January 2009
Identity Management: An Introduction to Identity Lifecycle Manager 2
The upcoming release of Microsoft Identity Lifecycle Manager “2” offers many new features and enhancements. Explore the new portal experience and find out how you can cut costs with self-service tools, increase security compliance with business process modeling, and reduce development time with simplified development tools. Aung Oo
Windows Administration: Expanded Control with Group Policy Preferences
The new Group Policy Preferences feature found in Windows Server 2008 and Windows Vista provides more than 3,000 settings, greatly expanding what administrators can do with Group Policy. Here’s a guide to using Group Policy Preferences to manage your environment. Derek Melber
Windows Administration: Deploying Applications with Terminal Services
Without too much effort, you can deploy a terminal server to host the applications you need in your environment. But there are some important decisions you’ll need to make to ensure your implementation meets user expectations. Greg Shields discusses the various options you have and explains how they will affect you. Greg Shields
SQL Server 2008: Advanced Troubleshooting with Extended Events
SQL Server 2008 includes a new “eventing” mechanism called SQL Server Extended Events that enables some sophisticated troubleshooting. Get an overview of Extended Events and find out how you can use this new functionality for monitoring and troubleshooting. Paul S. Randal
Microsoft Office: Getting Started with Project Server 2007
Project Server 2007 delivers significant enhancements, not only to the features and functionality for users but also for administrators. Alan Maddison explores some of the most significant new features and walks you through the installation and configuration of Microsoft Office Project Server 2007. Alan Maddison
Columns
From the Editor: A Few New Things: | Letters: Readers Speak Out: | Toolbox: New Products for IT Pros: Greg Steen discusses recovering from system crashes with Replay RA - Recovery Accelerator, managing compressed archives with WinRAR, using TortoiseSVN to simplify source control, measuring disk I/O with Iometer, as well as rebooting servers remotely with the APC Switched Rack PDU, and looks at the book "Windows Group Policy: Windows Server 2008 and Windows Vista".Greg Steen
Exchange Queue & A: Mysterious Attachment Size Increases, Replicating Public Folders, and More: Why do attachment sizes increase when sending and receiving e-mail messages? How can you ensure databases on a passive node in a CCR cluster are defragmented during online maintenance? Can you use an external trust between forests? We answer these questions and more.Henrik Walther | Utility Spotlight: USB Flash Drive Manager: See how the free Microsoft USB Flash Drive Manager can help you easily copy, delete, and back up files from a flash drive, as well as perform other useful tasks.Lance Whitney | Utility Spotlight: Microsoft Remote Server Administration Tools for Windows Vista: This column describes the Microsoft Remote Server Administration Tools, which allow administrators to remotely manage roles and features in Windows Server 2008 and Windows Server 2003 from a computer running Windows Vista SP1.Edward Dake
Inside SharePoint: SharePoint Security Accounts: Take a close look at SharePoint Security Accounts to see how a weak configuration can give an attacker full control over all site collections and sites.Pav Cherny | Windows PowerShell: Trapping Errors: Learn how you can implement error-handling in Windows PowerShell.Don Jones | Hey, Scripting Guy!: Learning to Excel: Discover how to use the Excel.Application automation model for a more powerful way to process data from your servers and take advantage of the analysis and charting tools built into Excel.The Microsoft Scripting Guys
The Desktop Files: Windows Won't Start!: Drivers fail, files get corrupted, disks crash--there are numerous uncontrollable reasons why Windows might fail. But all is not lost. Wes Miller explores the kinds of things that can go wrong in a Windows system, and explains how you can troubleshoot them to get your system working again.Wes Miller | Security Watch: Subjects and Security Principals: Security principals underlie so much of Windows security that it is essential for any administrator to have at least a basic understanding of how the various types of Security principals work and how they are used. Here's what you need to know.Jesper M. Johansson | Sustainable Computing: How to Plan Your Server-Consolidation Strategy with System Center: Find out how you can use Microsoft System Center and virtualization software to consolidate servers and reduce your IT costs.Frank Koch and Michael Walsh
Field Notes: What On Earth Is Green IT?: Get a quick overview of some simple IT upgrades that can provide both environmental and cost cutting benefits.Jim Lynch | Field Notes: IT's Surprises: Although many CIOs want to avoid the public eye, a lively discussion at a recent conference revealed that perhaps the opposite is actually true—the IT department should take the time to extol its virtues and reveal its accomplishments to the people it supports.Romi Mahajan | Windows Confidential: Last Check-In Chicken: Raymond Chen explains why it is often the developers who have their acts together who end up checking in the final bug fixes to products.Raymond Chen


This article is based on a prerelease version of Microsoft Identity Lifecycle Manager "2." All information is subject to change.

Identity Management
An Introduction to Identity Lifecycle Manager 2
Aung Oo
At a Glance:
  • The new portal experience
  • Self-service tools
  • Business process management
  • Codeless provisioning

Contents
Portal Experience
The Administrator
For the Standard User
For Group Management
Self-Service Password Management
Office Integration
Business Process Management
Codeless Provisioning
Wrapping Up
The new release of Microsoft Identity Lifecycle Manager "2" (or ILM "2"), which is in beta 3 at the time of writing this article, builds upon the identity management capabilities found in Microsoft Identity Integration Server 2003 (MIIS 2003) and ILM 2007. It offers many new features and enhancements—you can cut costs with self-service tools, increase security compliance with business process modeling, and reduce development time with intuitive development tools.
In this article, I want to showcase key new features and enhancements and discuss the benefits ILM "2" can bring to your organization. In particular, I will discuss the ILM "2" portal experience in managing user profiles and groups, self-service password management, business process and workflow design, integration with Microsoft Office, and the ability to develop synchronization rules without using code (known as codeless provisioning). Last, but not least, I will cover the software, hardware, and tentative licensing requirements for implementing ILM "2."

Portal Experience
The Web portal is one of the most notable features added to ILM "2" as this is the first time Microsoft has included a UI for end users to perform self-service functions. The Web interface provides an entry point for authorized users and administrators to manage users and groups, define business rules, and even allow development of codeless provisioning to provision accounts.
ILM "2" makes use of Windows Integrated Authentication with Active Directory so organizations can use existing users and groups already defined in Active Directory to provide authentication and authorization to new users. Those with administrative privileges can perform administrative functions, such as defining workflows for processes and configuring synchronization rules, as well as the tasks that end users can perform.

The Administrator
If you log into the portal and you have administrative privileges, you'll have access to more features than standard users (see Figure 1). You can view and update existing records, as well as request accounts for new employees in the connected directory.
Figure 1 The ILM “2” portal
When setting up a new user with the portal, you can submit such user details as name, display name, e-mail address, start date, end date, and the like. And the fields on the page can be configured as necessary. Using object visualizations, you can extend the schema of the portal to request most any kind of data, such as the employee's shoe size.
The synchronization engine detects new records and changes made from the portal and provisions user information in the connected directory accordingly. The process of provisioning accounts in connected directories using the synchronization engine follows the same process as in ILM 2007. The key change here is that administrators can enter and update employee information via the portal, and the portal then feeds the synchronization engine, offering a more flexible way to gather and update user information in connected directories.
Human resources databases often do not contain contractors and temporary workers, such as student interns, making it difficult to manage these accounts. And these accounts are often created manually in various applications, making it easy to forget to then manually delete the accounts when necessary. This creates a potential for security holes, where accounts remain active after a user has left the organization.
One approach is to use the ILM "2" portal to provision and track profiles for temporary workers. The HR database remains the authoritative source for employee and contractor records, while the portal simply complements the HR database as another way to enter and update profiles.

For the Standard User
The portal also puts some of the power in the hands of standard users. Users can update a subset of their information and the information is then pushed out to connected directories, again using the ILM "2" synchronization engine. You, the administrator, can configure which attributes users can update and you can validate the format of the information that users enter into the fields. This approach can help to keep data more current in various data sources.
This is in stark contrast to the ungainly methods used today. In order to allow users to update their own information, many organizations rely on third-party phone book solutions or build their own solutions internally. Other organizations require users to actually call the help desk or submit paperwork to update information.
There are some serious disadvantages to both of these approaches. Third-party applications and custom in-house solutions can be very expensive and difficult to maintain. And the updated information contained in one of these solutions generally doesn't use a synchronization engine to then update other connected directories. Meanwhile, having users call the help desk to update information can greatly increase IT support costs and tie up support personnel with relatively trivial tasks.

For Group Management
Administrators can now provision security groups and distribution lists with memberships in connected directories by defining queries to classify memberships based on user attributes values or by name. All operations can be done using the simple Web-based UI. Provisioning groups by explicitly adding users is straightforward, but more complex scenarios are supported.
You can provision groups with calculated memberships, creating groups that are based on reporting relationship and specific attributes. This is done by defining a workflow action. For instance, the administrator can define a query to group all users within the marketing department, assigning a value of "marketing" in the group name (All Users in Marketing). The ILM "2" synchronization engine imports the group according to the definition and provisions groups in the connected directory. Complex queries can be developed quite easily using Boolean logic to look up multiple attributes.
End users can also create a distribution list and add or remove themselves from the list through the portal. The approval logic of the workflow can be incorporated so that only approved distribution lists or authorized users can join the list.
Previous versions of ILM let you manage groups through the Web interface, but this required a separate download—it was included as a part of the provisioning and workflow section of the Microsoft Identity and Access Management Series. That solution was only for administrators and did not allow end users to join and leave assigned groups.
There are also administrative functions that you can perform on the Web portal. Some of the notable administrative capabilities include:
  • Prioritizing the type of objects being provisioned to a connected directory. (This allows you to ensure that certain objects do not have to wait the entire synchronization cycle to get provisioned.)
  • Modifying the schema of the user profiles page. (The schema of the page for collecting user information can be extended to incorporate fields that are specific to your organization's requirements.)
  • Updating user account status.
  • Modifying how the site looks and functions. (This allows you to customize the portal to accommodate your organization's standards.)

Self-Service Password Management
Another key feature that is new in ILM "2" is the self-service password management solution. The two password management solutions available in ILM 2007 (a Web-based solution and the Password Change Notification Service) offer limited self-service capabilities. Both require that the user input his old password to reset his password; thus they are quite useless when it comes to a forgotten password—in that situation, the user would need to call the help desk.
ILM "2" addresses this by allowing users to reset their passwords using challenge-response questions, which can be accessed from the Windows logon UI. This, obviously, can help reduce help desk costs.
Once the password management application is deployed and a user logs on for the first time, a screen will pop up, requesting that the user answer a set of questions (what was your first car, in what city were you born, and the like). The password rest dialog is shown in Figure 2.
Figure 2 The password reset screen
The administrator can specify the type and number of questions to be used. He can also specify the number of gates (each gate contains a set of questions). In addition, the administrator can configure the number of questions that the user must be able to answer to be able to reset the password or move on to the next gate.
To provide the appropriate level of security, you can tie the number of gates and questions the user must correctly answer to Active Directory security groups. For instance, users in the executive security group may need to go through three gates and must answer all questions at each gate correctly. Users in the marketing security group, on the other hand, may only need to go through one gate and answer two out of three questions. And if you do not want to give users the ability to reset passwords from the Windows logon, there is an option to provide a Web UI for resetting passwords.

Office Integration
ILM "2" office integration allows users to manage group membership from within Microsoft Office Outlook, as shown in Figure 3. This provides a familiar way to access common tasks, such as joining and leaving distribution lists, as well as adding and removing other users from the group (this requires Outlook 2007 or later).
Figure 3 Integration with Outlook
A user can select Join group, browse the global address list, select the groups she wants to join, or remove herself from group membership, and then just send the request. The owner of the distribution list receives the request via e-mail and can approve or deny that request from within Outlook. If the group owner approves the request, the ILM synchronization engine is triggered to complete the process.

Business Process Management
Business process and workflow management are fundamental to all key scenarios in ILM "2." Happily, business process and workflow logic can be tailored to your particular organization's requirements. For example, you can specify to have certain events in the system trigger a series of automated steps, known as processes (see Figure 4).
Figure 4 Configuring workflow processes
An administrator can associate an event with one of the three process types: Authentication, Authorization, and Action. For example, selecting the Authorization process type will allow the owner to approve all requests to join or leave the group. When selecting the Authorization workflow, you can also define the names of approvers, the number of approvers, and the number of days for which the approval is valid.
Complex workflows can be defined so that all delete operations performed to groups must be approved by administrators and require users to authenticate against a challenge-and-response authentication process. All users, including administrators, must go through the authentication process by answering questions that they have registered during the initial registration period to validate their identity.
Once the authentication process is done, the request for the group deletion is sent to the approver for authorization. The authorization process confirms the user's permission to request the operation. Finally, the approver approves the request and ILM carries out the delete operation.
The ability to design a complex workflow using the built-in tool is a significant addition to ILM; previously, a solution like this required the Single-Step Provisioning Workflow in the MIIS resource tool kit or a third-party solution. Today, Web service APIs are also available so you can go a step further to customize your own workflows and integrate them with ILM "2."

Codeless Provisioning
Codeless provisioning allows IT professionals to perform most of the tasks that previously required code development. ILM 2007 required you to use Microsoft Visual Studio to develop rule extensions and provisioning code to transform attributes and objects in the connected directory.
From the Web UI, you can define the type of objects, filter rules, provisioning condition, object relationships between the metaverse and connector space, deletion rule, and data flow. All the data flow mapping that is defined in the management agent designer is displayed, allowing you to edit the mapping to concatenate and format the attribute flow in both inbound and outbound flows. And if you prefer coding, you can still develop functions by developing extension and provisioning rules for ILM "2."

Wrapping Up
ILM "2" offers a range of new features that can help simplify management and reduce help desk costs. From a new portal and self-service features that are greatly needed additions to codeless provisioning, both administrators and end users will benefit from new features that simplify tasks and help users to be more productive. And there are other compelling improvements, such as the enhanced Certificate LifeCycle Management feature plus the extended connectivity and extensibility enabled by increased management agents.
ILM "2" is scheduled to be available in the first half of 2009. You can find more information at Microsoft's Identity Lifecycle Manager "2" website.

Aung Oo is an identity management subject matter expert within Microsoft Consulting Services. Aung has been designing, developing, and deploying enterprise directory and identity management solutions for both commercial and government customers since the first release of Microsoft Identity Management.


table.one { table-layout:fixed;width: 890px; } table.two { table-layout:fixed;width:750px; } .tdwidth{ width:150px; } tr.heading td { padding : 10px; background-color:white; color: black; vertical-align:top; } tr.fig td { background-color:black; color: white; padding: 10px; font-weight:bold; vertical-align:top; } tr.dark td { background-color: #b9d1dc; color: black; padding: 10px; vertical-align:top; } tr.lite td { background-color: #dde8ee; color: black; padding: 10px; vertical-align:top; } tr.small td { background-color: #dde8ee; color: black; padding: 5px 10px 5px 10px; vertical-align:top; font-size: 10px; } .floatleft4 { float: left; margin: 5px 0px 10px 0px; width:420px; font-weight: normal; font-size: 14px; color: #323e58; font-family: "Segoe UI", Arial; } .floatright5 { float: right; margin: 5px 0px 10px 0px; width:420px; font-weight: normal; font-size: 14px; color: #323e58; font-family: "Segoe UI", Arial; } .floatleft8 { float: left; margin: 5px 15px 10px 0px; width:404px; font-weight: normal; font-size: 14px; color: #323e58; font-family: "Segoe UI", Arial; }
Windows Administration
Expanded Control with Group Policy Preferences
Derek Melber
At a Glance:
  • Operating system compatibility for Group Policy Preferences
  • Policies vs. preferences in different management areas
  • Setting preferences with the GPME
  • Administering Group Policy Preferences

Contents
GPP Compatibility
Policies and Preferences
GPP Structure and Settings
Advanced Configurations
Administering GPP
Group Policy Preferences to the Rescue
Summing It Up
Among the new technologies that Windows Server 2008 and Windows Vista brought, one of the most compelling is Group Policy Preferences (GPPs), which now greatly expands what administrators can do with Group Policy. Group Policy Preferences provide more than 3,000 settings in 22 different areas within a Group Policy Object (GPO) and include setting drive and printer mappings and controlling local group membership. And the great thing is that you don't need to install a new infrastructure since the technology works with your existing Active Directory infrastructure and Group Policy environment. You need only install an administrative tool and client DLL to get this to work. In this article, I'll delve into Group Policy Preferences in order to demonstrate both their usefulness and how easy they are to deploy and administer.

GPP Compatibility
GPPs can only be administered in an Active Directory environment that contains at least one Windows Server 2008 server or Windows Vista desktop, because these are the only ones that can support the new Group Policy Management Console (GPMC). The GPMC is required to support and administer the GPP settings, and it also launches the new Group Policy Management Editor (GPME) that displays the GPPs that can be administered.
The situation is much different, however, when it comes to applying the settings that are associated with GPPs; for this, operating systems before Windows Server 2008 and Windows Vista are supported as well. Specifically, GPPs support Windows Server 2003 SP1 and Windows XP Professional SP2, as well as all operating systems that came after these. Figure 1 summarizes which operating systems can administer GPPs and which can apply GPPs.
Figure 1 Operating system support
Operating System | Can Apply Group Policy Preferences | Can Manage Group Policy Preferences through GPME
Windows 2000 | Not supported | Not supported
Windows XP (x86 and x64) | Supported with SP2 and CSE installation | Not supported
Windows Vista (x86 and x64) | Supported with SP1 and CSE installation | Supported with SP1 and RSAT installed
Windows Server 2003 (x86 and x64) | Supported with SP1 and CSE installation | Not supported
Windows Server 2008 (x86 and x64) | Integrated | Integrated

Policies and Preferences
The terms "policies" and "preferences" are important to grasp with the new Group Policy capabilities. The definitions of policies and preferences are based upon some key management areas of Group Policy, including enforcement, flexibility, Registry behavior, targeting, and user interface. That's not an exhaustive list, but these are the areas that tend to be most important to administrators.
Let's look at the key benefits preferences provide in these areas. Figure 2 has more information on the differences between policies and preferences.
Figure 2 Group Policy preferences and policies*
Management Areas | Group Policy Preferences | Group Policy Settings
Enforcement | Preferences are not enforced. User interface is not disabled. Preferences can be refreshed or applied only once. | Settings are enforced. User interface is disabled. Settings are refreshed.
Flexibility | Easily create preference items for registry settings, files, and so on. Import individual registry settings or entire registry branches from a local or a remote computer. | Adding policy settings requires application support and creating administrative templates. Cannot create policy settings to manage files, folders, and so on.
Local Policy | Not available in local Group Policy. | Available in local Group Policy.
Awareness | Supports non-Group Policy-aware applications. | Requires Group Policy-aware applications
Registry Location and Behavior | Original settings are overwritten. Removing the preference item does not restore the original setting. | Original settings are not changed. Stored in registry Policy branches. Removing the policy setting restores the original settings.
Targeting and Filtering | Targeting is granular, with a user interface for each type of targeting item. Supports targeting at the individual preference item level. | Filtering is based on Windows Management Instrumentation (WMI) and requires writing WMI queries. Supports filtering at a GPO level.
User Interface | Provides a familiar, easy-to-use interface for configuring most settings. | Provides an alternative user interface for most policy settings.
*Table courtesy of "Group Policy Preferences Overview" by Jerry Honeycutt

Enforcement GPPs are not enforced; thus initial configurations can be made but the end user is in control.
Flexibility GPPs let you easily add any Registry value, file, or folder to the GPO for management. Also, since GPPs are XML-based, they can be copied and pasted into other GPOs efficiently.
Registry Behavior All Registry entries can be controlled even when the target computer or user is no longer under the scope of management of the GPO where the Registry value is configured. Registry values can be removed or kept in place after the GPO no longer affects the target object.
Targeting Each GPP setting provides more than 25 different targeting filters for controlling whether or not the setting affects the target object. Examples of filters include IP address range, security group membership, and Registry value match.
User Interface The user interface for GPP is dramatically easier and friendlier than for other settings in the GPO. In most cases, the "real configuration interface" is duplicated in the GPO, making configuration of the setting easy and familiar.

GPP Structure and Settings
When a GPO is opened in the GPME, policies and preferences are very clearly separated, as shown in Figure 3, making it easy to see which settings fall within the new GPP arena. This is important to note, as preferences behave differently than policies. When you expand the Preferences nodes under either Computer Configuration (see Figure 4) or User Configuration (see Figure 5), you'll find the numerous settings split into two categories, Control Panel Settings and Windows Settings.
Figure 3 The GPME separates policies from preferences
Figure 4 Computer Configuration Preferences
Figure 5 User Configuration Preferences

Advanced Configurations
You can control GPPs more granularly than other settings in a GPO by using the options available on the Common tab for each preference. The Common tab includes checkboxes for five different settings, an option to configure targeting, and a textbox for describing the GPO preference for documentation and troubleshooting purposes.
Stop Processing Items in this Extension if an Error Occurs The default behavior of Group Policy processing is that all settings will be processed, even if there are multiple settings with the same Client Side Extensions (CSE) and one of those settings fails. If you want to have the processing of the settings within a single CSE stop after one of the settings within that CSE fails, enable this option. This setting only has the scope of the current GPO.
Run in Logged-on User's Security Context (User Policy Option) When Group Policy settings (policies and preferences alike) apply, they apply using the local System account. Since the local System account only has access to the system environment variables and local resources, obviously the user context is not available. In order for the user environment variables and network resources to be accessed, this option can be enabled to process Group Policy Preferences using the logged-on user's account.
Remove This Item when It Is No Longer Applied GPP settings are not deleted from the registry when the GPO is removed from the user or computer, nor are they deleted when the user or computer falls out of scope of management of the GPO. In order to have preferences settings removed when the GPO no longer applies to the user or computer object, this option can be enabled (though it should be noted that this option is not available for some extensions, such as those for Internet Explorer).
Apply Once and Do Not Reapply Group Policy has a default refresh interval, which is approximately every 90 minutes. This refresh is implemented so that new settings can be applied, and old settings reapplied, without the computer or user needing to restart or re-logon. If the GPP setting you are configuring should only apply one time to the computer and never update, you can enable this setting. This is an excellent mechanism for establishing an initial array of configurations that GPP can affect, while still allowing the user to create a customized environment by changing the settings after logon and not have them overwritten.
If the settings fall under the User Configuration, GPP will apply these settings once on each computer the user logs onto. If the setting falls under the Computer Configuration, GPP will apply the setting once per computer. Note, however, that this is a one-time-only application of these settings. In order to update or re-apply these settings, you must uncheck this option first.
Item-Level Targeting By default, all users and computers that fall under the scope of management of the GPO will receive the settings within the GPO. In order to have these settings apply to only a subset of the default users and computers, targeting can be used. More than 25 different targeting items are available; they can be used alone or in conjunction with other items. Figure 6 shows the full list of item-level targeting options.
Figure 6 Item-level targeting is used to dynamically control GPP settings on user and computer objects
Description The Description textbox lets you document the settings, options, and targeting items for each GPP setting. This is the text that will be seen when the particular preference setting is selected within the GPME, without having to edit the GPP setting itself, as shown in Figure 7.

