Search This Blog

Wednesday, November 30, 2011

Design Your DNS Infrastructure for DirectAccess

Design Your DNS Infrastructure for DirectAccess

Remove ISATAP from the DNS Global Query Block List

http://technet.microsoft.com/en-us/library/ee649158(WS.10).aspx

direct access infrastructure servers

How to configure remote access client account lockout in Windows Server

How to configure remote access client account lockout in Windows Server

http://support.microsoft.com/kb/816118

  1. Start, click Run, type regedit in the Open box, and then press ENTER.
  2. Locate and then click the following registry key:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\AccountLockout
  3. Double-click the MaxDenials value.

Sunday, November 27, 2011

windows 7, windows 2008 ipv6 addresses

windows 7, windows 2008 ipv6 addresses

http://www.networkworld.com/community/node/37947

quote here
One of the controversial IPv6 features in Windows Vista, Windows Server 2008, and Windows 7 is that it uses random interface identifiers when creating its IPv6 addresses

Windows 7 doesn’t use the EUI-64 technique by default when forming its interface identifier. Microsoft has blurred the lines between these two address autoconfiguration concepts with their temporary addresses and now their randomly-generated interface identifiers. However, thankfully Microsoft has given us the ability to disable or enable this feature as needed with the following commands.

netsh interface ipv6 set global randomizeidentifiers=disabled
netsh interface ipv6 set global randomizeidentifiers=enabled

Friday, November 25, 2011

Active Directory Domain Services Database Mounting Tool

Active Directory Domain Services Database Mounting Tool

http://technet.microsoft.com/en-us/library/cc753609(WS.10).aspx

dsamain /dbpath /ldapport
If you plan to view the snapshot data on a domain controller, specify ports that are different from the ports that the domain controller will use. For example, type:
dsamain /dbpath E:\$SNAP_200704181137_VOLUMED$\WINDOWS\NTDS\ntds.dit /ldapport 51389

Offline Domain Join (Djoin.exe)

Offline Domain Join (Djoin.exe)

Windows 7, Windows Server 2008 R2


http://technet.microsoft.com/en-us/library/offline-domain-join-djoin-step-by-step(WS.10).aspx

Windows Server 2008 R2 domain controllers include a new feature named Offline Domain Join. A new utility named Djoin.exe lets you join a computer to a domain, without contacting a domain controller while completing the domain join operation, by obtaining a blob from a Windows Server 2008 R2 domain controller at an earlier point in time. The computer is domain-joined when it first starts, so no restart is needed as with a normal domain join. The general steps for using Djoin.exe are:
  1. Run djoin /provision to create the computer account metadata. The output of this command is a .txt file that includes a base-64 encoded blob.
  2. Run djoin /requestODJ to insert the computer account metadata from the .txt file into the Windows directory of the destination computer.
  3. Start the destination computer, and the computer will be joined to the domain.

Advanced Security Audit Policy

Advanced Security Audit Policy

http://technet.microsoft.com/en-us/library/dd772712(WS.10).aspx

Audit policy enhancements in Windows Server 2008 R2 and Windows 7 allow administrators to use audit policies to help monitor and enforce business rules. For example, applying audit policy settings on a domain or organizational unit (OU) basis will allow administrators to document compliance with rules such as:
  • Track all group administrator activity on servers with finance information.
  • Track all the files that are accessed by defined groups of employees.
  • Confirm that the correct SACL is applied to every file, folder, and registry key when they are accessed

How to use Group Policy to configure detailed security auditing settings for Windows Vista-based and Windows Server 2008-based computers in a Windows Server 2008 domain, in a Windows Server 2003 domain, or in a Windows 2000 domain.

http://support.microsoft.com/kb/921469

How to use Group Policy to configure detailed security auditing settings for Windows Vista-based and Windows Server 2008-based computers in a Windows Server 2008 domain, in a Windows Server 2003 domain, or in a Windows 2000 domain.

Service Accounts

Service Accounts

http://technet.microsoft.com/en-us/library/ee617252.aspx

http://technet.microsoft.com/en-us/library/dd548356(WS.10).aspx

Parameters

AccountExpirationDate

Specifies the expiration date for an account. When you set this parameter to 0, the account never expires. This parameter sets the AccountExpirationDate property of an account object. The LDAP Display name (ldapDisplayName) for this property is accountExpires.

