Exchange 2010 OWA mailbox policies and feature segmentation

Exchange 2010 supports the ability to allocate different levels of functionality to OWA users through policies. Although Exchange 2010 includes a default OWA policy, it is not actually applied to mailboxes unless you explicitly select the mailbox and apply the policy to it. Otherwise access to OWA features is controlled by the segmentation properties defined for the OWA virtual directory on each CAS server.

OWA mailbox policies didn’t exist in Exchange 2007, and the only way that you could segment functionality was through the properties of the OWA Web site. The problem with this approach is that any change applies to all mailboxes that connect to that CAS. Using policies allows more granular control because you can apply different policies at the level of an individual mailbox. In addition to their ability to segment features presented through OWA, OWA mailbox policies control some of the user-controllable settings available through ECP.

The easiest way to apply any OWA policy, including the default policy, to a set of mailboxes is with the Set-CASMailbox cmdlet. For example, this command fetches all the

mailboxes that belong to the Exchange Users organizational unit (OU) and pipes them to Set-CASMailbox to apply the default OWA mailbox policy:

Get-Mailbox –OrganizationalUnit ‘Exchange Users’ | Set-CASMailbox -OwaMailboxPolicy ‘Default’

The default OWA policy typically duplicates the default out-of-the-box segmentation properties of the OWA default Web site as installed on a CAS server and permits access to all OWA features, including the premium client. To create a new policy, go to the Organization Configuration section of EMC, select Client Access, then on the Outlook Web App Mailbox Policies tab, and select the New Outlook Web App Mailbox Policy option in the action pane. A wizard then allows you to select which features you want users to access.

In this case, we create a policy to restrict access to the OWA Light version that also selectively disables some OWA features.

Some of policy restriction features depend on other components (text messaging, public folders, and instant messaging), and others require a really good reason before you disable them. For example, it usually doesn’t make much sense to disable the Change Password feature because handling user requests to change their passwords creates extra work for help desks.

A new policy can also be created with EMS. For whatever reason, this is a two-step process. First, you create the new policy with the New-OWAMailboxPolicy cmdlet, and then you use the Set-OWAMailboxPolicy cmdlet to define what features are enabled or disabled by the policy. For example, here’s a policy that allows users to use the premium client while removing some of the more esoteric features:

New-OWAMailboxPolicy -Name ‘Limited OWA features’

Set-OWAMailboxPolicy -Identity ‘Limited OWA features’

-ActiveSyncIntegrationEnabled $True -AllAddressListsEnabled $True

-CalendarEnabled $True -ContactsEnabled $True -JournalEnabled $True

-JunkEmailEnabled $True -RemindersAndNotificationsEnabled $True

-NotesEnabled $True -PremiumClientEnabled $True -SearchFoldersEnabled $False

-SignaturesEnabled $True -SpellCheckerEnabled $True -TasksEnabled $True

-ThemeSelectionEnabled $False -UMIntegrationEnabled $False

-ChangePasswordEnabled $True -RulesEnabled $True -PublicFoldersEnabled $False

-SMimeEnabled $True -RecoverDeletedItemsEnabled $True

-InstantMessagingEnabled $False -TextMessagingEnabled $False

More than just segmentation

Although feature segmentation is the most obvious use of OWA mailbox policies and receives the most attention, you can also control other aspects of how users work with

OWA through these policies. After you create a new OWA mailbox policy, you are able to define rules for file access and download when OWA is run on private and public computers. Click the policy with which you want to work and then select Properties. You can then access the properties that control feature segmentation and two other tabs for Public Computer File Access and Private Computer File Access.

The Direct File Access settings

allow you to control how various file types are opened by users through OWA. The default option for both public and private computers is to allow direct access, meaning that users are able to open files. However, all types of files are not treated equally, as there are some file types that pose a potential risk of infection because they are often used as threat vectors by hackers who wish to infiltrate a computer. Files are therefore grouped into four categories:

● Always Allow: These files are deemed to be innocuous and safe to open on the client computer. The list includes types such as Word documents (.doc and .docx extensions)

and Windows bitmaps (.bmp extension) that you can be reasonably sure will not contain malicious code.

● Always Block: These files pose a significant risk to a computer when they are opened by a user because they contain executable code. These files include types such as

Windows batch files (.bat extension) and Windows command files (.cmd extension).

● Force Save: These are files that users cannot open directly and must save to disk before they can access the content. These types include Windows compiled help files (.chm extension).

● All others (unknown files that are not included in the other lists): The policy states what should be done if an unknown file type is detected. The default is to force a save to disk.

The priority given to action is from top to bottom. In other words, if a file type is on both the Always Block and the Force Save lists, it will be blocked.

If you prefer to have users open a viewer to access files rather than running the native application, you can select the Force WebReady Document Viewing When A Converter Is Available option. The effect is to force OWA to check documents as they are opened to see whether a WebReady converter is available and, if so, to always use the converter to open the file rather than calling the application. The idea is to eliminate any potential risk from macros or other code that could be carried around in the common file formats supported by WebReady, such as Microsoft Word and Microsoft Excel. In truth, the antivirus software that runs on today’s PCs will usually catch any malicious code, so forcing WebReady viewing for OWA when it is run on a private computer could be considered overkill. Next image shows how to access the list of file formats supported by WebReady converters. This list has been augmented over the last few years and supports a reasonably full set of the most common file formats that users will need to open in office environments.

It might be safe to allow users to open documents with applications on private computers, but it’s a different matter on computers that are used for public access. In this scenario, it is reasonably common to block access to attachments to avoid the risk that users might download and leave sensitive files on a computer that can be accessed by an unauthorized individual. You can do this by clearing the option through EMC or by running the Set-OWAMailboxPolicy cmdlet. Settings applied through an OWA mailbox policy override those set through the properties of the OWA virtual directory. For example:

Set-OWAMailboxPolicy –id ‘Restricted Users – OWA Light’

-DirectFileAccessOnPublicComputersEnabled $False

-ForceWebReadyDocumentViewingFirstOnPublicComputers $True

When this policy is applied, users will not be able to open or download and save files on public computers, but they will be able to access the content if a WebReady viewer is available.

