msgoodies

ATE Schedule for TechEd Berlin

2009-11-08T20:12:00.001+01:00

I’m in Copenhagen waiting for my flight to Berlin. If you want to touch base then I have booth duty at the UC Ask-The-Experts (and Dennis ;-) area Tuesday from 15:15 – 18:15 and Friday 11:30 – 14:45.

CU there !

Code Contracts and Pex

2009-11-04T14:11:00.001+01:00

If your are coding, you should check out this Channel 9 video (11:30 minutes) where Manuel Fähndrich and Peli de Halleux show you how to specify code contracts and testing them using Pex directly in your coding environment.

Here’s a screen shot showing the Contract statements in the code and the Pex test runs below -

Happy coding

OCS Cumulative Server Update Installer

2009-11-03T23:28:00.001+01:00

One of the biggest serviceability issues with OCS 2oo7 R2 hotfixes, has been that you as an admin had a list of 17 (Seventeen – yes) different hotfixes that you had to apply to the correct server/role. This could be done by checking the 13 (Thirteen) different server roles and the list of updates that applied to them and then manually installing each and every of the necessary updates separately.

This “design issue” has now been mitigated with the “Cumulative Server Update Installer”, that basically checks each server, its roles and then suggest and applies the necessary hotfixes to your OCS Server (How hard can it be ;-).

So one installer (and one download, that contains all the hotfixes), that handles all servers/roles and it can be done either through GUI or scripted through Command Line.

You can download the installer from KB968802 that contains a list of all the updates (October Patches), a description of the process for updating and a download link.

At the download site you can download each update, but just scroll down to the download called “ServerUpdateInstaller.exe” and only download this. Do note that you should execute it from an empty folder as it extracts all the necessary updates for the relevant server role on execution (After installation has been completed it removes updates and only logs from each applied update is left).

Below is an example from ServerUpdateInstaller executed on a mediation server:

As you can see it both lists existing installed version, the new updated version and not least a link to the hotfix KB.

Do note that the July Database Update found in KB969834 isn’t installed automagically, this update has to be run manually!

Good work Microsoft (And happy updating to all of you ;-)

PowerShell V2 now Available on Older Operating Systems

2009-11-02T09:50:00.001+01:00

Now you can safely forget V1 and switch to the vastly superior V2. As of last week it is now available on -

Windows Server 2008 with Service Pack 2

Windows Server 2003 with Service Pack 2

Windows Vista with Service Pack 2

Windows Vista with Service Pack 1

Windows XP with Service Pack 3

In Windows 7 and WS08 R2 it is part of the package.

PS2 is part of Windows Management Framework which also includes WinRM and BITS4.

BTW: You need to install PowerShell 2 on server core. Read how in KB 976736.

Windows Server 2008 R2 Service and Virtual Accounts

2009-11-02T09:01:00.001+01:00

One of the best reasons for upgrading to R2, is the new account types for managing services. Changing user account passwords being used for running services, scheduled tasks and application pools are often a real pain and consequently, often being skipped. And wouldn’t it be nice if it was handled automatically like a computer account? Well, that is exactly what R2 offers.

Two new types of service accounts are available in Windows Server® 2008 R2 and Windows® 7—the managed service account and the virtual account. The managed service account is designed to provide crucial applications such as SQL Server and IIS with the isolation of their own domain accounts, while eliminating the need for an administrator to manually administer the service principal name (SPN) and credentials for these accounts. Virtual accounts in Windows Server 2008 R2 and Windows 7 are "managed local accounts" that can use a computer's credentials to access network resources.

Read the Service Accounts Step-by-Step Guide for more information.

DFS, IPv6 and – sort of – disabling it

2009-11-02T08:22:00.001+01:00

Ask the Directory Services Team has a good article on troubleshooting DFS links (DFS Referrals and IPv6: Outta site!) as well as a discussion of how not to disable IPv6 (unbinding it from an adapter) and how to do it correctly (KB929852).

In case you really need to disable IPv6, consider using a Group Policy Preference or automate it with PowerShell -

Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters DisabledComponents 0xffffffff -type dword

Useful information.

