 TechNet Magazine July 2006

TechNet Magazine July 2006

Managing Identity: The 7 Laws of Identity

Digital identities have taken on an increasingly important role in the corporate infrastructure, as IT departments define what applications and data sources each individual user can access. But as the role of identities has grown, so has the complexity of identity systems.

Joshua Trupin Managing Identity: MIIS Gets your Directories in Sync

Trying to maintain security and identity information in a large, heterogeneous network can be difficult and complicated. And this can put your network at risk. Fortunately, Microsoft Identity

Randy Muller Managing Identity: 5 Essential Tools for MIIS

Identity and access management. These are important issues as your business implements systems that provide corporate information to employees, business partners, and customers.

Jenn Goth Managing Identity: Automate Active Directory Group Management

Group management is central to today's businesses. Groups are commonly used to control access to network resources, computers, buildings, and so on. Simultaneously, they need to grant access to

Craig Owen Managing Identity: Simplify Single Sign-on Using ADFS

Matt Steele Managing Identity: Create Custom Directories with ADAM

Active Directory Application Mode, also known as ADAM, is often misunderstood. In this article I will demystify ADAM, explain how it can be a useful tool in many organizations, and show you some valuable utilities that make it easier to use.

Brian Redmond Managing Identity: Extreme VPN Makeover

Who decided that Virtual Private Networks, or VPNs, were a good idea? With VPNs, we could let armies of mobile workers with "legitimate" business needs connect to our nice corporate

David Conrad Managing Identity: The InfoCard Identity Revolution

Keith Brown Microsoft Office: Create Scorecards For Your Business With Office

Let's assume, as I'm going to do here, that you manage a sales team tasked with meeting regular sales quotas. Team member sales are logged into your corporate database, but you have no easy way of telling your team members how well they are doing.

Mauro Cardarelli From the Editor:

Summer is finally here, and you know what that means—vacations, travel, long days by the pool sipping margaritas, without a care in the world!

Joshua Trupin Toolbox: New Products for IT Professionals

System and network administrators always seem to be looking for a better monitoring solution. By better, I mean more stable, more cost-effective, more scalable, and loaded with more features. NETIKUS.

Greg Steen Utility Spotlight: The Shared Computer Toolkit

One of the most common requests I get at my Group Policy forum, GPanswers. com, is how to take machines and "lock them down. " People want to ensure their machines can’t be broken by Joe User or Harry Badguy.

Jeremy Moskowitz SQL Q&A: Monitoring DBAs, Replicating Sprocs, and More

Your queries answered by Microsoft IT professionals.

Nancy Michell How IT Works: SMS Client-Side Software Installation

When configuring a software package for distribution in Systems Management Server (SMS) 2003, the administrator must choose the user context under which the software will be installed—either the logged-on user or the administrative context.

Steve Rachui Hey, Scripting Guy!: It’s About Time (Oh, and About Dates, Too)

You know, the Scripting Guys hardly ever wax philosophical. (We hardly ever wax our cars or our floors, either, but that’s a different story. ) When it comes to the nature of time, however, well, in that case we just can’t help ourselves.

The Microsoft Scripting Guys Inside Microsoft.com: Managing SQL Server 2005 Peer-to-Peer Replication

The Microsoft corporate Web sites rely heavily on databases, which power such high-traffic destinations as Microsoft® Update, Download Center, Communities, TechNet, and MSDN®. Microsoft. com operations has a team of 17 engineers, the SQL Server™ operations team, that manages these database systems.

David Lindquist Security Watch: Help Wanted—Need "People" People

I’m not really a people person. I’ve said so for years. My old college roommate, Joe, had a better way to put it, but the way he said it is unfortunately not suitable for print. Frankly, not being a people person is a good part of the reason I went into IT in the first place.

Jesper Johansson Field Notes: An Ounce of Prevention

All good IT pros worry about their servers. If something goes wrong it’s your problem and it’s usually a big one. Most of you stick your servers in a closet and neglect them. Unless something blows up, you may not even look at them for months at a time.

Jay Shaw TechNet Update: Resource for the IT Professional

The complete Microsoft TechNet Program provides comprehensive tools and authoritative information to help IT professionals get the most out of Microsoft products and technologies. It’s where you turn for the latest security alerts, live discussions, virtual testing labs, free tools, and in-depth articles that allow you to be more responsive, more informed, and more effective.

Windows Confidential: A Brief and Incomplete History of FAT32

Why did classic Windows 95 limit local hard drives to 2GB? Some people would lead you to believe that the FAT file system team said, "Y’know, the FAT file system supports hard drives of indefinite size, but let’s impose an artificial cap just to make people’s lives more frustrating.

Raymond Chen


 Managing Identity: The 7 Laws of Identity
Identity & Access Management Joshua Trupin

The 7 Laws of Identity

Digital identities have taken on an increasingly important role in the corporate infrastructure, as IT departments define what applications and data sources each individual user can access. But as the role of identities has grown, so has the complexity of identity systems. Since each application and resource typically has its own mechanism for handling authentication and authorization, managing this critical information can be a challenge. Fortunately, you can roll out a solution to simplify identity and access management within your organization. But before you plan your solution, you need to understand the seven laws of identity.
Chances are you're having an identity crisis, or will be soon. Identity and access management have become important components of every organization's infrastructure, but the complexity can leave you stymied. When you are designing security into your infrastructure, the worst thing you can do is assume you have to reinvent the wheel. The best thing, in actuality, is to take advantage of the knowledge and experience of those who have been through the process. There are some well-trod paths you can follow.
Microsoft TechNet shows you these paths with a series of papers and discussions that help turn the winding route into a straight-ahead journey. That help is freely available online.
But implementation isn't the only facet of identity assurance. If you move up one level of abstraction, you begin to see some universal truths about the concepts surrounding identity itself and designing a system that will be strong, extensible, and trustworthy. It's always a good idea to make sure you're up-to-date on what others have discovered about security before you leap headlong into the fray. In particular, you should know about the Seven Laws of Identity.
The seven laws were developed by Kim Cameron, chief identity and access architect at Microsoft, and then refined in the blogosphere through his site. The laws have been compiled and enhanced during an ongoing conversation among numerous people, and they represent the best available advice for architecting your identity solutions. Let's look at these seven laws and how they relate to real-life systems. Just to make sure you're paying attention, you'll be quizzed at the end of each section.

User Control and Consent
Technical identity systems must only reveal information identifying a user with the user's consent.
No matter what the circumstance is, the user must always have control over her destiny. If the user ends up not trusting the system, she will try to bypass it. It's as simple as that. The system must be clear about what information it requires and what it will do with the information.
This remains true in any context—even on the job. If you're designing an enterprise system, the right of first refusal must rest with the user, even if this breaks the conditions of employment. If set up this way, the employee is informed about how the information would be used, and the employer is indemnified by revealing all.

Question 1: Your company is designing a new system that will store a user's confidential reviews on a server in your main office. How should this system be designed?
A Users are required to upload their files to a site, with no explanation of where the files go
B Users are required to upload their files to a site, and they are informed that other users may have access to the information
C Users are required to upload their files to a site, and they're notified that the information can be accessed only by their supervisors and HR counselors
D Users are not required to upload their files if they don't want to; instead of placing their review on a remote server, they may play Solitaire on company time

Minimal Disclosure for a Constrained Use
The solution that discloses the least amount of identifying information and best limits its use is the most stable long-term solution.
Simply put, the less information you pass along to providers, the less information they can keep for future uses. And subsequently the less information that can be compromised.
If a system uses your Social Security number as a sign-in ID and other systems do the same, you are uniquely identified across all these systems. That's identity theft waiting to happen, and, in fact, there are several laws proscribing the use of such identifiers. You're assured that the number is unique, but that strength is also its weakness.

Question 2: Complete the following message: "Thank you for signing up for free daily joke e-mails! In order to begin your subscription, we need your..."
A Home address
B E-mail address
C Cell phone number
D Social Security number and mother's maiden name

Justifiable Parties
Digital identity systems must be designed so the disclosure of identifying information is limited to parties having a necessary and justifiable place in a given identity relationship.
Are you, as a user, aware of whom you're giving your information to and whether there's any reason for them to have it? This was the question many people asked about the Microsoft® Passport system—why would you give your information to Microsoft in order to access a third-party bookseller? What else was being traced? Were cross-site visits being compiled in some way?
The actual answers to those questions don't matter. Once suspicions are planted in users' minds, they shy away from a single identity system. That's exactly what's happening in many countries and municipalities as governments debate issuing digital identities to citizens. It's one thing to use your government ID for government services. Would you really want to use the same ID to sign onto your personal e-mail account or do online banking, no matter how convenient that might be?

Question 3: Who is the best party to control the identifying information you've given to an online bookseller?
A The bookseller
B The government
C A third-party address-book site
D None of the above

Seven Rules in a Nutshell by Kim Cameron
  • Technical identity systems must only reveal information identifying a user with the user’s consent.
  • The solution that discloses the least amount of identifying information and best limits its use is the most stable long-term solution.
  • Digital identity systems must be designed so the disclosure of identifying information is limited to parties having a necessary and justifiable place in a given identity relationship.
  • A universal identity system must support both "omnidirectional" identifiers for use by public entities and "unidirectional" identifiers for use by private entities, thus facilitating discovery while preventing unnecessary release of correlation handles.
  • A universal identity system must channel and enable the inter-working of multiple identity technologies run by multiple identity providers.
  • The universal identity metasystem must define the human user to be a component of the distributed system integrated through unambiguous human/machine communication mechanisms, offering protection against identity attacks.
  • The unifying identity metasystem must guarantee its users a simple, consistent experience while enabling separation of contexts through multiple operators and technologies.

Directed Identity
A universal identity system must support both "omnidirectional" identifiers for use by public entities and "unidirectional" identifiers for use by private entities, thus facilitating discovery while preventing unnecessary release of correlation handles.
Directed identity is an extension of the public/private key setup. A public entity is omnidirectional, broadcasting its existence for all to see. A private entity, like a user, is unidirectional. You should always know how to find a particular Web site, because it broadcasts its existence by way of its URL. But Web sites should not be able to follow you around. (Some affinity marketers disagree with this, which is why Internet Explorer® lets you reject third-party cookies.)
In the physical world, systems like Bluetooth and RFID currently have problems with the Law of Directed Identity. An RFID tag is omnidirectional—anyone with an RFID reader can sense the tag's approach. If one of these tags gets into your passport or driver's license, you'll be broadcasting information about yourself to anyone with the mechanism to pick it up. At best, this is probably a nuisance; in certain situations (traveling abroad, for instance), it could be downright dangerous. Any identifier should respond only when it can be certain that the reader is trusted.

Question 4: Which of the following choices is an example of a unidirectional identifier?
A Your Bluetooth adapter signal
B A Web site URL
C A building-entry swipe card
D The microchip that was secretly implanted in your arm when you were vaccinated as a child

Pluralism of Operators and Technologies
A universal identity system must channel and enable the inter-working of multiple identity technologies run by multiple identity providers.
Context is always important in identification. While we can dream of a single, all-encompassing ID system that works in all contexts, the vast differences in purpose among roles makes this impossible (not to mention undesirable). You don't want the same system to provide both your office e-mail and your personal e-mail, because you have different privacy expectations for each.
For this reason, a good identity metasystem will allow for components that offer divergent—and sometimes contradictory—features. While a metasystem can adopt a single protocol, and even a consistent user experience, the actual identity providers will vary depending upon whether the user is acting in the context of a consumer, an individual, an employee, or some other role. If you think about what XML has become—the same structure is used to syndicate content, to store user settings, and to provide inter-process communication—it becomes clear that identity metasystems can act similarly, providing a basis for whatever functionality vendors need to provide.

Question 5: How many operators should be able to work together with a universal identity system?
A 1
B 3
C 47,559
D As many as necessary

Human Integration
The universal identity metasystem must define the human user to be a component of the distributed system integrated through unambiguous human/machine communication mechanisms, offering protection against identity attacks.
The Internet seems more dangerous than ever, but in reality it's becoming more secure. We understand attacks better now, and administrators are more attuned to the concept of preventative maintenance.
But all the antivirus programs in the world can't keep a user from clicking on a link in a phishing e-mail, thereby inadvertently authorizing an attack on his machine. The same goes for identity. You can protect communications with all the 128-bit keys you want, but the easiest way to commit identity fraud is to steal identifiers right from the user. That's why human integration is so important to a successful identity metasystem.
A system that works is one that's clear to the end user and that can be shown to work effectively. Is the user experience unambiguous? Can the user make informed decisions from it? ID systems don't end at the keyboard, they end at the individual—and systems must take this into account.

Question 6: Why do hackers target the end user rather than the in-process communication?
A The end user can be tricked into opening a fake message from a bank and entering info
B If the hacker can assume a user's identity, he also gets to keep the comfy office chair, stapler, and travel coffee mug
C Communications protocols can be effectively secured, and the end user is the weak point on the chain
D All of the above (except maybe B)

Consistent Experience Across Contexts
The unifying identity metasystem must guarantee its users a simple, consistent experience while enabling separation of contexts through multiple operators and technologies.
Take a look in your wallet. Chances are you have a large number of cards. One might be a driver's license; another a student ID. You might have a couple of credit cards, an ATM card, a library card, a health plan card, and maybe even a supermarket "rewards" card.
You can think of your wallet as an identity metasystem. It holds identification as physical objects, and you are probably comfortable using each card you get. Each one identifies you, but each card is used in different contexts and has different capabilities. One lets you borrow books, while another buys your groceries.
Different people have different combinations of cards, depending on the various contexts they need to access. Creating a consistent ID experience across contexts works the same way in an identity metasystem. Depending upon what context you're trying to access, the relying party may ask you to provide one or more cards to prove you are who you say you are and you have the rights you're asserting. You need to understand which cards do what, but you know you can always ID yourself as long as you bring your wallet.

Question 7: Which of the following is not a common contextual identity choice?
A Browsing (self-asserted identity for exploring the Web)
B Community (public identity for collaborating with others)
C Citizen (identity issued by a government)
D Credit card (identity issued by a financial institution)
E Klingon (self-asserted identity for visiting a sci-fi conference at the local VFW hall)

ID Management
For more information on Identity Management, visit the following online resources.
  • The Identity Metasystem
  • Design Rationale Behind the Indentity Metasystem Architecture
  • How Microsoft Does IT: Identity Management

Conclusion
Why are these seven laws of identity so important? Digital identities play a key role in today's information infrastructure. If users and companies do not see identification as safe, private, and secure, the lack of trust will end up undermining any products and technologies that are built upon it.
To keep up on the ever-evolving world of identity systems, you should definitely get Kim Cameron's Identity Weblog in your aggregator. You can get the feed at www.identityblog.com/?feed=rss2, and you'll get several interesting articles every week. These will give you a better picture of the important work going on in this area.

Question | Answer
1. Your company is designing a new system that will store a user’s confidential reviews on a server in your main office. How should this system be designed? | C. It is a condition of employment to create and file a review. Users can choose whether to do this, but not complying violates company policy. At the same time, they are given concrete information that clearly explains the exact boundaries for their personal information, so they can feel confident that prying eyes will not get to it.
2. Complete the following message: “Thank you for signing up for free daily joke e-mails! In order to begin your subscription, we need your...” | B. You only need an e-mail address to send out e-mail. If this is a real service and not just some trick to get your home address, nothing more is or should be required. Forms that ask for all sorts of personal information create an atmosphere of distrust.
3. Who is the best party to control the identifying information you’ve given to an online bookseller? | A. People have high levels of trust in the entities they’re dealing with directly, and less trust in third-party go-betweens.
4. Which of the following is an example of a unidirectional identifier? | C. A swipe card only works when you choose to swipe it. In contrast, a Bluetooth adapter announces its existence indiscriminately to all in the vicinity. A URL lets any visitor find their way to your site. And we won’t even get into what that microchip does.
5. How many operators should be able to work together with a universal identity system? | D. An identity system is best defined through its underlying protocol and user experience, providing extensibility for any valid operators who want to plug into the system.
6. Why do hackers target the end user rather than the in-process communication? | D. The human at the end of the identity system is the path of least resistance into the system. Systems should be designed to minimize confusion and ambiguity for the end user.
7. Which of the following is not a common contextual identity choice? | E. At least, we hope that’s the answer.

Joshua Trupin is the Executive Editor of MSDN Magazine and TechNet Magazine. He has written numerous articles for MSJ, MIND, MSDN Magazine, and TechNet Magazine, as well as a book, Hoop Stats: The Basketball Abstract.
© 2007 Microsoft Corporation and CMP Media, LLC. All rights reserved; reproduction in part or in whole without permission is prohibited.


 Managing Identity: MIIS Gets your Directories in Sync
Identity & Access Management Randy Muller

MIIS Gets your Directories in Sync
At a Glance:
  • Managing diverse credential information
  • Using management agents
  • Becoming familiar with the MIIS metaverse

Trying to maintain security and identity information in a large, heterogeneous network can be difficult and complicated. And this can put your network at risk. Fortunately, Microsoft Identity
Integration Server (MIIS) 2003 allows you to synchronize identity information from many different directories and services into a single, organization-wide solution. This can help protect your network's security and simplify management.
Some of the major capabilities of MIIS 2003 include:
  • Directory synchronization
  • Account provisioning
  • Certificate publishing
  • Group management
  • Management of Global Address Lists (GALs) for diverse e-mail systems
  • Management and synchronization of passwords
There are four major components of MIIS 2003. They are the connected data sources, management agents, connector spaces, and the metaverse. I'll explain each concept briefly and describe how they all fit together.

Connected Data Sources
A connected data source is a system that provides information to or receives information from MIIS 2003. Many systems can act as a connected data source including directory services (such as Active Directory®), databases, and even individual files. The connected data sources currently supported by MIIS 2003 Service Pack 1 (SP1) are shown in Figure 1.

Management Agents
Every connected data source has a corresponding management agent. Each management agent acts to control the flow of information between its connected data source and MIIS. If you modify synchronized data in either the connected data source or within MIIS (via defined rules), the management agent will keep MIIS 2003 and the connected data sources consistent. Since there is a management agent for each supported connected data source type, the types of management agents are the same as the types of connected data sources supported by MIIS 2003. If you need to connect a data source not listed in Figure 1, MIIS also provides a generic management agent that can be configured to connect to any system that provides programmatic access to its data, called the extensible connectivity management agent. In Figure 2 an Active Directory management agent (called NewAgent) has been created.
Figure 1 Supported Sources (Close Figure 1)

Active Directory
Active Directory Application Mode (ADAM)
Active Directory Global Address List (GAL)
Attribute-Value Pair text file
Delimited text file
Directory Services Mark-up Language (DSML) 2.0
Exchange Server 5.5
Exchange Server 5.5 (bridgehead server)
Fixed-Width text file
IBM DB2 Universal Databases
IBM Resource Access Control Facility (RACF)
IBM Tivoli Directory Server
LDAP Data Interchange Format (LDIF)
Lotus Notes 4.6, 5.0, and 6.x
Microsoft Exchange Server 2000 (use the management agent for Active Directory)
Microsoft SQL Server 7.0
or SQL Server 2000
Netscape Directory Servers
Novell eDirectory 8.6.2, 8.7, and 8.7.x
Oracle Database 8i or 9i
Sun ONE Directory Server: 4.x and 5.x
Windows NT 4.0
Figure 2 Creating a Management Agent
Figure 2 Creating a Management Agent
Management agents are all very similar in their construction, with only slight variations depending on their type. All management agents perform some common tasks regardless of their type. These tasks include schema discovery, configuring the connector filter, configuring join and projection rules, configuring attribute flow, configuring deprovisioning, and configuring rules extensions.
Management agents also support password management, which will be important to know later in the article. The management agents that natively support password management in MIIS 2003 SP1 are: Active Directory, Active Directory Application Mode (ADAM), Lotus Notes, Sun and Netscape Directory Servers, Novell eDirectory, and Windows NT® 4.0. Any of the management agents can be programmatically extended to support password management.

Connector Spaces
The connector space is a staging area for information coming into or going out from a given management agent. The information that is staged in a management agent's connector space is used to synchronize with the metaverse or is exported out to its connected data source. Each connected data source has its own reserved logical area within the connector space that is used by its corresponding management agent. The connector space does not actually contain the connected data source as an object itself, but rather contains a subset of the connected data sources' attributes, as defined on the management agent. MIIS uses the connector space object instead of making direct queries to the connected data source when processing business rules. This improves synchronization speed between the metaverse and the connected data sources.

Installing the Password Change Notification Service
The actual Password Change Notification Service (PCNS) is not installed by default. The installation files are located on the installation media and can be installed by clicking the password change notification service.msi file found in the Password Synchronization folder.
When you install the PCNS a dialog box will appear telling you that the service will need to extend the schema with the command msiexec /i “D:\ENGLISH\IIS2003\ ENT_SP1\ PASSWORD SYNCHRONIZATION\PASSWORD CHANGE NOTIFICATION SERVICE.MSI” SCHEMAONLY=TRUE as shown in Figure A.
Figure A Extend the Schema
Figure A Extend the Schema
As you continue with the installation process, a dialog box appears confirming that you wish to extend the schema to support the PCNS. Click OK to make the changes.
Now you can go back and install the PCNS; once the service has been installed, you will have to restart the system for all of the changes to take affect.
During the installation process for the PCNS, three components are installed: pcnsflt.dll, pcnssvc.exe, and pcnscfg.exe.
Pcnsflt.dll This is the filter that is used to actually capture any changes to passwords.
Pcnssvc.exe This is the actual PCNS. It encrypts and sends the password changes to a designated MIIS 2003 server.
Pcnscfg.exe You use this command-line utility to configure the service.
Both the pcnssvc.exe and pcnscfg.exe files are located in the %Systemroot%\Program Files\Microsoft Password Change Notification Service directory. You will use these later to configure the PCNS. Once you have the PCNS installed, you will need to configure it using the pcnscfg.exe command mentioned earlier. With this command, you will specify which MIIS 2003 server will receive password changes. An example of the pcnscfg.exe command and some of the switches can be seen in Figure B.
Figure B Pcnscfg.exe and Some Switches
Figure B Pcnscfg.exe and Some Switches

The Metaverse
The metaverse is a collection of tables that contains information about connected identities from the connected data sources. These tables are stored in a SQL Server database and contain all the aggregated information about a specific entity as it exists in all of the connected data sources. Attributes and objects flow into and out of the metaverse. Updates flowing in are used to update the metaverse; updates going out are used to update the connected data sources through their respective connector space. The metaverse contains its own schema, which defines which object types and attributes the metaverse can contain. All objects in the metaverse must be of one of the types defined in the metaverse schema. The metaverse schema contains the following default objects, but can be easily extended:
  • computer
  • domain
  • group
  • locality
  • organization
  • organizational unit
  • person
  • printer
  • role
Now that you have some background on the structure and components of MIIS 2003 SP1 and how they interact, let's discuss the password management functionality in more detail.

Password Management in MIIS
Passwords are one of the weakest security points in a network, but the use of secure passwords can become a source of contention between administrators and users. Users would rather have nice, easy-to-remember passwords (or truthfully, none at all), whereas administrators want to implement more restrictive password requirements. This is of even more concern on networks with disparate directories where users may have several accounts with varying levels of password requirements to access each of these directories or services. MIIS 2003 SP1 has a number of new password management and synchronization features that can help. Let's see how the use of the password management and synchronization capabilities help you control passwords and reduce administrative efforts.
  • Auditing features let you track changes to or setting of passwords through the use of entries written to the Event Log.
  • Developers have the ability to perform password management functions through an API.
  • An administrator or a user can reset passwords through a central point or through a Web services application.
  • Integrated third-party solutions can be used to extend the capabilities of MIIS 2003.
  • Password policies as defined in Active Directory, for example, can be enforced across other systems.
A number of security groups are created by default when you install MIIS 2003. Two of these groups are used specifically in support of password management, MIISBrowse and MIISPasswordSet, while the others, MIISAdmins, MIISOperators, and MIISJoiners are used in support of MIIS 2003. A listing of these groups and a description of their functions is shown in Figure 3.
Figure 3 Security Groups (Close Figure 3)

Group | Function
MIISBROWSE Security Group | Members of this group have permission to gather information about a user’s accounts when doing search operations with WMI queries
MIISPasswordSet Security Group | Members can perform account search, password set, and password change operations using the password management interfaces with WMI.
MIISAdmins Security Group | Members of this group have full access to everything in Identity Manager.
MIISOperators Security Group | Members have access to Operations in the Identity Manager only. MIISOperators can run management agents, view synchronization stats, and save the run histories. Members must also be members of the MIISBrowse group to open links in synchronization statistics.
MIISJoiners Security Group | Members have access to Joiner and Metaverse Search in Identity Manager. MIISJoiners can join or project disconnectors by using Joiner and they can use Metaverse Search to view object properties and disconnect objects from the metaverse.

Configuring a Management Agent
Now that you have the PCNS installed, the next task is to configure a management agent. There are 10 steps in creating a management agent.
Start the creation process by clicking on the Management Agents tab in the Identity Integration Server screen, right-click in the Management Agents box and press create. At this point you will have to specify what type of management agent you want to create as you can see in Figure C
Figure C Configure Directory Partitions
Figure C Configure Directory Partitions
When you have specified the management agent type, you will have to connect to a specific forest and configure directory partitions. This screen also holds the checkbox you want to ensure and check for password synchronization (by checking the Enable this partition as a password synchronization source box as you can see in Figure D.
Figure D Configure Management Agent
Figure D Configure Management Agent
Once you have done this, you will specify what object type you want, Attributes, Connector Filter, Join and Projection Rules, Attribute Flow, Deprovisioning and finally Extensions. The extensions box also holds another box you must make sure to check, Enable password management, as shown in Figure E.
Figure E Enable Password Management
Figure E Enable Password Management

Password Change Notification Service
The management of passwords is a costly and time-consuming process for many administrators. Fortunately, this process has been greatly enhanced with a new feature in MIIS 2003 SP1—the Password Change Notification Service (PCNS). This new service allows for the secure updating of password resets to be sent to an MIIS 2003 server. When a password reset is initiated on a domain controller, either by a user who presses Ctrl+Alt+Del, or by an administrator, the request is intercepted. The intercepted request is encrypted and then forwarded on to the MIIS 2003 server and from there to all connected data sources (that are configured for password management) through synchronization. To see how to install the PCNS and configure a management agent, see the sidebars by the same names.

