Jeff's Connected Corner

My RSS reader was on fire this weekend after word of the Office Genuine Advantage (OGA) mix-up made the rounds. To prevent this issue from getting (further) blown out of proportion I've listed a few key details below.

Point #1:

The OGA hotfix requires admins to accept an End User License Agreement (EULA) before deploying anything to WSUS clients. I captured a screen shot of the OGA EULA using my lab WSUS server.

Point #2:

Even if your WSUS server(s) use automatic approvals, an EULA-enabled update still requires manual approval. This is an important point that every WSUS admin who uses automatic approvals should understand. I prefer to manually approve all but Definition Updates; however, your environment may allow less stringent controls.

Point #3:

Immediately after recognizing the mistake (yes, mistake... not conspiracy) Microsoft marked the update as Expired by issuing an update revision. This action essentially disabled OGA and prevented unsuspecting WSUS admins from approving it. Unfortunately most WSUS servers only sync once or twice per day, which means OGA was hanging around unexpired for 12-24 hours. However, this doesn't change the fact that OGA still required an EULA before being deployed (see first bullet). Here is a screen shot of both revisions, with the second one highlighted.

Bottom Line:

OGA shouldn't have been published in the first place. Microsoft needs to implement tighter controls on the publishing channel. However, in this instance OGA could not be deployed without admin intervention. I hope this post answers any questions you had after reading other accounts of the incident. Feel free to post a comment if you have any questions. Note: Due to comment SPAM your question will not appear right away (I need to moderate first). Depending on my schedule this could be anywhere from 2-24 hours. Thanks for your patience.

Blog Post Changelog:

4/21/08 (v.1) - Initial post

4/21/08 (v.2) - Added info to clarify EULA-enabled updates still require manual approval. Also misc. typesetting changes.

Want to administer your Windows Server 2008 servers (including Server Core and Hyper-V) without using Terminal Services? Microsoft just released the Remote Server Administration Tools (RSAT) for Windows Vista SP1. The links may or may not work for you... but here you go:

• RSAT - Vista SP1 x86
• RSAT - Vista SP1 x64

For anyone testing Hyper-V there is a separate download for that role (probably separate since Hyper-V isn't finalized):

• Hyper-V Remote Management Tool x86
• Hyper-V Remote Management Tool x64

Keep in mind these downloads require Vista SP1 in an Active Directory domain environment. If you have trouble with the links just hit www.microsoft.com/downloads - search for RSAT or Hyper-V and sort by date. They should be at the top of the list. Enjoy!

Exchange 2007 is serviced by a new 'Update Rollup' strategy that is designed to simplify testing and deployment. Here's a useful post on the Exchange Team Blog if you need some background.

However, the way Microsoft decided to name the updates will likely cause confusion among IT Pros. Instead of increasing the version number by 1 each time a new update rollup is released, we now have a forked release path. For example, we were at Update Rollup 5 around the time Exchange Service Pack 1 (SP1) released. Shortly *after* SP1 was finalized Microsoft released Update Rollup 6. In the overview section Microsoft clarifies that Update Rollup 6 does not apply to Exchange 2007 SP1. The updates included in Update Rollup 6 that are not included in SP1 are included in Update Rollup 1 for Exchange Server 2007 Service Pack 1 (confused yet?).

I've created a Visio diagram to make sense of the Update Rollups (click here for the .VSD file). Each shape in the Visio file includes a link to the appropriate Update Rollup KB article. I'm also including a PNG version below in case you don't have Visio, or don't want to download the viewer.

Bottom line - once you wrap your brain around this servicing model it makes sense why Microsoft *must* maintain separate release paths. After all Exchange 2007 RTM will be supported until Jan. 2009 per the MS Lifecycle site. My only recommendation is to come up with a simpler naming strategy. Update Rollup 1 for Exchange Server 2007 Service Pack 1 doesn't exactly roll off the tongue now, does it ;)

Windows Server 2008 (WS08) had an official launch event in Los Angeles, CA today. Instead of enjoying the festivities - I'm in the trenches having my own 'virtual launch party' by deploying WS08 in a production environment. Granted, it's a limited deployment... but still important. Here are a couple items to keep in mind as you begin deploying WS08.