Attending TechEd Europe 2009 in Berlin

2009-10-31T19:27:00.001+01:00

Im attending TechEd Europe 2009 in Berlin as an ATE and will be arriving late Sunday, so if you want to connect then give me a ping ;-)

Two of my colleagues from Inceptio (Per Østergaard and Risto Pedersen) will also be at the TechEd and Peter Ingerslev and I is at the Interact 2009 event on Monday.

CU there !

Executing a PowerShell Pipeline from your own program

2009-10-30T09:51:00.001+01:00

In Executing PowerShell code from within your own program I showed how to execute PowerShell code, but the interface was rather rude as the value had to be converted to string and added to the script code involved. If you have lots of objects to proces, this method is inefficient – a pipeline would be much better as the script source only has to be parsed once and the script would be able to access the objects as real objects.

I have now taken it a step further and created a piece of code that can execute a pipeline. If you have lots of objects – ‘lots’ depends on the amount of memory you have available – this may not be the most efficient method. All input and output objects will be represented as List<PSObject> giving some overhead. An alternative would be to use a steppable pipeline but for now, I’ll stick to the easy method.

Here’s the code

public class PSHost
{
    private PSDataStreams _InvokePipeline(string Script,
                                          List<PSObject> inputPipeline,
                                          out Collection<PSObject> outputPipeline)
    {

        PowerShell PS = PowerShell.Create();
        PS.AddScript(Script);

        outputPipeline=PS.Invoke<PSObject>(inputPipeline);
        return PS.Streams;
    }
    private string _ConvertStreamsToString(PSDataStreams streams)
    {
        string s = "";
        foreach (DebugRecord result in PS.Streams.Debug)
        {
            s += "DEBUG: " + result.ToString();
        }
        foreach (VerboseRecord result in PS.Streams.Verbose)
        {
            s += "VERBOSE: " + result.ToString();
        }
        foreach (WarningRecord result in PS.Streams.Warning)
        {
            s += "WARNING: " + result.ToString();
        }
        foreach (ErrorRecord result in PS.Streams.Error)
        {
            s += "ERROR: " + result.ToString();
        }
        return s;

    }

    public string PSExecutePipeline(string Script,
                                    List<PSObject> inputPipeline,
                                    out Collection<PSObject> outputPipeline)
    {

        PSDataStreams ds = _InvokePipeline(Script, inputPipeline, out outputPipeline);
        return _ConvertStreamsToString(ds);
    }
}

The script must include $input to pick up the values – if any. The streams collection is returned as a string, so you can check for warning/error/verbose/debug/progress output. Parsing errors will throw an exception; you would use a try-catch to handle that. Naturally, you can change the interface to your own requirements.

Note that output objects may be real objects with properties or just simple value types. A property value can be retrieved with p.property[“propertyname”].value and a simple with p.BaseObject.

Example 1 – summing numbers

// Input pipeline
List<PSObject> numbers = new List<PSObject>();

// Add values/objects
numbers.Add(new PSObject(1));
numbers.Add(new PSObject(2));
numbers.Add(new PSObject(3));
numbers.Add(new PSObject(4));
numbers.Add(new PSObject(5));

// Output pipeline
System.Collections.ObjectModel.Collection<PSObject> outputPipeline;

PSHost psh = new PSHost();
string s = psh.PSExecutePipeline("$input | measure-object -sum", numbers, out outputPipeline);
if (string.IsNullOrEmpty(s))
{
    foreach (PSObject p in outputPipeline)
    {
       System.Diagnostics.Debug.WriteLine("Sum is " + p.Properties["Sum"].Value.ToString());
    }
}
else
{
    System.Diagnostics.Debug.WriteLine("PowerShell failed: " + s);
}

Example 2 demonstrates how to return a value type

// Re-uses the variable from example 1
List<PSObject> empty = new List<PSObject>();
s = psh.PSExecutePipeline("100", empty, out outputPipeline);
if (string.IsNullOrEmpty(s))
{
    foreach (PSObject p in outputPipeline)
    {
        if (p.BaseObject.GetType().IsValueType)
        {
            System.Diagnostics.Debug.WriteLine("Number is " + p.BaseObject.ToString());
        }
        else
        {
            System.Diagnostics.Debug.WriteLine("Number is " + p.Properties["Value"].Value.ToString());
        }
    }
}
else
{
    System.Diagnostics.Debug.WriteLine("PowerShell failed: " + s);
}

Debug output can be seen with DbgView.