Use the DateTime

Editing Domain-Based GPOs Using ADMX Files

 Editing Domain-Based GPOs Using ADMX Files



To populate the central store
  1. Open a command window: Press the Windows logo key + R, and then type cmd.
  2. To copy all language-neutral ADMX files (.admx) from your Windows Vista administrative workstation to the central store on your domain controller using the copy command, type:
    copy %systemroot%\PolicyDefinitions\* %logonserver%\sysvol\%userdnsdomain%\policies\PolicyDefinitions\

Thursday, November 24, 2011

Active Directory Recycle Bin

Active Directory Recycle Bin

http://technet.microsoft.com/en-us/library/dd392261(WS.10).aspx

By default, Active Directory Recycle Bin in Windows Server 2008 R2 is disabled. To enable it, you must first raise the forest functional level of your AD DS or AD LDS environment to Windows Server 2008 R2, which in turn requires all forest domain controllers or all servers that host instances of AD LDS configuration sets to be running Windows Server 2008 R2. After you set the forest functional level of your environment to Windows Server 2008 R2, you can use the instructions in this guide to enable Active Directory Recycle Bin.
need ffl / dfl all 2008R2

Dcgpofix.exe command-line tool

 Dcgpofix.exe command-line tool

http://support.microsoft.com/kb/932445

You try to use the Dcgpofix.exe command-line tool that is included in Microsoft Windows Server 2003 to restore Group Policy objects to the default state. You try to do this in a domain whose schema was updated to Microsoft Windows Server 2003 R2. However, the restore operation is unsuccessful. Instead, you receive the following error message:

AppLocker

AppLocker

http://technet.microsoft.com/en-us/library/dd723678(WS.10).aspx

Applies To: Windows 7, Windows Server 2008 R2

Group Policy Preference Client Side Extensions for Windows XP (KB943729)

Group Policy Preference Client Side Extensions for Windows XP (KB943729)


http://www.microsoft.com/download/en/details.aspx?id=3628

Supported Operating Systems: Windows XP Service Pack 2, Windows XP Service Pack 3

To export the private key of a token-signing certificate

To export the private key of a token-signing certificate

http://technet.microsoft.com/en-us/library/cc784075(WS.10).aspx

To export the private key of a token-signing certificate

  1. Click Start, point to Administrative Tools, and then click Active Directory Federation Services.
  2. Right-click Federation Service, and then click Properties.
  3. On the General tab, click View.
  4. In the Certificate dialog box, click the Details tab.
  5. On the Details tab, click Copy to File.
  6. On the Welcome to the Certificate Export Wizard page, click Next.
  7. On the Export Private Key page, select Yes, export the private key, and then click Next.
  8. On the Export File Format page, select Personal Information Exchange = PKCS #12 (.PFX), and then click Next.
  9. On the Password page, type and confirm the password that is required to share the token-signing certificate. You will need this password when you select the exported token-signing certificate when installing the Federation Service.
  10. On the File to Export page, specify the certificate file, and then click Next.
  11. On the Completing the Certificate Export Wizard page, click Finish.

To export the public key portion of a token-signing certificate
http://technet.microsoft.com/en-us/library/cc737522(WS.10).aspx

To export the public key portion of a token-signing certificate

  1. Click Start, point to Administrative Tools, and then click Active Directory Federation Services.
  2. Right-click Federation Service, and then click Properties.
  3. On the General tab, under Token-signing certificate, click View.
  4. In the Certificate dialog box, click the Details tab.
  5. On the Details tab, click Copy to File.
  6. On the Welcome to the Certificate Export Wizard page, click Next.
  7. On the Export Private Key page, make sure that No, do not export the private key is selected, and then click Next.
  8. On the Export File Format page, select DER encoded binary X.509 (.CER), and then click Next.
  9. On the File to Export page, specify the certificate file in File name, and then click Next.

Test-AppLockerPolicy

Test-AppLockerPolicy

Test-AppLockerPolicy

Tests whether the input files are allowed to run for a given user based on the specified AppLocker policy.

http://technet.microsoft.com/en-us/library/ee460960.aspx

Setting up a Source Initiated Subscription

Setting up a Source Initiated Subscription       

http://msdn.microsoft.com/en-us/library/windows/desktop/bb870973(v=vs.85).aspx

Configuring the event source computer
  1. Run the following command from an elevated privilege command prompt on the Windows Server domain controller to configure Windows Remote Management: winrm qc -q
  2. Start group policy by running the following command: %SYSTEMROOT%\System32\gpedit.msc

Configuring the event collector computer
  1. Run the following command from an elevated privilege command prompt on the Windows Server domain controller to configure Windows Remote Management: winrm qc -q
  2. Run the following command to configure the Event Collector service: wecutil qc /q



How to Disable Easy Print service

How to Disable Easy Print service

http://social.technet.microsoft.com/Forums/en-US/winserverTS/thread/8dcaaee8-f6c5-48e3-8f29-6ad6d210b93b/

This policy setting is located in the following node of the Local Group Policy Editor:
Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Printer Redirection