Administering GPP
Administration of GPPs is the same as that of other GPO settings. The only catch, as noted earlier, is that they must be administered from a computer running Windows Server 2008 or Windows Vista SP1.
Figure 8 New Drive Properties dialog box opens when you create a new policy setting for Drive Mapping
Suppose you want to configure a drive mapping under the User Configuration portion of the GPO. The Preference setting for this is located at User Configuration | Preferences | Windows Settings | Drive Maps. By right-clicking on the Drive Maps setting, you can select New—Mapped Drive which will create a new policy, as shown in Figure 8. Here you input the information to map the drive, such as Location, a label for the drive locally, and a Drive Letter.
At this point, you have a choice to have the drive mapping apply to every user that falls under the scope of management of the GPO, or you can limit the users that receive the setting by configuring item-level targeting. You should set up item-level targeting that controls which users receive the drive mapping based on security group membership and by running a quick check to see if they have a specific program (.exe) file located on their computer. You perform this second check because the shared folder you're mapping contains files that are useful only when accessed with that program file.
To make these item-level targeting settings, click on the Common tab in the New Drive Properties dialog box. Then, click the checkbox next to Item-level targeting and then on the Targeting button. This opens the Item-level targeting dialog box. Click the dropdown list for Targets and click on Security Group. Then, click on Browse, which will let you configure the proper group, HR Users in the example (see Figure 9).
Now you'll want to configure the path to the .exe file. Select File Match from the Target dropdown list to add the criteria. Then type the path of the file, C:\Program Files\ACME\HRBenefits.exe, for this example. (Note: Drive Maps and Printers both adhere to foreground GPO policy refresh. For more information on foreground and background policy refresh, refer to the GPP article, Group Policy Processing.)
After this, the next time a user logs off and then back on, the mapped drive will appear, provided he is a member of the HR security group and has the HRBenefits.exe file on his computer. If those criteria are not met, the drive letter will not appear.
Figure 9 Item-level targeting options can be combined

Group Policy Preferences to the Rescue
Here is a short list of some of the problems I have solved using GPPs:
  • Fixing the membership of the local Administrators group on every desktop to include Domain Admins and the local Administrator account, but not deleting the existing members of the group.
  • Ensuring that the current user of the desktop does not have his user account located in the local Administrators group.
  • Controlling power options on every desktop computer for big electricity savings.
  • Updating the service configuration area on every server running a specific service so that the service startup mode is always Automatic.
  • Mapping printers dynamically such that when laptop users visit Branch office 1, they get the proper printers. Likewise, when they visit Branch office 2, they get the correct printers for that location.

Summing It Up
Group Policy Preferences are easy to administer and deploy. Since the technology is compatible with Windows Server 2003 SP1 and Windows XP SP2, nearly all companies can take advantage of the new settings and the power they bring. This reduces the cost of implementation and allows the administrators the control over the desktops they need to perform their job efficiently.
Combining a good Group Policy deployment design with item-level targeting gives administrators the ability to create dynamic desktop and server configurations. With more than 25 item-level targeting criteria available, nearly every setting can be controlled to apply only when appropriate. You'll find more information on Group Policy in the Group Policy Resource Kit and also at the Windows Server Group Policy site.

Derek Melber is an independent consultant, trainer, and author. Derek evangelizes Microsoft technology, focusing on Active Directory, Group Policy, security, and desktop management. Derek regularly contributes to online and print publications, and has written more than 10 technology books, including The Microsoft Windows Group Policy Resource Kit (Microsoft Press, 2008). You can reach Derek at derekm@braincore.net.


.SidebarContainerA { width: 950px; height: 600px; float: right; border: 2px solid #008080; padding: 10px 20px 0px 20px; background-color: #e1e8f5; margin: 20px 0px 20px 0px; font-family: Verdana, Arial; font-size: 12px; line-height: 16px; color: #333333; } table.five { table-layout:fixed; width: 500px; } tr.heading td { padding : 10px; background-color:white; color: black; vertical-align:top; } tr.fig td { background-color:black; color: white; padding: 10px; font-weight:bold; vertical-align:top; } tr.dark td { background-color: #b9d1dc; color: black; padding: 10px; vertical-align:top; } tr.lite td { background-color: #dde8ee; color: black; padding: 10px; vertical-align:top; } .tabright { text-align:right; } .SidebarContainerB { width: 340px; height: 440px; float: right; border: 2px solid #008080; padding: 10px 20px 0px 20px; background-color: #e1e8f5; margin: 20px 0px 20px 10px; } .floatleft1 { float: left; margin: 5px 20px 10px 0px; width:503px; font-weight: normal; font-size: 14px; color: #323e58; font-family: "Segoe UI", Arial; }
Windows Administration
Deploying Applications with Terminal Services
Greg Shields
At a Glance:
  • The benefits of RemoteApps
  • Making applications available to users
  • Evaluating a terminal services implementation
  • Ensuring a positive user experience

Contents
Goodbye Desktops, Hello RemoteApps
Launching Apps from the Web
Launching Apps from the Desktop
The User Experience
RemoteApps = Predictable Performance
You Have Options
You can find a lot of instruction on the Internet and in your local bookstore on exactly how to install and use Terminal Services. But what's sorely lacking in many of those outlets is information on how best to get remote applications to your users. With minimal effort, you can quickly deploy a terminal server in your environment that hosts your set of needed applications. Yet doing so in a way that meets your users' expectations definitely requires a little extra thought.
If you are a terminal server administrator, take a step back from your remote applications infrastructure and consider the following: How are you deploying applications? Do you supply users with remote desktops or TS RemoteApps? Do users access their apps via static Remote Desktop Protocol (RDP) files, a Web page, or desktop shortcuts?
Video
Greg Shields demonstrates how you can deploy applications with Terminal Services.

In the end, how are you evaluating the experience your users undergo when they use terminal services applications? With the improvements to Terminal Services now available with Windows Server 2008, the best answers to these important questions might surprise you.

Goodbye Desktops, Hello RemoteApps
Windows Server 2008 takes some of the pain out of terminal services administration through a significantly expanded set of services and capabilities. That list of what's new and what's changed was discussed in the November 2008 issue of TechNet Magazine, where Joshua Schnoll detailed the new features gained through the move to Windows Server 2008 ("Presentation Virtualization with Enhanced Terminal Services"). Of those features, arguably the most significant is terminal server's new ability to deploy individual applications to users instead of full desktops.
Called TS RemoteApps, these individual apps appear to users as if the application were installed directly to their local desktops. When a user clicks to launch a RemoteApp, he sees only the application itself on his local computer. No extra Start bar or double desktops intrude to make it plain you're interacting with a non-local system. Depending on the implementation and the expectations of your users, a TS RemoteApp can be superior to deploying an entire desktop simply because it makes these applications seem like a normal part of the local desktop experience.
With Windows Server 2008, creating a new TS RemoteApp is a simple process using the TS RemoteApp Manager console found under Administrative Tools. Clicking the Add RemoteApp Programs link in the Actions pane launches the RemoteApp Wizard, which interrogates the Terminal Server's Windows Management Instrumentation (WMI) store to identify a list of potential applications already installed on the server. An example of this list is shown in Figure 1.
Figure 1 The RemoteApp Wizard enumerates applications installed on the Terminal Server
Select from the list those applications you want to create as RemoteApps and click Next. If your desired application isn't available, click the Browse button and locate its primary EXE file. This will be the EXE file you normally use to launch the application. Complete the wizard and your remote application is ready for deployment.
If you right-click to view the properties of your new RemoteApp, you'll see that a few options can be adjusted. Besides being able to modify the name, location, icon, and alias information, you can also enter command-line arguments. This is handy for applications that require a set of arguments at launch time to function correctly, but it can also be used in conjunction with some applications to create links to remote content.
What a lot of administrators may not immediately realize is that the move to TS RemoteApps enables more than merely presenting applications on a user's screen. With a little sleight of hand, you can use RemoteApps to automatically launch preconfigured content as well.
For example, suppose that instead of deploying an application to users, you want to deploy a specific document. Rather than creating a RemoteApp that links users to an empty Microsoft Office Word or Access application, for example, you want to connect them to a specific Word document or Access database. In such cases, you can do so by entering the name of that document as an argument after the application's primary EXE. Thus, if you want to create a connection to your Access 2007-based PTO (paid time off) database stored at \\fileServer\fileShare\CompanyPTO.accdb, simply create a new RemoteApp called "PTO Database" and enter the document's location as a command-line argument. Now, when a user double-clicks to launch the PTO Database application, they'll automatically be directed to Access with the correct database already preloaded.
As you can see, creating connections to remote content is another way to expand the usefulness of RemoteApps. Yet with all RemoteApps, your users must still be presented with links to the icons to get started. In the next sections, I'll discuss a few ways in which terminal services in Windows Server 2008 makes this happen.

Launching Apps from the Web
The new TS Web Access role service allows the hosting of application shortcuts on a preconfigured Web page. This role service integrates with terminal servers in the environment to provide a single location where users can go to find and launch their applications. Figure 2 shows how this Web page looks to users.
Figure 2 The TS Web Access Web page enumerates deployed RemoteApps
To create such a page, install the TS Web Access role to an existing IIS server, then add the computer account for the TS Web Access server to the TS Web Access Computers Global Group in the domain. Note that for small environments, you can install TS Web Access to an existing terminal server for a single-server solution.
Once you've installed a RemoteApp, enabling it for TS Web Access is done by right-clicking the configured RemoteApp in the TS RemoteApp Manager and selecting Show in TS Web Access. Users with version 6.1 or later of the Remote Desktop Client can then navigate to http://serverName/ts to view a list of application shortcuts. Clicking any of the presented shortcuts automatically launches the RemoteApp.
TS Web Access is an easy way to present a friendly interface for finding and launching applications. It is particularly useful when applications or versions change regularly; updating the Web site involves simply hiding the link to the old application or version in TS Web Access and then showing the new link once it has been installed.
This tool does have some limitations, however. First, there is no built-in mechanism to limit the applications a user can access. Any RemoteApp that has been created on the terminal server and made visible in TS Web Access will be seen by every authenticated user.
The second problem has to do with the way in which users commonly work with their applications. When you want to start an application such as Word, how often do you actually click on the shortcut to the application? Not very often, I'll bet. It's more likely that you double-click an existing Word document to start the application with the document preloaded.
Unfortunately, TS Web Access does not support this method of launching applications. For those who are used to double-clicking documents to launch the linked application, TS Web Access may not be an acceptable solution. Never fear, though, as another much more useful option for this situation is discussed next.

Launching Apps from the Desktop
For users who want to double-click documents to launch the application, terminal services now provides the ability to "install" the remote application's link to the desktop. This process effectively wraps the RemoteApp's RDP file into a Windows Installer package—an MSI file—that is later installed to desktops in the environment.
At the same time, the installed MSI can modify the file extension associations on the desktop to reroute a double-clicked file to its associated RemoteApp on the terminal server. Figure 3 shows how the file extension associations have been modified on a client system after a Word RemoteApp is installed. Now, double-clicking any of the common Word file extensions will launch Word via the Remote Desktop Connection.
Figure 3 File extension associations that have been altered to launch the Remote Desktop Connection
To create a Windows Installer package out of an existing RemoteApp, first navigate to the TS RemoteApp Manager. Right-click the RemoteApp of interest and select Create Windows Installer Package. By default, all created Windows Installer packages are stored in the location C:\Program Files\Packaged Programs, but this location can be changed from within the RemoteApp Wizard. Also configurable within the wizard are the name and port for the server that will host the RemoteApp, as well as server authentication, certificate settings, and TS Gateway settings.
Settings that relate to the application's location after installation to a candidate desktop are shown in Figure 4. As you can see, it is possible to create a shortcut on the desktop as well as to a location within the Start menu folder. The most important checkbox on this screen is at the very bottom. It's the checkbox for Take over client settings, and it re-associates any file extension associations for the RemoteApp from the local desktop to the terminal server. This checkbox must be selected if you want users to be able to double-click documents to launch their TS-hosted application. Click Next and Finish to complete the wizard.
Figure 4 Creating a Windows Installer package enables the association of client file extensions
As is obvious, the upside of using desktop installation for connecting users to applications is that it doesn't require a change in users' behavior. Once the applications are installed, users can double-click documents to launch applications as they've always done.
However, this approach comes with its own downside in the form of extra desktop administration. Each RemoteApp used in this way must be installed to each desktop that requires access. This process is made easier through Group Policy Software Installation—which will be discussed next—but it's still an added management headache. Also, when applications change, it is likely that the installed RemoteApps at each desktop will need to be updated as well.
Once you've created a Windows Installer package, the process to install it via Group Policy Software Installation is not difficult to set up. First, create a file share that can be accessed by Group Policy. A good place for this file share in a single terminal server scenario might be the default C:\Program Files\Packaged Programs folder on your terminal server. Ensure that rights have been appropriately assigned to the folder and the share so that clients will be able to access the share during Group Policy processing. Then, create a new Group Policy Object (GPO) and navigate to Computer Configuration | Policies  | Software Settings | Software installation. Right-click Software installation and choose New | Package. In the resulting dialog box, locate the MSI file created for the RemoteApp. When asked for the deployment method, choose Advanced.
At this point you have a choice. Because RemoteApps are extremely small installations that install little more than RDP files and icons to the C:\Program Files\RemotePackages folder, you may want to select the option to Uninstall this application when it falls out of scope of management. By selecting this option, any time the GPO is deleted or if the computer is moved to a new OU where the GPO no longer applies, the RemoteApp will be automatically removed from the computer. Enabling this option makes the process of removing a RemoteApp very simple as computers and applications move in and out of your scope of management.

The User Experience
Deploying applications through any of these mechanisms is great, but there's more to terminal services administration than creating and deploying applications. Ensuring that your implementation is meeting the needs of your users is equally important. With any discussion of application delivery, it is essential to consider a subjective performance metric to capture the quality of the user experience. While difficult to quantify using hard metrics, effective terminal services deployments must look at the aggregate satisfaction of the users as a measure for defining success.
To explain, users can be a particularly troublesome lot, especially when they're sharing resources on the same server. With terminal services, multiple users gather on a single server to share applications installed on that server. The aggregation of large numbers of users onto small numbers of servers eases the management of applications by reducing the count of applications. Fewer applications to manage means less patching, a more controlled environment, and fewer administrative touch points.
This consolidation of users requires the terminal server administrator to play the role of system babysitter. The successful administrator manages the terminal server farm by watching user behaviors on the system and proactively enacting change. Changes arrive as reconfigurations and lockdowns to ensure that one user's bad behavior doesn't impact the experience of other users.
As an example, effective terminal server administrators will configure performance alerts to notify them when processor utilization has spiked to and remains at a very high level. Such behavior often indicates that a process has spiked a processor or that a user has initiated an action that uses too many resources on the shared system. Tracing down and killing the offending process is only the first step in resolving the incident. Finding out why that process behaved in the way it did is the long-term solution to the problem.
In such situations, the idea is to ensure that a remote application performs at least as well as would be expected on the local desktop. The sidebar, "Key Terminal Services Performance Counters," illuminates some PerfMon metrics that will get you on the right track.

RemoteApps = Predictable Performance
A RemoteApp is effectively a terminal services session where the width and height of the session is exactly the same as that of the application being launched. The result is that the remote application appears local because the boundary of the session never expands beyond the boundary of the app itself.
The Microsoft implementation of RemoteApps is actually quite a bit smarter than the previous explanation might suggest to you. A deployed RemoteApp is not the same as a deployed full desktop from the perspective of the resources needed to get it up and operational. To launch a remote desktop requires the instantiation of explorer.exe to operate the desktop shell, plus all the processes configured to start with explorer.exe, such as system tray applications, helper applications, or any services or processes that accompany a standard desktop.
In contrast, the launching of a RemoteApp does not require the full explorer.exe shell or all the add-ons. In fact, RemoteApps replace explorer.exe with two other processes named rdpshell.exe and rdpinit.exe. It is these two slimmed-down processes that operate as the alternative shell and shell logon application used to bootstrap a RemoteApp into existence.
Figure 5 shows a simplistic example of a terminal server where two users have connected and launched the calculator application. User1 has logged in via a full desktop, while User2 has connected to a pre-created RemoteApp instance of calc.exe. Although you'll note that User2 has a larger count of running processes required to launch the calc RemoteApp, the sum total of memory use of those processes is less than what is required for User1's explorer shell, as you can see in Figure 6.
Figure 5 Task Manager shows the differences in resource use between desktops and RemoteApps

Figure 6 Examples of memory use
Running Processes | User1–Full Desktop | User2–RemoteApp
Explorer.exe | 7064KB | n/a
Tasking.exe | 1792KB | 1704KB
Dwm.exe | 588KB | 516KB
Rdpclip.exe | 1032KB | 908KB
Calc.exe | 648KB | 716KB
Rdpinit.exe | n/a | 860KB
Rdpshell.exe | n/a | 828KB
Total | 11124K | 5532KB

This reduced RAM consumption is only one part of the performance discussion. The impact of user behavior on processor use must also be considered. When a user is deployed with a full desktop, he is in effect being given the ability to run any application that is installed to the terminal server.
Without proper lockdowns in place, a lightweight user who leverages terminal services for writing documents in Word can, at any point, become a heavyweight user by launching another more powerful application with higher resource needs. This behavioral unpredictability makes the planning of resources per user challenging. It also complicates administration of the terminal server, increasing the possibility that one user's behavior will impact the experience of other users.
There is perhaps no better example of this unpredictability than with Internet Explorer. Installed to every instance of Windows Server, this application typically does not require many resources to run. Yet when Internet Explorer is used to render a poorly written Web site that requires numerous plug-ins, its resource use can increase dramatically. A user who inappropriately and unexpectedly runs Internet Explorer while in a desktop session can accidentally over-consume available resources on the terminal server, causing the performance of others to slow.
In contrast to full desktops, the structure of RemoteApps tends to grant them more predictability in resource use. A user who launches a RemoteApp can work only with that specific application and others spawned by the initial application. Thus, the user's behavior tends to be more predictable from a performance standpoint.

You Have Options
Ultimately, the goal of this article is to let you know about the options you have for deploying remote applications to your users. The new features available with terminal services in Windows Server 2008 provide multiple paths for users to connect to applications. Some combination of desktop-hosted and Web-hosted plus full desktop versus RemoteApp will be the correct configuration for your individual environment.
Key Terminal Services Performance Counters

While measuring the experience of the user is often a subjective activity that involves personal interviews more than metrics, there are some useful performance counters whose measurement can help you determine terminal server performance—which impacts user satisfaction. You should consider measuring the following counters on your terminal servers:
Memory\Available MBytes When this counter shrinks to a very low number, it means that processes on the terminal server are consuming much of the available physical memory. Low numbers here aren't necessarily bad, but when combined with a high thread count and high pages/sec, low numbers can mean too many users attempting to do too many things on one terminal server.
Memory\Pages/Sec This counter relates to the rate in which memory is being read from or written to disk. A high count here in combination with a low count for Available MBytes can mean that available memory is not sufficient for the load being placed on the server and can therefore result in a poor user experience.
Processor\% Processor Time This counter effectively shows how much the processor is being used by productive work. You should watch this metric closely, especially in multiprocessor systems, as it can indicate a hung or spiking processor.
System\Threads Each process being run by the server is made up of a number of threads. The Threads counter is an integer that is the sum total across all processes on the system. Terminal servers tend to have high thread and process counts due to the number of people simultaneously using system resources. When this count grows high, it is reasonable to assume that a large number of activities are being attempted simultaneously on the server. A high thread count often results in a high count for Context Switches as the server attempts to handle the needs of each process.
System\Context Switches/Sec A Context Switch occurs each time the processor changes the thread it is currently processing. There is a slight overhead associated with each context switch, so a high count here—as with a high thread count—can mean that many users are attempting to do many things at once.
System\Processor Queue Length When the processor cannot keep up with the load, the requests begin to line up. The counter for that line is called the Processor Queue Length. When this counter grows high, you can assume that the server's processors are being overloaded with requests—which can also indicate an impact on the user's experience.
Terminal Services\Active Sessions and Terminal Services\Total Sessions These two metrics can help to effectively assess resource use against the number of users working on your terminal server. The first counter measures users who are actively working with the session, while the second counter includes users who are idle or have disconnected. These two counters, in combination with the others, are useful in helping you identify the maximum number of users your server can handle before it becomes overloaded and the user experience diminishes as a result.
The actual numbers you see will depend on your hardware composition, installed applications, and count and type of users on the system. Providing exact numbers as thresholds can therefore be misleading. Instead, you should look for variations in your own numbers or times when your metrics are far from their normal operations as an initial guide to determine when the user experience may not be good.

Greg Shields, MVP, is a co-founder and IT guru with Concentrated Technology. His latest book, Windows Server 2008: What's New/What's Changed, is available through SAPIEN Press. Get to know Greg at www.ConcentratedTech.com.


table.seven { table-layout:fixed;width: 500px; } tr.heading td { padding : 10px; background-color:white; color: black; vertical-align:top; } tr.fig td { background-color:black; color: white; padding: 10px; font-weight:bold; vertical-align:top; } tr.dark td { background-color: #b9d1dc; color: black; padding: 10px; vertical-align:top; } tr.lite td { background-color: #dde8ee; color: black; padding: 10px; vertical-align:top; } .SidebarContainerA { width: 40%; height: 480px; float: right; border: 2px solid #008080; padding: 10px 20px 0px 20px; background-color: #e1e8f5; margin: 20px 0px 20px 10px; } .floatleft3 { float: left; margin: 15px 15px 15px 0px; width:400px; font-weight: normal; font-size: 14px; color: #323e58; font-family: "Segoe UI", Arial; }
SQL Server 2008
Advanced Troubleshooting with Extended Events
Paul S. Randal
At a Glance:
  • Why troubleshooting is necessary
  • Troubleshooting tools in SQL Server
  • Overview and architecture of Extended Events
  • Using Extended Events

Contents
Troubleshooting in SQL Server 2005
Extended Events
Performance Considerations
Life of an Event
Using Extended Events
The system_health Extended Events Session
Wrapping Up
SQL Server DBAs the world over have a problem that never seems to go away: troubleshooting, with the vast majority of troubleshooting being done to find a performance problem of some kind. Even the most carefully architected and tested application system will experience changes over time that can lead to significant performance issues.
For example, the workload can change (such as the number of concurrent users, the queries being performed, and new month-end reports being run), the volume of data being processed may increase, the hardware on which the system is running may change (such as the number of processor cores, amount of server memory available, and I/O subsystem capacity), and new concurrent workloads might be introduced (such as transactional replication, database mirroring, and change data capture).
Video
Paul Randal demonstrates how you can use the new Extended Events functionality in SQL Server 2008 for monitoring and troubleshooting.

But those aren't the only problems that occur. When designing and testing application systems, unanticipated problems are often found with the design, which then also require troubleshooting. Obviously, regardless of when in the app lifecycle the problem is discovered, troubleshooting must be performed to identify the cause and a solution.
A complex application system will have many hardware and software components that may need to be analyzed, but the one I am concerned with is SQL Server. Without considering the various performance troubleshooting methodologies (which would be a conversation well beyond the scope of this article), what are the tools you need for troubleshooting in SQL Server?

Troubleshooting in SQL Server 2005
Over the last few releases of SQL Server, the selection of tools available for performance troubleshooting has expanded considerably. SQL Server has always had numerous DBCCs (Database Console Command) commands available to provide insight into what's going on in the various parts of the database engine. In addition, there is SQL Server Profiler and programmatically using the underlying SQL Trace mechanism.
Although SQL Server has continually offered advancements for troubleshooting, these options have some problems. Post-processing of DBCC output is awkward, as you need to dump the results into a temporary table before you can do anything with them. And running SQL Trace/Profiler can cause a performance degradation when poorly configured (such as tracing all Lock: Acquired and Lock: Released events on a busy system and forgetting to filter on the event's DatabaseId and ObjectId columns). The screenshot in Figure 1 shows a dialog being used to configure a filter for a new trace.
Figure 1 Configuring a filter in SQL Server 2008 Profiler
SQL Server 2005 added dynamic management views and functions (collectively known as DMVs) as a way of getting information out of the database engine. DMVs superseded some DBCC commands, system tables, and stored procedures, and exposed many new areas of the workings of the engine. These DMVs are powerful commands that are composable—they can be used in complex T-SQL statements that filter and post-process the DMV results.
For example, the code shown in Figure 2 returns just the fragmentation and page density (both rounded) of the leaf levels of all indexes in a database, with a filter on the fragmentation level. This could not be done easily using my old DBCC SHOWCONTIG command. (For more information on DMVs, see "Dynamic Management Views and Functions (Transact-SQL)." In addition, SQL Server 2005 added a number of other features that could be used for troubleshooting, including DDL (data definition language) triggers and event notifications.
Figure 2 Using DMVs for powerful results
SELECT
  OBJECT_NAME (ips.[object_id]) AS 'Object Name',
  si.name AS 'Index Name',
  ROUND (ips.avg_fragmentation_in_percent, 2) AS 'Fragmentation',
  ips.page_count AS 'Pages',
  ROUND (ips.avg_page_space_used_in_percent, 2) AS 'Page Density'
FROM sys.dm_db_index_physical_stats (
  DB_ID ('SQLskillsDB'), NULL, NULL, NULL, 'DETAILED') ips
CROSS APPLY sys.indexes si
WHERE
  si.object_id = ips.object_id
  AND si.index_id = ips.index_id
  AND ips.index_level = 0 -- only the leaf level
  AND ips.avg_fragmentation_in_percent > 10; -- filter on fragmentation
GO
Various teams within Microsoft have also provided useful performance troubleshooting tools, such as the SQLdiag utility, the RML Utilities for SQL Server, the SQL Server 2005 Performance Dashboard Reports, and DMVStats. There is also an Event Tracing for Windows (ETW) provider for SQL Server 2005, which allows SQL Trace events to be integrated with events from other portions of Windows.
While SQL Server 2005 made great strides to increase the ability of DBAs to troubleshoot the database engine, there were still many scenarios that were almost impossible for DBAs to troubleshoot effectively. In one commonly cited example, some queries use excessive amounts of CPU resources, but the DMVs don't provide enough information to pinpoint which ad hoc queries are the culprits. But unlike SQL Server 2005, SQL Server 2008 is able to address such limitations with a new feature called SQL Server Extended Events.