Hardware Support

As always, make sure you are deploying on supported hardware. I'm working with a client who appreciates the best server hardware - HP ProLiant servers (and no, they aren't paying me to say that). HP has an excellent support page for WS08 that you should review. Of particular interest are links to the new SmartStart v8 and ProLiant Support Pack v8. You'll want to grab these ahead of time to ensure smooth deployments. SmartStart v8 is the first version to offer integrated support for WS08. If you pop in a previous version you'll know right away since it won't offer WS08 as an install option.

Yes, SP1 is Baked In

There is plenty of logic behind the decision to label WS08 as SP1 - but this won't stop the peanut gallery from conjuring up all kinds of conspiracy theories. Just ignore C|Net and other mainstream bloggers for a few days, will ya?

Hyper-V is Still Beta

Here's a quick tip in case you aren't following Hyper-V development closely. Even though you will see WS08 RTM SKUs 'with Hyper-V' on the MS Volume License Download site, Hyper-V is STILL BETA. I'm honestly surprised Microsoft baked it in to the final DVDs. More than a few IT Pros will be surprised when the RTM version of Hyper-V ships in a few months (thinking they already had the final version installed). And here's a question for Microsoft - will you guys press/issue new DVDs with RTM Hyper-V code? I hope to see some info about this on the MS Virtualization Blog.

List of Supported Microsoft Applications

Knowledge base article 948680 contains a list of Microsoft server applications that are/will be supported on WS08. Another excellent read as you plan your WS08 deployment.

Alright - lunch break is over... back to the rollout.

I just got back from a nice family vacation to Florida (Orlando & Cocoa Beach). The weather was fabulous with daytime highs in the 70-80F range vs. 10-20F here in Kansas City. We also got to see a Space Shuttle launch, which has always been on my 'bucket list'. Of course, the week I decide to unplug is also the week Microsoft decides to release Windows 2008, Vista SP1 and WSUS 3.0 SP1. Oh well - Josh and Aubrey have done a great job picking up the slack. So from the 'Better Late than Never' department, here are my thoughts on recent Microsoft developments:

WSUS 3.0 SP1 RTM

Microsoft released WSUS 3.0 SP1 on 2/8/2008. This release fixes a few bugs, adds some minor features, and most importantly adds Windows Server 2008 as a supported platform. In fact, sometime in the next few weeks/months there will be an update to the Server Manager UI in Windows Server 2008 that allows direct integration with WSUS. I covered WSUS 3.0 SP1 back in November, 2007 when the product achieved Release Candidate status. Very little changed since November, so you can refer back to my previous post for details (including Server Manager integration screen shots).

So far the only upgrade issues I've read about are related to long (12+ character) e-mail notification passwords. The current work-around is to shorten the password... upgrade to WSUS 3.0 SP1... then reset the password to the desired length. Yes, this is a pain... but it won't impact everyone and it isn't a show-stopper. I'll post more info after working with the RTM code for a few days.

Windows Server 2008

After a long and thorough development/test cycle Windows Server 2008 was finalized on 2/4/2008. I'm pumped about Win2008... and not just because I'm in the consulting business. ;)

God willing, I'll blog more about Win2008 over the next few weeks/months. I'm also part of the Heroes Happen {here} campaign and will be hosting several user group meetings on Win2008. In the meantime here are my 'Top 5' new/improved features:

1. Active Directory (Read-only DCs, granular password policies, DFS-R for SYSVOL, improved auditing)
2. Server Core (as Iain McDonald likes to say, "The Wow Stops Now")
3. Terminal Services (TS RemoteApp, TS Easy Print, TS Session Broker, TS Web Access)
4. Failover Clustering (improved setup, ability to span IP subnets, NetBIOS dependency eliminated)
5. Security Improvements (new TCP/IP stack, NAP, firewall enabled by default, BitLocker, etc.)

