We had some trouble with users not being able to sync their mail, contacts and calendar to their mobile phone. The configuration works but when the synchronization starts we get a entry in the local log “Error in Exchange Server”.

Checking the logs on the Client Access server pointed me to look at permissions and it seems like some accounts have disabled the inherited security rights. This is the problem since Exchange can’t access the account information.

To check this you use Active Directory Users and Computers and open the user in question. Open the Security tab and press Advanced. On the open window you should se the “Include inheritable permissions from this object’s parent”. If it’s not selected your Active sync will fail.

Hope this shortens someone’s troubleshooting session.

We are currently in the process of setting up our new Exchange 2010 environment and I was looking for a certificate supplier that doesn’t require you to pay an arm and an leg for a certificate.

When you set up your Exchange server to use auto discovery and other services you probably won’t run everything on autodiscovery.domain.com. So you need a certificate with Subject Alternative Names or SAN. Also called Unified Communications Certificates or UCC.

You could buy them from Verisign or Thawte or any of the ones Microsoft currently supports, which is three suppliers you can find them here http://support.microsoft.com/kb/929395

Anyway, I wanted a simple certificate to encrypt the traffic between the server and the client and to be able to use auto discovery without any error messages for the users about untrusted certificates. Using AD-CS will remove the problem from the normal Active Directory computers but not mobile devices not belonging to the domain. So googling around I found this supplier and decided to post it here for future reference and so you can save a few bucks on the certificates. The supplier is http://certificatesforexchange.com/

Checking their prices today a multiple domain certificate costs 59,99$/year. And believe me that’s cheap.

One of the more important tools I use in my day to day work is Virtual PC. To be honest I’ve been looking at VMware Workstation for a while because Virtual PC 2007 doesn’t support 64-bit guest operating systems. But that’s another story. Right now I manage with what I’ve got.

Why a virtual environment?

This might be the first question. Well it saves time and money. I can test different products and deployments without using a full expensive test lab. The virtual systems can’t replicate every possible scenario but I’ve managed fine so far.

You can’t test disk encryption and that’s to bad but almost anything else is possible without making changes to your production environment.

How to setup the environment

First of all you should create a few master images so you will be able to copy in servers and clients when you need new ones. This is simply done by installing a copy of Windows Server 2008, Windows 7 or any other system you might need in the future. I personally keep master images of

• Windows Server 2008 32-bit
• Windows Server 2003 R2 32-bit
• Windows 7 32-bit
• Windows XP Pro 32-bit

So if you need all of them you need to start installing. Just install the basic OS, install all/any tools you like to use. Maybe you even want install the Office suite. Another tool collection I suggest you install is the Sysinternals Suite. After you have installed all the basic Operating systems we need to Sysprep them so they can be used again and again without any collisions on SID:s etc.

Using Sysprep

After you have everything installed you need to sysprep your installation and let the guest operating system shut down so you can copy the virtual hard disk (.vhd) file. Sysprep has been integrated in Windows Vista and newer, XP and 2003 has the files on the installation media in the folder <DRIVE>:\Support\Tools\Deploy.cab . In Vista and newer you can find sysprep in the folder C:\Windows\System32\sysprep.

For Windows Server 2008 and Vista you need to install the Virtual Machine Addons to get it running smoothly and you really want them to be left alone by sysprep. After all we are running sysprep to get our master images for Virtual PC.

So to keep your Virtual Machine Additions in the image you need to create a sysprep.xml file in the sysprep folder. If you want to you can place anything in the Sysprep file but this is needed to keep the Virtual Machine additions for the next boot.

<unattend xmlns="urn:schemas-microsoft-com:unattend" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
   <settings pass="generalize">
      <component name="Microsoft-Windows-PnpSysprep" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" processorArchitecture="x86">
         <PersistAllDeviceInstalls>true</PersistAllDeviceInstalls>
      </component>
   </settings>
</unattend>

Once you have the file saved in the C:\Windows\System32\Sysprep directory just run from the command prompt.

sysprep /generalize /unattend:sysprep.xml

After the computer shuts down you can move the .vhd file to a storage directory and name it something like Ws2008-master.vhd.