Web links that are included in messages are still active. Exchange 2010 includes viewers for Microsoft Office documents (next image), RTF, and PDF files.

 

Attachment processing

Administrators control how OWA handles attachments by creating a list of attachment types and marking each as blocked, allowed, or “force to save.” Obviously, blocked means that users cannot open or download an attachment of this type to their PC, normally because the file type is likely to contain a virus or some other dangerous content. Allowed means the opposite, as there is a high degree of confidence that these attachments are safe.

OWA performs special processing for attachments marked as force to save. This means that the user has to save the attachment to his local disk before he can view its contents. As OWA downloads the attachment from the server, it checks to see whether it is XML or HTML. In this case, OWA runs some code called Safe HTML to strip out any malicious XML or HTML code. If the attachment is another type, OWA examines the content to see if it actually contains XML or HTML code. This check is performed to ensure that no attachment is ever downloaded that contains malicious code, which could introduce a virus or another dangerous program onto the PC. If hidden XML or HTML code is detected, OWA strips the attachment and replaces it with a text file to tell the user that the attachment was removed.

Applying an OWA mailbox policy

After the new policy is created, to apply it, you switch to Recipient Configuration and select one or more mailboxes and then Properties from the action pane. Click the Mailbox Features tab, select Outlook Web App, and then select Properties. You can then select an Outlook Web App mailbox policy and apply it to the mailbox.

Exchange enforces the new policy the next time that the user logs into her mailbox. If everything works as expected, the user will be presented with a restricted version of OWA Light. Of course, you can also apply an OWA mailbox policy to a mailbox with EMS:

Set-CASMailbox –Identity ‘Andrews, Ben (IT)’ –OWAMailboxPolicy ‘Restricted Users–OWA Light’

Integrating OWA and OCS

One small glitch might creep in with the instant messaging section of the policy. OWA 2010 supports a nice integration with Office Communications Server (OCS), but if you want to create the link between the two products, you have to ensure that the OWA mailbox policy that is applied to mailboxes that want to use OCS specifies “OCS” in the InstantMessagingType attribute. For example:

Set-OWAMailboxPolicy –Identity ‘OCS Integration Enabled’ –InstantMessagingType ‘OCS’ –InstantMessagingEnabled $True

Set-CASMailbox –Identity ‘Akers, Kim’ –OWAMailboxPolicy ‘OCS Integration Enabled’

Troubleshooting Error Code 0×8004210e

When users attempt to download their email they sometimes will receive an error message such as:

“Task ‘<Server_Name> – Receiving’ reported error (0×8004210E): ‘Yουr mailbox іѕ temporarily unavailable bесаυѕе another e-mail message іѕ being delivered tο іt οr another mail application іѕ accessing іt. Thе server responded: -ERR box locked”

This error code, 0×8004210e, is sent from your Internet Service Provider and can be a result of a locked mailbox. Sometimes other error messages may appear that refer to a “POP Lock” (Post Office Protocol) or “Box Lock”. These error messages can be received when using email clients such as Microsoft Outlook, Outlook Express, Windows Mail and others.

The error message can be generated because of network problems, malformed email messages, or more than one email client being configured to poll the server. What happens is that the lock file – which is used to stop more than one person from logging into the account at once – fails to be deleted at the end of the POP3 session. It then prevents the end user from logging in again and thus the error code, 0×8004210e is sent.

One resolution is to simply restart your mail client. If your end user cannot wait for a restart, or if a restart is not convenient at the time, then the user can try to access their email from a webmail account. If that fails then the problem may lie with the Internet Service Provider and in that case the administrator should contact the ISP support desk.

If restarting the mail client and contacting the ISP are not successful resolutions then the following workarounds should be tried:

1. Limit the end user’s access to email from only one email client. For the particular end user with the email issue an administrator can restrict the end user’s access to all other email clients. Only Microsoft Outlook access should be allowed for the end user. One method is to disable the other email clients. Another method would be to rename the end user’s account on the other email clients thereby preventing further email messages from being downloaded to that particular client. In addition, email devices such as a Blackberry, iPhone, οr similar device, thаt download the end users email, should also be disabled.
2. Another workaround is to temporarily disable antivirus software and anti-spam software on the end user’s system. Unfortunately by disabling such software on an end user’s system this will render that system vulnerable to computer attacks. This should be the last choice and only be performed temporarily as systems are left open to computer viruses and other malicious programs. The reason why disabling the antivirus and anti-spam software is a workaround is because these software applications installed on the client can have problems with interpreting the email and does not complete. So it doesn’t try to download the next email message from the server. To implement this workaround an administrator can follow this procedure:
   a. All antivirus and anti-spam software should be disabled on the client system. Likewise, disabling any email scanning features should also be performed.
   b. From Outlook, click on Send/Receive to download any malformed email messages from the email server.
   c. Once email has been downloaded then re-enable the antivirus and the anti-spam software on the client system.
   d. Email messages can now be opened.
3. A web email client can be used to access the end user’s email messages and then delete the malformed email from the mailbox. A safe practice would be to target those email messages that are greater than one megabyte in size and then delete them.
4. A fourth workaround is to enable server-side anti-spam and antivirus software on the email accounts using the web control panel. Most malformed emails will be prevented from reaching the end user’s inbox and thus stop the error code (0×8004210E) from being generated.

Administrators should be cautious and fully aware of the risks associated with turning off antivirus and anti-spam software. It would be wise to make a backup of the end user’s system before turning off these applications. And if the end user is accessing their email from within a virtual environment then this will also help to lower the risk of any potential damages.