I'm not sure about the Volume Licensing download site - but Connect and MSDN/TechNet users can download the RTM bits now.

Windows Vista SP1

As expected Windows Vista SP1 hit RTM alongside Win2008. Marketing-speak aside... this is a major upgrade to Vista RTM and not simply a collection of security/bug fixes. If you need proof, check Mark Russinovich's blog post on file copy improvements. However, Vista SP1 won't usher in a new wave of UI changes either. To use a car analogy... think of Vista SP1 as a manufacturer recall to replace the engine. The car looks the same, but it runs a heck of a lot better and faster. Microsoft is hopeful that SP1 address most issues preventing large organizations from deploying Vista. It won't quiet the 'Resurrect Windows XP' crowd... but then again, nothing will.

Want to get your hands on Vista SP1? If you're a beta tester with access to Connect... have at it. The RTM code was uploaded over the weekend (stand-alone, ISO and WU script). As for the rest of you... check out this blog post from Mike Nash regarding external availability. Patience, grasshopper. I've done one successful upgrade so far - my home Media Center machine. Will hit a few more this week and report back if I run into problems. Happy upgrading!

... and there was much rejoicing (yea). Here's the link to Palm's Treo 750 Updater 2.25.

Of course, yours truly has been running WM6 on his Treo 750 already... but only because running 'unsupported' software is a way of life for me ;)

Note to AT&T: What took you so long? Recoup some customer sat and come clean with the technical difficulties around this update. Treo and Windows Mobile forums haven't exactly been singing your praises lately. Heck, your own forum has a discussion thread with 300+ replies dedicated to the misleading communication about this update. This situation brings to mind the story about how Lexus handled their first big recall in the US. You can read about it in the Time.com archives. I really don't think AT&T is adhering to the "Lexus Covenant" of customer service, which states in part "Lexus will treat each customer as we would a guest in our home".

Today at TechEd IT Forum in Barcelona Microsoft released Asset Inventory Service (AIS) to the web. In case you aren't familiar with AIS, it includes technology Microsoft acquired from AssetMetrix in 2006. In addition to the hosted service announced today, the 'brain power' behind AIS is also available in System Center Configuration Manager 2007 and SMS 2003 SP3 in the form of Asset Intelligence. Bottom line - we're talking about tools to help make sense of all the software products deployed across an enterprise. Here's the full PDF datasheet on AIS if you're interested.

The First System Center Online Service

One important thing to note about AIS is that the entire solution is hosted by Microsoft. As an administrator all you do is deploy a small client to your PCs and wait for the data to appear at https://sc.microsoft.com. I've included screen shots at the end of this post to give you a feel for the interface.

How Do I Get It?

If you own Microsoft Software Assurance and the Microsoft Desktop Optimization Pack (MDOP) you're half way there. You'll need to activate the MDOP-AIS 'benefit' through the Volume License Portal and designate an AIS administrator. The System Center Online team has a detailed post on the activation process over at their blog - so I won't delve into the details.

Other Details

Right now the AIS client installer weighs in at 1.37MB. I've been running various iterations of the AIS client over the last few months with no negative side-effects (including on Vista x64). Microsoft even published an ADM template on the public download site so you can tweak AIS settings using Active Directory.

Screen Shots

As usual I'll update this post with more info and screen shots as time permits. However, I wanted to get something in your hands before the weekend. The following screen shots were taken about a week ago using the final Release Candidate version of AIS. Differences between the RC and RTW interfaces are almost non-existent except removal of the word Beta. This should represent what you'll see on your own AIS home page. I've included images of the management page and several example reports (software and computer).

Expect to hear more about AIS and the System Center Online group in the near future. Check back in a couple days for updated info... or better yet, subscribe to the site RSS feed and get notified of any changes to this and other posts.