Windows 7 has a greatly improved support to run as a virtual machine so I’ve never had to install any of the additions on a Windows 7 image.

The result

The next time you need to “install” a new virtual Server or client just copy the .vhd file to another location and rename it. Create a new virtual machine and point it to the newly copied .vhd file. Boot the server or client and you’re done. Easy, fast and great for testing.

Virtual PC wants to store everything in your home folder but I like to keep my virtual machines in the root of a drive. So I know where to find them.

D:\VMS to keep the vmc files
D:\VMS\VHD to keep the .vhd files in use, not the master images
D:\VMS\Master to keep the master .vhd files
D:\VMS\ISOS to store any ISO files I might need.

You should set it up the way you like it but for me that keeps it in order and I know where to look for my files.

If you have any questions feel free to comment and I’ll answer anything I can.

I’ve been working on a new theme for the site for almost six months now. When you only have a few hours a week to work on it it takes some time. The theme should be easier to read than the previous one and most of the readers I have read to solve some problem. Due to that fact the reading should be easy.

There are still parts that are in development, like most of the forms and the search. But it should be functional and as I said, easier on the eyes when reading.

I’m also considering to make printing to PDF available so you can save some of the information on your local resources.

Hope the new look is satisfactory to everyone reading.

I’ve been setting up SCCM 2007 at work and the Primary site is working fine so I decided to deploy the first of many secondary sites. I pushed the install from our Primary Site server and added it to the Local Administrators group on the secondary site server to be. The installation went fine, or at least it looked like it did. I noticed I had forgot to set the Secondary Site server in the SMS_SiteSystemToSiteServerConnection_XXX group on the primary site server so the Secondary site wasn’t able to write to the inbox of the Primary site server. This resulted in the secondary site hanging at PENDING. And fixing it took some searching, after about 4 hours of searching I decided that when I find a solution I’m going to post it so no one  else has to go trough the same trouble.

Fixing the Pending issue

The solution is really simple. Since the secondary site wasn’t able to report it was done and the settings applied I had to find a way to get them to the primary site server. Apparently this is done at install and it won’t try it again. So just log in on your Secondary Site server, copy the file <ConfigMgrInstallPath>\inboxes\sitectrl.box\SiteCtrl.ct0 file to a temporary location (C:\Temp!?) and rename it to 00000000.ct2. When that’s done copy the renamed file to your Primary Site Server <ConfigMgrInstallPath>\inboxes\hman.box\ wait a second and your secondary site will be online. The solution was really easy but it was really hard to find so I’m hoping this will make someone’s day a little better.

Just watched Twit.tv live from Apples event. I knew long before the event I would not be exited about the tablet and I’m still not convinced of the success for the iPad. I can’t see where this thing fits in the market. The price is ranging from USD 499 to USD 829. It’s nearly as expensive as a MacBook or a MacBook Pro 13″.

Apple seems to think it will revolutionize press and save newspapers and the book industry. I have my doubts here. As a long time computer user I still PRINT every document that’s longer than 10 pages I have to or want to read. The screen just isn’t as good for reading as paper. Books wont do well on a iPad for me as I do most my reading in bed where a book is far better than an tablet.

It will however be a great device to watch a movie on while on a train or for taking notes in a meeting. But and this is a big but, if I already have a laptop why would I put out the extra money for the tablet.

It still doesn’t do flash, and like it or not flash is something we have to support today. It’s also as restricted as the iPhone and that’s to bad. I would have liked to see more OSX and less iPhone OS in this device. I like to be able to at least change some settings on my devices.

