Kurt Shintaku's Blog

We just released the following training course and exam for the Microsoft Desktop Optimization Pack (MDOP):

(Note:  MDOP contains Application Virtualization (a.k.a. Softgrid), Diagnostics & Recovery Toolset, Advanced Group Policy Management, Asset Inventory Services, Desktop Error Monitoring, and soon, Enterprise Desktop Virtualization, a.k.a. the Kidaro stuff)

• Course 7197: Deploying and Managing the Microsoft Desktop Optimization Pack is now available.
  Read a description of the MDOP Course 7197 syllabus. Find this training in a city near you
• Exam 70-656: Microsoft Desktop Optimization Pack, Configuring is now available.
  Read the preparation guide for MDOP Exam 70-656.

Both the course and exam target IT pros who focus on managing desktops. MDOP Course 7197 is eligible for SA training voucher redemption, so customers can apply their SA Benefits to reduce training costs. As an added incentive, the first 200 IT pros who pass the 70-656 certification exam become MDOP Charter Members and will receive an exclusive MDOP Charter Member jacket and award!

Learn more about the benefits of MDOP Charter membership.

This is a compilation of free training opportunities for Windows Server 2008. They consist of “Learning Snacks”, “How Do I?” video demonstrations, Virtual Labs, and Webcasts.

Windows Server 2008 Learning Snacks
Want to learn more about Windows Server 2008, but are short on time? Learning Snacks are short, interactive presentations about popular Windows Server 2008 topics and have been created by Microsoft Learning experts.

• Introducing Branch Office Server in Windows Server 2008
  This free Snack describes the benefits that Windows Server 2008 provides for installing and maintaining a branch office network. It demonstrates the installation of a branch office network by using the new server core option. It also lists the benefits of Active Directory read-only domain controllers (RODCs) and BitLocker Drive Encryption.
  http://www.microsoft.com/learning/_silverlight/learningsnacks/ws08/snack01/Default.html
• Implementing Active Directory Domain Services in Windows Server 2008
  This free Snack describes the new options available in Windows Server 2008 for installing and configuring Active Directory Domain Services (AD DS) and auditing changes to it. It lists the features of read-only domain controllers (RODCs) and describes how to perform a nonauthoritative or an authoritative restore of AD DS data.
  http://www.microsoft.com/learning/_silverlight/learningsnacks/ws08/snack03/Default.html

How Do I Demo Videos

• 10 Cool Things to do with the Powershell
  This demo shows some of the neat things you can do with PowerShell with regards to server administration. There are 10 demos you can run through ranging from simple queries for services to enumerating information in Active Directory. Some of the scripts use lists of computers, some prompt for a computername. Each script shows a different thing you can do with PowerShell to quickly create administration scripts.
  http://technet.microsoft.com/en-us/windowsserver/2008/cc441384.aspx
• Server Core Remote Management
  This demonstration highlights the benefits of Server Core, with its low overhead, and highlights how it is easy to manage Server Core with the new management tools and technologies included in Windows Server 2008.
  http://technet.microsoft.com/en-us/windowsserver/2008/cc441379.aspx
• Securing Branch Office User Accounts
  In this demo you will see several ways that user accounts in a branch office can be secured. Branch offices traditional are a place of high risk for domain controllers. Placing domain controllers in branch offices good for functionality and productivity, but bad for security. This demo shows how you can place a domain controller in a branch office, and take measures to make those branch office accounts more secure. The demo uses a combination of BitLocker, RODC, Fine Grained Password Polices using a tool from Special Operations Software, and Admin Role Seperation to achieve this goal.
  http://technet.microsoft.com/en-us/windowsserver/2008/cc441413.aspx

Virtual Labs

• TechNet Virtual Lab: Managing Active Directory – Directory Services 
  After completing this lab, you will be better able to use the new features in Active Directory. This lab has a laundry list of new features in Active Directory.  It is intended to demonstrate some of the ways that Active Directory management and operations have been improved in Windows Server 2008.  It addresses all scenario’s that Active Directory is used in, including management, security, and remote infrastructure.
  http://msevents.microsoft.com/CUI/WebCastEventDetails.aspx?EventID=1032380229&EventCategory=3&culture=en-US&CountryCode=US
• TechNet Virtual Lab: 10 Cool Powershell Scripts 
  After completing this lab, you will be better able to quickly create administration scripts with Windows Server 2008.
  http://msevents.microsoft.com/CUI/WebCastEventDetails.aspx?EventID=1032380227&EventCategory=3&culture=en-US&CountryCode=US

