With the growth of online collaboration suites such as GoogleApps, protecting data and sign-on credentials across public networks needs to be a priority.

In 2007, logon details for my personal e-mail account were compromised and used to send spam. While the consequences were minimal (see “User Name and Password Compromised,” below), in a business scenario, a similar incident could lead to lost revenue, breach of trust and even running afoul of the law. The e-mail service was hosted by a third party, but was there anything I could have done to better protect myself?
Never Assume You’re Secure by Default

The use of notebooks on open networks in airports and cafes poses a threat to information security, starting with users’ sign-on credentials. While it would be prudent to use smart card or certificate-based, two-factor authentication, user-name and password-only combinations are still commonplace in many small and medium-size businesses.

It’s often assumed that cloud-based e-mail and collaboration tools are secure by default. Read on to learn about the standard security provisions of popular cloud-based collaboration and e-mail services — Google Apps and Microsoft Office Live — and what you should know before using their services.

Microsoft Office Live Workspace

As you might expect, Office Live Workspace uses Windows Live ID for authentication. Users will be familiar with this system if they’ve ever used Hotmail (now Windows Live Mail) or other services from Microsoft. Previously known as Microsoft Passport, Windows Live ID was intended to provide authentication for all manner of online services against a central database held by Microsoft. However, the concept of any single vendor maintaining such a system, which if breached could give access to multiple sites through a single set of credentials, didn’t go down well with users or service providers. Passport eventually evolved into Windows Live ID, which gives access only to Windows Live and other Microsoft services.

Signing in to Office Live is essentially the same as for Google Apps, but users should be aware that sometimes Office Live defaults to standard security sign-in, meaning that IDs and passwords are transmitted in plain text. Enhanced security mode (Figure 1) uses HTTPS to encrypt IDs and passwords as they’re sent over the wire. Once signed in to Office Live, there is no encryption when viewing or uploading documents over the web interface, but Microsoft is hoping to add Secure Sockets Layer encryption in the future.


Figure 1
Windows CardSpace

One advantage that Office Live has over Google Apps is that Live ID integrates with Windows CardSpace. Part of the .NET Framework and built into Vista, CardSpace manages information cards, which can be created by the user as a form of identification. Information from the card and a site-specific card ID is exchanged with Live ID to be used on a particular site. Once configured, a personal information card (Figure 2) can be used to sign in to Office Live without having to provide a password every time.


Figure 2

A single card can be used to sign in to several sites — for instance, a Windows Live Mail account and an Office Live Workspace (Figure 3) — saving users from having to remember different passwords. Information cards use advanced cryptography to ensure the security of information over the wire. They are used to safeguard against phishing attacks.


Figure 3

The Microsoft Office Live Add-in and Outlook Connector, both applications that integrate Office desktop apps with Office Live services, are not compatible with CardSpace and don’t transfer data using HTTPS after a secure sign-on.

While information cards may not be very portable, it is possible to export cards and transfer them to another machine, and they can be additionally protected with a personal identification number (Figure 4). Live ID support for CardSpace is still in beta, but CardSpace is compatible with any site that works with Open ID.


Figure 4

Microsoft is currently working on the next version of Active Directory Federation Services, code-name Geneva, which will incorporate a new CardSpace identity selector and allow organizations to provide single sign-on facilities that extend to cloud services.
Google Apps

Out-of-the-box sign-on to Google Apps is by user name and password, but unlike Office Live, is not compatible with Windows CardSpace. Nevertheless, Google Apps has a well-supported marketplace where it’s possible to buy third-party authentication services. On the flip side, Google Apps offers data security through HTTPS, ensuring that the contents of e-mail and documents are encrypted over the wire (Figure 5). Be aware that this feature is not enabled by default.


Figure 5

The Premier edition of Google Apps allows sysadmins to enforce the use of SSL connections to protect session data, and there are password management features along with single sign-on capability in the Premier, Education and Partners editions.
E-mail in the Cloud

POP3 and SMTP were around long before the cloud-computing revolution, and there are still advantages to using a mail client, such as Outlook, to manage cloud e-mail, calendaring and contacts. Most web-based access to cloud services will automatically default to securing sign-on credentials using HTTPS, but this is not necessarily the case when using a desktop application. If you’re using SMTP, POP3 or IMAP to connect to Windows Live Mail or Gmail, be sure to follow the instructions carefully for setting up secure connections.

Outlook supports secure IMAP, POP3 and SMTP (Figure 6). These secure protocols can be used to protect both passwords and session data. Secure Password Authentication (SPA), more commonly known as Microsoft NTLM, can be enabled to secure credentials but does not encrypt session data.


Figure 6
IT Takeaway

While large enterprises may be able to afford all the trappings of multifactor security solutions and identity management, small businesses and self-employed entrepreneurs are vulnerable if they don’t understand the implications of exchanging credentials and data across open networks. If your business is also subject to regulatory compliance, you should think twice before sending e-mail or plain-text files when away from the office.

If all these technical details are mind-boggling, a simple solution might be to route Internet traffic through an encrypted virtual private network when using an open network, either to your corporate LAN or to a trusted third party, to ensure that your data and credentials are kept secure.
User Name and Password Compromised

In December 2007, I began receiving an unusually high amount of spam, addressed from myself, on my POP3/SMTP mail. After ignoring this situation for a few weeks, I found myself unable to retrieve POP3 mail. My provider informed me that they’d disabled my account due to the unusually high amount of traffic it was generating on their SMTP servers.

As a user name and password were required to send SMTP mail using my account, I decided to take my password security a little more seriously, disabled all POP3 and SMTP services from the previously compromised account and switched to Gmail, which provides secure IMAP and SMTP/TLS. This way, I could ensure that not only were my sign-on credentials safeguarded, but all information contained within e-mail would be protected when using public networks.


How the Apps Stack Up

Office Live Google Apps
Secure browser sign-on via HTTPS Yes Yes
Secure browser session data No Yes
Enforce session data HTTPS n/a Yes (Premier edition)
Password management features No Yes
Windows CardSpace support Yes No
Secure IMAP No Yes
Secure POP3/SMTP Yes Yes
Outlook integration Yes (Secure credentials but not session data via DeltaSync) No (but Outlook does have secure IMAP for mail only support)
Microsoft Office integration Yes (Secure credentials but not session data) No

-->Read more...

• 0 comments »

Fundamental changes to the migration strategy in Small Business Server 2008 have made the migration process more flexible and less disruptive to end users than in previous versions. While migration to SBS 2008 still requires detailed planning and testing, Microsoft provided a three-week window in which administrators can stage the migration, relieving the pressure to move all applications and user data in one shot.

SBS 2003 and SBS 2008 can now coexist in the same domain for up to 21 days, solely for purpose of easing the migration process. Once migration is complete, the source server is demoted, leaving only one SBS server in the domain per the standard licensing requirements. Because SBS client computers no longer need to be moved from old domain to new, the migration process can be completed during office hours without interruption to end users.

The Active Directory Migration Tool (ADMT) and Exchange Migration Wizard (used for migration to SBS 2003) are gone, and standard Active Directory (AD) and Exchange administration tools can be used to perform migration tasks once the new SBS 2008 server has been joined to the domain. Microsoft supports migration from Windows Server 2003 and SBS 2003, providing extra help for those migrating from SBS 2003 with a wizard that guides sysadmins through post-migration tasks.
Preparing for Migration

SBS 2008 does not include Internet Security and Acceleration Server (ISA) in any form, so before migration you will need to change your network infrastructure to support an Internet router and configure SBS 2003 to use just one network interface.

The SBS 2008 installer will run in migration mode and check for service packs on the following components if they are installed on the source server: Exchange 2003 SP2, Windows Server 2003 SP2, SBS 2003 SP1 and Windows SharePoint Services 2.0 SP3.
Here is a pre-migration checklist:

1. Minimize the amount of data that will be transferred to the new server by asking users to delete all unnecessary e-mail and empty their Deleted Items folders.
2. Make sure that the date, time and time zones match across source and destination servers. On the destination server, check these details in the BIOS.
3. Back up the source server.
4. Install the latest service packs for all server components.
5. Install the .NET Framework 2.0 (or later) on the source server. This is required by the migration tools.



