If you think a promiscuous client is a scantily-dressed customer, you're in trouble. And I'm not talking about having an affair.

Think an evil twin is a horror-movie villain? Wrong again. The horror you should be bracing yourself for is not on the silver screen — and it's not from a rolling pin flung at you from across the kitchen, for that matter. Rather, the trouble is in the airwaves and targeted to Wi-Fi users.

Both the "Promiscuous Client" and the "Evil Twin" are two of the latest wireless threats to your small business.

If you haven't heard of them, you probably will soon.

"What would happen to your business if your strongest competitor gained access to all of your data?" asks Greg Phillips, chief executive for AirTegrity Wireless, Inc., a Stateline, Nev. wireless security company. "Unfortunately, it is a very real possibility if appropriate controls against these new threats are not exercised."

So what's out there?

The Evil Twin. One of the most popular new threats to Wi-Fi users is the Evil Twin, sometimes referred to as WiPhishing. It's a rogue access point that replicates another network name, such as that of a hot-spot or a secure network. "The Evil Twin waits for a user to mistakenly sign into the wrong access point and captures the user's network data or attacks the computer," says Mike Klein, chief executive of Interlink Networks, Inc, an Ann Arbor, Mich. Wi-Fi security firm for small businesses. Klein recommends using an application like the free LucidLink Wireless Client (www.lucidlink.com), which automatically detects the change of security settings and warns the user to prevent an Evil Twin attack. He says it's also best to stay away from any open, or unsecured, wireless networks.
* The New War Drivers. Basically, War Driving is an unauthorized person hacking your company's wireless network. That's a problem if your network is open or not adequately secured. (Is yours? This is probably a good time to check.) "The War Driving threat only affects businesses with unsecured wireless networks," explains Nicholas Miller, chief executive of Cirond Corporation, a Campbell, Calif., wireless security company. "It can affect the security of confidential business data that resides on users laptops." So what's new about this threat? War Driving used to be an obscure pastime for hackers, who would cruise around in their compact cars looking for open networks. But lately, the new war drivers can also be competitors or disgruntled employees, sitting in the parking lot and trying to penetrate your network.

The Promiscuous Client.
A close cousin to the Evil Twin, Promiscuous Clients are opportunistic hazards to your business. Instead of associating with an access point that is placed near a public hotspot intentionally, and for malicious purposes, the promiscuous client is simply there for one reason or another, offering an irresistibly strong signal. "802.11 wireless cards often look for a stronger signal to connect to as well as look to hook up with a common SSID name," says Michael Maggio, the president of Newbury Networks, Inc., a Boston IT security firm. (I actually encountered a Promiscuous Client on a recent trip — one offering a terrific signal and speed. Fortunately, my laptop and I both survived the meeting.) Maggio suggests using a wireless "sniffer" (Microsoft Windows XP has one) that can help you monitor and test your network airspace. "The more you know about your layout — inside your offices, across the hallway, on the floors above and below you, as well as outside your bricks and mortar (business) — the better idea you'll have about where security breaches might occur," he says.
Bluesnarfing and Bluejacking. Your Bluetooth-enabled wireless device can leave you open to a hack attack, too. For example, Bluejacking allows unauthorized users to send a message to your phone. Bluesnarfers can steal data from your phone. But that's only part of the problem. Perhaps the more troubling issue is that these crimes are often untraceable. "The newest threat is the inability to perform forensics on this new technology," says Mark Lobel, director of PricewaterhouseCoopers' security services group. "You can try to stop an employee from doing bad things, but with some of the newest wireless technologies, you can not yet perform the forensics to determine what actually happened." These attacks can really leave you with the "blues," many experts say, so heed this advice: Turn off Bluetooth until you need it.
The cell phone virus. In a recent column, I took a closer look at the growing threat of cell phone infections. Several of the experts I interviewed suggested the worries might be overblown. But in the weeks ince the column appeared, says Ted Demopoulos, an IT consultant with Demopoulos Associates, in Durham N.H., a number of new cell phone viruses were identified. "Experts disagree on how serious the cell phone threats are," he says. "But it is wise to take some simple steps to protect against threats." Demopoulos says most small businesses ignore the data on their cell phones. By backing up the numbers, you can assure that they won't be lost if your phone ever succumbs to a virus outbreak.
#

Wireless network viruses. There are viruses, and then there are wireless viruses. For example, the virus worm MVW-WiFi, which bores into a laptop through a wireless network, sends out wireless probe request packets to find other local wireless networks and then forwards itself to adjacent wireless networks, according to David Sandel, the chief technology officer for NetLabs, LLC, a St. Louis networking company. "Its destructive capabilities are exponential in nature." His advice? Run antivirus software — and keep it updated.

Whether you're using a Bluetooth-enabled Personal Digital Assistant, a cell phone or a laptop, you can steer clear of most trouble by double-checking your security settings. That goes for your small business wireless network, too. Nearly two-thirds of all wireless users are on an unsecured network, according to several surveys. "That's pretty scary," says Scot Zarkiewicz, chief executive of SingleClick Systems, a Toms River, N.J., networking company for small businesses. "If there is one point that small businesses should know about wireless networking, it is that encryption is their best form of protection."

But the biggest wireless security threat, by far, isn't a virus or hacker attack. It is complacency, says Gary Morse, president of Razorpoint Security Technologies, Inc., a New York company that describes itself as "professional hackers." "We hear all the time, 'We're not a target,' or, 'We only need to secure the 'important machines,'" he says. "Awareness is the most critical point of fortification. If users are simply aware of what could take place, of what the true risks are, then everything else could be built on that."

-->Read more...

• 0 comments »

At first, the 802.11b hotspot I sprung for in 2003 seemed so frivolous that I didn't bother mentioning it to clients who visited my office. And since my PC remained wired to a high-speed land connection, I nearly forgot I had installed it.

Then one day I caught an editor who was visiting me as he tried to dial an Internet connection through the phone. I was horrified anyone would revert to dial-up in the 21st century, let alone my supervisor. "Why don't you use the Wi-Fi," I asked him.


It was nothing a wireless card and a password couldn't fix — but it did get me to thinking about the importance of having wireless Internet access in your office, and how that can help boost business.

A number of recent surveys link business productivity with wireless connections. But a 2004 Harris Interactive poll, in particular, caught my attention. It suggested that a quarter of all employees often work outside their regular office. It also said 14% of all office workers wanted more wireless networking tools.

Connect the dots on these two facts, and you could conclude that there's growing demand for wireless connections in small offices like yours. And not just by your own employees, but by visitors. According to industry studies, today's professionals are at their office desks only 30% of the time, and for frequent business travelers, the figure is even lower.

So how do you turn your wired office into a wireless workspace that's not only employee-friendly but also visitor-friendly? Here are six guidelines to follow.

1. Do your homework before you buy. The only thing worse than no wireless network is the wrong wireless network. "The most common mistake, when going wireless is not doing your homework or research before the equipment is bought and installed," says Larry Levy, a wireless troubleshooting expert based in Jacksonville, Fla. He's seen small-office managers pick wireless hardware that couldn't reach every part of the building, leaving big coverage gaps. Especially when it's a custom job using special hardware for encryption, it's important to pay attention to every detail.

2. Listen to your visitors. Are they asking for wireless access — or do they need speed? If your clients drop by your office with the intention of moving large files to and from their laptop computers, for example, then they may care more about bandwidth than convenience. "The assumption is that speed is the main determinant of access point quality," says Derek Kerton, a wireless expert and principal with The Kerton Group in San Jose, Calif. But that's not necessarily valid. An access point needs to be secure, interoperable with all client gear, and have long range, an easy user interface, and good instructions and support. "And if speed really is the goal, then string wire," he adds. "There is one-gigabit copper LAN equipment for sale at reasonable prices. So if speed is the metric, go for copper."

3. Don't confuse Bluetooth for Wi-Fi. Your visitors won't. In an effort to cut costs, some small businesses try to improvise by using Bluetooth as a cheap wireless network. "Bluetooth is designed as a cable-replacement technology, not as a way of linking multiple devices in a peer-to-peer network," says Robyn West, the vice president for small and medium business at Hewlett-Packard. Bottom line: In order to meet visitors' needs, you need both a reliable wireless network and at least a printer with Bluetooth capabilities.

4. Location, location, location. Where you put your access points is especially important when you want to be accommodating to your guests. Even if you've bought the right hardware, you have to put it in a place where it works best. And where's that? "Place your base station, gateway, or router near the center of your intended wireless network area," says Jim Caruso, chief executive officer of Telecom Alley, a technology consulting firm in Atlanta. "This will minimize the possibility of eavesdropping by neighboring wireless networks. Avoid placing wireless components close to electro-magnetic devices, especially those with frequencies in the 2.4-gigahertz range."

5. Remember: safety first. Your PC — and your visitor's PC — is twice as vulnerable to attacks on a wireless connection. It's an especially big problem for do-it-yourselfers, warns Gordon Bridge, president of CM IT Solutions in Austin, Texas. "None of the hardware providers offer on-site support," he says. "They try to make it easy to implement their products, but unfortunately, their products offer little security." Major breaches to the system wouldn't just affect your visitors — they'd affect you, too, since the outsiders would have access to your network. Bridge advises hiring a pro to fine-tune your wireless system.

6. Don't neglect the ongoing care and maintenance of your network. That's a surprisingly easy thing to forget when everyone else in your office generally works on a wired conventional network. But ignore the wireless access points at your own peril, says Todd Myers, the chief executive of Airpath Wireless, a hotspot provider based in Waltham, Mass. He recommends appointing one employee with oversight responsibility for the wireless network. But, he adds, give that person clear marching orders. "Open the network up to the visiting guests — but have it managed and also have it secure for employee network access," he says. "This can be accomplished by segmenting the private network and the public guest network."


For more tips on wireless networking for small offices, see this page.

