Kurt Shintaku's Blog

<stolen from the Microsoft Storage blog>

After requests to release a version of File Server Migration Toolkit (FSMT) compatible with Windows Server 2008, the Storage Solutions Division at Microsoft brings you FSMT 1.1 Beta!

Microsoft File Server Migration Toolkit v 1.1 adds the possibility to migrate and consolidate data to file servers running Windows Server 2008. With that, FSMT aims to reduce total cost of ownership (TCO) and increase the efficiency of storage management and backup tasks. It covers two main features:

• File Server Migration Wizard which copy shared folders, files, and their security settings from a source file server to a target file server.
• DFS consolidation root wizard which maintain the original Universal Naming Convention (UNC) path of files after they are migrated to a new server.

We are running a short beta for the tool. If you’d like to have first hand access to FSMT 1.1, follow the instructions below before August 8^th:

1. Go to http://connect.microsoft.com
2. Sign in with your live ID. If it’s your first time at Connect, you might have to fill in a small profile.
3. Under the Connection Directory session, look for “File Server Tools” program and click “Apply Now”.
4. In the left menu, click the “Download” link to download FSRM 1.1 beta.

Instructions for download and submitting feedback can be found inside the program main page.

<stolen from the Microsoft Deployment Guys blog>

The MDT Team has released the first Update to MDT 2008 (which is really the second update to MDT, hence the 4.2 version number).  The main new features for this release are support for OEM preload scenarios (i.e. having the PC vendor preload an image onto your hardware that will work with MDT in your environment) and a revised System Center Operations Manager Management Pack.  Minor updates include bug fixes and design changes to override driver platforms as well as the ability to inject all drivers into Windows PE.  This release also has revised documentation.

I’m sure that once we’ve had a chance to give this update a thorough review, the Deployment Guys will have more to say about how this update will impact your deployments.

DOWNLOAD: 
http://www.microsoft.com/downloads/details.aspx?familyid=3bd8561f-77ac-4400-a0c1-fe871c461a89&displaylang=en

This guide describes important tuning parameters and settings that can result in improved performance for the Windows Server 2008 operating system.  Each setting and its potential effect are described to help you make an informed judgment about its relevance to your system, workload, and performance goals.

This information applies for the Windows Server 2008 operating system.

What’s New:

• Added "Power Guidelines" under Server Hardware section and added "Performance Tuning for Virtualization Servers" section.

Included in this paper:

• Performance Tuning for Server Hardware
• Performance Tuning for Networking Subsystem
• Performance Tuning for Storage Subsystem
• Performance Tuning for Web Servers
• Performance Tuning for File Servers
• Performance Tuning for Active Directory Servers
• Performance Tuning for Terminal Server
• Performance Tuning for Terminal Server Gateway
• Performance Tuning for Hyper-V Virtualization Servers
• Performance Tuning for File Server Workload (NetBench)
• Performance Tuning for Network Workload (NTttcp)
• Performance Tuning for Terminal Server Knowledge Worker Workload
• Performance Tuning for SAP Sales and Distribution Two-Tier Workload

DOWNLOAD: 
http://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/Perf-tun-srv.docx

So here’s yet even more of my notes around Active Directory Rights Management Services in Windows Server 2008.

—————————

MANAGEMENT

1. ADRMS Group Policy Templates
   (Note:  Policy Templates are the IT managed categories by which you may protect a document or mail.  For example:  “Do not forward” is a policy template that can be applied to email in Outlook.  “Company Confidential” might be another policy template that might apply to Office documents to prevent anyone without domain credentials from opening the document.  This policies are magically selectable when applying RMS protection on an email & document.)
1. RMS Clients GP Template propagation uses Task Scheduler built into the operating system;  distribution of the templates is basically ALL or nothing if you use GP driven distribution.  This means that every person configured with RMS will get these templates.
   (Some people want executives to have special templates, and if this is necessary, another method of policy template distribution needs to be considered.  They are just files in a protected directory that need to be copied to each person’s machine so there are numerous ways that this can be done.)
2. Group Policy Templates can provide all the functionality of RMS.  Office and Sharepoint inherently do NOT expose all the RMS protection options available to the user.  For example:  Some of these options include, “do not copy & paste”, “do not print”, “do not forward”, “validate every time the document is opened”, “self destruct document after x days”, “validate user ever 3rd day”.
3. The most restrictive policy is “Check for validation on each access”:  This will require contact with the authentication server every time the document is opened.  Chatty but secure.
4. When applying rights, do not give “ANYONE” rights to a document.  This will include contractors and others.  Always apply rights to a group of people.
5. Internet Explorer 6 & 7 both work with the Rights Management Client and the IE plug in for viewing RMS content within the browser without having an Office product installed.
6. “Enable users to view protected content in browser” is neat because it enables people to view RMS protected content within Internet Explorer with full fidelity and protection…
   …HOWEVER it will grow the size of the document because it provides and HTML rendering of the document in the container of the document itself.