Have fun

Using ILM for DMZ Account Management

2009-10-29T10:06:00.001+01:00

When you need to manage your users and group in a DMZ, it can be done in several ways. At least these methods can be used -

Autonomous. All users and groups are maintained locally in the DMZ.
Forest trust. A forest trust is constructed so the DMZ forest trust internal accounts. To restrict.
Read-only Domain Controller. A RODC is deployed in the DMZ.

Besides these, ILM can also be used and when you read the advantages/disadvantages below, you may or may not decide that ILM is the best for your environment.

Method	Advantages	Disadvantages
Autonomous	Can be totally isolated No firewall setup No information leak from internal AD	Expensive owing to added administration Distributed administration No SSO
Forest trust	Good integration with internal AD SSO with Kerberos Access to DMZ for internal AD objects can be restricted with Selective authentication	Complex firewall setup Cannot pick internal objects with GUI picker (unless you open for LDAP from non-DC) Have to change the registry to allow RDP logon on WS03. See KB 902336
Read-only domain controller	A single forest SSO Exposure can be controlled by managing what sensitive properties are on the RODC	Windows Server 2008 only Complex control of updates like DDNS Cannot limit users and groups visible
ILM	Simple firewall setup No inbound firewall rules No ILM license if you use IIFP (Enterprise Edition is required). See more below. Single place of management in the internal AD. Everything is pushed to DMZ including password changes. Helpdesk does not need access to DMZ and not even special procedures for changing properties. Full control of what object that are visible in DMZ No leak of other objects (trust cannot be queried) SSO or at least same password	Requires an extra infrastructure component SQL license (unless existing can be used) May not have full SSO to all services (re-enter password)

The seems fine, you say. I know how to do the other stuff, how complex is it to implement the ILM solution? Well, with ILM 2007 you have to create at least some code or get the code from someone who have made it (like Inceptio). But besides this, the rest is standard components. A very rough plan looks like this -

Install ILM
Install and configure PCNS on the internal AD domain controllers to capture password changes
Enable password management in ILM
Create an DMZ AD management agent, specifying it as password target
Create an internal AD management agent. Specify it as password source and the DMZ AD Management Agent as target
Create a management agent that can figure out what objects should be replicated to DMZ (use a group membership, naming convention or some other property). Let this populate an expectedDN property. If the logic is simple, it could be done in an MVExtension. In the solution I have made, I have done it using attribute-value-property files and PowerShell code.
Flow the properties you want to keep in sync from the internal AD and export them to the DMZ AD

With Forefront Identity Manager (FIM) 2010, you should be able to get rid of the coding part, making the solution more attractive. When it comes to IIFP, that is not supported anymore. Microsoft removed the download at some time but made it available again. From my sources at Microsoft, no IIFP version of FIM will be available, so you have to buy it.

Executing PowerShell code from within your own program

2009-10-26T14:31:00.001+01:00

In V2 this got a lot easier. Here’s my PSExecute function. The idea is that you send in a text value and a script. The script references the value as $_. All output from the script is returned as the result of PSExecute. Exceptions (e.g. syntax errors), errors etc. are returned as well. Depending on the usage, this may not be what you need, but you can change it yourself.

I’m planning to use this in combination with ILM. Having the ability to use a piece of PowerShell script in an advanced flow rule or in the MVExtension seems very useful.

A script could be $_.toupper() etc.

private String PSExecute(String Script, String InputValue)
{
    // Create PS outside the function if called multiple times for performance reasons
    PowerShell PS = PowerShell.Create(); 