Preparing the Source Domain

The domain and forest functional levels must be raised before running the Source Server Migration Tool. To raise the domain functional level to 2003 on the source server, log on as administrator:

1. Open Active Directory Domains and Trusts from Administrative Tools on the Start menu.
2. Right click your SBS domain in the left pane and select Raise Domain Functional Level from the menu.
3. Windows Server 2003 is the only functional level available, so it already will be selected. Click Raise and then OK to confirm the operation. Click OK once more to complete the task.

Repeat this procedure to raise the forest functional level, right clicking instead on Active Directory Domains and Trusts in the left pane and selecting Raise Forest Functional Level from the menu. Before proceeding, run the SBS 2003 Best Practices Analyzer, which can be downloaded here [http://go.microsoft.com/fwlink/?LinkId=113752], and correct any problems that the tool reports.

Now run the Source Server Migration Tool from the SBS 2008 disk on the source server:

1. Log on with an administrator account that is a member of Enterprise Admins, Schema Admins and Domain Admins.
2. Insert SBS 2008 DVD 1 into the source server and run SourceTool in the tools folder.
3. Confirm that you have made a backup of the source server and click Next.
4. Wait while the tool updates the AD schema, updates licensing and modifies Exchange to run in Native mode. Click Finish once the process has completed, and reboot the server.

The built-in administrator account is disabled by default in SBS 2008, so it’s best practice to create an account for migration purposes. Create a new user account on the source server called migration and make sure that it’s a member of the Domain Admins, Enterprise Admins and Schema Admins groups. Now you’re ready to create an answer file to install SBS 2008 in migration mode:

1. Run sbsafg.exe in the tools folder on the SBS 2008 DVD 1.
2. Select Migration from existing server (Join existing domain).
3. Set the time zone by checking Use the following time zone and select the appropriate zone from the menu.
4. To simplify the process in this walkthrough, uncheck Windows Live OneCare and Forefront Security under Trial security services to prevent them from installing on SBS 2008.
5. Fill out your company, source and destination server information as appropriate (Figure 1).
6. Once all the information is complete, save the file to the root directory of a removable USB drive as sbsanswerfile.xml.


Figure 1
Install SBS 2008 in Migration Mode

1. Boot the SBS 2008 hardware from the SBS 2008 DVD 1 disk.
2. Select your language and regional settings, and click Next to continue.
3. Insert the removable USB drive that contains the answer file and click Install Now.

Follow the setup process for a usual installation of Windows Server, selecting the partition on which to install the operating system, etc. The server will restart twice, and if sbsanswerfile.xml is successfully detected after installation, setup will log on using the migration user specified in the file and continue with an automated setup of the SBS components, using the information provided.
Post-Installation Tasks

Once setup is complete, you’ll be prompted to address any problems detected during installation (Figure 2).


Figure 2

What happens next depends on whether the source server is Windows Server 2003 or SBS 2003. The SBS Console’s Migration Wizard (Figure 3) is only supported if the source server is SBS 2003. The Migration Wizard serves as a guide for sysadmins of what to do and in what order.


Figure 3

While there is no need to migrate user accounts or groups, they do not appear in the SBS Console by default. To remedy this problem, follow the steps below to set the msSBSCreationState attribute on AD user and group objects:

1. Run adsiedit.msc from the Start Search box on the Start menu.
2. Right click ADSI Edit in the left pane of the MMC console, select Connect to from the menu and then click OK to accept the default connection settings.
3. Expand Default Naming Context in the left pane and browse for the group(s) or user(s) you want to add to the SBS Console. Right click the user(s) or group(s) and select Properties from the menu.
4. Select msSBSCreationState on the Attributes Editor tab and click Edit. Change the value to Create, with a capital C, and click OK (Figure 4).


Figure 4
5. Additionally, for groups, you need to set the groupType attribute to define the group as either a security or distribution group. Set the value to –2147483640 for security groups and 8 for distribution groups.

Note that if you upgraded from SBS 2003, you should use the above procedure for groups only, and follow instructions in the Migration Wizard for migrating users. If the source server is Windows Server 2003, the SBS Console can be used to assign roles to migrated users.
Once your users and groups are in order, you should move Exchange mailboxes to the new server, which is an easy task with the Exchange Server 2007 Management Console:

1. Open the Exchange 2007 Management Console on the destination server from All Programs > Microsoft Exchange Server 2007 on the Start menu.
2. Expand Recipient Configuration in the left pane and then click Mailbox.
3. Select all mailboxes in the central pane that display as Legacy Mailbox and click Move Mailbox in the right pane (Figure 5).


Figure 5
4. Click Browse on the first screen of the Move Mailbox Wizard, select the default mailbox database on the destination server and click Next.
5. Configure move options to skip mailboxes with corrupted messages and set the Global Catalog and Domain Controller to be the destination server (Figure 6). Click Next to continue.


Figure 6
6. Opt to begin the move operation immediately and click Next.
7. Review the details on the summary screen and click Move.
8. Check that the move was successful on the completion screen and click Finish.

Mailboxes can be moved to the new server during office hours, but be aware of the extra workload this will put on both source and destination servers. Users can continue working while their mailboxes are being moved; they will be prompted to restart Outlook once the operation is complete. No reconfiguration is required.

The final step is to decommission or repurpose the source server. You should uninstall Exchange and then demote the source server, using dcpromo.exe to change its status to a member server, rather than simply reformatting the disk.
IT Takeaway

Though many of the steps required to migrate to SBS 2008 are still manual, the ability to join the new server to an existing SBS domain helps to ensure that end users will not be disrupted during the migration process, and enables sysadmins to stage the migration over several weeks, minimizing the risk that something could go wrong. With both source and destination servers in one domain, migration tasks are easier and less prone to errors than in previous versions of SBS. SharePoint and SQL databases will also need to be moved if they exist on the source server.

Russell Smith is an independent consultant based in the United Kingdom who specializes in Microsoft systems management.

-->Read more...

• 0 comments »

Quality of Service (QoS) gives you control over how your bandwidth is used, prioritizing critical network traffic (such as streaming media) over less important communication (such as e-mail) and limiting the bandwidth used by specific applications. It can also help cut costs by getting more use of existing bandwidth and enabling network consolidation by combining your phone, videoconferencing and wide area network connections with your Internet connection while minimizing performance problems.
How QoS Works

Routers forward traffic between networks. One of the biggest causes of network performance problems (specifically latency) is router queuing. Queuing occurs when a router needs to forward more traffic to a destination network than the network can handle at one time.

By default, most routers work on a first-in, first-out basis. This works well for Web browsing and e-mail, but if real-time communication sits in a queue for more than a few milliseconds, the quality degrades significantly. For example, if the total latency is more than 150 milliseconds, a Voice over Internet Protocol conversation will cut out.

Consider a small business with a 512-kilobits-per-second Internet connection. If a user makes a VoIP phone call while sending an e-mail, the router won’t be able to immediately forward all the traffic across the DSL connection. With first-in, first-out, some of the VoIP packets would need to wait behind the e-mail packets — adding latency and degrading the quality of the VoIP phone call. With QoS, as shown in the following figure, the router forwards all the high-priority VoIP traffic first, and sends the lower priority e-mail traffic only after the high-priority queue is empty.

What’s New in Windows Vista and Windows Server 2008

Routers can distinguish between high-priority and low-priority packets by examining the Differentiated Services Code Point (DSCP) value in each packet. Unfortunately, previous versions of Windows didn’t give systems administrators control over the DSCP values, and almost all traffic had the default DSCP value of 0.
With Windows Vista and Windows Server 2008, you can use Group Policy settings to mark outgoing network traffic with DSCP values. With this capability, a QoS routing infrastructure, and a few QoS policies, database queries from your critical customer service application can soar past e-mail and Web browsing traffic.

