Wednesday, July 25, 2012

Windows 2012 Licensing

Microsoft is changing things up a bit as they launch Windows 2012, the new server OS.  They are going to just two editions:

Standard Edition and Datacenter Edition.

Any copies of Enterprise Edition that are owned in the world (in Software Assurance) will convert to 2 standard licenses.

All features will be avaliable in both editions of Windows 2012.  The only difference being the virualization allowance.  With each license of Standard that you apply to a server you will be able to host up to two VMs.  You can stack copies of Standard on a server to increase that number as well.

Datacenter Edition will continue to provide unlimited free VMs.

The licensing for both editions is based on a two processor server and you license servers by their physical hardware (in other words VMs cannot be licensed). 

With the move to 2012, the Enterprise and Web Server versions are being elimiated.  One to reduce the costs / complexity of licensing and one due to the lack of popularity.

You can read more here: http://download.microsoft.com/download/4/D/B/4DB352D1-C610-466A-9AAF-EEF4F4CFFF27/WS2012_Licensing-Pricing_FAQ.pdf

Saturday, May 26, 2012

Handy ADFS / Claims Based Identity Links

Microsoft Windows Identity Foundation:
http://msdn.microsoft.com/en-us/security/aa570351.aspx
http://msdn.microsoft.com/en-US/evalcenter/dd440951.aspx

Microsoft's Claim Based Identity and Access Control (2nd Edition)
http://msdn.microsoft.com/en-us/library/ff423674.aspx

MSDN Magazine:
http://msdn.microsoft.com/en-us/magazine/cc163366.aspx

ADFS:
http://technet.microsoft.com/library/dd727958(WS.10).aspx

Claims Based Identity & Access Control Guide (Codeplex)
http://claimsid.codeplex.com/

Exchange Cross Forest Work

Perhaps you are caught up in the work of migrating users from one domain to another (then again perhaps you actually have really fun things to do besides dealing with the politics of moving people across domains).  One interesting thing that makes sense when you look at it but at first glance is a bit confusing is establishing Exchange permissions.

There are really two types of Exchange permissions when dealing with mailboxes.  There is full access and send as/on behalf of.  I say there are two permissions because send as and on behalf of, while assigned differently are generally assigned the same way.

So on to the story!  While moving people's mailboxes from domain A to domain B we discovered that going into Exchange and saying "Hey, grant this dude full access" via the MMC just was not getting us where we wanted to be (in other words, they got no access at all).  It was not till we sat down and really thought about the "Full Access" requirements.

So you have "Joe User" logging into his PC in domain A with the account DomainA\joe.user and the mailbox that Joe users is on domain B.  For that to work, there is a disabled account setup in Domain B that the linked mailbox is tied too.  That disabled account in turn is tied to Joe.User in Domain A (with me so far)?

So Joe logs in with his Domain A account and accesses his mail in Domain B.  Then comes along Sally User and Joe wants her to have full access to his mailbox.  So there we were thinking "Dude, this is easy, right click, Full Access, Sally, click a few times, get some Cheetos.

Sally fires up her Outlook, opens up Joe's mailbox and BAM, no access!

So what happened?  Well, Sally is just like Joe and she is logging into Domain A as DomainA\Sally.User and then accessing her mailbox (which has that same linked mailbox type with a disabled user in Domain B).  Then she clicks on Joe's mailbox and it tosses the error.  Well... Sally is trying to open Joe's mailbox as DomainA\Sally.User, not DomainB\Sally.User (the linked mailbox account) and we did not grant rights to that Sally!  We granted them to the linked mailbox and the account in Domain B.

Darn silly of us; but why doesn't Exchange tell us?  Well... my guess is it is partly evil with a chance of this is why they have Exchange experts and tech support.

So you have to get a little brave and fire up the old PowerShell and get Sally the access she so desperately needs!  That command looks a little like this:

Add-ADPermission -Identity ”joe.user” -User ”DomainA\sally.user” -AccessRights ‘FullAccess’

The thing to note is that you only have to identify Joe's mailbox (in Domain B) but you have to qualify Sally's account in Domain A with the domain name.