Extended Events
The capabilities of the Extended Events system are far beyond those of any previous event-tracking and troubleshooting mechanism that SQL Server has provided. In my opinion, the highlights of the Extended Events system are the following:
  • Events fire synchronously but can be processed synchronously or asynchronously.
  • Any target can consume any event and any action can be paired with any event, allowing for an in-depth monitoring system.
  • "Smart" predicates enable you to build complex rules using Boolean logic.
  • You can have complete control over Extended Events sessions using Transact-SQL.
  • You can monitor performance-critical code without impacting performance.
Before I go on, I'll take a moment to define some of the new terminology.
Event An event is a defined point in code. Some examples are the point at which a T-SQL statement finished executing or the point at which acquiring a lock is completed. Each event has a defined payload (the set of columns that are returned by the event) and is defined using the ETW model (where every event returns a channel and keyword as part of the payload) to allow integration with ETW. SQL Server 2008 initially shipped with 254 defined events and more are expected to be added over time.
You can see the list of defined events using the following code:
SELECT xp.[name], xo.*
FROM sys.dm_xe_objects xo, sys.dm_xe_packages xp
WHERE xp.[guid] = xo.[package_guid]
  AND xo.[object_type] = 'event'
ORDER BY xp.[name];
And you can find the payload for a specific event using this code:
SELECT * FROM sys.dm_xe_object_columns
  WHERE [object_name] = 'sql_statement_completed';
GO
Note that the Extended Events system has a comprehensive set of informational DMVs that describe all of the events, targets, and so on. For more details, see "SQL Server Extended Events Dynamic Management Views."
Predicates Predicates are the method used to filter events using a set of logical rules before the events are consumed. Predicates can be simple, such as checking that one of the columns returned in the event payload is a certain value (for example, filtering lock-acquired events by object ID).
They also provide some advanced capabilities, such as counting the number of times a specific event has occurred during the session and only allowing the event to be consumed after an occurrence or dynamically updating the predicate itself to suppress the consumption of events containing similar data.
Predicates can be written using Boolean logic so that they short-circuit as soon as possible. This allows for the minimum amount of synchronous processing to be performed before determining whether the event is going to be consumed or not.
Action An action is a set of commands that are performed synchronously before an event is consumed. Any action can be linked to any event. They typically gather more data to append to the event payload (such as a T-SQL stack or a query execution plan) or perform some calculation that is appended to the event payload.
As actions can be expensive, the actions for an event are only performed after any predicate has been evaluated—there would be no point to synchronously performing an action if it were then determined that the event would not be consumed. A list of predefined actions can be found using the following code:
SELECT xp.[name], xo.*
FROM sys.dm_xe_objects xo, sys.dm_xe_packages xp
WHERE xp.[guid] = xo.[package_guid]
  AND xo.[object_type] = 'action'
ORDER BY xp.[name];
Target A target simply provides a way to consume events, and any target can consume any event (or at least dispose of it if there is nothing for the target to do—such as an audit target getting a non-audit event). Targets can consume events synchronously (for instance, the code that fired the event waits for the event to be consumed) or asynchronously.
Targets range from simple consumers, such as event files and ring buffers, to more complicated consumers that have the ability to perform event pairing. You can find the list of available targets using the following code:
SELECT xp.[name], xo.*
FROM sys.dm_xe_objects xo, sys.dm_xe_packages xp
WHERE xp.[guid] = xo.[package_guid]
  AND xo.[object_type] = 'target'
ORDER BY xp.[name];
For more details on targets, see "SQL Server Extended Events Targets."
Package A package is a container that defines Extended Events objects (such as events, actions, and targets). A package is contained within the module (such as an executable or a DLL) it describes, as shown in Figure 3.
Figure 3 The relationship between modules, packages, and Extended Events objects
When a package is registered with the Extended Events engine, all the objects defined by it are then available for use. For more information on packages and a complete list of Extended Events terminology, see "SQL Server Extended Events Packages."
Session A session is a way of linking together Extended Events objects for processing—an event with an action to be consumed by a target. A session can link objects from any registered packages, and any number of sessions can use the same event, action, and so on. You can see which Extended Events sessions are defined using the following code:
SELECT * FROM sys.dm_xe_sessions;
Go
Sessions are created, dropped, altered, stopped, and started using T-SQL commands. As you can imagine, this offers a lot of flexibility, even the ability to dynamically alter a session based on programmatic analysis of data being captured by the session itself. For more on sessions, see "SQL Server Extended Events Sessions."

Performance Considerations
When you put together an Extended Events session using CREATE EVENT SESSION, there are some settings you need to be careful to configure correctly, as they can inadvertently affect performance. Your first decision is whether to have the events consumed synchronously or asynchronously. And as you might expect, synchronous targets have greater effect on the performance of the code being monitored than do asynchronous targets.
As I explained above, when an event is consumed synchronously, the code that fired the event has to wait until the event has been consumed. Obviously, if consumption of the event is a complicated process, this can slow down the code.
For instance, on a busy system servicing thousands of small transactions per second, synchronous consumption of a sql_statement_completed event with an action to capture a query plan will very likely have a negative impact on performance. Also, remember that predicates are always executed synchronously, so care should be taken not to create overly complex predicates for events fired by performance-critical code.
On the other hand, you may be forced to consume events synchronously. To count the occurrences of a particular event, the easiest way to do this will likely be to use the synchronous_event_counter target.
The second thing you must consider is how to configure event buffering if you decide to use asynchronous targets. The default amount of memory available for event buffering is 4MB. The default dispatch latency between an event being fired and subsequently consumed by a target is 30 seconds. If, say, you want to produce some event statistics every 10 seconds, then you'll need to tweak the latency.
Tied to the event buffering settings is how you want to partition the memory used to buffer events. The default is to create a set of buffers for the entire instance. On SMP (symmetric multiprocessor) and NUMA (Non-uniform Memory Access) machines, this can lead to performance problems with processors having to wait for access to memory.
The third consideration is how you want to handle event loss. When you define the Extended Events session, you can specify whether events can be "lost." This means that if there isn't enough memory to buffer an event, it is simply discarded. The default is to allow single events to be dropped, but you can also allow whole buffers of events to be lost (for sessions where event buffers fill up very quickly) or even specify that no events can be lost.
This last option should be used with great caution, as it forces the code that fired the event to wait until there is buffer memory to store the event. Setting this option almost always has a detrimental effect on performance. Note that if you accidentally set this option to on, the server should remain responsive enough to allow you to turn the setting off.
Typically, you will want to consider these settings together. And there isn't really a generalized best practice I can give except to make sure you do put thought into them or you may run into performance problems. You can find more information about these settings in "CREATE EVENT SESSION (T-SQL)".

Life of an Event
Once the Extended Events session has been defined and started, processing continues as normal until the code being monitored comes across an event. The steps followed by the Extended Events system are outlined in Figure 4. The steps are as follows:
  1. A check is done to see whether any Extended Events sessions are monitoring the event. If not, control is returned to the code that contains the event, and processing continues.
  2. The event payload is determined, and all required information is gathered into memory—in other words, the event payload is constructed.
  3. If any predicates are defined for the event, they are executed. At this point, the result of the predicate may be that the event should not be consumed. If this is the case, control is returned to the code that contains the event, and processing continues.
  4. Now the system knows that the event will be consumed, so it executes any actions linked to the event. The event now has a complete payload and is ready for consumption.
  5. The event is served to synchronous targets, if any.
  6. If any asynchronous targets exist, the event is buffered for later processing.
  7. Control is returned to the code that contains the event, and processing continues.
Figure 4 Life of an Extended Events event
As I mentioned previously, care should be taken when creating an event session so that synchronous actions or buffering for asynchronous targets will not affect the performance of the code being monitored.

Using Extended Events
SQL Server 2008 Books Online includes two examples of using Extended Events: "How to: Determine Which Queries Are Holding Locks" and "How to: Find the Objects That Have the Most Locks Taken on Them."
I'd like to walk through an example of setting up an Extended Events session and analyzing the results. As I learned when I started using Extended Events in late 2007, putting together a simple session is very easy (using the straightforward T-SQL DDL statements), but analyzing the results is non-trivial.
The results are presented in XML, which initially surprised me before I realized that the huge number of possible combinations of events and actions that could be collected in a single session really meant there was no other feasible choice for storing such an extensible schema.
Now, I was a developer on the SQL Server Storage Engine team for many years and consider myself a highly proficient C, C++, and assembly programmer, but I had to spend a few hours figuring out the code necessary to extract event payload fields programmatically from the XML data. I'm not trying to dissuade you from using Extended Events; rather, I'm just warning you that if you're not used to working with XML data, be prepared for a bit of a learning curve before you see results.
Here's my scenario: I'm a DBA using the Resource Governor feature of SQL Server 2008 to sandbox various groups in my company on one of the production servers. I've created two Resource Governor resource pools—Development and Marketing—to represent each team using that server. Resource Governor allows me to limit each pool's CPU and query execution memory usage, but not the amount of I/O resources they use. So, I'd like to institute a chargeback mechanism that helps me amortize the cost of upgrading to a new SAN (storage area network) by billing each team for I/O usage on that server.
I assume that the easiest way to trigger capturing I/O information is when any T-SQL statement completes, and I know there's an event called sql_statement_completed in the package0 package. So what data is collected in the event payload?
Executing the following code will give me the list of all the data, including both reads and writes:
SELECT [name] FROM sys.dm_xe_object_columns
  WHERE [object_name] = 'sql_statement_completed';
GO
I don't think that these are physical reads and writes (when data is read from or written to disk, rather than just in memory in the buffer pool), but they'll give me an idea of the proportion of I/O resources being used by each team.
Now I need to figure out which team executed a particular T-SQL statement, and so I need an action that will tell me that. Executing this code gives me a list of all the actions I can take when the event fires, including one that collects the session_resource_pool_id in the sqlserver package:
SELECT xp.[name], xo.*
FROM sys.dm_xe_objects xo, sys.dm_xe_packages xp
WHERE xp.[guid] = xo.[package_guid]
   AND xo.[object_type] = 'action'
ORDER BY xp.[name];
I can get the list of resource pools I've defined for the Resource Governor and correlate that with the IDs collected by my Extended Events session. Now I'm ready to define my session. Note that when I execute this code, it will first check to see whether an event session with the same name exists. If it finds one with the same name, it will drop the session. Here's the code:
IF EXISTS (
SELECT * FROM sys.server_event_sessions
    WHERE name = 'MonitorIO')
DROP EVENT SESSION MonitorIO ON SERVER;
GO

CREATE EVENT SESSION MonitorIO ON SERVER
ADD EVENT sqlserver.sql_statement_completed
  (ACTION (sqlserver.session_resource_pool_id))
ADD TARGET package0.ring_buffer;
GO
Then it creates a new session with a single event, sql_statement_completed, that also performs the session_resource_pool_id action, logging everything to a ring buffer while I'm still prototyping. (In production, I would most likely choose to use an asynchronous file target.)
To start my session, I will need to execute this code:
ALTER EVENT SESSION MonitorIO ON SERVER
STATE = START;
GO
Now it's up and running.
After faking some activity from the marketing and development teams, I'm ready to analyze the session results. This code will extract the data from the ring buffer:
SELECT CAST(xest.target_data AS XML) StatementData
  FROM sys.dm_xe_session_targets xest
JOIN sys.dm_xe_sessions xes ON
  xes.address = xest.event_session_address
WHERE xest.target_name = 'ring_buffer'
  AND xes.name = 'MonitorIO';
GO
However, it extracts the data as one large XML value. If I want to break it down further, I can use the code shown in Figure 5.
Figure 5 Breaking down the XML data
SELECT
  Data2.Results.value ('(data/.)[6]', 'bigint') AS Reads,
  Data2.Results.value ('(data/.)[7]', 'bigint') AS Writes,
  Data2.Results.value ('(action/.)[1]', 'int') AS ResourcePoolID
FROM
(SELECT CAST(xest.target_data AS XML) StatementData
  FROM sys.dm_xe_session_targets xest
  JOIN sys.dm_xe_sessions xes ON
    xes.address = xest.event_session_address
  WHERE xest.target_name = 'ring_buffer'
    AND xes.name = 'MonitorIO') Statements
CROSS APPLY StatementData.nodes ('//RingBufferTarget/event') AS Data2 (Results);
GO
This works but gives one line of output for each event that's captured. That's not a terrific format plus I'd like to get aggregated output, so I decided to use a derived table, as you can see in Figure 6.
Figure 6 Getting aggregated output
SELECT DT.ResourcePoolID,
  SUM (DT.Reads) as TotalReads,
  SUM (DT.Writes) AS TotalWrites
FROM
(SELECT
  Data2.Results.value ('(data/.)[6]', 'bigint') AS Reads,
  Data2.Results.value ('(data/.)[7]', 'bigint') AS Writes,
  Data2.Results.value ('(action/.)[1]', 'int') AS ResourcePoolID
FROM
(SELECT CAST(xest.target_data AS XML) StatementData
  FROM sys.dm_xe_session_targets xest
  JOIN sys.dm_xe_sessions xes ON
    xes.address = xest.event_session_address
  WHERE xest.target_name = 'ring_buffer'
    AND xes.name = 'MonitorIO') Statements
CROSS APPLY StatementData.nodes ('//RingBufferTarget/event') AS Data2 (Results)) AS DT
WHERE DT.ResourcePoolID > 255 –- only show user-defined resource pools
GROUP BY DT.ResourcePoolID;
GO
Phew! There is certainly some complicated code in there, but it works well. So now I've got the results I desired. Look at the output from this query on my test data, shown in Figure 7.
Figure 7 Output from my query
ResourcePoolID | TotalReads | TotalWrites
256 | 3831 | 244
257 | 5708155 | 1818

I know that resource pool 256 is for marketing, and 257 is for development—so these numbers make sense in terms of how much database activity I'd expect from the teams in my company. I could not have produced these results as easily had I not used Extended Events.
And finally, I need to stop the session using the following code:
ALTER EVENT SESSION MonitorIO ON SERVER
STATE = STOP;
GO
To see more of what I'm talking about in terms of the output at each stage of this example, check out the screen cast that accompanies this article. You can find it at technetmagazine.com/video.

The system_health Extended Events Session
SQL Server 2008 actually ships with a pre-defined session that is set to run by default and is called the system_health session. This session was the idea of the Product Support team and it keeps track of information they commonly use to debug customer systems, such as when a deadlock or a high-severity error occurs. The session is created and started as part of the install process for a SQL Server 2008 instance, and it tracks events in a ring buffer so that it does not consume too much memory.
You can use the following code to see what the ring buffer contains:
SELECT CAST (xest.target_data AS XML)
FROM sys.dm_xe_session_targets xest
JOIN sys.dm_xe_sessions xes ON
xes.address = xest.event_session_address
WHERE xes.name = 'system_health';
GO
The Microsoft PSS SQL Support blog has more detailed information on what's tracked by this session.

Wrapping Up
I've been told that the SQL Server team is planning to add many more events into sqlserver.exe in the future. In fact, the number jumped from 165 in the February 2007 CTP (Community Technology Preview) release to 254 in the RTM (release to manufacturing) release.
There are some really interesting-looking events to investigate as well, such as for change data capture (which I covered in my article "Tracking Changes in Your Enterprise Database" in the November 2008 issue of TechNet Magazine), data compression, and index page splits. Index page splits looks like a promising way to work out which indexes are building up performance-sapping fragmentation without the need to periodically run the sys.dm_db_index_physical_stats DMV over all indexes.
Overall, the new Extended Events system allows some pretty sophisticated monitoring that's never been possible before. Although it requires a bit of learning to figure out the XML parsing you'll need to do to get at the data, the benefits of the new system far outweigh the hassle of having to learn some new coding constructs.
I hope this article has given you enough of an overview of Extended Events to get you interested and show you the kinds of things you can do with it. Happy troubleshooting! As always, if you have any feedback or questions, feel free to drop me a line Paul@SQLskills.com.

Paul S. Randal is the Managing Director of SQLskills.com and a SQL Server MVP. He worked on the SQL Server Storage Engine team at Microsoft from 1999 to 2007. Paul wrote DBCC CHECKDB/repair for SQL Server 2005 and was responsible for the Core Storage Engine during SQL Server 2008 development. Paul is an expert on disaster recovery, high availability, and database maintenance, and is a regular presenter at conferences around the world. He blogs at SQLskills.com/blogs/paul.


.floatleft1 { float: left; margin: 15px 15px 15px 0px; width:325px; font-weight: normal; font-size: 14px; color: #323e58; clear: right; font-family: "Segoe UI", Arial; }
Microsoft Office
Getting Started with Project Server 2007
Alan Maddison
At a Glance:
  • Four general areas of enhancement
  • Multitier architecture aids scalability and flexibility
  • Prerequisites for installation
  • Installing and configuring

Contents
Features and Functionality
Installation Prerequisites
Project Server 2007 Installation
Last Words
As IT administrators, most of us will have used Microsoft Office Project (Standard or Professional) to help streamline and organize at least some of our many projects. However, not many of us have implemented Project Server, due to a lack of familiarity, expertise, or simply the time to tackle one more complex installation and configuration. With Office Project Server 2007, Microsoft has made significant enhancements not only to the features and functionality available for users but also to those that interest administrators.
In this article I'll take a look at some of the most significant new features and functionality in Project Server, and I'll also take a walk through the installation and configuration of Project Server 2007. I'll focus on a Web-farm implementation, as this approach provides for a great deal more flexibility in growing your Project Server infrastructure. Even if a standalone server is sufficient right now, a single-server Web farm adds little complexity to your infrastructure while making it easy to expand to meet the needs of your company in the future.
Though the Office Project Server family covers a number of products, this article will focus on Project Server. And while I won't be looking much at desktop clients, you should bear in mind that Project Standard (a desktop client) cannot connect to Project Server; only Project Professional is able to connect.

Features and Functionality
The enhancements Microsoft made to Project Server 2007 can be divided into four general areas: enterprise functionality, ease of use, insight, and extensibility. If you've worked with any of the earlier versions of Project Server, you will immediately recognize why Microsoft focused on these areas.
Although Project Server 2003 was a powerful application, its complexity made troubleshooting very painful and added substantial administrative overhead. Moreover, it was very difficult to customize and lacked flexibility in its reporting capabilities outside of its integration with SQL Server 2000 Analysis Services. Fortunately, the shortcomings have been addressed, ensuring an easier and more productive experience with Project Server for both users and administrators.
The scalability limitations in Project Server 2003 have been addressed with a true multitier architecture, as shown in Figure 1. The Web tier is made up of Project Web Access and Windows SharePoint Services (WSS) 3.0. The application tier consists of the Project Server platform, the Queuing Service, the Reporting Service, and the Eventing System, as well as the Project Server Interface (PSI)—a completely revamped API that exposes Project Server functionality to admins and developers. The data tier holds the Project Server databases stored in either SQL Server 2000 or SQL Server 2005. These tiers lend themselves to scaling to support large numbers of users.
Figure 1 Project Server 2007 architecture
As a function of this new architecture, Microsoft supports a number of deployment topologies, including Standalone, Small Farm, Medium Farm, Large Farm, and Extranet. Each topology allows for more granular segmentation of Project Server components as well as incorporating technologies such as load balancing for the Web front end and clustering for the SQL servers. Other enterprise-class enhancements include Active Cache, a client/server technology that optimizes network traffic and client responsiveness, and the Queuing Service, which ensures data integrity and fault tolerance while enhancing reliability and fostering a consistent user experience.
There have also been some significant improvements in making Project Server easier to learn and easier to use. What this means in practical terms for administrators is that once you have the product installed and configured, you can let your users loose and expect them to be productive.
One thing that helps make Project Server so much easier is its deep integration with Microsoft Office, including a plug-in for Microsoft Office Outlook that provides task and time management, and Visual Reports, which integrate with Office Excel reporting capabilities and Office Visio diagramming capabilities. There is simplified task scheduling and project creation with support for SharePoint task lists, which allows users to rapidly adapt ad hoc projects into a more robust framework as the project grows.
The Microsoft Project Task List Import template allows you to create a simple task list in Excel, import it into Project Server, and then add resources and assignments. In addition, an extensive list of predefined project templates provides for rapid setup of project outlines for many different project types. An enhanced Project Guide helps new users maximize their productivity within Project Server while allowing more experienced users to turn off this feature. Simplified resource planning is achieved with the resource substitution wizard and a multi-level undo feature that gives experienced Project Managers tremendous power and flexibility in adjusting schedules and understanding the impact without consuming a large amount of time. This is particularly true with the Change Highlighting feature, which highlights all changes resulting from the most recent edit that involved scheduling.
Furthermore, Project Server now provides greater visibility into project financial management and planning. There's a new resource type, the cost resource, which allows integration with third-party accounting systems. In addition, Project Server introduces a number of new predefined accounting fields. For example, the budget field allows organizations to specify a budget as money, labor, or materials and then track variance as the project progresses. A new time sheet solution not only provides more accurate time tracking of project resources but is also designed to integrate with general ledger systems. A new Resource Planning feature helps provide a high-level view of resource allocation to facilitate preliminary planning when details aren't available or desired, at project inception for example.
Other improvements make Project Server much easier to customize and extend. The revamped API, the aforementioned PSI, makes it easy to access Project Server data using ADO.NET, and it also supports programmatic manipulation of projects, resources, tasks, and assignments. The API is further enhanced through an extensive server-side event system that allows third-party applications to respond to events within Project Server. Finally, integration with Windows Workflow Foundation (WF) provides built-in support for workflows.

Installation Prerequisites
This article focuses on installing Project Server 2007 on Windows Server 2003, but it will also offer some pointers on working with Windows Server 2008 when there are obvious differences in the steps required for installation and configuration. If you decide to use Windows Server 2008, you must use Project Server 2007 SP1, and you should also ensure that your server hardware meets Microsoft recommendations. In particular, it should have at least 2GB RAM and dual cores or dual CPUs with a clock speed of 3.0 GHz.
I'll focus on installing and configuring a small Web farm, which allows two deployment options: installation of all components (Web server, application server, and database server) on one computer, or hosting the database server on another physical computer. Since both options support up to 500 users, either is acceptable in smaller environments. And both provide flexibility as your company moves forward. As a general best practice, consider using at least a separate database server; in larger organizations, you will want separate hardware for each of the layers.
Before beginning the installation, your database server must be available. Since discussing a SQL Server installation is beyond the scope of this article, note simply that you should use either SQL Server 2000 SP4 or SQL Server 2005 SP2 and make sure that Named Pipes is enabled. In addition, the account with which you install WSS should have all of the rights required to create a new database in SQL Server.
You must install the Microsoft .NET Framework 3.0 SP1 (which ensures that you have WF). And you need to install IIS 6.0 by selecting the Application Server option available in the Add/Remove Windows Components section of the Add/Remove Programs Control Panel applet. You should enable ASP.NET, which is available if you click the Details button when selecting Application Server. Project Server will not install if the ASP.NET 2.0.50727 Web extension is not enabled within IIS. This can happen if ASP.NET 2.0 is installed on the computer before IIS is enabled. If this happens, enable ASP.NET 2.0 by running the command aspnet_regiis –i –enable.
In Windows Server 2008, you can do this by using Server Manager to install the Web Server (IIS) role and the Application Server role. As part of the Application Server role, which installs the .NET Framework 3.0, you need to make sure that the Application Server Foundation and Web Server (IIS) Support role services are selected for installation.