If most of the employees in your small office remain connected to a conventional network, you might have second thoughts before investing in wireless technology. After all, why shell out perfectly good money for something only your guests are going to use? But that approach is shortsighted, according to Josh Radlein, a technology specialist with CDW Corp. in Vernon Hills, Ill. "We hear frequently that return-on-investment comes from productivity gains and the flexibility to shift people and resources around quickly to optimize available space," he says.

That long-term approach is what Sparkspace, a small business that offers conferencing facilities in Columbus, Ohio, took when it redesigned its office spaces. "I've noticed a high percentage of our guests now have wireless cards in their laptops. It seems like this trend took off almost overnight," says Mark Henson, who manages the facility.

The result? Not only do clients benefit from Wi-Fi. So have Sparkspace's employees. They have more freedom of movement within the office, which has revved up productivity. "And it adds a coolness factor, which fuels the perception of Sparkspace as a hip, cutting-edge kind of place for our guests," he adds. "That's good for PR."

-->Read more...

• 0 comments »

You probably know what a server can do for your office. But do you know what it can do when you're out of the office?

A 2003 survey of Small Business Server users conducted by Lawrence Associates LLC offers a clue. It found that employees were able to perform an average of 20% more revenue-producing tasks, thanks in no small part to functions that allowed them to stay connected to their office computers while they were away.

Ann Westerheim knows about these productivity gains firsthand.
As the president of Ekaru, a Westford, Mass., small-business technology adviser, she's seen the benefits in client after client.

One of her customers is a small law office in which the principal attorney's home is linked to the main office through a server's remote-connectivity features. Another small-business client is a marketing firm with employees constantly on the go.

"Thanks to the server," Westerheim says, "the connection between employees is seamless."

Ask any small-business owner about server technology, and you may get an earful about the complexity of deployment — the costs of hiring a computer guru to pull a network together, buying the right hardware, and so forth. But many server experts today say that's not the problem. Quite the opposite: A product such as Windows Small Business Server 2003 is relatively easy — and painless — to install, they say.

No, they say, the trouble is that today's server software tends to be so rich in features that there's a real chance that some of the best tools for productivity gains might be overlooked — or underused. So if you already have a server, or are considering one, here are a few connections in Windows Small Business Server 2003 you might have missed:

1. You get the mobility features of Exchange. If you're already using Windows Small Business Server 2003, you've probably discovered that it incorporates Microsoft Exchange Server's mobile-office friendly functions, such as its scheduling, contact, and task management. But did you also know that Exchange supports mobile devices such as Pocket PCs and Smartphones? It also allows users to access their e-mail remotely through a simple Web browser, via Outlook Web Access.

Exchange also comes with a few lesser-known benefits that will affect your productivity, like anti-spam and virus protection features. (For more Exchange features, see this overview.)

2. Hey, there's a VPN in there too. The Remote Web Workplace, a robust Web resource for remote users, offers access to e-mail, remote desktops, and your company's internal Web site, and is one of the key connectivity features in Small Business Server. But what you might not know is that the program also includes advanced virtual private network (VPN) capabilities that are easy to turn on. (Incidentally, setting up a VPN is remarkably simple, all things considered. No, you can't do it in three easy steps, but the document available at this page will show you how to do it in 11 steps. See "Manual Configuration of a VPN Remote Access Connection.")

3. Collaborate and share with SharePoint.

You may have also noticed that Small Business Server 2003 uses Windows SharePoint Services, which enables you to collaborate among employees and business partners. For instance, users can post documents into shared libraries and peruse a company's vacation calendar to make sure they're not overlapping with a co-worker's off-time. For mobile workers, Windows SharePoint Services also allows you to synchronize data in Microsoft Office Outlook 2003 with data from SharePoint, so you trade and update leads with a team of co-workers even while you're away. (Here's more on how to do it.)


4. Work safe and secure. The security features in Small Business Server 2003 are pretty impressive. You may have heard that because the program is based on Windows Server 2003, it can mitigate attacks against the server by 60%. You may also know that Small Business Server 2003 includes internal firewalls and that it supports external firewalls. But the security also extends to you and your employees when you're out of the office. Small Business Server 2003 helps make it easy for your entire office to share files across the network, from anywhere, without having to worry so much about security. You also can easily do regular data backups, via the Backup Configuration Wizard. (See this demonstration of Small Business Server's security features.)

For advanced security and Internet connectivity needs, Small Business Server's premium edition includes Microsoft Internet Security and Acceleration (ISA) Server 2000. (For more information about Small Business Server 2003's standard and premium editions, see this page.)

But do you need a server? Not necessarily. Mike Landman, the president of 3rd Wave, an Atlanta-based information-technology solutions provider, says every business isn't a candidate for a server. But most of them are.

"We would recommend a file server for every company over two people," he says. Not only does it offer advanced connectivity features, but it also allows you to perform advanced centralization and backup tasks, he notes. "The productivity gains are quite high."

-->Read more...

• 0 comments »

Many small-business owners shell out big bucks for high-speed Internet access. The savings in time are usually rewarded with higher productivity.

If your high-speed system happens to be running slower than a clogged drain, don't complain just yet. Before you pay for an expensive in-office visit from your Internet service provider's tech support, here are four things you should consider.

1. Know your speed. You can sit at your computer with a stopwatch to see how long it takes to connect to your favorite Web site. But this is not a very good indication of download speed. Believe me, I've tried it. There are too many variables involved. I suggest you call the ISP and ask. The ISP probably can check download speeds on your line remotely. The number you get from the technician will probably be a best case figure; real-world Internet traffic can be bogged down.Or, you can also easily check your speed online, through MSN Tech & Gadgets' Internet speed test. Two other good sites are at BroadbandReports.com (formerly DSLReports) and Bandwidthplace.com. All three sites send data to your computer. The tests calculate the connection speed based upon the elapsed time it takes to download and upload the data.You may receive different results based on which test you use and where that test's server is located. For example, BroadbandReports offers servers throughout the world, while Bandwidthplace's test server is located in Texas. The further away you are from a server, the greater chance you'll encounter bottlenecks.The speed tests can give you a baseline speed. To establish that baseline, test your connection speeds throughout the day and keep a log. If there is a noticeable difference during specific times of the day, you'll be able to troubleshoot better.

2. Start at the source. You could have one of the fastest connections in the world. But if your computers are old, it won't matter much. When surfing the Net, you are downloading information. Some Web sites are simple and don't require much processing power. But most are heavy on graphics and code. A modern, fast chip will process and display the pages quickly.Memory is crucial, too. A Web page is loaded into your computer's memory. If there's not enough memory, some data is saved as a swap file on the hard drive. This can really slow things down, especially if you are running multiple applications. If you are using Windows XP or Windows 2000, you need a minimum of 256 megabytes of RAM. Windows 98 and Windows Me require 64 MB. Don't worry about purchasing a separate video card for your company's computers. Video cards are great for processing intense graphic images you'll encounter in games and video editing. When it comes to the Net, you won't see much difference between a system that uses an integrated video card and one with a video card separate from the motherboard.

3. Clean the cache. If you have the latest and greatest processor with plenty of memory, your Web browser may be causing the slowdown. After weeks spent on the Internet, your Web browser can get bogged down from temporary files. It's time to do some spring cleaning.Go into your Web browser and clear out your history and temporary files. To do this in Internet Explorer, click Tools and Internet Options. On the General tab, click Delete Files (place a check mark next to Delete all offline content) and Clear History.In Netscape, click Edit and Preferences. Under Navigator, find History. Click Clear History. Under Advanced, click Cache. Click Clear Disk Cache.If you're using Apple's Safari, click Safari and Empty Cache. Reboot the computer.

4. Tweak your settings.

You may need to configure your computers' settings to take advantage of broadband. BroadbandReports has a "Tweak Test" that will examine your computer's configuration (from the BroadbandReports home page, click on "Test & Tools" at left). After the test, enter the service you have (cable, DSL, etc.), advertised speed, operating system and connection type. Click recommend.You'll find a series of settings that can be changed along with notes and recommendations. Recommendations are broken into five categories, ranging from "something good" to "big problem." If your computer is not optimized to maximum, you'll probably find that DrTCP is recommended. This is a small, free program at BroadbandReports that acts as a GUI interface into your registry. Before changing any of your settings, I recommend you read the FAQ on the program at the BroadbandReports' site (www.dslreports.com/faq/578). If you are still experiencing unusually slow speeds, you might have to call in an expert. Your ISP's small-business tech support might have to come to your office to evaluate the situation. There may be an internal hardware issue (your router, modem, networking wires, etc.) causing the creeping service. Lagging service can also be caused by the lines outside your company's walls. There are many outside influences that can cause slow-surfing problems. The Internet is a system of countless networks. When delays occur, it's not necessarily your fault.

-->Read more...

• 0 comments »

Mention the words "battery life." The first gadget that comes to mind is probably the energy-consuming laptop computer — particularly if you're on the go a lot.

If not, it should be. There never seems to be enough juice to run your portable PC, as I griped about in a previous article. Ah, but if laptop PCs were the extent of your battery blues, you might not feel so, well, powerless.

But power problems plague other mobile devices. For example, a 2003 In-Stat/MDR survey found that long battery life ranked as the most important feature to business users when selecting a wireless handset. Users of personal digital assistants (PDAs) are just as concerned about a possible energy crisis. I know because I am one and I never seem to stop worrying about running dry.

So, what about mobile gadgets?

How do you make sure your batteries last as long as possible? Here are four tips.

1. Follow instructions and use them right — right from the start. "All batteries should be properly conditioned prior to first use," says Larry O'Connor, chief executive of Other World Computing, a Woodstock, Ill., developer of battery solutions and computer enhancement products. "You must properly prepare the battery by following the first charge and use instructions." And what if you don't? O'Connor warns that failure to follow can shorten the life or runtime of your battery. "Follow the instructions to the letter and that battery will give you a lot more," he says.