Webcasts

• Deep Dive into Windows Server 2008 File Services (Level 300)
  is webcast will provide an overview of the changes in Distributed File System (DFS), Volume Shadow Copy Service (VSS), and storage management in Windows Server 2008. It also takes a close look at some of the most significant and valuable improvements to Windows Server 2008, including Transactional NTFS, Self-Healing NTFS, and the Server Message Block (SMB) 2.0 protocol.
  Upcoming IT Manager Webcast: Deep Dive into Windows Server 2008 File Services (Level 300)

<stolen mostly from the Application Virtualization (product-formerly-known-as-Softgrid) blog>

To simplify Application Virtualization Server management, the App-V team is excited to make available a RC version of our App-V 4.5 System Center Operations Manager 2007 Management Pack (OpsMgr 2007 MP). It has just been posted over on the Microsoft Connect site (http://connect.microsoft.com). This OpsMgr 2007 MP only supports version 4.5 servers; it does not support previous SoftGrid server versions or MOM 2005.

The Management Pack is designed to maximize Application Virtualization Server availability for handling Application Virtualization Client requests. The Application Virtualization Server health status is color-coded:

• No color indicates that the server is running without non-recoverable errors.
• Yellow indicates that one of the components is not functioning correctly. The overall functionality of the server is degraded but the server is still available.
• Red indicates that the server is not available and it cannot provide key services or it cannot communicate with external service dependencies.

Health Status change is triggered when an Application Virtualization Server logs a tracked error or warning to the local System Event Log under the Application Virtualization heading. Over 60 unique errors are tracked and these errors are mapped to information about how to fix or further troubleshoot the issue.

The Management Pack monitors the following aspects of server health:

1. Server Status—monitors server events to validate that the server is providing its expected services.
2. Data Store Access—tracks the ability of the Application Virtualization Management Server(s) to access and communicate with the Application Virtualization Data Store.
3. Content Data Access—monitors access to the Content directory, which might be a local directory or a network share, and the ability to read the requested files.
4. Security—reports errors with the Application Virtualization Server’s certificate and secure communications.
5. Client Request Handling—monitors the ability of the Application Virtualization Server(s) to handle and correctly respond to client requests. These requests include publishing configuration requests, package load requests, out of sequence requests, etc.
6. Server Configuration—checks the configuration settings of the Application Virtualization Server. These configuration settings include the settings in the Registry and in the Application Virtualization Data Store.

The following items indicate the main differences between the Application Virtualization Management Server and the Application Virtualization Streaming server areas of the Management Packs:

• Application Virtualization Management Servers can provide publishing, streaming, management, and reporting services. Therefore, the Management Pack can manage more aspects of the Management Server compared to the Streaming Server, which only provides package streaming.
• The Streaming Server does not have a Data Store, therefore, data store access is not monitored. The configuration information for the Streaming Server is managed in the registry.
• The Streaming Server does not use the Server Management Console interface; use other tools to manage the configuration.

The OpsMgr 2007 MP will be translated into all the languages supported by the Application Virtualization Server.

We hope this OpsMgr 2007 MP will make it easier to manage App-V 4.5!

This is pretty cool.  It’s the developer map of the Open XML ISO standard file format so that people can understand how to extend it or leverage it for their own business applications.

Customers can compose their own Office documents using the Open XML standard.  Because it’s well documented, basically any piece of software could leverage it and build applications based on content within a document.

DOWNLOAD:
http://www.microsoft.com/downloads/details.aspx?FamilyID=134bcb91-dd7b-4209-ac94-2699b9366874&DisplayLang=en

“How to improve performance quickly & easily in Windows Vista”

If you’re one of the people that still hasn’t been able to figure out how to tune an installation of Windows Vista for performance (and you call yourself an IT Professional?  <grin>) we’ve made it pretty straight forward for you with this basic guide on “Performance & Tuning” for Windows Vista.

Windows Vista and SP1 focus on delivering greater performance and overall system responsiveness. By striking a balance between speed and responsiveness, Windows Vista and SP1 deliver a level of performance that has the greatest positive impact on the system’s usability.This guide looks at the following areas of performance improvement:

• Making configuration changes that help a computer feel more responsive when you use it.
• Using hardware to boost the actual physical speed of a computer.
• Making configuration changes that help a computer to start faster.
• Making the computer more reliable may help increase performance.
• Monitoring performance occasionally so that you can stop problems before they get too big.

DOWNLOAD: 
http://www.microsoft.com/downloads/details.aspx?FamilyID=ab377598-a637-432c-a3c8-1607ab629201&DisplayLang=en

The fact is, single core machines with 1GB of memory and 50GB of storage can run Windows Vista Home Basic or Business just fine.  (Home Premium & heaven forbid Ultimate have substantially higher resource needs and may require 2GB RAM)  In fact, there’s a lot that even the guide doesn’t tell you.  Here’s an example of a document that I’m writing myself about little tweaks that you can make:

Do you own a standard, conventional laptop? 
Have you installed Windows Vista Ultimate Edition?
If so, there’s a darned good chance you’ve got the Tablet Input Panel Service running in the background of your PC as a service for basically no reason at all.  Go to Start—>Run and type SERVICE.MSC.  Search for the Tablet PC Input Panel Service and disable it.  You’ll never need it and it’s basically just eating RAM and the occasional CPU cycle to iterate through another service.