You can also use Group Policy settings to throttle traffic from specific applications. For example, if your outgoing e-mail server is filling up your Internet connection every time you send a mass-mailing, you can throttle the e-mail server to use only half the bandwidth — even if your network infrastructure doesn’t support QoS. Policy-based QoS can be very specific, so you could throttle traffic bound for the Internet but allow traffic bound for computers on your high-speed local area network to use all available bandwidth.

QoS policies are focused on controlling outgoing traffic. While you have much less control over incoming traffic, you can also use Group Policy settings to throttle all incoming Transmission Control Protocol traffic for a computer. So, if downloads to your client computers are using too much bandwidth, you can tune Windows to slow down that incoming traffic.
Adding QoS to Your Network

QoS requires careful planning and coordinated efforts from systems and network administration teams. Before you create your policies, follow these high-level steps to create a plan to add QoS to your network:

1. Prioritize the different types of traffic on your network by assigning a standard DSCP value to each, as the example below shows. You don’t need to use every DSCP value. Any traffic you don’t classify will automatically have a DSCP value of 0, which is considered best effort.
2. Work with your network engineering team to configure routers to prioritize traffic based on the DSCP values you specified. This might already be done; some routers have QoS enabled by default for standard DSCP values.
3. Identify the executable file associated with each traffic type. For example, if you want to assign a DSCP value to packets sent by your Internet Information Services Web server, you would specify the executable inetinfo.exe. If you can’t identify the executable file, identify the TCP or User Datagram Protocol port number that the application uses. Finally, decide whether to apply the DSCP values for all outgoing traffic or for only traffic addressed to specific networks or IP addresses.
Tip: Run the command “netstat -a -b” to identify the executable name associated with all network connections.
4. Configure policy-based QoS using Group Policy Objects (GPOs), as described later in this article.
5. If you identify client computers consuming too much bandwidth with incoming traffic, use GPOs to throttle all incoming traffic on those computers, as described at the end of this article.

Typically, QoS will work only on your internal network. Most Internet Service Providers either remove or ignore DSCP values.
How to Configure Policy-Based QoS

To configure QoS policies, follow these steps:

1. Edit the GPO you want to add the policy to, and select the Computer Configuration\Windows Settings\Policy-based QoS node or the User Configuration\Windows Settings\Policy-based QoS node.
2. Right-click the Policy-based QoS node and click Create New Policy.

The Policy-based QoS Wizard appears.

3. On the Create A QoS Policy page, type a policy name and DSCP value. Optionally, select the Specify Throttle Rate check box, and set a throttle rate in either kilobytes per second or megabytes per second. The value you enter must be in kilobytes or megabytes per second, rather than the more commonly used kilobits or megabits per second. One kilobyte is equal to eight kilobits, and one megabyte is equal to eight megabits. Click Next.
4. On the This QoS Policy Applies To page, select Only applications with this executable name if you can identify a specific executable file. Then, type the executable name. If you can’t identify an executable file (for example, the traffic you want the policy to apply to is generated by a service running in svchost.exe), then leave All applications selected. Click Next.
5. On the Specify The Source And Destination IP Addresses page, leave the default settings to apply the policy to all computers. To apply the policy only to specific computers on your network, select Only for the following source IP address or prefix, and then type the IP address or network that identifies the computers that should use the policy. To apply the policy only to traffic being sent to specific computers or networks, select Only for the following destination IP address or prefix, and then type the destination IP address or network. Click Next.
6. On the Specify The Protocol And Port Numbers page, identify traffic based on TCP or UDP port numbers only if you didn’t specify an executable name. If you are configuring a QoS policy for a server, specify the source port. If you are configuring a QoS policy for a client, specify the destination port. For example, if you want to throttle SMTP traffic from an e-mail server, you would select TCP, select From This Source Port Number Or Range, and then specify port 25 (the port number SMTP uses). Click Finish.

How to Throttle Incoming Traffic

While you don’t have direct control over incoming traffic, Windows can use TCP’s traffic control capabilities to slow down incoming traffic. Unlike the policy-based QoS you just read about, this change affects all applications on a computer (including any critical applications). Because of this limitation, you should leave this setting at the default unless you have a computer that’s slowing down your network by downloading large files.

To specify the inbound TCP throughput level, follow these steps:

1. Edit the GPO you want to configure, right-click Computer Configuration\Windows Settings\Policy-based QoS, and then click Properties.
2. On the Inbound TCP Traffic tab, select the Specify the inbound TCP throughput level check box. Then, a level from 0 (to slow down traffic as much as possible) to 3 (the default setting, which is maximum throughput).
3. Click OK.

Tony Northrup is a developer, security consultant and author with more than 10 years of professional experience developing applications for Microsoft Windows.

-->Read more...

• 0 comments »

Organizations have spent years and invested huge sums of money to secure and protect network resources within their environment. Antimalware applications on the perimeter and at the desktop protect computers from viruses, worms and other malware threats. Network and personal firewalls secure computers against unauthorized network traffic.

The basic, essential layers of security are fairly universal and relatively effective at guarding the network against outside threats and malware attacks. However, a newer threat to network security bypasses the traditional network defenses. Portable media, specifically USB flash drives, are capable of transporting malware and infecting devices on the internal network. They also pose a significant risk of information leakage or data loss.

With capacities up to 8 gigabytes for USB flash drives smaller than a person’s thumb, and even higher capacities available for USB storage devices that fit easily into a pocket, users can store huge amounts of sensitive or confidential data. In addition, the drives’ small size puts them at risk of being stolen, lost or misplaced, which puts the data at even greater risk than if it were on a notebook computer.

Organizations need to take proactive steps to define the acceptable use of portable storage devices such as USB flash drives within the environment, and then put the tools and technology in place to help monitor and enforce the policy and protect the network and data from the risk posed by USB flash drives.
Define Acceptable Use

The first step in restricting or controlling the use of USB flash drives within your environment is to develop a written policy. The policy should outline what, if any, are the acceptable uses for portable storage devices. You should also spell out specific actions that are banned or include a blanket statement that any action not specifically allowed is, by default, banned.
Most organizations already have an acceptable use policy defined, which users must agree to and sign. The acceptable use policy (AUP) essentially defines how users are allowed to use the Internet, e-mail, telephones, and other communications and network resources. Users must read and agree to abide by the AUP. The AUP is an official document that should have the approval and support of both the legal department and the human resources department.

Defining the acceptable use of USB flash drives and other portable storage media, and ensuring that users have read the policy and agree to abide by the policy help educate users about the risks of using portable storage devices and give the organization more solid grounds for taking action against users who abuse or ignore the policy.
Restricting USB Flash Drives

Group Policy is an effective tool for managing computers on your network and enforcing security policies. Unfortunately, there are no default Group Policy settings for restricting or denying the ability to use USB flash drives and other portable storage devices. The good news is that you can extend Group Policy to add that functionality yourself.

Microsoft Knowledge Base article KB 555324 (http://support.microsoft.com/kb/555324) provides detailed instructions to create an administrative template (.adm) file that you can add to Group Policy to enable the ability to block the use of USB flash drives, CD-ROM drives and floppy drives. If you copy the text from the Knowledge Base article (below) into Notepad and save it as an .adm file, you can add the template to Group Policy.