Project Server 2007 Installation
Start the installation of Project Server by running Setup.exe. If you have installed WSS, the installation of Project Server 2007 will be familiar, as it is based on WSS 3.0. After entering the product key and accepting the license agreement, choose either Basic or Advanced installation. If you are planning a standalone system, choose Basic, which installs all the components on one server, including SQL Server 2005 Express edition. If you select Advanced, you'll see the screen in Figure 2. If you select the Complete option, you will install the Web front end and application server components.
Figure 2 A standalone installation puts all components on a single machine
Keep in mind that if you configure the server as a Search server, you may require a large amount of local storage for indexes. As a result you may want to click on the File Location tab (also shown in Figure 2) and select a different install location. After selecting Complete, press the Install Now button.
After installation is complete, the option to "Run the SharePoint Products and Technologies Configuration Wizard" is selected by default. Click the Close button to launch the Configuration Wizard.
After the wizard launches and you click Next to get past the Welcome screen, you will be reminded that some services including IIS may need to be restarted. Click Yes to proceed to the next screen, which prompts you to either create a new server farm or connect to an existing one. Select the option to create a new farm, then enter the database server name.
You also need to enter the name of a domain user account that will be used by WSS in order to connect to the database, as shown in Figure 3. During setup, you will also assign SQL Server rights and provide credentials for the SharePoint Services Central Administration application pool within IIS. If you are deploying a standalone server, the user account can be local.
Figure 3 Creating a configuration database
After pressing Next, you will be asked to configure the Port number and choose the authentication method for use by the Central Administration Web application. By default, the wizard will assign a random port number which you can change by selecting the checkbox and entering a port number. The default authentication protocol is NTLM; the second option is Negotiate (Kerberos). If you select the second option, the authentication process will attempt to use Kerberos first and will fall back to NTLM if that fails. Unless you are familiar with the requirements for enabling Kerberos authentication, stick with NTLM.
After pressing Next, you will be presented with a summary screen. Press Next again to start the configuration process. When the provisioning process is complete, take note of the port number of the Central Administration site if you have not already done so. The Central Administration Web site will be launched in your browser once you press the Finish button, as shown in Figure 4.
Figure 4 The Central Administration Web site
You'll notice that the Central Administration Web site is preconfigured to guide you through the remaining steps. The first item in the list is a pointer to the SharePoint Services Quick Start Guide, which lists some of the remaining configuration steps including:
  • Configuring incoming and outgoing e-mail settings
  • Creating or extending Web applications
  • Creating sites and subsites
  • Configuring workflow settings
  • Configuring diagnostic logging
You should follow the instructions for configuring e-mail settings, but all other Project Server settings are covered in the subsequent tasks. The second task is a reminder to add all servers to the farm before configuring farm services. To add servers to the farm as well as check which servers are already added, click on the Operations tab and then click on the Servers in Farm link under Topology and Services, as shown in Figure 5.
Figure 5 Add all servers to the farm before you configure farm services
Continuing our example of a small server farm with Web and application services on one server and the database on another, you should see two servers already listed. The next task to complete involves starting the Project Server services. To configure the services, click on the Operations tab and then on the Services on Servers link under Topology and Services, as shown in Figure 5. Once you have selected this option, you will see the screen shown in Figure 6.
Figure 6 Setting up services on servers
You should notice that by default some services are not started; you will have to select the Start option in order to start them. The services listed here correspond to services listed under the Computer Management Microsoft Management Console (MMC). Note that if you start the WSS Search service, you will need to provide credentials for the Search Service account and the Content Service account.
The WSS Search Service forms the basis for searching Project Server Help. These accounts should be domain accounts for any type of server farm implementation and should not be members of the Farm Administrators group. All required rights will be assigned during configuration. The final configuration step on this page is to specify the Indexing Schedule. It's a good idea to leave the Schedule at the default until you are more comfortable with the day-to-day operational requirements of your Project Server environment. Larger environments can have dedicated Search servers.
The final step in configuring Project Server involves creating Web applications for two Web sites: the Project Web Access (PWA) site and the Shared Services Provider (SSP) home site. In addition, you need to create a site collection for the PWA Web application. The creation of the Shared Services home site is part of the final task in the list of Administrative tasks identified in the Central Administration Web site, as shown earlier in Figure 4.
The first step is to create the new Web application for the PWA site. From the Central Administration site, click on Application Management and then select Create or extend Web application in the SharePoint Web Application Management section. When the next page loads, select Create a new Web application, as shown in Figure 7.
Figure 7 Creating a new SharePoint Services Web application
Start by entering a description for the IIS Web site and selecting a port number. For the example here I'll use the default port 80, but if your Web server is hosting other sites, you will need to choose a different port, as this procedure conflicts with the Default Web Site in IIS. You also have the option of using Host Headers if you need some additional flexibility in configuring IIS.
The next item you'll see is the path to the virtual directory, which generally does not need to be modified.
In the next section you configure security. The first two selections cover the authentication protocol, which you should leave as NTLM, and whether to allow anonymous access. As a best practice, you should disable anonymous access. The next section allows you to configure the application pool used by the Web application. Enter a domain account in the credentials section, then leave the remaining options at the default selection. The final selection you'll need to make is to identify the Search server. In your two-server farm, this will be the local server.
After creating the application, you must create a Site Collection. To do this, select Create a new WSS site collection and then enter the required information including title, description, and URL name and path. When selecting a template for the site, any one will suffice, but the Team Site template is generally a good starting point. You're finished—and successful—when the Top Level Site Successfully Created page loads.
The next step is to create a Web application to host the Shared Services Provider. From the Central Administration site, click on Application Management and then select Create or extend Web application in the SharePoint Web Application Management section. When the next page loads, select Create a new Web application. Rather than using an existing Web site, you will be creating a new site with a new port number. The port number can be random or one you select. Follow the steps you took to create the Web application pool for PWA. You can also reuse the application pool credentials if you desire. When the process is complete, you'll see the Application Created page.
Next create the Shared Services Provider (see Figure 8). A Shared Services Provider is an integral part of a WSS 3.0 infrastructure that Project Server leverages for its application services. This also facilitates a common provider across servers in a farm.
Figure 8 Creating a Shared Services Provider
To create a Shared Services Provider start by clicking on the Application Management tab and then under the Office SharePoint Shared Services section select Create or configure this farm's shared services. On the subsequent page click on New SSP and work through the configuration options. Most important is to be sure to select the Web application you created for the Shared Services.
The only mandatory data is the information relating to which credentials to use for the SSP Service. All other options can be left at their defaults, although you should double-check every individual value. In the example, there should be two Web applications, which were created in the previous steps. Once the services have been created, you will see the Success page.
The final step is to create the Project Server instance. If you press OK on the Success page, you will be taken to the Manage this Farm's Shared Services page. Click on the name of the Shared Services you just created and you will be taken to the Shared Services Administration page. Now click on the Project Web Access Sites link and when the page loads, click on the button called Create Project Web Access Site, as shown in Figure 9.
Figure 9 Creating a Project Web Access Site
When the next page loads, you will have to confirm the configuration information, such as which Web application to use, the path to use for PWA, and the name of the account that is to be used for Administration. Select the Web application that you extended earlier in the process, not the Shared Services Web application.
In addition you will need to enter the name of your database server. Pressing OK will start the database and Web site creation process. You will be returned to the screen shown in Figure 9, but now there will be a Web site listed and its status will change as it is being created. When the process is complete, the status changes to Provisioned and you have completed your Project Server implementation, as shown in Figure 10.
Figure 10 An instance of Project Server 2007

Last Words
Project Server 2007 is clearly the most significant release of this product in a long time. Microsoft has invested a lot of time and energy into making Project Server 2007 a marked improvement over earlier versions and if you have not taken a look at it recently, then it is time you did.

Alan Maddison is a Senior Consultant, specializing in Microsoft technologies, with Strategic Business Systems, a division of Brocade.


.floatleft { float: left; margin: 0px 15px 15px 0px; width:100px; font-weight: normal; font-size: 14px; color: #323e58; font-family: "Segoe UI", Arial; } From the Editor A Few New Things
Joshua Hoffman

The new year is a time for change. That's got to be one of the oldest clichés in the book. But, given that I'm about to tell you all about the changes we have in store at the magazine, I guess the cliché actually applies in this case.
We begin with one change that all of us here are happy to announce. I'm sure you've noticed a new "regular" in our midst, Paul Randal. Over the past many months, he has been writing our always-popular SQL Q&A column and he has also brought us a number of fascinating articles about new features in SQL Server 2008. Paul comes to us with an impressive background as a senior member of the SQL Server team at Microsoft, and he is currently a prolific speaker, author, trainer, and blogger at sqlskills.com. Paul's content in TechNet Magazine has received high praise from our readers, and we're excited to cement his place as a regular presence in and contributing editor to TechNet Magazine.
We're also very pleased to welcome Greg Shields to the pages of TechNet Magazine. Many of you know Greg from his work at Redmond Magazine, Realtime Community, TechMentor events, or ConcentratedTech.com. Greg is a longtime expert in IT and an MVP in Terminal Services; he joins us this month to write about the seamless deployment of applications via Terminal Services. Greg will continue next month as the author of a brand new column called "Geek of All Trades." In this new column, Greg will explore powerful yet simple solutions for the IT pro who has to do it all (and I'm betting that includes you.)
There's still more! As we move into the new year, you'll see the long overdue return of our online Sustainable Computing column discussing all things Green and an online expansion of our Utility Spotlight column.
Turning to the present, this month's issue has plenty in store: along with the contributions from Paul and Greg, Aung Oo joins us with a terrific overview of the new version of Identity Lifecycle Manager. As the importance of maintaining data integrity grows, with it grows the importance of ensuring that identity information in your organization is in sync. I think you'll find it to be invaluable in sorting through issues of identity integrity. And who among us hasn't had to manage a project in the course of their career? Alan Maddison is back this month with great insight into making the process much easier with Project Server 2007. We hope you enjoy it all!
—Joshua Hoffman

Thanks to the following Microsoft technical experts: Alex Balcanquall, Brjann Brekkan, Christophe Fiessinger, Darrell Gorter, Mark Gray, Costin Hagiu, Jerome Halmans, Kelly Hengesteg, Jan Kalis, Mike Lagase, Klaas Langhout, Greg Marshall, Scott McArthur, Doug McCutcheon, Tim McMichael, Kevin Miller, Sanjeev Nair, Stuart Presley, Alym Rayani, and Jim Truher.


.ArticleTypeQuestion1 { font-family: Verdana, Arial; font-size: 12px; font-weight: bold; font-style: normal; font-variant: normal; text-transform: none; line-height: 1.3em; color: #444444; } .ArticleTypeQuestion2 { font-family: Verdana, Arial; font-size: 12px; font-weight: bold; font-style: normal; font-variant: normal; text-transform: none; line-height: 1.3em; color: #444444; text-indent: 1em; } .ArticleTypeAnswer1 { font-family: "Times New Roman", Times, serif; font-size: 15px; font-weight: normal; font-style: normal; font-variant: normal; text-transform: none; line-height: 1.2em; color: #333333; } .ArticleTypeAnswer2 { font-family: "Times New Roman", Times, serif; font-size: 15px; font-weight: normal; font-style: normal; font-variant: normal; text-transform: none; line-height: 1.2em; color: #333333; text-indent: 1em; } Letters Readers Speak Out

Admin Passwords
After reading your article "Understanding Shared Account Password Management" that is in the September 2008 issue, I was wondering if my company would need to manage passwords if we use two-factor authentication in our network and, if so, why?
—Alan M.

I have never come across a company that employs two-factor authentication for their built-in admin, service/process accounts, or firewall accounts, even when they have two-factor authentication configured. Simply put, they can't. Two-factor authentication does not work in a scenario where the user account can't manage its pin number and rotating key code.
Service accounts, for example, rarely if ever log on interactively, so they are never prompted for the pin number and key code. Furthermore, it's just not feasible to maintain an ID token for every built-in admin account in your network.
As a result of this, these accounts will always use passwords for authentication, and thus it is necessary that these passwords be managed. Some companies I have dealt with utilize two-factor authentication for their user base, but then they use a randomization tool to manage user passwords that would otherwise never be changed.
—Chris Stoneff, Product Manager, Lieberman Software

WIndows PE
I have enjoyed reading your articles on Windows PE, and I have a question. I want to know whether a Windows Vista driver will always install and work in Windows PE 2.0 (the version that comes with Windows Vista). Or is it the case that some drivers won't work just because it is Windows PE and not the full operating system?
—Karthika A.

A Windows Vista driver (or any Windows driver, actually) may not necessarily work in Windows PE, regardless of the version that you're using. The issue at hand here is whether that specific driver requires some operating system functionality in order to provide its own full functionality.
If the driver depends on a part of Windows that isn't there under Windows PE, the driver won't work. Or sometimes a driver will work, but not completely. For example, audio drivers can be installed under Windows PE, but because the audio stack isn't present in Windows PE, the functionality provided is generally limited to just installing the device itself and then determining if the device is working as well as possible.
—Wes Miller, Columnist, The Desktop Files

Missing Reference Document
I have recently been reviewing the August 2008 Inside SharePoint column titled "Troubleshooting Messaging Integration." However, I'm having some trouble locating a document referenced in the column.
In the SharePoint Messaging Integration.pdf in the companion download, there is a prerequisite of installing and configuring WSS 3.0, as outlined in the worksheets in the \TestLab folder. There is no TestLab folder available in the companion download.
—Mike D.

We are sorry for the miscommunication. The TestLab folder referenced in the August column is available in the download for the July 2008 SharePoint article "Integrating Office Applications."
That TestLab folder has information on how to set up the test environment. Because the author is using the same test environment, nothing has changed in terms of the documentation. If you download the July .exe file, you'll find what you need.
—Sharon Terdeman, Senior Editor, TechNet Magazine

Where Has Exchange Queue & A Gone?
What happened to the Exchange Queue & A column? I'm waist deep into a 22,000 user Groupwise-to-Exchange migration project, and that column always offered helpful information. I enjoyed reading it every month. Will it run again?
—Kirk L.

We're really glad to hear how much you enjoy the TechNet Magazine Exchange Queue & A column. Don't worry, it hasn't disappeared—the column now runs every other month, alternating with the SQL Q&A column. In case you missed any installments, you can find them on our Exchange Queue & A page.
—Sharon Terdeman

Got something to say? E-mail us at tnmag@microsoft.com, or visit our blog forum at blogs.technet.com/tnmag.


Toolbox New Products for IT Pros
Greg Steen

The opinions expressed in this column are solely those of the author and do not necessarily reflect the opinions of Microsoft. All prices were confirmed November 10, 2008, and are subject to change.

Simplify Source Control
TortoiseSVN
tortoisesvn.net
If you think source control is just for your developers, you're wrong. As a system administrator, a version-control solution can be an invaluable tool, giving you revision control and differential visibility for your administrative scripts and text-based informational documents. And it provides an organized repository for any other type of file you might want to have on hand.
Subversion (SVN) is a well-established open-source and free version-control system that has developed a substantial, and very loyal, user base. There are a number of service providers who will host Subversion for you, enabling you to connect to your source-control tree from anywhere without having to worry about the infrastructure needs of the server. (And you can connect over SSL and password protect your repositories.)
If you aren't comfortable with the idea of having your scripts and documents hosted externally, no need to worry. You'll find numerous books and instructional how-tos to help you set up an SVN server in your own environment.
One of the issues that many users cite about SVN is that it doesn't have a very friendly or easy-to-use command-line interface. That is where TortoiseSVN comes into play for your Windows workstations. Dubbed as the "coolest interface to (Sub)Version control," TortoiseSVN gives you an easy-to-use, GUI-based Windows shell extension that is integrated directly into Windows Explorer so you won't need an additional IDE or application to manage your source repositories. You can work directly from your Windows environment.
Many TortoiseSVN users also like that it is community supported, open source, and free to use in any environment. It has a very active developer community and an update-notification process that lets you know when a new build is available. In addition, TortoiseSVN supports both 32-bit and 64-bit versions of Windows natively.
TortoiseSVN, of course, has the usual check-in/check-out functionality you would expect from a source-control system. It's graphical UI also provides users with easy ways to perform branching, merging, and tagging within repositories. Icons provide visual cues when items are conflicted, need to be committed, and are newly added or deleted, as well as when they are up-to-date.
Another cool feature is the included Repository Browser, which gives you a view into a specified repository at a specific label or revision that works much like Windows Explorer. This allows you to get a quick at-a-glance view of what a set of scripts or documentation looked like at a particular release or time.
In addition to the Repository Browser, you also get two requisite tools for version control systems: TortoiseMerge (a merge tool) and TortoiseDiff (a diff tool). As the names suggest, these tools can help you merge or show the differences between revisions of a particular file or folder, respectively, within a repository.
If you don't currently have your administrative scripts and documentation under source control, I highly recommend you do so. This can save you from a number of hassles down the line. And when you are looking at version-control systems, you might want to consider the free, robust, actively developed, and open-source combination of Subversion on the back end and the TortoiseSVN client on your Windows workstations.

Price: Free.
Simplify source control with TortoiseSVN

Measure Disk I/O
Iometer
iometer.org
"Hmmm, that disk seems to be performing poorly," or "I wonder why it is taking so long to copy this file." Do these thoughts sound familiar? If so, you may want to take a look at Iometer. This is a free, open-source performance test tool, originally conceived and developed by Intel and later released to the open-source development community.
Though it hasn't been updated in quite some time, Iometer is still very useful for measuring disk I/O performance. The user guide supplied with the application is very thorough and will help you get up and running with the tweaked parameters you need to test your systems. You will, however, need a pretty deep understanding of I/O subsystems to really get the most out of Iometer's capabilities.
More than just a single CPU/single disk test tool, Iometer can spawn multiple workers to test multi-disk and -CPU scenarios adapting to fit whatever environment you need to test. And with its Network Targets feature, Iometer can also test remote systems.
There are two components to the Iometer application: the controller Iometer GUI and the Dynamo workload generation executable. Both of these components are also usable through the command line. Within the controller, you have the ability to spawn your worker clients to test out different disks and usage patterns on those disks and then to save those settings for reuse later.
To set up a test, you need to select your workers, drives, and access specifications. The documentation and references on the Internet will help you choose appropriate access specifications for different types of usage, such as desktop, database server, or file server. You're also responsible for setting the test time options (such as ramp up/ramp down times) and specifying the number of workers and CPUs to utilize in one that is run.
As your test runs, results are stored in a file that you can import into a different application for analysis. You can also click the Results Display tab to see simple bar charts of different statistics on the data collected, such as total I/Os or MBs per second, error counts, CPU utilization, and I/O response times.
If you love nitty-gritty information and need to analyze I/O numbers (or you are just curious about what kind of numbers your system can push out), you should check out Iometer.

Price: Free.
Measure I/O with Iometer

Reboot Servers Remotely
APC Switched Rack PDU
apc.com
As nice as it can be to escape the office and listen to the drone of the servers and HVAC at the datacenter, it's generally a good thing if you can avoid unexpected trips there. One common cause of these trips is a hung server. I'm sure you have been in this situation—you can ping the server, but you can't connect to it via RDP (Remote Desktop Protocol), WMI (Windows Management Instrumentation), SNMP (Simple Network Management Protocol), or the classic iisreset /reboot.
Instead of having to stop and head down to the datacenter or having to call the expensive on-hands network operations center just to power off the machine, you could just use something like APC's Switched Rack power distribution unit (PDU). The networked Switched Rack PDU line has a number of really cool features to help you remotely manage your gear at the datacenter.
First, after hooking up the device to your network via standard Ethernet cable and assigning an IP address, you can manage the device via SNMP, Telnet, or even via a Web browser. And since you are connected to a network, you can also download and remotely install new firmware for the device as it becomes available. Locally, you can monitor load on the circuits via colored LEDs and alarms; remotely you can be notified of those alarms via e-mail and check the loads via the management interfaces.
If you need a little more headroom on your circuits, you can define custom load thresholds. You also have the ability to control each outlet individually, turning off power to those that aren't currently in use. Or, if you need to, you can define the power-on sequence of the outlets, ensuring that devices come on in a predetermined order.
This is great for making sure, for example, your network devices come back to life before your servers or your domain controllers before your domain members. And, of course, you can cycle the power remotely for each outlet to unfreeze a stuck machine or device.
APC carries a number of different models to suit your needs, including the choice between horizontally or vertically mounted devices, different voltages and amperages, and the type of power connector you may need at your datacenter. Prices range from about $500 to more than $1,000 depending on the options you choose. Measuring the cost of a Switched Rack PDU against the time and cost spent on trips to a remote data center, a Switched Rack PDU can be a very good deal.

Price: Starts at about $500.
Reboot servers remotely with an APC Switched Rack PDU

Manage Compressed Archives
WinRAR 3.80
rarlab.com
Compressed archives are essential. In the IT world they are indispensable for organization and saving resources. Since the release of Windows XP, you have been able to right-click on a folder or file and select to send it to a compressed archive. Likewise, Windows provides a built-in way to easily extract zipped files. But if you are an IT professional, you probably prefer something with a little more power. One great tool for working with compressed archives is WinRAR from RARLabs. This utility has been around for many years, and the company has recently updated the app with the release of version 3.8.
WinRAR is a 32-bit Windows version of the RAR (Roshal Archive) archiver. More than just the RAR archive file format, WinRAR also offers support for ZIP, 7Z, ACE, TAR, Z, CAB, JAR, ISO files, and more. So it will undoubtedly be able to handle nearly all of the compressed file formats you may need to work with. Furthermore, it can also handle and create multi-volume archives and self-extracting (SFX) archives.
The application integrates into Windows with a shell extension, allowing you to right-click on a file or folder and manage archives without first having to launch the application. In addition, you can easily drag and drop files and folders into archives, modify existing archives within the graphical UI, and password protect and encrypt archives in just a few clicks.
One particularly nice benefit of the RAR file format is that it supports a recovery record, which can help you recover a damaged archive. And, with multi-volume archives, you can also choose to create recovery volumes (or REV files) that enable you to reconstruct a missing or damaged file within a set.
Most of the features of WinRAR are also available via command line (obviously, you can't drag and drop), enabling you to use it in automated systems administration tasks, such as for managing log files.

Price: $29 (direct) per user.
Manage compressed archives with WinRAR
Greg Steen is a technology professional, entrepreneur, and enthusiast. He is always on the hunt for new tools to help make operations, QA, and development easier for the IT professional.