2. Don't overcharge them. When it comes to batteries for small devices such as PDAs, cell phones or Tablet PCs, the single biggest mistake users make is leaving them plugged in to the charger for lengthy periods after they've been fully recharged. "Leaving the batteries, at least those types associated with these devices, on charge for endless periods will reduce the overall life of the battery," warns Paul Klatt, a quality assurance engineer for Batteries Plus, a Hartland, Wis., commercial-battery distributor. He says battery chargers normally taper down when the battery is fully charged. "However, enduring weeks of even a 'trickle charge' creates heat buildup and will eventually cause premature battery failure," Klatt says. How do you avoid overcharging? Remove the charger right after the battery is fully charged.

3. Use them at regular intervals.

This is a problem that affects spare batteries, but it can also be a factor on a backup unit, such as a second cell phone. O'Connor says batteries have to be used in order to get the most out of them. "If you have spares, cycle them at least once every six months — or even better, every three months," he says. "This will go a long way in keeping your batteries maintained to properly perform."

4. Stay away from cheap-o replacements. "Quality is very important when it comes to replacement batteries," says Stefan Betesh, vice president of product development for Sakar International, an Edison, N.J., consumer electronic products manufacturer. Many lesser-known but cheaper brands cut corners when they make their batteries. That can affect the overall life expectancy and performance of the battery. Worse, the batteries may be defective because "most low-end batteries are refurbished or just not working with quality control," he says. His recommendation? Go with a recognized brand and buy from a reputable source.

But let's be honest: Keeping your batteries at peak performance is a lot like taking care of an infant. Lots of "dos" and "don'ts" to remember — change this, stay away from that, follow the directions, etc.

Does anyone expect you to do all of this?

Well, not really.

I leave my cell phone charger plugged in overnight from time to time (OK, more than that) and I've never cycled my batteries. Is there a solution for those of us who really couldn't be bothered?

I spoke with Bill Acker, president and CEO of MTI Micro Fuel Cells, an Albany, N.Y., battery manufacturer. He tells me that fuel cells will soon become alternatives to today's high-maintenance lithium-ion batteries. The new technology can hold up to 10 times more of a charge than conventional batteries. "For the first time," he says, "wireless and other electronic hand held devices will be truly wireless." But fuel cell technology and other innovations like it are still a few years away from being widely available. Until then, these four tips can help you stretch your power supply to the limit.

-->Read more...

• 0 comments »

With the growth of online collaboration suites such as GoogleApps, protecting data and sign-on credentials across public networks needs to be a priority.

In 2007, logon details for my personal e-mail account were compromised and used to send spam. While the consequences were minimal (see “User Name and Password Compromised,” below), in a business scenario, a similar incident could lead to lost revenue, breach of trust and even running afoul of the law. The e-mail service was hosted by a third party, but was there anything I could have done to better protect myself?
Never Assume You’re Secure by Default

The use of notebooks on open networks in airports and cafes poses a threat to information security, starting with users’ sign-on credentials. While it would be prudent to use smart card or certificate-based, two-factor authentication, user-name and password-only combinations are still commonplace in many small and medium-size businesses.

It’s often assumed that cloud-based e-mail and collaboration tools are secure by default. Read on to learn about the standard security provisions of popular cloud-based collaboration and e-mail services — Google Apps and Microsoft Office Live — and what you should know before using their services.

Microsoft Office Live Workspace

As you might expect, Office Live Workspace uses Windows Live ID for authentication. Users will be familiar with this system if they’ve ever used Hotmail (now Windows Live Mail) or other services from Microsoft. Previously known as Microsoft Passport, Windows Live ID was intended to provide authentication for all manner of online services against a central database held by Microsoft. However, the concept of any single vendor maintaining such a system, which if breached could give access to multiple sites through a single set of credentials, didn’t go down well with users or service providers. Passport eventually evolved into Windows Live ID, which gives access only to Windows Live and other Microsoft services.

Signing in to Office Live is essentially the same as for Google Apps, but users should be aware that sometimes Office Live defaults to standard security sign-in, meaning that IDs and passwords are transmitted in plain text. Enhanced security mode (Figure 1) uses HTTPS to encrypt IDs and passwords as they’re sent over the wire. Once signed in to Office Live, there is no encryption when viewing or uploading documents over the web interface, but Microsoft is hoping to add Secure Sockets Layer encryption in the future.


Figure 1
Windows CardSpace

One advantage that Office Live has over Google Apps is that Live ID integrates with Windows CardSpace. Part of the .NET Framework and built into Vista, CardSpace manages information cards, which can be created by the user as a form of identification. Information from the card and a site-specific card ID is exchanged with Live ID to be used on a particular site. Once configured, a personal information card (Figure 2) can be used to sign in to Office Live without having to provide a password every time.


Figure 2

A single card can be used to sign in to several sites — for instance, a Windows Live Mail account and an Office Live Workspace (Figure 3) — saving users from having to remember different passwords. Information cards use advanced cryptography to ensure the security of information over the wire. They are used to safeguard against phishing attacks.


Figure 3

The Microsoft Office Live Add-in and Outlook Connector, both applications that integrate Office desktop apps with Office Live services, are not compatible with CardSpace and don’t transfer data using HTTPS after a secure sign-on.

While information cards may not be very portable, it is possible to export cards and transfer them to another machine, and they can be additionally protected with a personal identification number (Figure 4). Live ID support for CardSpace is still in beta, but CardSpace is compatible with any site that works with Open ID.


Figure 4

Microsoft is currently working on the next version of Active Directory Federation Services, code-name Geneva, which will incorporate a new CardSpace identity selector and allow organizations to provide single sign-on facilities that extend to cloud services.
Google Apps

Out-of-the-box sign-on to Google Apps is by user name and password, but unlike Office Live, is not compatible with Windows CardSpace. Nevertheless, Google Apps has a well-supported marketplace where it’s possible to buy third-party authentication services. On the flip side, Google Apps offers data security through HTTPS, ensuring that the contents of e-mail and documents are encrypted over the wire (Figure 5). Be aware that this feature is not enabled by default.


Figure 5

The Premier edition of Google Apps allows sysadmins to enforce the use of SSL connections to protect session data, and there are password management features along with single sign-on capability in the Premier, Education and Partners editions.
E-mail in the Cloud

POP3 and SMTP were around long before the cloud-computing revolution, and there are still advantages to using a mail client, such as Outlook, to manage cloud e-mail, calendaring and contacts. Most web-based access to cloud services will automatically default to securing sign-on credentials using HTTPS, but this is not necessarily the case when using a desktop application. If you’re using SMTP, POP3 or IMAP to connect to Windows Live Mail or Gmail, be sure to follow the instructions carefully for setting up secure connections.

Outlook supports secure IMAP, POP3 and SMTP (Figure 6). These secure protocols can be used to protect both passwords and session data. Secure Password Authentication (SPA), more commonly known as Microsoft NTLM, can be enabled to secure credentials but does not encrypt session data.


Figure 6
IT Takeaway

While large enterprises may be able to afford all the trappings of multifactor security solutions and identity management, small businesses and self-employed entrepreneurs are vulnerable if they don’t understand the implications of exchanging credentials and data across open networks. If your business is also subject to regulatory compliance, you should think twice before sending e-mail or plain-text files when away from the office.

If all these technical details are mind-boggling, a simple solution might be to route Internet traffic through an encrypted virtual private network when using an open network, either to your corporate LAN or to a trusted third party, to ensure that your data and credentials are kept secure.
User Name and Password Compromised

In December 2007, I began receiving an unusually high amount of spam, addressed from myself, on my POP3/SMTP mail. After ignoring this situation for a few weeks, I found myself unable to retrieve POP3 mail. My provider informed me that they’d disabled my account due to the unusually high amount of traffic it was generating on their SMTP servers.

As a user name and password were required to send SMTP mail using my account, I decided to take my password security a little more seriously, disabled all POP3 and SMTP services from the previously compromised account and switched to Gmail, which provides secure IMAP and SMTP/TLS. This way, I could ensure that not only were my sign-on credentials safeguarded, but all information contained within e-mail would be protected when using public networks.


How the Apps Stack Up

Office Live Google Apps
Secure browser sign-on via HTTPS Yes Yes
Secure browser session data No Yes
Enforce session data HTTPS n/a Yes (Premier edition)
Password management features No Yes
Windows CardSpace support Yes No
Secure IMAP No Yes
Secure POP3/SMTP Yes Yes
Outlook integration Yes (Secure credentials but not session data via DeltaSync) No (but Outlook does have secure IMAP for mail only support)
Microsoft Office integration Yes (Secure credentials but not session data) No

-->Read more...

• 0 comments »

Fundamental changes to the migration strategy in Small Business Server 2008 have made the migration process more flexible and less disruptive to end users than in previous versions. While migration to SBS 2008 still requires detailed planning and testing, Microsoft provided a three-week window in which administrators can stage the migration, relieving the pressure to move all applications and user data in one shot.

SBS 2003 and SBS 2008 can now coexist in the same domain for up to 21 days, solely for purpose of easing the migration process. Once migration is complete, the source server is demoted, leaving only one SBS server in the domain per the standard licensing requirements. Because SBS client computers no longer need to be moved from old domain to new, the migration process can be completed during office hours without interruption to end users.

The Active Directory Migration Tool (ADMT) and Exchange Migration Wizard (used for migration to SBS 2003) are gone, and standard Active Directory (AD) and Exchange administration tools can be used to perform migration tasks once the new SBS 2008 server has been joined to the domain. Microsoft supports migration from Windows Server 2003 and SBS 2003, providing extra help for those migrating from SBS 2003 with a wizard that guides sysadmins through post-migration tasks.
Preparing for Migration

SBS 2008 does not include Internet Security and Acceleration Server (ISA) in any form, so before migration you will need to change your network infrastructure to support an Internet router and configure SBS 2003 to use just one network interface.