    // The script could probably be parsed once to speed things up if the same script is used repeatably
    PS.AddScript("'" + InputValue + "' | foreach {" + Script + "}");
    String s = "";
    try
    {
    foreach (PSObject result in PS.Invoke())
    {
        s += result.ToString();
    } // End foreach.
    }
    catch (Exception e)
    {
    s += "EXCEPTION: " + e.Message; // ToString();
    // just continue
    }
    foreach (DebugRecord result in PS.Streams.Debug)
    {
    s += "DEBUG: " + result.ToString();
    }
    foreach (VerboseRecord result in PS.Streams.Verbose)
    {
    s += "VERBOSE: " + result.ToString();
    }
    foreach (WarningRecord result in PS.Streams.Warning)
    {
    s += "WARNING: " + result.ToString();
    }
    foreach (ErrorRecord result in PS.Streams.Error)
    {
    s += "ERROR: " + result.ToString();
    }

    return s;
}

If you want to try it from PowerShell first, here’s the statements -

$script='$input | fforeach {$_.toupper()}'
$script='$_.toupper()'
$ps=[System.Management.Automation.powershell]::create()
$ps.AddScript('''' + $Inputvalue + ''' | foreach {' + $script + '}')
$ps.invoke()
$ps.Streams

Have fun!

Getting PowerShell V2 SDK

2009-10-26T13:54:00.001+01:00

Messing around to find it, I’ll make it easier for you!

Unlike V1, the SDK is not a separate download, but part of Microsoft Windows SDK for Windows 7 and .NET Framework 3.5 SP1. After installing it (you can exclude the Win32 parts), add references to the relevant DLLs found in C:\Program Files\Reference Assemblies\Microsoft\WindowsPowerShell\v1.0.

Have fun

Exchange Web Services Managed API Release Candidate – Part 2

2009-10-13T13:55:00.001+02:00

Developing the every day Line Of Business Applications (LOBA) often includes handling various types of information. When dealing with custom CRM system you often need to collect and bind typed data sources together. One of these sources is often emails but of its good features i.e. handling unstructured information is also its worst. Fortunately the Exchange Server 2007 SP1 and EWS api provides us with tools and handles to enable us to structure and categorize all types of information in a Exchange Mailbox Store. When making connections between two systems some patterns always emerge. The first is you need an unique item key from the source system to store in the destination system to make a one way connection. This strategy has a flaw because when the source item is deleted you need to remove the reference key in the destination. In this case people tend to delete items though outlook and not your LOBA and outlook does not contact you LOBA to tell you have to delete the reference. So the before mentioned strategy flaw was the tight coupling of information between the source and destination.

So let me suggest another solution. Lets say you what to connect you LOBA with a item from a Exchange Mailbox. Instead of storing the Exchange Item ID in you LOBA try instead tag the Exchange Item with the item id from you LOBA you want to connect with. Then from the LOBA, search the Mailbox for items tagged with the LOBA item id. In this way when some elements has been deleted you do not end up with lost keys because the search will not return items that has been deleted. For making this work we need to handle to things: Item Extended Properties and the ability to search for these items.

Working with extended properties

To illustrate how to work with extended properties I will make use of an email object and store it in the default Innbox

   1: //Setup the request. es is an instance of ExchangeService

   2: EmailMessage em = new EmailMessage(es);

   3: em.Subject = "Hello World!";

   4: em.Body = "Your base belongs to us!";

   5: //Creating the Extended property CustomerID as a type of string

   6: ExtendedPropertyDefinition epd = new ExtendedPropertyDefinition(DefaultExtendedPropertySet.Common, "CustomerID", MapiPropertyType.String);

   7: //Give the property a value and assigning it to the email

   8: em.SetExtendedProperty(epd, "1234");

   9: // Store the message in the inbox

  10: em.Save(WellKnownFolderName.Inbox);

Searching form Extended Properties

   1: //Defining a view/windows into the search result.

   2: ItemView view = new ItemView(50);

   3: //Telling that i am only interested in the id of the item.

   4: view.PropertySet = new PropertySet(BasePropertySet.IdOnly);

   5: //Creating a extended property definition to search for.

   6: ExtendedPropertyDefinition epdCustomerID = new ExtendedPropertyDefinition(DefaultExtendedPropertySet.Common, "CustomerID", MapiPropertyType.String);

7:

   8: //Variable for storing the searchresult

   9: FindItemsResults<Item> foundItems;

10:

  11: do

  12: {

  13:     //Search the inbox for at item with a extended property value stet to 1234

  14:     foundItems = es.FindItems(WellKnownFolderName.Inbox, new SearchFilter.IsEqualTo(epdCustomerID, "1234"), view);

  15:     foreach (Item current in foundItems)

  16:     {

  17:         //Getting the email message from the Exchange Service via the item id.