AutoSiteCoverage

AutoSiteCoverage

http://technet.microsoft.com/en-us/library/cc787491(WS.10).aspx

0The system cannot add sites to the coverage area of this domain controller.

dsdbutil

dsdbutil

http://technet.microsoft.com/en-us/library/cc730941(WS.10).aspx

With the Dsdbutil.exe tool, you can create installation media that corresponds only to the AD LDS instance that you want to back up, as opposed to backing up entire volumes that contain the AD LDS instance.
Membership

Wednesday, November 23, 2011

New-ADObject

Service Connection Points

Service Connection Points

http://blogs.technet.com/b/askds/archive/2008/09/18/service-connection-points-scps-and-adam-ad-lds.aspx

Service Connection Points (SCPs) are objects in Active Directory that hold information about services. Services can publish information about their

Certificate Propagation Service

Certificate Propagation Service

The certificate propagation service applies when a logged-on user inserts a smart card in a reader that is attached to the computer. This

http://technet.microsoft.com/en-us/library/ff404288(WS.10).aspx

dsmgmt.exe

Xe script to shutdown a Xen server and vm guests tested with APC software

Xe script to shutdown a Xen server and vm guests tested with APC software

home made one - tested by tm to be working

"C:\program files\citrix\xencenter\xe" -s 192.168.1.90 -u root -pw mypw vm-shutdown vm="termserv"
"C:\program files\citrix\xencenter\xe" -s 192.168.1.90 -u root -pw mypw vm-shutdown vm="myvoomlumberPDC"
"C:\program files\citrix\xencenter\xe" -s 192.168.1.90 -u root -pw mypw host-disable host="myvoomLUMBER-XEN01"
"C:\program files\citrix\xencenter\xe" -s 192.168.1.90 -u root -pw mypw host-shutdown host="myvoomLUMBER-XEN01"


the one need customize
::
:: should have customize it , and test it
:: its a xen-shutdown.cmd to work with apc shutdown script
:: like xen username / password ; server IP address
::

::
:: Xen shutdown script
::
:: Jason Poyner
:: jason.poyner@deptive.co.nz
:: 8 April 2009
:: v0.5
::
@echo off
:: Configure these variable for your environment
:: ---------------------------------------------------
set xe=C:\Program Files\Citrix\XenCenter\xe.exe
set xuser=root
set xpwd=
:: Set the xmaster variable to the host you expect to be the pool master
:: The script will attempt to connect to this host first and if it is not the pool master
:: the pool master will be retrieved.
set xmaster=
set xmaster_backup=
::  Specify the delay after shutting down the VMs, before shutting down the hosts
set xshutdowndelay=120000
set logfile=XenShutdownError.log
:: ---------------------------------------------------


:GetMaster
:: Get pool master
"%xe%" -s %xmaster% -u %xuser% -pw %xpwd% pool-list params=master>master.txt
IF %ERRORLEVEL%==0 goto GotMaster
:: The first xe command failed. Either the xmaster variable is set to a slave host,
:: or a non-Xen host. If we connected to slave host, master.txt will have the IP
:: address of the master - lets get it:
FOR /F "skip=1 tokens=2 delims=:" %%H IN (master.txt) DO SET xmaster=%%H
:: Ok, now see if we have a valid master address:
"%xe%" -s %xmaster% -u %xuser% -pw %xpwd% pool-list params=master>master.txt
IF %ERRORLEVEL%==0 goto GotMaster
:: We do not have a valid master address
:: Have we already tried the second host?
if "%xmaster%"=="%xmaster_backup%" goto ERROR_NoMaster
:: We have not tried the second host yet, so try now:
set xmaster=%xmaster_backup%
goto GetMaster

:GotMaster
:: trim leading spaces
FOR /F "tokens=* delims= " %%a in ("%xmaster%") DO SET xmaster=%%a
@echo Master: %xmaster%
:: Disable all hosts and shutdown all VMs
"%xe%" -s %xmaster% -u %xuser% -pw %xpwd% host-list params=address>hosts.txt
FOR /F "tokens=2 delims=:" %%H IN (hosts.txt) DO CALL :DisableHost %%H
CALL :ShutdownVMs

:: WAIT FOR VMs TO SHUTDOWN
:: This could be scripted to check the status of VMs on a host and wait until
:: all VMs have been shutdown before continuing with the shutdown of the host
::
:: Or the easy, but not so clever way is to use the following line to delay for a while
PING 1.1.1.1 -n 1 -w %xshutdowndelay% >NUL