Top protection measure for your computer security and integrity

Top protection measure for your computer security and integrity

With the continuous improvement in the field of  the internet technology we have come a long way, people can communicate to every one sitting at any part of the world, but also comes several threats in the mean time of this evolution process for example virus, worm, Trojan horse, and spyware.
But by following these easy steps we can make ourselves, secure on the Internet

1 Scan your computer, for virus or other threats.
As we all know that there has been a continuous threat from the virus or malware attacks. So to avoid all these threats from the computer perform antivirus installation , use proper  antivirus software’s and they should be updated, as all the antivirus software companies launches the definitions for  new threats time to time.

2 Use proper firewalls
Use proper antivirus software’s firewall, and keep them on. Some of the best free firewall that tops the list are Comodo Firewall, ZoneAlarm Firewall, Online Armour, Agnitum Outpost

3 Keep the Windows security feature turned on
In spite of using antivirus software’s, also keep updating your operating system with Windows Update with latest security patches from Microsoft.

4 Keep a check on the security bulletins from Microsoft
For any sort of new threat, i.e. virus or any other loop holes periodically have a check on Microsoft Website.

5 Download the files from the trusted websites.
Have a trace about where have you landed up with your browsing and only explore the website you trust upon. Always download software’s or other files from a trusted network.

6 Install only authentic softwares
Developing Software is a costly affair so contribute and credit them and always have genuine software.

7 Back up your data regularly
To protect your data, you should keep a data backup of your entire system regularly because a virus can erases or corrupts files on your hard disk. So if did not have a recent data backup then, it is the time to do that right away and keep that in regular practice on a periodic basis.

8 Don’t open suspicious email messages.
The  Microsoft Outlook help to protect your inbox mails from spam and phishing messages through the junk e-mail filter. Don’t open the emails you are not expecting for and some unknown source.

The above steps are some of the protection measure for your computer which is advised for every individual to have in practice. As your system is right in your hand and so does is its protection.

I am a printer support specialist for iYogi, iYogi is the first direct-to-consumer and windows technical support service from India. Providing an Annual Unlimited subscription to technical support, iYogi now boasts of more than 50,000 customers.

Windows User State Virtualization – Technologies and Issues

Introduction

Virtualization means different things to different people. In a general sense, virtualization refers to the process of using various technologies to decouple one computing resource from other resources in order to achieve business benefits such as lower TCO, increased availability, improved business agility, easier manageability, and so on. Here are some descriptions of different types of virtualization taken from my free e-book titled Understanding Microsoft Virtualization Solutions, From the Desktop to the Datacenter, 2nd Edition (PDF file, 10 MB) (Microsoft Press, 2010):

• Server virtualization refers to the ability to virtualize server workloads, which can save businesses money and simplify management overhead by allowing them to reduce the number of physical servers they need through server consolidation.
• Desktop virtualization refers to any type of technology that creates an additional virtualized operating system environment (the guest operating system installed in a virtual machine) on a physical desktop computer (the host). In local desktop virtualization, the virtual environment is running on the user’s computer (the host), while in remote desktop virtualization the virtual environment runs on a server.
• Cloud computing refers to any solution where virtualized computing resources running “in the cloud” can be provisioned and delivered as services to those who need them. These computing resources can include servers, storage, and networking resources running in virtualized environments using Microsoft Hyper-V, and the virtualized environment itself resides in a datacenter that can be either privately or publicly owned.

Other types of virtualization can include application virtualization, storage virtualization, network virtualization, and so on. What then does the term “user state virtualization” refer to?

Understanding User State Virtualization

User state virtualization or USV refers to the process of virtualizing (decoupling) user state information from the user’s computer and storing this information elsewhere, usually on a server in the datacenter. User state information is anything stored on the computer that pertains to the user, such as:

• User data such as documents, pictures, music files, video files, spreadsheets, PowerPoint presentations, and other types of files that belong to the user.
• User settings such as operating system settings (e.g. wallpapers, screensavers, keyboard layouts etc.) and application settings (e.g. toolbar selections, custom dictionaries, autosave settings, default page layout etc.) that can be customized on a per-user basis.

Figure 1: Windows user state information comprises user data and user settings

The goals of USV are essentially the same as those of any other type of virtualization: lower TCO, increased availability, improved business agility, and easier manageability.

Windows USV refers to a collection of features and technologies that can be used to implement a USV solution for client computers running some version of Microsoft Windows. The key features and technologies of Windows USV are these:

• User profiles which are file system structures (folders and files) that contain the user state information for each user on a Windows-based computer. Some folders and files in a user profile are normally hidden from view to keep users from messing with their contents.
• Folder Redirection which is a Windows technology that lets administrators redirect certain folders within user profiles to shared folders on the network so that when users save files they are working on these files are saved onto the network instead of on their own machines.
• Offline Files which is a Windows technology that lets users work with local copies of files stored in shared folders on the network even when the network itself is unavailable.
• Roaming User Profiles which is a technology that lets you store user profiles in shared folders on the network. When the user logs on to his computer, his profile is downloaded from the network and loaded to display his desktop. When the user logs off, his profile is uploaded back to the network.

Figure 2: Windows USV technologies

As a WindowsNetworking.com reader, you are probably already familiar to some degree with these different technologies, but let’s review them really fast anyways. And while the focus of this series of articles will be on virtualizing user state information on Windows 7 computers, we’ll also examine how USV technologies have changed from Windows XP to Windows Vista to Windows 7 since understanding these changes is important when implementing USV strategies in mixed environments.