  18:         EmailMessage email = EmailMessage.Bind(es, current.Id) ;

  19:         Console.WriteLine("Message found. Subject: {0} - Body: {1}", email.Subject, email.Body);

  20:     }

  21:     //Offset the index of the view/windows with 50. This gives the ablity to page through larger resulset.

  22:     view.Offset += 50;

  23:     //while there more result available...

  24: } while (foundItems.MoreAvailable);

Other cool things

The item id can still be very valuable for your LOBA. If you store the id in you LOBA you can always find the item again even if a user decides to move the message to another folder. By using the EmailMessage.Bind method with the item id you will always get the message returned. Same thing goes for folders they also have a id. So even if the users decide to reorganize the folders with the folder id you can still find the folder again.

Exchange Web Services Managed API Release Candidate – Part 1

2009-10-06T08:40:00.001+02:00

For some time now developers have been able to access Exchange Server 2007 via Exchange Web Services(EWS). To get this working you basically added a webreference in Visual Studio and constructed a request pending upon the type of function you wanted to execute. EWS was a great step away from the various message api(CDO, MAPI, WebDaV) which had their own strength and weakness. But still EWS can be laborious and you often end up building your own stub upon the EWS webreference. Through my teaching of Developing for Microsoft Unified Communications R2 i got to know a new API called Exchange Web Services Managed API. In short this is the way – this is the api for programming for Exchange Server 2007 with sp1. In the next few blogs I will run through some of the basics for this new API. As a first sending a email would be a place to start.

Sending email with EWS(c#)

   1: // Setup the request

   2: MessageType emailMessage = new MessageType();

3:

   4: // Set the To email address

   5: emailMessage.ToRecipients = new EmailAddressType[1];

   6: emailMessage.ToRecipients[0] = new EmailAddressType();

   7: emailMessage.ToRecipients[0].EmailAddress = "email@receiver.somewhere";

8:

   9: // Set the From email address

  10: emailMessage.From = new SingleRecipientType();

  11: emailMessage.From.Item = new EmailAddressType();

  12: emailMessage.From.Item.EmailAddress = "email@sender.somewhere";

13:

  14: // Set the Subject

  15: emailMessage.Subject = this.textBoxSubject.Text;

16:

  17: // Set the Body

  18: emailMessage.Body = new BodyType();

  19: emailMessage.Body.BodyType1 = BodyTypeType.Text;

  20: emailMessage.Body.Value = "Something to write about";

21:

22:

  23: // Create request object and set properties

24:

  25: // Create the CreateItemType in order to create and send the email

  26: CreateItemType request = new CreateItemType();

  27: request.Items = new NonEmptyArrayOfAllItemsType();

  28: request.Items.Items = new ItemType[1];

  29: request.Items.Items[0] = emailMessage;

  30: request.MessageDisposition = MessageDispositionType.SendAndSaveCopy;

  31: request.MessageDispositionSpecified = true;

32:

33:

  34: // Call CreateItem and process response

35:

  36: // Finally, call the CreateItem method to create and send the email

  37: CreateItemResponseType response = _service.CreateItem(request);

38:

  39: // Analyze the response message for success/failure

  40: ItemInfoResponseMessageType responseMessage = response.ResponseMessages.Items[0] as ItemInfoResponseMessageType;

41:

  42: if (responseMessage.ResponseClass == ResponseClassType.Success)

  43: success = true;

44:

  45: MessageBox.Show("Email send succeeded: " + success);

Sending email with EWS Managed API(c#)

   1: //Creating service binding for a Exchange Server 2007

   2: ExchangeService es = new ExchangeService(ExchangeVersion.Exchange2007_SP1);

3:

   4: //Assigning credentials for accessing the sender account

   5: es.Credentials = new System.Net.NetworkCredential("sender@email.somewhere", "SuperSecret#1");

6:

   7: //using autodiscover to find righ Exchange From End

   8: es.AutodiscoverUrl("pli@inceptio.dk");

9:

  10: //Creating a email message

  11: EmailMessage em = new EmailMessage(es);

  12: em.Subject = "Hello World!";

  13: em.Body = "Using EWS Managed API";

  14: em.ToRecipients.Add("receiver@emai.somewhere");

  15: em.SendAndSaveCopy();

Using a PS Session without having Administrative Permissions

2009-09-19T23:03:00.001+02:00

One of the great features of PowerShell V2 is the remote session support. But in the default configuration only local administrators can create a remote session. This is what a normal user sees -

This is how you delegate the feature to other users – the easy way.