:: Shutdown slave hosts
FOR /F "tokens=2 delims=:" %%H IN (hosts.txt) DO CALL :ShutdownHost %%H NoMasterShutdown
:: Shutdown master host
CALL :ShutdownHost %xmaster%
:: --------------------------------------------------
::Cleanup the files created during the batch file runtime.
del Master.txt
del hosts.txt
::We leave the XenShutdownError.txt file for problem solving reasons.
goto :eof
:: --------------------------------------------------
:ERROR_NoMaster
@Echo.>>%logfile%
@Echo ---------------------------------------------------------------------------------------------------------------------------------------------------->>%logfile%
@Echo %date% %time%>>%logfile%
@Echo The cause of this was due to both the xmaster and the backup_xmaster servers specified in the beginning of the script were not rechable.>>%logfile%
@Echo.---------------------------------------------------------------------------------------------------------------------------------------------------->>%logfile%
@Echo.>>%logfile%
goto :eof
:: --------------------------------------------------
:: --------------------------------------------------
:: Routine  to disable a host
:: Usage:
::   CALL :DisableHost hostname
::
:DisableHost
@echo Disable host: %1 
@echo Pool master: %xmaster%
:: Stop any VMs from being started on the host
"%xe%" -s %xmaster% -u %xuser% -pw %xpwd% host-disable address=%1
goto :eof
:: --------------------------------------------------
:: --------------------------------------------------
:: Routine  to shutdown all VMs on a host
:: Usage:
::   CALL :ShutdownVMs
::
:ShutdownVMs
@echo Pool master: %xmaster%
echo Shutdown all VMs
:: Shutdown all running VMs
"%xe%" -s %xmaster% -u %xuser% -pw %xpwd% vm-shutdown power-state=running force=false --multiple
goto :eof
:: --------------------------------------------------
:: --------------------------------------------------
:: Routine  to shutdown a host
:: Usage:
::   CALL :ShutdownHost hostname [NoMasterShutdown]
::   if NoMasterShutdown is present, the pool master
::   will not be shutdown
::
:ShutdownHost
if "%2"=="NoMasterShutdown" goto CheckMaster
goto :AnyHost
:CheckMaster
if "%1"=="%xmaster%" goto :eof
:AnyHost
echo Shutdown host: %1
:: Shutdown host
"%xe%" -s %xmaster% -u %xuser% -pw %xpwd% host-shutdown address=%1
goto :eof

TEST shutdown script otherwise you will be told

TEST shutdown script otherwise you will be told

annoying and rough, picked up by the TM;

XEN shutdown scripts / need customize one; 

never ever forgot to test one

Tuesday, November 22, 2011

ADMX and ADML

http://technet.microsoft.com/en-us/library/cc749513(WS.10).aspx

In Windows Vista, ADMX files are divided into language-neutral (.admx files) and language-specific resources (.adml files), available to all Group Policy administrators.

active directory diagnostics data collector set

active directory diagnostics data collector set

http://blogs.technet.com/b/askds/archive/2010/06/08/son-of-spa-ad-data-collector-sets-in-win2008-and-beyond.aspx

This performance feature is located in the Server Manager snap-in under the Diagnostics node and when the Active Directory Domain Services Role is installed the Active Directory Diagnostics data collector set is automatically created under System as shown here

AIA and online responder

http://technet.microsoft.com/en-us/library/cc770413(WS.10).aspx

configure the CAs to include the Online Responder's URL as part of the authority information access extension of issued certificates. This URL is used by the OCSP client to validate the certificate status.
  1. Open the Certification Authority snap-in, right-click the name of the issuing CA,and then click Properties.
  2. Click the Extensions tab.
  3. In the Select extension list, click Authority Information Access (AIA) (Figure 11), and then click Add.

Setting Up Certificate Enrollment Web Services

Setting Up Certificate Enrollment Web Services

http://technet.microsoft.com/en-us/library/dd759243.aspx

Manage Certificate Enrollment Policy by Using Group Policy

Manage Certificate Enrollment Policy by Using Group Policy

http://technet.microsoft.com/en-us/library/dd851772.aspx

Adjust the expire interval for a zone

Monday, November 21, 2011

AD RMS Client Requirements

AD RMS Client Requirements

http://technet.microsoft.com/en-us/library/dd772753(WS.10).aspx

The Active Directory Rights Management Services (AD RMS) client is included with the Windows Vista®, Windows® 7, Windows Server® 2008, and Windows Server® 2008 R2 operating systems. If you are using Windows XP, Windows 2000, or Windows Server 2003 as your client operating system, a compatible version of the AD RMS client is available for download from the Microsoft Download Center Web site.