User Profiles

There are a bunch of different types of user profiles you need to know about:

• Local profiles which are user profiles stored on the user’s computer. Even when RUP is used to virtualize (decouple) a user’s data and settings from the user’s computer, there is still a locally stored copy of the user’s profile on the user’s computer.
• Roaming profiles which are user profiles stored on the network. Note that Roaming User Profiles (capitalized) or RUP refers to the procedures and technologies involved while roaming profiles (Iowercase) refers to the actual profiles themselves.
• Mandatory profiles which are roaming profiles that are ACL’d as read-only. Mandatory profiles are frequently used in Remote Desktop Services (a.k.a. Terminal Services) environments when you don’t want your users to be able to make any changes to the configuration of their session-based desktops or RemoteApp programs.
• Temporary profiles which are used when the user’s local profile can’t be loaded and there is no roaming profile to download. A typical scenario where you might find yourself logged on with a temporary profile would be when your antivirus software locks files during the logon process thus preventing your local profile from loading. The result is that all your personal files suddenly seem to have vanished—My Documents is empty!! Fortunately, logging off and then on again usually causes your profile to load and your documents to be restored—whew!
• Default profile refers to a special user profile that is used as a template for creating a user’s local profile the first time he logs on to his computer. By customizing the default profile prior to deploying Windows, you can ensure a customized, uniform experience for your users. For example, you could prepopulate desktops with shortcuts to network shares, ensure that a corporate wallpaper is being used, and so on. Group Policy can be used to do some of these things as well.

User profiles changed significantly from Windows XP to Windows Vista (or Windows 7) as you can see by comparing Figures 1 and 2 below. Some of the important changes include the following:

• Windows XP stores local profiles in the C:Documents and Settings folder; Windows Vista and Windows 7 store them in the C:Users folder.
• In Windows XP the root folder of your user profile can be accessed using Windows Explorer. In Windows Vista and Windows 7 however, you can access your root profile folder directly from the Start menu and this is not necessarily a good thing since it means you can create additional folders in your user profile and these folders can’t be redirected (though they can be roamed).
• Windows Vista and Windows 7 profiles have more subfolders (and some different subfolders) than Windows XP profiles have.
• In Windows XP the folders My Pictures, My Music and My Videos were subfolders of My Documents; in Windows Vista and Windows 7 the user profile structure was flattened so that all of these folders are now peers.

The bottom line here is that the changes in the user profile structure starting with Windows Vista are so significant that these new profiles are called “v.2” profiles to distinguish them from the earlier Windows XP profile structure. This has significance, particular when trying to implement Roaming User Profiles in an environment (more about that in another article of this series).

We’ll dig deeper into certain portions of user profiles later in this series, but meanwhile if you’re interested in more detailed information concerning user profile changes in Windows Vista and Windows 7 you should read Chapter 15 of the Windows 7 Resource Kit (Microsoft Press, 2010). You can also find good information in the Managing Roaming User Data Deployment Guide (for Vista) here and What’s New in Folder Redirection and User Profiles (for Windows 7) here.

Figure 3: User profile structure in Windows XP. Other profile folders may be present depending on Windows features enabled and applications installed

Figure 4: The new “v.2” user profile structure in Windows 7 (and Windows Vista). Other profile folders may be present depending on Windows features enabled and applications installed

Roaming User Profiles

Roaming User Profiles (RUP) was actually developed way back in the Windows NT 4.0 timeframe and was intended to allow users to change seats and access their personalized desktop from any Windows computer on the network. In other words, RUP provides the ability for users to roam between computers. RUP as it was initially implemented had some problems however:

• RUP roams the entire user profile including settings for applications that aren’t specifically intended to be roamed (in other words, RUP has no granularity in what you can roam—it just roams everything in the profile). This isn’t a problem however for applications that are “well-designed” that is for apps that store their settings in the proper places—we’ll talk more about this later in this series.
• RUP syncs the local copy of the profile on the user’s computer with the copy stored on the server only at logoff. This is still the default behavior in Windows 7 though you can now choose to sync periodically in the background if you desire—more on this as well in a later article.
• RUP doesn’t work well in scenarios where users need to log on to multiple computers at the same time. The least that can happen might be data loss or settings that don’t apply the way you expect them to; the worst can be profile corruption, which necessitates rebuilding the user’s profile from scratch and losing all the data and settings that were previously present. And generally speaking in Active Directory environments there’s no easy way to prevent users from logging on to multiple computers concurrently except by educating them not to do this.
• RUP doesn’t work well if you have a mixed environment of Windows XP and Windows 7 (or Windows Vista) computers. RUP also doesn’t work well if your environment has a mix of computers running x86 and x64 versions of Windows. We’ll talk more about mixed environments later in this series.
• Because the profiles RUP creates (roaming user profiles) contain all of the user’s data and settings, they can grow very large, especially if the user has lots of pictures, music and videos on their computer. The result is that RUP as it was originally designed could result in terribly long logon/logoff times for users as their profile was downloaded to or uploaded from their computer.

That last issue led Microsoft to introduce a second USV technology to complement RUP and that’s what we’ll look at next. But meanwhile if you’re interested in learning more about RUP you can check out the chapter of the Windows 7 Resource Kit mentioned earlier in this article.

Folder Redirection

Folder Redirection (FR) was introduced in Windows 2000 as a way of mitigating the slow logon/logoff issue associated with large roaming profiles in NT. The idea is that FR lets you redirect certain profile folders such as My Documents out of the user’s profile and store the contents of these folders on a separate network share than the one where the user’s profile is stored. Then when the user’s computer downloads (or uploads) the user’s roaming profile from the network, the contents of My Documents and other redirected folders won’t need to be downloaded, making logon (and logoff) times faster.

FR was also introduced for several other reasons:

• So that users could roam between computers and access their data from the network even when RUP has not been implemented in the organization’s environment. FR in this case can be seen as a kind of “poor man’s RUP” that roams only user data but not user settings, but we’ll see below that you can also use FR to roam user settings (sort of).
• So that administrators could more easily back up user data by having such data stored on the network (in the redirected My Documents folders located on a file server) instead of on client computers (in each user’s local My Documents folder).
• So that any application settings (specifically, files associated with applications and certain Windows features) stored in the Application Data subfolder could also be redirected and hence roamed. More on this in a moment.
• So that RUP could work more effectively in a Terminal Services environment. More on this too in a moment.