.Qltr { float:left; padding-right: 5px; padding-top: 2px; color:#b9d1dc; font-size:40px; line-height: 30px; font-weight:normal; font-family:Arial, Helvetica, sans-serif } .Altr { float:left; padding-right: 5px; padding-top: 2px; color:#b9d1dc; font-size:40px; line-height: 35px; font-weight:normal; font-family:Arial, Helvetica, sans-serif } .ArticleTypeQuestion1 { padding-top: 18px; font-family: "Segoe UI", Arial; font-size: 14px; font-weight: bold; line-height: 1.2em; color: #444444; } .ArticleTypeQuestion2 { font-family: "Segoe UI", Arial; font-size: 14px; font-weight: bold; line-height: 1.2em; color: #444444; text-indent: 1em; } .ArticleTypeAnswer1 { padding-top: 18px; font-family: "Times New Roman", Times, serif; font-size: 16px; line-height: 1.2em; color: #444444; } .ArticleTypeAnswer2 { font-family: "Times New Roman", Times, serif; font-size: 16px; line-height: 1.2em; color: #444444; text-indent: 1em; } Exchange Queue & A Mysterious Attachment Size Increases, Replicating Public Folders, and More
Henrik Walther

Q Our organization's messaging infrastructure is based on Exchange Server 2007. We have a relatively strict message-size limit of 12MB set throughout the organization.
We have observed a strange behavior that seems to be related to the size of files attached to a message. When sending an e-mail message to an external user with, let's say, an 11MB attachment, the message is delivered to the recipient as expected. But if this message (including the attachment) is forwarded back to the sender on the internal network, the sender gets a non-delivery report (NDR), indicating that the message is larger than the current system limit or that the recipient's mailbox is full.
After taking a close look at the issue, we can see that at some point after the message leaves the organization, the size of the attachment increases by approximately 30%. The question is, why do attachment sizes increase while sending and receiving e-mail messages through the Internet? And more important, is this expected behavior?
A The short answer is yes. This is often expected behavior, not only for Exchange Server 2007 but also for earlier versions of Exchange Server as well as any other messaging system that supports MIME (Multipurpose Internet Mail Extensions) and uses Base64 to encode attachments. When an internal Exchange user sends a message to a recipient inside the Exchange organization, the message doesn't require any content conversion. This means that you won't see the message or attachments increase in size when they are delivered. Messages sent to external recipients, on the other hand, may require content conversion.
A standard SMTP message (also known as a plain-text message) consists of a message envelope and the message contents—the message header and message body. These elements are based on plain 7-bit US-ASCII text. When a message contains elements that are not plain US-ASCII text, the elements must be encoded. When dealing with such non-text content, including attachments, MIME is used for encoding. Both Exchange 2007 and earlier versions of Exchange Server use the Base64 algorithm to encode attachments. And the disadvantage of Base64 is that it bloats attachments by 33%.
In Exchange 2007, except when Outlook Web Access is used, most transport-related content conversion is performed on the Hub Transport server. For a detailed explanation, see the topic "Understanding Content Conversion" at technet.microsoft.com/library/bb232174.
Q We are in the middle of a transition from Exchange 2003 to Exchange 2007. We have moved all user mailboxes to Exchange 2007 mailbox servers, all of which have been configured using Cluster Continuous Replication (CCR). We are currently replicating all public folders from our legacy Exchange 2003 public folder server to a CCR-based mailbox server. However, we have discovered during testing that when a lossy failover occurs on the CCR cluster, the public folder database isn't brought online on the other node. We also cannot mount it manually after the failover.
We have a lab environment that mirrors our Exchange 2007 infrastructure in the production environment, and testing shows that the issue occurs here as well. We don't see this issue with any of the mailbox databases on any of the CCR clusters on which a lossy failover occurs, so it seems to relate strictly to public folder databases on CCR clusters. Since we want to achieve true redundancy for all databases, including the public folder database, do you have any insight into what would cause this behavior?
A The replication methods used by CCR and by public folder replication in Exchange 2007 are two very different beasts. Because of this, it is not recommended that you combine multiple public folder databases in an Exchange organization with CCR-based mailbox servers, if one of the public folder databases is hosted on a CCR-based mailbox server. You can actually do this during a transition, and the Exchange product group supports having a public folder database hosted on a CCR-based mailbox server and, for instance, a legacy Exchange 2003 server. But it's highly recommended that you remove the public folder database on the non-CCR-based mailbox server after all public folder data has replicated.
What you're experiencing in your Exchange messaging environment is normal. When you have multiple public folder databases and one of them is hosted on a CCR-based mailbox server, the public folder database on the CCR-based mailbox server will not be brought online during a lossy failover (that is, an unscheduled outage).
Actually, the public folder database can't be brought online before the previously active node is brought up again. Furthermore, all transaction log files for the storage group in which the public folder database is hosted must be available.
If this isn't an option, the first line of defense should be to restore the public folder store from the last good backup, play through the available logs, and then reseed the other node from the restored database. Alternatively, the public folder store could be created from scratch. In this case, the original active node must be recovered, and a new public folder database must be created and have public folder data replicated from another public folder server in the Exchange organization.
What may seem odd is that when a lossless (scheduled) outage is performed, the public folder database is brought online. This is expected behavior. For more information see "Cluster Continuous Replication and Public Folder Databases" on the "Planning for Cluster Continuous Replication."
Q All the mailbox servers within our Exchange 2007-based messaging infrastructure are configured using CCR. We are very satisfied with the way CCR works, but have a question we hope you can answer.
When online maintenance is run each night, one of the tasks is the online defragmentation. How do we ensure the databases on the passive node in a CCR cluster get defragmented during online maintenance?
A The online defragmentation task, which deletes any items marked for removal and then turns the space used by these items into white space, will generate new transaction log files during the process. Any transaction log files generated on the active CCR node will be replicated to the passive node, resulting in the changes being performed to the databases on the passive node as well.
With this in mind, please make sure you schedule the online maintenance window so that it doesn't conflict with your backup window, as this forces the online defragmentation to halt. Not that the defragmentation necessarily needs to complete every day, every week, or even every second week for that matter. In the past, guidance from the Exchange Product group specified having online defragmentation complete at least every second week. But that's changed with Exchange Server 2007 SP1, as each organization's environment is different. For more details on this new guidance, see the post on the Microsoft Exchange Team Blog.
Q We're planning to use Exchange 2007 CCR in order to achieve true redundancy for our mailbox servers. Currently, we're looking into how the transport dumpster is used in combination with CCR in order to ensure that no messages are lost during a lossy failover from the active CCR node to the passive node. Do you know of any transport dumpster gotchas we should be aware of?
A The transport dumpster ensures that you have a minimum data loss during a lossy failover from one node to another on an Exchange 2007 mailbox server that uses CCR. This is accomplished by redelivering messages that were recently submitted to the mailbox server. During a lossy failover, there's a real chance you will lose some transaction log files and, because of this, actual data as well. As noted, the transport dumpster redelivers the messages that were recently submitted to the mailbox server and thereby ensures that data lost during the lossy failure is restored. However, since it is only messages that are delivered via the Hub Transport server on which the transport dumpster resides, data such as tasks and calendar items created close to the lossy failover will be lost.
Q We are currently planning a cross-forest migration from an Exchange 2003 organization to an Exchange 2007 organization in a new Active Directory forest. We have extensively studied the cross-forest migration documentation, "How to Transition from Single Forest to Cross-Forest", which indicates that you should create a forest trust and not an external trust between the forests. Why is it that an external trust can't be used?
A Although the Exchange 2007 documentation on TechNet says you should use a forest trust rather than an external trust, it doesn't mean that you can't use an external trust. In fact, an external trust works just fine for a cross-forest Exchange migration, but there is one disadvantage. You must specify an account with the appropriate permissions to access a domain controller in the trusted forest when creating a linked mailbox (see Figure 1), since you cannot use the credentials of the logged-on user no matter what permissions were assigned to it.
Figure 1 Specifying an account on the Master Account page when creating a Linked Mailbox
Q Our organization just transitioned to Exchange 2007, and so far we are very pleased with the new version, with one possible exception. Back when we were using Exchange 2003 SP2, we were able to configure our environment so that the simple display name of a user mailbox was shown as the sender of an outgoing message. To our dismay, we have not been able to find a similar feature in Exchange 2007. Please don't tell us that this feature is missing in Exchange 2007!
A This feature was, in fact, missing from Exchange 2007 RTM, right up until Exchange 2007 SP1 Rollup Update 4 (RU4) was released back in October 2008. With SP1 RU4, you can once again, just as with Exchange 2003 SP2, configure Exchange to show the simple display name on outgoing messages. This task can be accomplished using the Windows PowerShell Set-RemoteDomain cmdlet with the –UseSimpleDisplayName parameter. For example, to enable simple display names on outgoing messages that are sent to the contoso.com domain, use the command shown in Figure 2.
Figure 2 Using Simple Display names for outgoing messages
Q What is the best practice for defragmenting the database copies on the passive node on an Exchange 2007-CCR-based mailbox server? Will Exchange become confused if the databases on one of the nodes in the CCR are defragmented, but those on the other nodes aren't?
A If an offline defragmentation is required, it should always be performed on the active node in the CCR cluster, never on the passive node. Bear in mind as well that if you do an offline defragmentation of one or more databases on the active node, a full reseed of the particular databases to the passive node is required.
This means, for instance, that if you have a 200GB database (when using CCR, the recommended database size is 200GB when replicating over a 1GB network), it will take several hours to defragment it (a good rule of thumb is 2-4GB per hour). But after the defragmentation process has completed, you will also need to replicate 200GB of data to the passive node. If log file shipping is occurring over the public network, this could impact the overall network performance experienced by your end users.
In most cases, the reason for performing an offline defragmentation is to remove any white space in the database in order to reduce the size of the database. But this is rarely necessary since white space will be reused before a database grows further. And it doesn't really matter if you have available space in the database or on the disk itself, does it?
If you have many gigabytes of white space in a database and you want to remove it, a much better approach is to move all mailboxes out of the database and into a new one.

Henrik Walther is a Microsoft Certified Master: Exchange 2007 and Exchange MVP with more than 14 years of experience in the IT business. He works as a Technology Architect for Interprise Consulting (a Microsoft Gold partner based in Denmark) and as a Technical writer for Biblioso Corporation (a U.S.-based company that specializes in managed documentation and localization services).


Utility Spotlight USB Flash Drive Manager
Lance Whitney

If your users are increasingly relying on USB flash drives for storing all or many of the files they use in the course of their work, it may be just about time to offer them a tool that will help them to manage those drives more efficiently. One solution can be the very handy Microsoft USB Flash Drive Manager. Even better, it's free! This utility helps you easily copy, delete, and back up files from a flash drive as well as perform a number of other useful tasks. You can download the USB Flash Drive Manager from the Microsoft website.
To install the utility, run the downloaded file UFDSetupWizard.msi. This creates a shortcut in Start Menu Programs called Microsoft USB Flash Drive Manager. Launch the program, and the Flash Drive Manager window displays its various commands divided into tabbed sections, as you can see in the screenshot.
The Overview window provides links to the individual tabbed windows, each of which is geared toward a specific function. You can either click on the tabs or select one of the commands under the View menu to move to a specific function.
The first function, Copy Files, makes it easy to copy files to and from a flash drive. The program window displays an icon list of all of the folders and files on the drive. You can copy files to and from the flash drive by dragging and dropping them between the icon window and Windows Explorer.
This window integrates into your OS environment, so other commands are available as well. Right-click on a folder or file in the icon window and you can run the usual commands from the popup menu—Delete, Rename, Send To, and so forth. Other options allow you to delete all files in a single step and open the USB drive in Windows Explorer view.
The next function, Backup/Restore, will back up the entire flash drive to the default directory set by the application—My Documents\Microsoft USB Flash Drive Backup. The folder for each backup is given a default name of UFD Image, followed by a sequential number: UFD Image 1, UFD Image 2, and so on. Using this function you can then restore the image files back onto any USB drive.
Figure 1 USB Flash Drive Manager lets you keep track of files on multiple USB drives
The third function, Properties, gives you the ability to change the drive label and to create an autorun.inf file to launch Drive Manager automatically when you plug in the drive. The fourth function, Manage Library, helps you take care of the drive image backups, letting you rename them or delete them from your PC.
The final function, Settings, lets you change the default backup directory for your flash drive image files and specify the amount of free disk space you need on your PC to store the backups. There's also an option here to save information for a WIFI network onto the flash drive, which is very handy if you need to apply the same wireless settings to multiple PCs. You're prompted to enter a network name (SSID) and assign an encryption key. You can choose between WPA or WEP for the encryption algorithm. After the wireless settings are stored on the flash drive, you then plug the drive into another computer where you can apply those settings.
You can insert, manage, and switch among multiple USB drives, but only one drive's contents will be visible at any time. Keep in mind as well that the tool can only read up to 4GB, so larger capacity USB drives won't display their full contents.
USB Flash Drive Manager is compatible with Windows XP, including Windows XP Home, Professional, and Media Center Editions, and requires the Microsoft .NET Framework 1.1.

Lance Whitney is an IT consultant, trainer, and technical writer. He has spent countless hours tweaking Windows workstations and servers. Originally a journalist, he took a blind leap into the IT world 15 years ago.


.img2 { float: left; margin: 10px 10px 10px 0px; width:429px; font-weight: normal; font-size: 14px; color: #003399; font-family: "Segoe UI", Arial; } .img3 { float: left; margin: 10px 10px 10px 10px; width:393px; font-weight: normal; font-size: 14px; color: #003399; font-family: "Segoe UI", Arial; } .clearboth { clear:both; } Utility Spotlight Microsoft Remote Server Administration Tools for Windows Vista
Edward Dake

Remember the Windows Server 2003 Service Pack 1 Administration Tools Pack (Adminpak) that, once installed on a client or server, allowed administrators to perform common administrative tasks without having to actually go to the server? It certainly made life easier, but the release of Windows Vista brought things to a halt: many of these tools did not work with a Vista client. Fortunately, you can download the installation file of the Remote Server Administration Tools (RSAT) for Windows Vista to add these tools to a Windows Vista SP1 machine (a link to the 64-bit version is also available) after the required validation.
RSAT is designed primarily to enable administrators to remotely manage Windows Server 2008 roles and features from a Windows Vista SP1 machine, but it also provides support for Windows Server 2003 roles. Of course, not all of the 2008 roles and features are supported in a 2003 environment, but the tool will satisfy most of the major management needs for that environment. See the Knowledge Base article "Description of Windows Server 2008 Remote Server Administration Tools for Windows Vista SP1" for all support options for Windows Server 2008 and Windows Server 2003, and for the localized languages currently offered for RSAT. The article also provides instruction on install methods, uninstall information, known issues, and links to the download packages.
After you install the package for your specific language and OS, you expose the features by turning the ones you want on (or off) in Windows Vista. To do this, open Control Panel|Programs and Features, and then click "Turn Windows features on or off" on the Tasks pane (see Figure 1). Once you take care of the User Account Control (UAC) prompt, you'll see a pop-up window showing the features you can turn on or off. RSAT adds a new category to the list entitled Remote Server Administration Tools that, when expanded, displays two major subcategories: Feature Administration Tools and Role Administration Tools, as shown in Figure 2. Each subcategory has multiple tools that you can activate and add to your client machine.
Figure 1 Turn Windows features on or off
Figure 2 RSAT feature and Role Tools
Figure 3 Setting Start Menu Properties

After selecting the features and tools to turn on, the system will configure the tools and install the necessary files and snap-ins that correspond to that particular tool or feature on your system. This allows you to utilize these tools in your Administrative Tools group in your Start Menu or in the Microsoft Management Console (MMC). If you want to do this, go into the Start Menu Properties and enable System Administrative Tools to be displayed in All Programs (or All Programs and the Start Menu), as shown in Figure 3. For MMC, use the Add/Remove Snap-in… to enable the functionality of the tool or feature in your custom console.
You will find the RSAT utility a valuable addition to your management tool belt for easy, feature-rich, remote administration of your Windows Server 2008 and Windows Server 2003 resources from a Windows Vista SP1 client workstation.

Edward Dake has worked for Microsoft Corporation since 1997 as a Technical Account Manager, a Support Engineer, and a Technical Lead in Customer Service and Support organization. His current role is Team Manager for Xbox Support.


.SidebarContainerA { width: 380px; height: 185px; float: right; border: 2px solid #008080; padding: 10px 20px 0px 20px; background-color: #e1e8f5; margin: 20px 0px 20px 10px; font-family: Verdana, Arial; font-size: 12px; line-height: 16px; color: #333333; } .floatright { float: right; margin: 15px 0px 15px 15px; width:275px; font-weight: normal; font-size: 14px; color: #323e58; font-family: "Segoe UI", Arial; } .floatleft2 { float: left; margin: 15px 15px 15px 0px; width:500px; font-weight: normal; font-size: 14px; color: #323e58; font-family: "Segoe UI", Arial; } .tdwidth{ width:20px; vertical-align:baseline; } Inside SharePoint SharePoint Security Accounts
Pav Cherny

Contents
Application Pools and Security Accounts
Running Custom Code on SharePoint Servers
About Dr. Jekyll and Mr. Hyde
Security Accounts and Process Isolation
Security Accounts in the Configuration Database
Security Accounts and Credential Keys
Don't Break the Law
When using SharePoint security accounts, there is a high risk of creating weak system configurations that can expose an entire SharePoint environment. To help you deploy and secure SharePoint server farms correctly, Microsoft has published extensive information and detailed guidelines. The Office SharePoint Server Security guide, for example, comprises more than 300 pages about planning and implementing site and content hierarchies, authentication methods, security roles, administrator and service accounts, and many other security issues. The Windows SharePoint Services Security Account Requirements worksheet also provides essential information regarding security account configurations. If security is important to you, you definitely want to make sure to follow this worksheet.
Even with extensive documentation, configuring security accounts can be a difficult task. In fact, the default settings of single-server installations deviate from the worksheet's recommendations, and certain components, such as the E-mail Integration Web Service included in Windows SharePoint Services (WSS) 3.0, require elevated permissions on the server, which not only strays from the Microsoft security recommendations but is in direct conflict with security best practices and plain common sense. The SharePoint 3.0 Central Administration tool happily applies critical security account configurations without warnings, the Microsoft Baseline Security Analyzer (MBSA) does not detect the resulting weaknesses, and so it remains a challenge to secure a SharePoint server farm—and to keep it secure.
In this column, I put SharePoint security accounts under a microscope to show you how a weak configuration can give an attacker full control over all site collections and sites. This is a somewhat sensitive topic. On the one hand, I want to help you recognize the security challenges that surround SharePoint server configurations. After all, you must understand both the strengths and the weaknesses of your SharePoint environment if you want to secure it effectively.
On the other hand, I don't want to aid malicious people. For this reason, I am not providing any worksheets or custom tools with this column and I'll constrain source code discussions to basic topics that should be familiar to every professional ASP.NET developer. The source code snippets covered in this column should help you detect vulnerabilities, but not help anyone exploit them. Even with limited programming skills, you should be able to use these snippets to create custom ASP.NET pages if you have Microsoft Office SharePoint Designer 2007.
A trial version of Microsoft Office SharePoint Designer 2007 is available online. I invite you to configure a test lab according to your own preferences, secure it as best as you can, and then run the code snippets for verification purposes. Let's see how secure your SharePoint sites are!

Application Pools and Security Accounts
Security accounts are at the very core of the SharePoint request-processing model. They define the security context of the IIS worker processes that run the SharePoint Web applications. When you create a SharePoint Web application, you must specify, among other things, an application pool with associated security account credentials and a SharePoint database with an associated authentication method. If you use Windows authentication (recommended), SharePoint automatically grants the specified security account dbOwner permissions on the content database so that the IIS worker process running the SharePoint Web application can gain access to the site collections and sites hosted in this database. Otherwise, you must provide explicit SQL Server credentials.
In any case, SharePoint site collections and sites are virtual constructs. Physically, they correspond to database records. If you know the account name and password to establish a direct SQL Server connection to the content database, you can gain full access to all its site collections and site data regardless of permissions and access controls defined at the SharePoint level. SharePoint cannot block you because you are establishing a direct connection to the database server, as illustrated in Figure 1. The security account is therefore a prime target for an attack.
Figure 1 Bypassing SharePoint site collections and sites to access data
To mitigate security risks, Microsoft recommends that you configure separate applications pools (and security accounts) for site collections with authenticated and anonymous content and to isolate applications that store passwords or where users have great liberty to create and administer sites and to collaborate on content. By following this configuration advice, the underlying idea is that an attacker who gains control over one application pool will not then implicitly have universal access to all data hosted in the SharePoint farm. SharePoint site collections and sites in other databases are still out of reach, provided you use separate security accounts for their associated Web applications.
Microsoft first introduced the concept of worker process isolation based on applications pools with IIS 6.0 and states that IIS has not suffered a single critical security vulnerability ever since. This is very reassuring, so be sure to take advantage of application pools in SharePoint farms. Keep in mind, however, that IIS Web sites and SharePoint Web applications are not synonymous. While you can isolate IIS Web sites, you cannot isolate SharePoint Web applications from each other.
Genuine isolation exists only if Web sites do not share resources, yet SharePoint Web applications always have resources in common, such as the farm's configuration database. As illustrated in Figure 2, gaining control over a SharePoint security account implies the ability to access the SharePoint configuration database. That access capability should make you feel uncomfortable if you deployed your SharePoint farm without giving proper thought to the protection of your security accounts, especially if you are hosting site collections and sites from different internal or external customers in a shared environment.
Figure 2 Relationship between SharePoint Web applications, configuration database, and content databases

Running Custom Code on SharePoint Servers
Out of the box, SharePoint doesn't disclose security account information; it takes malicious code to discover the details. As we all know, security vulnerabilities can enable attackers to upload malicious code, but sometimes intrusion is even easier.
In the simplest case, an attacker might be able to log on to a SharePoint server locally or via Terminal Server and copy malicious code into the %COMMONPROGRAMFILES%\Microsoft Shared\Web Server Extensions\12\TEMPLATE\Layouts folder. Note that SharePoint includes this folder as a virtualized subfolder in every SharePoint site.
In another scenario, a SharePoint administrator might unknowingly introduce malicious code by deploying a custom SharePoint solution from a questionable source without proper testing and code verification. Inline ASP.NET code embedded in master and content pages is also cause for concern. By default, SharePoint does not process server-side scripts, but anyone with write-access to a SharePoint Web application's web.config file can change the rules for processing server-side scripts. You need only add a PageParserPath entry to the web.config file's <PageParserPaths> section. How exactly does the PageParserPath entry work?
Let's suppose a developer who is using SharePoint calls you and complains about an error message he gets while developing a custom ASP.NET page that states "Code blocks are not allowed in this file." You search the Internet and find the solution in a newsgroup or blog site:

<PageParserPath VirtualPath="/*" CompilationMode="Always" AllowServerSideScript="true" IncludeSubFolders="true" />
Perhaps you ignore the security warnings or perhaps the security implications aren't even mentioned. No matter, you add this line to your web.config file and now everybody is happy because you solved the problem.
Unwittingly, however, you also just opened an avenue to run any custom code in ASP.NET pages with full trust. If an attacker now uploads a malicious ASP.NET page, the SharePoint environment is in jeopardy. As indicated in Figure 3, it is irrelevant where in a site collection hierarchy an attacker has the permission to upload a page—it can be an innocent-looking small team site. The attack always affects the Web application and possibly the entire server farm because both content database and configuration database are accessible.

Figure 3 Enabling inline ASP.NET code can compromise a SharePoint Web application

About Dr. Jekyll and Mr. Hyde
So how does an attacker gain access to content and configuration databases without explicitly knowing the security account credentials? It's actually relatively straightforward. The IIS worker process that runs the SharePoint Web application impersonates the SharePoint user and uses the resulting thread token for access checks. For example, Dr. Jekyll can access all those SharePoint resources that his security token is permitted to access. But the SharePoint Web application also has the process token of the IIS worker process, which is the security token of the SharePoint security account.
It is Mr. Hyde who shows up when you revert impersonation by calling the static WindowsIdentity.Impersonate method, and passing in a zero pointer, as illustrated in Figures 4 and 4a. Dr. Jekyll has no direct access to the databases, but Mr. Hyde does. The road is clear for SQL Server connections and T-SQL queries.
Figure 4 SharePoint Web applications have two security contexts
Figure 4a Code to retrieve the two SharePoint Web application security contexts
private string GetMrHyde()
{
    string retVal = string.Empty;
    retVal = "Dr Jekyll is: " + WindowsIdentity.GetCurrent().Name + "<br>";

    WindowsImpersonationContext impCtx = WindowsIdentity.Impersonate(IntPtr.Zero);

    retVal += "Mr Hyde is: " + WindowsIdentity.GetCurrent().Name + "<br>";

    impCtx.Undo();
    return retVal;
}

Security Accounts and Process Isolation
Application pools and security accounts cannot help you protect site collections and sites placed in a Web application configured to run unverified code. Their purpose is to mitigate, by means of process isolation, the impact of an exploit on one site that allows an attacker to inject code onto the server to attack other sites. Process isolation can help to achieve this goal, but it requires you to place the other sites in separate Web applications that run in application pools with different security accounts.
You must adequately protect the account credentials, otherwise the configuration effort is pointless. One easy way to deliver these sensitive security credentials straight into the wrong hands is to grant application pool accounts access to the IIS metabase, which is required to run the Directory Management Service—a part of the E-mail Integration Web service. If the application pool account has metabase access, an attacker can revert impersonation and then retrieve all the accounts and passwords in clear text, as illustrated in Figures 5 and 5a. The entire server farm is lost because the attacker can now bypass process isolation by running malicious code under any of these security accounts and establishing SQL Server connections to all content databases.
Figure 5 Retrieving security account information from the IIS metabase
Figure 5a Code to retrieve security account information from the IIS metabase
private string GetMetabaseAppPoolIDs()
{
        WindowsImpersonationContext impCtx = WindowsIdentity.Impersonate(IntPtr.Zero);
        string retVal = string.Empty;
        try
        {
            string metabasePath = "IIS://localhost/w3svc/AppPools";
            DirectoryEntry appPools = new DirectoryEntry(metabasePath);
            foreach (DirectoryEntry appPool in appPools.Children)
            {
            switch (int.Parse(appPool.Properties["AppPoolIdentityType"].Value.ToString()))
            {
                case 0: // Local System
                    retVal += "<br>" + appPool.Name
                        + " (Local System)";
                    break;
                case 1: // Local Service
                    retVal += "<br>" + appPool.Name
                        + " (Local Service)";
                    break;
                case 2: // Network Service
                     retVal += "<br>" + appPool.Name
                        + " (Network Service)";
                     break;
                case 3: // Custom
                    retVal += "<br>" + appPool.Name
                        + " (" + appPool.Properties["WAMUserName"].Value
                        + " [Pwd: " + appPool.Properties["WAMUserPass"].Value
                        + "])";
                    break;
               }
            }
         }
        catch (Exception ee)
         {
        retVal = "Metabase " + ee.Message;
         }

        impCtx.Undo();
}
If you're interested in a Directory Management Service solution that doesn't require metabase access, you should look up my September 2008 column, "SharePoint Directory Integration."