On the positive side it is able to run all the iPhone’s applications so even before the release it has over 140 000 applications and that’s great. Still I don’t see the value of this device if you already have a laptop and a smartphone. Some think it would be great for users reading email and browsing the web but most of them will want to store their pictures locally and do some editing on the pictures. The 800USD version has 64Gb space so it might be usable for this but then cough up a little bit more and you can have a Apple laptop, go for PC:s and you’ll get one much cheaper. The 500USD version has 16Gb so that’s just to small for any real use and to pay 500USD for a book reader, well that’s to much.

Before I pass any final judgment I will go take a look at it when it hit’s the stores in Finland I’ll give it a fair chance even if my first impressions weren’t that great.

Finally the Google Chrome browser is out for OSX. I’ve been using it on and off in Windows 7 for a few months and now I can finally start using it in my Mac’s also. A big thank’s to the Chrome team for getting it out.
It’s still a beta but works like a charm in OS X 10.5. Go get your’s from http://www.google.com/chrome

I got a new HP Z400 Workstation to my office today and decided to recycle the old DC5800 to someone who needs a trusty workhorse and doesn’t work with memory intensive tasks like Virtual Systems like I do. Even if my old desktop was getting a new life I still wanted to keep it because I’ve installed many tools on it I still use and I like to do some Group policy testing on it.

I found the great tool Disk2VHD by Sysinternals. It converts your physical disk to a VHD file so you can use it in Virtual PC or some other virtualization software that supports Microsoft’s VHD format. Disk2VHD homepage http://technet.microsoft.com/en-us/sysinternals/ee656415.aspx

Before you start this you may want to make a backup of your VHD file in case something goes wrong.

Shrinking the VHD for Virtual PC

So I captured my old hard drive and moved it to my new workstation. The file was only 80Gb as Disk2VHD makes it a dynamically expanding disk. Everything looks fine so far. The problem is that Virtual PC only supports 127Gb drives or smaller and my physical drive was 250Gb so booting the drive in Virtual PC didn’t work. I had to get it resized to under 127Gb to get it booting. Googling around I found a few tools but none of them worked the way I needed them to. I had to get my drive size under 127Gb. Some researching later I found that the computer management console, disk management, in Windows 7 was able to mount and shrink my VHD. So fingers crossed I started compmgmt.msc and mounted the drive.

Right clicking on Disk Management and selecting attach Virtual Hard disk worked like a charm. So now let’s shrink the drive. Select your drive from the list and right click selecting Shrink.

After the query is done it will tell you how much it will be able to shrink the volume. If it’s still over 127Gb you can activate the drive in Computer Management and go delete some files. I had a lot of downloaded files I had to delete before I could get it to shrink under 127Gb. When the shrink operation is done we still have to shrink the vhd file. This just made our Windows partition smaller and now we want to get rid of the unused partition from the VHD file to get it under the magic 127Gb line.

VHDResizer to the rescue

All you need to do now is get the software vhdresizer and have it resize your vhd. You can get VHDResizer from http://vmtoolkit.com/files/folders/converters/entry87.aspx

Still no roses

I was hoping this would be the end of the journey and I would be able to boot the system. You could try it at this point but for some reason my system wont boot. I booted into the XP setup and ran FIXBOOT and FIXMBR and the system still won’t boot. So next I tried an Repair install. Victory!

The repair install fixed any issues but I’m tempted to go trough the same again to check where this really fails. I’m sure you can do this without the repair install.

But the result is the same, I have my old desktop OS back and can use the tools when I need to and I didn’t have to reinstall from scratch. If anyone else has had the same problems and solved them without repair install I would be curious to know what you did.

I’ve seen this question come up on discussion forums and other support resources a lot since the release of Vista. Many organizations still use Windows Server 2003 to serve users print services. And the need to upgrade isn’t really behind the corner yet. I know, I feel the same. We still use a Windows Server 2003 R2 as a print server and it it 32-bit, not 64-bit.

Can a 32-bit server handle 64-bit drivers

Short answer, yes. The server uses it’s own 32-bit driver as a interpreter between the spooler and the printer but it can serve clients with the drivers they need. The server really doesn’t care if the drivers it serves to clients are 32 or 64 bit. It can store all of them on the filesystem.