First, create a local group and insert the user(s)

net localgroup "PowerShell Session Users" /add
net localgroup "PowerShell Session Users" the-user /add

Second, execute this command to bring up the permissions GUI

Set-PSSessionConfiguration microsoft.powershell -ShowSecurityDescriptorUI

add the group and grant execute (invoke) permissions -

Note that you have to restart the service -

And finally, try it out.

Let me draw your attention to two things in the picture above. First, the remote command is executed by a wsmprovhost process and second, extra properties are returned even though only the processname was selected. The extra properties are useful if you execute command on multiple sessions. In this way, you can recognize the returned objects.

Interesting post on Early Media and Windows 2008 Firewall

2009-09-11T23:40:00.001+02:00

Jeff Nye posted an interesting gotcha with the Windows 2008 Firewall blocking Early Media. Find his elaborate version of the problem/solution here and the original post in French here.

Getting Communicator Mobile 2007 R2 running on Nokia S40/S60 devices

2009-09-08T11:38:00.014+02:00

As the current documentation for the Office Communicator Mobile 2007 R2 client for Java (used by Nokia S40 and S60 devices, among others) is a bit sparse in regards to client setup, I thought I would share this with you.

As you are probably aware, CoMo R2 for Java utilizes components from the Communicator Web Access server, but the thing you need to be aware of is this:

The Server Address (URL) that you enter when configuring the client on your mobile device has to point to the Communicator Web Access URL, not the Access Edge (typically sip.domain...)

Thus, if you need to support Java clients using CoMo R2, you need your CWA published externally through a reverse proxy (ISA/TMG recommended) - and those clients need to input a different URL than the Windows Mobile CoMo R2 clients (which use the Access Edge URL).

Hopefully, this will be spelled out in more detail in the documentation in a future revision.

Whitepaper on Deploying Certificates in OCS 2007 and OCS 2007 R2

2009-08-28T23:50:00.000+02:00

One of the areas where the learning curve for OCS has been very steep is in the area of certificates. This has partly been due to lack of a single coherent OCS related certificate documentation and the fact that using certificates with SSL and TLS are two different species.

Rick Kingslan, with the help of a series of excellent people, has now created a whitepaper called “Deploying Certificates in Office Communications Server 2007 and Office Communications Server 2007 R2”. This whitepaper includes links to learning resources for the basics of certificates/PKI, but more importantly very specific OCS 2007 / R2 deployment information (and command lines) and it is certainly worth a read (95 pages of good technical info).

Should I try a VoIP call using this (Wireless/Hotel?) network ?

2009-08-21T20:33:00.002+02:00

The OCS 2007 R2 Reskit provides a Pre-Call Network Diagnostic Tool that can be used for both continuous monitoring from e.g. a machine that has recurring voice quality problems or just as a one time check of that home/hotel/conference wireless network before making a call.

After installation of the OCS 2007 R2 ResKit go to %ProgramFiles%\Microsoft Office Communications Server 2007 R2\Reskit\PreCallDiagTool and launch PCDSetup.exe (Or copy the directory to a shared network drive).

The tool willl require .NET Framework 3.5 Sp1 and will prompt the user to install it.

After installation start PreCallDiagnostics with elevated privileges (note - this may only be required the first time) and insert your SIP URI.

Note that the tool can be started on Windows startup and that it does keep a log over time of network connection quality.

After restarting click “Start media network monitoring” and you will see this screen (After collecting data for a while)

After tool has established connectivity with your R2 Media Relay server it will display 1-4 “bars” of quality in the main window.

It will give you important information like the Network MOS, Packet Loss Rate and not least Jitter and will continue monitoring until stopped. It uses very little bandwidth (approx 5 kbps) and CPU resources.

This is a nice little troubleshooting tool both for personal use and for use at customers where a Monitoring server isn’t readily available.

R2 Edge Servers on WS08 and Update Root Certificates issue

2009-08-20T21:23:00.001+02:00

We have encountered an issue with R2 Edge and the Windows Server 2008 feature called “Update Root Certificates feature” which is enabled by default (and apparently not used by R2). Below is a detailed description of the problem provided by my colleague Lars Sørensen from Inceptio A/S.

