Windows 2008 Access Based Enumeration

Novell admins always had one big complaint about Windows file shares.  It was a legitimate one too.  How come users who didn’t have access to folder could see it?  Microsoft gave us ABE or Access Based Enumeration for Windows Server 2003.  I was looking at a solution today where ABE would be handy.  However, this would be a Windows Server 2008 deployment.  I found someone had already done a nice job on documenting how to use ABE in W2008.  Once you enable it, anyone not in a group with access permissions will not be able to see the folder in a share.

Ferrari Deploys Windows HPC Server 2008

I’m sitting in my hotel in Barcelona (exhausted from a hard and long week).  BBC World is showing "Click", an IT show.  Ferrari are running Microsoft’s Windows HPC server 2008 for simulating aerodynamics.  Please, no jokes about Italian cars, oil on driveways and dodgy Windows 🙂

Ferrari say they wanted to do more with less so that’s why they wanted to go with HPC 2008.  MS says that HPC would be perfect for huge scale simulations for the financial industry.  The Beeb reckoned it might have been useful in Wallstreet not so long ago.

The Beeb reports that HPC 2008 runs on Cray super computers.

Easy Print Experience

Like many, I’m dubious of claims where marketing people have been involved.  If you’re in IT any length of time, you’ve probably been burned.

I deployed a test W2008 Terminal Server last week and I configured RemoteApp (application publishing), TS Web (web interface) and TS Gateway (SSL access to the previously listed functions).  I got our networking folks to set up a firewall rule to the lab machine (on a  dedicated lab network) so I could access the test machine over SSL from the Internet.  All of this runs in our data centre in a remote and secure location.

I didn’t configure anything related to printers on the Terminal Server or the lab network.  Nothing.  Zilch.  Zero.  No drivers were set up and no configuration was made for Easy Print.  It’s literally log in and print.

I then logged in over the Internet to Terminal Services via the TS Web (SSL) from home.  I was able to print to my local photo printer with no delays.  I was in the office on Monday and connected to the TS Web (SSL) – remember that the data centre is still remote.  I printed to a Dell printer with no delays.  This included a Word document with lots of formatting and pictures as well as a PDF document.

Fantastic! The user experience easily exceeded my expectations.  Well done to the TS team in Microsoft!  This is a cracking solution to a major problem.

My First Hands-On With W2008 Terminal Services

I got to do some Windows Server 2008 Terminal Services work over the last few days.  In particular, I was focusing on:

  • RemoteApp: Applications can now be published like in Citrix’s old solution.  A shortcut pointing to a TS application is shared.
  • TS Web: A web interface for logging into TS.  You can publish your RemoteApp shortcuts or even a desktop to the web interface.
  • TS Gateway: This provides a secure way of sharing RemoteApp applications to the Internet, e.g. a RemoteApp shortcut can be shared on the Internet via TS Web.  The RDP session is encapsulated in HTTPS/SSL thus making it Internet and firewall friendly.
  • EasyPrint: The biggest failing of TS over the Internet was printing.  You just couldn’t print over the Internet or a Corporate WAN, e.g. a 2MB PDF can generate a 20MB stream of data that is sent to a printing device.  This is only available to Vista SP1 and XP SP3 clients.

The user experience is simple.  They sign onto the site and then either log into a desktop or an application that you’ve published.  Simple as that.

You then do your traditional TS stuff for the user experience and server lockdown, i.e. file permissions and loop back GPO processing.

I tried it out on my 3MB DSL from home connecting to a W2008 TS in our data centre at work.  The user experience was excellent.  I printed a doc to my photo printer with no driver messing (thank you Easy Print!) and my DSL wasn’t clogged for hours 🙂  Overall, two thumbs up!

Branch (Office) Infrastructure Implementation Solution For Windows Server 2008

Microsoft has just released BIIS for W2008:

"The Branch Infrastructure Implementation Solution provides guidance to design and implement Microsoft’s branch infrastructure solution. This solution, previously known as the Branch Office Infrastructure Solution, has been updated to support the features and functionality in Windows Server 2008 that support branch infrastructure.

Windows Server 2008 includes several enhancements to the base operating system plus powerful new functionalities that make it valuable in a branch office environment. These include:

  • Mitigated Security Risks: The Read-Only Domain Controller is a powerful new feature that enables organizations provide their remote branch office with local authentication servers, without having to increase security exposure to their Domain Database. The RoDC also provides a read-only copy of the DNS and receives uni-directional updates from the Central Office DataCentre. BitLocker technology provides hardware-based encryption for data on branch office server. The Server Core installation option helps significantly decrease the servers’ surface area of exposure and management overheads by reducing the operating system footprint.
  • Improved Network Performance: Windows Server 2008 offers several new or improved network technologies that will improve the efficiency of WAN communications. The new TCPIP Stack and the Server Message Block (SMB 2.0) is redesigned for networking environments especially when connecting branch offices. The Distributed File System Replication service (DFSR) is a multi-master replication engine that increases data availability and gives users in remote sites fast, reliable access to files
  • Improved Deployment and Administration: New management tools like the Server Manager Console provide a single, unified console for managing a server’s configuration and system information, displaying server status, identifying problems with server role configuration, and managing all roles installed on the server.

BIIS provides an understanding of the complex issues that affect branch infrastructure planning and design. This solution was designed using a modular approach that will support future releases and add-on guides to support core as well as extended branch infrastructure services. The service guides that are available with this release focus specifically on key Windows Server 2008 role services. Future releases will present a selection of “extended” services to detail branch infrastructure focused on solutions for roles and products such as Hyper-V, System Center Configuration Manager, and Forefront Client Security. This guidance helps IT Service designers and architects minimize the branch office design and implementation costs and provide the most efficient and effective management possible, while still providing the desired user experience for staff in branch offices."