The SBS 2008 installer will run in migration mode and check for service packs on the following components if they are installed on the source server: Exchange 2003 SP2, Windows Server 2003 SP2, SBS 2003 SP1 and Windows SharePoint Services 2.0 SP3.
Here is a pre-migration checklist:

1. Minimize the amount of data that will be transferred to the new server by asking users to delete all unnecessary e-mail and empty their Deleted Items folders.
2. Make sure that the date, time and time zones match across source and destination servers. On the destination server, check these details in the BIOS.
3. Back up the source server.
4. Install the latest service packs for all server components.
5. Install the .NET Framework 2.0 (or later) on the source server. This is required by the migration tools.



Preparing the Source Domain

The domain and forest functional levels must be raised before running the Source Server Migration Tool. To raise the domain functional level to 2003 on the source server, log on as administrator:

1. Open Active Directory Domains and Trusts from Administrative Tools on the Start menu.
2. Right click your SBS domain in the left pane and select Raise Domain Functional Level from the menu.
3. Windows Server 2003 is the only functional level available, so it already will be selected. Click Raise and then OK to confirm the operation. Click OK once more to complete the task.

Repeat this procedure to raise the forest functional level, right clicking instead on Active Directory Domains and Trusts in the left pane and selecting Raise Forest Functional Level from the menu. Before proceeding, run the SBS 2003 Best Practices Analyzer, which can be downloaded here [http://go.microsoft.com/fwlink/?LinkId=113752], and correct any problems that the tool reports.

Now run the Source Server Migration Tool from the SBS 2008 disk on the source server:

1. Log on with an administrator account that is a member of Enterprise Admins, Schema Admins and Domain Admins.
2. Insert SBS 2008 DVD 1 into the source server and run SourceTool in the tools folder.
3. Confirm that you have made a backup of the source server and click Next.
4. Wait while the tool updates the AD schema, updates licensing and modifies Exchange to run in Native mode. Click Finish once the process has completed, and reboot the server.

The built-in administrator account is disabled by default in SBS 2008, so it’s best practice to create an account for migration purposes. Create a new user account on the source server called migration and make sure that it’s a member of the Domain Admins, Enterprise Admins and Schema Admins groups. Now you’re ready to create an answer file to install SBS 2008 in migration mode:

1. Run sbsafg.exe in the tools folder on the SBS 2008 DVD 1.
2. Select Migration from existing server (Join existing domain).
3. Set the time zone by checking Use the following time zone and select the appropriate zone from the menu.
4. To simplify the process in this walkthrough, uncheck Windows Live OneCare and Forefront Security under Trial security services to prevent them from installing on SBS 2008.
5. Fill out your company, source and destination server information as appropriate (Figure 1).
6. Once all the information is complete, save the file to the root directory of a removable USB drive as sbsanswerfile.xml.


Figure 1
Install SBS 2008 in Migration Mode

1. Boot the SBS 2008 hardware from the SBS 2008 DVD 1 disk.
2. Select your language and regional settings, and click Next to continue.
3. Insert the removable USB drive that contains the answer file and click Install Now.

Follow the setup process for a usual installation of Windows Server, selecting the partition on which to install the operating system, etc. The server will restart twice, and if sbsanswerfile.xml is successfully detected after installation, setup will log on using the migration user specified in the file and continue with an automated setup of the SBS components, using the information provided.
Post-Installation Tasks

Once setup is complete, you’ll be prompted to address any problems detected during installation (Figure 2).


Figure 2

What happens next depends on whether the source server is Windows Server 2003 or SBS 2003. The SBS Console’s Migration Wizard (Figure 3) is only supported if the source server is SBS 2003. The Migration Wizard serves as a guide for sysadmins of what to do and in what order.


Figure 3

While there is no need to migrate user accounts or groups, they do not appear in the SBS Console by default. To remedy this problem, follow the steps below to set the msSBSCreationState attribute on AD user and group objects:

1. Run adsiedit.msc from the Start Search box on the Start menu.
2. Right click ADSI Edit in the left pane of the MMC console, select Connect to from the menu and then click OK to accept the default connection settings.
3. Expand Default Naming Context in the left pane and browse for the group(s) or user(s) you want to add to the SBS Console. Right click the user(s) or group(s) and select Properties from the menu.
4. Select msSBSCreationState on the Attributes Editor tab and click Edit. Change the value to Create, with a capital C, and click OK (Figure 4).


Figure 4
5. Additionally, for groups, you need to set the groupType attribute to define the group as either a security or distribution group. Set the value to –2147483640 for security groups and 8 for distribution groups.

Note that if you upgraded from SBS 2003, you should use the above procedure for groups only, and follow instructions in the Migration Wizard for migrating users. If the source server is Windows Server 2003, the SBS Console can be used to assign roles to migrated users.
Once your users and groups are in order, you should move Exchange mailboxes to the new server, which is an easy task with the Exchange Server 2007 Management Console:

1. Open the Exchange 2007 Management Console on the destination server from All Programs > Microsoft Exchange Server 2007 on the Start menu.
2. Expand Recipient Configuration in the left pane and then click Mailbox.
3. Select all mailboxes in the central pane that display as Legacy Mailbox and click Move Mailbox in the right pane (Figure 5).


Figure 5
4. Click Browse on the first screen of the Move Mailbox Wizard, select the default mailbox database on the destination server and click Next.
5. Configure move options to skip mailboxes with corrupted messages and set the Global Catalog and Domain Controller to be the destination server (Figure 6). Click Next to continue.


Figure 6
6. Opt to begin the move operation immediately and click Next.
7. Review the details on the summary screen and click Move.
8. Check that the move was successful on the completion screen and click Finish.

Mailboxes can be moved to the new server during office hours, but be aware of the extra workload this will put on both source and destination servers. Users can continue working while their mailboxes are being moved; they will be prompted to restart Outlook once the operation is complete. No reconfiguration is required.

The final step is to decommission or repurpose the source server. You should uninstall Exchange and then demote the source server, using dcpromo.exe to change its status to a member server, rather than simply reformatting the disk.
IT Takeaway

Though many of the steps required to migrate to SBS 2008 are still manual, the ability to join the new server to an existing SBS domain helps to ensure that end users will not be disrupted during the migration process, and enables sysadmins to stage the migration over several weeks, minimizing the risk that something could go wrong. With both source and destination servers in one domain, migration tasks are easier and less prone to errors than in previous versions of SBS. SharePoint and SQL databases will also need to be moved if they exist on the source server.

Russell Smith is an independent consultant based in the United Kingdom who specializes in Microsoft systems management.

-->Read more...

• 0 comments »

Quality of Service (QoS) gives you control over how your bandwidth is used, prioritizing critical network traffic (such as streaming media) over less important communication (such as e-mail) and limiting the bandwidth used by specific applications. It can also help cut costs by getting more use of existing bandwidth and enabling network consolidation by combining your phone, videoconferencing and wide area network connections with your Internet connection while minimizing performance problems.
How QoS Works

Routers forward traffic between networks. One of the biggest causes of network performance problems (specifically latency) is router queuing. Queuing occurs when a router needs to forward more traffic to a destination network than the network can handle at one time.

By default, most routers work on a first-in, first-out basis. This works well for Web browsing and e-mail, but if real-time communication sits in a queue for more than a few milliseconds, the quality degrades significantly. For example, if the total latency is more than 150 milliseconds, a Voice over Internet Protocol conversation will cut out.

Consider a small business with a 512-kilobits-per-second Internet connection. If a user makes a VoIP phone call while sending an e-mail, the router won’t be able to immediately forward all the traffic across the DSL connection. With first-in, first-out, some of the VoIP packets would need to wait behind the e-mail packets — adding latency and degrading the quality of the VoIP phone call. With QoS, as shown in the following figure, the router forwards all the high-priority VoIP traffic first, and sends the lower priority e-mail traffic only after the high-priority queue is empty.

What’s New in Windows Vista and Windows Server 2008

Routers can distinguish between high-priority and low-priority packets by examining the Differentiated Services Code Point (DSCP) value in each packet. Unfortunately, previous versions of Windows didn’t give systems administrators control over the DSCP values, and almost all traffic had the default DSCP value of 0.
With Windows Vista and Windows Server 2008, you can use Group Policy settings to mark outgoing network traffic with DSCP values. With this capability, a QoS routing infrastructure, and a few QoS policies, database queries from your critical customer service application can soar past e-mail and Web browsing traffic.

You can also use Group Policy settings to throttle traffic from specific applications. For example, if your outgoing e-mail server is filling up your Internet connection every time you send a mass-mailing, you can throttle the e-mail server to use only half the bandwidth — even if your network infrastructure doesn’t support QoS. Policy-based QoS can be very specific, so you could throttle traffic bound for the Internet but allow traffic bound for computers on your high-speed local area network to use all available bandwidth.

QoS policies are focused on controlling outgoing traffic. While you have much less control over incoming traffic, you can also use Group Policy settings to throttle all incoming Transmission Control Protocol traffic for a computer. So, if downloads to your client computers are using too much bandwidth, you can tune Windows to slow down that incoming traffic.
Adding QoS to Your Network

QoS requires careful planning and coordinated efforts from systems and network administration teams. Before you create your policies, follow these high-level steps to create a plan to add QoS to your network:

1. Prioritize the different types of traffic on your network by assigning a standard DSCP value to each, as the example below shows. You don’t need to use every DSCP value. Any traffic you don’t classify will automatically have a DSCP value of 0, which is considered best effort.
2. Work with your network engineering team to configure routers to prioritize traffic based on the DSCP values you specified. This might already be done; some routers have QoS enabled by default for standard DSCP values.
3. Identify the executable file associated with each traffic type. For example, if you want to assign a DSCP value to packets sent by your Internet Information Services Web server, you would specify the executable inetinfo.exe. If you can’t identify the executable file, identify the TCP or User Datagram Protocol port number that the application uses. Finally, decide whether to apply the DSCP values for all outgoing traffic or for only traffic addressed to specific networks or IP addresses.
Tip: Run the command “netstat -a -b” to identify the executable name associated with all network connections.
4. Configure policy-based QoS using Group Policy Objects (GPOs), as described later in this article.
5. If you identify client computers consuming too much bandwidth with incoming traffic, use GPOs to throttle all incoming traffic on those computers, as described at the end of this article.