Conclusion
In this article, I have discussed the major components of MIIS 2003 and how they work together. I've also given you a brief overview of the password management and synchronization features available through the PCNS. All this should put you on the road to successful identity synchronization and password management across your organization. Now that you've been introduced to all the great features available in MIIS 2003 SP1, you'll almost certainly want to take a look at more info, which you can find at microsoft.com/windowsserversystem/miis2003/default.mspx.

Randy Muller, MCT, MCSE, MCSA, MCDST, teaches a variety of networking, security, and other computer classes. He is a former Army Signal Corp Officer and has been teaching since 2000. You can contact Randy at randy@randymuller.org.


 Managing Identity: 5 Essential Tools for MIIS
Identity & Access Management Jenn Goth

5 Essential Tools for MIIS
At a Glance:
  • MIIS 2003 Design and Planning Collection
  • MIIS Provisioning Assistant
  • MIIS Preview
  • Oxford MIIS Documentor
  • MIIS Service Monitor

Identity and access management. These are important issues as your business implements systems that provide corporate information to employees, business partners, and customers.
Each solution introduces new applications with their own authorization requirements and potentially their own authentication mechanisms. As these disparate systems proliferate throughout an organization, managing digital identity—determining when users are on-boarded, when they are off-boarded, and what privileges and access they have while active in the environment—becomes an increasingly complicated process.
Microsoft® Identity Integration Server (MIIS) 2003 lets you manage identity information across multiple platforms and applications. It ships with management agents that can be used to integrate identity information across many different data repositories and provides synchronization functionality that lets integrated systems maintain data consistency based on business rules. MIIS gives you provisioning capabilities so identities can be added or removed across repositories, along with password management features to ensure password consistency across integrated systems and platforms.
As you approach an identity management project, it is important to have the right technical and team resources available. You'll need an in-depth understanding of your overall business processes to design and architect a solution based on MIIS. You'll also need the development skills to implement complex business logic in the rules extension assemblies used by MIIS. Once you've assembled the right team, there are a number of useful resources that can assist you during design and implementation. Here are five tools to simplify the design process, reduce custom coding, facilitate deployment, keep documentation current, and help with daily operations and monitoring.

Design: MIIS 2003 Design and Planning Collection
As you begin to tackle an identity management project, the first challenge you're likely to run into is determining where you should start. Typically, identity management solutions are strategic. Translating that strategy into concrete activities requires some experience. To address this challenge, Microsoft has developed the MIIS 2003 Design and Planning Collection—a series of documents and worksheets that can aid in scoping your project, gathering requirements, and configuring a solution based on MIIS 2003. It is especially useful if you're new to this type of project.
The Design and Planning Collection contains an introductory document that explains how to use the series, seven separate documents that address particular design components, templates to be used in conjunction with the documents, and completed sample templates so you can see what the finished templates should look like. You can download the entire collection from go.microsoft.com/fwlink/?LinkId=65986.
This collection is intended to provide you with the building blocks for designing and documenting your MIIS 2003 implementation. The introductory document is brief but informative. It outlines what you will find in each of the seven guides and even advises you on which of your project shareholders should read which guide. It suggests that everyone on the team read the Roadmap Guide, for example. If you are going to use the templates, this should be a requirement. You'll save significant effort understanding the rest of the documents and templates if you take the time to read the twelve-page Roadmap Guide. And each template has an accompanying guide you should read before starting to use that template.
If you have experience designing and documenting identity management solutions, the MIIS 2003 Design and Planning Collection may offer some interesting pieces of information for you. But in general, this collection is really intended for people who are new to defining and implementing identity management projects.
Even with these planning tools, remember that for the best chance of success you should tackle a large identity management project in bite-sized chunks. While all identity management projects need a high-level strategy, complex designs often come together better when implemented in a phased approach.

Develop: MIIS 2003 Provisioning Assistant
As a result of your design efforts, you've identified the data flow for both attributes and objects. If your design requires creating or deleting objects in connected data sources, you'll need to develop a method of provisioning and deprovisioning these objects. In MIIS 2003 this means implementing that logic in a metaverse rules extension. Rules extensions are implemented as DLLs and stored in the Extensions subfolder of the MIIS root folder.
To reduce the amount of development work necessary for simple provisioning and deprovisioning, you can take advantage of the MIIS Provisioning Assistant, part of the Microsoft Identity Integration Server 2003 Resource Tool Kit 2.0 (see go.microsoft.com/fwlink/?LinkId=65991). Prior to the release of this tool, all provisioning extensions had to be developed in Visual Studio®.
MIIS Provisioning Assistant is a wizard-based tool that generates a metaverse rules extension to perform simple provisioning and deprovisioning actions. All configurations are done through the wizard's user interface, so no development is necessary. But this tool generates a Visual Basic® or Visual C#® project so you can configure additional complex provisioning rules using Visual Studio, if you prefer.
When you create a metaverse rules extension with this tool, a series of templates are created in the project. These templates are used to store your configuration and, based on the information in the templates, a metaverse assembly is created.
There are a few actions that must be completed before you can use the wizard. The metaverse schema must be configured with the object types and attributes that will be used for provisioning, and any management agent that will be configured for provisioning or deprovisioning must exist in the Identity Manager. Once these configuration tasks are completed, the next step is to generate server export files. These files contain all the necessary information about the management agents and metaverse schema.
When the server export is available, you can launch Provisioning Assistant and configure a new metaverse extension project. The wizard prompts you for the name of your extension, the programming language (C# or Visual Basic), and the location for the project. Note that regardless of the project's location, the compiled assembly will be placed in the Extensions folder.
As you progress through the wizard, you provide conditions that must be met to trigger provisioning on a particular metaverse object type. For example, if you are provisioning mail-enabled contacts into your Active Directory® environment, you want to make sure that a person in the metaverse has his mail attribute populated (see Figure 1).
Figure 1 Provisioning Assistant
Figure 1 Provisioning Assistant
You also define object templates that specify the connector space object type you are provisioning to and the metaverse object type that should be evaluated. In the example of creating mail-enabled contacts, the connector space object type is contact, and if the users are person objects in the metaverse, the object type is person. In this template you also specify the initial attribute population. This is important because some attributes can't be included in regular attribute flow, but instead must be configured when an object is created in the connector space. One such example is setting the initial password on a connector. In general, a password attribute cannot be configured in export attribute flow, but it can be set initially during the provisioning process (see Figure 2).
Figure 2 Setting Password Attribute
Figure 2 Setting Password Attribute
While running the wizard, you also need to configure the format of the distinguished name (DN) in the target connector space. You can define both constant and variable components for the DN. For example, you may decide to create a DN where the first component contains "last name, first name", the second component is the user's department, and the rest is constant. Such a configuration would look like this:
{sn},{givenName},OU={department},
OU=Users,DC=fabrikam,DC=net
Provisioning Assistant includes two advanced features for managing distinguished name conflicts and changes. The simple conflict-resolution option specifies that a number will be appended to the DN if the name of the object you are trying to provision already exists in the target connector space. The renaming existing connectors option specifies whether an existing connector will be renamed if a portion of the DN changes. If a user changes departments or changes his name, for example, selecting this option will propagate that change to the DN.
As a final step in the wizard, you specify any deprovisioning rules. These are conditions that must be met on a metaverse object type before deprovisioning will occur. After defining the conditions, you can then select the management agents from which the object will be deprovisioned.
After stepping through the templates for each object type you want to provision and deprovision, click the Generate Extension button to create the metaverse custom extension. Before provisioning will actually occur, you need to do the following:
  • Enable the metaverse extension.
  • Specify the name of the assembly you just created.
  • Enable the provisioning rules extension.
These three tasks are performed through commands that are accessible from the Options submenu of the Tools menu within the Identity Manager console. If you need to reuse this configuration on another MIIS instance, you can export the project to a single XML file that can be easily imported into Provisioning Assistant on a different server.
Without MIIS Provisioning Assistant, even the simplest of synchronization designs requires custom development work. But by using MIIS Provisioning Assistant, you can create a Microsoft Identity Integration Server implementation with provisioning that does not require any custom development work at all.

Deploy: MIIS Preview
Both new and existing MIIS implementations have the same challenge: ensuring that what you roll out does not negatively impact your existing production systems or the metaverse. MIIS addresses this challenge with MIIS Preview, a powerful deployment tool that ships in the box. Preview enables you to model how configuration changes might impact a single object in a given connector space. Having that information accessible before committing changes to a production system is invaluable. Preview displays all rules that were applied as well as those that did not apply during a synchronization process. You can drill into a rule's details and analyze the results for potential errors before any changes are committed to the metaverse or connector space.
To run Preview, select a connector space object and view its properties. You can select a connector space object in many different places within the Identity Manager interface. If errors occur during an import or export process, you can select the connector space object by clicking on the hyperlink in the Synchronization Errors pane. If a connector space object isn't joining to a metaverse object, you can locate that connector space object on the Joiner tab and view its properties. If you want to spot-check objects, you can search the metaverse or connector space and randomly select objects. Note that if you search the metaverse for objects, you'll need to get properties on the metaverse object, then click the Connectors tab to locate the connector space object you want to run a preview on and get its properties.
Once you've selected a connector space entry, you choose whether to preview a full or delta synchronization. Full synchronization is typically selected when deploying new systems or changing configurations. You can then generate the preview and review all synchronization steps—from the import connector filters to the export attribute flow (see Figure 3).
Figure 3 Previewing Attribute Flow for Synchronization
Figure 3 Previewing Attribute Flow for Synchronization
I use Preview most often to test advanced rules because it's a great way to debug code that isn't doing what you anticipated. Not only can you see what data is passing through an object, you can also attach the debugger and step into your advanced rules without having to launch a run profile. If you run the management agent, you might have to step through the processing of many other objects before you can debug the one with issues. With Preview, you can select that object, attach the debugger, generate the preview, and step into the code being applied to that specific object.
Although Preview is not a substitute for lab development and thorough testing, it does let you review data before any changes are committed. So, when your production data is not as clean as the lab you're developing in, the Preview feature provides a means to catch any errors before they become production issues.

Document: Oxford MIIS Documentor
As you build these complex management agents and metaverse configurations, the business logic sometimes gets locked away in the UI and the rules extension assemblies. There are tools in the MIIS Resource Tool Kit that allow you to view your configuration—these include MA Configuration Viewer, Attribute Flow Viewer, and MV Configuration Viewer. These tools are very useful for viewing their targeted configurations, but they do not produce the detailed information that you will need for system documentation and auditing purposes.
Oxford MIIS Documentor, from Oxford Computer Group, can automatically generate reports of your MIIS installation, which are suitable for creating or updating deployment documentation (see Figure 4). You can install it on any computer running Microsoft Word; it is not installed on the server running MIIS. A demonstration version of Oxford MIIS Documentor is available for download at www.oxfordcomputergroup.com. You can obtain additional functionality by purchasing a license.
Figure 4 Oxford MIIS Documentor Settings
Figure 4 Oxford MIIS Documentor Settings
Before you generate the documentation, you'll need to export your MIIS configuration. To ensure advanced flow rules are included in the report, your rules extensions projects must also be available. Oxford MIIS Documentor expects a specific folder hierarchy: the server export files must be in a folder called \MVExport and the rules extension projects must be in the same root folder. For example, if you have two rules extensions called HR MAExtension.dll and AD MAExtension.dll, and your root folder is \MIIS Config, you'd need this folder structure for the tool to work:
  • \MIIS Config\MVExport\ contains all of the XML files that result from your server export.
  • \MIIS Config\HR MAExtension\ contains the source code file HR MAExtension.vb.
  • \MIIS Config\AD MAExtension\ contains the source code file AD MAExtension.vb.
When you run the application, it provides automated documentation of your MIIS installation, including definitions of all object classes, attribute flows, and management agent configurations. Any references between sections are represented as hyperlinks in the report document. This is handy because these documents are typically over 100 pages long and navigating between sections is much easier with the clickable references.
Additionally, the portion of code used in any advanced rules definition will automatically be placed in the proper section of the document. This is one of the most powerful features, as it saves a significant amount of time spent on documenting new implementations, and it also ensures all changes are captured when an existing implementation is modified. This tool also lets you customize the report and provide any additional content that should be incorporated into the final document.
MIIS Resources
The tools discussed here are only a few of the resources available to help you navigate the different phases of an MIIS-based identity management project. MIIS has an active community you should be sure to explore. If you are looking for additional tools or tips, be sure to check out the following resources:
  • Microsoft Identity Integration Server 2003 Support Center
  • Microsoft Discussions in MIIS/IIFP
  • MMSUG—Microsoft Identity Integration Server
  • MIIS Experts

Monitor: MIIS Service Monitor
Once you have designed and deployed an enterprise identity management solution, downstream data sources and applications will expect consistency in their data. To ensure these expectations are met, you need to implement an operational plan.
Organizations that are currently using or planning on investing in Microsoft Operations Manager (MOM) can take advantage of a management pack designed specifically for MIIS 2003. This management pack monitors for service outages, management agent errors, and issues with connected data sources. It additionally provides notifications for errors in password management and account provisioning. You can download the Microsoft Identity Integration Server 2003 Management Pack for MOM 2000 SP1 from Microsoft.
If you are not planning on using MOM, you'll still want a full-featured monitoring and auditing solution for MIIS. A third-party product called MissionControl for MIIS from NetPro Computing includes core monitoring and auditing functions, and provides a graphical representation of MIIS to assist with diagnostics, troubleshooting, and service-level reporting. You can learn more about MissionControl at www.netpro.com/products/missioncontrol/index.cfm.
But if your organization does not employ an enterprise-wide operational platform or strategy, MIIS Service Monitor can help you get some baseline MIIS service statistics. Like a number of the other tools I've discussed, MIIS Service Monitor ships with the MIIS Resource Tool Kit. It can be installed on any computer running Windows Server™ 2003 or Windows® XP. Service Monitor regularly polls the configured MIIS 2003 server and returns information on server status, resource statistics, management agent activity, and MIIS application events.
The main view of MIIS Service Monitor provides information about the MIIS Service and statistics on the performance of the MIIS server, SQL Server™, and management agents (see Figure 5). You can stop, start, and refresh the MIIS service. You can also view MIIS events in the application event log on the MIIS server. The events that are returned to MIIS Service Monitor can be filtered by number of days, then copied or saved. The statistics reported on MIIS and SQL Server include:
  • The current state of MIIS or SQL Server.
  • The current working memory set size and peak working set size.
  • The total number of handles MIIS or SQL Server currently have open.
  • The number of threads currently active in the MIIS or SQL Server processes.
  • The current virtual memory size and peak virtual statistics.
Figure 5 MIIS Status
Figure 5 MIIS Status
Additionally, the Service Monitor window displays the open Identity Manager sessions and allows you to disconnect those sessions. All MIIS and SQL monitoring configurations can be changed by updating the configuration options in this application.
The management agent statistics provide information on the total number of management agents on the MIIS 2003 server. This number is a link that can be clicked to open the Management Agents page, which displays the last run information for each management agent as it would appear on the Operations tab in Identity Manager (see Figure 6). This statistics module also displays the number of management agents that are currently running. To actually modify, run, or query a management agent, you must use the Identity Manager interface.
Figure 6 Monitoring Management Agents
Figure 6 Monitoring Management Agents

Jenn Goth is an identity management subject matter expert within Microsoft Consulting Services (MCS). She joined MCS in New York eight years ago and has been designing, developing, and deploying enterprise directory and identity management solutions for government, commercial, and financial services customers.


 Managing Identity: Automate Active Directory Group Management
Identity & Access Management Craig Owen

Automate Active Directory Group Management
At a Glance:
  • Important uses of MIIS
  • Group management in MIIS
  • Features of MIIS

Group management is central to today's businesses. Groups are commonly used to control access to network resources, computers, buildings, and so on. Simultaneously, they need to grant access to
resources that people need to get their work done, while also protecting those resources from intentional or inadvertent harm. E-mail distribution lists, where users, contacts and other groups are logically associated with one another, exemplify the potential difficulties. The implications of controlling these groups range from users getting more information than they want (information overload) to getting more information than they should have (information security).
Groups need to be properly maintained to both minimize security risks and enhance the work environment. But many organizations have more groups than users. Even if yours doesn't, chances are it does have a high group-to-user ratio—and these groups are often being managed manually. That's an administrative nightmare.
Ever wish you could bring some automation to group management? Microsoft® Identity Integration Server (MIIS) 2003, along with a downloadable group management application, can alleviate a lot of the headaches. Automation of group management not only reduces the administrative overhead associated with group management, but it also helps you solve your security concerns.

How MIIS Fits Into Group Management
MIIS 2003 allows companies to perform data synchronization and object provisioning between otherwise disconnected systems. It does this by collecting information from external data sources (such as Active Directory®, SQL Server™, or SAP) and merging that information into a central repository called the metaverse. Once the information has been collected in the metaverse, you choose the information to be shared among the different data sources.
MIIS 2003 can communicate with a large number of external data sources and maintain information about the objects in those systems. Because of this, the metaverse in MIIS is a logical source of information for making decisions about group membership.

A Group Management Solution
A good way to learn about MIIS is to look at the whitepapers in the Identity and Access Management series. You'll find the latest version at microsoft.com/technet/security/topics/identitymanagement/idmanage. One of the scenarios in the Provisioning and Workflow section walks through a group management solution that's the basis of our discussion. We'll start with an overview of the solution, then cover some of the setup details including defining two types of groups, and finally we'll look at the benefits of this solution.
Using MIIS as a basis for group management starts with an MIIS installation. If you already have MIIS deployed, you can use the information that is already there to create groups. Otherwise you'll want to connect MIIS to your HR database, Active Directory, or any other system that you feel has helpful information to formulate groups. Next, you'll create definitions or rules that describe how the groups should be composed. In the solution we're following, this is done by leveraging a Group Management Web application. You input information about how the group should be created, including the most important part—the membership clause. This clause is literally part of a SQL query that will be executed against the information stored in the MIIS metaverse. The clause might tell the query to return all objects that have a state attribute equal to "California" or all objects that have a title that contains the word "Senior." This is how the group's membership gets dynamically maintained.
MIIS originally shipped with a program called Group Populator, which came included in the walkthrough scenarios. The solution was expanded in the Identity and Access Management Series, and is the one I'll discuss here. It uses information entered into the Web application in conjunction with information in the MIIS metaverse to build group membership. It is the engine that runs periodically to calculate and output the group membership. You can decide how often your membership information is regenerated, based on the needs of your company.
Once the group populator generates a group's membership, you turn back to MIIS to synchronize that group information to any connected directory that supports the group concept. This is done with the help of a management agent (part of MIIS that allows it to communicate with different data sources) that works with the group management database to import group and membership information. Figure 1 illustrates how groups are built using MIIS.
Figure 1 Building and Populating Groups
Figure 1 Building and Populating Groups

Solution Setup
We won't cover installation of the entire solution—that's detailed in the Provisioning and Workflow whitepaper. (In Appendix A you'll find supplemental information specifically about the group management solution.)
The first step involves creating the SQL database that stores the new group information. A script will create the database and tables for you. The database consists of eight relational tables.
Next you need to compile, install, and configure the group management Web application and group populator application. The final step is to configure MIIS with a management agent that will work with the SQL database to inform MIIS of group and membership changes. All steps of installation and configuration are outlined in the whitepaper.
After the solution is installed you will need to define some groups in the Web app. Two types of group definitions can be created. To create a normal group definition, which will result in one group being created (see Figure 2), click the Add Group button on the default page. This will allow you to define the basic attributes: Group Name, Description, and Group Type. There are also more complex choices for setting the mail properties, clause, and exceptions.
Figure 2 Creating a Normal Group Definition
Figure 2 Creating a Normal Group Definition
The second type of group is an attribute-based definition (see Figure 3), which create families of groups automatically for each distinct value of a specified attribute. An example might be an attribute group definition based on job title. Each distinct title value in the metaverse will then get its own group. You will specify the name of the group and the group populator will plug in the distinct value when it creates the group. For example, you can specify that the group will be called Title of {attributeValue}. Possible names of groups might include Title of Administrator and Title of Consultant, where each distinct title in the metaverse will have a group represented and each object with that title will be a member of that group.
Figure 3 Creating Attribute-Based Group Definitions
Figure 3 Creating Attribute-Based Group Definitions
Within the settings for attribute-based definitions, you can create a linked definition. This will allow you to create families of groups based on reference attributes in the metaverse. A reference attribute in MIIS is an attribute that points (links) to another object. A good example of this is the manager attribute. After importing the manager attribute into the metaverse as a reference attribute, you can create a linked attribute group definition. The end result would be groups that might look like Direct Reports of Bob Smith and Direct Reports of Fred Brown, where each person with direct reports in the metaverse has a group created.

Top User Benefits
Why should you take advantage of this group management solution? Here are a number of benefits you'll see.
Web Administration App The UI allows for group definitions to be created and managed from the Web. The Web application also helps you create accurate definitions.
Delta Imports Only the groups that have changed since the last synchronization are evaluated by MIIS. This reduces the processing time and allows you to run the synchronization more frequently, which results in groups that are more up to date.
Attribute-Based Families of Groups You can create families of groups for each distinct attribute value. An example might include setting a rule to create a new group for each state where employees reside, resulting in a group being created for each state in the metaverse. Additionally, when your company expands into a new state and there are new employees in the metaverse, a new state group will be created automatically.
Mail Enable Groups and Set Group Type You have the ability in the Web administration console to mail-enable groups and make them security or distribution-only groups. Here's where you can change the mail alias and other properties of the group (see Figure 4).
E-Mail Notification The group management solution can e-mail the members of the group as they are added or removed.
Figure 4 Mail Status Options
Figure 4 Mail Status Options
Group Clause Builder The original group populator required you to form a SQL statement to define how the group would be populated. The new solution allows you to choose a list of available attributes from a dropdown box and have the Web console build the SQL query for you (see Figure 5). The SQL-savvy can still manually create the SQL statement if they choose.
Figure 5 Clause Builder
Figure 5 Clause Builder
Preview the Results As you are creating a group definition, you have the ability to preview and check the results of your actions. It will show the number of potential members and a list of each person who will be included in the group.
Manual Exceptions to the Groups This feature allows you to manually include or exclude someone from the group whether or not they fit the clause criteria.
Share the Group Clause Between More than One Group If you need two or more groups with the same basic membership, but different attributes, you can share the clause between them.
Delayed Membership Deletion Often, HR data in the metaverse does not get changed concurrently with an employee's status. Employees who change jobs may get a whole new set of groups from the group management application. If you want to allow them a short period of time to transition their work, you can specify that they will not be removed from their previous groups for a configurable number of days, essentially delaying their removal. This option is set on a per-group basis for all members in the group.

Conclusion
The automation of group management will help ensure that the right objects are in your groups. Group management can improve your organization's security and help ensure that your group owners are spending a minimal amount of time managing groups. The Identity and Access Management Series has the tools to aid you in evaluating, designing, and deploying this solution.

Craig Owen is a Senior Identity Architect at Oxford Computer Group. Oxford specializes in identity and access management consultancy. Services include strategic and functional consulting, system integration, solution development, and skill development. Reach Craig at technet@oxfordcomputergroup.com.


 Managing Identity: Simplify Single Sign-on Using ADFS
Identity & Access Management Matt Steele

Simplify Single Sign-on Using ADFS
At a Glance:
  • ADFS architecture and basic message flow
  • Configuring ADFS claims
  • Integration with SharePoint technologies
  • ADFS best practices

Active Directory Federation Services, also known as ADFS, was introduced in Windows Server 2003 R2 to help organizations set up and participate in a standards-based identity federation.
IT organizations can use identity federations to make decisions based on identity data from other organizations, while also sharing selected information about their own users' identities. You can think of a federation as an agreement between two organizations with some common purpose, often structured so that each partner retains the management of its own internal affairs. In this context, identity is defined by a set of statements or claims about a subject (you can read more about this in Joshua Trupin's article in this issue, or in Kim Cameron's "Laws of Identity" whitepaper). So the common purpose of an identity federation is the sharing of identity information and identity authentication responsibilities. ADFS enables this decentralized identity sharing by implementing the WS-Federation protocol along with standards such as WS-Trust and Security Assertion Markup Language (SAML).
In this article I will discuss the underlying concepts and architecture of identity federation and ADFS. In addition, I'll review how claims are configured and transmitted between account and resource partners using ADFS, provide notes about the ADFS SharePoint® integration, and share some ADFS best practices.

Major Benefits of ADFS
ADFS provides an identity federation solution for organizations looking to share identity information with their partners in a secure manner. Using the trust policy for an ADFS Federation Service, you can manage your trust relationship with partners and map partner claims to claims understood by your organization's Web applications.
By relying on partner claims to initiate Web application sessions, responsibility for partner account management remains with the partner. The partner knows when its new employees are hired, shift roles, and are terminated. And ADFS enables federation partnerships to be managed in a central place, reducing the headache of adding and removing partnerships.
ADFS also helps organizations share identity with partnerships using the same trust policy. When establishing a partnership to use another organization's Web applications, ADFS provides a central place to manage and audit the employee identity information that is shared with that partner.
Identity federation with ADFS offers solutions to a number of potential issues.
Partner Account Provisioning A partner organization has just hired a new employee and would like that employee to access Web applications offered by your organization under the existing partnership agreement. Instead of requiring a new account managed by your organization, ADFS enables your organization to accept digitally signed claims from the partner organization. These claims from the partner organization can confirm that the requestor is indeed an employee of the partner.
Partner Account Credential Management With a new local account for the partner employee, you'd normally need to have some method of managing the credential she uses to authenticate. With ADFS, your organization no longer needs to revoke, change, or reset that credential, since the credential is managed by the partner organization.
Partner Account Management Suppose an employee in a partner organization has a new role that requires access to a different set of your Web apps. With ADFS, your partner always sends claims that reflect the employee's current roles and permissions. Since ADFS allows you to use the partner's claims to control access to your applications, the employee's access is updated immediately.
Partner Account Deactivation What if an employee with access to partner resources is fired? With ADFS, the employer can remove access for this employee across all other partner organizations. Without this functionality, the employer would have to contact each partner organization separately—and the ex-employee would continue to have access until this was accomplished.
Partner Changes Imagine that a partner organization has begun aligning itself with your top competitor. Your organization decides to terminate the partnership to avoid any further information disclosure. With ADFS, the termination of the partnership can be effected with a single trust policy change. Without centralized partner management, individual accounts for each partner employee would need to be deactivated—a much lengthier process.