   A 200k document can grow to 2MB in size with this option turned on.

7. “Print” rights is a HOLE.  A user can always print to PDF and then reverse engineer the PDF into a document.
8. Watermarking or “stamping the background” of an RMS document with the end users name/title/email when they print is possible through third parties.
9. The recommended method of distributing templates is to establish a Network Share that everyone has access to, enable Offline folders for that share, and place the appropriate templates on the share that people need.
   This enables specific templates to be distributed “per user/group” by redirecting the users to different folders depending on their group membership.
10. IMPORTANT:  You can NEVER remove or retire a template from the organization without killing all the documentation that was protected by it previously.  Disaster Recovery plans must export all templates to preserve integrity of all protected documents.
11. IMPORTANT:  Office 2003/2007 have a 20 template limitation in their UIs.  You may publish more than 20 but only 20 will be accessible by the users.

So here’s some more of my notes around Active Directory Rights Management Services in Windows Server 2008.

—————————

ARCHITECTURE & DESIGN (cont’d)

1. Active Directory Rights Management Services does NOT require Windows Server 2008 Domain Controllers.  You do NOT have to upgrade these authentication servers.
2. You additionally do NOT need to upgrade older RMS Clients if it’s already deployed to existing workstations.  They will work with the new ADRMS infrastructure.

IMPLEMENTATION

1. SUPER, MAJOR, IMPORTANT BEST PRACTICES
1. Always used fully qualified domain names (.com) when configuring ADRMS trusts however be very careful about selecting these names because you will never be able to change them once applied, without re
2. Always use virtual names – not actual server names – whenever you’re configuring ADRMS for seamless agility of servers.  If you configure actual server names, you’ll have to use the same configured servers forever.
3. Always use both HTTP: & a HTTPS: (for external authentication) in case you later want to work with partners via ADFS or need external access to documents without a VPN.  Make it some sort of domain name like https://virtualname.customerdomain.com.  Seriously.  Even if you never, ever think you’ll ever need it, configure it anyway because once millions of files are protected using a “configuration policy” referencing a set of authentication servers, if you ever need access to an authentication server externally, you’ll need to have an encrypted pipe, and that’s going to requires HTTPS:. 
4. Never use self-signed certificates when you’re configuring your HTTPS: configuration.  Remember that people won’t have your root cert if it’s a 3rd party that you’re looking to share with.
2. CLUSTERS
1. You can expect 60 connections per second per cluster.
2. You can NOT have bothe RMS 1.1 and RMS 2008 servers within a cluster.
3. RMS 1.1 licensing clusters should work but it’s not recommended by the product group.
3. ADRMS Client
1. There is a new registry key i.e. a “publishing bit” that enables/disables the ability to ‘create/originate new RMS encrypted content’ .  This allows an organization to control who has the ability on a Group Policy basis to protect documents based on the Office Edition the user owns.   (ONLY Office Professional licensees may ‘create new protected content’ from Outlook/Word/Excel/Powerpoint.  Office Standard licensees & Exchange Outlook users may only ‘receive/read/reply to protected content’.)
   KEY –> HK_CURRENT_USERSoftwareMicrosoftOffice12.0CommonDRM
   DWORD Value –> Disable Creation 0/1
2. Clients must have fully qualified domain names of the ADRMS Cluster in the local Intranet Zone of their Internet Explorer security configuration.
4. ADRMS & Sharepoint, Exchange, and Windows Servers
1. Sharepoint Server & RMS must exist in the same forest; ADFS doesn’t matter in this case.
2. When configuring the Exchange 2007 Pre-licensing Agent, you must have both Exchange Server 2007 Service Pack 1 applied and the RMS Client installed on the server.
3. Windows Server 2008 has RMS Client built directly into the OS.  There is no “install"/”uninstall”.  It’s just there.  Warning:  If something goes irreparably wrong with the client for some reason on the server, it’s hosed.  You’ll need to reinstall the whole server.

I have this spreadsheet that I created that thought I’d share.  Basically, it’s a simple table of all of Microsoft’s earnings across every business division we have  from year to year.  I’ve entered all of the revenue & income numbers (a.k.a. the “money coming in” vs. overall profit of each division) and graphed it out in Excel 2007. 

