I can control traffic flow and reroute traffic using ARR and URL Rewrite. I can do rolling upgrades of content using this system and redirect traffic to other servers while content is being refreshed or populated. My users can even use it to move web applications through their lifecycle from DEV/TEST to QA and then Production, whether that be by migrating web applications via WDT to the various server farms or routing some production traffic via ARR and URL Rewrite to DEV/QA staging servers. If I suffer from seasonal effects and need to quickly provision capacity I can leverage my OS deployment system (SCCM, WDS, In-House, 3rd party) or virtual machine management system (SCVMM) to bring nodes online whether that be new physical host deployments or quickly provisioning virtual machines from library and the web deployment system will populate my server settings, site content and/or web applications and start directing traffic to these new nodes. The possibilities are endless.

I would encourage anyone who is not using any of these modules to hop on over to IIS.NET and take a look at what the team has to offer. I would encourage anyone who is using any of the modules today, not just the three I discussed in this blog to leave feedback on the forums. I would personally ask anyone using the three modules above to provide feedback either in the comments section or on the IIS.NET forums.

As for me...well I am a fairly new member of the team. Having recently come to Microsoft back in July 2008 after spending the better part of 14+ years working in the financial services industry in IT. This was my first post on the team site and it won't be my last. I look forward to future constructive two-way dialogue that hopefully come out of these posts.

-eric

Thinking Thru Building a Virtualized Datacenter

allenstew — Tue, 29 Jan 2008 03:33:17 GMT

In most if not all enterprise customers most technology areas are driven by various teams responsible for a technology area. Some enterprise customers have more integrated technology teams then others. So how does this affect the common approach today of infusing virtualization into datacenters and building out a virtualization utility/service? To date this task has been assigned to a virtualization team or a virtualization expert in most companies folks that understand the virtualization technology well. This is reflective of the disruptive nature of the virtualization technology initially and companies reacted by creating teams to work on Virtualization. The virtualization projects started out small with Test/Development environments and expanded into production then into full blown virtualized datacenter projects.

So of course the datacenter existed long before the project to create a virtualization utility/service with various technology and process areas. Some will say the datacenter was lumbering along (no offense to present datacenter operations managers) with various issues and challenges and that virtualization is going to cure all the ills of the datacenters. I am a virtualization person and I love the virtualization technology and I happen to believe that virtualization capabilities have the potential to change how we build and use capabilities in the datacenter and beyond. Ok with that said without reference architecture of these new datacenters where virtualization is a key pillar we may miss some opportunities to completely realize all of the potential across datacenter service areas.

A Virtualization datacenter project should seek to review present datacenter capabilities determine gaps, leverage existing capabilities and redesign others that do not fully leverage or hinder the virtualization effort. What are some of the areas that have to be taken into account when embarking on this journey to build a virtualized datacenter? Well let's look at some of the services that a present day datacenter offers:

Power and Cooling
Systems/Service Management
Backup services
Disaster Recovery services
Security Services
Capacity services
Storage services
Equipment Provisioning
- Servers
- Network devices
- Storage
- Backup devices
Compliance services

So it is pretty clear that today's datacenters offer a range of complex services and you thought all it did was keep servers from being homeless. So a project to infuse virtualization as a core pillar has to seek to understand how virtualization impacts the various datacenters areas. I know what people are thinking, I already have virtual machines in production so this is a mute point. There is some production virtualization but very few projects that have truly looked at all of the datacenter areas and designed the area to fully leverage virtualization. This is an opportunity for datacenter architects and datacenter service owners to think and rethink how virtualization can affect some of the service areas in the datacenter. This exercise will help unlock potential that relooking at some of the services with virtualization capability in mind will provide. Some core areas to start are Storage and Business continuity areas that receive a lot of interest especially from the Virtualization community but have very little architecture patterns and practices. I look forward to your comments on this and experiences' looking deeper at datacenter services that Virtualization affects.

Allen Stewart

Principal Program Manager

Windows Server Group

The Definitive Guide to NAP Logging

morello — Mon, 29 Oct 2007 15:39:00 GMT

Pete Rivera is the Windows Team Lead on one of our DoD support teams and we've been working together on a NAP project. In addition to being a master of style and male fashion, Pete also puts together some great guidance for his customers. Recently, he wrote a detailed description of all the various logging capabilities that you might ever need to use to debug a NAP problem. Thanks, Pete!

NPS has various places where it does logging and/or creates a log… First off we do accounting IAS logging of the NPS status and network connection process data in %windir%\system32\LogFiles, but it can be configured to an alternative location. The log is:

IN<date>.log

2. Secondly we also can do SQL logging to a SQL 2k or SQL 2k5 database. This is used for logging user authentication and accounting requests: Logs user authentication and accounting requests in a stored procedure in a SQL Server 2000 or SQL Server2005 database. Request logging is used primarily for connection analysis and billing purposes. It is also useful as a security investigation tool, providing a method of tracking down the activity an attacker.