ADFS Architecture and Message Flow
ADFS provides a standards-based solution that interoperates with other identity federation products supporting the WS-* Web services architecture. ADFS complies with the WS-Federation specification using the Passive Requestor Interoperability Profile. Implementing the WS-Federation specification enables ADFS to interoperate with environments that might not use the Windows® identity model.
Imagine that two companies, A. Datum Corporation and Trey Research Inc., want to set up a federation. Trey Research makes its research reports available to partner companies with a Web application. Trey Research has a new agreement with A. Datum to allow access to these reports for A. Datum employees. Trey Research is referred to as the resource partner in this scenario because it is providing access to the resource Web application. A. Datum is referred to as the account partner in this scenario because the user accounts are managed by A. Datum (see Figure 1).
Figure 1 Partner Relationships
Figure 1 Partner Relationships
So let's examine how the message exchange in this example will work. All exchanges and redirects require the use of TLS/SSL to secure the claims that are transferred. When an A. Datum user accesses the Trey Research ADFS-enabled Web application, the user will be redirected to the Trey Research ADFS Federation Service. If it's the first time the user has been redirected, the Federation Service may present the user with an interface for selecting an account partner membership. This process is referred to as Home Realm Discovery, and it is necessary when Trey Research has more than one partnership. This may be augmented with customized code in order to automate the discovery process. The corresponding ASP.NET page may also be customized by the Trey Research IT organization to provide a consistent interface and experience that would be familiar to the A. Datum user.
After selecting the A. Datum account partner, the user is then redirected to the A. Datum Federation Service, which authenticates the user using the appropriate technology (integrated, forms, certificate, or the like). Referring to its trust policy, the A. Datum Federation Service gives the client a signed security token with a set of claims appropriate for Trey Research to be redirected back to the Trey Research Federation Service.
The Trey Research Federation Service verifies A. Datum's digital signature on the security token and examines the attached claims. For each claim in the security token, the Trey Research Federation Service will refer to its trust policy and map the claim (if configured) to another claim local to the organization. For organizations that are already using Active Directory®, these mapped claims can be further associated with groups in Active Directory. Once all claims have been mapped to their local equivalents, a new security token is created containing the claims local to Trey Research. This token is then sent back to the client to be redirected to the original Trey Research ADFS-enabled Web application.
The Web application receives the security token and verifies the digital signature of the Trey Research Federation Service. Once the signature has been verified, the claims in the token can be used to identify the user and make any necessary authorization decisions.

Claims Flow in ADFS
The heart of identity federation with ADFS is the ability to capture existing identity date in an account partner organization and transmit it as a set of claims to a resource partner organization in a standardized way. The claims from an account partner pass through several components before arriving at the resource application. The transformations that take place at each of these components must be configured correctly for the claims to pass through in the expected manner. Understanding the overall picture of these components and transformations in ADFS helps to understand the purpose of each step of the process.
Figure 2 shows the general flow of claims through all of the ADFS components. The organization claim is the starting point and is typically created first as a representation of the possible claims in the organization. Using the earlier example configuration (which you can read more about in the Step-by-Step Guide for Active Directory Federation Services, the account partner, A. Datum Corporation, is transmitting group claims to its federation resource partner Trey Research.
Figure 2 ADFS Claims Flow
Figure 2 ADFS Claims Flow
It is easy to imagine that A. Datum may want to identify certain individuals who are entitled to purchase new research reports in the Trey Research Web application. This designation could be specified by membership in a particular group in A. Datum's Active Directory. ADFS enables this identity data to be communicated to Trey Research as a claim (I'll call it the "Purchaser" claim), so that Trey Research may ensure that only authorized purchasers are allowed to execute a purchase order.
The Purchaser claim is an A. Datum organization claim that will be passed to Trey Research with the intent to grant access to A. Datum users for the Trey Research Web application. Figure 3 shows the ADFS UI for creating the organization claim in the A. Datum trust policy.
Figure 3 Organization Claim
Figure 3 Organization Claim
Once A. Datum's organization claim is defined, the company's ADFS administrator must define which A. Datum users will be assigned this claim. The mapping can be done by associating one or more Active Directory groups with the claim using the New Group Claim Extraction option for the Active Directory account store. Figure 4 shows a group claim extraction being defined to ensure that all users that are members of the Purchasers group will be assigned the Purchaser organization claim.
Figure 4 Group Claim Extraction
Figure 4 Group Claim Extraction
Now the first two legs of Figure 1 have been configured for A. Datum. The last part of the A. Datum configuration is to enable the claim to be sent to Trey Research using a name for the claim that has been agreed upon by both organizations. To do this I'll define a new Outgoing Group Claim Mapping for the Trey Research resource partner. Here, the string "ResearchPurchaser" is the actual text that will be used to represent this claim in the token sent to Trey Research. Without an outgoing claim mapping for a resource partner, an organization claim will not be sent to that resource partner. This can be useful when you have claims you don't want to share with some partners. Figure 5 shows the claim mapping creation UI with the text and the associated organization claim in the dropdown box.
Figure 5 Outgoing Group Claim Mapping
Figure 5 Outgoing Group Claim Mapping
This completes the configuration of claims flow for the A. Datum account partner. Using the Federation Service UI, I've defined the Purchaser organization claim, configured which users are assigned this claim (based on Active Directory groups), and defined the text representation of the claim to Trey Research. Using the partner relationships in Figure 1 as a reference, I've defined the first three transformations and the A. Datum Federation Service now correctly packages claims in the user's token to be transmitted to Trey Research.
To begin configuring the Trey Research Federation Service to handle this claim, I now need to define an organization claim for Trey Research. This claim is constructed using the same interface shown in Figure 3 and is called the Adatum Purchaser Claim. Once the claim is defined, I'll associate it with the incoming text in A. Datum users' security tokens by creating a new Incoming Group Claim Mapping in the A. Datum account partner configuration of the Trey Research Federation Service. Because the mapping represents the actual incoming text, it must match exactly what is configured in the A. Datum trust policy. Figure 6 shows the connection between the text and the Adatum Purchaser Claim.
Figure 6 Incoming Group Claim Mapping
Figure 6 Incoming Group Claim Mapping
At this point, all of the necessary components have been configured except for enabling the claim for the particular Trey Research application. Optionally, the claim may be mapped to an Active Directory group to allow an NT Token-based application to rely on Win32® authorization mechanisms such as access control lists (ACLs) set using Active Directory security identifiers (SIDs). This configuration change is made on the organization claim itself under the properties dialog and is optional because claims-aware applications do not leverage the Windows NT® token model.
The final step for completing the flow to the application involves configuring the organization claim to be sent to the intended application, as detailed in the ADFS Step-by-Step Guide. Completing this final step connects all the components together so that, for the account partner, claims may be created from Active Directory groups and sent to appropriate partners. For the resource partner, claims may now be received from partners, possibly correlated with Active Directory groups, repackaged in the user's security token, and sent to the appropriate applications.
Claims-aware applications are part of a newer model designed for applications written in ASP.NET 2.0 and built to handle the claims within the application code. These applications consume ADFS claims natively and may make authorization decisions based directly on the content of those claims, without necessarily incorporating Windows security principals or groups. Using claims in this way allows inclusion of dynamic, custom claims, such as purchasing limits, that may be configured at the Federation Service and distributed to applications that understand the claims. Using the example Purchaser claim defined in this section, the Trey Research Web application may now allow A. Datum users with the Purchaser claim to order new research reports for A. Datum. This functionality is enabled without the need for Trey Research to maintain any A. Datum user accounts.

ADFS Best Practices
Imagine for a moment that, as the local ADFS guru, you are asked to spearhead configuring your company's 30 business partners as account federation partners. Setting up a single partner following the ADFS Step-by-Step Guide wasn't too difficult, but what about configuration on a larger scale? There are important concerns for organizations looking to scale the number of partners further out in ADFS. Best practices for addressing these concerns include understanding the technical requirements of your partnering process, using a consistent structure for organization claims, and using the ADFS Object Model (OM) Application Programming Interface (API).
Standardization Your organization may have a large set of business and legal requirements for setting up federation partners, but the ADFS technical requirements are fairly simple. Whether your organization will be functioning in the account or resource partner role, you'll need to agree with each partner on the actual names for the claims that will be exchanged across organizations. If you are a resource partner with numerous account partners, it may be fairly easy to develop a standard set of mappings and ask your account partners to conform as part of the partnership. As a resource partner, you must also make sure you obtain each account partner's token-signing certificate, which must be configured when creating the partner in the ADFS trust policy.
Flexibility When organizing claims in trust policy, there are some constraints to be aware of. For organizations looking to leverage NT Token-based applications, at least one group claim must map to each security group that the organization plans to use for authorization decisions on account partner users. The claims and mapping system in ADFS allows for some flexibility and abstraction in claim assignment on the resource. For example, in situations where multiple different claims from a partner result in the same claim on the resource side, ADFS allows multiple claim mappings to refer to the same claim. Because the claims intended for claims-aware applications often do not map to Active Directory groups, there is even more flexibility for those applications. Flexibility in the ADFS claims model allows for many solutions.
Automation For organizations with complex workflows and business processes and high partner churn, the ADFS OM API offers an alternative to the manual configuration process. The OM API allows programmatic access to trust policy construction and editing. Organizations with existing custom tools for handling business processes can integrate ADFS trust policy editing into the partnering process tools directly. As partner volume and churn increase, this can also be preferable to allow for some automation as well as extended partner-analysis functionality.
Read more about the ADFS OM API at go.microsoft.com/fwlink/?LinkId=66063.

Integration with SharePoint
Understanding the flow of claims makes configuring the trust policy fairly intuitive. The Web application and ADFS Web Agent are the final elements of a full ADFS configuration. There are many applications that can be federation-enabled with ADFS Web Agents. Windows SharePoint Services (WSS) and SharePoint Portal Server (SPS) 2003 are popular options because of their rich, user-focused functionality. The ADFS Step-by-Step Guide details configuring WSS as an NT Token-based application and using claims mapped to Active Directory groups for partner-user authorization. The first appendix of the guide describes the necessary configuration steps for ADFS with SPS 2003. The ADFS Step-by-Step Guide is a great source of finely detailed information on this integration, so I'll just summarize the important points about deploying ADFS with the SharePoint technologies.
WSS qualifies as an NT Token-based application and integrates with the corresponding ADFS Web Agent. Configuring the ADFS Web Agent is the same for SharePoint as it is for most other NT Token applications. As stated in the guide, you configure the Federation Service URL within IIS and then enable the ADFS Web Agents on the default Web site. Figure 7 shows the IIS console interface for configuring the ADFS Web Agent.
Figure 7 Configuring the ADFS Web Agent
Figure 7 Configuring the ADFS Web Agent
Once the Web Agent is configured for the SharePoint application, Active Directory groups can be assigned SharePoint roles such as Reader, Member, or Administrator. This process of assigning roles is part of SharePoint. SPS 2003 adds several significant features beyond WSS, including the ability to search across multiple sites. Because the SPS indexing process requires Windows Integrated Authentication, using SPS 2003 with ADFS requires a large farm-type configuration. The large farm configuration allows an internal indexing site to remain configured for Windows Integrated Authentication while the external sites are ADFS-enabled. This is important because configuring the SPS 2003 option described in the ADFS guide requires up to nine machines for a full identity federation simulation.
When using WSS or SPS with ADFS as a federated application, administrators must also consider the integration points with Microsoft® Office 2003 clients. The WS-Federation Passive Requestor Interoperability Profile, which ADFS implements, was designed for use by browsers that fully implement HTTP along with client-side scripting. The HTTP clients in Office 2003 are designed with constrained browser functionality in order to keep security high and attack surface low. With the constrained browser functionality, Office clients are not always able to participate fully in the protocol. WSS and SPS have several unique integration points with Office clients that must be disabled to avoid confusing user errors in Office applications. The Knowledge Base article details the necessary configuration changes and supported scenarios. Much of the user experience remains the same, and downloaded documents will still be displayed to users in a manner similar to standard Internet browser downloads.

Conclusion
ADFS-enabled identity federation allows organizations to share identities in an interoperable, standardized way while reducing the headaches involved in business-to-business partnering. In addition, the claims-based identity model supported by ADFS and the WS-* specifications represents an integral part of the Microsoft identity platform. The online documentation makes it easy for you to experiment with the technology and see how it can help to alleviate your identity management challenges.

Matt Steeleis a Program Manager on the Active Directory Federation Services team at Microsoft. Matt is currently working on ADFS product integrations and supporting the design of future identity and access technologies.


 Managing Identity: Create Custom Directories with ADAM
Identity & Access Management Brian Redmond

Create Custom Directories with ADAM
At a Glance:
  • ADAM versus Active Directory
  • Using ADAM effectively
  • ADAM bind redirection
  • Some ADAM-centric utilities

Active Directory Application Mode, also known as ADAM, is often misunderstood. In this article I will demystify ADAM, explain how it can be a useful tool in many organizations, and show you some valuable utilities that make it easier to use.
ADAM is a directory service based on the Lightweight Directory Access Protocol (LDAP). The concept of an LDAP directory was created after the introduction of X.500 directories. LDAP is similar to X.500, but is more lightweight and is designed for fast, efficient information search. You might think of LDAP as similar to a telephone directory. In computing, LDAP directories store information about people, computers, printers, and services. LDAP directories typically have a replication mechanism that allows this sort of data to be readily accessible across a network or the Internet.
Active Directory® is also an LDAP directory, but in addition, it provides a substantial list of other infrastructure services that are not part of a basic LDAP directory. ADAM is solely an LDAP directory, built for situations where LDAP is the only required protocol. It does not provide all of the additional infrastructure features that Active Directory provides.
Figure 1 shows the differences between ADAM and Active Directory. As you can see, ADAM uses the same Extensible Storage Engine (ESE) database engine as Active Directory. It also uses the same LDAP protocol and replication mechanisms. However, ADAM does not provide a Kerberos service, Group Policy, Global Catalog, and other technologies to support an enterprise-wide security system. LDAP support in ADAM is the same as in Active Directory, which means both are compliant with the LDAPv3 proposed standard (see microsoft.com/windowsserver2003/techinfo/overview/ldapcomp.mspx for more information). This allows you to take a legacy application that requires generic LDAP and possibly migrate it to ADAM, gaining a higher level of standardization and consistency in the directory platform.
Figure 1 ADAM Uses a Subset of Active Directory Components
Figure 1 ADAM Uses a Subset of Active Directory Components
Since ADAM and Active Directory share the same database engine and LDAP protocol, you gain some interesting advantages. The programming model is the same; applications that work with Active Directory will typically work in a similar fashion with ADAM. Also, ADAM will scale at least as well as Active Directory, or possibly even better due to less overhead. ADAM shares the same mechanisms for Access Control Lists (ACLs) and delegation of control. This allows for attribute-level control and container-level control within the directory. You can also configure ACLs on the data stored in ADAM for user principals stored in the ADAM instance or for Windows®-based user accounts. By sharing these kinds of technologies, administrators can easily transfer the skills they've acquired in using Active Directory to managing ADAM.
ADAM shares the same reliable replication mechanisms as Active Directory. Multiple ADAM servers can share the same directory, but can still be configured in a multi-master set of replicas. This means that ADAM stores its replication topology within the directory and uses the Knowledge Consistency Checker (KCC) to calculate the actual replica connections. ADAM uses the same serial number (USN)-based delta replication technologies and conflict-resolution algorithms as Active Directory does. If you have worked with Active Directory in the past, you know these technologies to be reliable and resilient. ADAM instances can easily be load balanced using Windows Load Balancing Service or any other network load balancing technology.
ADAM Management Tools
In most cases, the data in ADAM is either synchronized from Active Directory or managed from within a custom application. ADAM does have a number of management tools available to administrators and developers who are building a solution. If you’re used to working with Active Directory, you’ll find many of these tools familiar.
ADAM ADSI Edit Though this is primarily a raw data manipulation utility for administrators, it is the main data-editing utility provided with ADAM. Since ADAM is typically used more for application solutions, organizations often develop front-end interfaces in the application or synchronize the data with another directory.
Ldp This is another raw LDAP tool for viewing and managing the ADAM instance. Ldp.exe can be used with any LDAP directory and allows for viewing, searching, and updating data within the ADAM directory. For example, to connect to an ADAM instance, see the instructions at go.microsoft.com/fwlink/?LinkId=66565.
Dsmgmt With Windows Server 2003, Microsoft increased the focus on providing command-line management tools. The ADAM Dsmgmt tool is used for basic ADAM administrative functions at the command prompt. See go.microsoft.com/fwlink/?LinkId=66566 for more information.
Ldifde and Csvde These tools allow for bulk import and export of directory data. Ldifde uses the LDAP Data Interchange Format (LDIF) for files, while Csvde uses comma-delimited files. Both tools are useful in making mass changes to the directory, but would not be very efficient for ongoing synchronization. For information about Ldifde see go.microsoft.com/fwlink/?LinkId=66568. For information about Csvde see go.microsoft.com/fwlink/?LinkId=66569.
Repadmin This tool allows the ADAM administrator to manage and monitor replication of ADAM replicas. For more information see go.microsoft.com/fwlink/?LinkId=66570.
Dsdiag This tool provides diagnostic functionality for ADAM that is useful during troubleshooting situations. For more information see go.microsoft.com/fwlink/?LinkId=66571.
ADAM Schema Management MMC Snap-In The MMC snap-in is used for changing the ADAM instance schema. To access the snap-in, adamschmmgmt.msc, see go.microsoft.com/fwlink/?LinkId=66572.

But there are some notable differences with ADAM, too. ADAM does not require that you convert your server to a domain controller. In fact, multiple instances of ADAM can be run on a single server. Each instance of ADAM on a single server will have its own schema and LDAP port. ADAM can run on either Windows XP or Windows Server™ 2003. This also includes the 64-bit versions of these operating systems.
You can stop, start, install, or uninstall ADAM instances without restarting the system. ADAM supports X.500 naming conventions for the directory (such as O=US, C=Company).
ADAM credentials can only be used for a LDAP BIND into the ADAM instance. Though there are ADAM user and group objects, they will only have access to objects in their specific ADAM partition. ADAM does not use DNS service locator (SRV) records for users to locate ADAM instances. It is only based upon standard server name lookup (DNS A records). And ADAM does not support the concepts of forests, domain trees, or trusts.

ADAM in R2
Windows Server 2003 R2 was recently released by Microsoft as an update to the Windows Server 2003 platform. A number of the new features in R2 focus on identity management, including ADAM, which was previously only available as a separate download. The R2 version of ADAM has also been updated with some interesting new features. For example, ADAM bind operations now support Digest Authentication. This is a more secure authentication mechanism that eliminates the clear text storage of a user's password in memory.
In cases where a user has a proxy object in ADAM representing a user in Active Directory, ADAM will now allow you to change a password in ADAM and have it automatically changed in Active Directory during the same operation.
In the previous version, only Active Directory users could be ADAM administrators. I could not place an ADAM principal in the proper context that would allow it to manage the instance. Users can now be created in the configuration naming context and thus be given the rights to administer the instance.
With the R2 release, Microsoft also added some new tools that make ADAM much easier to implement and manage. Microsoft added a new version of the Ldp.exe tool that allows for raw LDAP functions. This new version also includes a much anticipated ACL editor. R2 also ships with Active Directory Schema Analyzer and ADAM Synchronizer. These two tools can be used in conjunction with each other to replicate data from Active Directory over to your ADAM instance.

Using ADAM Effectively
ADAM is intended to solve certain kinds of application requirements that can't easily be solved with the existing Active Directory infrastructure. ADAM can be a useful tool in a number of different scenarios.
White Pages Directory Because LDAP directories are well suited to quick search of information, Active Directory can certainly act as a "white pages" employee directory for your organization. On the other hand, if you want the directory to include people who are not in Active Directory, ADAM might be the perfect choice.
Using a directory synchronization utility of your choice, you have the ability to pull data from your Active Directory as well as other databases in the organization (see Figure 2). This allows your white pages directory to include people such as contractors, suppliers, partners, or customers who may be stored in a number of other systems. This ADAM instance could be developed with a Web application interface in your intranet, allowing for easy access to white pages data.
Figure 2 Synchronizing White Pages
Figure 2 Synchronizing White Pages
Application-Specific Schema Requirements Many organizations are protective of their Active Directory schema, requiring approval by high-level corporate managers to get the schema extended. There is a safe, documented way to extend the Active Directory schema, but in many cases, it may not make sense relative to the goals of the IT group. For example, the attributes needed for the application may be local to that particular application and not needed for other systems, so extending the Active Directory schema may be hard to justify. In these cases, the application-specific data could be stored in an ADAM instance where the schema could be tailored to suit the needs of the application without impacting the larger Active Directory schema.
Figure 3 ADAM Used for Special Data
Figure 3 ADAM Used for Special Data
In the model shown in Figure 3, the authentication is still handled by Active Directory. When the application needs to access the special schema data about the user (for example, shoe size or shirt size), it can read the data from or write the data to the ADAM instance. In this example, data like shoe size and favorite color do not belong in the corporate authentication directory.
Extranet Authentication It can be difficult to implement Web applications in an extranet or intranet and provide strong and effective authentication. Kerberos does not work over the Internet, so providing a seamless Web single sign-on (SSO) login experience for users is quite difficult. Solutions often involve placing a policy server in the perimeter network (also known as the DMZ, or demilitarized zone, and screened subnet) that can manage authentication and provide tokens to users for Web SSO.

Microsoft recently released Active Directory Federation Services (ADFS) as a solution for cross-organization trusts to allow federated relationships for Web applications. ADFS can also provide Web SSO for Internet-based Web applications. Generally, policy servers like ADFS do not store user credentials and instead use some sort of LDAP directory. ADFS is designed to work with either Active Directory or ADAM. In this case, ADAM would store the credentials of application users and ADFS would handle the authentication.
In Figure 4, ADFS is running on the Web server and intercepts all requests. Each request is verified against the ADFS Federation Server, which checks ADAM for the validity of the account. Once validated, a token (cookie) is issued and can be used against any other server in the perimeter network environment. (See Matt Steele's article in this issue of TechNet Magazine for more information about ADFS.)
Figure 4 ADAM Used with ADFS
Figure 4 ADAM Used with ADFS
Legacy LDAP Migration There are many third-party and custom applications developed to work with LDAP directories. Many organizations would like to minimize the number of directories they manage. If some of these applications can be migrated to Active Directory or ADAM, they can begin to accomplish this goal (see Figure 5).
Some applications require special schemas or naming contexts (for example, "O=corp,O=contoso,C=us") that are not compatible with Active Directory. ADAM can replace the legacy LDAP directory and the application could continue to function normally. This solution can be combined with the ADAM bind redirection ability to limit the number of passwords you would need to maintain.
Figure 5 Migrating Legacy Directories
Figure 5 Migrating Legacy Directories

ADAM Bind Redirection
ADAM bind redirection is a special function that allows legacy applications to be integrated with Active Directory even if they are not designed to support it. This solution is generally targeted at applications that only support LDAP bind as an authentication mechanism. In some cases, the special schema or naming context may force you to avoid Active Directory, making ADAM a perfect choice. That said, you would not want to contribute to the multiple passwords users must remember by employing an additional directory with its own user ID and password.
You can create a special user proxy object in ADAM that maps to a regular Active Directory user account. The user proxy does not have an actual password stored in the ADAM object itself. When the application performs its normal bind operation, it checks the ID locally, but checks the password against Active Directory under the covers (see Figure 6). The application does not need to be aware of this Active Directory interaction. This is clearly beneficial because you can reduce the number of passwords users must remember and maintain. Also, by using ADAM instead of the legacy LDAP directory, your IT department gains consistency across the supported directory solutions.
Figure 6 Using LDAP Bind Redirection
Figure 6 Using LDAP Bind Redirection

Active Directory Schema Analyzer
When you build an ADAM instance, you first need to create the appropriate schema for the data to be stored. If you are building a custom application, you can easily build your schema using custom LDIF files, scripts, or in the ADAM Schema Management MMC snap-in. When copying data from an existing Active Directory instance, it would be cumbersome to build the schema file needed. Active Directory Schema Analyzer was created to allow ADAM administrators to quickly copy the schema from an Active Directory instance and then import it into ADAM.
To import a schema, start by opening the ADSchemaAnalyzer utility. Now use the Load target schema function. Here you will enter the connection details for the Active Directory server from which you want to copy the schema (see Figure 7). This will load your Active Directory schema into ADSchemaAnalyzer.
Figure 7 Loading the Target Schema
Figure 7 Loading the Target Schema
Next, use the Load base schema function. This works much like loading the target schema except you enter the connection details about the ADAM instance where you want to copy the schema. When the ADAM schema is imported, ADSchemaAnalyzer compares the two and finds any differences. You can then use the "Mark all non-present elements as included" function to mark the missing schema elements that are needed within ADAM.
Figure 8 Preparing the Schema for ADAM
Figure 8 Preparing the Schema for ADAM
Use the Create LDIF file command to create a schema file that will be ready for importing into ADAM, as shown in Figure 8. You can then use an Ldifde command to import the schema into ADAM. The Ldifde syntax needed is provided for you in a comment within the LDIF file created by the tool. For example, you would see something like this:
ldifde -i -u -f "C:\test.ldf" -s adamserver.contoso.com:3389
-b adammgr contoso * -j . -c "cn=Configuration,dc=X" #ConfigurationNamingContext
Once complete, the ADAM schema is identical to the Active Directory schema.