(Note:  You’ll need to have Office Excel 2007 installed, have the Excel 2007 Viewer installed, or if you already have Office 2003/XP/2000 installed, you’ll need to download and install the Office 2007 Compatibility Pack to allow you to read and write the  OpenXML file format for Excel 2007 (.XLSX) – which is much better than the older .XLS format for compression, reliability, and programmability.)

DEFINING THE DIVISIONS
For the uninitiated, there are 5 divisions within Microsoft and our financials are reported along these organizations:

• Client (Windows desktop & Embedded revenue)
• Server & Tools (Server products that aren’t aligned with Information Worker initiatives along with Developer Tools)
• Business (Information Worker technologies like Office, Office Servers along with Business Solutions like CRM & the Dynamics family of products)
• Online Services (Windows Live, Office Live, MSN Services, Advertising Services, etc.)
• Entertainment & Devices (Xbox, Xbox Live, Zune, & Windows Mobile)

ALSO QUARTER-TO-QUARTER NUMBERS
For the truly anal, I’ve also got all the numbers from quarter to quarter, and broken out each quarter’s earnings year over year so you can compare, for example, what the “Holiday season” was like for Microsoft’s Entertainment & Devices division (a.k.a. the Xbox guys) year over year.

Now before the more short-sighted folks scream that the sky is falling, be aware that revenue & income are not always linear:  Certain things happen – whether you hear about them or not in the press – that create irregularities in earnings & profitability in certain quarters. 

For example:

• In Q4 2007, there was a sudden & massive drop in income (profitability) in the Entertainment & Devices division.  For the informed, this was because of the $1B charge that was taken in that quarter to fund the extended 3 year warranty applied to Xbox 360’s that were having “red ring of light” failures and it was deemed necessary to take the hit for the sake of our customers.
• In Q2 2007, there was a strange drop in revenue/income in the Client division relative to Q2 earning in previous years and a sudden irregular surge in revenue/income in the same division in Q3 of the same year.  This was because we deferred revenue from Windows OEM licensed PCs from that Q2 into Q3 causing a delay in when that revenue was realized in the ol’ accounting books.
• Prior to Q2 2004, Microsoft didn’t report per division income so although I have revenue numbers for Q1 2004, I don’t have income numbers. (That’s why data points for that quarter are missing)  This incidentally is also the reason I started this chart at 2004.  Operating income (i.e. revenue less operating costs, or “profit”) is a pretty important dimension, don’t you think?

THE PRE-2007 FUDGE FACTOR
Incidentally, I had to munge some numbers in the first few years.  What I mean by that is that before 2007, in case you weren’t constantly looking at our financials back then, Microsoft used to report its revenue & income across 7 divisions instead of 5:

• Client
• Information Worker
• Server & Tools
• Business Solutions
• MSN
• Mobile & Embedded Devices
• Home & Entertainment

It’s not an exact correlation as I understand it but what I did was I merged the Office & Business Solutions numbers to create synthetic “Business Division” numbers and I merged the Home & Entertainment & Mobile devices numbers to create synthetic “Entertainment & Devices” numbers.  The end result still totals the complete revenue across all divisions but if my “inaccuracy” bothers you, simply ignore the pre-2007 numbers.

Anyway, here’s my spreadsheet.  Hope you find it interesting.

http://cid-00da410c7f7e038d.skydrive.live.com/embedrowdetail.aspx/Miscellaneous/MicrosoftRevenue-WEB.zip

The statistical results from the Mojave Experiment, a blind study of individuals who evaluated Windows Vista without knowing what it was they were using. (Taken from http://www.mojaveexperiment.com/facts/)

Microsoft Technology Center Presents…

Best of MMS 2008
Microsoft Irvine

Join the Microsoft Technology Center (MTC) for an exclusive engagement covering the Best of Microsoft Management Summit 2008. For IT Professionals unable to join MMS 2008 in Las Vegas, we are excited to announce that we are holding a special session: “Best of MMS 2008” in Irvine. This session will review the exciting announcements from MMS, along with how Microsoft solutions will enable you to proactively manage your IT environment.

Chris Tillier, Microsoft Senior Technology Specialist, will be conducting this session using Microsoft’s Envisioning Center and Hands-on labs. This workshop will provide the best way to learn how to apply Microsoft’s Management solutions in your organization, fueling productivity and building growth. Attendees will be shown demonstrations using the envisioning center and be given the opportunity to try the new products in our instructor-led hands-on lab.  