CLASS MACHINE
CATEGORY !!category
CATEGORY !!categoryname
POLICY !!policynameusb
KEYNAME "SYSTEM\CurrentControlSet\Services\USBSTOR"
EXPLAIN !!explaintextusb
PART !!labeltextusb DROPDOWNLIST REQUIRED

VALUENAME "Start"
ITEMLIST
NAME !!Disabled VALUE NUMERIC 3 DEFAULT
NAME !!Enabled VALUE NUMERIC 4
END ITEMLIST
END PART
END POLICY
POLICY !!policynamecd
KEYNAME "SYSTEM\CurrentControlSet\Services\Cdrom"
EXPLAIN !!explaintextcd
PART !!labeltextcd DROPDOWNLIST REQUIRED

VALUENAME "Start"
ITEMLIST
NAME !!Disabled VALUE NUMERIC 1 DEFAULT
NAME !!Enabled VALUE NUMERIC 4
END ITEMLIST
END PART
END POLICY
POLICY !!policynameflpy
KEYNAME "SYSTEM\CurrentControlSet\Services\Flpydisk"
EXPLAIN !!explaintextflpy
PART !!labeltextflpy DROPDOWNLIST REQUIRED

VALUENAME "Start"
ITEMLIST
NAME !!Disabled VALUE NUMERIC 3 DEFAULT
NAME !!Enabled VALUE NUMERIC 4
END ITEMLIST
END PART
END POLICY
POLICY !!policynamels120
KEYNAME "SYSTEM\CurrentControlSet\Services\Sfloppy"
EXPLAIN !!explaintextls120
PART !!labeltextls120 DROPDOWNLIST REQUIRED

VALUENAME "Start"
ITEMLIST
NAME !!Disabled VALUE NUMERIC 3 DEFAULT
NAME !!Enabled VALUE NUMERIC 4
END ITEMLIST
END PART
END POLICY
END CATEGORY
END CATEGORY

[strings]
category="Custom Policy Settings"
categoryname="Restrict Drives"
policynameusb="Disable USB"
policynamecd="Disable CD-ROM"
policynameflpy="Disable Floppy"
policynamels120="Disable High Capacity Floppy"
explaintextusb="Disables the computers USB ports by disabling the usbstor.sys driver"
explaintextcd="Disables the computers CD-ROM Drive by disabling the cdrom.sys driver"
explaintextflpy="Disables the computers Floppy Drive by disabling the flpydisk.sys driver"
explaintextls120="Disables the computers High Capacity Floppy Drive by disabling the sfloppy.sys driver"
labeltextusb="Disable USB Ports"
labeltextcd="Disable CD-ROM Drive"
labeltextflpy="Disable Floppy Drive"
labeltextls120="Disable High Capacity Floppy Drive"
Enabled="Enabled"
Disabled="Disabled"

The default directory for storing templates is %windir\inf. After you have saved the .adm file, you need to import it into Group Policy so that you can apply the settings. Follow the steps below to import it:

1. Using Group Policy Editor, open your GPO (Group Policy Object).
2. Under Computer Configuration, right-click on Administrative Templates.
3. Select Add/Remove Templates.
4. Click Add and browse to the directory where you saved your .adm file.
5. Select your new template and click Open.
6. Click Close to exit the Add/Remove Templates console.

The new settings from your .adm template should now be visible and available for you to use in your GPO. The .adm templates are imported and applied at the GPO level, so you will need to import the .adm template to the GPOs that the computers or users you are trying to manage are linked to.
Encrypt Portable Data

Even if you restrict access to USB flash drives or other portable storage devices through Group Policy, the fact is that these devices are fairly inexpensive, are simple to use, and can increase productivity and efficiency if used properly. Rather than creating a blanket policy that such devices are simply not allowed or implementing a GPO that denies access to portable storage for all Users and Groups, you will probably want to allow their use under certain circumstances and by certain users.

One solution is to issue company-sanctioned USB devices to those users who are authorized to use them. Some devices, such as the Lexar JumpDrive Secure II (http://www.cdw.com/shop/products/default.aspx?EDC=852700), provide password protection and 256-bit AES encryption to protect the data in the event that the device is lost or stolen. Another device, the SanDisk Cruzer Profile (http://www.cdw.com/shop/products/default.aspx?EDC=824282), provides biometric security for your portable data. It comes complete with a fingerprint scanner and requires biometric authentication before providing access to the data it contains.

Alternatively, you can use normal, unencrypted USB flash drives but provide software that will ensure the data stored on them is secure. Pointsec Protector (http://www.cdw.com/shop/products/default.aspx?EDC=1221712) helps you lock down USB ports and can be configured to ensure that any data written to removable storage is properly encrypted. It also provides some flexibility and control over how the data is accessed once it is on the USB flash drive.
Control Access to Data

A broader solution for protecting data and guarding against information leakage or theft is to use Windows Rights Management Services. WRMS will not work for every organization, but it will for organizations that are running Windows Server 2003 networks and rely primarily on Microsoft for their desktop operating systems and office productivity applications.

WRMS allows you to implement security that is persistent and continues to protect the data no matter where the data goes. With WRMS, you can mark an e-mail or a Word attachment as confidential and apply security to control how the information is accessed. You can designate that only certain users can view the information and restrict them from editing, copying, printing, saving or forwarding the information.

If a user does not usually have rights to certain data but needs access to sensitive information for a specific project or deliverable, that access can be provided on a short-term basis with a pre-defined expiration date. Once the expiration passes, the user will no longer be able to access the data even if they have copied it and taken it home to their personal computer.

Diving into all of the functions and benefits of WRMS is beyond the scope of this article. Suffice it to say that WRMS can be a powerful tool in your arsenal for securing data and protecting against information leakage. For more information about WRMS, visit Microsoft’s Windows Rights Management Services Web site: http://www.microsoft.com/windowsserver2003/technologies/rightsmgmt/default.mspx.
Embracing Portable Storage Securely

It might seem simpler to just issue a draconian mandate that portable storage devices are not allowed. Sticking your head in the sand and pretending that USB flash drives don’t exist doesn’t make the risk go away, though. Users still own them and can easily bring them into the office and connect them to computers on your network without your knowledge.

It is much better to embrace the technology. Learn about the advantages of using such devices and understand the risks. Determine how they improve efficiency and increase productivity for your users and define a policy to restrict and control their use to specified users or tasks. Most important, though, for those who ignore policy and bring in USB flash drives from home, or for those who are authorized to use them but lose their USB flash drives or have them stolen, implement security controls and technology to restrict the ability to use them and to secure and protect the data that is stored on USB flash drives.
Tony Bradley, a Microsoft Most Valuable Professional in Windows security, is a computer security consultant with BT INS in Houston and author of Essential Computer Security.

-->Read more...

• 0 comments »

With Group Policy objects, you can change hundreds of default settings in Microsoft Windows — from color schemes to desktop security — and create a complex hierarchy of GPOs to configure settings based on the user and the computer’s location, organization and purpose in Active Directory environments.

Here’s how to define, edit and prioritize multiple local GPOs.

First, not all computers can join a domain. For example, public computers (such as a kiosk in a library) are frequently attacked and could put the entire domain at risk. Windows XP and earlier versions of Windows had a single local GPO that applied settings to the client computer and all users that logged on to the computer. Therefore, if you needed to lock down the desktop environment to prevent guests from opening the Start menu, you also made it impossible to manage the computer when logged on as an administrator.

Windows Vista now supports multiple local Group Policy objects (MLGPOs) so that you can apply different settings to administrators, non-administrators and specific users.
MLGPO Types

Windows Vista supports the following local GPOs:

* Local Computer Policy: Just like earlier versions of Windows, Vista supports local computer policy that always applies, regardless of which user is logged on. This policy contains both the Computer Configuration and User Configuration nodes. All other local GPOs contain only the User Configuration node.
* Administrators Policy: Settings configured in this policy apply only to users who are members of the local Administrators group.
* Non-administrators Policy: Settings apply to all users who are not members of the local Administrators group.
* User-Specific Policies: You can configure GPOs that apply to only a specific user account.

Any user who logs on will have, at most, three local GPOs: the local computer policy, a user-specific policy, and either the administrators or non-administrators policy. Oddly, you cannot create local GPOs that apply to local groups, such as “backup operators” or “guests.”
GPO Priorities

Local GPOs are applied in the following order, with later policies overriding conflicting settings in earlier policies:

1. local computer policy;
2. administrators and non-administrators policies;
3. user-specific policies.

For example, if you set the desktop to blue in the local computer policy but set it to red in the administrators policy, it will appear red when an administrator logs on. If you set the desktop to green in the user-specific policy, that setting would override all other local GPOs.