Typically, QoS will work only on your internal network. Most Internet Service Providers either remove or ignore DSCP values.
How to Configure Policy-Based QoS

To configure QoS policies, follow these steps:

1. Edit the GPO you want to add the policy to, and select the Computer Configuration\Windows Settings\Policy-based QoS node or the User Configuration\Windows Settings\Policy-based QoS node.
2. Right-click the Policy-based QoS node and click Create New Policy.

The Policy-based QoS Wizard appears.

3. On the Create A QoS Policy page, type a policy name and DSCP value. Optionally, select the Specify Throttle Rate check box, and set a throttle rate in either kilobytes per second or megabytes per second. The value you enter must be in kilobytes or megabytes per second, rather than the more commonly used kilobits or megabits per second. One kilobyte is equal to eight kilobits, and one megabyte is equal to eight megabits. Click Next.
4. On the This QoS Policy Applies To page, select Only applications with this executable name if you can identify a specific executable file. Then, type the executable name. If you can’t identify an executable file (for example, the traffic you want the policy to apply to is generated by a service running in svchost.exe), then leave All applications selected. Click Next.
5. On the Specify The Source And Destination IP Addresses page, leave the default settings to apply the policy to all computers. To apply the policy only to specific computers on your network, select Only for the following source IP address or prefix, and then type the IP address or network that identifies the computers that should use the policy. To apply the policy only to traffic being sent to specific computers or networks, select Only for the following destination IP address or prefix, and then type the destination IP address or network. Click Next.
6. On the Specify The Protocol And Port Numbers page, identify traffic based on TCP or UDP port numbers only if you didn’t specify an executable name. If you are configuring a QoS policy for a server, specify the source port. If you are configuring a QoS policy for a client, specify the destination port. For example, if you want to throttle SMTP traffic from an e-mail server, you would select TCP, select From This Source Port Number Or Range, and then specify port 25 (the port number SMTP uses). Click Finish.

How to Throttle Incoming Traffic

While you don’t have direct control over incoming traffic, Windows can use TCP’s traffic control capabilities to slow down incoming traffic. Unlike the policy-based QoS you just read about, this change affects all applications on a computer (including any critical applications). Because of this limitation, you should leave this setting at the default unless you have a computer that’s slowing down your network by downloading large files.

To specify the inbound TCP throughput level, follow these steps:

1. Edit the GPO you want to configure, right-click Computer Configuration\Windows Settings\Policy-based QoS, and then click Properties.
2. On the Inbound TCP Traffic tab, select the Specify the inbound TCP throughput level check box. Then, a level from 0 (to slow down traffic as much as possible) to 3 (the default setting, which is maximum throughput).
3. Click OK.

Tony Northrup is a developer, security consultant and author with more than 10 years of professional experience developing applications for Microsoft Windows.

-->Read more...

• 0 comments »

Organizations have spent years and invested huge sums of money to secure and protect network resources within their environment. Antimalware applications on the perimeter and at the desktop protect computers from viruses, worms and other malware threats. Network and personal firewalls secure computers against unauthorized network traffic.

The basic, essential layers of security are fairly universal and relatively effective at guarding the network against outside threats and malware attacks. However, a newer threat to network security bypasses the traditional network defenses. Portable media, specifically USB flash drives, are capable of transporting malware and infecting devices on the internal network. They also pose a significant risk of information leakage or data loss.

With capacities up to 8 gigabytes for USB flash drives smaller than a person’s thumb, and even higher capacities available for USB storage devices that fit easily into a pocket, users can store huge amounts of sensitive or confidential data. In addition, the drives’ small size puts them at risk of being stolen, lost or misplaced, which puts the data at even greater risk than if it were on a notebook computer.

Organizations need to take proactive steps to define the acceptable use of portable storage devices such as USB flash drives within the environment, and then put the tools and technology in place to help monitor and enforce the policy and protect the network and data from the risk posed by USB flash drives.
Define Acceptable Use

The first step in restricting or controlling the use of USB flash drives within your environment is to develop a written policy. The policy should outline what, if any, are the acceptable uses for portable storage devices. You should also spell out specific actions that are banned or include a blanket statement that any action not specifically allowed is, by default, banned.
Most organizations already have an acceptable use policy defined, which users must agree to and sign. The acceptable use policy (AUP) essentially defines how users are allowed to use the Internet, e-mail, telephones, and other communications and network resources. Users must read and agree to abide by the AUP. The AUP is an official document that should have the approval and support of both the legal department and the human resources department.

Defining the acceptable use of USB flash drives and other portable storage media, and ensuring that users have read the policy and agree to abide by the policy help educate users about the risks of using portable storage devices and give the organization more solid grounds for taking action against users who abuse or ignore the policy.
Restricting USB Flash Drives

Group Policy is an effective tool for managing computers on your network and enforcing security policies. Unfortunately, there are no default Group Policy settings for restricting or denying the ability to use USB flash drives and other portable storage devices. The good news is that you can extend Group Policy to add that functionality yourself.

Microsoft Knowledge Base article KB 555324 (http://support.microsoft.com/kb/555324) provides detailed instructions to create an administrative template (.adm) file that you can add to Group Policy to enable the ability to block the use of USB flash drives, CD-ROM drives and floppy drives. If you copy the text from the Knowledge Base article (below) into Notepad and save it as an .adm file, you can add the template to Group Policy.

CLASS MACHINE
CATEGORY !!category
CATEGORY !!categoryname
POLICY !!policynameusb
KEYNAME "SYSTEM\CurrentControlSet\Services\USBSTOR"
EXPLAIN !!explaintextusb
PART !!labeltextusb DROPDOWNLIST REQUIRED

VALUENAME "Start"
ITEMLIST
NAME !!Disabled VALUE NUMERIC 3 DEFAULT
NAME !!Enabled VALUE NUMERIC 4
END ITEMLIST
END PART
END POLICY
POLICY !!policynamecd
KEYNAME "SYSTEM\CurrentControlSet\Services\Cdrom"
EXPLAIN !!explaintextcd
PART !!labeltextcd DROPDOWNLIST REQUIRED

VALUENAME "Start"
ITEMLIST
NAME !!Disabled VALUE NUMERIC 1 DEFAULT
NAME !!Enabled VALUE NUMERIC 4
END ITEMLIST
END PART
END POLICY
POLICY !!policynameflpy
KEYNAME "SYSTEM\CurrentControlSet\Services\Flpydisk"
EXPLAIN !!explaintextflpy
PART !!labeltextflpy DROPDOWNLIST REQUIRED

VALUENAME "Start"
ITEMLIST
NAME !!Disabled VALUE NUMERIC 3 DEFAULT
NAME !!Enabled VALUE NUMERIC 4
END ITEMLIST
END PART
END POLICY
POLICY !!policynamels120
KEYNAME "SYSTEM\CurrentControlSet\Services\Sfloppy"
EXPLAIN !!explaintextls120
PART !!labeltextls120 DROPDOWNLIST REQUIRED

VALUENAME "Start"
ITEMLIST
NAME !!Disabled VALUE NUMERIC 3 DEFAULT
NAME !!Enabled VALUE NUMERIC 4
END ITEMLIST
END PART
END POLICY
END CATEGORY
END CATEGORY

[strings]
category="Custom Policy Settings"
categoryname="Restrict Drives"
policynameusb="Disable USB"
policynamecd="Disable CD-ROM"
policynameflpy="Disable Floppy"
policynamels120="Disable High Capacity Floppy"
explaintextusb="Disables the computers USB ports by disabling the usbstor.sys driver"
explaintextcd="Disables the computers CD-ROM Drive by disabling the cdrom.sys driver"
explaintextflpy="Disables the computers Floppy Drive by disabling the flpydisk.sys driver"
explaintextls120="Disables the computers High Capacity Floppy Drive by disabling the sfloppy.sys driver"
labeltextusb="Disable USB Ports"
labeltextcd="Disable CD-ROM Drive"
labeltextflpy="Disable Floppy Drive"
labeltextls120="Disable High Capacity Floppy Drive"
Enabled="Enabled"
Disabled="Disabled"

The default directory for storing templates is %windir\inf. After you have saved the .adm file, you need to import it into Group Policy so that you can apply the settings. Follow the steps below to import it:

1. Using Group Policy Editor, open your GPO (Group Policy Object).
2. Under Computer Configuration, right-click on Administrative Templates.
3. Select Add/Remove Templates.
4. Click Add and browse to the directory where you saved your .adm file.
5. Select your new template and click Open.
6. Click Close to exit the Add/Remove Templates console.

The new settings from your .adm template should now be visible and available for you to use in your GPO. The .adm templates are imported and applied at the GPO level, so you will need to import the .adm template to the GPOs that the computers or users you are trying to manage are linked to.
Encrypt Portable Data

Even if you restrict access to USB flash drives or other portable storage devices through Group Policy, the fact is that these devices are fairly inexpensive, are simple to use, and can increase productivity and efficiency if used properly. Rather than creating a blanket policy that such devices are simply not allowed or implementing a GPO that denies access to portable storage for all Users and Groups, you will probably want to allow their use under certain circumstances and by certain users.

One solution is to issue company-sanctioned USB devices to those users who are authorized to use them. Some devices, such as the Lexar JumpDrive Secure II (http://www.cdw.com/shop/products/default.aspx?EDC=852700), provide password protection and 256-bit AES encryption to protect the data in the event that the device is lost or stolen. Another device, the SanDisk Cruzer Profile (http://www.cdw.com/shop/products/default.aspx?EDC=824282), provides biometric security for your portable data. It comes complete with a fingerprint scanner and requires biometric authentication before providing access to the data it contains.