Active Directory to ADAM Synchronizer
The other new tool to look at is the Active Directory to ADAM Synchronizer, Adamsync. Now that your ADAM schema matches your Active Directory schema, you can start copying actual data from Active Directory into ADAM. There are a number of different ways to copy and synchronize the data, as detailed in Figure 9.
Figure 9 Active Directory Synchronization Options (Close Figure 9)

Sync Method | Description
Microsoft Identity Integration Server (MIIS) | Dedicated tool for identity synchronization and account provisioning in a variety of systems (directories, databases, files, host systems, and so on). Can modify data while synchronizing.
Ldifde/Csvde | Tools used to import or export data from a directory using a text file as storage. It would be possible to use these as methods to copy data from Active Directory to ADAM, but they would not be effective for ongoing synchronization.
ADSI or System.DirectoryServices | A custom application could gather data from one directory and copy it to another. Code libraries such as ADSI or System.DirectoryServices in the .NET Framework allow you to read and manipulate the data.
LDAP synchronization utilities | Third-party solutions are available to synchronize directories.
ADAMSync | A utility that performs a one-way synchronization of data in Active Directory into ADAM.
Adamsync is a command-line utility that performs a one-way synchronization of data from Active Directory into ADAM. Adamsync uses an XML-based con-figuration file that drives the parameters of the ongoing synchronization (see Figure 10). The details of the configuration are stored in the ADAM instance itself. You will need to extend the schema of your ADAM instance in order to do this. A default schema file is provided with a base install.
Figure 10 Adamsync Config File (Close Figure 10)
<?xml version="1.0"?>
<doc>
 <configuration>
  <description>Sample Adamsync Configuration
    File</description>
  <security-mode>object</security-mode>
  <source-ad-name>AD-DC</source-ad-name>
  <source-ad-partition>dc=contoso,dc=com
    </source-ad-partition>
  <source-ad-account>administrator
    </source-ad-account>
  <account-domain>contoso.com</account-domain>
  <target-dn>ou=People,o=contoso,c=us
    </target-dn>
  <query>
     <base-dn>ou=Coporate,dc=contoso,dc=com
      </base-dn>
   <object-filter>(objectClass=user)
     </object-filter>
   <attributes>
    <include>displayname</include>
    <include>givenName</include>
    <include>sn</include>
    <include>mail</include>
    <include>sAMAccountName</include>
   </attributes>
  </query>
  <schedule>
   <aging>
    <frequency>0</frequency>
    <num-objects>0</num-objects>
   </aging>
   <schtasks-cmd></schtasks-cmd>
  </schedule>
 </configuration>
 <synchronizer-state>
  <dirsync-cookie></dirsync-cookie>
  <status></status>
  <authoritative-adam-instance>
    </authoritative-adam-instance>
  <configuration-file-guid>
    </configuration-file-guid>
  <last-sync-attempt-time>
    </last-sync-attempt-time>
  <last-sync-success-time>
    </last-sync-success-time>
  <last-sync-error-time>
    </last-sync-error-time>
  <last-sync-error-string>
    </last-sync-error-string>
  <consecutive-sync-failures>
    </consecutive-sync-failures>
  <user-credentials>
    </user-credentials>
  <runs-since-last-object-update>
    </runs-since-last-object-update>
  <runs-since-last-full-sync>
    </runs-since-last-full-sync>
 </synchronizer-state>
</doc>
You can create one or more Adamsync configurations and install them into ADAM using the /install parameter. Once installed, Adamsync will keep the specified ADAM instance up to date by working with the Active Directory DirSynch mechanism. You have the ability to filter on particular containers and object types. You can also select attributes to include or exclude as needed. The ability to have multiple configurations at once allows you to have multiple Active Directory domains all synchronized into a single ADAM instance.
Here is how the synchronization process works. First, create an XML configuration file. A sample is provided with the ADAM installation and placed in the C:\Windows\Adam folder. The sample shown in Figure 10 shows some of the key areas that need to be updated. The source and target domains must be identified and the query section allows you to limit the data you want to import from Active Directory.
Next, install the configuration file using the /install parameter:
adamsync /install adamserver.contoso.com:3389 CONFIG-FILE.XML
You can use the /list parameter to view any installed Adamsync configurations. All other parameters can be viewed by running Adamsync with the /? parameter.
The following command performs a full synchronization of the data by using the /fs parameter:
adamsync /fs adamserver.contoso.com:3389 "ou=People,o=contoso,c=us"
Once a full sync is performed, ongoing synchronizations would only need the /sync parameter:
adamsync /sync adamserver.contoso.com:3389 "ou=People,o=contoso,c=us"
The /log command-line parameter can be used to output debugging information for troubleshooting.
adamsync /sync localhost:4389 "ou=People,ou=test2,o=contoso,c=us" /log –
You should now be able to see your ADAM instance populated with data from Active Directory.

Conclusion
After reviewing all of the capabilities that ADAM supplies, you can see that it provides one agile little directory service and is a valuable supplement to the more feature-rich Active Directory. ADAM gives you the ability to expand the power of Active Directory. ADAM lets you adapt schemas to your particular application needs, and it supports a directory for applications to address numerous application architecture solutions. All of this is possible, while retaining the technology requirements and skill sets consistent with Active Directory.

Brian Redmond is a Technology Specialist with Microsoft specializing in identity management and infrastructure technologies. Brian is based in Pittsburgh, PA, and enjoys biking, hiking, baseball, and traveling. He can be reached at brian.redmond@microsoft.com


 Managing Identity: Extreme VPN Makeover
Identity & Access Management David Conrad

Extreme VPN Makeover
At a Glance:
  • VPN vulnerabilities
  • Deploying a PKI
  • Authentication options
  • Quarantined connections

Who decided that Virtual Private Networks, or VPNs, were a good idea? With VPNs, we could let armies of mobile workers with "legitimate" business needs connect to our nice corporate
networks—using the same home PCs their teenagers used for gaming and who knows what else. Quick to see the value of VPNs, IT managers immediately proceeded to fund projects, ensuring that legitimate productivity would forever be slowed as workers learned they could check their e-mail and play online poker at the same time.
Fast forward to today and not much has changed. Many organizations still use the basic VPN scenario they deployed years ago, relying on the Point-To-Point Tunneling Protocol (PPTP) and letting all kinds of infected, unpatched, and misconfigured machines connect to their network. In today's environment of ever-more-sophisticated Internet threats, this kind of setup just doesn't cut it. If your VPN solution hasn't evolved to stay ahead of these types of threats, do yourself a favor and give your organization an extreme VPN makeover.
An extreme VPN makeover based on Microsoft technologies will improve your VPN security in two main areas. First, it ensures that your data protection is based on strong IP Security (IPsec), and second, it uses the Microsoft® VPN quarantine service to inspect client machines as they connect, ensuring that clients have the required security patches and antivirus definitions installed before they can access the rest of the corporate network.
In this article, I'll discuss a secure VPN solution built on two key products, Windows Server™ 2003 and Internet Security and Acceleration (ISA) Server 2004. I'll describe how to provision X.509 digital certificates to your VPN users and look at the VPN quarantine service. If you need a step-by-step guide for installing and configuring a secure VPN solution, see the ISA Web site.

Setting Our Goals
Let's say we need to support a mobile community and our users need access to our network not only from their managed PCs (members of the corporate domain), but also from their home PCs and other networks. We also need to make sure no one introduces viruses, malware, or other threats into our corporate network by connecting with unpatched, unprotected machines. How can we accomplish these goals?
First, we want every VPN client coming into our network to use strong IPsec encryption for data protection, requiring an X.509 digital certificate on each client. It's easy to issue certificates to managed workstations, but what about home machines and contractor PCs? We can provision certificates to these machines using the cmgetcer.dll tool from the Windows Server 2003 Resource Kit. The strategy is to let clients connect using the weaker PPTP protocol just long enough to get a digital certificate and then forcibly disconnect them and have them reconnect using the certificate-based IPsec encryption. We'll use a couple of remote access policies defined on a domain controller to manage this behavior.
Next, we need to make sure no one brings the latest virus, worm, or other exploit into the network. For this we'll use the VPN quarantine service, which allows VPN clients to be held in quarantine until they've passed a health check. Administrators can script additional checks, but at a minimum each client should be checked for current antivirus definitions, the latest security patches, and a few other odds and ends, such as ensuring that the Windows® Firewall is enabled. Once a client is deemed healthy, the VPN quarantine service releases the client from quarantine, allowing it to access network resources. Clients that fail the check can be held in quarantine and patched by a server on the quarantine network, then reevaluated. For a general description of the quarantine procedure, see the "The Quarantine Process" sidebar.
Finally, we'll assume that our users have Active Directory accounts and that we'll use usernames and passwords (MSCHAPv2) for our authentication scheme. As we walk through the solution scenario, you should assume that users enter valid Active Directory user name and password credentials for authentication.
To understand the mechanics of this solution, let's dig into its components.

The Quarantine Process by Steve Riley
1 Pre-Connection A pre-tunnel script runs before the remote client initiates the VPN connection. This script checks most of the policy elements and stores the results. If the script fails, it stops the connection attempt and informs the user.
2 Connection If the script succeeds, the remote client establishes a connection to the RAS server.
3 User Authentication The RAS server contacts a RADIUS server to authenticate the user. If authentication fails, the script aborts the connection and informs the user.
4 In Quarantine If authentication succeeds, the RAS server places the remote client in quarantine. Here a post-tunnel script performs additional non-mandatory checks and limits the remote client in two ways: IP filters restrict the computer's communications capabilities to the quarantine subnet only, and a timeout ensures the computer doesn't remain in quarantine forever.
5 Notification The post-tunnel script returns the results of the pre-tunnel script to the RAS server. If the remote client is out of policy compliance or if the timeout expires before the remote client replies with acceptable results, the script drops the connection.
6 Access Granted If the post-tunnel script succeeds, the RAS server removes the IP filter restrictions and allows the remote client full regular access to the network (as specified in the remote access policy).

VPN Protocols
For years network administrators deployed VPN solutions based on PPTP because it was simple. PPTP clients were built into Windows, available for many other platforms, and didn't require any additional infrastructure services. While PPTP provides good security, it lacks advanced data protection features such as establishing a secure connection before authentication takes place, providing data authentication, and protecting against replay attacks. Chances are good that your current VPN solution uses PPTP, and a big part of this extreme VPN makeover is to upgrade to the stronger Layer Two Tunneling Protocol (L2TP).
The Microsoft implementation of L2TP addresses the security shortcomings of PPTP by using IPsec to provide enhanced data protection features, so it might more correctly be called L2TP over IPsec, or L2TP/IPsec. One of IPsec's most significant advantages over PPTP is that the entire user authentication process takes place after an encrypted connection is established between the client and the VPN server. IPsec requires X.509 digital certificates on each client machine, which in turn requires a public key infrastructure (PKI) to deploy the certificates.

PKI Certificate Autoprovisioning
The first step in our VPN makeover is to move the Windows clients to certificate-based L2TP/IPsec to improve data protection. If you have an existing PKI, your clients may already have machine certificates that will work (they must contain the Enhanced Key Usage OID "1.3.6.1.5.5.7.3.2" which is used for client authentication.) If you don't have a PKI, or you need to extend your solution to home machines or contractors, you can take advantage of the Certificate Services built into Windows Server 2003.
Be aware that deploying any kind of PKI is a serious matter that requires planning. Every implementation should include two legal documents that describe the overall security policies. A Certificate Policy (CP) must describe how users are authenticated before they receive certificates, the certificates' intended uses, and other such information. A Certificate Practice Statement (CPS) should describe how the Certificate Authorities (CAs) in your PKI are maintained and the environmental security precautions you've put in place to protect it. If you're setting up a new PKI just to enable secure VPN, take some time to look at the example CP and CPS documents available on the Microsoft Web site and perhaps adjust them to reflect your organization's policies. A corporate security officer often takes the lead with these documents.
Now back to the technology. Let's assume we don't have an existing PKI and that our only requirements are to deploy certificates to VPN clients. We'll need a Windows Server 2003 Enterprise Edition server for our Certificate Authority (CA) because it's the only edition of Windows that supports Version 2 Certificate Templates. This machine should be a member of our domain because we want to take advantage of the certificate auto-enrollment features available on domain members. We should include IIS and the certificate enrollment Web pages. When we enable the Certificate Services on our server, we need to configure it as an Enterprise Root CA. This publishes the CA information into Active Directory, and it allows us to take advantage of the auto-enrollment features supported by domain member CAs. Once the CA is enabled, we configure it to allow client machine certificates to be automatically issued to authenticated users, thus enabling our provisioning scenario. Finally, we'll deploy a machine certificate to the VPN server, which is going to run ISA Server 2004.
With the CA configured to issue client certificates, we're ready to let our VPN clients request certificates using the cmgetcer.dll tool. The client connects to the VPN server using PPTP, then requests the certificate by running a script. The script and its parameters are specified in the Connection Manager Client VPN software, which we'll get to in a bit. The cmgetcer.dll tool solves two of the toughest problems in PKI deployments. When an authenticated client requests a certificate, not only does cmgetcer.dll take care of enrolling for a certificate, but it also registers the issuing CA and any associated certificate chain into the client's trusted CA store.

The VPN Endpoint
ISA Server 2004 is the VPN endpoint for our solution. Though Windows Server natively includes a VPN server as part of the Routing and Remote Access Services, enterprise customers need the additional security, manageability, and rules provided by the ISA Server 2004 VPN service. ISA Server 2004 is an application-layer firewall (ALF) that provides stateful packet inspection at Layer 7, as well as secure VPN services based on PPTP or L2TP. The ISA Server VPN services may be load balanced across multiple machines and, importantly, may run on servers that are not domain members. Deploying ISA Server on workgroup member servers in the DMZ is an important part of a defense-in-depth strategy, as no services run with domain credentials on the VPN servers.
Configuring ISA as a workgroup member in the DMZ is straightforward. You need to specify which VPN protocols are allowed, in our case both PPTP and L2TP. You'll recall that L2TP is really L2TP/IPsec, so we'll manually request a machine certificate from our CA using the built-in certificate Web pages. With the certificate properly configured on our ISA server, we can select how we want to handle authentication.

RADIUS Authentication
Since the ISA VPN server is not a member of our domain, it can't directly authenti-cate our domain users. As a result, we'll need to configure the ISA VPN server to use Remote Access Dial-In User Service (RADIUS) for authentication.
The RADIUS server we'll use is the Internet Authentication Service (IAS), another service that is built into Windows Server (see Figure 1). By enabling this service on one or more domain controllers on the internal network, our domain controllers can serve as RADIUS servers for RADIUS clients, which in our case is the ISA VPN Server.
Figure 1 Configuring IAS
Figure 1 Configuring IAS
The traffic traveling between the RADIUS client and server is encrypted based on a shared secret password, so use the same long, complex password on each machine. One of the nice things about this configuration is that your ISA VPN server in the DMZ uses a single port (usually UDP 1812) to send authentication requests into the internal network. There is no need to open numerous ports to allow typical Kerberos-style authentication through the DMZ's internal firewall.
Now, with the IAS service enabled on one or more domain controllers, we need to build a couple of remote access policies. IAS uses these policies to determine whether a user should be granted VPN access. One common strategy is to create a Windows security group called VPN Users and to place any appropriate Active Directory users in that group. Then you can create a remote access policy that allows members of that group to VPN into the network.
Organizations can have many remote access policies defined for many different scenarios. As clients attempt to authenticate via RADIUS, policies are evaluated in the order they are listed on the IAS server. The first matching policy is the policy that's used for that client, and if no policies match, the client is not permitted to connect.
Now let's define our remote access policies. The first policy will indicate that the user should be using the L2TP tunnel type, and it will specify some parameters specific to the VPN quarantine service. The second policy will allow PPTP tunnel types, but will only allow authenticated users to stay connected for one minute, in order to allow the certificate autoprovisioning mechanism we've set up to work. After one minute, IAS will cause the ISA VPN server to disconnect the client, enforcing the policy.

VPN Connections
With these two policies in place, we've set the stage for the behavior we want. Shortly, we'll look at how to configure the client VPN software, but essentially here's what happens. First, clients attempting to VPN into our network will have to use the Connection Manager dialer package we create later. This custom dialer runs the VPN quarantine scripts locally on the client and subsequently reports its health to the VPN quarantine service. Without the custom dialer, clients would be stuck in quarantine indefinitely.
Clients attempting to connect to our VPN server will try to establish an L2TP connection first and then fall back to PPTP if necessary (see Figure 2). This is another configuration choice made in the Connection Manager dialer. The first time a new client tries to connect to the VPN server, it will not have a certificate so L2TP will fail. The client will then transparently attempt a PPTP connection. At the VPN server, we've chosen to allow PPTP traffic, so the ISA server accepts the PPTP connection attempt and uses RADIUS to request authentication for the user. The IAS RADIUS server begins checking its remote access policies. Since the first policy allows connections only with L2TP, the connection type doesn't match and the next policy is evaluated. Since the next policy allows PPTP, and since the user has the proper Active Directory credentials, the connection is permitted, but only for one minute, thanks to our PPTP policy.
Figure 2 The Connection Process
Figure 2 The Connection Process
It is during this critical one minute of connection that we need our certificate autoprovisioning to work. Connection Manager provides the capability to execute scripts or other commands on the client after a successful connection is made. We'll use this feature to run a batch file that requests an X.509 certificate from our certificate server, which is all we need to do over our PPTP connection. Remember, the certificate server has to be accessible from the VPN quarantine network that ISA defines.
After the PPTP connection is forcibly disconnected, Connection Manager attempts to reconnect. The Connection Manager software is set to try L2TP first, and since we now have a machine certificate, the client will try this connection type. Since our ISA VPN server was configured to allow L2TP connections (and it also has a machine certificate), it will accept this connection attempt and use RADIUS to authenticate the user. The IAS server will check its list of remote access policies, starting at the top. Since the first policy matches our criteria, with a tunnel type of L2TP, and since we've used valid Active Directory credentials, we're allowed to connect.
Now our client is placed on the VPN quarantine network, a special virtual network ISA creates when you configure it to use the VPN quarantine service. A client that successfully authenticates via the remote access policies is automatically placed on this VPN quarantine network until ISA gets the signal that it's safe to move the client out of quarantine and over to the VPN client network, which permits access to some or all of the corporate network. Let's take a closer look at the VPN quarantine service.

VPN Quarantine Service
The VPN quarantine service has a simple mission: place each VPN client on a restricted virtual network, check it for required security patches, antivirus definitions, and any other prerequisites set forth by your security policy, and then allow the client access to the network if it passes the administrator's checks. Administrators may choose to put one or more software update servers on the quarantine network (as defined by ISA) to allow clients that don't pass the checks to download the necessary patches and re-attempt to clear quarantine.
The VPN quarantine service consists of two components. The first component, RQS.exe, is a listener that runs on the ISA VPN server. It's the service that allows ISA to transparently move healthy clients out of quarantine and onto the network. During the installation of RQS.exe, an administrator specifies a text string that represents a healthy status. The second component, RQC.exe, is used by clients to alert the quarantine service that the health checks have passed. Clients automatically run RQC.exe after the client-side scans have completed successfully, passing the required text string to the RQS.exe listener on the server. When the RQS.exe service receives the appropriate text string, the client is released from quarantine.
Many network administrators are surprised to learn that none of the actual scanning for security patches and antivirus definitions is performed by the Microsoft quarantine client, RQC.exe. Instead, you choose how you'd like to scan your clients—batch files, Windows Scripting Host, .NET Framework-based applications, or whatever you like. This flexibility allows customers to design their health check based on their specific requirements and lets them leverage the development skill they're most comfortable with. There's only one requirement: your client-scanning routine must call the RQC.exe client-side executable at the completion of a successful scan, passing the appropriate text string. That's how RQS.exe knows it's allowed to remove the client from quarantine and allow it access to the network.
The last obstacle we need to tackle is how to get our scanning scripts and the RQC.exe client-side component of the quarantine service delivered to our VPN clients. For that, we'll use the Connection Manager Administrator Kit (CMAK), yet another feature built into Windows Server 2003.
Online Resources
The TechNet Online Virtual Private Network Web site offers a host of information and related resources. To learn more about the solution covered in this article, follow the Step-by-Step Guides listed on the site: microsoft.com/technet/itsolutions/network/vpn/default.mspx
Also see the following:
  • Internet Security and Acceleration (ISA)
  • Windows Server 2003 Resource Kit
  • Internet Authentication Service (IAS)
  • Connection Manager Administrator Kit
  • Certificate Authorities and PKI for Windows Server 2003
  • L2TP/IPsec Administrator's Guide
  • Approaches to Virtual Private Network Quarantine

Connection Manager Administrator Kit
The CMAK has been included with Windows Server for years and is used to build customized VPN client connectivity packages. In our scenario, a custom-built Connection Manager dialer is essential because it specifies the appropriate VPN settings for our environment and delivers the key client-side files we use: the cmgetcer.dll file from the resource kit, the batch file to request a machine certificate, the client-side scanning scripts, and last but not least, the RQC.exe file.
Once a Connection Manager package is built using the CMAK, it can be made available to clients in many ways. For managed machines, it can be delivered through various software delivery mechanisms, such as Systems Management Server (SMS). For unmanaged machines, authorized users could retrieve the package from an extranet Web site, or a secure FTP site. Connection Manager packages are Microsoft Installer (MSI) files that use the Windows Installer Service to install.

Wrap Up
With Internet threats growing ever more sophisticated, VPN entry points can pose a significant risk to a corporate network. The steps covered in this extreme VPN makeover scenario help to reduce those risks by establishing strong data encryption and ensuring that vulnerable machines are not permitted to connect to the network.

David Conrad has worked at Microsoft for over nine years in a variety of technical roles. He is currently focused on technology solutions for the federal government in Washington, D.C. David can be reached at dconrad@microsoft.com.


 Managing Identity: The InfoCard Identity Revolution
Identity & Access Management Keith Brown

The InfoCard Identity Revolution
At a Glance:
  • What is InfoCard?
  • Important laws of identity
  • The future of identity on the Web

Are you tired of managing and securing an ever-growing portfolio of usernames and passwords? Are you tired of filling out endless user profiles for Web sites that want to glean some personal
information from you? Would you like to make it easier for users to log onto your Web sites and services? Are you worried about identity theft and phishing? If so, stay tuned. I’ll introduce you to a new identity layer for the Internet, which will be exposed to end users through a GUI currently code-named "InfoCard."

An Identity Metasystem
InfoCard helps you manage and share personal information, and whenever you start talking about systems like this, privacy concerns surface. No single identity technology or identity provider will make everyone comfortable in every situation. Passport works really well when I want to connect to Hotmail® or MSDN®, but I don’t necessarily want to use it for non-Microsoft properties like my online banking system.
Back in November 2004, Kim Cameron, identity and access architect at Microsoft, began a discussion on his blog about what he dubbed the laws of identity. Kim’s goal was to have the identity community at large agree on a set of laws that would describe a stable identity system—one that people would feel confident using for all of their digital identity needs. This fascinating public discussion among identity industry luminaries, most of whom were not associated with Microsoft, resulted in seven laws of identity. (Both the sidebar here and Joshua Trupin’s article in this issue provide more on these essential laws.)
The Seven Laws of Identity
  1. User Control and Consent The user should be in control of her information and be able to decide which information to reveal.
  2. Minimal Disclosure Stable identity systems don’t disclose more information than necessary in a given context, and they use identifiers that are designed specifically for the context.
  3. Justifiable Parties All parties involved must have a justifiable reason for being a part of the transaction.
  4. Directed Identity Many public entities need to behave like beacons, broadcasting their identities to the world. However, I expect them to use a private identifier to track my personal activity, so stable identity systems must support both omnidirectional identity (beacons) and unidirectional identity (my private relationship).
  5. Pluralism of Operators and Technologies No single identity system is going to suffice in all contexts, and no single identity provider is going to be justifiable in all contexts.
  6. Human Integration Any successful digital identity solution must empower its human users to consistently make understandable and correct choices on their own behalf. The last couple of feet between the computer console and the human is where most bad things happen. Phishing and other social engineering attacks exploit the user. A stable identity system mitigates these threats.
  7. Consistent Experience A stable identity system presents an easy-to-understand abstraction to the end user that is consistent no matter what underlying technology or identity provider is involved.
You can read the full text of these laws at: Kim Cameron's Identity Weblog.

Interestingly, the fifth law makes it clear that no one identity system can suffice in all contexts. Instead, an identity metasystem is needed that makes it easy for you to choose the identity providers and technologies you want, and not feel locked into one vendor’s solution.
To be of any use, participants in the metasystem need to agree on a basic encapsulating protocol. Remember how the Internet blossomed when the industry converged on TCP/IP as the standard communication protocol? We’ll see the same explosion of innovation when the industry agrees on an identity protocol. Kim calls this the Identity Big Bang, and it’s exciting to think about.
This identity proposal is centered around the WS-* suite of protocols, the core of which are WS-Security and WS-Trust. This makes sense because these protocols allow any type of security credential to be used; you can represent any type of data in XML.