A few of you posted questions about the WSUS issues that started this morning. If you haven't already found the fix (or maybe you didn't even know there was a problem) check the WSUS Team Blog for information. Additionally, keep an eye on the public WSUS newsgroup for late-breaking info (microsoft.public.windows.server.update_services). As was the case today, you often find people discussing issues in the newsgroup long before something appears on a team blog or on the official Microsoft Support site.

Note: If you aren't into traditional NNTP, just point your web browser to http://www.microsoft.com/communities/newsgroups/list/en-us/default.aspx for the entire list of Microsoft newsgroups (English only). RSS and blogging are great... but a traditional newsgroup is still a fast and efficient way to discuss hot topics.

FYI - Microsoft just announced the public availability of WSUS 3.0 SP1 Release Candidate 1. Improvements include support for Windows Server 2008 and product bug fixes (see Update2 below for details). More information is available on Microsoft Connect. Click the 'Available Connections' link and look for Windows Server Update Services 3.0 SP1 Release Candidate. Here's a brief overview of the WSUS page on Connect:

"Thank you for joining the WSUS 3.0 Service Pack 1 Release Candidate Program and we welcome you to provide feedback on the Service Pack 1 through the channels listed below. By including you in our development process, we can ensure that our products meet the needs of our customers and are reliable.

WSUS 3.0 SP1 addresses a number of product fixes and includes the addition of support for forth coming Windows Server 2008 (code named Longhorn Server).  The release notes on this release can be downloaded along with the build which provides more details on the installation."

Download Service Pack 1 and Documentation:
The downloads link on the left hand menu will take you to the download page for the following SP1 builds and documentation:
- WSUS 3.0 SP1 Beta x86 Build
- WSUS 3.0 SP1 Beta x64 Build
- WSUS 3.0 SP1 RC ReadMe
- WSUS 3.0 SP1 RC Pre Release License
- WSUS 3.0 Overview Document
- WSUS 3.0 Operations Guide
- WSUS 3.0 Step by Step Guide

Update 1: 11/4/2007

I installed the new build on Windows Server 2008 and all is well. The prerequisites can be a little tricky if you aren't familiar with the new IIS Role Services... but aside from that it's a no-brainer. Here are a couple screen shots of the install process (including a failed prerequisite check), the prerequisite list, and finally one of a running WSUS 3.0 SP1 console on Windows 2008 RC0.

From what I've been told this RC build isn't appropriate for production server use, but the automatic updates RC client will self-update to the RTM build when it goes gold. In other words, don't plan on a 'build-over-build' update for your server - just your test client machines. As always, your mileage may vary. Feel free to drop me a comment with your RC observations or if you have any questions.

Update 2: 11/10/2007

The WSUS team just posted a list of fixes and enhancements included in SP1. I've included it here since the list is brief. Head over to Connect if you want to download the official list (WSUS 3.0 SP1 RC Features and Fixes.htm). There are a couple interesting fixes and enhancements in this build - highlighted in red for your convenience. I'll blog about these in more detail at a future date.

Window Server 2008

• Integration with Server Manager as an out-of-band role
• Fixed bugs that required workarounds for Windows Server 2008

New Client Servicing API

• Supports software distribution for non-Windows platforms
• Client registration
• Filtering of updates by Category and Classification
• Provides Applicability Rule Extension mechanism
• Get package metadata
• Report Update Status for each client

Driver Publishing via existing Admin API

• Supports publishing of drivers within the enterprise using vendor provided catalogs
• Support for bundles
• Support for prerequisites

Bug Fixes

• Bulk approval of updates now does not overwrite existing approvals
• “Optional” approvals are taken into account when computing effective approval for overlapping target groups
• Computer Detailed Status report to Excel works!
• Configuration Wizard retains proxy server password if one is set before upgrade
• Support for separate proxy server and port for SSL traffic
• Improved performance by turning off AUTO SHRINK on SUSDB
• Some client bug fixes based on Windows Error reporting (Watson)
• Add Printer Wizard now works when getting very large number of drivers from Windows Update