Easy right?  Well, here comes another twist!  Want to grant send as rights or send on behalf of?  Well, you can do that from the MMC or via PowerShell.  The reason this works is because it is not a permission that is checked as you access the system, it is checked on the Exchange server as the email is sent.

So Exchange says "Hey, an email from Sally's account going out as Joe.  Does her mail account have that right?  Well, the mail account is the Domain B linked account.  There you can go into the MMC, right click, send as, add the user, click a few times, and you'll get some tasty success action!

You can also dig into the account and grant send on behalf of rights.

One last thing to note.  If you grant "Send on Behalf of" and "Send As" rights to the same account, it will send on behalf of, not send as.  So keep an eye on that!

All of this might not be new to those of you out there that know more than me (which covers just about everyone) but I learned something that day, and it was jolly good!

Friday, December 09, 2011

Granting Exchange Send As Permissions

I am on a quest to discover what the most stringent AD permissions I can grant to people are and right now I am working through the process of granting the user administration team the right to manage granting the Exchange rights "Send As" and "Full Access" for user mailboxes.

There is a shockingly light amount of information about this on the Internet.  The Exchange blogs seem to focus on granting wide and generous permissions.

One thing that makes this a bit more complicated for us is that we have moved our AD administration into Quest ActiveRoles, while our Exchange administration is still in Active Directory.

At this point, the best I have found is that to grant the ability to Send As, the permissions that seem to work is to make the administrator a member of the "Exchange Recipient Administrators" group and to grant that group the "modify permissions" right on the AD user objects.

I have a feeling there is a stricter right that can be applied but I have not found it yet.

I am still on the search for the ability to grant the "full access" rights.... One day!!!

Friday, April 22, 2011

AD FS 2.0: Getting Started

I have started a project to play with AD FS 2.0; and I have discovered that there is not a single book on the topic nor is there a lot of good information on the Web about AD FS, so my adventures in getting started in AD FS have been bumpy to say the least.

The good news, for me, is that a coworker received an invitation to the Microsoft AD FS 2.0 class which was passed on to me. Starting Monday I will get to learn, hopefully in depth, how AD FS 2.0 works and much more detail about it.

My goal is to launch AD FS 2.0 and to write the fable of launching AD FS 2.0 so that people who follow in my footsteps can have a resource for getting started.

What I know so far is that I want to have something that looks like this at the end of the day:

So, check back here to keep track of my AD FS adventures!

Sunday, February 27, 2011

Items of Confusion

In a recent discussion with some other IT people over an issue with a drive that had run out of space I discovered that there is some confusion around what you can actually do with Windows 2003 to expand drives.

After some research (with websites providing both good and bad information) I have come to believe these are the facts:

If you have Windows 2003 install on a machine you can expand or span a volume if:

1) The drive was not a basic partition and was not upgraded from Windows 2000. If the drive started life as a Windows 2003 basic partition you can covert the disk to a dynamic disk and then extend the volume across other drives. However, you cannot do this if the machine was a Windows 2000 server that was upgraded.

2) You can expand a basic partition as long as there is continuous free space. So if you have a C and a D drive on a hard disk and they take up 1/2 of the space and you want to extend the D drive, you can do so as long as the open space is the next available space on the disk.

3) Any drive that started its life as a dynamic volume can be manipulated in any way.

4) If needed, you can convert a dynamic disk to a basic disk; but you will have to blow away all the volumes on that disk. You cannot convert volumes to partitions (that bit is a one way street).

5) Your partition or volume must be NTFS. You just can't roll with FAT.


I have found some articles out there that will tell you that it is not possible to upgrade a basic partition and then expand it. This is true in Windows 2000 and Windows XP. This limitation has been removed in Windows 2003.

The exceptions to this rule are in the cases that you cannot create dynamic drives, which you will find in laptops and removable media. Dynamic drives are just cranky like that.

Sunday, October 03, 2010

Warning Fail

Found on a website:

"NOTICE: Your web browser is obsolete. As such, some functionality of this website may not function correctly or at all. Please upgrade your browser to the latest version "

I sure hope that the function of the functionality is functional when I need it to be fun.