Digital Identity and Claims
In the identity metasystem, identity is represented as a signed set of claims. A claim is something someone says about you, or something you say about yourself. Just like in real life, you’ll judge the veracity of a claim based on who made that claim, or in the case of the metasystem, based on who signed the claim.
Do self-signed claims make any sense? Sure! In fact, I’d be willing to bet that the vast majority of the identities you use on the Internet are purely self-asserted. When you sign up for an account at a Web store, no third party checks up on you to ensure you enter the correct phone number in your user profile. It’s you who enters your name and e-mail address when you create your user profile, not a third party.
When you access a resource on your corporate network, however, you’ll probably need to supply credentials that a third party can verify, for example, a Kerberos ticket from your domain controller. Kerberos tickets include a section called a Privilege Attribute Certificate (PAC). Inside the PAC is a list of Security Identifiers (SIDs) that describe your user account and the domain groups of which you are a member. The PAC is signed with the domain controller’s key, so that any server that receives your Kerberos ticket can verify the signature of the domain controller and therefore develop trust in the claims (in the form of SIDs) in the PAC.
In the identity metasystem, there will be many parties that rely on claims about your identity. Some, like resources on your corporate network, will require a trusted third party to provide claims about your identity. Others, like the Web store I mentioned earlier, will simply take your word for it. In the metasystem, you’ll see trust relationships pop up all over the place, between the subject (you), the relying party (the resource), and the identity provider. Figure 1 shows these players in the identity metasystem.
Figure 1 Identity Relationships
Figure 1 Identity Relationships
I would imagine that many ISPs, which effectively already provide millions of identities, as well as others who currently work in the identity space will eventually become identity providers in the metasystem, and some of the more widely known will be trusted by many different companies. That’s a valuable service, because it allows you to have a single identity that you can use all over the Internet. As long as both you and the relying party agree on an identity provider, there shouldn’t be any friction: the third law (justifiable parties) has been satisfied! Each relying party exposes a policy listing the identity providers that it trusts and the security token technologies that it implements. This is part of the negotiation between players that occurs in the metasystem, and it’s required in order to satisfy the fifth law (pluralism of operators and technologies).

The Identity Selector
The last two laws relate to human integration. The metasystem needs to be presented to users as a concrete concept. This is where the InfoCard identity selector comes in—it’s the Microsoft user interface to the metasystem. Each identity is represented graphically as a card, just like the plastic cards you carry with you every day. And no matter what underlying technology is used to represent the signed set of claims, be it Kerberos, the Security Assertion Markup Language (SAML), X.509, or something else, the cards themselves work the same way. The image on the card will likely reflect the issuer and the type of data the card represents, but the cards will feel the same to the user. This is important to satisfy the consistent experience requirement of the seventh law.
The user interface is called the identity selector, and it’s implemented on a separate, highly secure desktop just like the WinLogon desktop you see when you log into Windows. When you visit a Web site or use a Web service that acts as a relying party in the metasystem, the identity selector will pop up, lighting up a selection of cards appropriate for the current context. When you select a card, you can see a text representation of each claim that is going to be sent to the relying party, and you can cancel the transaction if you’d rather not disclose the information requested. Imagine if a bulletin board asked for your passport number, for example. You’d be wise to decline that request. Putting the user at the center is what InfoCard is all about, and this also helps to satisfy the first law.
InfoCard aligns with the sixth law (human integration) by involving the user in the process in ways that help him make good choices on his own behalf, with no special training required. For example, the first time you use a Web site or service that acts as a relying party, you’ll be shown a dialog with a graphical depiction of the target’s certificate and information about whether the certificate appears to represent a legitimate business.
This is made possible by a feature called logotypes (described in RFC 3709). Certificates with logotypes have URLs inside them that point to images on the Web. These images represent recognizable branding for the subject and issuer, which allows the user to evaluate a certificate visually. Each image URL comes along with a hash of the image, which InfoCard checks to ensure the image hasn’t been tampered with since the certificate was issued. The point of this exercise is to get you more involved in the authentication protocol. (How often do you check the target’s certificate before sending personal information?) You must make a choice when shown this dialog: trust or don’t trust. If you decide to trust the target, you’ll be asked to choose a card, and you won’t be asked this trust question again for the site unless you do something that indicates a decline in trust, such as deciding not to select a card when prompted.

What’s In a Card?
In the metasystem, identity is represented by signed sets of claims, which are carried around in little XML buckets known as security tokens. WS-Security makes it possible to transport many different types of tokens this way, from binary tokens like Kerberos tickets to SAML tokens.
You need a security token in order to transmit claims to a relying party, but a card doesn’t have these claims inside it. The card is simply a data structure on the user’s client machine that tells it how to contact the identity provider to get a token if one is needed. The card also describes the shape of the token you’ll get: SAML, Kerberos, X.509, or something else entirely, along with the claims that the user agreed that identity provider can release to the relying party.
This metadata coupled with the policy exposed by relying parties makes it possible for the identity selector to light up cards that make sense in a given context. For example, when checking out at a Web store, the identity selector will light up your credit card (see Figure 2). And if you think about it, given that the protocol contacts the bank each time it needs a token, the bank could easily issue a one-time credit card number for that transaction. That sort of transparency is key in order for InfoCard and the identity metasystem to work.
Figure 2 The Identity Selector in Action
Figure 2 The Identity Selector in Action
When you select a card with identity data you want to send to a relying party, the identity selector will make a secured request to the identity provider, asking for the set of claims that the relying party needs. The identity provider may choose to authenticate you before issuing the token, asking for an InfoCard, a password, a smart card, or some other form of credentials to help ensure that an imposter isn’t sitting behind your console.
Once the identity provider issues the token, you get a second chance to look at the card, and now you can see the exact claim values that are going to be sent to the relying party (see Figure 3), and decide whether or not you still want to proceed with the transaction. If you decline to send the token, the local identity selector notes this choice (which could represent a decline in trust) and will pop up the trust dialog the next time you visit the site.
Figure 3 Verify What You Share
Figure 3 Verify What You Share

How Many Cards Will I Need?
If I think about my own personal habits, I know I’m going to need at least three cards. My anonymous card, a self-issued card with a whole raft of generic and utterly false personal information, will be used at Web sites I don’t trust. If they ask for personal information that they don’t really need, they’re going to get generic data, like an address of 1234 Main Street, Anytown, USA. My second card will be issued by a widely recognized identity provider such as VeriSign. I’ll use that with sites that I do trust. And my third card will be self-issued, with truthful personal information. I’ll use it at trusted sites that only accept self-issued identities.
While these three cards will suffice for the vast majority of relying parties, I know I’ll need a number of more specialized cards. I’ll have bank-issued cards that represent my credit lines. I hope to have a set of reputation cards issued by companies like eBay, where I have a stellar reputation as a buyer and seller (100 percent positive feedback). Although reputation claims are only just being talked about, imagine the power for bootstrapping your reputation in a new Internet community.

Self-Issued Cards
Microsoft is actively working to get many different industries involved in the metasystem. From major e-commerce sites to existing identity providers like VeriSign, to financial institutions that provide credit cards and online banking services, there is a lot of excitement around InfoCard. But adoption won’t happen all at once; companies will have to ramp up to support it. In the meantime, there is a self-issued provider that ships with the identity selector. It runs in a separate, highly privileged process and acts as any identity provider would, except that it’s local. And because the claims for self-issued cards will be stored in an encrypted form on your hard disk, it’s limited to only publicly available information such as your phone number, snail and e-mail addresses, and so on. You won’t be able to store credit card numbers on your hard disk using this provider.
Because the self-issuing provider stores this data on your hard disk, it’s not very mobile. Sure, you can export the data behind a self-issued card and import it onto another machine, but in the long term, there are plans to have a portable version of this provider that could run, say, on a USB device you carry with you, or on your cell phone. Your computer could connect to this device via Bluetooth to request tokens. This is an important issue for users who want to roam with their identities.

Getting InfoCard?
The identity selector ships with WinFX®, so as soon as you install the WinFX runtime components you’ll see a new applet called Digital Identities in your Control Panel. Running this applet opens the identity selector and allows you to create new self-issued cards and manage your identities.
WinFX is expected to ship with Windows Vista™ sometime around the end of 2006. What if you’re still running Windows® XP? No problem. WinFX also runs on Windows XP, as does the identity selector. You’d be better off running on Windows Vista because of the other security features it offers, not the least of which is the user account control feature that helps you run with least privilege. Developers can use Windows Communication Foundation to implement relying parties and identity providers. If you want to take a look at InfoCard from a developer’s perspective, see my articles on the subject in the April and May 2006 issues of MSDN Magazine.

Keith Brown is a cofounder of Pluralsight, a premier Microsoft .NET training provider. Keith is the author of Pluralsight’s Applied .NET Security course, as well as several books, including The .NET Developer’s Guide to Windows Security, available in print and on the Web. Learn more at www.pluralsight.com/keith.


 Microsoft Office: Create Scorecards For Your Business With Office
Microsoft Office Mauro Cardarelli

Create Scorecards For Your Business With Office
At a Glance:
  • Installing Business Scorecard Manager
  • Common scenarios
  • Building a scorecard
  • Deploying the scorecard
Download the code for this article: BusinessScorecard2006_07.exe (155KB)

Let's assume, as I'm going to do here, that you manage a sales team tasked with meeting regular sales quotas. Team member sales are logged into your corporate database, but you have no easy way of telling your team members how well they are doing.
Getting BSM Installed
The first step in building your scorecard is to install the software. Business Scorecard Manager should be installed on a machine running Windows Server 2003 and requires a SQL Server database. While it is possible to install BSM with SQL Server 2000, the steps here detail the installation with SQL Server 2005. Since this is a sample scorecard, it assumes your development will be on a virtual machine environment. Installation in a production environment requires the same steps, but using more servers.
  1. Create a new Virtual PC image.
  2. Install Windows Server 2003.
  3. Apply Windows Server 2003 Server Pack (SP)1.
  4. Install SharePoint Portal Server (SPS) 2003.
  5. Apply Windows SharePoint Services (WSS) SP2 and SPS SP2.
  6. Install SQL Server 2005.
  7. Configure SPS to use the corresponding SQL Server instance.
  8. Create a sample Portal.
  9. Run SQL Server 2000 Analysis Services SP4. Find and run ptsfull.exe (this installs the PivotTable® service). (Note: if you don’t do this, the BSM server install will fail with a "Microsoft OLE DB Provider for OLAP Services (MSOLAP) 2000 SP4" error.)
  10. Install Microsoft XML Core Services (MSXML) 4.0 SP2.
  11. Install ADOMD.NET 8.0.
  12. Install BSM (Builder and Server).
For more installation guidance, see the Business Scorecard Manager Team Blog.

You would like a quick and secure way to give the sales team insight into their progress against defined targets. You would like the interface to be simple but the messaging very powerful. When any salesperson is in danger of missing his target, you want it to be very clear. You have already invested in Microsoft® SharePoint® Portal Server (SPS) and would like to use it for the presentation of sales team data.
Well, Microsoft Office Business Scorecard Manager (BSM) 2005 has just the solution for you. It is a product designed to help information workers design, build, secure, and deploy organizational scorecards. You may be surprised at how often such a scorecard can come in handy. For example, scorecards can chart the progress of tactical and strategic goals, and they offer a visual presentation of the data at hand. Scorecard data is often point-in-time and is meant to show how the information you are tracking compares to your expected target values. A scorecard is a visual summary meant to give the viewer a pulse on the data being measured. This can be useful for anyone in an organization, from senior executives and business managers to teammates and staff members.
In this article I will walk you through the construction of a simple business scorecard based on the scenario I just presented. I'll include details on the installation, development, and deployment of your first BSM scorecard. But before you get started, you'll need to install the necessary software. You'll find detailed instructions for this in the "Getting BSM Installed" sidebar.

A Simple Scenario
First you'll need to choose the data source. To keep this demonstration simple, I'll use Microsoft Excel® as the data source here. Note, however, that BSM supports a full range of data sources (SQL Server™, Microsoft Access, and Oracle to name a few). As you'll see, connectivity is established via an ODBC connection string. A good place to find the right connection string format for your data source is www.connectionstrings.com. It has dozens of connection string examples for various sources.
Figure 1 Sample Data from Excel
Figure 1 Sample Data from Excel
Figure 1 shows the sample data I'll use. I have four salespeople. I am interested in measuring how each performed during the last sales cycle (units sold) how they are doing for this sales cycle (again, units sold), what the expected sales target is, and how well they are doing against the target number. The idea here is that the third column will be updated regularly as new sales data is obtained. The first and third columns will stay fixed until the next sales cycle. Figure 2 shows what the scorecard will look like eventually.
Figure 2 Scorecard Under Development
Figure 2 Scorecard Under Development
Now let's open Business Scorecard Builder and see how to get there. As you can see in Figure 3, the interface is pretty simple. Since this is your first scorecard, you'll need to start from scratch. As you make some progress, you'll want to save your work (or workspace). The workspace file (*.bsw) is an XML-based file containing all the data used in configuring the scorecard.
Figure 3 Business Scorecard Builder UI
Figure 3 Business Scorecard Builder UI

Defining the Data Source and Indicators
First you'll need to choose a data source, so click the Data Source link in the left-hand navigation area. Next you'll see that you need to provide a connection string to the Excel file you created. It is always a good idea to test the connection. Scorecard Builder will tell you if there are problems accessing the data source.
The next step is to select the type of graphical indicator you'll use to show status. There are two main types (although you can create your own). Three-Level is the stoplight presentation—Green, Yellow, and Red. Five-Trend has arrows indicating what direction the current data is trending toward (against previous data)—Up, Slightly Up, Level, Slightly Down, and Down). Indicator selection is performed in the UI.

Defining the KPIs
Before proceeding, let's label the scorecard. Figure 4 shows the selection of New Definition for the scorecard and the labeling of MyFirstScorecard. This is the name of the scorecard as it will appear on your SharePoint portal.
Figure 4 Defining a New Scorecard
Figure 4 Defining a New Scorecard
Now it's time for the meat of the scorecard—the Key Performance Indicators (KPIs). These are the data elements that I'm tracking. In this simple example, the four salespeople are the data elements. In more complex scorecards, you might have dozens of KPIs with groups associated with specific objectives (appropriately named Objectives). Figure 5 shows the creation of my first KPI, which is mapped to the first salesperson.
Figure 5 The First KPI (Mapped to the First Salesperson)
Figure 5 The First KPI (Mapped to the First Salesperson)
I'll label the KPI with the salesperson's name. Figure 6 is an example of how I map the data from the spreadsheet. To get the data values, I actually have to write conditional queries against the Excel worksheet.
Figure 6 Data Mapping from Spreadsheet
Figure 6 Data Mapping from Spreadsheet
It is interesting to note that Scorecard Builder tracks what has been done locally versus what has been published to the server. If you get a red exclamation mark next to one of the KPIs, this indicates that any changes you've made have not yet been committed. Therefore, the changes will not show up on your scorecard until you publish them. To be ready for deployment, I'll need to define all the KPIs and the respective mapped data. Figure 7 shows what a finished KPI looks like.
Figure 7 Finished KPI
Figure 7 Finished KPI
When that is finished, I still need to determine what values should be shown on my scorecard and how they should be displayed (as raw values or graphical images). Figure 8 indicates that I would like to present Actuals (previous and current) as well as Target (with a graphical indicator to show progress).
Figure 8 Actual and Target Goals
Figure 8 Actual and Target Goals
Once I create KPIs for each of the four salespeople and map data values for each, I am ready to publish the data to the server using the Publish All button. Once complete, I'm ready to display the data in SharePoint. Note: you can see all of the mappings I made by downloading the MyFirstScorecard.bsw file from the Code Downloads section of the TechNet Magazine Web site, and opening it in Scorecard Builder.

Deploying to SharePoint and Seeing the Scorecard
You will see two new Web Parts in the SharePoint Virtual Gallery—the Office Scorecard View and the Office Report View. In this case, I'll use the Office Scorecard View. Once I drag the Web Part onto my page I can select the MyFirstScorecard scorecard. That's it! Look back at Figure 2 for the completed scorecard.
Doug and Paul are doing a fine job this sales cycle. Mary is in danger of missing her target number. Susan is in big trouble! I now have a clear sense of how the team members are doing. The information presented is simple, yet powerful. The scorecard is truly displaying a "pulse" on the measured sales data.

Next Steps
This example was very simple. BSM offers a great deal more in terms of the complexity of the scorecard as well as how to get even more information from it. Perhaps the next step is to connect a SQL Server 2005 Reporting Services report with each salesperson in order to gain more insight into his pipeline. You can do this with the other Web Part installed with BSM, the Office Report View. You can connect the KPIs with reports shown in that Web Part so that the scorecard becomes more dynamic.
Business Scorecard Manager offers tremendous value in allowing users to process organizational data quickly and easily. It lets them monitor and analyze business activities. Not only does Business Scorecard Manager further the goal of delivering business intelligence for the masses, but it actually extends it by giving users a tool for controlling the presentation.

Mauro Cardarelli is a Managing Partner at Jornata, a Boston-based information technology consulting services company. His responsibilities include technology evangelism, architecture design, and software development. He can be reached at mauro.cardarelli@jornata.com.


 From the Editor:
From the Editor

Summer is finally here, and you know what that means—vacations, travel, long days by the pool sipping margaritas, without a care in the world!
Not for you, though. You’re an IT pro and you’re always on call. You get to sit by the pool and stare at your beeper. The flashing light mocks you as you never quite relax, worrying when the next page will come.
And come it does. You raise yourself up from that lounge chair and call in to find that a VP forgot his remote access PIN, and yes, also the address of the extranet site for the reset tool. Another day in paradise ruined.
An IT pro is never off duty. This year, however, we’re doing our part to help you enjoy your summer trips. With this issue, TechNet Magazine is going monthly!
So how does that help? Never again will you have to plan your getaways around our bimonthly publication schedule. No more waiting around the mailbox until we show up, just to make sure no one swipes your copy while you’re away. You’ll have plenty of reading material on the plane. And when you take TechNet Magazine to your poolside lounge chair, you’ll be treated to a bit of extra shade as admiring throngs crowd around to read over your shoulder. You’ll be so popular!
Each month, we’ll bring you a feature-packed issue of TechNet Magazine, filled with the tools you need to get your job done. Just as your beeper keeps you on duty 24 hours a day, think of us as being on call for you whenever you need the best in topical, hands-on information. Put us under your pillow every night to absorb more content.
This month’s issue gets deep into the world of identity and access management. We start with an overview of identity, including a synopsis of Kim Cameron’s well-known "Seven Laws." We then take a trip through Microsoft Identity Integration Server, look at tools to simplify identity system design, and see how to use ADFS to simplify single sign-on. We show you how to create custom directories with ADAM, and how to give your network and extreme VPN makeover. We even step back and take a look at InfoCard, a system that will soon take off in popularity.
There’s something else to notice about TechNet Magazine: its eye-catching new cover. As part of our upgrade to monthly status, we’re implementing a new design. Over the next few months, you’ll be seeing changes to the way the magazine looks. We’re taking many of your suggestions on usability and incorporating them into a pleasing new layout. TechNet Magazine 2.0 is on the way! (And no, wise guy, this doesn’t mean you’ve been beta testing version 1.0 for the last two years.)
A new monthly schedule and an enhanced design are great news, but we have even more to report. Kerry Gates, our publisher since our first issue, is moving on (but not out). Kerry, whose belief in TechNet Magazine made it all possible when it was but a glint in our eyes, has been named the vice president for software development publications at CMP Media, our publishing partner for both TechNet Magazine and MSDN Magazine. After years of working with her, I can tell you that there’s not a better person to have on your side in all of publishing.
We also welcome Jill Thiry as our new publisher. Jill has over 15 years of publishing experience, including a stint as the publisher of Network Computing magazine. Jill, CMP, and the rest of the staff here at TechNet Magazine, will be working hard all summer so you can enjoy that margarita at the pool.—J.T.
Thank you to the following Microsoft technical experts: Bruno Aziza, Kim Cameron, Derek Del Conte, Jenn Goth, Scott Greene, Geoff Grisso, George Holman, Kannan C. Iyer, Ryan Johnson, Mike Jones, Paul Jones, Brad LeRoss, Michael Murgolo, Aung Oo, Paul Randal, and Steve Riley.


 Toolbox: New Products for IT Professionals
Toolbox
New Products for IT Professionals
Greg Steen

System and network administrators always seem to be looking for a better monitoring solution. By better, I mean more stable, more cost-effective, more scalable, and loaded with more features. NETIKUS.NET aims to deliver a better monitoring solution with the latest version of Event Sentry. The application allows you to track most of your vital stats, such as event log entries, disk space, performance, services, installations, and processes. The result is a product well worth considering for your toolbox.
Event Sentry uses a Welcome Wizard to get you up to speed quickly; it gives you a quick overview of the application’s terminology and feature-set, and provides the suggested steps for implementing the monitoring solution in your environment. Event Sentry allows you to divide your monitored systems into different computer groups and specify actions based upon membership to those groups. This is helpful in larger deployments where, for example, you may want to define different monitoring tasks for different departments or handle monitoring of internal application servers differently than Web-servers.
Monitoring services are defined as packages within the application and you can easily assign packages to individual systems, groups, or all monitored systems. The packages are further divided into three groups: filter packages (which are event log filters used to specify which events to process), health packages (which represent system health monitoring tasks, such as status and disk space), and tracking packages (which are for events that are monitored over time). Event Sentry even supports an environmental monitor for measuring the temperature and humidity around your machines as well.
Event Sentry provides numerous types of notification, with support for e-mail, databases, Syslog, SNMP traps, text files, and executable scripts and applications. EventSentry also has Web reporting features that let you easily share event log data, tracking data, performance indicators, and service information, which can be viewed with a standard Web browser. You can provide a custom search URL for linking unknown events to, for instance, MyEventlog.com, the Microsoft Knowledge Base, or a custom reference you may have already put together.
The tracking packages require a database for gathering and aggregating data; the application supports both MySQL and MS-SQL. EventSentry includes one default tracking package that tracks all processes, logon/logoff events, and print jobs tracked by the filter packages. The application also includes a default set of filter packages, and additional packages are available from the Event Sentry Web site.
The default filter packages are varied, with event log filters that cover antivirus notifications, database events, Exchange events, various hardware issues, and so on. A particularly handy feature that is fairly new to Event Sentry is the Sarbanes-Oxley filter. This filter deals with a number of the event audits that are required to comply with the Sarbanes-Oxley legislation.
The system health packages monitor the general health of your servers. Event Sentry includes default settings for monitoring disk space, system resources (CPU and memory performance), and applications and services.
The Remote Update feature allows you to install or update the client agents on your computer groups from a remote host. Remote installation of the client agent does require you to have both the default administrative share (ADMIN$) enabled and the Remote Registry Service running on your host system—and this may not be an option for all infrastructures.
Event Sentry’s included monitoring packages are customizable and some tailoring of the defaults settings is necessary for handling your needs. The result is a feature-rich yet flexible product that can get you monitoring without breaking the bank.
Price: Based on number of hosts. Starts at $69.00 (direct) for one full license.

Book Review
Windows Server 2003 Security Cookbook
http://www.oreilly.com
The Windows Server 2003 Security Cookbook (O’Reilly Media, December 2005) provides effective and to the point "recipes" for enhancing the security of your Windows Server™ 2003 boxes. In typical O’Reilly cookbook fashion, the book is not intended as the be-all and end-all authority of security precautions. Rather, it delineates solutions to specific security concerns.
Each chapter covers a specific technology, from TCP/IP to Group Policy objects to patch management. The book begins with a chapter on "System Preparation and Administration," covering tasks like renaming the Administrator account and encrypting the Security Accounts Manager (SAM). This chapter also discusses the importance of creating a secure original build that can be deployed across the enterprise and the steps to take to ensure that first build is secure.
In the "Encrypting File System" chapter, the book makes a good point regarding Active Directory® traffic, noting that not all of this traffic is encrypted and that you should be sensitive to what kinds of data you are storing in the Active Directory database. While Windows Server 2003 defaults to enabling encryption, it is better to ensure it is in place for all communications on your infrastructure, rather than assuming encryption is on. The book follows that commentary with the steps to take to encrypt Lightweight Directory Access Protocol (LDAP) traffic with secure sockets layer (SSL) or Transport Layer Security (TLS) and digital signing.
In the section on "Group Policy," the book covers such useful items as configuring password policies and assigning user rights. This is a good chapter to use in tandem with the recipes found in the "User and Computer Accounts" section, which gives you steps on how to set user expiration, determine logon hours, and troubleshoot account lockout issues.
Moving up the application stack, the book then covers DNS, File and Print Server security, and IPSec considerations. The chapter on IIS shows you how to configure HTTP and FTP authentication, restrict client access based on IP address or an access control list (ACL), and configure certificate authentication.
A nice approach, the book provides numerous methods to achieve the solution to a specific security issue. It typically denotes GUI, Common Language Infrastructure (CLI), and VBScript methods so you can choose the one that best fits your skills and needs.
Overall, the Windows Server 2003 Security Cookbook is a good quick reference for your bookshelf. It doesn’t provide the nuts and bolts of infrastructure security, but it does deliver a handy resource for finding and implementing security measures in your Windows Server 2003 deployments.
Price: $49.95 (list).

Encrypt Your Data
Private Disk
www.dekart.com
Security is a concern for everyone, but it’s especially important for IT professionals, since their responsibilities often affect entire organizations and numerous users. Everyone in your IT structure—from desktop support technicians to the CIO—has knowledge and access to critical data that is vital to your company. Protection of that data is paramount for both corporate and personal integrity. Dekart’s Private Disk can help you prevent sensitive data from being accessed.
Private Disk lets you create virtual encrypted disks on top of your Windows® folder structure. The virtual disks are strongly encrypted files that contain a virtual disk image, which can be formatted as NTFS, FAT, or FAT32. The virtual disks are encrypted using 256-bit Advanced Encryption Standard (AES) and Secure Hash Algorithm (SHA-512) generated secret cryptographic keys. Dekart’s cryptographic libraries have been certified by the National Institute of Standards and Technology (NIST) for their compliance to SHA-256, SHA-384, and SHA-512.
The application supports virtual disks of up to 4TB—you’ll most likely run out of physical space before you hit the limit. Virtual disks are password-protected and Private Disk includes a quality meter to ensure you don’t provide a weak password, essentially undermining all the security measures offered by the application.
In case you forget the password, Private Disk offers a brute force recovery/attack feature. Of course, if you follow all the best practices when creating a password, this feature won’t be of much help in recovering a strong password. It does, however, provide a great way to test the strength of your current password.
You can back up your virtual disk to a compressed, encrypted, password-protected copy of the disk. In addition, you can set your virtual disks to connect automatically at start-up and have the application automatically disconnect virtual drives after a specified amount of time; this is a great safety measure for when you go to lunch and forget to lock your desktop.
As a default, Private Disk places an icon in your system tray, letting you manage virtual disks on your workstation or server. But one of its greatest strengths is its portability. The company’s Web site provides a short set of instructions for dumping a newly created virtual disk to portable media, such as a USB key drive or DVD, along with the application’s key files to make a portable encrypted disk. This sort of feature is very handy for desktop-to-datacenter support—you can keep all your important data on the virtual drive and have it at your fingertips.
Price: $45.00 (direct) for a single license for personal or business use. Volume discounts and student pricing are available.