Full Day Agenda (½ day Envisioning Center and ½ day Hands-on Workshop):

Managing and Securing the Dynamic Infrastructure (morning)

Overview of MMS 2008

• Review of Microsoft’s latest System Center announcements

Envisioning Center Demonstration: Infrastructure Optimization

• Streamlining Operations.  “Day in the Life” demonstration of how automation, security, standardization, and management save the day (and time and money!).  Higher efficiency through “Better Together”

Meeting & Exceeding your service level targets

• Service Level Monitoring
• Proactive alerting
• Dynamic Allocation of resources

Lunch: Room: Technical Briefing Center (TBC)

Hands-on Workshops: (afternoon)

Room: Technical Briefing Center (TBC)

• System Center Operations Manager 2007 SP1
• System Center Configuration Manager 2007 SP1
• System Center Data Protection Manager 2007
• System Center Virtual Machine Manager 2007
• Desktop Optimization Pack

Room:
MTC Envisioning Center

Date:
August 20, 2008 – Repeated on August 21, 2008

Time:
9:00 AM – 4:30 PM
Registration begins at 8:30 AM
(Breakfast, lunch and parking included)

Location:
Microsoft Irvine
3 Park Plaza, Suite 1600
Irvine, CA 92614

Registration:
If you are a customer of mine and are interested in attending, please contact me directly for information on how to register.  Seating is limited to 25 guests, so please sign up for this informative session as soon as possible. 

Introduction to Microsoft
System Center Configuration Manager 2007
Hands-On Workshop

Irvine – October 1, 2008

You are invited to attend a 1-day seminar designed to deliver practical, hands-on information about Microsoft’s System Center Configuration Manager 2007. Attendees will learn how to manage the ongoing operations using System Center Configuration Manager. This workshop will be led by a Microsoft Senior Technology Specialist, covering the following topics:

• Introduction to System Center Configuration Manager 2007
• Managing more than Microsoft in your environment
• Lifecycle management (Asset Management)
• Microsoft System Center: Vision and Roadmap
• Microsoft Desktop Optimization Pack (MDOP) Overview
• Hands-on Labs

We will also share best practices, methodologies and tools that will assist in the planning and implementation of a Microsoft System Center Configuration Manager solution.

Audience:
This course is intended for System Center Administrators who are responsible for configuring and managing one or more sites and all supporting systems. This technical hands-on workshop is limited to 30 attendees.

Date/Time:
Wednesday October 1, 2008
9:00 AM – 4:30 PM
Registration begins at 8:30 AM
(Breakfast, lunch and parking included)

Location:
Microsoft Irvine
3 Park Plaza, Suite 1600
Irvine, CA 92614

Registration:
If you are a customer of mine and are interested in attending, please contact me directly for information on how to register.  There are only 30 seats available and at least check 12 were taken already.

Introduction to Microsoft System Center Operations Manager 2007
Hands-On Workshop
Irvine – September 30, 2008

You are invited to attend a 1-day technical introduction designed to deliver practical, hands-on information about managing your infrastructure with Microsoft’s System Center Operations Manager 2007. This workshop will be led by a Microsoft Management Technical Specialist covering the following topics:

• Introduction to System Center Operations Manager 2007
• Common Monitoring Scenarios
• Monitoring more than Microsoft
• Microsoft Desktop Optimization Pack (MDOP) Overview
• Hands on Labs

With this new release, Operations Manager will:

• Proactively manage business critical IT services, including distributed applications, the supporting infrastructure and hardware, and end-user service delivery.
• Reduce the complexities of managing your IT environment by providing a monitoring solution that is designed with ease of use in mind.
• Provide a highly reliable infrastructure by leveraging Windows Server and SQL 2005 clustering for high availability and through agents that automatically failover to a secondary management server if connectivity to the primary server is lost.
• Include management packs with prescriptive knowledge developed by the application and OS development teams at Microsoft and verified in production deployments to improve monitoring, troubleshooting, and problem resolution for more than 50 Microsoft applications and Windows Server components.

Audience:
This hands-on lab is for IT Professionals in job roles like infrastructure specialists, network administrators, directory administrators, management specialists, storage and data administrators and client support. This technical hands-on workshop is limited to 30 attendees.

Date/Time:
Tuesday September 30, 2008
9:00 AM – 4:30 PM
Registration begins at 8:30 AM
(Breakfast, lunch and parking included)

Location:
Microsoft Irvine
3 Park Plaza, Suite 1600
Irvine, CA 92614

Registration:
If you are a customer of mine and are interested in attending, please contact me directly for information on how to register.  There are only 30 seats available and at least check 15 were taken already.