Warning Fail

Found on a website:

"NOTICE: Your web browser is obsolete. As such, some functionality of this website may not function correctly or at all. Please upgrade your browser to the latest version "

I sure hope that the function of the functionality is functional when I need it to be fun.

Monday, May 10, 2010

ADMT: Failed to change domain affiliation, hr=800704f1 The system detected a possible attempt to compromise security.

We have been testing out migrations from several domains into our main domain and discovered the following issue when we would go to migrate computer accounts:

ERR3:7075 Failed to change domain affiliation, hr=800704f1 The system detected a possible attempt to compromise security. Please ensure that you can contact the server that authenticated you.

This error does not impact moving groups or users. During our search for the resolution we found a lot of people saying you should use the KB article 942564: (http://support.microsoft.com/kb/942564) to resolve the issue by adjusting the cryptography algorithms to becompatible with Windows NT 4.0.

Looking deeper into that solution we decided that all we where really doing was lowering the level of security on our domain and we wanted to avoid that.

Fortunatly we read a little further down and discovered the KB article 944043 (http://support.microsoft.com/kb/944043/) which talks about the domain having 2008 Read Only Domain Controllers which we do not have so I overlooked that solution.

Further research showed that the KB 944043 should be used any time your domain is PREPARED for a 2008 RODC. The solution was presented here: http://blogs.technet.com/askds/archive/2009/10/19/admt-rodc-s-and-error-800704f1.aspx

So if you want to keep your 2008 domain at a higher level of security and bring in those computers from another domain check out KB 944043, grab those patches and see if it resolves the issue for you!

Monday, February 15, 2010

The art of selling yourself

Resumes are as much (if not more) about marketing yourself then they are about actually listing skills. Check out this great example!

Monday, February 09, 2009

Has your email disappeared?

If you ever moved an email to your Mailbox - User's Name in Outlook you have probably then discovered that your email magicly disappeared. Well, it ends up in a folder called "IPM_Subtree."

Here is a handy tip to recover those emails: http://www.saiweb.co.uk/windows/ipm_subtree-outlook-and-the-vanishing-emails

Tuesday, January 13, 2009

Windows 7 Beta

The Windows 7 Beta has been released to the public, it weighs in at 2.44 GB and is downloading as we speak. You can get your hands on a copy at: http://technet.microsoft.com/en-us/evalcenter/dd353205.aspx

Dell's "temprature probe has exceeded a non-critical threshold" message

Today I got a call from a user who was receiving a message that read:

"A temperature probe has exceeded a non-critical threshold..."

This message, according to Dell means that either the heat sink [on the CPU] has come loose or a fan is not working correctly.

This issue might be easy to resolve for many users by simply blowing into the fan vents, this could dislodge any dirt that is blocking the fan, which is the most likely issue. If not, you may need to remove the cover and use a can of compressed air or a PC vac to clean out the inside of the computer (remember to unplug the system first!).

If it is a heat sink, you can reattach it with some glue from a PC parts store.

Running the Dell diagnostics will help you to determine which part is not working correctly and lead you to the next step you should take (either cleaning or replacing the fan or fixing the heat sink).

Friday, December 12, 2008

Finding the brains of a computer.

In today's society we tend to try and humanize everything. We gave the tin man a heart because we were afraid of a robot without compassion, we assign human emotions to our pets, and we have even given the computer "a brain!"

If you read articles or books that are an introduction to computing you will commonly find a reference to the CPU as the brains of a computer; but is this really a valid comparison?

If we think about what the brain does, even one inside an ant, it is able to receive data, store that data, determine the best course of action based on previous data (or make an assumption or "best guess" when there is no previous data) and set about the body to perform the needed action. The brain handles so many different functions that we do not even understand how it really works (which is the reason we have so many different medications for emotional and mental problems).

The CPU on the other hand, does one thing and does it well. It performs calculations on information and returns that to the software that requested the CPU get involved.

Now there is no doubt that the CPU does emulate one of the thousands of functions the brain does, hell, the CPU is usually a lot faster than the brain at this one specific task; but that is it. The CPU simply cannot do everything the brain does.