First a little update on on the “Update Root Certificates feature” in Windows Server 2008

The feature is designed to automatically check the list of trusted authorities on the Windows Update Web site when this check is needed by an application on the server. Specifically, if the application is presented with a certificate issued by a certification authority in a PKI that is not directly trusted, the Update Root Certificates feature will contact the Windows Update Web site to see if Microsoft has added the certificate of the root CA to its list of trusted root certificates. If the CA has been added to the Microsoft list of trusted authorities, its certificate will automatically be added to the set of trusted root certificates on the server.

Why am I telling you this, well recently I did an Office Communications Server 2007 R2 implementation with the Edge role. The certificates on the external interfaces on the Edge server is from Digicert, which are member of the Microsoft root certificate program KB931125.

Everything is working fine, except for federation. So I did a little troubleshooting and found out that the reason for the federation not working was a certificate issue, not on the customer installation, but on the federated partners Edge server. In this case our own Edge server. In the Event Log I found the following errors :

So I checked the Certificate Store on our Edge server and could conclude that the root certificate for Digicert wasn’t there. I downloaded and installed the root certificate from http://www.digicert.com/digicert-root-certificates.htm and tested the federation again, and the federation between the customer Edge server and our Edge server was now working as expected.

So why wasn’t the root certificate for Digicert downloaded by the “Update Root Certificates feature”. So I deleted the root certificate from Digicert from our Edge server and did a test from http://www.digicert.com/digicert-root-certificates.htm. This is a link where you can test the browser for the root certificate.

When doing this test the following appears in the Event Log as expected.

This confirms that the Update Root Certificates feature has downloaded and installed the Digicert root certificate from Windows Update. To make sure that the Digicert certificate I used on the customers edge server, was working correctly, I created a web site and assigned the Digicert certificate to that web site. Created a host entry on our own Edge server, that pointed to that website, and then tried to access this web site to see if the root certificate for Digicert was downloaded, and it was.

So far my conclusion is, it seems that the Office Communications Server 2007 R2 Edge role doesn’t trigger the Update Root Certificates feature to download the root certificate.

All testing has been done on Windows Server 2008 SP2 and fully updated from Windows Update, and OCS 2007 R2 also fully updated from Windows Update. I don’t know if the problem also occur on Windows Server 2003.

If anyone has seen similar issues please leave your comments here.

Updates to Communicator Mobile available

2009-08-20T21:04:00.001+02:00

Just in case you haven’t seen then there is a new update for Communicator Mobile that include some nice new features (Including support for WM 6.5).

Furthermore there is now support not logging on when using roaming networks(Which is nice when you’re in the US and Roaming data costs 12$/MB !!).

Find the update at getcomo.com (Directly from your mobile) at the Download Center and/or read more about the feautres at the Communicator team blog Communicator Mobile Just Got Better.

Tandberg / OCS integration suddenly not working?

2009-08-20T01:47:00.001+02:00

Just a quick note. If you have problems with your Tandberg not working then it may be caused by security update in KB968389. This update provides a new feature called “Extended Protection for Authentication” and when installed (and enabled) it breaks Tandberg functionality.

Current “solution” is to disable the Extended Protection for Authentication, but I will get back with an updated/elaborated posting if a solution is found.

Microsoft Exchange 2010 RC RTW’ed

2009-08-18T23:38:00.002+02:00

and the link is now working ;-) There are a lot of interesting features in this product. I especially like the enhanced OCS integration (Including those Outlook 2010 introduces) and of course the language support (Now supporting Danish).

Anyway here is the link for the download !

OCS 2007 R2 Web Scheduler RTW’ed

2009-08-16T05:02:00.001+02:00

The OCS 2007 R2 Web Scheduler that was originally going to be part of the R2 ResKit has now been Released To Web and can be found here.