Alternatively, you can use normal, unencrypted USB flash drives but provide software that will ensure the data stored on them is secure. Pointsec Protector (http://www.cdw.com/shop/products/default.aspx?EDC=1221712) helps you lock down USB ports and can be configured to ensure that any data written to removable storage is properly encrypted. It also provides some flexibility and control over how the data is accessed once it is on the USB flash drive.
Control Access to Data

A broader solution for protecting data and guarding against information leakage or theft is to use Windows Rights Management Services. WRMS will not work for every organization, but it will for organizations that are running Windows Server 2003 networks and rely primarily on Microsoft for their desktop operating systems and office productivity applications.

WRMS allows you to implement security that is persistent and continues to protect the data no matter where the data goes. With WRMS, you can mark an e-mail or a Word attachment as confidential and apply security to control how the information is accessed. You can designate that only certain users can view the information and restrict them from editing, copying, printing, saving or forwarding the information.

If a user does not usually have rights to certain data but needs access to sensitive information for a specific project or deliverable, that access can be provided on a short-term basis with a pre-defined expiration date. Once the expiration passes, the user will no longer be able to access the data even if they have copied it and taken it home to their personal computer.

Diving into all of the functions and benefits of WRMS is beyond the scope of this article. Suffice it to say that WRMS can be a powerful tool in your arsenal for securing data and protecting against information leakage. For more information about WRMS, visit Microsoft’s Windows Rights Management Services Web site: http://www.microsoft.com/windowsserver2003/technologies/rightsmgmt/default.mspx.
Embracing Portable Storage Securely

It might seem simpler to just issue a draconian mandate that portable storage devices are not allowed. Sticking your head in the sand and pretending that USB flash drives don’t exist doesn’t make the risk go away, though. Users still own them and can easily bring them into the office and connect them to computers on your network without your knowledge.

It is much better to embrace the technology. Learn about the advantages of using such devices and understand the risks. Determine how they improve efficiency and increase productivity for your users and define a policy to restrict and control their use to specified users or tasks. Most important, though, for those who ignore policy and bring in USB flash drives from home, or for those who are authorized to use them but lose their USB flash drives or have them stolen, implement security controls and technology to restrict the ability to use them and to secure and protect the data that is stored on USB flash drives.
Tony Bradley, a Microsoft Most Valuable Professional in Windows security, is a computer security consultant with BT INS in Houston and author of Essential Computer Security.

-->Read more...

• 0 comments »

With Group Policy objects, you can change hundreds of default settings in Microsoft Windows — from color schemes to desktop security — and create a complex hierarchy of GPOs to configure settings based on the user and the computer’s location, organization and purpose in Active Directory environments.

Here’s how to define, edit and prioritize multiple local GPOs.

First, not all computers can join a domain. For example, public computers (such as a kiosk in a library) are frequently attacked and could put the entire domain at risk. Windows XP and earlier versions of Windows had a single local GPO that applied settings to the client computer and all users that logged on to the computer. Therefore, if you needed to lock down the desktop environment to prevent guests from opening the Start menu, you also made it impossible to manage the computer when logged on as an administrator.

Windows Vista now supports multiple local Group Policy objects (MLGPOs) so that you can apply different settings to administrators, non-administrators and specific users.
MLGPO Types

Windows Vista supports the following local GPOs:

* Local Computer Policy: Just like earlier versions of Windows, Vista supports local computer policy that always applies, regardless of which user is logged on. This policy contains both the Computer Configuration and User Configuration nodes. All other local GPOs contain only the User Configuration node.
* Administrators Policy: Settings configured in this policy apply only to users who are members of the local Administrators group.
* Non-administrators Policy: Settings apply to all users who are not members of the local Administrators group.
* User-Specific Policies: You can configure GPOs that apply to only a specific user account.

Any user who logs on will have, at most, three local GPOs: the local computer policy, a user-specific policy, and either the administrators or non-administrators policy. Oddly, you cannot create local GPOs that apply to local groups, such as “backup operators” or “guests.”
GPO Priorities

Local GPOs are applied in the following order, with later policies overriding conflicting settings in earlier policies:

1. local computer policy;
2. administrators and non-administrators policies;
3. user-specific policies.

For example, if you set the desktop to blue in the local computer policy but set it to red in the administrators policy, it will appear red when an administrator logs on. If you set the desktop to green in the user-specific policy, that setting would override all other local GPOs.

If the computer is a member of an Active Directory domain, domain GPOs always override conflicting settings in local GPOs. If you want to completely disable local GPOs, enable the following setting in a domain GPO:

computer configuration\administrative templates\system\group policy\turn off local group policy objects processing
To remove a local GPO, right-click it from this dialog box, and then click Remove Group Policy Object.
How to Edit Local GPOs

To edit one of the local GPOs in Vista, log on as a member of the administrators group and follow these steps:

1. Click Start, type MMC, and then press Enter. Respond to the User Account Control prompt that appears.
2. In the blank console, click the File menu, and then click Add/Remove Snap-In.
3. In the Add or Remove Snap-Ins dialog box, under Available Snap-Ins, click Group Policy Object Editor. Then, click Add. The Select Group Policy Object wizard will appear.
4. On the Welcome to the Group Policy Wizard page, click Browse.
5. On the Browse for a Group Policy Object dialog box, choose a GPO:
* Local Computer Policy: On the Computers tab, click This Computer.
* Administrators Policy: On the Users tab, click Administrators.
* Non-administrators Policy: On the Users tab, click Non-administrators.
* User-Specific Policies: On the Users tab, click the user account you want to configure.
6. Click OK, and then click Finish.

You can now use this custom management console to edit the GPO you selected. To simplify editing, add any useful local GPOs to the console, and then save the console for future use.
Copying Local GPOs Between Computers

It’s not as easy as managing GPOs in a domain, but you can copy most GPO settings between standalone computers running Vista. First, use the Group Policy Object Editor to configure the local GPOs on the primary computer. Then, copy the GPO settings to your target computers. The technique you use to copy the data depends on whether your settings are within the Security Settings node or the Administrative Templates node. (Just a reminder: The Group Policy Management Console can be used only with domain GPOs.)
Security Settings

If you edit the local computer policy and update any settings within the computer configuration\windows settings\security settings node, use the secedit command-line tool to copy the settings to the target computers:

1. Export the security settings from the primary computer by running the following command:
secedit /export /cfg secsettings.inf
2. Copy the secsettings.inf file to each of your target computers, and perform a full backup.
3. On each target computer, run the following command to import the security settings from the primary computer:
secedit /configure /db secsettings /cfg secsettings.inf /overwrite
4. To ensure all settings are applied, restart the target computers.

Administrative Templates

If you edit any of the local GPOs and update settings within the Administrative Templates node, manually copy the settings to the target computers by following these steps:

1. For any GPO you edited, copy the contents of the folder listed in the following table to the target computer. These folders are hidden and require administrative privileges to access. For user-specific policies, you must change the folder name to match the service set identifier (SSID) of the user on the target computer.
2. On the target computer, run gpupdate /force to apply the new Group Policy settings.

The registry.pol file stores most of the GPO data. To view these files directly, use the free PolViewer utility available at www.gpoguy.com/polviewer.htm.
GPO Folder
Administrators %windir%\system32\grouppolicyusers\s-1-5-32-544\
Non-administrators %windir%\system32\grouppolicyusers\s-1-5-32-545\
User-specific policies %windir%\system32\grouppolicyusers\\
Local computer policy, computer config. %windir%\system32\grouppolicy\machine\
Local computer policy, user config. %windir%\system32\grouppolicy\user\

Troubleshooting Local GPOs

You can troubleshoot problems with local GPOs using most of the same tools you use for Active Directory GPOs, including:

* Resultant Set of Policy: A Microsoft Management Console snap-in that analyzes all Group Policy settings, displays the effective settings, and allows you to isolate the Group Policy objects that define any setting.
* GPResult: A command-line tool that provides a list of active GPOs, including both domain and local GPOs, among other useful information.
* Event Viewer: Vista adds an event to the System Event Log when policies are applied, and stores detailed processing information in the applications and service logs\microsoft\windows\group policy\operational event log. The Operational Event Log replaces the userenv.log file used in earlier versions of Windows.
* Group Policy Log View: A tool that exports Group Policy event data into a text file. You can download GPLogView at go.microsoft.com/fwlink/?LinkId=75004.

IT Takeaway

GPOs are the most efficient way to configure the hundreds of settings on a Windows computer. XP and earlier versions of Windows had only a single local GPO, and any settings configured in that GPO applied to all users. Therefore, you couldn’t use the local GPO to harden the desktop environment because you would also prevent administrators from managing the computer.
•Vista solves this problem by providing three levels of local GPOs: the local computer GPO, the administrators and non-administrators GPOs, and GPOs for individual users.
• With Vista, you can lock down a computer without locking yourself out.


Tony Northrup is a developer, security consultant and author with more than 10 years of professional experience developing applications for Microsoft Windows.

-->Read more...

• 0 comments »

Photo: Richard Robinson
A document management system comes in handy in case of an audit, says Member One Federal Credit Union IT Specialist Tonya McEnheimer.
Most businesses work with more documents than ever, and managing them all is often a costly and complex process.

“There is a demand within our credit union for document management,” says Tonya McEnheimer, information technology specialist at Member One Federal Credit Union in Roanoke, Va. “Paper is challenging. We do not have enough space for it, and it would be a big help to have a document management system, so that we could retain data and documents and retrieve them immediately if we were audited or if a member needed a document.”

Windows SharePoint Services 3.0 is a free Web-based application from Microsoft for Windows Server 2003 that provides collaboration, workflow, document management and security features through a Web browser or via direct integration with Microsoft Office XP 2007. WSS allows users to create virtual work spaces for individual projects that can be used, among other things, to store and manage related documents. Document work spaces contain a default document library, called Shared Documents. Each document library can have individual settings that control functions, such as document versioning and security.