Create Help Files
Fly Help
www.flyskysoft.com
Creating help files doesn’t have to be time-consuming (or costly). Fly Sky Software’s Fly Help is an easy to use authoring tool that simplifies the creation, editing, and conversion of HTML Help (CHM) and browser-based Web help files. Converting existing HTML files into a CHM file is as simple as dragging files onto your help book.
Converting existing CHM files into a navigable HTML page set is also simple. This is great for quickly putting existing help onto the Web. The interface also allows quick edits of content and titles of CHM files. You can use either the embedded WYSIWYG HTML editor or launch an external editor from within the application. Your help file index can be created manually (by adding keywords) or automatically (based on the table of contents).
The CHM explorer allows you to navigate through existing help files. Shockwave Flash movies (.swf files) can be quickly incorporated by simply dragging and dropping the content onto your help file. The app automatically generates a display wrapper and incorporates the HTML page into your book.
Price: $99.95 (direct) for a single license.

Locate Network Problems
PingPlotter Pro
www.pingplotter.com/pro
In some respects, big network problems are easier to manage than those pesky intermittent issues. Sure, quickly resolving a big issue might cause some elevated stress levels, but isolating the problem is a breeze. ("Hey, check out that smoking router over there!") The nagging connection issues, on the other hand, can be difficult to isolate and may linger, taunting you. Nessoft’s PingPlotter Pro can help put an end to these annoyances.
The application is essentially ping and tracert wrapped in a GUI that allows you to monitor routes over time. This is especially useful when, for example, you are trying to prove to your ISP that its network (not yours) is the root of the problem. (There’s nothing like a big red line on a graph to make the point.)
The Pro edition ties in with Microsoft® Outlook®, letting you easily send e-mails of your sample set and graphs.
The application, which allows you to trace monitor multiple hosts concurrently, can run either in the system tray or as a Windows service, making it truly useful for long-term monitoring. In case your monitoring server is in a remote location, PingPlotter includes a built-in Web server (it also supports IIS) so you can access reports and graphs through a Web browser.
You can set up alert thresholds to notify you of potential connectivity events. These are based on latency and packet loss for a number of targets on your network or the network path to your destination address. The Pro version supports multiple types of notification, including support for sending e-mail, launching an executable, logging the event to a file, and popping up a dialog. I quite like the feature that auto-saves captured data and images at specified intervals. You can also set the application to ignore specified route changes if you aren’t concerned with a normally oscillating route.
Price: $149.95 (direct) for a single license.

Greg Steen is a technology professional, entrepreneur, and enthusiast. He is always on the hunt for new tools and methods to help make operations and development easier for IT professionals.


 Utility Spotlight: The Shared Computer Toolkit
Utility Spotlight
The Shared Computer Toolkit
Jeremy Moskowitz
Download the code for this article: Microsoft Shared Computer Toolkit for Windows XP (1KB)

One of the most common requests I get at my Group Policy forum, GPanswers.com, is how to take machines and "lock them down." People want to ensure their machines can’t be broken by Joe User or Harry Badguy. The out-of-the-box Group Policy settings can go a long way toward solving this conundrum. But the settings can only take you so far.
Computer lockdown can get complex fast. You might not know who’s walking up to the machine, but you may still have to give them some portion of your network resources, such as Internet browsing, file viewing, or printing.
You would typically find computers like these in public places like universities, airports, hotels, community centers, museums, kiosk stands, and conference centers. These aren’t the kinds of machines that your typical business workers use day to day; these are machines where people need sporadic access, people you may or may not trust.
Figure 1 Getting Started with the SCT
Figure 1 Getting Started with the SCT
What you need is a way to restrict anything from being written to the Windows® partition. You need a way to trap the bad stuff, but keep the good stuff like critical Windows updates and antivirus updates. You want to lock down Windows so it’s much harder to get to the under-the-hood stuff like the C:\Windows directory. And you need a way for new users to get a guaranteed profile, so you’re dictating their experience, not fighting to clean up after them. You might also want to manage exceptions. That is, you might want to have a known or trusted user use this shared PC for some specific task, and to make sure that his data and settings stick around.
What you need is the Shared Computer Toolkit (SCT). The SCT is not specifically meant to be loaded on every desktop to restrict the actions of day-to-day employees (though I’m sure some enterprising geeks will attempt to roll it out to an entire corporation). It’s also not really meant as a "parental control" device either, though some attributes of the Shared Computer Toolkit might be useful for this.

Requirements
To use the SCT, you need to be running Windows XP Service Pack 2 (SP2) with at least 1GB of unallocated space (though having 10 percent of the hard drive unallocated is recommended). This unallocated space will be converted into a special protection partition by the SCT. You might also want to create a second partition for Use data, also known as a persistent partition. For instance, if someone uses this machine for his daily work, you might want him to be able to save Microsoft® Word documents on this additional partition.
One of the tricks is starting with a machine that is already running Windows XP SP2 and carving out some unallocated space. Typically, when Windows is installed, the entire hard drive is used. However, any commercially available repartitioning tool will make it possible.
You can use SCT both with computers that are joined to a domain and those that are not. I’ll examine both scenarios here.

Getting Started
After you’ve repartitioned the computer, take the following steps to use the SCT:
  1. Install all the applications that you want to make available on the shared computer.
  2. Remove Windows components that you don’t want people to use (or would be potentially dangerous to use) like IIS or Outlook® Express.
  3. Install the SCT after installing the required User Profile Hive Cleanup Service (UPHClean).
  4. Configure the SCT.
Once the SCT has been configured, its goal is to keep your computer as clean as the day you installed it. So be careful that you’re not loading junk on your shared computer as you’re preparing it for use.
At the heart of the SCT is the Windows Disk Protection (WDP) service. The goal of WDP is to trap writes to the Windows system volume and temporarily store them on the protected partition so users can’t actually do any permanent damage to the real Windows partition. Once the session is over (and the computer is rebooted), any accompanying potential damage is vanquished.
The SCT cannot prevent certain attacks. Even though the SCT will help you lock out common functions like direct access to Windows Explorer, that doesn’t mean an application you’ve installed and made available for use doesn’t have Explorer-like capabilities. For instance, many applications allow you to browse the contents of the hard drive when you’re in their File | Open dialog boxes. The SCT will ultimately prevent the disruption of Windows—that is, the WDP ultimately discards any writes to the system volume. However, it is incapable of preventing this kind of poking-around attack if enabled by an installed application.
To download the SCT, go to microsoft.com/windowsxp/sharedaccess. The SCT installation is a wizard-driven snap to use. It does require an additional package called UPHClean, which is popular with Terminal Services administrators whose users have difficulties logging off Terminal Services while saving their User Profiles settings. UPHClean is now a required component for this SCT. It would have been nice if the SCT installation didn’t make you download it separately, but simply made it part of the SCT installation.

Configuring the SCT inEight Easy Steps
Once SCT has been installed, configuring it is made easier with a Getting Started page (see Figure 1), which guides you through the step-by-step process. The second step, as seen in Figure 2, is mostly configuring security-related Group Policy settings within the local Group Policy Object (GPO). In most cases, you’ll want to make sure all boxes are checked.
Figure 2 Group Policy Settings for Security
Figure 2 Group Policy Settings for Security
In Step 3, you create a new local user and give it a name of your choosing, such as Public. Step 4 has you configure the user account the way you want: choose the desktop wallpaper, accept first-time run settings and license agreements (for programs such as Windows Media® Player, Microsoft Office, and Adobe Acrobat Reader), add printers, and so on. Your configuration of this profile will determine how all public users of this machine will see it.
In Step 5, select the Public profile and lock down some additional settings, as seen in Figure 3. There are too many options to delve into right here. Thankfully, the recommended settings can all be selected with one checkbox. Defaults here include the restriction on running applications from USB thumb drives, restricting the running of system tools (such as regedit.exe), and preventing users from right-clicking within Internet Explorer®. Optional restrictions, such as "Remove CD and DVD burning features" and "Prevent printing from Internet Explorer," are welcome additions.
Figure 3 Restricting User Options
Figure 3 Restricting User Options
You actually test the Public profile before you go into lockdown mode in Step 6. This enables you to see what the user will see, but still makes it easy for you to go back and make changes.
Step 7 contains the secret sauce—the Windows Disk Protection service, which requires a reboot before it can be configured. Here, you can specify whether to retain changes made by public users and how critical updates will be handled (see Figure 4).
The WDP features a very, very strong protection mechanism with four choices.
Figure 4 Windows Disk Protection
Figure 4 Windows Disk Protection
Clear Changes with Each Restart Once this function is turned on, the system is officially protected. All historically vulnerable parts of the system, such as the registry, services, even critical boot files like boot.ini and NTLDR, are protected from permanent harm.
Save Changes with Next Restart Once the SCT has been running for a while, you might want to add another application to the system or make another permanent change. Select "Save changes with next restart" and you’ll have skirted around WDP this one time and integrated your changes. Restart the computer before you load your new application, so as not to keep something bad or unknown. Then, once loaded, select "Save changes with next restart."
Retain Changes for One Restart If you’re installing a new application that requires a reboot, select this option. Once you’ve loaded and configured the application correctly, pick the "Save changes with next restart" option to permanently seal in your changes.
Retain Changes Indefinitely If you want to load many applications and watch their interactions over time, you might select this option. Once you’re ready to accept your changes, select "Save changes with next restart." If you want to back out of all changes, select "Clear changes with each restart." This functionality is great for training centers where a new class comes in every week and you want students to have free rein over the computer. You can let them do what they want and they can restart the computer as often as necessary. At the end of the week, just clear the changes and the computer will be restored to its Monday morning state.
Another way to think about these settings is that once WDP is turned on, all changes are written to the protection partition until you choose "Save changes with next restart," and they are merged with the real partition.
All About Updates It’s likely your other corporate computers are downloading critical Windows updates from Microsoft or from Windows Server™ Update Services (WSUS) by themselves (see my article about corporate WSUS settings in TechNet Magazine). But computers using the SCT need for you to grab these updates manually. When it’s time to automatically install patches, the interactive user is logged off, and during the critical updates installation time, no users (other than administrators) can log on. It should be noted that when critical updates are downloaded, they are always written directly to the "real" Windows partition and not the protection partition. The process is quite elegant: an automatic reboot clears any potentially damaging changes users might have introduced, and then the updates are written. This ensures that only the critical updates make it onto the disk.

Large Environments
So far, the discussion has been for one standalone PC—not a domain environment. One PC is a good start, but corporations, schools, and other organizations will need to use this in a larger environment. The two additional scenarios to consider are domain-connected SCT machines and a mass deployment of the SCT (domain-joined or not).
If your target SCT machine or machines are domain-joined you can, of course, go through all the steps I’ve listed to get the job done. But that means you have to visit each and every computer to do the job. Instead, the SCT team (thankfully) rounded up their hard work and made a Group Policy Application Distribution and Management (ADM) template file that snaps into the Group Policy Editor. This file (SCTSettings.adm) is located in the C:\Program Files\Microsoft Shared Computer Toolkit\bin directory. This enables you to make mass changes on multiple SCT-enabled machines, as seen in Figure 5. The ADM template is a little rough around the edges and could use some refinement of the Explaintext entries, but it’s a really good start.
There are some additional technical obstacles to overcome with domain-joined machines. For instance, how do you run around to 1,000 SCT-enabled machines and reconfigure their disk-protection settings? Thankfully, there’s a DiskProtect.wsf provided for scripting the behavior of your SCT-enabled machines. You also need to manually implement the suggested software restriction policy settings which prevent system tools and unwanted programs from running. This is all explained in Chapter 10 of the Shared Computer Toolkit Handbook, which is available in the Shared Computer Toolkit program folder on the Start menu after you install the Toolkit.
The next hurdle is mass deployment. How do you get the SCT bits and pieces on the target machines in the first place? The suggested avenue here is to embed the preinstalled SCT and corresponding bits inside your "ghost-style" or "RIPrep" image build. Or, if you deploy clean machines, you could simply script the UHPClean and SCT installation using a postinstallation script or use Group Policy Software Installation and simply assign both UHPClean and the SCT to your shared computers via Active Directory® and Group Policy.
Once you have the required bits on the machines, use the included Group Policy ADM and VSB files to control the computers after they’ve been deployed.
There are just a few other issues to think about. Every computer running Windows must be expressly validated by Windows Genuine Advantage. This becomes a bit of a problem because each machine needs to be touched, either by installing an Internet Explorer ActiveX® control (see "Running the Windows Genuine Advantage Validation Tool") or running an HTML application, or HTA (see "Validate Windows Using an Alternate Method").
Also, how do you remotely repartition a computer’s hard drive if you don’t want to trot over to it? Remember, every SCT computer needs the required protection partition. There are some possibilities through the use of software such as Systems Management Server (SMS) and some custom scripting solutions, but if you have your own ideas of how to mass validate computers via an HTA or remotely repartition a computer, don’t keep it a secret! Let me know and I’ll post a follow-up on GPanswers.com.

Final Outcome
Once the computers have been deployed, your users log on with the username you set; in my examples it was Public. If you were using a domain account, you could use domain credentials as well. Once they’re logged on, it really is a restricted, fully managed machine as seen in Figure 6. SCT is a really great tool with lots of potential uses. The tool itself as well as the documentation is well thought out, and the additional control via Group Policy is just icing on the cake.
Online support for the tool is available at the Microsoft newsgroups.

Jeremy Moskowitz, MCSE and MVP in Group Policy, runs GPanswers.com, a community forum on Group Policy. He also leads a two-day Group Policy intensive training course. His latest book is Group Policy, Profiles and IntelliMirror, 3rd Edition (Sybex, 2005). Contact Jeremy at www.GPanswers.com.


 SQL Q&amp;A: Monitoring DBAs, Replicating Sprocs, and More
SQL Questions & Answers
Monitoring DBAs, Replicating Sprocs, and More
Edited by Nancy Michell

Monitoring DBA Activities
Q I have a network administrator who is also a database admin for all the SQL Server™ databases in my enterprise. As such, he has administrative access to the data and data structures of those databases. How can I monitor his administrative activities?
A If you’re using SQL Server 2005, you can use Data Definition Language (DDL) triggers to write events to a log table that you can later review. In SQL Server 2000, you can run a profiler, but that can be resource intensive.
Often these monitoring requirements can be met by having a documented change-control process in place and by removing the built-in administrator role from the sysadmin list, replacing it with a custom group that only contains your DBAs. This would prevent your operating system and domain admins from automatically gaining sa access to SQL Server.
However, while SQL Server 2005 DDL triggers can generate information about schema changes, they won’t capture read or write object access. In SQL Server 2005, you can probably get a lot more mileage from event notifications with very little overhead (for further information, see "DDL Events for Use with Event Notifications").
Running a server-side trace (without using the Profiler UI) may incur an acceptable amount of overhead, but that option first needs to be tested and confirmed. You may be able to use a combination of filters on Application Name, DBUserName, LoginName, and NTUserName for capturing events such as RPC:Completed, SP:Completed, SP:StmtCompleted, SQL:StmtCompleted (these are examples from SQL Server 2000).
With a well-configured trace, you can monitor both read and write access in all databases for selected users or for applications (such as Enterprise Manager and Query Analyzer), while limiting tracing so it captures only the info you want and excludes normal application activity.
Just keep in mind that a user with sysadmin privileges on SQL Server can defeat most forms of database monitoring with enough effort and determination.

Paging Problems
Q I am running SQL Server 2000 SP4 on Windows Server™ 2003 SP1 and I have been investigating some performance problems. I’ve noticed that the Pages/sec and Page Reads/sec counters are very high. The average Pages/sec is 606 and the max is 6469. The Page Reads/sec average is 507 and the maximum is 2090.
The server has 23.5GB of memory with SQL Server configured to use 21.3GB. I changed the memory allocated to SQL Server to 18GB, but I see no change in the values for the Pages/sec and Page Reads/sec. This is a 32-bit environment and SQL Server is running on a dedicated machine. Could either database fragmentation or bad queries be causing the counters to reach such heights?
A When Pages/sec is greater than 0 or Page Reads/sec is greater than 5, Windows is going to disk to resolve memory references (via a hard page fault), which comes at the price of disk I/O and CPU resources. Do you have any other applications running on the server apart from SQL Server? If you stop SQL Server what happens? If the problem is disk fragmentation, try using the DBCC SHOWCONTIG tool on specific tables that could be causing the issue, rebuilding those tables if required. If this issue occurs only during a specific query, do some query tuning.
The following is further information on these counters that you may find useful in determining your problems:
When looking at Pages/sec, start investigating if you’re getting over 100 on a system with a slow disk. Please note that the stated values of over 20 pages, which appear in many other sources of documentation, are out of date. On a system with a fast disk subsystem, even 500 pages per second may not create an issue.
Always break up this count into pages output and pages input if the counter is above 100 per second.
Pages/sec represents the number of pages read from the disk and written to the disk in order to resolve memory references to pages that were not in memory at the time of the reference. In other words, it is the sum of Pages Input/sec and Pages Output/sec. This counter includes paging traffic on behalf of the system cache used to access file data for applications. It is the primary counter to observe if you are concerned about excessive memory pressure (thrashing) and the excessive paging that may occur as a result.
This counter, however, also accounts for such activity as the sequential reading of memory-mapped files, whether cached or not. Therefore, you must understand the expected behavior of the processes on your server in order to interpret this counter. The typical red flag for a mapped file reading is the following combination of characteristics:
  • A high number of Pages/sec
  • A normal (average, relative to the system being monitored) or high number of Available Bytes
  • A normal or small number for Paging File: % Usage
In the case of a non-cached memory- mapped file, you will also see normal or low cache (cache fault) activity.
The number of Pages Output/sec is only an issue when disk load becomes an issue. This value is completely meaningless unless it is evaluated in concert with the disk throughput capacity.
Remember, these pages are pages written by an application and need to be written to the disk to resolve memory references to pages that were not in memory at the time of the reference. This is not resource intensive, and as long as disk write time for the logical partition does not exceed 30 percent, you should not see any impact on system performance. The proper way to observe the disk’s write time is to look at its inverse counter; in this case, the disk idle time should be 70 percent or greater.
Pages Output will stress the system but the application will remain unaware of this. An application will only wait on Pages Input and the troubleshooter will need to know what the application tolerance for waiting on Pages Input will be. For example, SQL Server and most applications will tolerate very few Pages Input while Exchange Server will do much better. Again, you will need a good baseline for comparison.
If you suspect paging is the issue, the best threshold value to use for diagnosing the problem is disk read time on the logical disk that holds the page file. To rule out paging as an issue, look for disk idle times of greater than 85 percent and transfer times of less than 15 ms.
It is important that you know that the pages in and pages out represent writing to the page file and not some data file reading and writing to another file. This is bit difficult except on an enterprise installation where you have different disk partitions for each type of file—for example, the page file is on a partition by itself or on the system partition, the TEMPDB file is on another partition, and all the SQL Server files on another partition.
Look at the disk counter for logical disks, then take the bytes per second and divide by 4096 to convert to pages per second and see which disk the I/O is going to in order to determine if this is true paging or data reads and writes.
SQL Server uses paging for some memory operations. If none of the disks with page files have I/O then the remaining operations must be data operation, not process paging.
If you have no other information, follow the general guideline that paging 40 Pages Input/sec per spindle will not slow down most applications.
Replicating Stored Procedures
Q In my current transactional replication I replicate the transaction, but not the stored procedure. It was recommended that I replicate the stored proc itself.
I have a few questions regarding this. If I replicate the sproc, how do I tell replication not to replicate the transactions? Before I publish the sproc, do I need to stop replication, take a snapshot, and then restart? And finally, if the sproc refers to a table on a linked server, will this be performed on the subscriber?
A To answer your first question, when the sproc is executed, SQL Server automatically tags the session with proper information so modifications made inside the sproc are not individually marked for replication. As a result, only the sproc exec statement will be replicated, not the individual Data Manipulation Language (DML) within the sproc.
As for stopping replication, the answer is no, you don’t have to do all that. You can simply add the sproc article just as you do with table articles.
Finally, if you publish the stored procedure sp_foo, ‘exec sp_foo ‘bar’’ will get replicated as such. You need to make sure sp_foo can execute on the subscriber just like it executes on the publisher.

SQL Server Reporting Services
Q I have some domain users who need to view a report that I created in SQL Server 2005 Reporting Services. How do I grant permission to those users so that they can view the report?
A You can either script this using the rs tool, or you can use the Report Manager by following these steps:
  1. Go to the folder in Report Manager where you have the report and click the Show Details button in the upper right.
  2. Click the Edit icon next to the report you want to share, and then click the Security link on the left.
  3. In the Group or username field, enter the DOMAIN\groupname for the group you created and assigned the users to. (You can add users individually, but groups are easier to manage.)
  4. Put a check next to the Browser role and click OK. And now you’re all set.

Monitor Table Statistics
Q I need to issue a list of all tables that have more than 10,000 rows for a specific application. In that list, I want to identify possible candidate columns for indexes based on auto-generated statistics. I know I can list these statistics using the sp_helptstats Stored Procedure in SQL Server 2000 and then run DBCC SHOW_STATISTICS to see the data distribution. But I don’t want to do that. Is there an alternative?
A The best way to do something like this is to configure a trace to capture the SP:Starting, SP:Completed, and Showplan:Statistics events. (There are others you may also have to capture to collect the events for remote procedure calls and T-SQL events.)
Run the trace at least three times during your operational day—during slow, moderate, and heavy traffic times. Take the output trace files and feed them to the Index Tuning Wizard (ITW) as workload files. The recommendations made by the ITW are not absolute, but they should point you in the right direction. Running this sort of trace periodically is really the best way to keep the indexing and statistics in tune.
SQL Server Memory Allocation
Q I recall there being an issue in SQL Server 2000 that if a max memory setting was configured, SQL Server allocated the entire max amount at startup. Is this problem fixed in SQL Server 2005?
A Unfortunately, this is a misconception. Configuring max server memory alone does not make SQL Server allocate all the memory at startup—not under SQL Server 2000, and not under SQL Server 2005. But, depending on the real load, the configured amount can be consumed very quickly.
There are, however, other settings that would result in switching of the dynamic memory management—for example, turning on address windowing extensions (AWE) support. The good news is this has changed in SQL Server 2005!
If you run SQL Server 2005 under Windows Server 2003 (editions that support AWE), you get dynamic memory management even if you switch on AWE support. On almost all other configurations, SQL Server switches dynamic memory management off as soon as you switch AWE on.
Dynamic AWE memory is only available with SQL Server 2005 on Windows XP and Windows Server 2003 or higher. After changing the AWE option, you need to restart the SQL Server process; the decision of whether to use static AWE memory allocation or dynamic AWE memory allocation is made at server start-up time.
It’s also worth noting that if you’re using SQL Server 2005 on 64-bit systems, and the account used to run SQL Server has the "Lock pages in memory" privilege, SQL Server will default to using AWE memory even though the AWE configuration option is not available on 64-bit systems. See the blog by Slava Oks at blogs.msdn.com/slavao/archive/category/9005.aspx for more details on this.
The difference between static memory allocation and dynamic memory allocation is that with dynamic memory allocation, SQL Server responds to changes to min and max server memory without having to restart SQL Server. SQL Server will also respond to the operating system low memory notifications and release memory back to the OS when necessary.

Alternatively, you can configure and run the data collection utility Pssdiag. This approach provides additional performance data about the OS and hardware. This data can be used for an ongoing historical report of server health.
If SQL Server 2005 is an option for your data collection and diagnostics, then you should note that there is a collection of Dynamic Management Views (DMV) to help you find cases where an index would have been useful. If the optimizer finds a case in which an index would have been useful, it makes note of this, detailing which column(s) should be included and whether the columns need to be index key columns or just included columns. It even provides rough estimates of the improvement that might be gained by adding an index. This estimate is based solely on that specific query and without optimizing the workload as a whole (the Database Tuning Advisor, on the other hand, would take the optimized workload into consideration) but it gives you an idea of whether the index is worth pursuing. (See msdn2.microsoft.com/en-us/library/ms345421.aspx for more information.)

Rebuilding Statistics
Q I need to rebuild statistics on very large SQL Server tables that are located in heavy usage environments where there is no server downtime. I would rather not play around with different sample sizes. I’m running SQL Server 2000 and SQL Server 2005. There seems to be less of a need for explicit sampling in SQL Server 2005 since the default sample size has increased dramatically. When is it necessary to do a full scan on a table?
A If the sample is good, there is usually no need to play with the sample size and the default sample will be sufficient.
But, statistical estimations based on sampling depend on the randomness of the sample. A non-random sample will yield bad results, and without randomness, increasing the sampling rate won’t help. The only proven workaround is to avoid sampling altogether and do full scan statistics.
Unfortunately, there is no simple way to determine the randomness of the sample. It usually takes some statistical analysis of the involved data. For instance, to get a sample on column B, you use an index on column A. If A and B are correlated in any way, the sample isn’t random. Other sources of non-randomness come from the fact that you do page sampling for performance reasons.
So, start with default sampling. Try full scan only if you observe performance issues (slow plans). If this works, come up with a plan for periodically refreshing the statistics of the full scan. Also keep in mind that at least on SQL Server 2005, full scan stats get parallelized. Depending on your circumstances and hardware this might dramatically reduce the build time.
Online Resources
  • Get SQL Server 2005 Service Pack 1
  • Try it out in SQL Server Virtual Labs
  • Learn about Full-Text Search in SQL Server
  • Build a small installation and hone your skills with SQL Server 2005 Express Edition

Thanks to the following Microsoft IT pros for their technical expertise: Maria Alex, Ben Christenbury, Richard Dawson, Keith Elmore, Michael Epprecht, Qun Guo, George Heynen, Allan Hirt, Cynthia Keough-Erdmann, Simona Marin, Jaime McGeathy, Nitie Mehta, Alejandro Mihanovich, Nagesh Nayak, Igor Pagliai, Uttam Parui, David Reinhold, Craig Riter, Franz Robeller, Steven Wort, Jason Wu, and Peter Zabback.