If the computer is a member of an Active Directory domain, domain GPOs always override conflicting settings in local GPOs. If you want to completely disable local GPOs, enable the following setting in a domain GPO:

computer configuration\administrative templates\system\group policy\turn off local group policy objects processing
To remove a local GPO, right-click it from this dialog box, and then click Remove Group Policy Object.
How to Edit Local GPOs

To edit one of the local GPOs in Vista, log on as a member of the administrators group and follow these steps:

1. Click Start, type MMC, and then press Enter. Respond to the User Account Control prompt that appears.
2. In the blank console, click the File menu, and then click Add/Remove Snap-In.
3. In the Add or Remove Snap-Ins dialog box, under Available Snap-Ins, click Group Policy Object Editor. Then, click Add. The Select Group Policy Object wizard will appear.
4. On the Welcome to the Group Policy Wizard page, click Browse.
5. On the Browse for a Group Policy Object dialog box, choose a GPO:
* Local Computer Policy: On the Computers tab, click This Computer.
* Administrators Policy: On the Users tab, click Administrators.
* Non-administrators Policy: On the Users tab, click Non-administrators.
* User-Specific Policies: On the Users tab, click the user account you want to configure.
6. Click OK, and then click Finish.

You can now use this custom management console to edit the GPO you selected. To simplify editing, add any useful local GPOs to the console, and then save the console for future use.
Copying Local GPOs Between Computers

It’s not as easy as managing GPOs in a domain, but you can copy most GPO settings between standalone computers running Vista. First, use the Group Policy Object Editor to configure the local GPOs on the primary computer. Then, copy the GPO settings to your target computers. The technique you use to copy the data depends on whether your settings are within the Security Settings node or the Administrative Templates node. (Just a reminder: The Group Policy Management Console can be used only with domain GPOs.)
Security Settings

If you edit the local computer policy and update any settings within the computer configuration\windows settings\security settings node, use the secedit command-line tool to copy the settings to the target computers:

1. Export the security settings from the primary computer by running the following command:
secedit /export /cfg secsettings.inf
2. Copy the secsettings.inf file to each of your target computers, and perform a full backup.
3. On each target computer, run the following command to import the security settings from the primary computer:
secedit /configure /db secsettings /cfg secsettings.inf /overwrite
4. To ensure all settings are applied, restart the target computers.

Administrative Templates

If you edit any of the local GPOs and update settings within the Administrative Templates node, manually copy the settings to the target computers by following these steps:

1. For any GPO you edited, copy the contents of the folder listed in the following table to the target computer. These folders are hidden and require administrative privileges to access. For user-specific policies, you must change the folder name to match the service set identifier (SSID) of the user on the target computer.
2. On the target computer, run gpupdate /force to apply the new Group Policy settings.

The registry.pol file stores most of the GPO data. To view these files directly, use the free PolViewer utility available at www.gpoguy.com/polviewer.htm.
GPO Folder
Administrators %windir%\system32\grouppolicyusers\s-1-5-32-544\
Non-administrators %windir%\system32\grouppolicyusers\s-1-5-32-545\
User-specific policies %windir%\system32\grouppolicyusers\\
Local computer policy, computer config. %windir%\system32\grouppolicy\machine\
Local computer policy, user config. %windir%\system32\grouppolicy\user\

Troubleshooting Local GPOs

You can troubleshoot problems with local GPOs using most of the same tools you use for Active Directory GPOs, including:

* Resultant Set of Policy: A Microsoft Management Console snap-in that analyzes all Group Policy settings, displays the effective settings, and allows you to isolate the Group Policy objects that define any setting.
* GPResult: A command-line tool that provides a list of active GPOs, including both domain and local GPOs, among other useful information.
* Event Viewer: Vista adds an event to the System Event Log when policies are applied, and stores detailed processing information in the applications and service logs\microsoft\windows\group policy\operational event log. The Operational Event Log replaces the userenv.log file used in earlier versions of Windows.
* Group Policy Log View: A tool that exports Group Policy event data into a text file. You can download GPLogView at go.microsoft.com/fwlink/?LinkId=75004.

IT Takeaway

GPOs are the most efficient way to configure the hundreds of settings on a Windows computer. XP and earlier versions of Windows had only a single local GPO, and any settings configured in that GPO applied to all users. Therefore, you couldn’t use the local GPO to harden the desktop environment because you would also prevent administrators from managing the computer.
•Vista solves this problem by providing three levels of local GPOs: the local computer GPO, the administrators and non-administrators GPOs, and GPOs for individual users.
• With Vista, you can lock down a computer without locking yourself out.


Tony Northrup is a developer, security consultant and author with more than 10 years of professional experience developing applications for Microsoft Windows.

-->Read more...

• 0 comments »

Photo: Richard Robinson
A document management system comes in handy in case of an audit, says Member One Federal Credit Union IT Specialist Tonya McEnheimer.
Most businesses work with more documents than ever, and managing them all is often a costly and complex process.

“There is a demand within our credit union for document management,” says Tonya McEnheimer, information technology specialist at Member One Federal Credit Union in Roanoke, Va. “Paper is challenging. We do not have enough space for it, and it would be a big help to have a document management system, so that we could retain data and documents and retrieve them immediately if we were audited or if a member needed a document.”

Windows SharePoint Services 3.0 is a free Web-based application from Microsoft for Windows Server 2003 that provides collaboration, workflow, document management and security features through a Web browser or via direct integration with Microsoft Office XP 2007. WSS allows users to create virtual work spaces for individual projects that can be used, among other things, to store and manage related documents. Document work spaces contain a default document library, called Shared Documents. Each document library can have individual settings that control functions, such as document versioning and security.

But while it is free, WSS is resource intensive and requires a server with a minimum of 1 gigabyte of random access memory. WSS introduces an extra level of complexity, especially having to maintain a database, which will require extra work from the IT department.

This product is a good fit for organizations, such as Member One. “We run a financial platform to process transactions with its set of rules, and Microsoft for just about everything else,” says McEnheimer. “We keep one drive open for end users and use it for storing documents, and we restore those documents from tape backups.”

WSS includes document versioning, approval, document check in/out and control on copying and distributing documents. Here are the basic steps for developing a secure WSS environment:
1) Creating a Document Management Work Space

Once WSS has been installed, the first task is to log onto the default top-level Team Site (using the account that you used to install WSS, which is the first default WSS user) and create a document work space (essentially a sub-site of Team Site) for a new project: Project X. The top-level Team Site will be opened automatically once the configuration wizard has completed. You can browse to the site anytime by simply typing http://<> into a browser window. It is also necessary to add this site to the list of Trusted Sites under the security tab in the Internet Options control panel applet if you are browsing the site from the server.

From the Team Site home page, click Site Actions, and select Create. Under Web Pages, select Sites and Work Spaces. In the New SharePoint Site window, you will be able to configure various options for the new work space. Give it a title (Project X) and URL (projectx). Select Document work space as the template.
2) Configuring Security

There are two options for configuring security on the new work space. In a simple environment, it is likely that you will have one top-level site with several work spaces. Let’s assume that each work space will have access restricted to a specific group of users. In this scenario, it is best to select Use unique permissions. Leave the navigation options as default, and press Create.

One of the biggest advantages of using WSS to manage document security is that it allows trusted users to control access to document libraries, or individual documents, rather than relying on the IT department to configure access control lists on files and folders. Transferring this responsibility should be made with careful consideration, however.

The Set Up Groups for this Site window allows you to set up three basic groups for controlling user access. Visitors are allowed to view documents, members may create new and edit existing documents, and owners have full control over the work space. It is possible to configure granular security down to individual documents, but the simpler you can keep things, the better. To start with, these three basic groups should suffice. By default, a new group unique to the new work space will be created for members and owners. To configure a unique group for visitors to the Project X work space, rather than allow visitors who are granted view permission to the top-level Team Site to view content in the Project X work space, simply select Create a new group, and a default name will be assigned. Press OK.

Let’s add a user to the Project X Members group. From the Project X home page, select Add new user where it says Groups. In the Users/Groups box, you can add a user to a specified group by entering the user’s name in the following format: \user. Press the Check names icon under the box, and your entry should be underlined if it can be matched. Make sure Add users to a SharePoint Group is selected under Give permissions, and select Project X Visitors [Read] from the menu. Press OK.