But while it is free, WSS is resource intensive and requires a server with a minimum of 1 gigabyte of random access memory. WSS introduces an extra level of complexity, especially having to maintain a database, which will require extra work from the IT department.

This product is a good fit for organizations, such as Member One. “We run a financial platform to process transactions with its set of rules, and Microsoft for just about everything else,” says McEnheimer. “We keep one drive open for end users and use it for storing documents, and we restore those documents from tape backups.”

WSS includes document versioning, approval, document check in/out and control on copying and distributing documents. Here are the basic steps for developing a secure WSS environment:
1) Creating a Document Management Work Space

Once WSS has been installed, the first task is to log onto the default top-level Team Site (using the account that you used to install WSS, which is the first default WSS user) and create a document work space (essentially a sub-site of Team Site) for a new project: Project X. The top-level Team Site will be opened automatically once the configuration wizard has completed. You can browse to the site anytime by simply typing http://<> into a browser window. It is also necessary to add this site to the list of Trusted Sites under the security tab in the Internet Options control panel applet if you are browsing the site from the server.

From the Team Site home page, click Site Actions, and select Create. Under Web Pages, select Sites and Work Spaces. In the New SharePoint Site window, you will be able to configure various options for the new work space. Give it a title (Project X) and URL (projectx). Select Document work space as the template.
2) Configuring Security

There are two options for configuring security on the new work space. In a simple environment, it is likely that you will have one top-level site with several work spaces. Let’s assume that each work space will have access restricted to a specific group of users. In this scenario, it is best to select Use unique permissions. Leave the navigation options as default, and press Create.

One of the biggest advantages of using WSS to manage document security is that it allows trusted users to control access to document libraries, or individual documents, rather than relying on the IT department to configure access control lists on files and folders. Transferring this responsibility should be made with careful consideration, however.

The Set Up Groups for this Site window allows you to set up three basic groups for controlling user access. Visitors are allowed to view documents, members may create new and edit existing documents, and owners have full control over the work space. It is possible to configure granular security down to individual documents, but the simpler you can keep things, the better. To start with, these three basic groups should suffice. By default, a new group unique to the new work space will be created for members and owners. To configure a unique group for visitors to the Project X work space, rather than allow visitors who are granted view permission to the top-level Team Site to view content in the Project X work space, simply select Create a new group, and a default name will be assigned. Press OK.

Let’s add a user to the Project X Members group. From the Project X home page, select Add new user where it says Groups. In the Users/Groups box, you can add a user to a specified group by entering the user’s name in the following format: \user. Press the Check names icon under the box, and your entry should be underlined if it can be matched. Make sure Add users to a SharePoint Group is selected under Give permissions, and select Project X Visitors [Read] from the menu. Press OK.

It may be necessary to access your work space through its unique URL rather than via the top-level Team Site, for instance, http://<>/projectx. It will depend on the account you are using to access the site and whether it has access to the top level.
3) Configuring Document Versioning, Check I/O and Approval

From the Project X home page, click the default Shared Documents library, and then Settings > Document Library Settings. Under General Settings, select Versioning settings. Configure the settings shown in the table below, and press OK.
Content Approval Yes
Document Version History Create Major and Minor Versions
Require Checkout Yes

Go back to the Project X home page, and select Add a new document under the Shared Documents library. After adding a new document, you will see that it is necessary to check the document in to WSS. You can check it in immediately to allow others to edit it by clicking Check In. You can now edit the document in Word by clicking on the document icon on the Project X home page. If you are using Word 2007, you will notice that it is necessary to check the document out before you can edit it. Simply click on the Check Out button at the top of the screen. You will be notified that you are now working with an offline copy of the document, so you can disconnect from the network and continue working until you’re ready to check the document back in with WSS. The document management pane in Word 2007 gives you the opportunity to check the document back in to WSS when you are ready. Publish a new major version, and press OK.

If you return to the WSS Project X home page and view the document’s history from the drop down menu, you will see there are now two versions of the document: the original draft (version 0.1) and the new major version (version 0.2), which is pending approval. Once the document has been approved, version 0.2 will become version 1.0 automatically. You need to have appropriate rights in order to approve a document, which can be done from the same drop-down menu used to view the document’s history.
4) Working with Document Libraries Offline

If you have Outlook 2007, you can take whole document libraries offline by clicking on the document library from the work space home page (shared documents in this case), and in the Actions menu select Connect to Outlook. You will be presented with a new folder in Outlook that contains a list of documents from the library. You can then edit any document offline, and when you reconnect to the network, simply open the document from Outlook, and you have the option to upload the modified version to WSS.
5) Document Backup and Recovery

Backup of WSS, its database and all other components, is straightforward. From the SharePoint 3.0 Central Administration site, which can be found under administrative tools in the control panel, log on as an administrator, select the Operations tab and then Perform a backup. If you select the top level (Farm), everything required to restore WSS to its present state will be backed up. Continue to Backup Options from where you can choose the type of backup and the file location. There is a command-line tool (stsadm.exe), which can be used to automate various WSS operations including backup.

WSS Version 3 contains a two-stage recycle bin. The Project X work space contains a user recycle bin where items are retained for 30 days if a user deletes a document. There is also a site recycle bin where items that are purged from the user’s recycle bin can be found and restored if necessary by an administrator. This facility should minimize the need to restore documents from backup and further protect critical business data.

But McEnheimer says this feature makes it easier to retrieve documents that users delete by mistake. “A common problem for end users is the mistaken deletion of an important document,” she says. “If the recycle bin has been emptied, the last resource is retrieval from a stored backup, which is very time consuming. WSS gives IT staff a break by allowing quick and easy access to deleted files.”

From the work space (or user) recycle bin, which can be found in the menu on the Project X home page, you can select Site Collection Recycle Bin from the top of the screen. At the Site Collection Recycle Bin, you then need to select Deleted from end user Recycle Bin under Select a View. If you choose to restore a document from the Site Collection Recycle Bin, it will be put back to its original location in the work space.
Hardware Requirements for WSS

Hardware requirements for Windows SharePoint Services 3.0 vary depending on many factors, such as how WSS is deployed (e.g., standalone or farm installation), the number of concurrent users and the volume of documents that need to be stored. Before deciding on how to deploy WSS and what hardware specifications will be required, it is important to understand how WSS will be used. For a standalone WSS installation, during which the Web application and database are running on the same server, 2 gigabytes of RAM are recommended with dual processors 3 gigahertz or faster.

Make sure you plan for future growth from the outset. If you want to store 100GB of documents, you need to have 130GB of disk space available for Structured Query Language server. If you decide to enable document versioning, a copy of each version is stored in the database. You also need to take into account the space required for database log files and consider leaving 25 percent free disk space on each volume. To help control the amount of disk space used, you can create quotas for SharePoint sites to limit the amount of storage they will use. Warning e-mails may also be sent when the amount of storage used reaches a given level.

If WSS is to be used intensively or you require flexibility for future growth, WSS may be installed in a server farm topology, in which the front-end and database server roles are hosted on one or more computers. The recommended hardware requirements for the front-end server (the server that hosts the WSS Web application) are the same as for a standalone WSS installation. Requirements for the database server are that it should host SQL Server 2000 SP3a, or higher, or SQL Server 2005 SP1, or higher. Recommended processor requirements for the standard edition of SQL Server 2005 are a single processor 1GHz, or faster, and a minimum 1GB of RAM. Realistically, these are minimum requirements, however.

To determine whether your WSS installation is secure and set up correctly, you can run the Best Practices Analyzer for WSS against your server. This tool may be accessed at http://go.microsoft.com/fwlink/?LinkID=83335&clcid=0x409.

The tool is run from the command line and generates an HTML report. Simply run the downloaded executable and extract the files to a convenient directory. From the command line, change the working directory to the location where the files were extracted from and run the following command:

sharepointbpa.exe -cmd analyze -substitutions SERVER_NAME

Replace with the name of the WSS server. The report will be generated in the same directory, detailing any issues with the configuration.

Additional security is provided with the ability to block certain file types from being stored in the WSS database. From Central Administration > Operations > Blocked File Types, you may add or remove file extensions to determine whether users can save and/or retrieve certain file types.


IT Takeaway
• Will Your Users Really Benefit from WSS?
WSS introduces many useful features, but you should consider whether it would benefit your users and whether they will need training to use it. It is not the most intuitive system. Consider the way your users work with documents and how security is managed by the IT department on your file servers. How does this compare with the facilities WSS has to offer?
• Consider the Extra Resources and Increased Costs Involved in Hosting WSS
WSS is resource intensive and requires a server with a minimum of 1GB of RAM. WSS introduces an extra level of complexity, which will require extra work from the IT department.
• What Is the Difference Between Windows SharePoint Services and SharePoint Portal Server?
SharePoint Portal Server is based on and requires Windows SharePoint Services. It lets large organizations integrate multiple WSS sites and applications into one portal with advanced features, such as search indexing across multiple sites and single sign-on.

-->Read more...

• 0 comments »

BizTech’s crack team of information technology professionals offers 10 guaranteed proven techniques that will enable your desktops to move as if they were powered with Flintstone-era technology instead of dual-cores. If you recognize any of these end-user behaviors, you can share the consequences and help others avoid bringing their machines to a screeching halt.