This is good news for those of us who are running 64-bit Office 2010 as the Live Meeting add-in doesn’t support 64-bit yet :-|

Here’s a snippet from the download page -

Web Scheduler is a 64-bit tool for Microsoft Office Communications Server 2007 R2. It provides a Web-based alternative to the add-in for the Microsoft Outlook messaging and collaboration client for the purpose of scheduling a meeting using Office Communications Server 2007 R2. It also provides a browser-based conference management experience that includes operations such as:

Scheduling a new Live Meeting conference or conference call.
Viewing and modifying details of an existing conference.
Listing all existing user schedules of a Microsoft Office conference.
Deleting an existing conference.
Sending an e-mail invitation to conference participants by using a configured SMTP mail server.
Joining an existing conference.

Happy installing !

Fiddler Web Debugger - A free web debugging tool

2009-07-30T17:14:00.001+02:00

What is Fiddler?

Fiddler is a Web Debugging Proxy which logs all HTTP(S) traffic between your computer and the Internet. Fiddler allows you to inspect all HTTP(S) traffic, set breakpoints, and "fiddle" with incoming or outgoing data. Fiddler includes a powerful event-based scripting subsystem, and can be extended using any .NET language.

Fiddler is freeware and can debug traffic from virtually any application, including Internet Explorer, Mozilla Firefox, Opera, and thousands more.

Came across this tool today, and I’m quite impressed.

Watch the videos! I’ve been looking for a tool like this for long.

A warning: You have to stretch you security if you want to monitor Outlook traffic, as Outlook requires a valid certificate. Read more here.

A useful Test-Host Function

2009-07-30T08:56:00.001+02:00

BS on Posh (tshell) have created a Test-Host function that is very useful. I have written some of these functions myself, but this beats the ones I have made, so I’ll switch :)

Test-Host supports normal ping but as ping is not always sufficient - may be blocked or you may have to wait for a service to be ready (who said RDP?) - TCP port is also supported. Finally, Test-Host accepts the server name as argument or from the pipeline (using V2 parameter binding) and it even allows you to specify a property, in case the server name is part of the object.

Test-Host sends the server argument down the pipeline, if that server is reachable. In this way, Test-Host acts more like a filter than a classic Test-Cmdlet. Maybe it could have been called Where-HostReachable or similar?

Another comment I have, is that the server argument should have been called ComputerName (to follow other Cmdlets). To make the function more flexible, alternative names like server and name could have been specified with [Alias()]. A quick fix here is to add ComputerName and Name as aliases: [Alias("ComputerName","Name")] Place the text before the $server parameter.

I also found a bug in the code. You have to remove the [string] before the $server to be able to use $property. If server is forced into a string, the properties are lost and thus cannot be selected.

Some examples of it use -

Ping test (not reachable)
PS> test-host www.dr.dk 

TCP port 80 test (reachable)
PS> test-host www.dr.dk -tcp 80
www.dr.dk 

Ping test (reachable)
PS> test-host www.jp.dk
www.jp.dk 

Ping test (not reachable)
PS> test-host 1.2.3.4 

TCP port 80 test (reachable)
PS> test-host 1.2.3.4 -tcp 80 

Pipe names
PS> "www.dr.dk","www.jp.dk" | test-host -tcp 80 | foreach {"Web server runs on $_"}
Web server runs on www.dr.dk
Web server runs on www.jp.dk 

Pipe names, one not reachable
PS> "www.dr.dk","www.jp.dk","nosuchserver" | test-host -tcp 80 | foreach {"Web server runs on $_"}
Web server runs on www.dr.dk
Web server runs on www.jp.dk 

Build objects array with two servers
PS> $objs=@() 
PS> $obj="" | select Server,Role; $obj.server="www.dr.dk"; $obj.role="webserver"; $objs+=$obj 
PS> $obj="" | select Server,Role; $obj.server="nosuchserver"; $obj.role="mailserver"; $objs+=$obj 
PS> $objs 

Server                                                    Role                                                     
------                                                    ----                                                     
www.dr.dk                                                 webserver                                                
nosuchserver                                              mailserver                                               

Test, selecting the Server property as the name
PS> $objs | test-host -tcp 80 -property Server | foreach {"Server $_ is running"}
Server @{Server=www.dr.dk; Role=webserver} is running

Test, constructing a ComputerName property to show the alias parameter binding
PS> $objs | select @{n="Computername";e={$_.server}} | test-host -tcp 80 -property ComputerName| foreach {"Server $_ is running"}
Server @{Computername=www.dr.dk} is running