 How IT Works: SMS Client-Side Software Installation
How IT Works
SMS Client-Side Software Installation
Steve Rachui

When configuring a software package for distribution in Systems Management Server (SMS) 2003, the administrator must choose the user context under which the software will be installed—either the logged-on user or the administrative context. If you choose local user, the software installation will be executed under the context of the user currently logged onto the computer. Because this option requires a user be logged onto the target computer, and is very limited if the local user does not have administrative rights, it is more common for software distributions to be sent under administrative credentials.
Even using administrative credentials, there are software installation differences depending whether the target is an SMS 2003 advanced client or a legacy client. On an advanced client, software distributions configured to install using administrative credentials cause the software program to be executed in the context of the local system account. On legacy clients, selecting administrative credentials causes the installation to be executed under the context of the SMS Client Token local account (smsclitoknlocalacct&). This account is created as a typical user account and elevated to the necessary administrative credentials at the time of software install. For workstations and member servers, this account is unique to that particular system and is stored in the local Security Accounts Manager (SAM) database. Domain controllers also use this account but share a domain copy.
The choice to use the local system account for the advanced client allows for increased security, but there’s more you need to know. Consider, for example, the distribution of a Microsoft Installer (MSI) package. If the MSI package has been built to attempt a per-user instead of per-system installation, the installation may fail or the results may be unexpected. MSI packages can usually be deployed per-system by adding the allusers=2 switch to the MSI command line through SMS.
Other installations may also not behave as expected if they’re initiated from SMS distribution points but during execution attempt to access external network resources. The advanced client and legacy client handle this differently, and without understanding these differences, software installations may be inconsistent between the two clients.
When distributing software using administrative credentials, the local system account (advanced client) and SMS Client Token Local Account (legacy client) have full administrative privileges on the local computer but do not necessarily have access to network resources that might be needed during software execution.
When the SMS 2003 advanced client initiates software execution, it connects to the SMS Distribution Point to retrieve the software. Assuming all required files are available on the SMS distribution point, installation proceeds. If the requested software does not reside on an SMS distribution point or if during installation references are made to a non-SMS share, then SMS will attempt to connect to that share location under the context of the Advanced Client Network Access Account. If this account is not configured or does not have rights to the requested share, the installation will fail and errors will be noted in the execution manager log (execmgr.log). Typically errors in this log will be of the access-denied variety when the SMS client attempts to access a non-SMS share. It should be noted, however, that even if the network access account is used, the actual installation of the software is still handled by the local system context. The Advanced Client Network Access Account is used strictly for network access.
In contrast to the advanced client, the SMS 2003 legacy client has the ability to use the Software Installation Account. This account is used not only to access non-SMS shares for software installation—just as the Advanced Client Network Access Account—but also to perform the actual installation. At run time this account is elevated (if necessary) to have administrative privileges.
Understanding how network communication is facilitated for each client during software distribution can help pinpoint failures should they occur. Execmgr logging (advanced client) or SMSAPM32 logging (legacy client) is often useful to track the cause of errors.

Steve Rachui is a Manageability Support Escalation Engineer in the Product Support Services group at Microsoft. He has supported SMS since its introduction. Steve can be reached at steverac@microsoft.com.


 Hey, Scripting Guy!: It’s About Time (Oh, and About Dates, Too)
Hey, Scripting Guy!
It’s About Time (Oh, and About Dates, Too)
The Microsoft Scripting Guys
Download the code for this article: ScriptingGuy2006_07.exe (151KB)

You know, the Scripting Guys hardly ever wax philosophical. (We hardly ever wax our cars or our floors, either, but that’s a different story.) When it comes to the nature of time, however, well, in that case we just can’t help ourselves. That’s because time is such an interesting phenomenon. After all, you can call time, cheat time, make time, waste time, steal time, and keep time; heck, you can even kill time. (Disclaimer: no time was harmed in the making of this column.) Time flies, time marches on, and time (not to mention tide) waits for no man. And yet, time is on your side and time heals all wounds, even though there’s no time like the present and definitely no time for sergeants. We could go on, but we simply don’t have the time.
OK, that’s not true. We actually have lots of time. It’s just that the editors of this magazine have certain expectations, one of them being that a scripting column should include information about scripting. Although, considering what they pay us, they should be happy to get any kind of column. Haven’t they ever heard the expression "time is money"?
Unfortunately, there is something you can’t do with time, at least not easily: make any sense of it in a Windows® Management Instrumentation (WMI) script. For example, consider this simple little script, which tells you the date and time that the operating system was installed on a computer (the value of the InstallDate property):
strComputer = "."

Set objWMIService = GetObject("winmgmts:\\" & _
    strComputer & "\root\cimv2")

Set colOperatingSystems = _
    objWMIService.ExecQuery _
    ("Select * from Win32_OperatingSystem")

For Each objOperatingSystem in _
    colOperatingSystems
    Wscript.Echo objOperatingSystem.InstallDate
Next
So when was the operating system installed on this computer? Why, on the date shown in Figure 1, of course. Ah, yes: 20031121093604.000000–480. What a great time we had back then, eh? Remember when that one guy did that one thing? Precious memories...
Figure 1
Actually, this is a valid date and time: 9:36 A.M., November 21, 2003. And, no, the date and time isn’t being stored in, say, Klingon format. Instead, WMI stores dates and times in the Universal Time Coordinate (UTC) format. We won’t explain the details of the UTC format here; for more information, read the WMI chapter in the Microsoft® Windows Scripting Guide. Suffice it to say that the InstallDate property returns the date in a valid date-time format. Furthermore, you can use code similar to this function to convert a UTC date-time value to a regular date-time value:
Function WMIDateStringToDate(dtmInstallDate)
    WMIDateStringToDate = _
        CDate(Mid(dtmInstallDate, 5, 2) &_
        "/" &_
        Mid(dtmInstallDate, 7, 2) &_
        "/" &_
        Left(dtmInstallDate, 4) &_
        " " &_
        Mid (dtmInstallDate, 9, 2) &_
        ":" &_
        Mid(dtmInstallDate, 11, 2) &_
        ":" &_
        Mid(dtmInstallDate, 13, 2))
End Function
We know what you’re thinking—this isn’t the most straightforward code you’ve ever seen. (Yes, we know what you’re really thinking, but they won’t let us use words like that in this magazine.)
Oh, and it gets worse. Suppose you want to use WMI to query the event logs for all the events that occurred on 12/19/2005. Can you use the date 12/19/2005 in your WMI Query Language (WQL) query? You wish. Instead, you have to convert 12/19/2005 to its UTC equivalent (something on the order of 20051219000000.000000–480). How nice...
We’re sure by this point you’re wondering, "Man, if those WMI guys are so smart, why can’t they come up with a way to do these conversions for us, and without us having to use Mid and Left and all those other crazy VBScript functions?" Well, it turns out that they did. In Windows XP and Windows Server™ 2003 (sorry, Windows 2000 users, but this enhancement isn’t available on operating systems that predate Windows XP), WMI includes a new object—the SWbemDateTime object—that makes it a snap to convert a UTC date-time value to a regular old date-time value. And vice versa.
No, we’re not pulling your leg; it’s true. To prove it, let’s take a look at a sample script that retrieves the date and time at which the operating system was installed and then reports that information back as a real date-time value.
As you can see in Figure 2, this script is similar to the first script we showed you—the script that reported back the InstallDate as a UTC value. In fact, there are only a couple of differences here. To begin with, we create an instance of the WbemScripting.SWbemDateTime object. As you might have guessed, this gives us an instance of the SWbemDateTime object we can work with:
Set objSWbemDateTime = _
    CreateObject("WbemScripting.SWbemDateTime")
Figure 2 A Readable Install Time (Close Figure 2)
Set objSWbemDateTime = _
  CreateObject("WbemScripting.SWbemDateTime")

strComputer = "."
Set objWMIService = GetObject( _
    "winmgmts:\\" & _
    strComputer & _
    "\root\cimv2")

Set colOperatingSystems = _
    objWMIService.ExecQuery _
    ("Select * from Win32_OperatingSystem")

For Each objOperatingSystem _
    in colOperatingSystems
    objSWbemDateTime.Value = _
        objOperatingSystem.InstallDate
    Wscript.Echo _
        objSWbemDateTime.GetVarDate(False)
Next
The other difference is that we now use two lines of code to retrieve, convert, and report back the install date. First, we assign the UTC date-time value returned by InstallDate to the Value property of the SWbemDateTime object. That’s what we do here:
objSWbemDateTime.Value = _
    objOperatingSystem.InstallDate
Why do we have to do this? Well, when we create an SWbemDateTime object we create a blank object—the object’s properties, such as Value, are all null. Here we’re just assigning a UTC value to our object: the value of the InstallDate property.
All we have to do now is call the GetVarDate method. This converts the UTC value to a regular old date-time value (or, more correctly, a variant date-time value). To keep the coding to a minimum, we echo back this value at the same time we convert it:
Wscript.Echo objSWbemDateTime.GetVarDate(False)
Alternatively, we could have stashed this value in a variable:
dtmMyDate = objSWbemDateTime.GetVarDate(False)
And what do we get when we run this script? We get the output shown in Figure 3.
You’re right: it is about time, isn’t it? Some of you noticed the False parameter that we passed to the GetVarDate method. As it turns out, GetVarDate can report back the date and time in one of two ways: correcting for the local time zone or without correcting for the offset (difference) between local time and Greenwich Mean Time (technically, a somewhat nebulous time known as "unzoned time"). What does that mean? Well, suppose we set this parameter to True. In that case, we’ll get back the value shown in Figure 4.
Figure 3
Figure 4
Why the difference? This computer happens to be based in Redmond, WA (the center of the universe), and Redmond time is eight hours behind Greenwich Mean Time. (For a more detailed discussion of local time and unzoned time, see the CIM_DATETIME section of the WMI SDK.) To report the value as Redmond time (or whatever your local time happens to be) set the parameter to True.
Unless, of course, you’re running Windows XP Service Pack 1 (SP1) or "plain-vanilla" Windows XP. Setting the parameter to False under these OSs gives you the corrected time. That’s actually the opposite of what it should do; because this parameter corrects for local time, you’d expect to set it to True to get local time. That’s the case in Windows XP SP2 and Windows Server 2003. With these operating systems, this has been "fixed" and you set the parameter to True in order to correct for local time.
That could pose a problem if you have some computers running Windows XP SP1 and others running Windows XP SP2. In that case, you’ll have to add a bit of logic to check which version of Windows you’re running and then set the value of the parameter accordingly. But hey, if it didn’t have some quirkiness, it wouldn’t be scripting, would it?
Now, what about going the other direction? That is, what about taking a variant date and converting it to a UTC value? Figure 5 shows a script that retrieves a collection of all the event log events recorded on or after January 1, 2006 (that is, all events where the TimeWritten property is greater than or equal to 1/1/2006). To do so, it takes a variant date (1/1/2006), converts that date to a UTC date-time value, and then uses that value in the WQL query.
Figure 5 Converting to UTC (Close Figure 5)
Set objSWbemDateTime = _
  CreateObject("WbemScripting.SWbemDateTime")

objSWbemDateTime.SetVarDate #1/1/2006#, True

strComputer = "."

Set objWMIService = GetObject(_
    "winmgmts:\\" &_
    strComputer &_
    "\root\cimv2")

Set colEvents = objWMIService.ExecQuery _
    ("Select * from Win32_NTLogEvent _
    Where TimeWritten >= ‘" & _
    objSWbemDateTime.Value & "’")

For Each objEvent in colEvents
    Wscript.Echo objEvent.TimeWritten
Next
As you can see, this is even easier than converting a UTC date to a regular date. After creating an instance of the SWbemDateTime object, we use one line of code to set the Value of the object to 1/1/2006:
objSWbemDateTime.SetVarDate #1/1/2006#, True
That’s it—we simply call the SetVarDate method, passing the date (enclosed within # characters, which ensures that VBScript treats the value as a date) and the parameter True. Note that in this case—unlike GetVarDate—True really does mean "Yes, convert this date to local time." That means you can use the same value in Windows XP SP1, Windows XP SP2, and Windows Server 2003.
You probably want to convert the time to local time. After all, we’re using this value in a WQL query that retrieves events written to the event log where the TimeWritten for the event is greater than or equal to the zero-hour on 1/1/2006. If we don’t correct the time for local time, we could end up getting events that were written as many as eight hours prior to the zero-hour, which means we could end up with some events that actually occurred on New Year’s Eve (12/31/2005). Needless to say, many of us don’t want to know what happened on New Year’s Eve, if you catch our drift.
If this is confusing, try running the script twice, once with the parameter set to True and once with the parameter set to False. If you compare the results, you’ll see what we’re talking about.
Now that we’ve converted our date to a UTC date, we can use the Value of our SWbemDateTime object in our WQL query, like this:
Set colEvents = objWMIService.ExecQuery _
    ("Select * from Win32_NTLogEvent _
    Where TimeWritten >= ‘" & _
    objSWbemDateTime.Value & "’")
Cool, huh?
Now, admittedly, we chose a pretty easy case here—any event that occurred after the year 2005. We could get a bit fancier and retrieve only events that occurred between 2:00 P.M. on January 1st and 6:00 P.M. on January 3rd. But that’s a tad bit more complicated and something we’ll have to address later on; after all, right now we really are out of time.

Parting Words
Before we go, we’d like to remind you of the words of author and activist Louise Hart: "The best thing to spend on your children is your time." Maybe that’s true, but we’re willing to bet there were some awfully disappointed kids at the Hart household last Christmas morning.
A Note from the Scripting Guys
If you’re walking down the street and you see a crowd of people looking up at the sky, do you stop and look? Of course you do. Even if you’re trying not to, you still take a subtle peek. On the one hand, this could be some sort of human behavior study and you’ve just responded as an obedient guinea pig. On the other hand, there could be a UFO hovering overhead and you certainly don’t want to miss the first sight of life from another planet. Or there could be something dangling from a crane, ready to fall on your head if you don’t watch out. Whatever the reason, your curiosity will typically get the better of you and you’ll look.

Take a Look
That brings us to the Script Center. Why are system administrators flocking to the Script Center and looking around? Come find out for yourself. Chances are nothing will fall on your head if you don’t, but you could still eliminate a certain amount of pain from your life if you do.
The Script Center is overflowing (can a Web site overflow?) with resources to help you automate your Windows systems. In addition to thousands of scripts, you’ll find daily Q & A articles (that answer actual user questions), puzzles to improve your troubleshooting skills, and even something called Dr. Scripto’s Fun Zone. (Missing the Fun Zone would be like missing the UFO. OK, not exactly like that, but close.) All of this is meant to educate you and help you become more efficient at your job—and here’s the important part—without putting you to sleep in the process. It’s one of those "you have to see it to believe it" things.

Tell Me Something I Don’t Know
Now you’re waiting for us to throw in some steak knives for just $19.99, aren’t you? Well, that’s not going to happen. (We’re usually not allowed to handle sharp objects.) But here are some new things we can provide:
  • Information about the new scripting capabilities of Windows Vista.
  • New articles every day and a new puzzle each week.
  • New scripts in the Community-Submitted Scripts Center provided by your fellow script writers. (You can even submit your own scripts that you’d like to share.)

Celebrate!
And finally, join us in July as we celebrate the 500th episode of Hey, Scripting Guy! For complete details on the celebration (and maybe even some prizes), visit us at microsoft.com/technet/scriptcenter.

The Microsoft Scripting Guys spend most of their time at the beach...oh, um, no, we mean: The Scripting Guys are hard-working members of the Microsoft Windows Server User Assistance team. To find out more, go to "About The Scripting Guys".


 Inside Microsoft.com: Managing SQL Server 2005 Peer-to-Peer Replication
Inside Microsoft.com
Managing SQL Server 2005 Peer-to-Peer Replication
David Lindquist

The Microsoft corporate Web sites rely heavily on databases, which power such high-traffic destinations as Microsoft® Update, Download Center, Communities, TechNet, and MSDN®. Microsoft.com operations has a team of 17 engineers, the SQL Server™ operations team, that manages these database systems. In all, this team is responsible for more than 2250 active user databases that take up about 55.15TB of space on 291 production SQL Servers.
One system managed by this team hosts databases for internal content providers. These content providers are groups within Microsoft that publish content to the Web. They are located around the world and they all require database functionality behind their Internet-facing Web applications.
This environment has gone through different architectures as databases, functionality needs, and hosting strategies have changed. Currently, there are more than 100 databases consolidated in this environment. It is built on Windows Server™ 2003 SP1 Enterprise Edition and SQL Server 2000 SP4 running on six HP Proliant servers. Transactional replication is used to move data to and from a consolidator server, which serves the data to multiple live servers that are accessed by Web applications. A logshipping scenario is also used to provide failover and redundancy. Figure 1 illustrates the architecture.
Figure 1 Current Architecture
Figure 1 Current Architecture
As the release of SQL Server 2005 approached, we were interested in a number of its new features and needed to put together a game plan for upgrading the environment. One feature in particular that we were interested in was a new flavor of transactional replication called peer-to-peer replication. With this configuration, all nodes in a topology are peers. Each node publishes and subscribes to the same schema and data. Changes (such as inserts, updates, and deletes) can be made at any node and the replication technology recognizes when a change has been applied to a given node, preventing changes from cycling through the nodes more than one time.
The SQL Server Books Online article "Replication Availability Enhancements" says that "in SQL Server 2000, transactional replication supported hierarchical topologies in which a Publisher owned the data that was replicated to Subscribers. Transactional replication with updating subscriptions supported Subscriber-side updates, but the Subscribers were classified as different types of participants in replication than the Publishers."
The article goes on to explain that SQL Server 2005 introduced a new peer-to-peer model that allows replication to occur between identical participants in the topology. This model is well suited to users who are running server-to-server configurations and also need to move the roles between replicated nodes dynamically to perform maintenance or to manage failure scenarios.
The thought of having the same database hosted on more than one server, where each was in sync with the others and each could be written to and read from sounded great. We could load balance the databases when there was no maintenance to be done, and when we needed to work on a server, we could pull it out of rotation while the other servers handled the load. The uptime, performance, and failover possibilities were quite attractive. (For a comparison of load balancing and failover scenarios, see the "Load Balancing Versus Failover Strategies" sidebar.)
Load Balancing Versus Failover Strategies
Strategy I: Load-Balancing Characteristics
Each production server hosts a read/write copy of the database. The databases are kept in sync using SQL Server 2005 peer-to-peer replication. Applications connect to the SQL cluster through the production interface using a host name that will distribute and load balance traffic between the four nodes.
Redundancy
There is a copy of the database on four different servers. If one node of the cluster becomes unavailable, the other nodes automatically pick up the traffic.
Availability
Each server can be taken out of the cluster individually so maintenance can be performed without causing the database to become unavailable.
Performance
Application calls to a database are load balanced between the four nodes of the cluster. Balancing the load should result in better performance during times of increased activity.

Strategy II: Failover Characteristics
Each production server hosts a read/write copy of the database. The databases are kept in sync using SQL Server 2005 peer-to-peer replication. Applications connect to one node of the SQL cluster using one of the virtual IP addresses on that cluster.
Redundancy
In the event the node taking traffic becomes unavailable or if the server needs to be taken down for maintenance, traffic is redirected (failed over) to the other node of the cluster. There is a current copy of the database on all four nodes for redundancy.
Availability
If the node of the cluster you are connecting to becomes unavailable or needs to be taken down for maintenance, traffic is directed to the other node of the cluster with minimal down time (only seconds).
Performance
The application is always connecting to one database in the topology.

Our Upgrade Strategy
We started our upgrade project by setting up two test servers in our lab. Each was running Windows Server 2003 SP1 and had two instances of prerelease SQL Server 2005. This gave us four nodes to test on. We then set up a test database on each instance and configured peer-to-peer for the first time. We found we could make data and schema changes in any of the four databases and the changes would replicate to the other nodes without a problem. We had initial proof of concept. The propagation of schema changes was a welcome feature. We could now alter tables, views, procedures, functions, and triggers (DML triggers only) and the changes would replicate to the other peers.
With 64-bit technology being adopted in the Microsoft datacenter (and considering the age of the internal content provider servers we had at the time) we decided to purchase new servers and implemented the configurations shown in Figure 2. (For more info on our move to 64-bit technology, see the January/February 2006 Inside Microsoft.com column.
Figure 2 New Datacenter Machines (Close Figure 2)

 | Model | OS | Processing | Memory | Application
Production 4X | 64-bit HP ProLiant DL585 G1 | Windows Server 2003 Enterprise x64 Edition SP1 | Four single-core AMD Opteron 2.20GHz processors | 16GB | SQL Server 2005 SP1
Pre-Production 2X | 64-bit HP ProLiant DL385 G1 | Windows Server 2003 Enterprise x64 Edition SP1 | Two dual-core AMD Opteron 2.21GHz processors | 8GB | SQL Server 2005 SP1

Load Balancing
Four of the servers are configured in two clusters behind the Microsoft.com Web servers using Network Load Balancing (NLB). The other two servers are set up in the datacenter for pre-production. We utilize a pre-production environment (PPE) so our users, the content providers, can set up their applications on servers that mimic the production servers. This way they can do some development and testing in an environment that has the same OS and application versions that their apps will run on in production. Figure 3 illustrates this setup.
Figure 3 Network Load Balancing Environment
Figure 3 Network Load Balancing Environment
There are two network interface cards (NICs) in each server. The admin NIC is used by the owners of the database to manipulate the data. We give them db_datareader permissions in the database and insert, update, and delete permissions on certain tables so they can upload and offload data from their production database without having to engage us. The production NIC handles traffic to and from the Web servers along with replication traffic between the nodes.
For the production servers, we configured a pair of two-node clusters. We added a virtual IP address (VIP) for each pair on the admin NICs and another VIP for each pair on the production NICs. This allows us to manage the traffic from both sides of the clusters—the production side and the admin side. We created a DNS host name that round-robins between the two production VIPs so we can utilize all four nodes in load balancing.
We set up NLB in unicast mode and took advantage of a new capability available in Windows Server 2003 SP1 that allows two servers configured for NLB to communicate with each other over the NLB interface. For an explanation of this, see the Knowledge Base article "Unicast NLB nodes cannot communicate over an NLB-enabled network adaptor in Windows Server 2003".
As we did more testing with load balancing, the inherent latency in the system became obvious (meaning the time it takes between a transaction being committed at the Publisher and the corresponding transaction being committed at a Subscriber). There was no getting around the fact that it would take a fixed amount of time for data to replicate from one node to the other three. This meant that some database design considerations had to be addressed.

Design Considerations
With load balancing, there is no guarantee that each time an application makes a call to a database it will connect to the same database. We found that load balancing works for read-only and some write-only databases. However, an application that needs to maintain any kind of session state can encounter problems. With load balancing in place, we weren’t able to guarantee that each time the application made a call to the clusters it would go to the same database. Worse yet, because the Web servers were also clustered, we could not guarantee that subsequent calls from an application would come from the same Web server.
This can cause problems, for example, if an application needs to read data immediately after it has been entered. Say an application stores a change a user makes to the data and then the application immediately reads that data in order to display it back to the user. If the application connects to one database to store the data, but connects to a different database to read it back, the second database may not have the updated data yet (because it hasn’t had time to replicate) and the old data is returned to the user.
We had to devise some way to guarantee that an application would hit the same database every time it made a call while still being able to maintain our availability requirement. After some investigation, we found that it is possible to create multiple VIPs on a pair of NLB-configured interfaces and control those VIPs independently of other VIPs configured on the same interfaces. This meant we could create a second production VIP on one of the clusters. By pushing 100 percent of the traffic from this VIP to one node of the cluster, we were able to guarantee that an application would hit the same database every time it made a call to the VIP. This gave us the flexibility to control the traffic utilizing this VIP between the two cluster nodes, and it allowed us the ability to failover from one node to the other.
Foreign key constraints can also be affected by the peer-to-peer latency. For example, imagine you have a foreign key that requires a value in the primary key column of a particular row in Table 1 before the foreign key value in Table 2 can be inserted. If an entry is made in the PK column of Table 1 DB1, but does not replicate to Table 1 DB2 in time, and the application tries to make an entry in the foreign key column of Table 2 DB2, it will fail because the necessary primary key value is not yet in place. Of course, if the entire procedure is handled in the same database connection, there is no problem. But if this is handled in separate calls from the Web server within seconds of each other, there is a potential for failure.
When tables contain identity columns that are configured as primary keys, there are considerations that must be addressed for both load balancing and failover scenarios. For example, when a row from a Publisher table with an identity value is replicated to a Subscriber table, and the Not For Replication property is set on that column at the Publisher, the row values are inserted in the Subscriber table but the insert does not increment the identity value. The result is that when an application tries to add a row directly to the Subscriber table (which would now be the Publisher) it fails because there is already an entry in the identity column with the next identity value because it was replicated from the original Publisher.
Identity columns can be addressed in two ways. First, a new column can be created in a table that has an identity column. This column is an integer data type (adding 4 bytes to the row) and defaults to the specific server ID where that instance of the database resides. For example, if the server ID of the first node is 1, the second is 2, and so on, the new column on the first node would default to 1, the new column on the second node would default to 2, and so forth. This new column, or SRVID column, and the identity column are configured as a composite primary key. This effectively ensures a unique key value on each node of the cluster and mitigates the duplicate key violation issue.
The second option is to seed each identity value on each node with its own range of values. This assures that each identity value remains unique across the four instances of the database. To reduce the maintenance of this approach, the identity columns are created as a bigint data type. We use bigint so we have enough overhead to create large ranges (a billion) that require less reseeding. For example, the range for node one starts at 1, the node two range starts at 1,000,000,001, the node three range starts at 2,000,000,001, and the range for node four starts at 3,000,000,001. This approach also adds 4 bytes to the row because bigint takes up 8 bytes instead of the 4 bytes taken up by the integer data type.