Add UPN Suffixes to a Forest

Add UPN Suffixes to a Forest

http://support.microsoft.com/kb/243629#appliesto

APPLIES TO
  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Datacenter Server

Windows NT Token-Based Application Configuration

Windows NT Token-Based Application Configuration

http://technet.microsoft.com/en-us/library/cc734905(WS.10).aspx

Nato phonetic Alphabet

Nato phonetic Alphabet

A                    Alpha
B                    Bravo
C                    Charlie
D                    Delta
E                    Echo
F                    Foxtrot
G                   Golf
H                   Hotel
I                     India
J                     Juliet
K                   Kilo
L                   Lima
M                  Mike
N                  Novermber
O                  Oscar
P                   Papa
Q                  Quebec
R                  Romeo
S                   Sierra
T                  Tango
U                 Uniform
V                 Victor
W                Wiskey
X                 X-ray
Y                 Yankee
Z                  Zulu

Sunday, November 20, 2011

RDC client requirements for Terminal Services Web Access in Windows Server 2008

RDC client requirements for Terminal Services Web Access in Windows Server 2008

http://support.microsoft.com/kb/943887

You must have the Remote Desktop Connection (RDC) client version 6.1 installed to use TS Web Access. RDC 6.1 is available with the following operating systems:
  • Windows Server 2008
  • Windows Server 2008 R2
  • Windows Vista with Service Pack 1 (SP1)
  • Windows XP with Service Pack 3 (SP3)

User Name Mapping Service

User Name Mapping Service

http://technet.microsoft.com/en-us/library/bb463221.aspx

Windows-based computers into their traditional UNIX-based enterprise networks.

or the other way around ???

Online Responder

Online Responder

http://technet.microsoft.com/en-us/library/cc770413(WS.10).aspx

Common scenarios for using OCSP include:
  • SSL/Transport Layer Security (TLS) certificate revocation checking
  • Smart card logon
  • Enterprise S/MIME
  • Extensible Authentication Protocol (EAP)/TLS–based virtual private network (VPN)

Configuring Network Device Enrollment Service

Create Installation Media by Using Ntdsutil

Saturday, November 19, 2011

Friday, November 18, 2011

Mdaemon server : cannot add aliases to a user

Mdaemon server : cannot add aliases to a user

I create a user initially , then change the user name, afterwards I can't add the original name as aliase

call local distributor support,

teamviewer is used to let the guy see the screen,

the trick is use notepad to open aliase.dat file
manually edit the file ; I can see something not right in the aliase file for what ever reason

then put it right

then create an aliases.sem file to re-generate (?)

also, aliases support wildcard * like order*@myboomer.com



not too bad for a friday afteernoon, except for the crab planker

Wednesday, November 16, 2011

AD CS: Restricted Enrollment Agent

AD CS: Restricted Enrollment Agent
http://technet.microsoft.com/en-us/library/cc753800(WS.10).aspx

quote""

What does the restricted enrollment agent do?

Enrollment agents are one or more authorized individuals within an organization. The enrollment agent needs to be issued an enrollment agent certificate, which enables the agent to enroll for smart card certificates on behalf of users. Enrollment agents are typically members of the corporate security, Information Technology (IT) security, or help desk teams because these individuals have already been trusted with safeguarding valuable resources. In some organizations, such as banks that have many branches, help desk and security workers might not be conveniently located to perform this task. In this case, designating a branch manager or other trusted employee to act as an enrollment agent is required to enable smart card credentials to be issued from multiple locations

iphone 4 as hotspot and tethering

iphone 4 as hotspot and tethering

iOs 5.0.1

settings - turn on personal hotspot

172.16.20.x


assign static dial in ip to vpn users in sbs 2008

assign static dial in ip to vpn users in sbs 2008

well, it doesn't work the way I did in windows 2003.

here is a link about it

http://alanhardisty.wordpress.com/2011/11/14/how-to-assign-a-static-ip-address-to-a-vpn-client-in-sbs-2008-and-sbs-2011/

in remote access policies

lauch NPS

network policies

in my case

goto VPN policies

tick off ignore user account properties







Tuesday, November 15, 2011

Authentication mechanism assurance in Windows Server 2008 R2

Authentication mechanism assurance in Windows Server 2008 R2

http://blogs.technet.com/b/activedirectoryua/archive/2008/11/21/authentication-mechanism-assurance-in-windows-server-2008-r2.aspx

use it across forest without a trust???

interesting

Difference between TS Web Access and TS Gateway??

Difference between TS Web Access and TS Gateway??
http://social.technet.microsoft.com/Forums/en-US/winserverTS/thread/bcc759bf-ac45-4ad6-bd63-ad5635b26884/

Web Access is a web interface - a page you visit using your browser that displays a list of all the applications published from a particular Terminal Server. To launch one of these published applications you simply click on its icon. Once you've launched the applications you need TS Web Access has served its purpose and you don't need it open any more to work with the applications.
TS Gateway allows RDP clients to communicate with a Terminal Server using HTTPS instead of RDP. More precisely, it wraps the RDP communication inside HTTPS, so it's still RDP on the inside but looks like HTTPS on the outside. This allows you to access a Terminal Server securely over the Internet and to go through firewalls. The TS Gateway is, therefore, used from the time a published application is launched until it is finished.