1 Ignore patch updates.
Who needs a stinking patch? Never patch your computer using Microsoft Corp.’s update utility. None of the latest viruses or other forms of malware ever take advantage of these vulnerabilities anyway. Besides, you’re smart enough to know those patches are part of the Microsoft Evil Conspiracy.
–Dr. Jeff Sheen, senior corporate network engineer for Sogeti

2a Visit gambling sites.
Many gambling Web sites will expect you to — and in some cases trick you into downloading software in order to play. While this software in many cases isn't malicious, some will sit in your system tray even when you aren’t playing and can inundate you with pop-ups and “free offers,” all the while soaking up memory and degrading your system’s overall performance.
– Jason Holbert, Tier II desktop support technician at Harcros Chemicals

2b And don’t forget the porn sites.
Similar to their gaming cousins, lots of porn sites will open all kinds of windows and pop-ups in addition to tricking you into downloading applications. These applications sometimes transmit data regularly to other Web sites. This robs you of computing cycles, and slows performance while increasing security risks.
– Jeff Gross, author of Texxors.com

3 Ignore EULA’s and Privacy Policies (especially on free software).
It’s free, after all, so why bother reading the End-User License Agreement and all that legal stuff? Except that you’ll often find that, along with your “free” program, anywhere from 15 to 20 other files are installed from various adware vendors. There are a few great and truly free programs out there, but typically adware is the difference between the free and paid versions of software.
– Phil Leiter, IT manager at Cumberland Associates LLC

4Download free screensavers, toolbars, browser helpers, unknown cleaners and any software offered from pop-up ads.
Since you’ve decided to ignore the EULA, these are the programs for you. Remember, if it costs nothing, it’s usually worth nothing. Even toolbars bundled from legitimate sources such as Google will rob you of computing cycles.
– Jeff Gross

5Download peer-to-peer file-sharing clients.
Since peer-to-peer relies primarily on the computing power and bandwidth of the active users within the P2P network, it has the potential to consume huge amounts of PC resources in the form of CPU cycles and memory, which, in turn, can tax the average system to the point where it slows to a crawl. So download Limewire and Kazaa onto your work desktop, which can effectively punch a huge hole in your security schema by bypassing your company’s firewall. Misconfigurations can result in wide open TCP/IP ports, a notorious method of introducing malware or spyware into a network. Once infected, one PC can infect other PCs on the network.
–Douglas Schweitzer, an Internet security specialist and author of several information security books

6Open as many programs as possible for as long as possible.
Computers are capable of doing many millions of things at a time, so running lots of programs that are unnecessary or fun will only add to your own enjoyable day. If you get enough programs running, you will even get built-in breaks during the day while your porn loads. Whatever you do, don’t run defrag or reboot the system. Rebooting will only force you to re-download all of those picture files again, and since it took so long the first time, you’d only lose productivity, right?
–Dave Howe, vice president of systems at Howe Lumber Co.

7Load up your System Tray
Nothing says “Ready to Go!” like 20 little icons standing by in the System Tray. Great examples of these are animated cursors and screen shots. Except that all of those little icons represent programs running in the background and taking away resources before you start your first program. Most of these programs are a part of larger applications — the annoying and often unnecessary part. Get the System Tray under control by running MSCONFIG, click the Startup tab and uncheck the programs you know are not critical. (Unchecking does not delete the program, but prevents it from starting).
– Phil Leiter

8Keep drivers from old printers.
Keeping old print drivers running in the background will slow things down. Many printers have toolbox programs that run and wait for print jobs or monitor the condition of your printer. And you guessed it — it’s using resources. Get rid of them. Even for printers you have, it’s only necessary to run the basic driver without installing tons of other stuff. If you don’t use the printer, remove the driver, the software toolbox and whatever else is associated with it.
– Jeff Gross

9Run lots of Internet video loops.
Everyone loves blooper reels and funny videos. Have them on constantly, so when coworkers come by, you can show them the latest and funniest. Don't worry that there won't be people walking by, because they are sure to be hunting for the IT person since their Internet is running slowly at the moment also.
– Dave Howe

10Keep your PC warm.
Try to place your desk as close as you can to a radiator or baseboard to keep your feet and PC warm. If you have a desk with one of those cut-outs for a PC, be sure to push it as far back as possible to keep the case exhaust air from blowing all over the place. Use the top of the PC, or any space in front of it, to store books and papers and such. In no time your PC will fill with dust and the overheating will bring your system to a screeching halt.
– Phil Leiter

-->Read more...

• 0 comments »

Troubleshooting problems often requires you to look at dozens of different settings, and that’s if you can even remember all of the important settings. In Windows Vista, you can use data collector sets to quickly capture a snapshot of a computer’s configuration, including the following:

* System state
* Registry values
* Log files
* Configuration files
* Windows Management Instrumentation (WMI) management paths
* Performance counter data
* Event trace data

Windows Vista includes built-in data collector sets that you can use to capture information about a system’s status, or you can create your own data collector sets to capture custom settings and log files. These data collection sets can help you streamline the troubleshooting process in your organization, even if the problems relate to custom applications.

First, create the data collector set on your computer based on one of the existing templates, and add custom data collectors to gather any files or registry keys used by internal programs. Then, use the Logman tool to export the data collector set to a file. Distribute that file to the computers you manage, and run Logman again to import the file. Data collector sets never forget to check an important setting, so they can substantially increase thoroughness of troubleshooting while decreasing the time it takes to solve a problem.
Built-in Data Collector Sets

Windows Vista includes the following data collector sets:

Local Area Network Diagnostics: Use this data collector set for troubleshooting problems with wired network connections. It logs network configuration data, network performance counters, and performs network diagnostics tracing.

Wireless Diagnostics: Use this data collector set for troubleshooting problems with wireless network connections. It logs the same data as LAN Diagnostics, and adds wireless network information.

System Performance: Use this data collector set if your Windows Vista computer is having random slowdowns, unexplained paging, or short battery life. It logs processor, memory, disk, and network performance counters, and performs kernel tracing.

System Diagnostics: Use this data collector set for general hardware or software troubleshooting, including Stop errors (also known as blue screens), hardware problems, and driver failures. It logs the same data as System Performance, and adds detailed system configuration information.
Figure 1: Access data collector sets from the Computer Management console or from the Reliability And Performance console.
How to Use the Standard Data Collector Sets

To use the built-in data collector sets, follow these steps:

Click Start, right-click Computer, and then click Manage. Respond to the User Account Control prompt that appears.

In the Computer Management console, expand System Tools, Reliability And Performance, Data Collector Sets, and then System.

Right-click a data collector set and then click Start, as shown in figure 1. A green arrow appears over the data collector set’s icon, indicating that it is currently running. Eventually, the green arrow will change to an hourglass while the data is being processed.

After the data collector set has finished running (or after you right-click it and click Stop), right-click the data collector set again, and then click Latest Report.
Figure 2: Reports summarize the results found by the data collector set.

Windows Vista displays the report generated by the data collector set, as shown in figure 2.
How to Create Custom Data Collector Sets

The built-in data collector sets are perfect for troubleshooting general computer and networking problems. While they might log far more data than you really need, there is little chance that any settings or counters related to the core operating system are missing.

What the built-in data collector sets will not capture is information about your applications. Fortunately, you can create your own custom data collector set based on one of the built-in data collector sets, and extend it to capture registry settings, log files, and configuration files for the applications you troubleshoot most. To create a custom data collector set, follow these steps:

In the Computer Management console, expand System Tools, Reliability And Performance, and Data Collector Sets. Right-click User Defined, click New, and then click Data Collector Set. The Create New Data Collector Set wizard appears.

On the “How Would You Like To Create This New Data Collector Set?” page, type a name and click Next.
Figure 3: Most custom data collector sets should be based on one of the standard templates.

On the “Which Template Would You Like To Use?” page, click one of the templates. Click Finish, as shown in figure 3 (the remaining wizard pages are not important).

By default, your custom data collector set will have all of the data collectors from the template.

Add your own ata collectors by following these steps:

In the Computer Management console, expand User Defined. Right-click your custom data collector set, click New, and then click Data Collector. The Create New Data Collector appears.

On the “What Type Of Data Collector Would You Like To Create?” page, type a name, click one of these options, and then click Next:

Performance counter data collector: Logs performance counters, such as processor or network utilization.

Event trace data collector: Stores event trace information from a Windows Vista event trace provider. Typically, you should add all event trace data collectors that might be related to a problem, because it is better to have too much information than not enough.

Configuration data collector: Stores registry keys, WMI management paths, or the system state.

Performance counter alert: Creates an alert if a performance counter reaches a threshold that you specify.

Follow the prompts that appear to create your data collector.

Configure your data collector set to automatically run at a scheduled time, to stop running after a number of minutes, or to launch a task after running by following these steps:

Right-click your custom data collector set, and then click Properties.

On the Properties dialog box, click the Schedule tab. Using this tab, you can configure your data collector set to automatically run on a scheduled basis. This is useful for proactively monitoring computers. For example, you could configure a data collector set to run daily. Then, if a user experienced a problem that started several days ago, you could look through the recorded reports to determine what may have changed.

Click the Stop Condition tab. Use this tab to configure how long the data collector set runs for.

Click the Task tab. Use this tab to configure a task to run after the data collector set. Use Task Scheduler to create a task that will run. For example, you might create a task that sends the report to you as an attachment to an e-mail message.

Click OK to close the Properties dialog box.

For example, to capture the Office 2007 configuration settings, select Configuration data collector in the Create New Data Collector wizard, and then specify the HKEY_CURRENT_USER\Software\Microsoft\Office registry key to capture all Office-related settings. Then, to capture Word’s Normal template, view the data collector’s properties, click the File Capture tab, and add the %appdata%\microsoft\templates\normal.dot path.

As with the built-in data collector sets, you can generate a report by right-clicking your custom data collector set, and then clicking Start.
Automating Data Collection Set Configuration and Capturing

Of course, you wouldn’t want to manually create a data collector set on every computer. Once you create a data collector set on one computer, use the Logman.exe command-line tool to export the data collector set to a file:

Logman export -n "Office 2007 Configuration" -xml "Office 2007 Configuration.xml"

Then, you can store the XML file on a central server and use a logon script to add the data collector set to computers with a command, such as the following:

Logman export -n "Office 2007 Configuration" -xml \\server\share\Office 2007 Configuration.xml

Lastly, you can use the “Logman update” command to replace an existing data collector set, or use “Logman start” and “Logman stop” to control data collection.
Tony Northrup is a developer, security consultant and author with more than 10 years of professional experience developing applications for Microsoft Windows.

-->Read more...

• 0 comments »