3. Likewise you can enable debug trace logging via netsh and this can be used to help provide detailed information about the Network Policy Server operation when NAP policies are configured: Netsh ras set tr * en

%windir%\Tracing\IASNAP.log

4. In addition this enabled a slew of other IAS/RAS related logs in the same folder (i.e.: IASSAM.LOG, IPSEC etc ):

%windir%\Tracing\*.log

5. You also have Event Logs. These provide a lot of info about the operation of NAP and connecting clients but is used primarily for auditing and troubleshooting connection attempts. Depending upon your build they are either in the SYSTEM (B3) log and/or the security log (RC0). There is also the Network Access Protection event log which you'd find on NAP clients.

6. On the client side we can enable NAP client Debug Tracing logs as well. This is enabled either via netsh or via the NAP client Configuration snap-in. It's an ETL file which is generated only by using logman… so you'll need to do a logman start QAgentRt -p {b0278a28-76f1-4e15-b1df-14b209a12613} 0xFFFFFFFF 9 -o %systemroot%\tracing\nap\QAgentRt.etl –ets in order to turn start .etl generation.

7. likewise we can also do WHSA tracing for NAP also… the trace GUID is 789e8f15-0cbf-4402-b0ed-0e22f90fdc8d

8. DHCP QEC tracing…

Netsh dhcpclient trace enable. This command enabled QEC tracing and the trace files will be generated at %WINDIR%\System32\LogFiles\WMI\DHCP*.*

9. EAPHost Tracing for 802.1x

Trace logs containing debugging information can assist users in finding the root causes of issues that occur during the EAP authentication process. The debugging information can include API calls performed, internal function calls performed, and state transitions performed. Tracing can be enabled on both the client side and the authenticator side.

When EAPHost tracing is enabled, logging information is stored in an .etl file in a user-specified location. Tracing generates an .etl file.

10. EAPHost Tracing for 802.1x (client side)

To enable tracing on the client side:

Run the following command: logman start trace EapHostPeer -o .\EapHostPeer.etl -p {5F31090B-D990-4e91-B16D-46121D0255AA} 0x4000ffff 0 -ets

Run the following command: logman stop EapHostPeer -ets

Convert the etl file into text using the following command: tracerptEapHostPeer.etl –pdb <pdbpath> -tp <tracemessagefilesdirectorypath> -o EapHostPeer.txt

11. EAPHost Tracing for 802.1x (Authenticator side)

To enable tracing on the authenticator side:

Run the following command: logman start trace EapHostAuthr -o .\EapHostAuthr.etl -p {F6578502-DF4E-4a67-9661-E3A2F05D1D9B} 0x4000ffff 0 -ets

Run the following command: logman stop EapHostAuthr -ets

Convert the etl file into text using the following command: tracerptEapHostAuthr.etl –pdb <pdbpath> -tp <tracemessagefilesdirectorypath> -o EapHostAuthr.txt

12. The we have the SCCM related logging specific to the SCCM SHA and shv. The Configuration Manager 2007 client computer log files are found, by default, in %windir%\CCM\Logs. For client computers that are also management points, the log files are found in %ProgramFiles%\SMS_CCM\Logs.

13. Ccmcca.log

This file logs the processing of compliance evaluation based on Configuration Manager NAP policy processing. It also contains the processing of remediation for each software update required for compliance.

14. locationservices.log

This log is used by other Configuration Manager features (for example, information about the client's assigned site), but it also contains information specific to Network Access Protection when the client is in remediation. It records the required remediation servers (management point, software update point, and distribution points that host content required for compliance), which are also sent in the client statement of health.

15. SMSSha.log

This is the main log file for the Configuration Manager Network Access Protection client, and it contains a merged statement of health information from the two Configuration Manager components: location services (LS) and the configuration compliance agent (CCA).

This log file also contains information about the interactions between the Configuration Manager System Health Agent and the operating system NAP agent, and also between the Configuration Manager System Health Agent and both the computer compliance agent and location services. It provides information about whether the NAP agent successfully initialized, the statement of health data, and the statement of health response.

16. CIAgent.log

This tracks the process of remediation and compliance. However, the software updates log file, Updateshandler.log provides more informative details on installing the software updates required for compliance.

17. SDMAgent.log

This log file is shared with the Configuration Manager feature desired configuration management, and it also contains the tracking process of remediation and compliance. However, the software updates log file, Updateshandler.log provides more informative details about installing the software updates required for compliance.

On the server side for the System Health Validator point, you should first check the Windows Application event log on the Windows Network Policy Server computer. This log will record any failure categories and errors with the source being SMS_SYSTEM_HEALTH_VALIDATOR. These are also raised as Configuration Manager status messages. Otherwise More detailed logging information can be found in the Configuration Manager logs and the System Health Validator point log files are located in %systemdrive%\SMSSHV\SMS_SHV\Logs.