Sunday, November 13, 2011

interview questions - at a local telecom months ago

interview questions - at a local telecom months ago

what do you see in this job? what attracted you?

what's your salary expectations?

tell us an example of your work solving customer's problem?

are you a lecturer ages ago

their answer is the role is not defined yet


interview questions - how do you work in a team

interview questions - how do you work in a team

are you going to get CCNP

do you have HP procurve experience in an enterprise enviroment

Active Directory Management Gateway Service

Active Directory Management Gateway Service

http://www.microsoft.com/download/en/details.aspx?id=2852

The Active Directory® Management Gateway Service enables administrators to manage Active Directory Domain Services and Active Directory Lightweight Directory Services (AD LDS) or Active Directory Application Mode (ADAM) using Active Directory module for Windows PowerShell and the Active Directory Administrative Center

SCVMM 2007 R2 has VMM slef service portal

Microsoft Forefront Unified Access Gateway MS UAG 2010

Microsoft Forefront Unified Access Gateway from wiki

MS UAG 2010

Microsoft Forefront Unified Access Gateway (UAG), is a reverse proxy and VPN solution that provides secure remote access to corporate networks for remote employees and business partners.

http://www.microsoft.com/en-us/server-cloud/forefront/unified-access-gateway.aspx

Microsoft Virtual Desktop Infrastructure (VDI)

http://www.microsoft.com/en-us/showcase/details.aspx?uuid=9291a982-2f32-4d25-84bb-671accbcb002

Virtual Desktop Infrastructure (VDI) is an alternative desktop delivery model that allows users to access desktops running in the datacenter. Microsoft offers comprehensive and cost effective technology that can help customers deploy virtual desktops in the datacenter. The Microsoft VDI Suites allow customers to manage their physical and virtual desktops from a single console, while providing great flexibility for deploying server-hosted desktops and applications.                           

Trust Anchors

Microsoft WINS Proxy

Microsoft WINS Proxy

A WINS proxy is a WINS-enabled computer that helps resolve name queries for computers that are not WINS-enabled in routed TCP/IP networks.

http://technet.microsoft.com/en-us/library/cc959252.aspx

Saturday, November 12, 2011

If you are using ADMT version 3.2, the source and target domains must be at least at a Windows Server 2003 functional level.

http://technet.microsoft.com/en-us/library/cc974342(WS.10).aspx

 If you are using ADMT version 3.2, the source and target domains must be at least at a Windows Server 2003 functional level.

http://www.microsoft.com/download/en/details.aspx?id=8377

Remote Desktop Web Access (RD Web Access)

http://technet.microsoft.com/en-us/library/cc772452.aspx
Remote Desktop Web Access (RD Web Access)
Remote Desktop Web Access (RD Web Access), formerly Terminal Services Web Access (TS Web Access), enables users to access RemoteApp and Desktop Connection through the Start menu on a computer that is running Windows 7 or through a Web browser. RemoteApp and Desktop Connection provides a customized view of RemoteApp programs and virtual desktops to users.

MS system center center data protection manager can backup VMs to tape library

MS system center center data protection manager can backup VMs to tape library

http://www.thelazyadmin.com/


virtualize client PCs - SCVMM

http://technet.microsoft.com/en-us/library/cc764232.aspx

Microsoft System Center Virtual Machine Manager (VMM) allows you to convert existing physical computers into virtual machines through a process known as physical-to-virtual (P2V) conversion. VMM simplifies P2V by providing a task-based wizard to automate much of the conversion process. Since the P2V process is completely scriptable, you can initiate large-scale P2V conversions through the Windows PowerShell command line

AD groups AGUDLP

Windows Server 2008 R2 - Microsoft VDI Configuration domain functional level at least Windows Server 2000 Native Mode

Windows Server 2008 R2 - Microsoft VDI Configuration

domain functional level at least Windows Server 2000 Native Mode?

http://support.microsoft.com/kb/2276905

Friday, November 11, 2011

DC Locator DNS SRV

http://blogs.dirteam.com/blogs/jorge/archive/2007/06/30/dc-locator-process-in-w2k-w2k3-r2-and-w2k8-part-1.aspx

Sites Covered by the DC Locator DNS SRV Rechttp://www.windowsitpro.com/article/dns/how-can-i-prevent-my-branch-office-domain-controllers-dcs-from-registering-generic-dns-service-records-ordsSpecifies the sites for which the DCs register the following:
  • Site-specific DC Locator DNS SRV resource records
  • Site-specific SRV records registered for the site where the DC is located
  • Records registered by a DC configured to register DC Locator DNS SRV records for those sites without a DC that are closest to it