On the other hand, the entire PC does perform most of the functions that the brain does from storing information in short term (RAM) and long term (hard drive) memory to receiving input signals (5 senses vs. keyboard, scanner, mouse, etc) and returning output (vocal or body language vs. monitor, printer, etc).

Even in computers running artificial intelligence software it is the software that emulates thinking not the CPU, still this software is governed by a very simple set of rules while the brain allows us to bend or break the rules that have been applied to us the computer will most often obey the laws it has been given. (If we ignore Chaos theory and errors, the computer will always obey). Three Laws Safe!

The day the CPU becomes the brains of the computer is probably the last day any of us want to see given the results of 2001, Terminator, or I Robot. Until that day the only brain that we will find involved with a computer is the one stored comfortably between the ears of the person at the keyboard!

Thursday, September 25, 2008

Log Me In!

One of the greatest little tools out there is the ability to access remote desktops via the Internet. There are several programs out there that can do this such as Gotomypc.com and VNC. One of my favorites is logmein.com. Why is it my favorite? It uses codes that the remote desktop user must provide for remote access and it is free! VNC is great too, but it can be accessed by anyone if it is on and they know the password. Using logmein.com can be a secure way to get where you need to be (assuming someone is on the other end).

Perfect for those IT people who's moms keep calling for help!

Wednesday, August 06, 2008

Today I must post!

According to my calendar it says that Wednesday is the day I should post to this blog, now I've been ignoring that for a long time, but figured I'd get this out there and pick on Microsoft a little bit...

We decided that we needed to move from Lotus Domino to Microsoft Exchange, I guess we can save a little money that way (and the iphone the CIO just got only syncs with Outlook).

Anyway, while following Microsoft's excellent instructions (which you can find all over the Internet) to connect Domino and Exchange together so that people on both sides can look up the calendars of the others and the mail users are synced between the two systems.

The mail routes through SMTP so there is no longer a connector there. Which solves some of the horrors of the migration.

Anyway, after following the steps to the letter we were able to sync the users but along the way we had to fight through issues involving security settings. Those are easily solved by checking the event log, so no big deal.

The snag we hit was when we tried to get the calendar to sync. It was easy enough to get the Exchange server to see the Domino side but the Domino side just refused to look into the Exchange world. There were no errors being displayed anywhere and the Internet didn't offer any suggestions. I knew it I called Microsoft they would send me to Lotus and if I called Lotus they would send me to Microsoft so I was stuck in the middle of this mess.

It wasn't until I finally found a person on the Internet that had the very same issue and this has driven me to post the same information for others to find (if they are unlucky enough to have the same issue).

On the Domino server that you set up to do the calendar sync you have to install a program called the Exchange Calendar Connector. This runs as a task on the Domino server and according to Exchange the command is:

load excalcon Exchange

While the command you should use is:

load excalcon

If you follow the Microsoft instructions it will be:

load excalcon ExchFreeBusy

Once you do that, the systems should sync up and you can see the busy times on either side.

This does not allow you to see the details of the calendar though, that is only accomplished by people on Domino accessing Domino calendars and Exchange users accessing Exchange calendars.

Friday, March 14, 2008

Windows 7

Microsoft has let it slip that the next version of Windows will be spurned fourth on the world in 2010. The good news is that 2 years before its release it is already better than Vista!

http://tech.yahoo.com/blogs/null/86646

Tuesday, March 11, 2008

Syncronize Contacts in Lotus Notes 8

For the longest time we have been trying to figure out how to get the word "disabled" to go away on the replication page in Lotus Notes 8 for the contacts to sync between the web access and the local file.

We found the issue today...

Under File -> Preferences -> Contacts there is a settings that reads Enable "Synchroize Contacts" on the Replicator that needs to be enabled. We found that setting several weeks ago and enabled it yet the system still said "disabled" on the replication tab.

So today we found the same setting (thanks to notes.net) under the More -> Preferences button in the Contacts database. That setting also has to be checked. It seems that there is a bug in the two linking up.

Anyway, once we checked both the disabled disappeared from the replication tab and the contacts synced up.

So there ya go!

Tuesday, January 08, 2008

Bill Gates' last day.

Keep your eyes open for the hidden cameos...