It may be necessary to access your work space through its unique URL rather than via the top-level Team Site, for instance, http://<>/projectx. It will depend on the account you are using to access the site and whether it has access to the top level.
3) Configuring Document Versioning, Check I/O and Approval

From the Project X home page, click the default Shared Documents library, and then Settings > Document Library Settings. Under General Settings, select Versioning settings. Configure the settings shown in the table below, and press OK.
Content Approval Yes
Document Version History Create Major and Minor Versions
Require Checkout Yes

Go back to the Project X home page, and select Add a new document under the Shared Documents library. After adding a new document, you will see that it is necessary to check the document in to WSS. You can check it in immediately to allow others to edit it by clicking Check In. You can now edit the document in Word by clicking on the document icon on the Project X home page. If you are using Word 2007, you will notice that it is necessary to check the document out before you can edit it. Simply click on the Check Out button at the top of the screen. You will be notified that you are now working with an offline copy of the document, so you can disconnect from the network and continue working until you’re ready to check the document back in with WSS. The document management pane in Word 2007 gives you the opportunity to check the document back in to WSS when you are ready. Publish a new major version, and press OK.

If you return to the WSS Project X home page and view the document’s history from the drop down menu, you will see there are now two versions of the document: the original draft (version 0.1) and the new major version (version 0.2), which is pending approval. Once the document has been approved, version 0.2 will become version 1.0 automatically. You need to have appropriate rights in order to approve a document, which can be done from the same drop-down menu used to view the document’s history.
4) Working with Document Libraries Offline

If you have Outlook 2007, you can take whole document libraries offline by clicking on the document library from the work space home page (shared documents in this case), and in the Actions menu select Connect to Outlook. You will be presented with a new folder in Outlook that contains a list of documents from the library. You can then edit any document offline, and when you reconnect to the network, simply open the document from Outlook, and you have the option to upload the modified version to WSS.
5) Document Backup and Recovery

Backup of WSS, its database and all other components, is straightforward. From the SharePoint 3.0 Central Administration site, which can be found under administrative tools in the control panel, log on as an administrator, select the Operations tab and then Perform a backup. If you select the top level (Farm), everything required to restore WSS to its present state will be backed up. Continue to Backup Options from where you can choose the type of backup and the file location. There is a command-line tool (stsadm.exe), which can be used to automate various WSS operations including backup.

WSS Version 3 contains a two-stage recycle bin. The Project X work space contains a user recycle bin where items are retained for 30 days if a user deletes a document. There is also a site recycle bin where items that are purged from the user’s recycle bin can be found and restored if necessary by an administrator. This facility should minimize the need to restore documents from backup and further protect critical business data.

But McEnheimer says this feature makes it easier to retrieve documents that users delete by mistake. “A common problem for end users is the mistaken deletion of an important document,” she says. “If the recycle bin has been emptied, the last resource is retrieval from a stored backup, which is very time consuming. WSS gives IT staff a break by allowing quick and easy access to deleted files.”

From the work space (or user) recycle bin, which can be found in the menu on the Project X home page, you can select Site Collection Recycle Bin from the top of the screen. At the Site Collection Recycle Bin, you then need to select Deleted from end user Recycle Bin under Select a View. If you choose to restore a document from the Site Collection Recycle Bin, it will be put back to its original location in the work space.
Hardware Requirements for WSS

Hardware requirements for Windows SharePoint Services 3.0 vary depending on many factors, such as how WSS is deployed (e.g., standalone or farm installation), the number of concurrent users and the volume of documents that need to be stored. Before deciding on how to deploy WSS and what hardware specifications will be required, it is important to understand how WSS will be used. For a standalone WSS installation, during which the Web application and database are running on the same server, 2 gigabytes of RAM are recommended with dual processors 3 gigahertz or faster.

Make sure you plan for future growth from the outset. If you want to store 100GB of documents, you need to have 130GB of disk space available for Structured Query Language server. If you decide to enable document versioning, a copy of each version is stored in the database. You also need to take into account the space required for database log files and consider leaving 25 percent free disk space on each volume. To help control the amount of disk space used, you can create quotas for SharePoint sites to limit the amount of storage they will use. Warning e-mails may also be sent when the amount of storage used reaches a given level.

If WSS is to be used intensively or you require flexibility for future growth, WSS may be installed in a server farm topology, in which the front-end and database server roles are hosted on one or more computers. The recommended hardware requirements for the front-end server (the server that hosts the WSS Web application) are the same as for a standalone WSS installation. Requirements for the database server are that it should host SQL Server 2000 SP3a, or higher, or SQL Server 2005 SP1, or higher. Recommended processor requirements for the standard edition of SQL Server 2005 are a single processor 1GHz, or faster, and a minimum 1GB of RAM. Realistically, these are minimum requirements, however.

To determine whether your WSS installation is secure and set up correctly, you can run the Best Practices Analyzer for WSS against your server. This tool may be accessed at http://go.microsoft.com/fwlink/?LinkID=83335&clcid=0x409.

The tool is run from the command line and generates an HTML report. Simply run the downloaded executable and extract the files to a convenient directory. From the command line, change the working directory to the location where the files were extracted from and run the following command:

sharepointbpa.exe -cmd analyze -substitutions SERVER_NAME

Replace with the name of the WSS server. The report will be generated in the same directory, detailing any issues with the configuration.

Additional security is provided with the ability to block certain file types from being stored in the WSS database. From Central Administration > Operations > Blocked File Types, you may add or remove file extensions to determine whether users can save and/or retrieve certain file types.


IT Takeaway
• Will Your Users Really Benefit from WSS?
WSS introduces many useful features, but you should consider whether it would benefit your users and whether they will need training to use it. It is not the most intuitive system. Consider the way your users work with documents and how security is managed by the IT department on your file servers. How does this compare with the facilities WSS has to offer?
• Consider the Extra Resources and Increased Costs Involved in Hosting WSS
WSS is resource intensive and requires a server with a minimum of 1GB of RAM. WSS introduces an extra level of complexity, which will require extra work from the IT department.
• What Is the Difference Between Windows SharePoint Services and SharePoint Portal Server?
SharePoint Portal Server is based on and requires Windows SharePoint Services. It lets large organizations integrate multiple WSS sites and applications into one portal with advanced features, such as search indexing across multiple sites and single sign-on.

-->Read more...

• 0 comments »

BizTech’s crack team of information technology professionals offers 10 guaranteed proven techniques that will enable your desktops to move as if they were powered with Flintstone-era technology instead of dual-cores. If you recognize any of these end-user behaviors, you can share the consequences and help others avoid bringing their machines to a screeching halt.

1 Ignore patch updates.
Who needs a stinking patch? Never patch your computer using Microsoft Corp.’s update utility. None of the latest viruses or other forms of malware ever take advantage of these vulnerabilities anyway. Besides, you’re smart enough to know those patches are part of the Microsoft Evil Conspiracy.
–Dr. Jeff Sheen, senior corporate network engineer for Sogeti

2a Visit gambling sites.
Many gambling Web sites will expect you to — and in some cases trick you into downloading software in order to play. While this software in many cases isn't malicious, some will sit in your system tray even when you aren’t playing and can inundate you with pop-ups and “free offers,” all the while soaking up memory and degrading your system’s overall performance.
– Jason Holbert, Tier II desktop support technician at Harcros Chemicals

2b And don’t forget the porn sites.
Similar to their gaming cousins, lots of porn sites will open all kinds of windows and pop-ups in addition to tricking you into downloading applications. These applications sometimes transmit data regularly to other Web sites. This robs you of computing cycles, and slows performance while increasing security risks.
– Jeff Gross, author of Texxors.com

3 Ignore EULA’s and Privacy Policies (especially on free software).
It’s free, after all, so why bother reading the End-User License Agreement and all that legal stuff? Except that you’ll often find that, along with your “free” program, anywhere from 15 to 20 other files are installed from various adware vendors. There are a few great and truly free programs out there, but typically adware is the difference between the free and paid versions of software.
– Phil Leiter, IT manager at Cumberland Associates LLC