Security Accounts in the Configuration Database
If you follow the rule not to grant application pool accounts administrative permissions or even so much as read access to the IIS metabase on your SharePoint servers, the code in Figure 5 only yields an Access is denied message. But security account information is also available in the configuration database and Mr. Hyde has access to this database, as explained earlier.
You can't deny SharePoint security accounts access to the configuration database nor can you deny access to the registry key that stores the corresponding SQL Server connection string. The connection string might not immediately work if you use SQL Server 2005 Express, but you can derive the correct data source information from the current SharePoint site collection (SPContext.Current.Site.ContentDatabase.DatabaseConnectionString) and the name of the configuration database corresponds to the name of the local farm (SPFarm.Local.Name).
Unfortunately, these little hurdles don't stop an attack. Regardless of whether you use SQL Server or SQL Server Express, Mr. Hyde can retrieve the information displayed in Figures 6 and 6a. Note that the password is encrypted, however, so the attack has not yet fully succeeded.
Figure 6 Getting security account information from the configuration metabase
Figure 6a Code to retrieve security account information from the configuration metabase
private string EnumAppPoolAccounts()
{
    string retVal = string.Empty;
    try
    {
       WindowsImpersonationContext impCtx = WindowsIdentity.Impersonate(IntPtr.Zero);

       string regConfigDB = @"SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\12.0\Secure\ConfigDB";
       RegistryKey keyConfigDB = Registry.LocalMachine.OpenSubKey(regConfigDB);

       string ConfigDB = (string)keyConfigDB.GetValue("dsn");

       SqlConnection sqlConn = new SqlConnection(ConfigDB);
       sqlConn.Open();

       SqlCommand sqlCmd = new SqlCommand("SELECT Name, Properties FROM Objects"
          + " WHERE ClassId = 'B8369089-08AD-4978-B1CB-C597B5E90F64'", sqlConn);
       sqlCmd.CommandType = System.Data.CommandType.Text;
       SqlDataReader sqlReader = sqlCmd.ExecuteReader();

          while (sqlReader.Read())
          {
             retVal += "<br>" + sqlReader.GetString(0);
             string appPoolXML = sqlReader.GetString(1);
             if (!string.IsNullOrEmpty(appPoolXML))
             {

                 XmlDocument xmlDoc = new XmlDocument();
                 xmlDoc.LoadXml(appPoolXML);

                 XmlElement root = xmlDoc.DocumentElement;
                 XmlNode ndType = root.SelectSingleNode("/object/fld[@name=                   'm_IdentityType']");
                 if (ndType != null && ndType.InnerText.ToLower() != "specificuser")
                 {
                     retVal += " (" + ndType.InnerText + ")";
                 }
                 else
                 {
                     retVal += " ("
                         + root.SelectSingleNode("/object/sFld[@name='m_Username']").InnerText
                         + " [Pwd: "
                         + root.SelectSingleNode("/object/fld[@name='m_Password']").InnerText
                         + "])";
                 }
             }
          }
          sqlReader.Close();
          sqlConn.Close();
          impCtx.Undo();
    }
    catch (Exception ee)
    {
          retVal = ee.Message;
    }
    return retVal;
}
But even without decrypting passwords, application pools that use the same security account are already recognizable. For example, in Figure 6, the application pools SharePoint Central Administration v3 and SharePoint—80 use the Network Service account and if SharePoint—80 happens to be the compromised Web application, then SharePoint Central Administration v3 is compromised as well. The corresponding security account is the Central Administration account, which has elevated permissions on the SharePoint server.
It should not be used for standard Web application pools, yet the SharePoint Products and Technologies Configuration Wizard applies this configuration in a single-server installation by default. Therefore, it's very important that you review and, if necessary, change the security account configuration in your SharePoint environment. More information on this topic is outlined in detail in the Microsoft Knowledge Base article "How to Change Service Accounts and Service Account Passwords in SharePoint Server 2007 and in Windows SharePoint Services 3.0."

Security Accounts and Credential Keys
So what's the big deal about the Central Administration account? Most importantly, unlike standard application pool accounts, the Central Administration account has access to the registry location that stores the credential key to decrypt the security account passwords.
Figure 7 shows this parameter and its default security settings. As you can see, local Administrators, the WSS_RESTRICTED_WPG group (which contains the Central Administration account), and the SYSTEM account have access to this key and this implies that your SharePoint Web applications should not use accounts with local administrator permissions, the Central Administration account, or the SYSTEM account. SharePoint Web applications should not be able to access the credential key.
Figure 7 Permission assignments to access the FarmAdmin registry key
Unfortunately, however, this is no guarantee that a skilled attacker cannot determine the CredentialKey or security account passwords, such as through SYSTEM token hijacking, password cracking, or simply by placing malicious code in master pages or content pages to export the credential key to an unprotected location and then waiting for a user with local administrator permissions to access the site. As you can see, it's important that you don't allow unverified code on your servers.
SharePoint Resources

SharePoint Products and Technologies Web Site

Windows SharePoint Services TechCenter

Windows SharePoint Services Developer Center

Microsoft SharePoint Products and Technologies Team Blog

SYSTEM token hijacking deserves some more detailed explanation because you can prevent this form of attack if you avoid using the built-in system accounts, such as Network Service, for your SharePoint Web applications. In fact, Cesar Cerrudo, founder and CEO of Argeniss, discovered this vulnerability, and he demonstrated the exploit at the HITBSecConf2008 Deep Knowledge Security Conference in Dubai, United Arab Emirates. Cesar showed how an ASP.NET Web application running under the Network Service account can inject a DLL into the Remote Procedure Call (RPC) service and then hijack the security token of a thread in the RPC service that runs at SYSTEM privilege level.
After this, an attacker then only needs to pass the hijacked SYSTEM security token to the WindowsIdentity.Impersonate method to gain access to the CredentialKey registry parameter and other protected resources. Microsoft confirmed the vulnerability, so you should avoid using the Network Service account for your SharePoint Web applications.

Don't Break the Law
The 10 Immutable Laws of Security were published by the Microsoft Security Response Center a long time ago, and they still apply today. Jesper M. Johansson recently wrote a three-part series called "Revisiting the 10 Immutable Laws of Security." You should keep these laws in mind when designing your SharePoint server farms, and you should also follow the SharePoint security guidelines and worksheets to apply reliable security account configurations.
In a nutshell: use strong passwords, don't grant security accounts elevated permissions on your SharePoint servers, change passwords frequently (including the farm credentials), and keep in mind that there is no absolute isolation between SharePoint Web applications that use common resources, just as there is no absolute computer security. Moreover, don't change the server code processing rules, keep unverified assemblies away from your servers, and follow the Windows SharePoint Services Security Account Requirements worksheet in your security account configuration, and you might be able to consider your SharePoint environment reasonably secure.
However, if strict separation of site content is a requirement for your organization, I recommend that you host the corresponding site collections in separate server farms, possibly in separate Active Directory forests and SQL Server environments.

Pav Cherny is an IT expert and author specializing in Microsoft technologies for collaboration and unified communication. His publications include white papers, product manuals, and books with a focus on IT operations and system administration. Pav is President of Biblioso Corporation, a company that specializes in managed documentation and localization services.


.SidebarContainerA { width: 330px; height: 500px; float: right; border: 2px solid #008080; padding: 10px 20px 0px 20px; background-color: #e1e8f5; margin: 0px 0px 20px 10px; } .SidebarContainerB { width: 400px; height: 450px; float: right; border: 2px solid #008080; padding: 10px 20px 0px 20px; background-color: #e1e8f5; margin: 20px 0px 20px 10px; } .floatleft4 { float: left; margin: 15px 15px 15px 0px; width:412px; font-weight: normal; font-size: 14px; color: #323e58; font-family: "Segoe UI", Arial; } Windows PowerShell Trapping Errors
Don Jones

Contents
Setting a Trap
Stop!
It's All in the Scope
Breaking Out
Why Worry?
Video
Continuing his discussion on building a powerful inventorying tool in Windows PowerShell, Don Jones turns his attention to error-trapping. In this month's accompanying video, Don demonstrates how you can incorporate error-handling in your Windows PowerShell-based functions.

In the previous installment of this column, I showed you how to make a rather advanced inventory tool using Windows PowerShell. The tool I created offered several options regarding output—thanks to the shell's built-in capabilities and the function's use of objects.
One admittedly weak aspect of the function I created is that it can't deal gracefully with any errors that might occur, such as connectivity or permissions issues. That is what I want to address in this month's installment of the Windows PowerShell column—I am looking at the error-handling capabilities offered by Windows PowerShell.

Setting a Trap
The Trap keyword in Windows PowerShell defines an error handler. When an exception occurs in your script, the shell looks to see if a trap has been defined—this means the trap must appear in your script before any exceptions occur. For this demonstration, I'll put together a test script that I know will generate a connectivity issue: I'll use Get-WmiObject to connect to a computer name that I know doesn't exist on the network. My goal is to have the error trap write out the bad computer name to a file, giving me a file of computer names that didn't work. I'll also include connections to two computers that are reachable (I'll use localhost). You can see the script in Figure 1.
Figure 1 Adding the trap
trap {
  write-host "Error connecting to $computer" -fore red
  "$computer" | out-file c:\demo\errors.txt -append
  continue
}

$computer = "localhost"
get-wmiobject win32_operatingsystem -comp $computer

$computer = "server2"
get-wmiobject win32_operatingsystem -comp $computer

$computer = "localhost"
get-wmiobject win32_operatingsystem -comp $computer
The output from this script, shown in Figure 2, is not exactly what I am looking for. Notice that the "Error connecting to…" message didn't display. The Errors.txt file wasn't created either. In other words, my trap didn't execute at all. What happened?
Figure 2 This is not the output I was hoping for!

Stop!
The key is to understand that a normal shell error message isn't the same as an exception. (There are non-terminating errors and terminating errors. Terminating errors stop the execution of the pipeline and result in an exception.) Only exceptions can be trapped. When an error occurs, the shell looks at its built-in $ErrorActionPreference variable to see what it should do. That variable defaults to having the value "Continue," which means "display an error message and keep going." Changing this variable to "Stop" would cause it to display an error message and produce a trappable exception. This, however, means any error in your script will do so.
A better technique is to have just the cmdlet you think might cause a problem use the "Stop" behavior. You can accomplish this by using the –ErrorAction (or –EA) parameter, a common parameter supported by all cmdlets. The revised version of the script is shown in Figure 3. It works just as expected, producing the output that you'll find in Figure 4.
Figure 3 Using -ErrorAction
trap {
  write-host "Error connecting to $computer" -fore red
    "$computer" | out-file c:\demo\errors.txt -append
  continue
}

$computer = "localhost"
get-wmiobject win32_operatingsystem -comp $computer -ea stop

$computer = "server2"
get-wmiobject win32_operatingsystem  -comp $computer -ea stop

$computer = "localhost"
get-wmiobject win32_operatingsystem  -comp $computer -ea stop
Figure 4 I get more useful results when using the –ErrorAction parameter
The use of Continue at the end of the trap instructs the shell to resume execution at the line of code after the one that produced the exception. The other option is to use the keyword Break (I'll discuss that in a moment). Also notice that the $computer variable, which is defined in the script, is still valid within the trap. That's because the trap is a child scope of the script itself, meaning the trap can see all the variables within the script (more information on this in a moment, too).

It's All in the Scope
One particularly tricky aspect of error trapping in Windows PowerShell is the use of scope. The shell itself represents the global scope, which contains everything that goes on inside the shell. When you run a script, it gets its own script scope. If you define a function, the inside of the function is its own private scope, and so forth. This creates a sort of parent/child type of hierarchy.
When an exception occurs, the shell looks for a trap in the current scope. That means an exception inside a function will look for a trap inside that function. If the shell finds a trap, the shell executes the trap. If the trap ends with Continue, the shell will resume execution on the line of code that follows the one that caused the exception—remaining in the same scope. Here's a bit of pseudocode to help illustrate this:
01  Trap {
02    # Log error to a file
03    Continue
04  }
05  Get-WmiObject Win32_Service –comp "Server2" –ea "Stop"
06  Get-Process
If an exception occurs on line 5, the trap on line 1 will execute. The trap ends with Continue, so execution will resume on line 6.
Now consider this slightly different example of scope:
01  Trap {
02    # Log error to a file
03    Continue
04  }
05
06  Function MyFunction {
07    Get-WmiObject Win32_Service –comp "Server2" –ea "Stop"
08    Get-Process
09  }
10
11  MyFunction
12  Write-Host "Testing!"
If an error occurs on line 7, the shell will look for a trap within the function's scope. There isn't one, so the shell exits the function's scope and looks for a trap in the parent scope. There is a trap and so it executes at line 1. In this case, Continue will resume on the line of code in the same scope that followed the exception—that's line 12, not line 8. In other words, the shell won't re-enter the function once it's exited.
Now contrast that behavior with this example:
01  Function MyFunction {
02    Trap {
03      # Log error to a file
04      Continue
05    }
06    Get-WmiObject Win32_Service –comp "Server2" –ea "Stop"
07    Get-Process
08  }
09
10  MyFunction
11  Write-Host "Testing!"
In this case, the error on line 6 will execute the trap on line 2, staying within the function's scope. The Continue keyword will stay within that scope, resuming execution on line 7. This is the benefit to including a trap within the scope where you expect the error to occur—you remain within scope and are able to resume execution within it. But what if this method won't work in your scenario?
Cmdlet of the Month: Compare-Object
This is a cool tool for managing configuration baselines. Compare-Object, or its alias Diff, is designed to compare two sets of objects to one another. By default, it compares every property of each object, and any differences are output by the command. So imagine that you've gotten a server's services configured exactly the way you want. Just run this to create a baseline:
Get-Service | Export-CliXML c:\baseline.xml
Nearly any object can be piped to Export-CliXML, which will turn the objects into an XML file. Later, you can run the same command—such as Get-Service—and compare the results to that saved XML. Here's how:
Compare-Object (Get-Service) (Import-CliXML
  c:\baseline.xml) –property name
Adding the –property parameter forces the comparison to only look at that property, rather than the entire object. In this case, you'll get a list of any service names which are different from your original baseline, letting you know if any services have been added or removed since the baseline was created.

Breaking Out
Earlier, I mentioned the Break keyword. Figure 5 shows an example of how you can put the Break keyword into action.
Figure 5 Using the Break keyword
01  Trap {
02    # Handle the error
03    Continue
04  }
05
06  Function MyFunction {
07    Trap {
08      # Log error to a file
09      If ($condition) {
10        Continue
11      } Else {
12        Break
13      }
14    }
15    Get-WmiObject Win32_Service –comp "Server2" –ea "Stop"
16    Get-Process
17  }
18
19  MyFunction
20  Write-Host "Testing!"
Here's a quick overview of the chain of execution. Line 19 executes first, calling the function on line 6. Line 15 executes and generates an exception. That exception is trapped on line 7, and then on line 9 the trap must make a decision. Assuming $condition is True, the trap will continue execution on line 16.
If, however, $condition is False, the trap will Break. This exits the current scope and passes the original exception up to the parent. From the shell's view, that means line 19 produced an exception, which is trapped by line 1. The Continue keyword forces the shell to resume on line 20.
In reality, both of these traps would have a bit more code in them to deal with the error, log it, and so on. I've simply omitted that functional code in this example to make the actual flow easier to see.

Why Worry?
When do you need to implement error trapping? Only when you anticipate that an error may occur, and when you want some behavior other than a plain error message—such as logging the error to a file or displaying a more helpful error message.
I usually include error handling in more complicated scripts to help deal with errors that I can foresee happening. These include, but are not limited to, errors such as bad connectivity or permissions problems.
Error trapping definitely requires a little more effort and time to understand. As you progress into more complicated tasks within Windows PowerShell, however, error trapping will be well worth the investment to help you make a more polished and professional tool.

Don Jones is the coauthor of Windows PowerShell: TFM and author of dozens of other IT books. Reach him through his blog at concentratedtech.com.


Hey, Scripting Guy! Learning to Excel
The Microsoft Scripting Guys

Having spent the last month living and working in Australia, this Scripting Guy is constantly amazed by the creativity and overall robustness of my Aussie colleagues. A few nights ago, a friend here took the Scripting Wife and me out to dinner. He said the restaurant was a short walk from our hotel.
Forty minutes later, we arrived at a beautiful restaurant overlooking Sydney Harbor, with the Sydney Opera House glistening like a seashell washed up on a multicolored beach. The Harbour Bridge—the longest single-span bridge in the world—imposes order by holding the two peninsulas together like a massive clamp restraining two warped boards.
Back home, 40 minutes of walking is not a short stroll to dinner. It's a daily workout preceded by 15 minutes of warm-ups and stretching.
One reason this Scripting Guy is enjoying this trip down under is for the different perspective my colleagues here have. They seem to have a unique way of looking at things, which often challenges my preconceived notions of how things should be done.
In scripting, it's all too easy to get into a rut as you stay the course with tried-and-true methodologies. Many times, using the same approach to obtain the same results is exactly what you want.
From a monitoring perspective, for instance, by using Windows PowerShell you can easily obtain a nice snapshot of process utilization on your local computer. You use the Get-Process cmdlet and are greeted with nice, orderly output, as shown in Figure 1.
Figure 1 Looking at local processes using Get-Process
The results of the Get-Process cmdlet are useful in many circumstances. They show the number of open handles, a couple of different views of memory consumption, and a snapshot of CPU utilization. And when Windows PowerShell 2.0 comes along, you will even be able to use Get-Process with a –computername parameter to retrieve this overview from a remote computer. With all this goodness, why in the world would anyone ever bother investigating anything else?
The problem is there is a whole lot of detail hidden in the long columns of data. All that data tends to mask the more important details. And while it's great that in the future Windows PowerShell 2.0 will support the –computername parameter, right now that does absolutely nothing for a network administrator. Therefore, we'll just have to use Windows Management Instrumentation (WMI) and the Win32_Process WMI class to do our monitoring of remote systems and present the information in a way that's truly useful. If you thought the output from Get-Process was bountiful, get a load of the output from Win32_Process, shown in Figure 2.
Figure 2 Using WMI to view processes
So what's a poor ol' network administrator to do when all he wants is an easy-to-read report of the amount of memory being consumed? This is where you need to think outside the box, get out of your shell, and begin to Excel at automation. More than likely, you have Microsoft Office Excel installed on your computer. If you are like us, you are not an expert, but it is part of the Microsoft Office system and you might as well make use of it.
How hard is it to automate Excel? It is actually rather easy because Microsoft has created an automation model specifically for working with Excel. The program ID is Excel.Application, and it is a COM object. When you create an instance of the Excel.Application object, by default Excel will start and run, but it will not be visible. However, you can use the visible property to make Excel visible.
Here's how to create the Excel.Application object, query the status of the visible property, and then set the visible property to true:
PS C:\> $excel = New-Object -ComObject Excel.Application
PS C:\> $excel.Visible
False
PS C:\> $excel.Visible = $true
When you've done that, you are greeted with a rather odd view of Excel, which looks like just a shell of the Excel application (see Figure 3). There are no workbooks, no spreadsheets—nothing but naked Excel.
Figure 3 Naked Excel—no workbooks or spreadsheets
We need to add a workbook to the application. To do this, we use the add method from the workbook object. The workbook object is accessed from the main Excel.Application object, as you can see here where we store the workbook object in a variable named $workbook:
$workbook = $excel.Workbooks.add()
Now we need to connect to a specific spreadsheet. By default, when a workbook is added to Excel, three spreadsheets are added to the workbook. These spreadsheets can be addressed by number. In this line of code, we connect to the first spreadsheet and store the returned spreadsheet object in a variable named $sheet:
$sheet = $workbook.worksheets.Item(1)
Now we can write data to that spreadsheet. Information in Excel spreadsheets is stored in cells. Because cells live in spreadsheets, you use the spreadsheet object that is stored in the $sheet variable to gain access to a specific cell. You do so by using numbers that refer to rows and columns in the spreadsheet. One thing that is a bit confusing is that in Excel spreadsheets, rows are numbers and columns are letters. When using the automation model, however, both rows and columns are numbers. The first number is the row and the second number is the column. You can write to the cell by simply making a value assignment to that specific cell:
$sheet.cells.item(1,1) = "Test"
After adding a workbook to our Excel.Application object and data to a cell in the spreadsheet, our Excel workbook looks like the one in Figure 4.
Figure 4 Adding a value to a cell
With all of this in mind, let's put together something useful. Let's get a collection of process information from WMI, write the name and memory consumption of each process to an Excel spreadsheet, and then create a chart to highlight the memory used. That's just what WriteProcessInformationToExcel.ps1 does. You will find the whole script on the TechNet Magazine Web site.
We begin the script by using the Get-WmiObject cmdlet to retrieve a collection of information about processes. We use the Win32_Process WMI class to obtain this information, and we store it in the $processes variable:
$processes = Get-WmiObject -class Win32_Process
Now we create an instance of the Excel.Application object and store it in the variable $excel, then make the application visible and add a workbook. You would normally perform these steps for any Excel automation you decided to do. Here are the lines of code:
$excel = new-object -comobject excel.application
$excel.visible = $true
$workbook = $excel.workbooks.add()
One of our annoyances with Excel is the way that a workbook always creates three spreadsheets. We consider this to be wasteful because we can barely use a single spreadsheet, much less three. Luckily, with automation, we can simply delete the extra spreadsheets using the worksheets collection to connect to the third spreadsheet and calling the delete method. The same can be done to delete the second spreadsheet:
$workbook.workSheets.item(3).delete()
$workbook.WorkSheets.item(2).delete()
Next, we rename the remaining spreadsheet. This is important because if you ever decide to use ActiveX data objects (ADO) to query the Excel spreadsheet, you use the spreadsheet name in the connection string. Therefore, to make the code readable and intuitive, the spreadsheet should have a logical name. To rename the spreadsheet, simply assign a new value for the name property of the specific spreadsheet. Here, we rename the first spreadsheet to "Processes":
$workbook.WorkSheets.item(1).Name = "Processes"
Now we need to connect to the renamed spreadsheet. Use the Item method from the worksheets object and give it the name of the spreadsheet:
$sheet = $workbook.WorkSheets.Item("Processes")
The first row of the spreadsheet will contain header information. We will draw a border and make the property names bold. As a result, the data will begin in row two, so we assign the value of 2 to the counter variable $x:
$x = 2
Next, four lines of code create four enumeration types. Enumeration types are used to tell Excel which values are allowed for specific types of options. As an example, xlLineStyle enumeration is used to determine the kind of line to draw: double, dashed, and so on. These enumeration values are documented on MSDN.
To make the code easier to read, we create shortcut aliases for each of the four enumeration types we will be using. Essentially, we're casting a string that represents the name of the enumeration to a [type]. This technique is actually a pretty cool trick:
$lineStyle = "microsoft.office.interop.excel.xlLineStyle" -as [type]
$colorIndex = "microsoft.office.interop.excel.xlColorIndex" -as [type]
$borderWeight = "microsoft.office.interop.excel.xlBorderWeight" -as [type]
$chartType = "microsoft.office.interop.excel.xlChartType" -as [type]
Now we need to format the first row. We make the font bold, define the line as xlDashDot, allow the color to be automatically specified, and set the border weight to medium thickness:
For($b = 1 ; $b -le 2 ; $b++)
{
 $sheet.cells.item(1,$b).font.bold = $true
 $sheet.cells.item(1,$b).borders.LineStyle = $lineStyle::xlDashDot
 $sheet.cells.item(1,$b).borders.ColorIndex = $colorIndex::xlColorIndexAutomatic
 $sheet.cells.item(1,$b).borders.weight = $borderWeight::xlMedium
}
When that's done, we assign values to the first row by selecting the cell with the item method and giving the coordinates of the row and column. Next, we do a straight value assignment to write the column headers:
$sheet.cells.item(1,1) = "Name of Process"
$sheet.cells.item(1,2) = "Working Set Size"
Now we need to put the process information stored in the $processes variable that was created as a result of our WMI query into the appropriate cells. We use the foreach statement to walk through the collection of process information. We define the variable $process to be our enumerator (placeholder) for the collection, and we choose the name and the workingSetSize properties to write to the first and second column respectively.
Here is where the $x variable comes into play. We begin with the second row, and as we walk through the collection of processes, we increment the value of the $x variable so that it always points to the current row in the collection. This is how we are able to sort through all the data stored in the $processes collection of process information:
Foreach($process in $processes)
{
 $sheet.cells.item($x, 1) = $process.name
 $sheet.cells.item($x,2) = $process.workingSetSize
 $x++
} #end foreach
After we have filled out the Excel spreadsheet, we want to adjust the size of the columns so that the cells are the same size as the data that is stored there. To do this, we could create a range by specifying the column coordinates to use; we can, however, simply use the usedRange property from the spreadsheet. When we have created our range object, we choose the EntireColumn property and use the AutoFit method to resize the columns. Because this method always returns data, we pipe the results to the Out-Null cmdlet. This keeps from cluttering up the console with useless information. Here's the code we use:
$range = $sheet.usedRange
$range.EntireColumn.AutoFit() | out-null
At this point, we could stop and we would have a nice spreadsheet with the name and memory working set of all our processes. But let's go ahead and create a chart. It's easy. We use the add method of the charts object from the workbook. Because this method also returns information we do not want to see, we pipeline the results to the Out-Null cmdlet, as shown here:
$workbook.charts.add() | out-null
The above command adds a line chart. If you want to define a different type of chart, you need to use one of the chart type enumeration values. To do this, you can make use of one of the microsoft.office.interop.excel.xlChartType enumeration values, such as the xl3DPieExploded type. The xl3DPieExploded type creates, not surprisingly, a three-dimensional pie chart that is exploded. We assign this enumeration type to the ActiveChart object's chartType property. Then we assign the data source for the chart to be the range we defined in the $range variable. The result is that you see the line chart flash briefly, and then the 3D pie chart explodes on the screen. Here's the code:
$workbook.ActiveChart.chartType = $chartType::xl3DPieExploded
$workbook.ActiveChart.SetSourceData($range)
As long as we are playing around, let's rotate the pie chart. We can do this by using the rotation property of the ActiveChart object. We use a for statement to increment the count to 360 by 15. 360 is the number of degrees in a circle; the chart will rotate a complete circle 15 degrees at a time. It actually looks pretty cool. Here is the code to perform this feat:
For($i = 1 ; $i -le 360 ; $i +=15)
{
 $workbook.ActiveChart.rotation = $i
}
The last thing we need to do is to save the spreadsheet. To do this, we use the Test-Path cmdlet to see if the spreadsheet already exists. If it does, we delete the old one by using the Remove-Item cmdlet, and then we save the current workbook to the location stored in the $strPath variable. We use the ActiveWorkbook object from the Excel.Application object and the SaveAs method to save the workbook. If there is not already a copy of the spreadsheet saved, we use the SaveAs method from the ActiveWorkbook object and save it directly:
IF(Test-Path $strPath)
  {
   Remove-Item $strPath
   $Excel.ActiveWorkbook.SaveAs($strPath)
  }
ELSE
  {
   $Excel.ActiveWorkbook.SaveAs($strPath)
  }
When the script runs, you are presented with a chart just like the one shown in Figure 5.
Figure 5 The Processes exploded pie chart
The spreadsheet itself is on the Processes tab. Figure 6 shows the column headers, the dot/dash line style we selected for the border, and the bold column heads. The process names and the working set size properties are the two columns of data we have displayed.
Figure 6 The finished spreadsheet
As you can see, with the Excel.Application automation model, you have the tools you need to let you process data from your servers in a manner that can take advantage of the analysis and charting tools from this rich and powerful application.

