Archive for category . All Posts
Windows Firewall through policies + SCM
Posted by RZomerman in . All Posts, Other, Windows 2008 R2 on June 1st, 2010
So everybody should enable firewall policies in order to keep their environment secure. Best practice is to manage the firewalls through policies.. keep a default policy to enable the firewall and do not allow incoming connections.. then based on server role add exceptions and ports. That way, each server added to the domain is secured by the firewall by default, but additional policies can enable applications to receive traffic.
CCF 2009 simple architecture
Posted by RZomerman in . All Posts on April 29th, 2010
I’ve been working with CCF the last days, CCF you say what is that? Well its a product from Microsoft that can be used to enhance the experience of users when working with multiple applications that require the same input. Say we have a call center with many applications. When a customer calls the agent asks for your zip code or address. Then you state your problem and the agent needs to open a different program and re-enter your zip code, then the company needs to send you a package and for that application he again needs your address details.. annoying for you (every time the agent asks you for your creds and even more annoying for the call center agent since he/she has to type the same info multiple times.
So CCF can help you with that..it requires a lot of programming to integrate all the apps, but it could be worth it.. are you designing CCF? are you interested in the architecture.. check out this post …
Selective authentication
Posted by RZomerman in . All Posts on April 9th, 2010
When creating a forest trust, each domain within the trusted forest becomes trusted. While this is sometimes not desired it is possible to limit the scope by implementing selective-authentication. It is possible to only allow authentication between those domains you want by granting the allowed to authenticate right to only those domains objects.
Windows 2008R2 features part VI: Managed Service Accounts – delegation
Posted by RZomerman in . All Posts, Active Directory, Kerberos on April 1st, 2010
In a previous entry I’ve explained how you can run services under the new Managed Service Account. Say now that we want to use this service account in combination with Kerberos and the account needs to be trusted for delegation. We set an SPN to it, but in the Active Directory Users and Computers, we seem to be unable to find the trusted for delegation option.. Let’s take a closer look at these accounts once they have been created, to do this we’ll be using ldp.exe
Cross Forest Authentication part 2 – Creating trusts
Posted by RZomerman in . All Posts, Active Directory, Windows 2008, Windows 2008 R2 on March 26th, 2010
In part of the the forest authentication blog post, we’ve seen that a particular path is used depending on Kerberos or NTLM authentication. We’ve also seen that domain controllers rely on other domain controllers of the forest to find the right domain (and thus object in the AD). The question now is, which domain controller of the other forest is used to authenticate the user? What happens during a trust creation, do we really need the PDC emulator? Will LMHOSTS still help us, like it did in the old days?
Those questions we will answer in this series of authentication across trusts part 2, 3 etc..
Server Core + network bindings
Posted by RZomerman in . All Posts on March 20th, 2010
When you want to control the bindings on a network card in Server Core (2008R2), your stuck with the registry editor. So how do you A: know what binding you want to remove, B: where to locate it, C: to disable it..
A is easy.. you want to remove, File and Printer Sharing, Client for Microsoft Networks etc etc..
B: the bindings are located in two sections, to first look what’s installed go to:
HKLM\System\CCS\
When you configure Hyper-V networks, you must make sure to create them once, and only once.. else you will end up in great trouble. To get out.. use this manual
The problem I encountered was that my nic had previously been bound to a Hyper-V network and I wanted to connect it to a new network. No problem you say, except for the error message “Adapter is already bound to another virtual network”.
Normally you would open ncpa.cpl and go to the network adapter. Over there, de-select the binding for Hyper-V networks and click OK..In server core however this is much nicer!. (NOT!)
First we must get the network card ID:
Wmic nicconfig Description,SettingID
You will receive a list of all network adapters and their SettingID.. note the adapter you wish to use and copy the setting id
Start regedit and go to HKLM\System\CCS\Services\VMSP\Linkage
Double click the Bind entry.. and remove the SettingID noted earlier..
A reboot would be nice.. and you should be able to connect the networks to the appropriate NICs again
<<Update>> You can take a look at http://code.msdn.microsoft.com/nvspbind, that would make things easier.
Best Practices Analyser + MOSS
Posted by RZomerman in . All Posts, Other, Windows 2008 R2 on December 7th, 2009
When installing MOSS in an 2008R2 environment, you will notice that the Best Practices Analyser for Sharepoint will not run.. now this is not only to the fact that the BPA is running on the 2008R2 environment, it’s when the entire sharepoint farm is running on 2008R2. One option is to have a single 2008/2003 server on the same farm and point to that, or wait for the next release of BPA for Sharepoint.
The error received would be: Failed to retrieve the configuration database connection string from machine ‘<insert machinename>’ due to the following error: Failed to retrieve the configuration database connection string from machine ‘<insert machinename>’
Missing some hours lately?
Posted by RZomerman in . All Posts on October 21st, 2009
Daylight saving time.. (DST).. some love it (due to some extra hours of sleep) some hate it.. because the have to program around it.. and so do the developers at Microsoft.. and then.. there are some countries that like to switch the dates they change the time (Argentina for example).. well all fuzzy logic if you ask me.. and so did the developers think.. and they accidently missed one date.. a date very close to come..(October 25th)
OWA 2010 Themes
Posted by RZomerman in . All Posts on October 14th, 2009
As you might of seen, the themes option is removed in Exchange 2010.. the old layout has been changed to some ugly yellow stylish look (probably to make it look like Office 2010.. ). Personally I do not like the yellow and have always used the Zune theme in Outlook 2007 (not that I like the logo, more the coloring).
When you install the CAS role, you will notice that the OWA folder (that holds all the owa pictures) actually still has multiple folders.. 1,2,3 and base. And that base is the normal OWA design. 1 apparently is some dark neon glow sort of theme, 2 is the Xbox 360 theme and 3 is a fully renewed Zune theme!
Now since the option to choose a theme has been removed, an administrator can only set a theme for everybody (but way better than the dodgy yellow). Create a copy of the base folder and copy the contents of 1, 2 or 3 in the base folder.. press shift F5 on your webbrowser and voila a new theme!
Hyper-V 2.0 + NLB
Posted by RZomerman in . All Posts on October 6th, 2009
If you want to create an NLB on Windows 2008 R2 Hyper-V, you will notice that all previous blog posts around this topic will do you no good.. Although you can setup the NLB, network traffic will halt no matter what you do.. change the mac to static, revert it back etc etc.. seems Hyper-V version 2.0 actually has a more neat way of allowing NLB traffic coming from clusters without setting static mac addresses..
Here’s how to get it working:
Create your VM and give your VM legacy network adapters (for 2003 at least) select the Dynamic Mac address but do select the Enable spoofing of MAC addresses option. Now create your NLB as you did before.. note that you do this on all network adapters that are in the or some sort of NLB. The intra-array traffic does not need this option.
Happy NLB’ing
PS; if you decide to use synthetic adapters you will receive the error: 8004100a00000000 meaning the NIC drivers are not NLB compatible..