4Download free screensavers, toolbars, browser helpers, unknown cleaners and any software offered from pop-up ads.
Since you’ve decided to ignore the EULA, these are the programs for you. Remember, if it costs nothing, it’s usually worth nothing. Even toolbars bundled from legitimate sources such as Google will rob you of computing cycles.
– Jeff Gross

5Download peer-to-peer file-sharing clients.
Since peer-to-peer relies primarily on the computing power and bandwidth of the active users within the P2P network, it has the potential to consume huge amounts of PC resources in the form of CPU cycles and memory, which, in turn, can tax the average system to the point where it slows to a crawl. So download Limewire and Kazaa onto your work desktop, which can effectively punch a huge hole in your security schema by bypassing your company’s firewall. Misconfigurations can result in wide open TCP/IP ports, a notorious method of introducing malware or spyware into a network. Once infected, one PC can infect other PCs on the network.
–Douglas Schweitzer, an Internet security specialist and author of several information security books

6Open as many programs as possible for as long as possible.
Computers are capable of doing many millions of things at a time, so running lots of programs that are unnecessary or fun will only add to your own enjoyable day. If you get enough programs running, you will even get built-in breaks during the day while your porn loads. Whatever you do, don’t run defrag or reboot the system. Rebooting will only force you to re-download all of those picture files again, and since it took so long the first time, you’d only lose productivity, right?
–Dave Howe, vice president of systems at Howe Lumber Co.

7Load up your System Tray
Nothing says “Ready to Go!” like 20 little icons standing by in the System Tray. Great examples of these are animated cursors and screen shots. Except that all of those little icons represent programs running in the background and taking away resources before you start your first program. Most of these programs are a part of larger applications — the annoying and often unnecessary part. Get the System Tray under control by running MSCONFIG, click the Startup tab and uncheck the programs you know are not critical. (Unchecking does not delete the program, but prevents it from starting).
– Phil Leiter

8Keep drivers from old printers.
Keeping old print drivers running in the background will slow things down. Many printers have toolbox programs that run and wait for print jobs or monitor the condition of your printer. And you guessed it — it’s using resources. Get rid of them. Even for printers you have, it’s only necessary to run the basic driver without installing tons of other stuff. If you don’t use the printer, remove the driver, the software toolbox and whatever else is associated with it.
– Jeff Gross

9Run lots of Internet video loops.
Everyone loves blooper reels and funny videos. Have them on constantly, so when coworkers come by, you can show them the latest and funniest. Don't worry that there won't be people walking by, because they are sure to be hunting for the IT person since their Internet is running slowly at the moment also.
– Dave Howe

10Keep your PC warm.
Try to place your desk as close as you can to a radiator or baseboard to keep your feet and PC warm. If you have a desk with one of those cut-outs for a PC, be sure to push it as far back as possible to keep the case exhaust air from blowing all over the place. Use the top of the PC, or any space in front of it, to store books and papers and such. In no time your PC will fill with dust and the overheating will bring your system to a screeching halt.
– Phil Leiter

-->Read more...

• 0 comments »

Troubleshooting problems often requires you to look at dozens of different settings, and that’s if you can even remember all of the important settings. In Windows Vista, you can use data collector sets to quickly capture a snapshot of a computer’s configuration, including the following:

* System state
* Registry values
* Log files
* Configuration files
* Windows Management Instrumentation (WMI) management paths
* Performance counter data
* Event trace data

Windows Vista includes built-in data collector sets that you can use to capture information about a system’s status, or you can create your own data collector sets to capture custom settings and log files. These data collection sets can help you streamline the troubleshooting process in your organization, even if the problems relate to custom applications.

First, create the data collector set on your computer based on one of the existing templates, and add custom data collectors to gather any files or registry keys used by internal programs. Then, use the Logman tool to export the data collector set to a file. Distribute that file to the computers you manage, and run Logman again to import the file. Data collector sets never forget to check an important setting, so they can substantially increase thoroughness of troubleshooting while decreasing the time it takes to solve a problem.
Built-in Data Collector Sets

Windows Vista includes the following data collector sets:

Local Area Network Diagnostics: Use this data collector set for troubleshooting problems with wired network connections. It logs network configuration data, network performance counters, and performs network diagnostics tracing.

Wireless Diagnostics: Use this data collector set for troubleshooting problems with wireless network connections. It logs the same data as LAN Diagnostics, and adds wireless network information.

System Performance: Use this data collector set if your Windows Vista computer is having random slowdowns, unexplained paging, or short battery life. It logs processor, memory, disk, and network performance counters, and performs kernel tracing.

System Diagnostics: Use this data collector set for general hardware or software troubleshooting, including Stop errors (also known as blue screens), hardware problems, and driver failures. It logs the same data as System Performance, and adds detailed system configuration information.
Figure 1: Access data collector sets from the Computer Management console or from the Reliability And Performance console.
How to Use the Standard Data Collector Sets

To use the built-in data collector sets, follow these steps:

Click Start, right-click Computer, and then click Manage. Respond to the User Account Control prompt that appears.

In the Computer Management console, expand System Tools, Reliability And Performance, Data Collector Sets, and then System.

Right-click a data collector set and then click Start, as shown in figure 1. A green arrow appears over the data collector set’s icon, indicating that it is currently running. Eventually, the green arrow will change to an hourglass while the data is being processed.

After the data collector set has finished running (or after you right-click it and click Stop), right-click the data collector set again, and then click Latest Report.
Figure 2: Reports summarize the results found by the data collector set.

Windows Vista displays the report generated by the data collector set, as shown in figure 2.
How to Create Custom Data Collector Sets

The built-in data collector sets are perfect for troubleshooting general computer and networking problems. While they might log far more data than you really need, there is little chance that any settings or counters related to the core operating system are missing.

What the built-in data collector sets will not capture is information about your applications. Fortunately, you can create your own custom data collector set based on one of the built-in data collector sets, and extend it to capture registry settings, log files, and configuration files for the applications you troubleshoot most. To create a custom data collector set, follow these steps:

In the Computer Management console, expand System Tools, Reliability And Performance, and Data Collector Sets. Right-click User Defined, click New, and then click Data Collector Set. The Create New Data Collector Set wizard appears.

On the “How Would You Like To Create This New Data Collector Set?” page, type a name and click Next.
Figure 3: Most custom data collector sets should be based on one of the standard templates.

On the “Which Template Would You Like To Use?” page, click one of the templates. Click Finish, as shown in figure 3 (the remaining wizard pages are not important).

By default, your custom data collector set will have all of the data collectors from the template.

Add your own ata collectors by following these steps:

In the Computer Management console, expand User Defined. Right-click your custom data collector set, click New, and then click Data Collector. The Create New Data Collector appears.

On the “What Type Of Data Collector Would You Like To Create?” page, type a name, click one of these options, and then click Next:

Performance counter data collector: Logs performance counters, such as processor or network utilization.

Event trace data collector: Stores event trace information from a Windows Vista event trace provider. Typically, you should add all event trace data collectors that might be related to a problem, because it is better to have too much information than not enough.

Configuration data collector: Stores registry keys, WMI management paths, or the system state.

Performance counter alert: Creates an alert if a performance counter reaches a threshold that you specify.

Follow the prompts that appear to create your data collector.

Configure your data collector set to automatically run at a scheduled time, to stop running after a number of minutes, or to launch a task after running by following these steps:

Right-click your custom data collector set, and then click Properties.

On the Properties dialog box, click the Schedule tab. Using this tab, you can configure your data collector set to automatically run on a scheduled basis. This is useful for proactively monitoring computers. For example, you could configure a data collector set to run daily. Then, if a user experienced a problem that started several days ago, you could look through the recorded reports to determine what may have changed.

Click the Stop Condition tab. Use this tab to configure how long the data collector set runs for.

Click the Task tab. Use this tab to configure a task to run after the data collector set. Use Task Scheduler to create a task that will run. For example, you might create a task that sends the report to you as an attachment to an e-mail message.

Click OK to close the Properties dialog box.