In Production
The beauty of this system is the flexibility that allows us to host a variety of databases in different configurations. We can take advantage of the fact that we have four servers and spread the load across all four, or two or three, or even send traffic to just one.
The majority of the databases in this environment connect through a data source name (DSN) that is configured in the registry on the Web servers. The DSN is how we control the traffic. We have a script that rolls DSN changes through the Web servers. If a DSN is pointing to the host name that balances the load between all four servers, we can run the script to change the DSN, one server at a time, to point to one node of the cluster. We can then make any changes to the database and verify that the changes replicate successfully to the other three nodes before resetting the DSN to point to the host name that provides load balancing between the cluster nodes. Also, if for some reason we have a replication problem while the DSN is pointing to the one node, we can tear down replication and set it back up again before pointing the DSN at the other three nodes. We can do all of this while the site continues to make successful calls to the database.
With the failover strategy, the application is already making calls to one database. So we can make changes on that one node without worrying about the availability of the other nodes since they are not being accessed directly by the application.
One thing to keep in mind is that the environment can become very complex very quickly. For each database, there is a publication and three subscriptions, one to each of the other three nodes. This means there are four copies of a database (one on each node), four publications (one on each node), and twelve subscriptions for each database (three on each node). Thus, the number of jobs and processes running on the servers can increase substantially. For instance, when we get 100 distinct databases in this environment, it adds up to 400 databases, 400 publications, and 1200 subscriptions.
Multiple VIPs on the interfaces can also create complexity. If the interface connections are not well documented and well understood, the failover VIP can be managed incorrectly, resulting in a group of databases in the environment becoming unavailable.
The identity value is one of the biggest hurdles to get over. This is because a lot of developers use the identity value to identify a logical entity, such as a business name, contact name, or product name. This can cause some unexpected development time needed to adapt an existing application to a composite primary key that includes the new server ID column and the identity column. We think the payoff is worth the work, but if the server ID column cannot be added, the identity ranges will need to be seeded and this seeding will need to be managed. One way to manage it is to create a SQL Server Agent job that monitors the incremented value of the identity columns in the database tables. If the value reaches a certain threshold, a stored procedure is run to reseed the identity value.
Being able to rebuild replication after a failure has been critical. If the data becomes inconsistent in the databases, we must point the traffic to one node and then investigate and resolve the differences between tables on the other nodes. There is a new utility that ships with SQL Server 2005 called tablediff.exe. This has proven very useful in identifying the differences between tables and building a script that corrects the differences. Once all the data has been recovered to the one live database, replication can be rebuilt and the DSN pointed back to the cluster.
We are now using peer-to-peer replication successfully for a variety of data sources throughout Microsoft. Moving forward, we have plans to implement a geo-clustering solution to add even further resiliency and redundancy to this infrastructure.

David Lindquist is a System Engineer / MCDBA on the Microsoft.com operations team. He has worked in operations at Microsoft since October 1999 and has been in his current position for the past year and a half. David lives near the Microsoft campus with his wife and two cats. You can reach him at davl@microsoft.com.


 Security Watch: Help Wanted—Need &quot;People&quot; People
Security Watch
Help Wanted—Need "People" People
Jesper Johansson

I’m not really a people person. I’ve said so for years. My old college roommate, Joe, had a better way to put it, but the way he said it is unfortunately not suitable for print. Frankly, not being a people person is a good part of the reason I went into IT in the first place. People don’t seem to ever do what I want them to do, so I found it more comfortable to work with computers. They are easier to control.
This basic realization, however, has lately started worrying me a lot. Not being a people person does not bother me personally all that much. The problem is that I seem to be working in an industry full of people like me. We all seem to have gotten into computers because we were not quite what you may call "normal." My long-lost friend Rob Kolstad once had a very good way to describe Linux users that epitomizes the problem: "What do you mean there is no driver for that printer? Guess I’ll just have to write one." While many of us probably would not resort to writing drivers, we certainly would not think twice about tweaking the parameters of one, and most people who write software today could probably write a driver—whether they could write one without a security hole is a different matter though.

Users Are Not Like Us
Unfortunately, most users are not really like us, and were we to build computers and software solely for people like us we would face certain market problems when trying to actually sell them. Microsoft has, quite frankly, made a fortune because the company figured out early on how to make software that regular people could use. Perhaps even more importantly, Microsoft figured out how to build an ecosystem that allowed third-party developers to do the same. Are we there yet? Not by a long shot, but we (the IT industry) have certainly made great strides.
The strange thing, though, is that few of us "computer people" seem to think much of the people who are to use the services we provide, who are to buy the software we are selling, and who are to actually use the computers we manage as part of the corporate, school, home, or friendsneighborsandpeoplewemeetinthesupermarket IT department. This is in spite of the fact that those very same people are the ones who actually pay for the lube on our propeller hats. I have been delivering presentations to IT professionals and developers for the better part of 10 years. One surefire way to get a laugh from the audience is to joke about how much easier it would be to run systems and write software if we did not have all these pesky users.
Nowhere is this presenting a bigger problem than in the security niche of the general IT industry. While we make it clear that a particular vulnerability requires user interaction, we also know that in most cases, getting users to interact is easy. We just have to offer them something they value more than their private or corporate data, like chocolate or naked celebrities. In spite of the fact that we all know this, very little seems to be done about helping users get better at security. Instead, we give up and claim that users just can’t be taught. However, as an industry, IT will never fully succeed unless we can get users on our side.

Traditional Strategy
For the past 20 years, the security industry has done little beyond just reacting to the bad guys, not proactively doing much to stop them. We place the bar in a certain place, and the bad guys jump over it. So we raise the bar, and the bad guys are stumped for a while, but eventually they jump over it again. It feels like we are stuck in an old Basic program:
10 Detect new attacks
20 react_to_attack_by_raising_the_bar
30 goto 10
We are not making any real headway. Instead of simply reacting to the latest attack, we need to finally get around to not just raising the bar, but to move it to a different playing field; a playing field where we get to write the rules!
To be fair though, the reactive approach led to some successes. For instance, even some industry followers are now conceding that Microsoft is getting ahead on security. But it has also created some new problems, as pointed out by Marcus Ranum a few months ago in his article "The Six Dumbest Ideas in Computer Security". Ranum discusses misguided, though commonly used, attempts and procedures to control attacks on your system. By and large, I really do agree with almost everything Marcus says. However, the part about giving up on users bothers me to no end. I agree that we need to work on preventing users from shooting themselves in the foot. The problem, though, is that we can’t always do that—at least not if we still want to allow people to do what they need or want to do with their computers. For instance, to block Web and e-mail attacks we really need to block Web and e-mail entirely. In other words, to do what Marcus recommends we would, among other things, need to block ports TCP 80, 443, 110, 25, and 143 on the firewall in all directions, as well as all tunneled versions of the typical protocols on those ports. Are you willing to do that?

Tech Solutions Will Fail
Some players in the IT industry would have you believe the solution is anti-virus, anti-spyware, anti-rootkits and other things that collectively fall under the heading of anti-malware. None of that provides a complete solution in the long run, for several reasons. First, they will only ever be able to find things they are programmed to find, and until someone tells them to find something, they won’t. Second, there will always be a contingent of computers that are out of date for one reason or another. With the interdependencies we have in systems today, those computers endanger the rest of us.
Finally, anti-malware will not be able to stop anyone from voluntarily entering their passwords on a Web site that really does look like eBay, but is actually hosted in some teenager’s closet. Clever anti-phishing techniques may be able to warn the user, but it won’t stop them. Nor will anti-malware prevent anyone from uploading sensitive organizational information to a hostile nation-state. In the next couple of years, anti-malware will probably be universally perceived as a good mechanism to protect against known attacks, but not of much use against targeted or mutating attacks.
Other players in the industry would have you believe that things like outbound host-based firewalls will be the panacea. That would probably qualify as the seventh dumbest idea in security. These firewalls will not stop the vast majority of real attacks. First, they are still port-based, and the attacks are not. The attacks occur in the application layer and above. The fact that attack traffic goes over port 80 does not make it legitimate. Second, this argument assumes we can contain a host that has already been compromised, on that host! This would be a violation of the first immutable law of information security: "If a bad guy can persuade you to run his program on your computer, it’s not your computer anymore". The firewall may block current attacks, but that misses the point—we have to start thinking about how to block future attacks. Finally, host-based outbound firewalls are a perfect example of why pure technical solutions can fail. These firewalls ask users intelligent questions, such as the one you see in Figure 1.
Figure 1 What We Show the User
Figure 1 What We Show the User
The problem is that these dialog boxes were not exactly written by people people. They were written by propeller heads, for propeller heads, because the propeller heads typically do not know any real people. When the average user is confronted with this dialog, he does not actually see it at all. What he sees is a lot like Figure 2.
Figure 2 What the User Actually Sees
Figure 2 What the User Actually Sees
For all these reasons, technical solutions to what are essentially people problems do not work very well. They may help technical people, but technical people do not need the help. In order to be successful the protection needs to sit as close to the problem as possible. Trying to use one object to protect another object generally will fail because only the object at risk can fully understand the intricacies of the risk. Objects, including people, therefore need to be empowered to protect themselves. A world where every object relies on some other object for its protection will ultimately fall down. At a deep technical level, many, if not most, buffer overflow vulnerabilities came about for this very reason—some object assumed it was protected by some other object.

Users Are the Problem
What this means is that even as we get better at securing the systems themselves, we are left with one fundamental problem: users are no smarter about security than they ever were. It was, and remains, far easier to hack people than it ever was to hack computers. The reason most criminals (with notable exceptions, such as convicted computer criminal Kevin Mitnick) have not taken to doing so on a massive scale may be because they went into IT for the same reason I did. But systems are getting better. There are fewer technical vulnerabilities to exploit and we are finding out about them sooner. All in all, this enables us to correct technical security problems quite quickly.
On the contrary, it seems like it is getting easier to hack people—or maybe I am just now realizing how easy and profitable it can be. Fifteen years ago, users had never heard of the Internet, nor had they done online banking, received an e-mail message telling them to click a link to select a password for their new credit card, entered their social security number or a credit card verification code on a Web site, or read their e-mail while sitting at Starbucks. These things were clearly beyond their world view back then. Now these are all common activities. People do not think twice about things that would have raised all sorts of alarms 15 years ago. Think about it. In 1991, what would your answer have been to the following request: "Go to cheaploans.woodgrovebank.com and fill out our easy application form, including your checking account number, your social security number, and your home address, and we will run a credit report and e-mail you three offers for a new mortgage in less than five minutes."
In a way, by enabling all these wonderful things online, we have also desensitized people to things that in many cases may be extremely malicious. By taking people out of their comfort zone, out of the cognitive space where they understood their world, we have put them into a world that feels thoroughly alien to them, where nothing seems out of the ordinary; a world where they have stopped questioning the legitimacy of anything that happens to them. Cognitive scientists claim that our cognitive facilities evolved in caves, where our major concerns were to stay out of reach of the saber-toothed cat, how to kill a mammoth to get food today, and where we might find a mate to club and drag home. I do not entirely agree with cognitive science, but it is clear that human cognitive faculties certainly did not evolve to deal with phishing attacks or a "Vulnerability in the Graphics Rendering Engine [which] Could Allow Remote Code Execution." In addition, by cultivating an industry of fear, the security industry has done little to help people cope with the new threats they are facing.
Like most people, I have burning thoughts that keep me awake at night. I think about the notion that all the indicators are pointing toward a disastrous showdown—a disastrous showdown which we are already starting to see in the phishing attacks that hit our mailboxes every day. Phishing is not a technical attack. It is a wetware attack—an attack against people. We can certainly stop it with technical means, but frankly, nobody wants to. Doing so would require us to shut off e-mail, or Web access, or both. That’s a losing proposition.

Empower People
I firmly believe that writing off people is wrong. People are incredibly smart when you get right down to it. They have learned some extremely complicated things, like walking, talking, reading, even driving cars without crashing into things all that often. There is no reason to believe they could not be taught to make more intelligent security decisions. I am not saying they should become security experts; only that they need to learn that sending a blank, signed check to an unknown recipient is probably not a good idea. There is, of course, the possibility that we could embody this expertise in a computer program—an expert system—and have it make decisions on behalf of users. However, during the late 1990s expert systems were shown to usually be a more complicated abstraction of the real world than the real world they were intended to model. Besides, scientific research by Michael Davern (see, for example, his article "Discovering Value and Realizing Potential from Information Technology Investments") and others showed that users typically overrode the decisions made by the system anyway.
In order to develop some solutions to these problems we need to figure out what to tell people to help them make intelligent security decisions. What do IT people need to tell their users, as well as friends, family, neighbors, and the guy at Starbucks, about security? How should you do it? I think the problem will take real cognitive psychology experts. We need to figure out how to transfer expertise from the people who do understand security to those who do not. Maybe it is time for the scientific field to pick up the gauntlet and solve these problems? I think we need leadership in this area, and right now it worries me greatly that I am not seeing it.
The real solution, therefore, is that we—the people who design, write, implement, and manage software—have to learn how to deal with people. That is the only way we will be able to help people defend themselves. Defending themselves is the only way people can be safe. People are the new frontline in the infosec battle. Like it or not, that is where we are heading. Take passwords, for instance. We can solve the technical issues with passwords. What we have not figured out yet is how to solve the biggest problem of all—the fact that if I want someone’s password, the easiest way to get it remains to simply ask the person for it. Done right, there is an 80 percent or better chance I will get it.
How to proceed then? Well, the sad fact is that the IT industry by and large won’t. There are some signs of improvement, such as an increase in the guidance available around selecting and managing passwords (see the documentation at "Password checker" for example). However, much of the IT industry does not consider it its job to solve these types of problems. The job of the IT industry is simply to improve the technical security of its products and to provide products which solve technical security problems. However, as a society we must secure the ecosystem itself. That part is nobody’s job since the success of a particular product is not clearly tied to it. It is hard to argue that Microsoft will sell more copies of Windows® by securing people. It will not sell more support contracts for Oracle to make people unbreakable. It certainly would not sell more copies of Norton Internet Security if people were better able to protect themselves. While the benefits of an ecosystem that can protect itself are available to all, the costs of bringing us there are not clearly assignable to any current players in the market place. We are, by and large, left without much leadership.
As the IT industry solves its security problems, the battlefield changes. On this new battlefield the generals have left. And the troops are unaware that they have joined a battle and they have no weapons and little body armor.

Jesper Johansson is a senior security strategist with Microsoft, focusing on how customers should best deploy Microsoft products more securely. He has a Ph.D in MIS and has delivered speeches on security at conferences all over the world.


 Field Notes: An Ounce of Prevention
Field Notes
An Ounce of Prevention
Jay Shaw

All good IT pros worry about their servers. If something goes wrong it’s your problem and it’s usually a big one. Most of you stick your servers in a closet and neglect them. Unless something blows up, you may not even look at them for months at a time. Sure you check them with Remote Desktop every day or so, but when did you last actually take a peek at the physical machine?

Can’t Take the Heat
What would you do if you were stuck in a closet where the temperature jumps to 130 degrees in July? Most likely you’d quit immediately, yet we expect our servers to keep working 24/7 without complaint. You had some warning—you heard the fans kick into high gear when you opened the closet a few months ago, and yet you did nothing.
Fans often break and make no sound at all. You might as well break out the BBQ sauce then, because the machine is going to cook. True, most servers are now built with temperature controls and automatic shutdown devices, but you can’t count on them.
I recently went to my office on a Saturday and found that Facilities was mistakenly shutting down the ventilation to the server closet on weekends. Fortunately, I noticed in time, but it was an important wake-up call.

Out of the Closet
If your servers aren’t in a closet, you still have other concerns to deal with. You have to think about who has access to them—legitimate or not. I have a customer who routinely has spyware issues on his server. The server sits in the middle of the office where everyone can play with it. People surf on it all the time and, of course, everyone has the administrator password, a surefire accident waiting to happen.
Even if you have a very small office where internal security is not much of an issue, you should still take precautions. If you keep your server behind lock and key where it’s supposed to be, you’ll go a long way toward avoiding problems that stem from misuse.

Environmental Impact
Fire and water may be elemental, but you don’t want them anywhere near your server. One of my clients recently had a fire in the server closet. Luckily, the fire was extinguished before the server got too badly singed. I noticed lots of paper and other flammable materials lying all over the server table. All those materials just added kindling to the fire. Keep your server room free of unnecessary flammables. And while I’m on the subject, keep your backup tapes in a fireproof and waterproof box with a second set of tapes at an offsite location.
Have you ever seen a server swim? I witnessed such an event on the third floor of a modern office building, in a lovely pool that developed after a pipe burst on the floor above. Do you have pipes running through or near your server closet? Is your server sitting directly on the floor? If so, you might come in one day and see it doing the back stroke. Keep your servers on a table and protect them from water leaks or sprinkler systems.
Just because servers don’t like water doesn’t mean they don’t need to be cleaned every once in a while. I once saw so much dust built up inside of a server that I literally had to scoop it out. I wore a grounding strap and administered compressed air but I lost that patient. That’s a fate you can easily avoid by just opening the case four times a year and using some compressed air to clear the dust.
Don’t house your servers in a jungle of cords either. When you open your server closet, does it look like there are vines falling from the ceiling or crawling across the floor? If you move the server three inches to the left, does the network cable pop out? Can you pull your server out of its rack at least 12 inches without jerking the keyboard and mouse out of the back?
Think of it this way: a server-friendly environment is probably not much different from the one you’d choose to live in.

Health and Well-Being
What kind of shape is your server in? When you last disassembled it, did you put it back together properly or do you have one of those machines that can’t be moved for fear the hard drives will slide right out of the case? And what about the drive cables? Do they make a lot of noise when you close the case? Are they rubbing on the processor fan? If you keep ignoring the symptoms, eventually the cable is going to break. You need to make sure the cables run through the case in the proper locations so that air can flow through and keep everything cool.
IT pros want to avoid making clients angry at all costs. If it takes a little forethought and a few special precautions to avoid server meltdown, it’s worth every moment at the client site. And it will prevent you from needing to constantly look for new clients.

Jay Shaw is an independent network consultant. His company, Network Consulting Services, is located in Long Island, New York. He can be reached at info@ncservices.net.


 TechNet Update: Resource for the IT Professional
What is Microsoft TechNet?
Resource for the IT Professional

The complete Microsoft TechNet Program provides comprehensive tools and authoritative information to help IT professionals get the most out of Microsoft products and technologies. It’s where you turn for the latest security alerts, live discussions, virtual testing labs, free tools, and in-depth articles that allow you to be more responsive, more informed, and more effective. Take a look at all the resources that Microsoft TechNet has to offer.

TechNet Online
The TechNet Web site is the place for IT professionals to get the information they need to plan, deploy, troubleshoot, maintain, secure, and support their Microsoft technology investments. You can access the latest security bulletins, tools, product documentation, TechCenters, Microsoft Knowledge Base articles, the Security Center, and the Script Center. You can also find learning resources, including e-learning, virtual labs, webcasts, and classroom training information, all at microsoft.com/technet.

TechNet Flash
The biweekly TechNet Flash newsletter delivers the latest IT news, security bulletins, software updates, and event announcements right to your inbox—making it easy for you to stay up-to-date with the latest technological developments from Microsoft. You can customize your own version to receive the information that’s most important to you. Register at microsoft.com/technet/abouttn/subscriptions/flash_register.mspx.

TechNet Magazine
Improve SQL Server™ performance, tune up your Windows servers, simplify your life with scripts, and learn how to best protect your environment against the latest security threats. TechNet Magazine is a monthly print publication, also available online, that features in-depth articles from experts to help you do all this and more. But don’t just take our word for it. Flip through this issue and see for yourself, or read online.

TechNet Events
Microsoft TechNet Events are free local events for IT professionals that explain how to use Microsoft products and technologies. You’ll see live demos and hear directly from specialists who live with real-world implementations of Microsoft products and technologies every day. Schedule and registration are available at technetevents.com.

TechNet Webcasts
TechNet webcasts are live broadcasts that feature interactive technical presentations, product demonstrations, and question-and-answer sessions. Up to 30 new webcasts are broadcast every month, each presented by an expert in their field. All content is also recorded and made available on demand. TechNet Support webcasts focus on support issues like troubleshooting, configuration, diagnostics, and fixes. Schedule and registration are available at microsoft.com/technet/community/webcasts/default.mspx.

TechNet Virtual Labs
TechNet Virtual Labs let you evaluate Microsoft software in a risk-free environment. You can explore apps through guided tours that highlight new features, without the hassle of downloads or complicated installations. You can gain real-world insight into business issues by working hands-on with Microsoft products, including Windows Server™ 2003, Exchange Server, and SQL Server 2005. TechNet Virtual Labs are free at microsoft.com/technet/virtuallab.

TechNet Radio
TechNet Radio features interviews and commentary from Microsoft insiders and industry luminaries, as well as profiles of leading companies. We bring you the trends and technologies that are shaping the industry, and offer perspectives from your peers. Take a listen at microsoft.com/tnradio.

TechNet Plus Subscriptions
With a TechNet Plus Subscription, you get two free professional support incidents to use on any Microsoft technology, access to full-version software with no time limits for evaluation purposes, early access to beta software, newsgroups monitored by support professionals (guaranteeing next-business day responses to your technical questions), free training, and much more. Sign up at microsoft.com/technet/subscriptions.


 Windows Confidential: A Brief and Incomplete History of FAT32
Windows Confidential
A Brief and Incomplete History of FAT32
Raymond Chen

Why did classic Windows 95 limit local hard drives to 2GB? Some people would lead you to believe that the FAT file system team said, "Y’know, the FAT file system supports hard drives of indefinite size, but let’s impose an artificial cap just to make people’s lives more frustrating." In reality, the 2GB limit was the result of a combination of several pre-existing limitations. The maximum size of a cluster was 32KB, and the maximum number of clusters on a single drive was a shade under 65535. When you multiply this out, you find that the maximum drive size was a tick under 2GB.
You could, with some tweaking, get the cluster size up to 64KB on Windows NT®, but you would quickly regret this. If you took this chance, you’d find that many apps would end up overflowing some internal 16-bit computations and producing garbage results. This issue was particularly common among application setup programs, which ended up telling you that your freshly formatted 1GB drive was out of disk space.
Increasing the maximum cluster size doesn’t really help anyway. Even though it raises the limit on the maximum size of a drive, it does so only in a crude way. Since the cluster is the unit of storage for files on FAT drives, increasing the size of a cluster merely increases the granularity of file storage. The total number of files you can store on the drive doesn’t change; the result is simply that each file can be bigger. If all you do is increase the cluster size, there is still a limit of 65535 or so files per drive. It’s the cluster count that you have to increase.
In the FAT file system, the number of clusters per drive was limited to around 65535 because the file allocation table—the object after which the FAT file system was named—consisted of an array of 16-bit cluster numbers. With Windows® 95 OSR2, FAT32 was introduced, raising the maximum number of clusters into the millions by expanding the file allocation table to an array of 32-bit values. Note, however, that the maximum number of clusters is 0x0FFFFFFF—not the full 32-bit value of 0xFFFFFFFF. Since this is limited to a 28-bit value, programs that manipulate FAT32 file allocation tables can use the top four bits as tag bits in their internal data structures. Losing this capacity at the top end has no impact on the theoretical maximum FAT32 volume size. That’s because the FAT32 volume size is capped by the 0xFFFFFFFF maximum sector count, and at 512 bytes per sector, this results in a theoretical maximum FAT32 volume size of 2TB. (While we’re on the topic of FAT32, the maximum size of a single file is 4GB, and the maximum number of files per directory is 65535.) Long before you hit the theoretical maximum volume size, you will reach the practical limits.
FAT used linear searching and threaded file allocation information in a linked list. All these linear-time data structures were acceptable when the FAT file system was developed—at a time when floppy drives were the primary storage device. Today, however, multi-gigabyte drives are the norm and these linear-time algorithms fall apart due to the large amount of disk access required to carry out a single operation. Furthermore, the high cluster count means a ridiculously large file allocation table; as a result, even the simple act of computing how much free disk space is available can take over a minute. That’s why the first time you type the dir command, there is a long pause at the end of the directory listing: the file system is busy calculating the disk free space to display at the bottom of the directory listing. (And don’t forget that Windows 95 needed to support FAT32 when running in real mode. I certainly don’t envy the engineer who had to implement the FAT32 file system in 16-bit assembly language under extremely tight memory constraints.)
At some point you have to say, "Enough is enough." After considerable discussion, 32GB was decided upon as the arbitrary cutoff point. Windows 2000 and higher offer only NTFS when formatting larger drives. Note, however, that Windows 2000 and higher will use a FAT32 drive larger than 32GB; they simply won’t create one. (For a 32GB FAT32 drive, it takes 4 megabytes of disk I/O to compute the amount of free space.)
I remember back when FAT32 was being developed, the project lead came to my office and had me read through his engineering notebook and sign and date every page. In part, this was an opportunity for me to go over his design and discuss it with him. But primarily it was to establish the date of the invention for defensive purposes.
One final note of trivia for your next geek cocktail party: the original name for FAT32 was "BigFAT".

Raymond Chen’s Web site, blogs.msdn.com/oldnewthing, deals with Windows history and Win32 programming. He can spell xerophthalmia but not accommodate.