As some of you know I recently made a career move to EMC - specifically EMC Global Services, Microsoft Practice. Every once in a while I'll get an EMC press release in my Inbox about a company we've acquired, or some other important 'public-facing' news. Note: Don't worry - I won't bore you with every EMC press release. After all, this is my personal blog ;)

Anyway...this morning I got a press release about EMC's acquisition of Berkeley Data Systems, the provider of Mozy Online Backup and Recovery. Although I haven't used Mozy myself (yet) it looks like pretty good stuff. According to Nick Berardi at Coder Journal it even works on Vista x64 (something I appreciate more since my move to 64-bit).

If you're like me and have family/friends who occasionally ping you to rescue their lost data, you might want to point them to MozyHome. Heck, there's even a free version that supports up to 2GB of data. Drop me a comment if you've used the service or know someone who has. I'll try it out on one of my pro-bono clients and report back in a future post. Cheers!

This afternoon Microsoft launched a new blog dedicated to System Center Online, and specifically the Asset Inventory Service. Check out Paul Bourgeau's post for more information on AIS. I've been testing this product/service for several months and plan a review (including screen shots) sometime next week. But for now, take a look at Paul's post for an overview of the service. Have a great weekend!

On Tuesday, August 14th Microsoft released a download service called the Microsoft Update (MU) Catalog (jump to site). You can read all about it on the official Microsoft Update Team Blog. The MU Catalog is a central location for Microsoft updates and 3rd party Windows drivers. You can search the site for updates, add them to a 'basket', and then download the updates for later distribution using your favorite ESD tool. Additionally, you can link the MU Catalog with products like WSUS, SCE, and SCCM to import updates that might not otherwise be available.

Main User Interface - Search or... Search

I know the team spent a lot of time building 'plumbing' and connectivity to various products... so I don't want to rain on their ship party. However, this service leaves quite a bit to be desired. For starters there's the UI - or should I say the lack thereof. Check out the following screen shot or just head on over to the MU Catalog yourself.

Maybe the team is taking a page from Google and emphasizing the importance of search... but I'm left wanting a hierarchical browse interface to drill down to the appropriate updates. Anyone else feel the same way?

Private Hotfixes, Anyone?

One of the most compelling features that didn't make it in v1 is the ability to download private and/or limited release hotfixes. Readers with access to Premier Support know how handy it is to download private hotfixes through the PSS web site. Here's a screen shot of Microsoft Premier Online's listing for KB 940046 - a hotfix for Windows Server 2003. Notice the link to download the hotfix right at the top of the page.

Now imagine if you could sign on to the MU Catalog with your Passport (er, Windows Live) credentials and import this same hotfix right into WSUS, SCE, or SCCM. That would simplify deployment and improve the usefulness of WSUS, SCE, and SCCM in one fell swoop. I'm keeping my fingers crossed that this feature makes it into MU Catalog v2.

On the Topic of Importing

To end on a positive note, there is at least one very useful scenario for the MU Catalog v1 when paired with WSUS 3.0. Let's say you configure WSUS to synchronize all products and classifications -EXCEPT- drivers (this is common among WSUS admins). However, one day you find out a critical update is published by your network card manufacturer. Instead of synchronizing the entire driver catalog to WSUS simply head on over to the MU Catalog and search for the critical driver. Add it to your basket and then import it into WSUS. Now you can deploy this one driver without 'polluting' the WSUS UI with drivers for every product ever released.

What are your thoughts on the MU Catalog v1? Post a comment below and we'll discuss this release in more detail.