FR was updated a bit in Windows XP and Windows Server 2003 and let you redirect the following profile folders:

• My Documents – This is usually the biggest profile folder by far, so redirecting this folder is always a best practice whenever you implement RUP. And since My Pictures, My Music and My Videos are subfolders of My Documents, the contents of these folders also get redirected to the network. Finally, as mentioned above redirecting My Documents lets administrators back up your data more easily so you don’t lose your work if your machine crashes.
• Desktop – Some (if not most) users tend to store important documents on their desktop so they can access them easily, and if you store a lot of files on your desktop then you may experience logon/logoff delays if RUP has been implemented in your environment. Redirecting the Desktop folder also ensures that anything you save to your desktop also gets backed up.
• Application Data – This profile folder stores configuration settings for Windows features and installed applications. In other words, by redirecting the Application Data folder you can roam user settings (in addition to roaming user data by redirecting My Documents and Desktop). The trouble is, redirecting the Application Data folder redirects all settings stored in this folder, even for applications that weren’t designed to be roamed. In fact, it turns out that roaming per-user settings applications is a thorny problem, so we’ll devote an entire article in this series to discussing it later.
• Start Menu – Redirection of this folder was intended mainly for Terminal Services environments where everyone is supposed to get the same Start Menu and be able to run a common set of applications. Because of this, redirection of Start Menu is a specialized topic that we’ll look at later in this series.

Anyways, in Windows XP and Windows Server 2003 you can use Group Policy to implement FR as shown in Figure 5 below. Beginning with Windows Vista however, you now have the option of redirecting additional profile folders (up to 13 folders in total) and Figure 6 illustrates this new situation. There are a few other improvements to FR in Windows Vista and Windows 7 that we’ll talk about later in this series.

Figure 5: Folder Redirection policy in Windows XP and Windows Server 2003

Figure 6: Folder Redirection policy in Windows Vista, Windows 7 and Windows Server 2008

Offline Files

When FR was introduced in Windows 2000 there was another feature introduced alongside it called Offline Files (OF) that was intended to complement FR. The reason is because if FR redirects user data (and possibly user settings) to a network server but the network (or the server) suddenly becomes unavailable, the user won’t be able to access their data files (and some application customization files) resulting in confusion, frustration and lost productivity. Offline Files is designed to mitigate this problem by synchronizing folders and files on the user’s machine with their copies on the network. OF thus goes hand-in-hand with FR and OF is almost always implemented when FR is implemented. We’ll dig deeper into OF later on in this series, but for now you can think of OF as a given whenever FR is being used.

Issues to Consider

What then are the major issues you need to consider when designing and planning a USV strategy for your organization? Here is a list of some key issues we’ll be looking at in this series of articles:

• What business scenarios can benefit from USV?
• What issues can arise when trying to virtualize application state?
• What considerations are there for mixed environments, for example when some of your users have Windows 7 running on their computers while others still have Windows XP?
• What do you need to be aware of when planning migration of a Windows XP environment that has FR/OF/RUP to Windows 7?
• Are there any security considerations for implementing FR/OF/RUP?
• Are there any other limitations you should be aware of concerning what one can do with FR/OF/RUP?
• And finally, how should you actually go about implementing a USV solution? What steps do you need to take in what order?

Window Firewall Does Not Secure? – Fix Your Window Firewall To Be More Effective Here!

Window Firewall Does Not Secure? – Fix Your Window Firewall To Be More Effective Here!

Window Firewall is an application designed for Microsoft Windows system to Secure Windows against viruses and some other threats. However, many users complain about Window Firewall is not effective in protecting from spyware or malware, so their computers are still easily compromised. It is recommended to remove spyware to protect Windows security completely to boost up your Windows system immediately!

 

Window Firewall sometimes encounters problems and vulnerabilities, and shows false threats reports to warn people, but it is not actually help too much to remove malware to secure computer system. This allows spyware or other rogue programs to execute unknown actions in the background including collecting and sending information. You may lose your personal information, and encounter some computer errors and slow PC performance. So, Windows Firewall obviously does not enough to secure our Windows systems.

 

 

How to Protect Windows with the Best AntiSpyware?

 

The most effective solution to get rid of Windows viruses to defend your computer from any potential spyware threats on your computer should be to use a truly reliable spyware removal tool. Here, Spyware Cease is highly recommended if you really want an actually-work spyware removal tool. Moreover, this program also contains profound utility to fix your Windows vulnerabilities and allow you to better manage Windows Firewall.

 

It has been proved to be a powerful Window Firewall for you with its Online Scan utility and is able to remove Windows threats and defend your computer from all the other computer threats. You can always get dedicated technical support from Spyware Cease support team whenever you have a spyware problem. Before you try other programs, give Spyware Cease a try, and you’ll be surprised!

 

Free Download a trusted and effective AntiSpyware Here: http://www.bestspywarescanner.net/. Give yourself a safer and better computer experience now!

Amy Zhou is a professional security software expert and virus threat analyst that contributes to the security software company. She is fond of reviews many antispyware and antivirus software in the market. She would like to help computer users to know more essential computer knowledge and take good care of their daily friends-the computers. Read more http://www.bestspywarescanner.net/

ABC of Microsoft Security Essentials

ABC of Microsoft Security Essentials

Are you too busy with so many things that you do not have time to worry on protecting your PC? Having problems with Trojans, worms and other malicious software? Unsatisfied with the services of the paid software subscriptions? Microsoft Security Essentials is the solution that you are looking for.

What is Microsoft Security Essentials?

The Microsoft Security Essentials (MSE), also codenamed Morro, is a free real-time consumer antivirus software released by Microsoft which provides high-quality protection when it comes to viruses, spyware, rootkits and Trojans. It is available for Windows XP, Windows Vista and Windows 7. The launching of the Microsoft Security Essentials has marked a change consumer antivirus marketing strategy of Microsoft because it was made for 50-60% of PC users who don’t have the money or don’t want to pay for antivirus protection. With MSE, there’s no need for registration, trials with an expiration date or renewals.

