Always Enjoy Lunch

I once received some sage advice from another System Administrator I worked with years ago regarding working with potentially troublesome servers.

It was back in the Exchange 5.5 days. I had a cranky server with a potentially unsolved hardware problem in the disk subsystem. Every time I powered off the server, it damaged the OS and I was forced to restore Exchange from tape. The manufacturer always replaced a part when I called for support, but I had ended up rebuilding it several times and had not yet confirmed that the latest hardware replacement resolved the issue.

My co-worker was on-site to help me set up a new server room after we relocated the office. Because of the history of the server, I was very anxious about possibly having to restore Exchange again. It was approaching lunch time and we were at the point where it was time to power on the mail server.

He turns to me and says, "We are going to press the power button and then walk out to eat without looking back." His theory was that if the server was going to be fine, it would be fine without us watching it boot. If was going to have a problem, the problem would still be there when we returned. At the very least we would have had a relaxing lunch break and would be better able to solve a problem without the additional stress of hunger pains.

Turns out the server was fine.

To this day, I still heed that advice. If I'm about to do something to a system that has the potential to backfire, I make sure I've already enjoyed my lunch.

Microsoft Security Essentials - Accessible for the Visually Impaired

On occasion, someone from one of my non-tech interests overlaps with my "geek" interests. A blind friend posted a question to the "Twitter-verse" asking about anti-virus software that was accessible for the JAWS screen reading software.

My first response was to suggest Microsoft's Security Essentials, but I didn't know if it was accessible in the way that was needed. Turns out, not only does MSE rank well against a variety of other anti-virus software offerings, it is accessible with at least JAWS 9. I suspect it will equally accessible with the most recent JAWS version as well.

The only issue was that download the software itself wasn't particularly accessible. This detailed post on the "Blind Access Journal" blog lists out how to download the software using JAWS. Once that hurdle is overcome, Security Essentials is a great fit for users who have special software needs and don't want AV software to get in the way of other applications that make their computers such valuable tools.

Getting Back in Touch with Hyper-V

Some days I feel really behind the eight ball, so today I spent some time getting back into Hyper-V. The office runs VMWare for our production items, but I'm really trying to make time to give Hyper-V a fair shake. Since all of our lab machines are segregated off into various nooks and corners of the server room, physical access while working on them is less than ideal. I'm happy to remotely connect to servers from the comfort of my desk.

Conveniently my co-worker already has a Hyper-V host server set up, so that saved me from having to hunt down hardware and get going from scratch. In order to get started configuring my guest server, I'm connected to my Hyper-V host machine via Remote Desktop and then connecting to my guest server with a Virtual Machine Connection. Because the mouse might "behave erratically" without Integration Services in this particular scenario, the mouse controls are intentionally blocked.

While one of my many random goals in life may be to navigate Windows without a mouse, it's not something I'm very proficient at currently. In order to install the Integration Services, one needs to be handy with keyboard commands, particularly the alternate versions used in the virtual enviroment. Here are a few that I found useful. The traditional key command is listed first, followed by it's Hyper-V VM equivalent.

• CTRL + ALT + DEL = CTRL + ALT + END
• ALT + TAB = ALT + PAGE UP
• ALT + SHIFT + TAB = ALT + PAGE DOWN
• ALT + ESC = ALT + INSERT
• CTRL + ESC (Start button) = ALT + HOME
• Right-Click (to get to context menus) = SHIFT + F10

Ultimately, I'll be using this guest server to play around with SharePoint 2007, but today I'm happy to have just gotten the OS configured and Windows Updates installed. SharePoint will have to wait until after Turkey Day.

Tech Tidbits - PDFs on Kindle 2, Beta Exams

For those of you who like to be on the bleeding edge of Microsoft exam offerings, don't miss out on the Microsoft Beta Exam Announcements blog. Right now there are 3 new beta exams available:

• 71-663 - Pro: Designing and Deploying Messaging Solutions with Microsoft Exchange Server 2010
• 71-580 - TS: Windows Mobile® 6.5, Application Development
• 71-579 - TS: Windows Mobile® 6.5, Configuring

Also, Amazon released a firmware update for the Kindle 2 that increases the battery life by several days and added support for native PDFs, which was originally only available in DX version. I don't expect I'll be dumping my Kindle "classic" immediately, but I will put a few whitepapers on my husband's to see how it handles diagrams and other components that don't convert well to the regular Kindle format.

Finally, don't miss out the PacITPros December meeting. Check out www.pacitpros.org for details and to RSVP.

TS RemoteApp, Group Policies, Internet Explorer Zones

It wouldn't be work if we didn't have more than one different, yet similar, things going on in the office at any given time. The disaster recovery user testing is drawing to a close and I'll be the first to admit that opening it up to users has certainly been a learning experience. (More on that later.)

Meanwhile, in an attempt to phase out our Citrix Remote Access farm, we've started to "soft-launch" our production version of Windows 2008 Terminal Services using Terminal Services Web Access and RemoteApp. Two applications we are publishing as remote applications are our financial system and our timecard system. We succeeding in getting both these applications mostly running in our disaster recovery lab last month, but our production version of Terminal Services is a different animal.

In the disaster lab, I didn't configure any special group policies that affected Internet Explorer or any other functions. The setup was just by the basic configuration wizards for Terminal Services, TS Gateway and RemoteApp. Our production version of Terminal Services was set up "by the book" (particularly this book) with lots of security customizations added on with group policies. I'm all for tightening things down until people squeal and then loosening things up as needed and my co-worker had done just that with this installation.

Today, I tested out the timecard application that requires a Java plug-in. The plug-in automatically initializes on our regular desktop machines without issue. On the Terminal Server, which is running the Enhanced Security Configuration, the name of server hosting time timecard web page must be part of the "Intranet" security zone in IE.

Easy fix... except I don't have access to the "Tools - Internet Options" pages in Internet Explorer with my regular user account. That's a group policy setting. Or rather, 3 group policy settings. Because the options available in group policy have grown as each new OS has been introduced, there are several places you can enable, disable and tweak various aspects of what IE menus are available to users. It took me several visits to our Terminal Services policies to restore access to the "security" tab of Internet Options.

Sure enough, once I added the proper web server to the Intranet list, the plug-in initialized. But we don't want to have to explain this to each and every user when they access remote applications for the first time. So next up was getting those setting to automatically configured for each new user.

Our first stop was Group Policy Preferences, which allows for configuration of much of the Internet Options tabs, but not any of the lists for Intranet, Trusted or Restricted sites - how frustrating. But those are simply registry keys, which can be added "a la carte" with Group Policy Preferences as well. The end seems near.

A quick search yields this MSDN article, Adding Sites to the Enhanced Security Configuration Zones. We ended up adding registry keys for both the regular non-ESC domains and the ESC domains because our testing showed that my user account put zone additions in the regular domain area and my co-worker's went in the EscDomain registry area. (The dword hex of 1 means "Intranet zone", use 2 for "Trusted" sites.)

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\timecard]
  "http"=dword:00000001
  
  
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\timecard]
  "http"=dword:00000001

We didn't experiment further with the "Domain" vs "EscDomain" mystery, instead just added registry keys to cover all our bases for the time being. Now the only thing left is to decide if we want to take away those IE Options pages that I added back in for testing. Jury is still out on that one.