WARNING:
This is by no means a blessing to “shutting down all supposedly unnecessary services” which some goombas on the Interwebs believe is the holy grail of performance tuning on Windows Vista.  Newsflash:  It’s HIGHLY unlikely you really know whether or not you need a given service, and it’s very likely that some Windows application, utility within Windows, or one of the other services requires the service you’re planning on shutting down – and it’s likely that you haven’t considered all the permutations of requirements, or even thought of what services are really impacting your system.  Just because it’s listed doesn’t mean it’s tasking your system. 

And the folks on the net that are listing out "what services to turn off in Windows Vista” are missing one very important piece of information:  The software that you run.  Because they don’t know your environment, how can they declare what services are “unnecessary to you”?

This is so cool it’s sick: 
Introducing the Dell Studio Hybrid.

• IT’S SMALL
  Same footprint as a Mac Mini Combo.
• IT’S MORE AFFORDABLE
  Cheaper than a Mac Mini Combo. ($499)
• IT’S MORE POWERFUL
  1.86Ghz Dual Core Pentium, 2GB memory (twice that of Mac Mini Combo), 250GB hard drive. (3x that of Mac Mini Combo)  And it comes with Windows Vista Home Premium.
• IT’S CONNECTED
  It comes with HDMI & DVI ports along with AC3 audio, Gigabit networking, and both firewire and 3 USB ports.
• IT’S GOT VALUE
  Unlike Mac Mini, it includes keyboard & mouse.  And for $199 more, you can get a very nice 19” widescreen flat panel monitor.
• IT’S PERSONAL
  It has with a bunch of customizations like a red frame and Blu-Ray drive.
• IT’S GREEN
  Systems power consumption is only 65 watts.

It’s got a lot of options to upgrade the memory or the hard drive or whatever you want.  I’m partial to this bamboo model:

http://www.dell.com/content/products/productdetails.aspx/desktop-studio-hybrid

I had the privilege of taking an Active Directory Rights Management Services for Windows Server 2008 course over the last two days containing content that should have been delivered over 4 days, and learned more than I could have imagined about the product.

Because I know that a lot of you have been strongly considering licensing Active Directory Rights Management Services or have purchased licenses for it and are planning on deploying Active Directory Rights Management Services, I’m going to document what information I was able to glean in a series of blog posts because this material simply doesn’t appear to be documented anywhere.

TIME OUT:  SUPPORT FOR ACTIVE DIRECTORY RIGHTS MANAGEMENT SERVICES
Before I begin, the most important thing to take away from this is that the lead Product Support engineer for Active Directory Rights Management Services at Microsoft is a guy named Jason Tyler, and he has a blog that he maintains at http://blogs.technet.com/rmssupp that is SCARY GOOD. 

Very rarely is there a blog with this much unique and pertinent content on a given product.  In fact, I wish there were more “support oriented” blogs out there written by the support geniuses that have to answer calls and debug issues on the products.

That being said, here we go:  A random series of notes that I took regarding Active Directory Rights Management Services for Windows Server 2008.

——————–

MICROSOFT ACTIVE DIRECTORY RIGHTS MANAGEMENT CAPABILITIES

1. Active Directory Rights Management Services is the only cross-application product on the market that support email encryption & policy-based usage restriction.  Other products – like Adobe – do not.
   
2. Windows Mobile-based devices are the only mobile devices on the market that can ORIGINATE Rights Managed content out of the box – specifically usage restricted emails.  Blackberries and other devices can at best – leveraging 3rd party add-on solutions for RMS – “read” and “consume” rights-managed email and content, but not originate it.
   
3. MSDN has a “Content Protection Tool” that enables a developer to write flawless code leveraging Active Directory Rights Management Services by literal “code creation” which the developer can cut & paste into their application.
   
4. The 3 major partners of Microsoft’s in the Rights Management Services space are Gigatrust, Titus, and Liquid Machines.

ADRMS ARCHITECTURE & DESIGN

1. Scaling of Active Directory Rights Management Services depends on the number of devices, the document count to be protected, the enforcement policies used.
   
2. Scaling Active Directory Rights Management Services is very easy.  It simply involved deploying more load balanced Rights Management Servers in a cluster that connect to a highly available cluster of SQL Servers with a RMS database. 
   
3. The Active Directory Rights Management Servers themselves can be formatted, reinstalled & hooked up to the SQL Server with no problem being that all the configuration data, policies, logs and certificate information are stored in the SQL back end and not configured on the ADRMS Server installation.
   