Thursday, November 10, 2011

Where Credential Roaming Can Be Used

Where Credential Roaming Can Be Used

http://technet.microsoft.com/en-us/library/cc779389(WS.10).aspx

quote""
To appreciate the power and flexibility of credential roaming, the following sections describe various use scenarios.
  • Accessing secured information from multiple computers.
  • Logging on to secured wireless networks.
  • Accessing secure Web sites.
  • Accessing remote systems with credential manager.
  • Using Encrypting File System.

RODCs Do Not Perform Domain Controller Certificate Enrollment

RODCs Do Not Perform Domain Controller Certificate Enrollment

http://technet.microsoft.com/en-us/library/cc730948(WS.10).aspx

quote ""

Smart card logons that are authenticated by an RODC fail. An error message appears that states that the operation is not supported.

Solution

To make it possible for an RODC to authenticate smart card logons, modify the following certificate templates:
  • On the Domain Controller certificate template, allow Enroll permissions for the ERODC group.
  • On the Domain Controller Authentication and Directory E-Mail Replication certificate templates, allow Enroll and Autoenroll permissions for the ERODC group. Allow Read permission for the Authenticated Users group.

Forefront Identity Manager -- forefront identity manager fim 2010

Forefront Identity Manager
 FIM integrates with Active Directory and Exchange Server to provide identity synchronization, certificate management, user password resets and user provisioning from a single interface.
http://en.wikipedia.org/wiki/Forefront_Identity_Manager
http://www.microsoft.com/en-us/server-cloud/forefront/identity-manager-overview.aspx

FIM 2010 delivers tools for more efficient user provisioning and de-provisioning. These include:

Improved tools for user provisioning

Automated user provisioning is managed through a user interface rather than writing customized code.

Integrated provisioning of identities, credentials, and resources

IT can use FIM 2010 to create policies that seamlessly provision and de-provision the appropriate accounts, resources, and credentials.

Self-service profile management for users

IT can set policies to enable end users to update profile information, such as their phone numbers, and to require approvals for and notifications of user-generated changes. End users can use these pages to search for other users as a white pages application.

Wednesday, November 9, 2011

Remote Desktop Services IP Virtualization

Remote Desktop Services IP Virtualization

http://www.windowsitpro.com/article/virtualization2/q-what-s-remote-desktop-services-ip-virtualization-and-why-would-i-want-it-

To enable Remote Desktop IP Virtualization you must create a DHCP Scope range large enough to provide virtual IPs for all of the RD RemoteAPP programs that require them. Instead of DHCP it is also possible to create a static pool of addresses using Regedit on the RD Session Host. Navigate to the: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TerminalServer\TSAPPSrv\VirtualIP location and create a new key with the IP addresses you want assigned as virtual IPs.
http://globalknowledgeblog.com/technology/data-center/virtualization-2/remote-desktop-ip-virtualization-on-server-2008-r2/

Active Directory Rights Management Services Role

http://technet.microsoft.com/en-us/library/cc771307(WS.10).aspx

Active Directory Rights Management Services Role

Are there any special considerations?

AD RMS relies on Active Directory Domain Services (AD DS) to verify that the user attempting to consume rights-protected content is authorized to do so. When registering the AD RMS service connection point (SCP) during installation, the installing user account must have Write access to the Services container in AD DS.
Finally, all configuration and logging information is stored in the AD RMS Logging Database. In a test environment, you can use the Windows Internal Database, but in a production environment, we recommend using a separate database server.

Routing name suffixes across forests

Routing name suffixes across forests
http://technet.microsoft.com/en-us/library/cc784334(WS.10).aspx

you still need manually enabling if the suffix is not the same

also

exchange server must be installed as along with a GC

Monday, November 7, 2011

Enabling Clients to Locate the Next Closest Domain Controller

Enabling Clients to Locate the Next Closest Domain Controller
 
 
you have a domain controller that runs Windows Server 2008 or Windows Server 2008 R2, you can make it possible for client computers that run Windows Vista, Windows 7, Windows Server 2008, or Windows Server 2008 R2 to locate domain controllers more efficiently by enabling the Try Next Closest Site Group Policy setting.
 

MAP tool kit identify which physical server can be virtualized

MAP tool kit identify which physical server can be virtualized

http://technet.microsoft.com/en-us/solutionaccelerators/dd537570

Server Consolidation Proposal: Summarizes the readiness assessments for and benefits of Hyper-V, and recommends a list of underutilized servers for consolidation using Hyper-V.