How do I install the drivers?

I’ve been using Windows 7 RSAT(Remote Server Administration tools) to add the drivers to our print server. The important step is to upgrade your current 32-bit drivers. If the driver versions of the 32 and 64 bit differ the server wont recognize them as the same driver. So if you’re using old drivers on your server I’m sorry to say you’ll have to start by upgrading the 32-bit ones first. I suggest you download both the 32-bit and the 64-bit version of the driver when you’re out driver hunting. First upgrade the 32-bit drivers you want to add 64-bit drivers for. I did this directly on the print server and I removed any old versions of the driver. Next add the 64-bit driver. Adding drivers from RSAT is really simple so I won’t go trough it in any detail. Just open Print Manager

Right click drivers and select add driver, add your 64-bit driver. As you can see in the image booth Toshiba drivers have the same version number, the difference is only the Environment.

Group policy edits for Windows 7

Next we’re going to create a group policy to allow restricted users to install their drivers, and we don’t want UAC to disturb or scare them. Side note: if you’re thinking of disabling UAC take a look at a previous article here http://www.nixadmins.net/2009/12/04/why-uac-is-the-best-thing-that-ever-happened-to-windows/ .

Open your Group policy management console and create a new / or add these settings to an old policy. You’ll find the setting under Computer Configuration \ Policies \ Administrative templates \ Printers \ Point and Print Restrictions.

Set the policy to Enabled and set the Security prompts Do not show warning or elevation prompt.

Push the group policy setting to your clients, point to your printer and you’ll be able to install it as a normal user.

You’ve probably heard, countless times, why the Windows UAC (User Access Control) is the worst function ever introduced in a Windows operating system. Today we’ll look at it from another point of view. I’m saying it’s the best function introduced in Vista and later. Why? Because it makes it easy to elevate your privileges without holding down the right CTRL button or looking for it in any menu. How? I’ll show you in a minute.

Using any operating system with administrative privileges is a bad idea. It doesn’t matter if your running OS X, Windows, Linux or something else. If you’re running your day to day tasks as an administrator(root) you’re not thinking straight. You should be using as little privileges as possible to get the job done, and here UAC does a beautiful job stepping in as a bridge into administrator land.

I run my Windows 7 as a ordinary user and have two separate administrator account for any admin work I need done. I haven’t had any problems running as a user since I started using Windows 7(never really used Vista that much). I can work efficiently as a user and elevate my privileges at any time if I need to.

UAC isn’t really there for the ordinary user it’s there to protect you as an administrator so you won’t make mistakes you might regret later. It makes you think about what you are doing, even if you are running as an administrator, touch something that’s crucial for the OS it will hit you with an prompt to remind you that this could have consequences. Find it annoying? Don’t. Use it, bend it to your will.

Using UAC to elevate privileges.

A typical situation is you start an installer and it asks you for the name and password for an administrative account. This worked long before Vista or Windows 7. But the great part with Windows 7 is that you can ask for elevated privileges REALLY easily.

Let’s take Active directory Users and Computers as an example. You can run it and browse your organizational units and you can se users without administrative privileges. If you need to open an account or reset a password you will have to elevate your privileges OR you can delegate the tasks to your restricted user or maybe even a co-worker who normally doesn’t work in IT(by creating custom MMC:s).

Anyway to elevate just hit the Windows Logo button, type Active Directory move to Active directory users and computers AND hit SHIFT+CTRL+ENTER. Instead of the program starting with your user privileges Windows tries to elevate and sees that your access token doesn’t have the required rights for this. So it shows you the prompt. Easy as 1,2,3.

This is something most corporate administrators are used to BUT I would like to see home users adapt to this workflow as well. In the example I used the builtin Windows search, but you can start up any program like this. Now that you have read how easy this is, PLEASE create an administrative user to use and remove administrative privileges from your normal account. I promise it will feel natural in a few days and you’ll be a lot safer using your computer.