Ed Wilson is a Senior Consultant at Microsoft and a well-known scripting expert. He is a Microsoft Certified Trainer who delivers a popular Windows PowerShell workshop to Microsoft Premier customers worldwide. He has written eight books, including several on Windows scripting, and has contributed to almost a dozen other books. Ed holds more than 20 industry certifications.
Craig Liebendorfer is a wordsmith and longtime Microsoft Web editor. Craig still can't believe there's a job that pays him to work with words every day. One of his favorite things is irreverent humor, so he should fit right in here. He considers his greatest accomplishment in life to be his magnificent daughter.


.SidebarContainerA { width: 476px; height: 760px; float: right; border: 2px solid #008080; padding: 10px 20px 0px 20px; background-color: #e1e8f5; margin: 20px 0px 20px 10px; font-family: Verdana, Arial; font-size: 12px; line-height: 16px; color: #333333; } .floatleft5 { float: left; margin: 15px 15px 15px 0px; width:525px; font-weight: normal; font-size: 14px; color: #323e58; font-family: "Segoe UI", Arial; } The Desktop Files Windows Won't Start!
Wes Miller

Contents
So What Can Happen?
Tools of the Trade
Operating System Is Missing
Boot Loader Is Missing
System Boots—then Hangs
Windows Safe Mode and Restore Points
System Crashes before Windows Finishes Loading
Last Known Good Configuration
System Crashes after Windows Starts
If you've worked with Windows for any length of time, chances are you've seen it fail at one time or another. Though Windows has grown increasingly reliable with each release, there are things that neither you nor Windows can control: drivers fail, systems get hit by power outages, files get corrupted, and disks crash. And when these things happen, you worry that you have to look for a new machine. In this column, I'll look at the things that can go wrong in a Windows system and how you can troubleshoot them to get it working again.

So What Can Happen?
After nearly 20 years of working with Windows, I've seen my fair share of systems that won't boot. The culprit can usually be found pretty quickly—depending on exactly what the system is doing. Let's categorize the symptoms that Windows systems will show and build up some cases to walk through for troubleshooting.
  • System won't perform a BIOS POST (Power On Self Test; it doesn't beep when you power it on).
  • System POSTs but says Missing Operating System or Operating System not found.
  • System POSTs but fails with either NTLDR not found or BOOTMGR not found.
  • System begins to boot but hangs during startup.
  • System begins to boot but crashes before the Windows desktop appears (and is stuck in a loop).
  • System makes it to the Windows desktop but then crashes while Windows is running (and is stuck in a loop).
These scenarios may sound altogether different, but, in fact, there are only a few common problems that cause most of them, and with some troubleshooting, you can figure out what went wrong and what you might have to do to fix it. One of the most difficult situations is when a system will no longer POST at all.
Unfortunately, this is almost always a hardware issue. It may require something as minor as a CMOS battery replacement or as complicated as a new motherboard or power supply. But if your system won't POST, you should probably grab the support phone number for your system OEM, as you're not likely to be able to solve this one on your own.

Tools of the Trade
As long as your system is POSTing, you stand a good chance of recovering, as the problem is not just hardware that's gone bad (though, of course, the problem may involve both hardware as well as software). Depending on how far your system gets into the boot process, you should be able to gradually remove various "suspects" from your list and get the system working again.
Before you start, here are some tools you'll want to keep handy:
  • Ideally, you should have access to another computer running Windows to use for crash analysis, which should include the Debugging Tools for Windows.
  • You should have a copy of the Microsoft Diagnostics and Recovery Toolset (DaRT), which is part of the Microsoft Desktop Optimization Pack (MDOP). At you can find a 30-day evaluation copy online. Alternatively, you could use a Windows PE CD (ideally version 2.1, especially if you are recovering a Windows Vista or Windows Server 2008 system).
  • You should have a USB flash drive large enough to hold any crash dump from your problematic system.
  • You should have any tools necessary to remove hardware from your problematic system.

Operating System Is Missing
If you receive an error regarding a missing operating system or the operating system not found (the text may vary depending on the BIOS used on your PC), the problem is that, effectively, your system is missing the boot sector—the section on the disk that says where to find the boot loader. I've only once had this issue crop up unexpectedly—an executive's machine was hit with a surge during a power outage—and, surprisingly, this was the only issue that was immediately apparent.
Unfortunately, upon deeper investigation, we found that her system appeared to have completely lost all of its partitions. Ironically, this was at Winternals, and we then created a tool called Disk Commander (see Figure 1) that is now part of the Diagnostics and Recovery Toolset.
Figure 1 The Disk Commander recovery tool
Disk Commander can also be useful for recovering entire deleted directories. In this instance, it was just what the doctor ordered, since it was able to scan the disk for recently deleted partitions and completely recover them (see Figure 2).
Figure 2 Recovering a disk partition with Disk Commander
Partition recovery is not foolproof, but on recently deleted or lost partitions—and using a tool like Disk Commander—it stands a decent chance of success. Of course, this error may be caused by other problems (usually hardware). The Knowledge Base article "'Operating System Not Found' or 'Missing operating system' error message when you start your Windows XP-based computer" discusses the topic a bit further. As with a BIOS problem, if you have a hardware issue that prevents the disk from even showing up, there isn't much you can do with DaRT or any other tool.

Boot Loader Is Missing
If your system is running Windows Server 2003 or earlier, a boot loader missing error will reference NTLDR; if you've upgraded or you dual boot with Windows Vista or later, it would be BOOTMGR. Basically, the message depends on which boot loader the boot sector is pointing to.
This error doesn't generally just happen, though I have heard of it occurring in much the same manner as I described regarding the lost partition. The main thing to remember is that all you need to do is boot to Windows PE and replace the NTLDR and NTDetect.com files from a CD or a share with Windows on it. You want to ensure the replacement files are from Windows release, as new or newer than those you are replacing (use the latest copy from the latest service pack that is available; these files are backward compatible). In the case of Windows Vista or Windows Server 2008, you should copy the BOOTMGR file and make sure that your Boot directory (hidden by default) is also there.
The article "An NTLDR or NTDETECT.COM Not Found Error" provides more information. You may notice that many of the Microsoft Knowledge Base articles suggest using the Windows Recovery Console, and some, such as the one at "How to use the Bootrec.exe tool in the Windows Recovery Environment to troubleshoot and repair startup issues in Windows Vista," can be quite useful.
My recommendation, however, is to use Windows PE in this scenario. Though there are a few things the Recovery Console can do more easily than Windows PE, the overall power and flexibility of Windows PE generally make it easier for you to get things up and running.
I recommend that you run chkdsk after completing either the partition or boot loader recovery to ensure that you don't have any further disk damage that might surface later.
In the case of file damage due to power outage or other issues, I also like to ensure that there aren't any Self-Monitoring Analysis and Reporting Technology (S.M.A.R.T.) disk monitoring errors logged to the event log. Anything that causes enough data loss to wipe out a partition or files can quite easily lead to bigger problems down the road.

System Boots—then Hangs
This one has a symptom that many encounter, but it rarely reflects the actual cause. Very often, you will see agp440.sys named as a culprit for the hang. But that driver is but an unwitting victim. It's simply the last driver loaded, as you can see in Figure 3, which shows a system booting into Windows Safe Mode right before Windows starts.
Figure 3 Drivers loading in Windows Safe Mode
Some articles I've read—including some Knowledge Base articles—suggest that disabling that driver is the best way to get a system working again. Not so. To get your system working again, here's what I suggest:
  • Start by removing any new hardware you have recently installed. Do this selectively, one piece at a time.
  • Try booting into Windows Safe Mode to see if that works. If it does, most likely it's a third-party driver causing the problem (since third-party drivers aren't started during Safe Mode).
  • Use either Windows PE or ERD Commander (from the DaRT) to disable any newly installed drivers. See the sidebar "Disabling Drivers or Services" for more information.
  • Try using the Last Known Good Configuration (discussed below) to find out if a recent driver change, not reflected in the last working configuration set, might be the source of the problem.
If these four options do not get you up and running, you may need to perform a Windows repair installation (booting from a CD that is a service pack match of your malfunctioning Windows installation), or you may need to reinstall Windows.
Disabling Drivers or Services

ERD Commander and Windows PE both allow you to disable drivers or services that are hanging Windows at boot, albeit with different levels of difficulty.
To use Windows PE to enable and disable problematic services, first boot to Windows PE (be sure you have necessary storage controller drivers for the system being booted). Start up the Windows Registry Editor (regedit.exe) and select the HKEY_LOCAL_MACHINE hive.
From the file menu, select Load Hive, and browse to C:\Windows\System32\Config\system (adjusting to fit your own Windows path), and specify a name to use for the hive while editing (the name doesn't matter). Browse into that new key\CurrentControlSet\Services\servicename and take note of the Start value, which can be 0-4:
0—Boot start: started by the operating system loader first.
1—System start: loaded during kernel startup after boot start drivers.
2—Auto start: Service Control Manager (SCM) starts these next.
3—Demand start: started on demand by the SCM.
4—Disabled: will not load.
Set the service or driver you need to disable to 4. Do this carefully—some drivers have interdependencies, and if you disable them and not their dependencies, you may crash your system, not just hang it. When you're finished, unload the registry hive and reboot your system. The driver or service should no longer hold up the boot process.
Now, if you have the MDOP, DaRT makes this truly easy. You can simply boot it up, connect to a Windows installation, and via the Services and Drivers application shown in Figure A, you can enable or disable services or drivers through a very simple UI.
Figure A An easy way to disable drivers or services

Windows Safe Mode and Restore Points
Of course, if your system is hanging or crashing at start up, booting into Safe Mode may help, especially if you don't have a copy of Windows PE handy and if Safe Mode will start. On client versions of Windows, you may also be able to use Restore Points to recover your system, assuming you have them enabled and that they have protected the files you need to restore (they don't protect everything on Windows XP).
It's important to note that if you are using Windows PE to recover your Windows Vista system, be sure that you only boot it with Windows PE 2.0 or later. Booting with earlier versions will corrupt your Restore Points, rendering them unusable. (This is due to the way that System Restore Points on Windows Vista watch for disk writes. Windows PE 1.x does not know how to interact with the system without causing writes that lead to corruption of the restore points).

System Crashes before Windows Finishes Loading
There are two classes of problems that often lead to system crashes before Windows finishes loading. The first is registry corruption. This is more common with earlier versions of Windows, as well as on systems that have had an abrupt system restart. Typically, if registry corruption is preventing your system from starting, it is just a small section of the registry that's the problem. With Windows Vista, you have two copies of the registry located in the \windows\system32\config\regback folder, both of which are less than 24 hours old, in most cases. You can try replacing the registry files with these.
Alternatively, using the approach I described earlier to load the registry offline under Windows PE will sometimes solve it. The Windows Registry Editor has logic built into it that attempts to repair corruption when encountered. This corruption repair was good in Windows XP, and it's even better in Windows Vista and Windows Server 2008.
If you can't fix the problem via Windows PE 1.6, try either using Windows PE 2.x or copying the registry off to a Windows Vista system, repairing it using methods mentioned earlier, and then copying it back. Unfortunately, there is often not much you can do if this doesn't recover the system. You can try performing a repair installation for earlier versions of Windows, but in general I would recommend performing a reinstall. Again, you should perform a chkdsk to verify that there are no other problems.
Probably the most common issue leading to system crashes (blue screens) before Windows has started is drivers. I recommend preparing a DaRT CD and using the Crash Analyzer (see Figure 4), an easy-to-use mechanism for analyzing Windows crash dumps—even on an unbootable system.
Figure 4 Analyzing a dump file with Crash Analyzer
If you don't have the DaRT, or don't have it handy, you can also use Windows PE and the Debugging Tools for Windows to see where the general point of failure may be. Note that a crash dump may be corrupt or may be inconclusive, but quite often it will point you in the right direction. Here are the steps to follow:
  1. Copy the most recent *.dmp file(s) from the crashed system via Windows PE. These files are located under %windir%\minidump\. If you have full dumps enabled, they will be in the Windows directory itself and will be at least as large as the memory on your system (so they can be quite sizable).
  2. Start up the Debugging Tools for Windows and, via File | Open Crash Dump, select the dump file you just copied.
  3. Set the Symbol Path to provide debugging information for Windows binaries to diagnose. Type in:
    .sympath= SRV*C:\SYMBOLS\*http://
msdl.microsoft.com/download/symbols
    and then click Enter.
  4. Type .reload and click Enter.
  5. Type !analyze –v and click Enter.
  6. The result will most likely point out the driver (or drivers) involved.
Note that you can often get a false positive that points to one driver when the cause is actually another, so you may want to do a little Web searching to see the opinions related to your scenario. Often others will have encountered the same problem with that driver before. You can use the steps described earlier to disable the driver(s) or boot into Safe Mode to see if it makes a difference.

Last Known Good Configuration
The Last Known Good Configuration, shown in Figure 5, can often help if your system is having problems. It contains a copy of the last set of services and drivers that booted successfully. But it isn't guaranteed and won't help if you have registry corruption. And it can only make a difference if Windows is crashing before Win32 starts (before you see the Windows desktop start initialization). Otherwise, that startup will be considered "good," and if Windows crashes after that point, it won't be recoverable this way.
Figure 5 Choosing the Last Known Good Configuration may allow your system to start

System Crashes after Windows Starts
If your system is crashing after Windows has started, the cause may be a driver, but it can just as easily be hardware. To diagnose, retrieve the .dmp file, as described earlier, and see what kind of clues you find.
Depending upon the direction Windbg points, you may try disabling services or drivers, or you may want to examine any newly added hardware. Memory (particularly newly added memory) can often cause crashes, as can a disk that is not working as it should. You may need to connect with your OEM or your software ISVs to see if they have seen any results like yours, or search the Web for similar situations.
If you suspect memory is the source of the problem, make sure you try the Windows Memory Diagnostic (which is included in Windows Vista and Windows Server 2008). The Memory Diagnostic tool is a very comprehensive way to test your system's RAM if you suspect problems that are leading to crashes.
While it's certainly frustrating when Windows doesn't boot correctly, the causes can generally be categorized into a pretty narrow group of problems. Understanding where and how to look when this occurs can often help you get Windows back up and running, without needing to revert to a full reimage.

Wes Miller is a Senior Technical Product Manager at CoreTrace (CoreTrace.com) in Austin, Texas. Previously, he worked at Winternals Software and as a Program Manager at Microsoft. Wes can be reached at technet@getwired.com.


.SidebarContainerA { width: 380px; height: 165px; float: right; border: 2px solid #008080; padding: 10px 20px 0px 20px; background-color: #e1e8f5; margin: 20px 0px 20px 10px; } .floatleft1 { float: left; margin: 15px 15px 15px 0px; width:400px; font-weight: normal; font-size: 14px; color: #323e58; font-family: "Segoe UI", Arial; } .floatleft2 { float: left; margin: 15px 0px 15px 0px; width:415px; font-weight: normal; font-size: 14px; color: #323e58; clear: right; font-family: "Segoe UI", Arial; } .floatright3 { float: right; margin: 15px 0px 15px 0px; width:415px; font-weight: normal; font-size: 14px; color: #323e58; font-family: "Segoe UI", Arial; } .floatleft4 { float: left; margin: 15px 15px 15px 0px; width:300px; font-weight: normal; font-size: 14px; color: #323e58; font-family: "Segoe UI", Arial; } Security Watch Subjects and Security Principals
Jesper M. Johansson

Contents
The Subject/Object/Action Tuple
Types of Security Principals
Services
Wrapping Up
At the most basic level, everything in security boils down to subjects and objects. Objects are the things you protect and subjects are the things you protect objects from. These two constructs are used in authentication (proving who you are), authorization (granting access to something), and auditing (tracking who accessed what). Fundamentally, these concepts are very simple, as shown in Figure 1.
Figure 1 A user attempts to read a file
Subjects are things that do things, while objects are the things they do them to. Moreover, sometimes the objects to which subjects do things are other subjects.
Windows supports some immensely rich semantics when it comes to security and has greatly extended the definitions of subjects and objects. A subject can be much more than just a user, and the representation is far more complex than just a basic user identifier.
In Windows parlance, a security principal encompasses not only the typical subject (what you would think of as a user) but also groups and computers. A security principal is anything that can be assigned a security identifier (SID) and given permission to access something.
In this installment of Security Watch, I am giving an introduction to how subjects are represented and used in Windows.
The Subject/Object/Action Tuple
Managing security very often comes down to the subject/object/action tuple. The subject is the actor that is trying to perform some action on an object. For example, a user may try to access a file, as shown in Figure 1. When a user tries to read the file, the operating system needs to check whether permissions are set on the object (the file) that permits the subject (the user) to perform the action (read) on that particular object. If the permissions are in order, the access request succeeds. If the permissions are not in order, the access request is denied. So far, this is all very simple.
Case Matters
In Windows literature, when you see the words "Administrator" or "Administrators" with a capital "A," this typically refers to the user or the group, respectively. When you see it spelled in all lowercase—"administrator"—it refers to some user account or person that has administrative privileges. The same holds for other entities, such as "Guest" and "guest."