I'm conducting a branch-office pilot of Windows Storage Server 2003 R2 - and so far things are going well. However, one point of frustration was trying to figure out the features included in each version. While plenty of product information exists about the four versions of Windows Server (Web/Standard/Enterprise/Datacenter) finding similar information about Windows Storage Server 2003 R2 proved very difficult. Credit goes out to a very sharp pre-sales tech at Dell for digging up the following information. I can only take credit for making it look good and spreading the word ;)

Note to Microsoft: You guys might want to think about posting a similar chart on the Windows Storage Server home page, eh?

Well... for the handful of people wondering where I've been lately - wonder no more. I'm baaaack! :)

A few things have contributed to my lack of blogging:

• 60+ hour work weeks (this will change soon)
• Technical writing burn-out. I wrote two whitepapers for Microsoft to coincide with the launch of WSUS 3.0. Check them out here and here. All that writing combined with insane work demands pretty much burned me out.
• Wanting to spend time with family. Seems pretty straightforward to me.

OK - enough MySpace fodder... on to the juicy tidbits.

My Friday the 13th Surprise

I experienced my first Xbox 360 failure on Wednesday - the dreaded 'Ring of Death'. After a 30 minute call with Microsoft Support (most of it on hold) I was told a 'coffin' would arrive within 3 business days. No sweat, I thought... I have a second Xbox 360 upstairs. Or at least I did until Friday the 13th. Here's what I have now...

Note: I'm not a big gamer, but my family does rely on the Media Center Extender functionality for time-shifting our favorite TV shows. Trust me, once your family is addicted to Media Center Extender there's no turning back.

I guess all the reports of quality problems aren't caused by overactive gamers after all. And to think earlier in the week I was going to blog about how well my two units have performed over the last 9 months. What a joke that would have been ;)

Lotus Notes - How to Stop the Bleeding

My current employer uses Lotus Notes/Domino for messaging and collaboration. I won't digress into a rant about how much I dislike Notes (this guy has done a pretty good job already)... but instead I'll give IBM some free and unsolicited advice. For the most part my end-users don't care what server software controls their messaging and collaboration - they just want to run Microsoft Outlook. So here's my advice: "Fix Domino Access for Microsoft Outlook (DAMO)". DAMO allows users to access a Notes/Domino back-end via Outlook. However, the unfortunate truth is that IBM has pretty much abandoned DAMO. For example, it still isn't compatible with Outlook 2007 and doesn't even work that well with earlier Outlook versions. Trust me, I've tried. So IBM... keep the Notes/Domino server business alive by re-investing in DAMO. Your ancient Notes client is driving more and more people to Exchange/Outlook every day (my company included). Competition is a good thing - but I'm afraid Exchange is well on its way to crushing Notes/Domino. That's sad.

Speaking of Notes... July Microsoft Patches Cause Minor Issue

During our testing of the July Microsoft patches we've noticed quite a few instances where the default mail client is reset to Microsoft Outlook. If it were only that easy to migrate ;) Not sure how many readers of this blog run Notes... but keep an eye on this before you distribute the July patches across your company. I haven't tracked the problem down to a particular update yet, but I expect to get to the bottom of it on Monday.

Until next time...

If you're running Vista and have a Windows Mobile device (version 2003, 5.0 and 6.0) you should grab the new WMDC. This Vista add-on is available for both x86 and x64. Here's a list of updates and new features from the download page.

Key updates in Windows Mobile Device Center 6.1 include:

• Windows Mobile 6 feature support
• Information Rights Management activation - Automatically configure the Windows Mobile 6 device to open IRM-protected documents and files
• HTML mail – Set up your Windows Mobile 6 device to sync HTML-formatted mail
• Certificate Enrollment - Acquire certificates through the PC the Windows Mobile 6 device is currently connected to
• Allow data connections on the Windows Mobile 6 device when connected to the PC
• File synchronization for smartphones – Synchronize files with your Windows Mobile 6 devices, including both touch screen and non-touch screen devices
• Automatic device authentication - Connect the Windows Mobile device to the PC without the need to enter the device-lock PIN every time upon connect
• Product Registration - Register your Windows Mobile device and get connected to information and offers available for your device