4. Active Directory Rights Management Server is supported in virtualized configurations HOWEVER the deploying customer must strongly consider the security & performance implications of doing so.  “Mobilizing” the RMS system by virtualizing it is not likely a good idea.
   
5. Both Windows Vista Services Pack 1 & Windows Server 2008 contain the Active Directory Rights Management Services client built into the operating system code.  It is not an “installable” component nor is it visible in Control Panel.  It’s just there in the OS itself.
   1. This makes every deployed Windows Vista machine ready to use Active Directory Rights Management Services out of the box.  Just add Group Policies and RMS Template distribution to configure appropriately.
   2. The same can be said for Windows Server 2008 which may require the use of the Active Directory Rights Management Services client’s libraries for various server side operations.  For example, if the server is an Exchange Server 2007, Exchange requires the ADRMS Client libraries to pre-cache licenses for emails so that the client doesn’t need to retrieve them.
6. Active Directory Rights Management Services client has no client-side logging.  This is a function provided by 3rd party add-on vendors like Gigatrust, Titus, and Liquid Machines.
   
7. The Active Directory Rights Management Service leverages 3 databases:
   – Configuration Database
   – Logging Database
   – Directory Services Database  (Used as a replica of AD for Group Membership caching – synchronized every 12 hrs with AD Domain Controller)

   These databases are represented by a SINGLE INSTANCE on a SINGLE PHYSICAL SERVER; i.e. you can not separate these databases out into different host SQL Servers.

8. There is only ONE ADRMS implementation per Active Directory forest.  To have two forest implementations work together, one must leverage the NEW ADRMS TRUST functionality of RMS in Windows Server 2008.  This configuration requires both an AD trust as well as a ADRMS Trust.
   
9. Audit reporting for access attempts, successes, & failures is not readily available out of the box; i.e. 3rd party partners develop comprehensive solutions for this.  Despite the availability of a log in ADRMS, we provide only basic reporting that is primarily used for troubleshooting – not for auditing.  (ex:  how many people have accessed this file, who specifically has read it so far, etc.)

There’s no Windows Mobile app/client available yet but it’s clear that it’s so close you can smell it.

Mobilized Windows Live Mesh… coming to a Windows Mobile device near you!

LINK:  http://m.mesh.com

[This was important enough that I thought I should post this here]

Not all SSL-encrypted Internet connections are secure.  Just like how certain area codes (900) or prefixes (976) are not "free", there are SSL sites out there that people need to be aware of that are ultimately not secure & very vulnerable… and the worst part is the vendor or web site owner may not even know it.  The problem is that there are SSL certificates out there on Internet sites that leverage weak certificates that are very easy/trivial to crack, due to an error in the current distribution of Debian Linux.

Anyway, there is a tool that’s been released by ‘heise Online’ that installs into any Windows 2000/XP/Vista machine that automatically detects these weak SSL connections and pauses for input when it finds one.  Called Heise SSL Guardian, the tool can prevent you from going to a weakly protected site, and will even report the site back to heise Online itself.

Note that the tool only works for Windows & Internet Explorer.  If you’d like to download the tool go to:

LINK:  http://www.heise-online.co.uk/security/Heise-SSL-Guardian–/features/111039

UPDATE 7/26/08: 
It looks like we’ve going to post the results here at http://www.mojaveexperiment.com/.

ORIGINAL POST:
There’s been some buzz recently about Windows "Mojave":

Microsoft last week traveled to San Francisco, rounding up Windows XP users who had negative impressions of Vista. The subjects were put on video, asked about their Vista impressions, and then shown a "new" operating system, code-named Mojave. More than 90 percent gave positive feedback on what they saw.

Then they were told that "Mojave" was actually Windows Vista.

That’s just ROFLtastic – especially in this day and age where Internet news seems to be very rarely researched, checked, and qualified.  Everyone knows that negative press sells more than positive press does but it’s impact is made doubly so with the advent of the Internet being that apparently it’s more fun for people to pile onto a negative story and let it snowball, going from "Windows Vista lacks drivers," to "M$ Vista is for l4merz – it lost my homework, stole my allowance, & kills babies!!!LOL"

You can just imagine these folks going into the room goin’, "I hate Vista!  Hateithateithateithateit!  It’s just bad!  Because that’s what I read on the Intenret.  And the kid down the street told me so."  Then the bomb drops on them and they go:  "Uh… erm… oh wow."

LINKS: 

• Microsoft looks to ‘Mojave’ to revive Vista’s image
  http://news.cnet.com/8301-13860_3-9998336-56.html
• Once Tricked Into Using It, XP Users Start to Love Vista
  http://www.realtechnews.com/posts/5893