Types of Security Principals
Subjects—or security principals, as I shall henceforth refer to them—in a Windows-based system, and by extension a Windows-based network, can be much more than just users. However, the user is still the most basic concept.
Users A user is some distinct entity that logs on to a computer. Fundamentally, all security principals are at least somewhat related to users. In Windows, there can be two types of users: local and domain. A local user is defined in the local Security Accounts Manager (SAM) database on a computer. Every Windows-based computer has a local SAM, which contains all the users on that computer.
It is commonly thought that domain controllers (DCs) do not have a local SAM and hence no local users. This, however, is incorrect. Even a DC has a local SAM, but the accounts in its SAM can only be used in Directory Services Restore Mode.
The local SAM always contains at least two user accounts: the Administrator and the Guest, and the Guest account is always disabled by default.
On all versions of Windows Server 2008 (with the exception of Windows Small Business Server 2008), the Administrator account is enabled by default and you must use this account the first time you log on to the computer. On Windows Vista, the Administrator account is disabled by default and can only be used under very restrictive circumstances.
In either case, you should create at least two accounts for each person that will administer a given computer. If you are subject to almost any kind of regulation (and you probably are), this is a requirement. For each user, one account should be the user's own personal administrative account. The other account is the user's personal non-administrative account for non-administrative tasks.
Users Who Are Not Local Are Domain Users These users are defined on the DCs for the domain. The difference between local and domain accounts is primarily the scope of the accounts. Domain accounts can be used on any computer in the domain while local accounts are valid only on the computer on which they are defined. Furthermore, domain accounts can have a considerably larger number of properties associated with them as compared to a local account (see Figures 2 and 3 for comparison).
Figure 2 Properties window for a local account
Figure 3 Properties window for a domain account
Domain accounts have a richer set of semantics, covering a variety of attributes in an organizational environment, such as telephone numbers, management relationships, and e-mail accounts. Domain accounts are also far more useful in a network because they can be used and assigned permissions on computers across the network. In addition, defining accounts in the domain simplifies management as now you only have to maintain accounts in one place.
Computers A computer is just another type of user. In Active Directory, this is particularly true and is borne out by the inheritance model. The inheritance structure leading to a computer is outlined in Figure 4.
Figure 4 The inheritance hierarchy in Active Directory showing how users and computers are related
There are several very interesting things illustrated in Figure 4. First, as you can see, all classes in Active Directory derive from a root class called Top. In fact, even Top is considered a subclass of Top. Second, the User class is derived from the organizationalPerson class. Third (and this is the most interesting point), the Computer class is derived from the User class. In other words, in object-oriented parlance, a Computer is a type of user. Anthropomorphizing computers in this way does actually make a lot of sense, though, because computers need to be treated as subjects as well and have almost all the same attributes as a person.
Groups A subject, you will recall, is something that attempts to access an object. The operating system verifies this access attempt by checking the permissions of the object. Very early on, OS designers realized that it would be very unwieldy to assign permissions to every single object for every single user that needed it. To solve that problem, the designers permitted users to be members of groups. This allows you to assign permissions to groups in addition to users.
A group may not be a user, but a group is still a type of security principal because it can have an identifier, just like users and computers. In Windows, a user can be a member of many groups and an object can have permissions assigned for many groups. Nested groups are also permitted, with some restrictions.
A non-domain controller has only two types of groups, built-in groups and local groups that the administrator has defined. In Active Directory, however, you will find six different kinds of security groups: built-in Domain Local groups, built-in Global groups, built-in Universal groups, user-defined Domain Local groups, user-defined Global groups, and user-defined Universal groups.
Domain Local groups can only be assigned permissions to resources within the domain where they are defined. They can, however, contain users, universal and global groups from any trusted domain or forest, and Domain Local groups from their own domain.
A Global group may only contain users and global groups from the domain in which it was defined, but it may be assigned permissions to resources in any domain in the forest the domain is part of or any trusting forest.
A Universal group may contain users and Universal and Global groups from any domain. A Universal group may be assigned permissions to resources in any trusting domain or forest. In other words, a Universal group is a kind of hybrid between Domain Local and Global groups.
While a workstation comes with only two groups by default—Administrators and Guests—a domain comes with a relatively large number, of all three types. Figure 5 shows the default groups in a domain. All are designated as Security Groups, which means they can be assigned permissions. (Security groups should not be confused with Distribution Groups, which are used by Microsoft Exchange Server to group users into e-mail lists. Both are defined in Active Directory.) The local groups that exist on all Windows-based computers are defined in Active Directory on DCs.
Figure 5 Default groups defined in the Users container in Active Directory
As with DCs, some non-DCs have large numbers of groups as well. Figure 6 shows 16 built-in groups on a test computer. The exact number of groups on any given computer will differ depending on the roles you've installed on that computer.
Figure 6 Built-in groups on a non-DC
If you were to attempt to assign permissions to an object, you would find still more groups than what I have shown so far. In fact, on a basic DC, you would find no fewer than 63 groups and built-in security principals, shown in Figure 7.
Many of the 63 groups that are shown in Figure 7 are abstract concepts, which are sometimes known as "special identities," that represent a dynamic group of security principals. They are also sometimes also referred to as Logon Groups.
Logon Groups Logon groups are groups that represent some dynamic aspect of a security principal, such as how a user or other security principal has logged on. For example, the INTERACTIVE group shown in Figure 7 includes all users that logged on to the console of the computer and via Terminal Services. By contrast, the NETWORK group includes all users that logged on via the network. By definition, a user can only be a member of one of these groups at a time and membership in them is assigned at logon time. You can use these groups to grant permissions to all users logging on a certain way, but you cannot control who becomes a member of those groups.
Figure 7 A basic DC has no fewer than 63 groups and built-in security principals
There are other groups of this nature, as well. Of particular note are the Everyone group and the Authenticated Users group. The Everyone group includes, as the name implies, every user accessing this computer—with the exception that, starting with Windows XP, completely anonymous, unauthenticated users are not included. In other words, the infamous NULL user is not included in Everyone on any supported Windows-based operating system. Guests are included, though.
The Authenticated Users group, while also populated dynamically, includes only those users that are actually authenticated. Thus, guests are not included in Authenticated Users. That is the only difference between these two groups. But since the only guest account that exists on the operating system is disabled, there is no functional difference between Authenticated Users and Everyone unless you have taken manual steps to enable the Guest account, in which case, presumably, you want Guests to be able to access resources, and therefore need the Everyone group intact.
In spite of this, many administrators have lost many hours of sleep over the fact that "everyone in the world has permissions on my server" and have taken very drastic steps to modify permissions to rectify this situation. Typically these modifications have completely disastrous results. You have no reason whatsoever to try to replace permissions for Everyone with Authenticated Users. Either you want guests to have permissions to your computer and you enable the guest account, or you do not and you leave the guest account disabled. If you do want guests to have permissions, you need the permissions for Everyone. If you do not, the Everyone group will not be any different from Authenticated Users.
Some people argue that making these changes are "defense-in-depth" changes. That would be true if you define "defense-in-depth" as "changes you cannot justify any other way." The fact is that such modifications provide little or no security improvement while carrying a very large risk. Leave the defaults alone.
If that argument was not persuasive enough, I direct you to Microsoft Knowledge Base article 885409 ("Security configuration guidance support"). It states, in a nutshell, that wholesale permissions replacement can void your support contract. When you do that, you basically build your own operating system and Microsoft can no longer guarantee that it works.
It is also worth pointing out the difference between Users, which is a built-in group, and Authenticated Users. The difference is the rather obvious fact that Authenticated Users includes every user that has authenticated to the computer, including users in different domains, users that are members of local groups other than Users, and users that are not members of any groups at all (yes, such a thing is possible). This means the Users group is far, far more restrictive than Authenticated Users.
In spite of this fact, I have seen organizations destroy their networks attempting to replace permissions for Users with permissions for Authenticated Users in an attempt to "harden their systems." I have argued endlessly with clueless PCI/DSS Auditors who claim that the payment card industry requires you to replace all permissions for Users with Authenticated Users. This simply is not true.
I have also defended organizations around the world from consultants who seem to view wholesale access control list (ACL) replacement as a great way to rack up billable hours. Needless to say, you can expect any attempts to do wholesale replacement of Users or Everyone with Authenticated Users to be largely unsuccessful with respect to both security and stability.

Services
Windows Vista and Windows Server 2008 support one new type of Security Principal: a service. To understand how these entities are valuable, consider the ongoing debate about host-based firewalls. Many people, supported eagerly by the vendors selling the products, argue that host-based firewalls must filter outbound traffic to be worthwhile because this protects the remainder of the network from a compromised computer. More objective minds point out that if a computer is compromised, the malware is already present on the computer and thus the malware has the ability to bypass or disable the host-based firewall entirely.
To understand why this is the case, consider two services running as the same Security Principal. Service A is permitted to communicate through the firewall, Service B is not. If Service B is compromised, the attacker could bypass that restriction simply by taking over another process running as this Security Principal, Service A, for instance, and communicate from that process instead.
To address this problem, Microsoft needed a way to apply permissions to a process, or more specifically, to a service. For this purpose, services became security principals in their own right. And as a result, each service now has an identifier that can be used to apply permissions against. You can run the "sc showsid" command from the command line to see the service SID for any service.
With Service SIDs, you can restrict access to resources for specific processes, as opposed to only restricting access for specific users. This change makes outbound host-based firewall filters meaningful, in some situations. The exact nature of those situations is beyond the scope of this discussion, but if you're interested in reading more about this, I suggest you read the article I wrote about the Windows Vista firewall in the June 2008 issue of TechNet Magazine (see "Managing the Windows Vista Firewall").

Wrapping Up
Security principals underlie so much of Windows security that it is essential for any administrator to have at least a basic understanding of how the various types of Security principals work and how they are used. Only by understanding these topics can you effectively create a security strategy that effectively uses these security principals. This knowledge will be handy when you must withstand pointless arguments from people who do not thoroughly understand security principals and expect you to endanger the health of your network with unnecessary and inappropriate changes.
This column is based on material in my book Windows Server 2008 Security Resource Kit (Microsoft Press).

Jesper M. Johansson is Principal Security Architect for a well-known Fortune 200 company, working on risk-based security vision and security strategy. He is also a contributing editor to TechNet Magazine. His work consists of ensuring security in some of the largest, most distributed systems in the world. He holds a Ph.D. in Management Information Systems, has more than 20 years experience in security, and is an MVP in Enterprise Security. His latest book is the Windows Server 2008 Security Resource Kit.


.img2 { float: left; margin: 10px 15px 10px 0px; width:444px; font-weight: normal; font-size: 14px; color: #003399; font-family: "Segoe UI", Arial; } .clearboth { clear:both; } Sustainable Computing How to Plan Your Server-Consolidation Strategy with System Center
Frank Koch and Michael Walsh

Contents
Why Consolidation Matters
Homogeneous Consolidation
Heterogeneous Consolidation
Consolidating with System Center
Conclusion
The best way to save energy is to avoid unnecessary energy consumption. While this principle of Green IT may seem obvious, a recent study by the Uptime Institute suggests that many IT departments fail to implement solutions that adhere to this principle. In fact, the study found that 10% to 30% of servers in the data center consume energy without serving a function.
Microsoft System Center, coupled with virtualization software, can help you avoid unnecessary energy consumption and reduce IT costs through physical server consolidation.

Why Consolidation Matters
Say there is a business group that requires a new application or service. Until recently, many IT professionals would simply install a new physical server to handle the task without first checking to see if the application could run on an existing box. Why? Because the IT pro learned through experience that it was far easier and cheaper to procure a new physical server than to reprovision an existing server to handle multiple functions.
But today, energy costs for operating a server are often higher than the acquisition costs of the physical hardware, and so this reasoning no longer holds true. Now the IT pro requires solutions that consolidate physical services in order to improve efficiency, reduce wasted energy, and cut costs. And this is where Microsoft System Center comes into play—it offers a variety of tools for implementing consolidation strategies for both homogeneous and heterogeneous workloads.

Homogeneous Consolidation
Nowadays, consolidation of a homogeneous workload is very easy. Hardware can handle much greater load and user access than in the past. With 64-bit, multi-core processor technologies; Gigabit network cards; and vastly more RAM and disk space than in the past, a single server can often handle a load that once required several servers. This is true especially for file, print, Web, and terminal servers.
However, as with many technology solutions, the solution itself creates a new problem: the new higher load can exponentially increase the risks for system failure. Therefore, you need a complex system-monitoring solution capable of providing much deeper information than a simple system ping. Microsoft System Center Operations Manager (OpsMgr) provides a robust system-monitoring solution, supporting Windows and Windows applications as well as cross-platform monitoring.
It allows you to work with abstract IT services (such as messaging) instead of single systems (such as one dedicated Exchange Server). This enables you to take full advantage of consolidation efforts.
In addition, OpsMgr provides both service and performance monitoring. This lets you check if the network is saturated, whether the disk subsystem cannot handle the load, if the memory is getting low, whether the processor is overloaded, and so on. All this data is transferred into a data warehouse for long-term archiving to allow baseline creation and comparison of system load over time.
IT departments, therefore, can implement easier and safer consolidations of homogeneous workloads with the assistance of Microsoft System Center.

Heterogeneous Consolidation
The consolidation of heterogeneous workloads is far more complex. The dependencies between applications are harder to predict, which is why people have often been afraid to attempt heterogeneous consolidation.
Advancements in virtualization software, though, have provided a technological solution that makes heterogeneous consolidation simpler—enabling multiple server instances to run on the same hardware simultaneously without affecting one another. Such software enables IT professionals to easily consolidate several machines running at a low utilization rate between 5% and 25% into a single physical box, increasing the overall utilization of the box by as much as 80% or higher. Given that several independent studies show that most servers today are running at a utilization rate of less than 20%, this presents an opportunity to dramatically reduce the number of physical servers needed per organization.
However, virtualization software alone does not provide a comprehensive heterogeneous consolidation solution. This is because virtualization software only solves one of the two obstacles to homogeneous consolidation—the ease of implementation. The safe execution of homogeneous consolidation via virtualization is equally important. Otherwise, consolidation will simply lead to more systems-maintenance issues and will negatively impact the availability of servers and the integrity of data. Therefore, you need a powerful systems-management solution.

Figure 1 Converting a physical machine into a virtual machine
Consolidating with System Center
The first step to consolidation is to find out which servers can and should be virtualized.
Ideal candidates will have complementary low utilization levels. So you need to plan your implementation strategy based upon server performance over time.
Performance monitoring with Microsoft System Center can help you visualize and analyze each server's performance over time, collecting data with unique performance counters per system or system group. With this data, you can easily generate predefined reports for virtualization candidates based on common criteria, such as disk, processor, and memory usage. This offers insight into which physical servers possess low utilization rates based upon patterns of use and activity. This is the key data you'll need for planning an optimal consolidation strategy.
Figure 2 Customizing host ratings for a virtual machine
The next step is to convert the servers into virtual machines and aggregate several of them on the same physical box.
The conversion of servers is simplified with the use of Microsoft System Center Virtual Machine Manager 2008 (VMM). To convert a physical machine into a virtual machine with VMM, all an IT Professional has to do is start a wizard and pick the right physical box. VMM will check the machine for any potential issues that might occur during the process and then convert the machine on the fly while the system is running, as shown in Figure 1. (This feature is available for current versions of Windows Server.) The machine is then available in the standardized Virtual Hard Disk (VHD) format and can be placed on any virtualization hosts, such as Hyper-V or Microsoft Virtual Server 2005 R2 machines.
While the physical to virtual conversion is nothing spectacular these days, the actual placement of the virtual system on the ideal host is a unique feature of VMM. The PRO (Performance and Resource Optimization) feature is utilized here. By combining the knowledge of VMM with OpsMgr, the ideal host for virtual machine combination is selected, and the decision is dynamically reviewed in case the load scenarios are changing. (You can customize how ratings are assigned, as shown in Figure 2.)
PRO analysis will select the appropriate combination of guest systems to avoid processor, disk, or memory overload of the host systems. This helps to avoid that key concern that heterogeneous consolidation will result in the combination of several memory-intensive applications on the same host or guests, causing heavy disk I/O or processor needs.

Conclusion
With OpsMgr and VMM, Microsoft System Center can help you achieve a combination of complementary utilization rates that will add up to an optimal load on components—without risking one bottleneck bringing everything down. OpsMgr provides service and performance monitoring of physical boxes as well as your virtual servers, regardless of whether they are running Windows Server or another supported OS, including VMware ESX.
Meanwhile, VMM makes management of large virtualization farms (with hundreds of hosts that may even be distributed over several locations) as straightforward as managing a single box. And again, this includes non-Microsoft virtualization technologies, such as VMware ESX.
In the end, you can consolidate server farms down to the minimum (ideal) number of physical hosts your environment needs. And this will reduce the amount of energy being consumed by your infrastructure.

Frank Koch is an Infrastructure Architect Evangelist at Microsoft. He resides in Germany.
Michael Walsh is the Senior Environmental Communications Manager at Microsoft. He can be reached at micwalsh@microsoft.com or walshtechnet@live.com.


.SidebarContainerA { width: 380px; height: 300px; float: right; border: 2px solid #008080; padding: 10px 20px 0px 20px; background-color: #e1e8f5; margin: 20px 0px 20px 10px; font-family: Verdana, Arial; font-size: 12px; line-height: 16px; color: #333333; } .bullet { background-image: url('http://i.technet.microsoft.com/dd314382.bluebulleta.gif(en-us).gif'); padding-left:15px; background-repeat:no-repeat; background-position:0px 5px; } Field Notes What On Earth Is Green IT?
Jim Lynch

With all the Buzz about climate change, energy conservation, carbon footprints, and environmental impact, it's easy to get lost in the noise and assume that there's little or no clear signal to be had. In this column, I'll highlight some simple IT upgrades that can provide both environmental and cost-cutting benefits.
Change Power Settings Probably the easiest measure you can take is to change the power management settings of all end-user computers to automatically go to "sleep" after 15 minutes of no use. This is a no-cost upgrade that IT departments can manage on a network system level. PCs are now designed to sleep while remaining on networks to prevent loss of data or connection. Using such power management features on your company computers saves, on average, nearly half a ton of CO₂ and more than US$60 per PC per year in energy costs.
Replace Older Computers Not all computers are the same in terms of their power usage; for instance, the average laptop consumes one-fifth the energy of a desktop PC. Also, the new generation of microprocessors are speedier and use less energy. As your company retires older computers, it should replace them with energy-saving laptops and desktops that are now available in nearly all cost brackets. The primary criteria for energy-efficient computers is Energy Star 4. Modern Energy Star-compliant PCs or laptops use 15% to 25% less energy on average than a standard new computer.
Energy-Saving IT Resources

Are You an Accidental Environmentalist?" by Preston Gralla
Energy Star-Compliant Computers

"Eco-Responsible Server Design" by Subodh Bapat
"How Virtualization Software Can Turn One Computer into Several" by Kevin Lo
Logicalis Virtualization Energy Savings Calculator

"10 Simple Steps to a Green Data Center" by Dave Douglas

Switch to Energy-Efficient Servers Subodh Bapat, Vice President and Distinguished Engineer at Sun Microsystem, is one of the notable experts in the field of sustainable computing. In a recent article on eco-responsible server design, he wrote that the cost of power as a percentage of overall IT spending ranges from 20% for small enterprise datacenters to about 80% for very large hosting and collocation providers. The largest resource hogs are the servers, storage, and switch infrastructure. With the rising cost of electricity, he estimates that the power and cooling costs required to run a low-cost server will soon outweigh the acquisition cost of the hardware.
Virtualization Virtualization is a software-based solution that takes a single-server environment and creates the illusion of multiple environments. In doing so, it cuts datacenter power consumption up to 80%. Virtualization has the additional benefits of server consolidation, improving ease of management, reducing backup and recovery time, improving testing software configurations, and saving space in the server room.
The main virtualization software companies are VMware, QEMU, and Microsoft. Their software packages can enable a single server to do the same work as several servers. The total cost of ownership and payback of virtualization is dramatic and immediate. According to Energy Star, the energy costs for running a server for a year quickly exceeds the price of acquiring it, so replacing up to 15 servers with one server pays for the software investment almost instantly.

Jim Lynch is the Program Director for computer recycling and reuse at TechSoup.org, a San Francisco-based nonprofit that supplies hardware and software to charities around the world. Reach him at techsoup.org/greentech.


Field Notes IT's Surprises
Romi Mahajan

Long before the age of IT, Aristotle said that the "secret of humor is surprise." Anyone who enjoys humor knows this to be true just as anyone familiar with good IT would have to fundamentally change the formulation with regard to IT, as "the secret of IT is no surprises." But hold on. Would one really have to change it, or is IT actually like humor in that both gain their sustenance from the element of surprise? I'll address that subject in a few moments, after providing some basic observations from a recent discussion in which I participated.
At the IT Connections 2008 conference, I was a panelist on the topic of "What Keeps CIOs Up at Night?" The entire hour was filled with thoughtful and brisk discussion, but most interesting was that the "usual subjects" (such as aligning IT with business or common scorecards) were dispensed with during the first 15 minutes. Instead, we began discussing basic IT pain points such as security, privacy, and the horrible possibilities of CIOs waking up in the morning to find the names of their companies all across the front pages, victims of breaches. The conclusion was that the CIO would love to avoid the public eye.
We also discussed the quotidian issues CIOs face—ranging from staff reductions to IT automating itself out of existence, from dealing with bean-counting CFOs to having to provide support for users who expect that all will be taken care of for them. The underlying theme, however, was about the importance of connecting IT to the business. And while there were some people in the room who felt they did it well, most felt dejected. "People don't understand our importance," lamented one person in the audience. Another mentioned how executives in her company want her to automate all IT, indicating to her that they significantly underestimate the complexity of what her team does.
Someone from a 100-person company mentioned that in these difficult economic times, his company is laying off 10% of its workforce. The panelists sighed in empathy, but these sighs gave way to facial contortions when he added that his IT staff had to be pared by one-third. "From three to two. … I will have only two people running IT," he said in a voice indicating that he had been through this before.
"They don't get what we do," boomed a voice from the back.
We three panelists came to the same conclusion at once—all of the problems we were discussing (from proving business value to bridging the culture gap between IT folks and other employees) is in large part reducible to a home truth, namely that good IT is invisible. Good IT happens when users don't even know IT exists.
We had begun this discussion extolling the virtues of avoiding the public eye, and here we were lamenting the fact that so few people actually see what we do. Maybe our certainty about good IT being invisible is, as are so many home truths, actually not true at all.

Strutting IT's Stuff
I recommend an immediate guerilla marketing plan to make IT much more visible. Here are some tactics I suggest:
  • Send out a monthly update to your workgroup (if you are in a large company) or your entire company (if your enterprise is 500 people or fewer) about the things your team does on a monthly basis. Offer real numbers. The IT manager in my company recently sent out a very powerful e-mail message itemizing the number of distribution lists delivering vital targeted information to interested people, the number of messages per month that attempt to infiltrate unsuspecting inboxes under false pretenses, the number of MBs it takes to back up all files so that there's no bloodshed when a server crashes, and so on.
  • Instead of waiting for inbound calls to your help desk, have each help desk member make one outbound call to a user each day, just asking if all is well or if the person needs any help.
  • Present what you do at monthly staff meetings.
  • Create the IT Narrative: tell a story of what you do and have all IT personnel discuss their roles in terms of that narrative.
These are just a few examples of things you can do to make your presence known.
The importance of good IT is unmistakable; therefore, the need to sustain and nurture IT, too, is unmistakable. We have to overcome the invisibility of IT and surprise people who gain so much from IT, all the while not understanding it. So discussing IT in the Aristotelian formulation this column started with might be a good idea.
The secret of good IT is, indeed, surprise.

Romi Mahajan is Chief Marketing Officer of Ascentium Corporation. Before joining Ascentium, he spent 7+ years at Microsoft where his last role was as Director of Technical Audience and Platform Marketing. Romi is widely published in the areas of technology, politics, economics, and sociology.


Windows Confidential Last Check-In Chicken
Raymond Chen

As a project winds down, the team often plays an informal game known as Last Check-In Chicken. In this game, teams "compete" in order to avoid being responsible for the last change to the product because, in principle, if it weren't for your bug, the project could have shipped a day earlier. (This is rarely actually true, but it is, nonetheless, the motivation for the game.) The competition is purely virtual—nobody really keeps score, and the "winner" is soon forgotten.
Unless you're that winner.
One of the senior members of the Windows team admitted to me that he won the game twice in a row back in the earlier days of Windows. The second time was particularly noteworthy because the change was made after manufacturing had already begun. The entire manufacturing run had to be recalled and restarted.
An attempt to make it three in a row was thwarted, however. The third attempt ended up being the second-to-last check-in rather than the last. The final check-in was made by another one of my colleagues who not only made the final check-in to Windows 2000 but then started a new dynasty by also making the final check-in for Windows XP.
One of the ironies of the game of Last Check-In Chicken is that it is often the people who have their act together (and, therefore, the people whom you'd least expect) who end up winning. This isn't because their code is inferior, mind you. By virtue of being well prepared, they're in a much better position to make that final check-in, even though it's not in a component for which they normally have responsibility.
Making a late check-in is a major undertaking because the insulation that normally separates the developer from the master tree is no longer there. Under normal circumstances, a check-in goes like this:
  • You make your check-in to your subproject.
  • Your subproject's build lab churns on the change overnight and produces a build in the morning.
  • Your subproject's test team pores over the code for a week or more before giving the OK for the check-in to be released to the trunk.
Doing it in this way, it is much more likely that if you have made any mistakes, they will get caught before they become an official part of the project. Some subprojects are so large that they apply this principle recursively, creating sub-subprojects that verify their changes independently before they are released to the larger subproject to which they belong.
But when you're in the project endgame and the release management team decides to take your fix, the clock is ticking and there's no time for the leisurely multi-week change verification process. Scattered throughout the project are developers who regularly build the entire project (not just their subproject), from the make clean all the way to creating disk images on a private release server and verifying that build constraints are satisfied. (For example, one of the things they would do is make sure the CD image isn't too big to fit on a CD!)
If a team finds itself in a situation where it needs to make a last-minute check-in, it will typically look to whichever team member is well prepared—if there isn't such a person, the team will then enlist the assistance of someone from a nearby team who is well prepared.
Now a little game of Cyrano takes place. The team provides the change to the well-prepared developer, and the developer builds the disk images, verifies the build constraints, and then points the test team to the private release server. If the test team happens to find a problem, the development team comes up with a new fix and hands it to the well-prepared developer, who restarts the cycle.
In other words, the well-prepared developer acts as a one-man virtual build lab for that team. Once everybody is satisfied, the well-prepared developer makes the check-in. This is why those who are well-prepared end up winning the game of Last Check-In Chicken. It's not because they are on the hook for a problem but because they are ready to help those who are on the hook.

Raymond Chen's Web site, The Old New Thing, and identically titled book (Addison-Wesley, 2007) deal with Windows history, Win32 programming, and exploding coffee machines.