Infrastructure planning and design guide for DirectAccess

The Infrastructure planning and design guide for DirectAccess has just been RTM:ed and can be downloaded from http://go.microsoft.com/fwlink/?LinkId=164151. If you’re planning on implementing DirectAccess read this document! ;)

AppLocker does NOT require a Windows Server 2008 R2 DC

Documentation from Microsoft regarding the new feature AppLocker in Windows 7 (and Windows Server 2008 R2) early stated that to be able to use AppLocker you must have a “Windows Server 2008 R2 Domain Controller to host the AppLocker rules”. I have seen this information several times since then and at a seminar I payed a quick visit to yesterday regarding Windows 7 this particular questions was raised.

Of course I had to make sure what’s really going on here and I have now verified that AppLocker works perfectly fine in environments where there are only Windows Server 2003 DCs or Windows Server 2008 DCs. I can see no reason what so ever for AppLocker to require a Windows Server 2008 R2 DC to function. The only requirement is that you’re running Windows 7 Enterprise or Windows 7 Ultimate edition to be able to use th powerful feature of AppLocker.

Antivirus software slowing down RDP sessions via TS/RDS Gateway

We saw an interesting issue with connecting via Remote Desktop from a Windows client to another machine using Remote Desktop Services in Windows Server 2008 R2. After doing some troubleshooting it turned out to be ESET NOD32 version 4 that caused the extreme slowdown. The work around is to turn off ”HTTPS filtering” in the NOD console.

Hotfix saves power on AMD CPU:s for Windows Vista, 7 and Server 2008 R2

Microsoft have just released a hotfix for Windows Vista, Windows 7 and Windows Server 2008 R2 that potentially can reduce CPU power consumption by ten percent for AMD processors, specifically ones supporting the power state C1E. This includes popular CPUs such as AMD Phenom and Athlon range of CPUs.

The hotfix can only be obtained by contacting PSS (Product Support Services) or by requesting it for instant download via the KB article below.

KB974090: An update is available that allows for a potential power saving in an AMD multicore processor that is running an x64-based version of Windows Vista SP2, of Windows Server 2008 SP2, of Windows 7, or of Windows Server 2008 R2

Active Directory Administrative Center makes you do things in fewer steps

A new tool in Windows Server 2008 R2 that you must not miss is the Active Directory Administrative Center. The tool is far from the speediest to load but once you’ve got it started I promise you that you will find it very convenient to use for account and other Active Directory object management. As with the user interface, new search tools and more in Windows 7 the Active Direcory Administrative Center in Windows Server 2008 R2 makes you do things in fewer steps and eases your daily work!

Be aware of a problem when renaming domain controllers

If you have renamed a Windows Server 2008 or Windows Server 2008 R2 domain controller you should be aware of  a problem. The problem is that a DFSR object is not renamed to the new name. This does not cause any problems until you remove the domain controller in question and after doing a demote or cleaning it up with metadata cleanup the object will become orphaned. So if you have renamed 2008 or 2008 R2 DCs you should follow the steps in KB2001271 to fix this.

When to troubleshoot blue screen crashes

The other day I got an email from a blog reader which contained the information of a successful analyze of a memory dump file which is generated when an infamous blue screen of death occur. The reader wanted me to give him the solution or point him in the direction of a solution. This got me into thinking. When is it worth putting time on doing blue screen analyzes?

The content of the crash dump is maybe not that relevant after all. What is more important is how often and when the blue screen of death occurs. If the crash occurred just once or very seldom and randomly I would say that it might not be worth finding out exactly what caused the crash. Keep in mind that a blue screen could indicate a hardware failure, although driver problems are the most common cause for crashes.

However if the crashes occur often or at when doing specific tasks you have all the reasons in the world to get to the bottom of the problem. In these cases I recommend following the guide for troubleshooting blue screen crashes.

An interesting thing to note about blue screens that start occurring after for instance upgrading the OS from Windows XP to Windows Vista or Windows 7 is that the new memory management in the later operating systems might reveal problems in the memory modules that did not show when using Windows XP.

Finally, whenever having problem with blue screens of death I would recommend upgrading the machine BIOS. Often there are compatibility and stability fixes which solves problems with hardware which might be causing you the problems you are experiencing.

WEBSPAPW = Microsoft IT Environment Health Scanner

I guess you’re wondering what the heck “WEBSPAPW” stands for and it is nothing but “Windows Essential Business Server Preparation and Planning Wizards”. Microsoft has now come to the conclusion that this tool as I’ve written before was not only used for EBS migrations but also for general health checks in Active Directory environments. This has resulted in the name change to “Microsoft IT Environment Health Scanner” which is built from the previous EBS tool.

When running the Microsoft IT Environment Health Scanner you may find problems related to AD, DNS, replication and many other things and for everyone in charge of or controlling the IT environment this tool is strongly recommended. Read more on the EBS Blog.

Download: Microsoft IT Environment Health Scanner

Install Windows client and server without product key

I just want to share a quick tip about something really smooth that many IT staff seems to be unaware of. Windows Vista and Windows Server 2008 introduced the fact that you can install it without entering a product key. This was later introduced in Windows XP (with service pack 3 slipstreamed) and also later Windows Server 2003 R2 media. Nothing about this changes for Windows 7 or Windows Server 2008 R2. So to sum it up you can install all current as well as coming operating systems without entering a product key and you will then have up to 30 days to enter it.

Restore permissions on objects in Active Directory

Some time ago I had the unfortunate job to do some manual cleaning of an old and since long disconnected (and not decommissioned) Exchange Server in Active Directory using adsiedit.msc and this is not something one want to do I can promise you. Anyway during the testing phase I had to make sure that certain keys and values in adsiedit.msc were safe to be deleted and to accomplish this I removed all permissions on the keys to make sure that no one could read the information. You might think that restoring the permissions on objects in adsiedit.msc is the same as the management with file and folders but that is not the fact.

Instead use the command DSACLS to control the access control lists of Active Directory objects and run for example the following command to let the group Everyone get full permission on the object “First administrative group”.

DSACLS "CN=First Administrative Group,CN=Administrative groups,CN=CONTOSO,
CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=CONTOSO,DC=LOCAL"
/G Everyone:GA

Beware when working in adsiedit.msc and be very certain about what you are doing before deleting stuff. Sometimes just removing all permissions on objects is the best way because then you can always use the above command to restore permission to the object(s).