Sunday, November 6, 2011

your real job security is your skill

your real job security is your skill

forest trust

http://technet.microsoft.com/en-us/library/cc754612.aspx

transitive trusts:
  • Shortcut trust: A transitive trust between a domain in the same domain tree or forest that shortens the trust path in a large and complex domain tree or forest.
  • Forest trust: A transitive trust between a forest root domain and a second forest root domain.
  • Realm trust: A transitive trust between an Active Directory domain and a Kerberos V5 realm. For more information about Kerberos V5 realms, see Kerberos V5 authentication (http://go.microsoft.com/fwlink/?LinkId=92699).
nontransitive trusts:
  • External trust: A nontransitive trust between a Windows Server 2008 or a Windows Server 2008 R2 domain and a Windows NT domain or a Windows 2000 domain, Windows Server 2003 domain, Windows Server 2008, or a Windows Server 2008 R2 domain in another forest.
  • Realm trust: A nontransitive trust between an Active Directory domain and a Kerberos version 5 (V5) realm. For more information about Kerberos V5 realms, see Kerberos V5 authentication (http://go.microsoft.com/fwlink/?LinkId=92699).

 

windows 2008 and SSTP

App-V reduces the cost deploying and maintaining applications on Windows 7;MED-V provides a solution to supporting incompatible applications in Windows 7

http://technet.microsoft.com/en-us/library/ee872305.aspx

App-V reduces the cost deploying and maintainingapplications on Windows 7

MED-V provides a solution to supporting incompatible applications in Windows 7

Saturday, November 5, 2011

office 365 - the cons

finally nailed it, sigh .....dreaded ... you have exceeded the size limit of your mailbox

finally nailed it, sigh .....dreaded ... you have exceeded the size limit of your mailbox

another message would be outlook.ost file reached its max size, consider change to unicode

the client PC is running windows-xp, outlook 2007, the server is sbs 2003 server

I tried heaps of things, but the ost file size will stop at 2.0gb and throw up a mailbox cleanup message. the actual mailbox size is 2.3GB.

yet changing from ANSI to unicode eventually get rid of the problem

http://technet.microsoft.com/en-us/library/cc179012(office.12).aspx

only 1 PC got that problem, so I did gpedit.msc

and load adm template for outlook 12.

and do this (I just copy /paste here)
To enforce Unicode format for new PST files by using Group Policy
  1. In Group Policy, load the Office Outlook 2007 template (Outlk12.adm).
  2. To customize the Unicode format, under User Configuration\Administrative Templates\Microsoft Office Outlook 2007\Miscellaneous, double-click PST Settings.
  3. Double-click Preferred PST Mode (Unicode/ANSI).
  4. Click Enabled to enable the policy setting.
  5. In the Choose a default format for new PSTs drop-down list, select Enforce Unicode PST.
  6. Click OK.
To enforce Unicode mode in Outlook by using Group Policy
  1. In Group Policy, load the Office Outlook 2007 template (Outlk12.adm).
  2. Under User Configuration\Administrative Templates\Microsoft Office Outlook 2007\Tools | Account Settings, double-click Exchange Settings.
  3. Double-click Exchange Unicode Mode — Ignore Archive Format.
  4. Click the Enabled radio button to enable the policy configuration.
  5. Select the Ignore existing format of the Archive PST check box, and click OK.
  6. Double-click Exchange Unicode Mode — Ignore OST Format.
  7. Click the Enabled radio button to enable the policy configuration.
  8. In the Choose whether existing OST format determines mailbox mode drop-down, select Create new OST if format doesn't match mode. Users are prompted for the file name of the new OST file.
    –or –
    To prompt users with a dialog box that allows them to defer creating a new OST, select Prompt to create new OST if format doesn't match mode. Users are prompted to decide whether to create the new OST file now or later, and then (if they choose to create the file now) for the file name of the new OST file.



eventually the message disappear, after the new ost become unicode. the new ost size is 2.1GB




Wednesday, November 2, 2011

applocker gpo settings

computer-configuration
- windows settings
---security settings
----- application control policies
-------applocker

windows 2008 R2 and windows 7

application identity service must be running

dont forget create the default rules first

Tuesday, November 1, 2011

VNC client for ipad / iphone

VNC client for ipad / iphone

tried a few free one, no luck connecting to a real vnc 4.x server

I have to get the client to buy real vnc viewver for about $15.00US

not enough memory to open word on a brand new HP elite notebook

not enough memory to open word on a brand new HP elite notebook

quite shocking

the answer is restarting the notebook after office 2010 activation

virtual desktop infrastruture VDI - windows 2008 R2

virtual desktop infrastruture VDI - windows 2008 R2

add remote desktop services role