Installing Microsoft Essentials is very easy. It has a smaller download size, also include the fast installation. According to Microsoft, MSE should not be installed together with any other antimalware software. As soon as you see the Security Essentials icon becomes green, it signifies that your computer is protected and in good status. Worry no more with the latest protection because the updates and upgrades are automatic. Updates are published three times a day to Microsoft Update. MSE decompresses and scans archived files, file downloads and e-mail attachments. Using the Dynamic Signature Service, it checks the updates if an application show suspicious behavior which can help the user to identify malicious files. MSE receives positive reviews because of its low resource usage, straightforward user interface and price point. PCWorld remarked the clear-cut and cleanly designed tabbed interface. PC Magazine noticed the small installation package and speedy installation.

It is a very user–friendly security software that runs quietly in the background while you are using your computer. You won’t be bothered to continue doing other tasks while updating the system. It only gives alerts if there’s something important that you need to do. You will be able to continue your work or have fun at the same time because it doesn’t require a lot of system resources. It also helps the users to stop potential threats before they harm your computer.

Microsoft Security Essentials was generally made to help you in securing your computer. However, as experts will tell you there’s no best or infallible antivirus. If you want your PC to be protected further or you suspect that your antivirus has not done the job, the come to Techie Now and enjoy our virus removal services and more.

If you want your PC to be protected, Techie Now is ready to provide you flexible, quick and safe services when it comes to virus and spyware removal, performance optimization, software installation and configuration, and other general repair. Feel free to visit us, www.techienow.com

Support Policies and Recommendations for Exchange Servers in Hardware Virtualization Environments

Microsoft has published an interesting article about their official support for installing Exchange on Hyper-VVirtual Server 2005 virtual machines.

To make a long story short, here are the support policies for both Exchange 2007 and Exchange 2003:

Support Policy and Recommendations for Exchange Server 2007

Microsoft supports Exchange Server 2007 in production on hardware virtualization software only when all the following conditions are true:

• The hardware virtualization software is Windows Server 2008 with Hyper-V technology, Microsoft Hyper-V Server, or any third-party hypervisor that has been validated under the Windows Server Virtualization Validation Program.
• The Exchange Server guest virtual machine:
  • Is running Microsoft Exchange Server 2007 with Service Pack 1 (SP1) or later.
  • Is deployed on the Windows Server 2008 operating system.
  • Does not have the Unified Messaging server role installed. All Exchange 2007 server roles, except for the Unified Messaging role, are supported in a virtualization environment.
• The storage used by the Exchange Server guest machine can be virtual storage of a fixed size (for example, fixed virtual hard drives (VHDs) in a Hyper-V environment), SCSI pass-through storage, or Internet SCSI (iSCSI) storage. Pass-through storage is storage that is configured at the host level and dedicated to one guest machine.Note:

  In a Hyper-V environment, each fixed VHD must be less than 2,040 gigabytes (GB). For supported third-party hypervisors, check with the manufacturer to see if any disk size limitations exist.

  • Virtual disks that dynamically expand are not supported by Exchange.
  • Virtual disks that use differencing or delta mechanisms (such as Hyper-V’s differencing VHDs or snapshots) are not supported.
• No other server-based applications, other than management software (for example, antivirus software, backup software, virtual machine management software, etc.) can be deployed on the physical root machine. The root machine should be dedicated to running guest virtual machines.
• Microsoft does not support combining Exchange clustering solutions (namely, cluster continuous replication (CCR) and single copy clusters (SCC)) with hypervisor-based availability or migration solutions (for example, Hyper-V’s quick migration). Both CCR and SCC are supported in hardware virtualization environments provided that the virtualization environment does not employ clustered virtualization servers.
• Some hypervisors include features for taking snapshots of virtual machines. Virtual machine snapshots capture the state of a virtual machine while it is running. This feature enables you to take multiple snapshots of a virtual machine and then revert the virtual machine to any of the previous states by applying a snapshot to the virtual machine. However, virtual machine snapshots are not application-aware, and using them can have unintended and unexpected consequences for a server application that maintains state data, such as Exchange Server. As a result, making virtual machine snapshots of an Exchange guest virtual machine is not supported.
• Many hardware virtualization products allow you to specify the number of virtual processors that should be allocated to each guest virtual machine. The virtual processors located in the guest virtual machine share a fixed number of logical processors in the physical system. Exchange supports a virtual processor-to-logical processor ratio no greater than 2:1. For example, a dual processor system using quad core processors contains a total of 8 logical processors in the host system. On a system with this configuration, do not allocate more than a total of 16 virtual processors to all guest virtual machines combined.

Support Policy and Recommendations for Exchange Server 2003

Microsoft supports Exchange Server 2003 in production on hardware virtualization software (virtual machines) only when all the following conditions are true:

• The hardware virtualization software is Microsoft Virtual Server 2005 R2 or any later version of Microsoft Virtual Server.
• The version of Exchange Server that is running on the virtual machine is Microsoft Exchange Server 2003 with Service Pack 2 (SP2) or later.
• The Microsoft Virtual Server 2005 R2 Virtual Machine Additions are installed on the guest operating system.
• Exchange Server 2003 is configured as a stand-alone server and not as part of a Windows failover cluster.
• The SCSI driver that is installed on the guest operating system is the Microsoft Virtual Machine PCI SCSI Controller driver.
• The virtual hard disk Undo feature is not enabled for the Exchange virtual machine.Note:

  When a Microsoft Virtual Server SCSI adaptor is added to a virtual machine after the Virtual Machine Additions have been installed, the guest operating system detects and installs a generic Adaptec SCSI driver. In this case, the Virtual Machine Additions must be removed and then reinstalled for the correct SCSI driver to be installed on the guest operating system.