19. Ccmperf.log

This log contains information about the initialization of the System Health Validator point performance counters.

20. SmsSHV.log

This is the main log file for the System Health Validator point. It logs the basic operations of the System Health Validator service, such as the initialization progress.

21. SmsSHVADCacheClient.log

This log file contains information about retrieving Configuration Manager health state references from Active Directory Domain Services.

22. SmsSHVCacheStore.log

This log file contains information about the cache store used to hold the Configuration Manager NAP health state references retrieved from Active Directory Domain Services, such as reading from the store and purging entries from the local cache store file.

23. SmsSHVRegistrySettings.log

This log is used to record any dynamic changes to the System Health Validator component configuration while the service is running.

24. SmsSHVQuarValidator.log

This log file records client statement of health information and processing operations. To obtain full information, change the registry key LogLevel from 1 to 0 in the following location:

HKLM\SOFTWARE\Microsoft\SMSSHV\Logging\@GLOBAL

25. <InstallationPath>\Logs\SMSSHVSetup.log

This log file records the success or failure (with failure reason) of installing the System Health Validator point.

NAP Customer Web Cast

morello — Thu, 28 Jun 2007 01:10:58 GMT

Jeff Sigman (NAP Release Manager) just added a post I wrote to the NAP blog about an upcoming customer webcast. If you weren't able to make it to TechEd, you probably missed the session that fellow WinCAT PM Pat Fetty did with Hunter Ely, who is charge of Louisiana State University's IT security technology and is one of our NAP TAP customers. Pat and Hunter's session covered LSU's architecture, deployment process, and lessons learned. So, if you've wanted to hear some real world experiences on NAP, tune into the web cast.

Morello

The Datacenter Dynamic or Otherwise

allenstew — Tue, 01 May 2007 14:01:19 GMT

Allen Stewart from the WinCat team I focus on the Datacenter from an Architecture standpoint across many technologies and I have expertise in Virtualization Technologies as well. Service Oriented Applications, Real Time Infrastructure. Service Oriented Infrastructure is all new buzz words to describe various application and infrastructure design approaches for the datacenter. Add the various Virtualization technologies: Hardware, Application, Storage, Network, Presentation and Virtualization management into the mix of technologies for someone looking at changing, implementing or redesigning a datacenter it is an exciting time.

In today's datacenter are we just adding technologies to solve today's problems or are we retrofitting the datacenter one disruptive technology at a time? Take for instance Hardware Virtualization (I will not preach about all of the benefits we know them well) it changes the way we provision, manage and allocate resources in the datacenter. As I work with customers it becomes apparent in some cases that Virtualization has been deployed without looking at things like what is the over arching impact to various datacenter services. Take for instance what is the Storage Architecture required to support the Virtual environment especially as virtualization makes workloads portable between servers. In addition, what are the types of servers we should be purchasing there are various camps blades, larger multiple core machines with Virtualization as the partitioning technology that allows the best server asset utilization. What are the management/security requirements for the virtualized world are they so different then the physical world?

As you see there are lots of things to think about and incorporate. I have been working with customers architecting Virtualization solutions with Microsoft Virtualization technologies and have taken various architectural approaches. I look forward to hearing your comments and sharing some design decisions with you from various customer scenarios. Here are some areas for us to explore:

Patch Management in the Virtualized datacenter

Capacity planning in the Virtualized datacenter

Storage architecture in the Virtualized datacenter

Business Continuity in the Virtualized datacenter

Configuration management in the Virtualized datacenter

Allen Stewart

Principal Program Manager

Windows Server Division

Longhorn Beta3 Ships!

ram — Fri, 27 Apr 2007 02:54:26 GMT

Little late on this post, nevertheless, it is great news for the Server Division and our customers. The highly anticipated release of Longhorn Server Beta3 is available as of yesterday. Beta3 is a big deal, it is a public release and is feature complete! Beta3 enables some of the coolest scenarios purely based on our customer feedback. The 60 second pitch is:

PowerShell – play around for five minutes, you will wonder how you lived without this awesome scripting functionality.
Server Manager – one stop shop to provisioning and managing server roles.
Internet Information Services (IIS) 7.0 – next gen web and app platform
Server Core – more roles, low footprint, no GUI!
Terminal Services Gateway – access your apps with TS web gateway.
Failover Clustering – improved cluster management, security, and stability.
Network Access Protection – keep your network safe from un-healthy clients.
Read-Only Domain Controller – ideal for branch offices.

Below are download links for the available ISOs:

We hope you can take the new scenarios for a spin and provide us feedback using the "Customer Scenario Voting" tool. In this tool you can "vote" on the scenario, tell us your experience, importance, etc. Trust me, we are actively monitoring your feedback. Get started, get the product, give it a spin, keep the feedback coming.

There are few webcasts coming up that will cover various topics in Longhorn Server. Be sure to check out the calendar.