Rest of the recommendations are at Microsoft website.

Window Security Center Shows Up On Your Computer? You Can Remove Window Security Center From Your Computer

Window Security Center Shows Up On Your Computer? You Can Remove Window Security Center From Your Computer

What is Window Security Center?

To begin with, you should think about how long time you have not maintain your PC performance or remove virus completely from your system? Have you found it run much slower than before? Want to retrieve your smooth computer running and enjoyable computer experience again? Then you should check this review now!

Window Security Center is a kind of malicious program designed by hijackers to attack and compromise computers. Window Security Center spreads through the Internet, and usually sneaks into your computer without your notice. Window Security Center can obviously slow down your computer speed, interrupt you from normal surfing on the Internet, and even make the whole system crash. Once you have Window Security Center on your computer, remove it immediately!

Window Security Center intrudes in your computer?

Many computer users may always get alert from their antivirus software that Window Security Center is detected, but can’t be removed and quarantined. Or, this malicious threat appears again after deletion, which annoys people very much. Here, specifically against Window Security Center, I would like to introduce some technique in order to effectively get it removed. Before automatically removing Window Security Center, you need a reliable program that is able to scan out and remove this threat completely. This allows you to remove Window Security Center once for all.

How can you remove Window Security Center quickly?

To Remove Window Security Center effectively, and to prevent your computer from Window Security Center and any other Internet virus, you are highly suggested to use Spyware Cease, if you really want an actually-work spyware removal tool. Most importantly, it has been proved to be powerful with its Online Scan utility and is able to remove Window Security Center and almost all the other computer threats. And, you can also get dedicated technical support from Spyware Cease support team if your Window Security Center problem is really tough. This is fairly nice for most of us who are not very good at dealing with tough spyware threats, isn’t it?

If you are infected by Window Security Center or any other threats, you are sincerely suggested to free download Spyware Cease right now. You are able to use this good and trusted security tool to get rid of the annoying Window Security Center, Adware, spyware and any future PC threats effectively. Before you try other programs, try Spyware Cease first, and you’ll be surprised!

Denny has worked in a computer company for 3 years. She is excellent in providing Easy and Useful Tips for computer users to resolve PC problems. To maintain your PC performance and make it run like new, you can Click Here to get the best solution freely!

How to migrate your existing Active Directory to Windows Server 2008

This is a brief How To guide (the first of many) on how to migrate your existing Active Directory to Windows Server 2008.

Please note that I cannot be held responsible for any issues that you encounter when following this guide, my upgrade was done in a lab environment on a single Domain Controller running Exchange 2003.

If you do follow this and do it on a live system please, please, please run a full back up of your domain controllers and verify that the backup was successful. Even though this is a straight forward upgrade if anything goes wrong during the upgrade, you could potentially be left with a domain that NO users can logon to.

Before you start upgrading

verify that your domain controllers meet these requirements:

• The hardware meets or exceeds the requirements for Windows Server 2008.
• All hardware and software is compatible with Windows Server 2008, including antivirus software and drivers.
• You have ample disk space to perform the install.
• The current domain functional level is Windows 2000 Native or Windows Server 2003. You cannot upgrade directly from Windows NT 4.0, Windows 2000 Mixed or Windows Server 2003 Interim domain functional levels.
• All Windows 2000 Server domain controllers have Service Pack 4 installed.

Test your domain

Active Directory domains are very resilient and can continue to function even when a there are various problems e. Even if your Active Directory seems to be working properly, you might have logon delays, replication failures or Group Policy settings that aren’t being applied. These conditions can cause problems during an upgrade, so it’s crucial to resolve them now.

These tools will help you identify and diagnose any problems:

• Dcdiag.exe. Run this tool to analyse your Active Directory for common problems; it’s included with Windows Server 2003 and Windows Server 2008.
• Repadmin.exe. Use Repadmin.exe to identify Active Directory replication problems; it’s included with Windows Server 2003 and Windows Server 2008.
• Gpotool.exe. Use this tool to verify that Group Policy is consistent among domain controllers, it’s included with the Windows Server 2003 Resource Kit tools, available at http://go.microsoft.com/fwlink/?linkid=27766.
• Event Viewer. Review the Directory Services log file for errors that might indicate problems.

Prepare Your Schema

If you upgraded from Windows 2000 to Windows Server 2003 you will be familiar with the Adprep.exe tool that was located on the Windows Server 2003 CD to prepare your Forest and Domain Schema. To prepare the Schema for Windows Server 2008 you will need to run the adprep tool from the Server 2008 DVD. This is located in the SoucesADprep Folder on the CD.

Run the following Command to prepare your domain for 2008:

Adprep /forestprep
Adprep /domainpre

Adprep /domainprep /gpprep

Adprep /rodcprep

If you get an error during the Adprep /domainprep about the domain not being in native mode you need to raise the level of your domain and then re-run domainprep. To raise the level of your domain go into Active Directory Domains and Trusts. Right click on the domain and select Raise Domain Function Level… 

Once you have finished running the Adprep on you domain controller, join your new Windows Server 2008 Server to your domain make sure that you have a static IP assigned to the server I am using IPv4 as to be honest know nothing about IPv6 just now, so when running dcpromo click yes to the prompt about the Static IP assignment.

Then once that has done you will have a functioning Windows Server 2008 Active Directory Server.

The ScreenCast video content presented here requires JavaScript to be enabled and the latest version of the Macromedia Flash Player. If you are you using a browser with JavaScript disabled please enable it now. Otherwise, please update your version of the free Flash Player by downloading here.

// < ![CDATA[
//

How to migrate your Active Directory Domain to Windows Server 2008

Windows Server 2008 includes a handful of important upgrades to your Active Directory domain infrastructure. The most useful are these:

• Read-Only Domain Controllers: RODCs are a new type of domain controller that doesn’t allow updates but does provide authentication and directory services. This reduces the risk of an Active Directory security compromise (especially for branch offices with poor physical security) because an attacker with access to an RODC would have a very difficult time using that access to update the Active Directory.
• Flexible Password Policies: You can assign different password policies to different sets of users within a single domain—finally! If you have created separate domains to work around this restriction in the past, get rid of those redundant domains after the upgrade.
• Auditing: Active Directory auditing is much more granular in Windows Server 2008, allowing you to closely track changes on just the objects you’re interested in (including recording both the old and new values). You can separately audit read accesses and replication.

You can take advantage of these improvements only by upgrading every domain controller in a domain to Windows Server 2008, and then upgrading the domain functional level. That sounds easy, but if you don’t plan it properly, you could be left with a broken Active Directory and thousands of angry users. Follow these tips to upgrade without fear.

1. Back up your domain controllers

While most upgrades go smoothly, there’s the possibility of creating an outage that could affect your entire domain — potentially preventing users from accessing network resources. The more customized your Active Directory schema and permissions, the more likely you are to have problems. Therefore, you should plan your upgrade during nonpeak hours and have a full backup (including System State) of at least two domain controllers in case you need to roll back to an earlier version.

2. Verify upgrade requirements

Before you can upgrade the domain functional level, all domain controllers in the domain must be running Windows Server 2008. This allows you to take advantage of the new features but prevents you from adding any domain controllers running earlier versions of Windows.

Before you start upgrading, verify that your domain controllers meet these requirements:

• The hardware exceeds the Windows Server 2008 requirements.
• All hardware and software is compatible with Windows Server 2008, including antivirus software and drivers.
• Sufficient disk space is free to perform the operating system and Active Directory upgrade. Specifically, verify that your free space is at least twice the size of your Active Directory database.
• The current domain functional level is Windows 2000 Native or Windows Server 2003. You cannot upgrade directly from Windows NT 4.0, Windows 2000 Mixed or Windows Server 2003 Interim domain functional levels.
• All Windows 2000 Server domain controllers have Service Pack 4 installed.

3. Test your domain

Active Directory domains are very resilient and can continue to function even when a variety of problems exist. Even if your Active Directory seems to be working, you might have logon delays, replication failures or Group Policy settings that aren’t being applied. These conditions can cause problems during an upgrade, so it’s important to resolve them now.

These tools will help you identify and diagnose any problems:

• Dcdiag.exe. Run this tool to analyze your Active Directory for common problems; it’s included with Windows Server 2003 and Windows Server 2008.
• Repadmin.exe. Use Repadmin.exe to identify Active Directory replication problems; it’s included with Windows Server 2003 and Windows Server 2008.
• Gpotool.exe. Use this tool to verify that Group Policy is consistent amongdomain controllers, it’s included with the Windows Server 2003 Resource Kit tools, available at http://go.microsoft.com/fwlink/?linkid=27766.
• Event Viewer. Review the Directory Services log file for errors that might indicate problems.

4. Prepare your schema

Just as when upgrading to a Windows Server 2003 functional level, you must use the Adprep.exe tool to prepare your forest and domain schema. Note that you must use the version of Adprep included on the Windows Server 2008 media in the sourcesadprep folder, even though you will need to run it from an existing Windows Server 2003 domain controller. Be sure to use 32-bit media when running Adprep from a 32-bit domain controller, and use 64-bit media for 64-bit domain controllers.

To prepare your Active Directory schema, follow these steps for each domain that you plan to upgrade:

1. Run Adprep/forestprep on your Schema Master with Enterprise Admins, Schema Admins and Domain Admins privileges. Wait for changes to replicate.
2. Run Adprep/domainprep/gpprep on the Infrastructure Master with Domain Admin privileges. On Windows Server 2003 domains, you’ll receive an error message caused by the unnecessary /gpprep parameter that you can ignore.
3. On Windows Server 2003 domains, run Adprep/rodcprep on the Domain Naming Master with Domain Admin privileges.

Note: As long as your domain and forest are at the Windows Server 2003 functional level and you’ve prepared the schema, you don’t need to upgrade your entire domain to install a Windows Server 2008 RODC.

5. Migrate your domains

Before you upgrade a domain, be sure that you don’t plan to add domain controllers running Windows 2000 Server or Windows Server 2003. While you can always upgrade the domain functional level, you can never downgrade it.

The easiest way to migrate your domain to the Windows Server 2008 functional level is to follow these steps:

1. Install a new Windows Server 2008 computer, and then run Dcpromo.exe. You can configure either a Full Server or a Server Core as a domain controller. On Full Servers, you also have the option of adding the Active Directory Domain Services role using Server Manager.
   Tip: You can use command-line parameters to run Dcpromo.exe unattended (with or without an answer file). For detailed information, run Dcpromo/?.
2. Wait for replication to occur.
3. Retire or upgrade all Windows 2000 Server and Windows Server 2003 computers. To upgrade a Windows 2000 Server, upgrade it to Windows Server 2003, and then upgrade it to Windows Server 2008.
4. Upgrade the domain functional level using the Active Directory Domains and Trusts tool. Right-click the domain, and then click Raise domain functional level.

Now, test any applications that depend on Active Directory, including user logons and Exchange Server. If you run into problems, restore your domain controllers from backups, and head back to the lab for more testing. If everything goes well, wait a couple of weeks for the environment to stabilize before you make any other major changes.

6. Upgrade your forest

There are no new features available if you upgrade your forest to the Windows Server 2008 functional level — it just causes any new domains that are added to the forest to be at the Windows Server 2008 domain functional level by default. Still, it’s a worthwhile step to save yourself the trouble of upgrading a new domain that you accidentally added at the wrong functional level.

Summary

Microsoft must have been listening to the complaints about Active Directory limitations because Windows Server 2008 allows multiple password policies within a domain, read-only domain controllers and auditing that’s actually useful. If you follow these steps, you’ll be finished with your upgrade in no time.