For example, to capture the Office 2007 configuration settings, select Configuration data collector in the Create New Data Collector wizard, and then specify the HKEY_CURRENT_USER\Software\Microsoft\Office registry key to capture all Office-related settings. Then, to capture Word’s Normal template, view the data collector’s properties, click the File Capture tab, and add the %appdata%\microsoft\templates\normal.dot path.

As with the built-in data collector sets, you can generate a report by right-clicking your custom data collector set, and then clicking Start.
Automating Data Collection Set Configuration and Capturing

Of course, you wouldn’t want to manually create a data collector set on every computer. Once you create a data collector set on one computer, use the Logman.exe command-line tool to export the data collector set to a file:

Logman export -n "Office 2007 Configuration" -xml "Office 2007 Configuration.xml"

Then, you can store the XML file on a central server and use a logon script to add the data collector set to computers with a command, such as the following:

Logman export -n "Office 2007 Configuration" -xml \\server\share\Office 2007 Configuration.xml

Lastly, you can use the “Logman update” command to replace an existing data collector set, or use “Logman start” and “Logman stop” to control data collection.
Tony Northrup is a developer, security consultant and author with more than 10 years of professional experience developing applications for Microsoft Windows.

-->Read more...

• 0 comments »

Previous Versions, a file restore feature available by default as part of Windows XP (Service Pack 2) and Windows Server 2003, restores files stored on Windows Server 2003. On Vista, it can also restore local files. You can also install Previous Versions on Windows 2000 (Service Pack 3 or higher) and Windows XP (pre-Service Pack 2) by downloading the Shadow Copy Client software from Microsoft’s Web site at http://www.microsoft.com/downloads/details.aspx?
displaylang=en&familyid=e382358f-33c3-4de7-acd8-a33ac92d295e.

On Windows Server 2003, Shadow Copies can be scheduled per storage volume to let users see a history of previous file versions when connecting to a share on the server from Windows XP or Vista. This feature allows users to roll back to an older version of a file if unwanted changes were made. Giving users the ability to restore previous versions of files may help alleviate the reliance on the information technology department from restoring files from backup.
Figure 1

Figure 2

Figure 3

Figure 4

Before configuring Shadow Copies you should consider how often you want to create a Shadow Copy of a volume (the default setting is twice a day), and how much extra storage space you’ll need. Ideally, Shadow Copies should be stored on a separate disk for improved performance, but by default they are stored on the source volume and you can set a size limit. A maximum of 64 Shadow Copies can exist per volume before old copies are automatically overwritten.
Configuring Shadow Copies on Windows Server 2003

Go to My Computer and select any volume shown under Hard Disk Drives. Click the Shadow Copies tab and highlight the source volume for which you would like to enable Shadow Copies (figure 1). Click Settings, and you will see that by default the storage area for Shadow Copies is the same as the source volume. On this file server, I have a volume on a separate disk that I will dedicate to Shadow Copies, so I will select F:\ from the drop down Located on this Volume and select No Limit under Maximum Size, because there is nothing else on the disk (figure 2). If the volume you select for storing Shadow Copies contains other data, you should consider enforcing a limit.

Click Schedule, and on the drop down menu at the top of the dialog box you will see that there are two default scheduled tasks to create Shadow Copies at 07 a.m. and noon, Monday through Friday. My users work on the weekend, so I will modify both tasks to include Saturday and Sunday under Schedule Task Weekly, and then press OK. Press OK again on the settings dialog box. Back to the Shadow Copies tab, let’s kick off the first Shadow Copy by pressing Create Now, making sure the source volume is still highlighted (figure 3).
Training Employees to Restore Their files from Shadow Copies

Before showing users how they can use Previous Versions to restore files, you should explain a little about how it works, what the feature can do and what it can’t do. Make sure your employees know the following:

* How often Shadow Copies of their files will be created
* In Windows XP, Previous Versions may not be used to restore a file that has been deleted
* In Windows Vista, they can use Previous Versions to restore local files that have been backed up if users are storing files locally and Vista’s backup is enabled
* Shadow Copies of files are not stored indefinitely
* Approximately how many Previous Versions of files will be available at any time based on the storage space allocated for Shadow Copies and the frequency with which they are generated
* They can view previous versions of files, copied them to an alternate location, or replace the file in its existing location

To demonstrate the Previous Versions feature, use this example:

Suppose a user creates a file at 10 a.m. on a shared network drive that is hosted on a storage volume where Shadow Copies are enabled. After lunch at 1:30, the user changes the file, has second thoughts, and wants to revert to the “before lunch” version of the file. Our schedule automatically created a Shadow Copy of the volume while the user was at lunch, so an older version of the file will be available to restore.

On Windows XP or Vista, right click on the file you want to restore, and select the Previous Versions tab. You will see an older version of the file available to restore, along with the date and time it was created (figure 4). You have the option to view the older version of the file, restore it to an alternate location (Copy), or overwrite the file with the older version.

Previous Versions does not provide true document versioning because copies are created based on a schedule, but it can save time and let uses restore their own files in certain situations.
Russell Smith is an independent consultant based in the United Kingdom who specializes in Microsoft systems management.

-->Read more...

• 0 comments »

If you're not fortunate enough to have a means of centralizing your backups, the new backup and restore features in Vista can help protect your data and help you recover files more quickly than previous versions of Windows.
By Russel Smith
4/24/2007


Backup and restore has been radically redesigned in the Microsoft Windows Vista operating system. Ntbackup, the backup application from Windows NT Server, is gone. In its place, Vista offers Backup and Restore Center with two main forms of backup: Backup Files and Backup Computer.

Centralizing business data to a file server and backing up to removable media is still the preferred method for safeguarding data against accidental loss. However, for many small businesses, even with a file server on their networks, it is often the case that business data is spread around desktop computers in addition to the server. Maybe this is because there is no dedicated IT support person or simply due to a lack of training for staff on how to save data to a file server. For those businesses without a server, Vista’s new backup offers an easy and automated method for ensuring that your data is backed up at the end of every day to a CD/DVD-ROM or external hard drive without having to concern yourself with a complicated backup configuration.
Backup Files

Backup Files allows you to create a “set it and forget it” backup, which can be stored on CD/DVD or a network share. From there, you may restore individual or groups of files/folders. Backup Files creates compressed folders, not a .bkf file, as Ntbackup did. You cannot select individual files and folders when configuring a backup. The backup scans the disk and backs up everything that matches certain criteria you may configure through a wizard.

This new system can be a little disconcerting for IT professionals accustomed to having the ability to select files and folders individually and view exactly what is being backed up. The new system is designed to get those who did not back up their data in the past to start now with Vista. There is a version of Ntbackup available for download, for the purpose of restoring files from backups made on Windows XP, or Windows Server 2003, to a Vista computer, but only the restore function is available.
Configuring a “Set it and Forget it” Backup

In the search box on the Start Menu, type backup and you will see Backup and Restore Center appear under Programs. Open the Backup and Restore Center, and click Backup files. You will be prompted to select a location to store the backup, either a writeable CD/DVD or network share, and then press Next. At this point you can select which categories of files are included in the backup. Leave everything selected unless you have a good reason to exclude certain types of files, and press Next. We will change the backup schedule to daily at 7 p.m. as once a week may be fine for a home user but not frequent enough for business data. Now press Save settings and start backup to launch the first full backup.

The backup service works in background to launch backup jobs as scheduled. The service will automatically prompt you to insert writeable media if required every day. Go to the Start Menu, and type task in the search box. Under Programs open Task Scheduler. Drill down into Task Scheduler Library > Microsoft > Windows > Windows Backup and you will see that two tasks have been created to launch and monitor the backup process and a third to ensure that at least once a week a full backup is created.
Restoring Files from Backup

If you need to undo some changes that have been made to an individual file, you should first try restoring to a previous version (see the next section). If you have deleted a file or need to restore multiple files, you can use the Restore Files wizard.

Open the Backup and Restore Center by typing backup in the search box on the Start Menu, and press Enter. Select Restore files, and then Files from the latest backup, and press Next. A nice touch here is that you can search for a particular file or folder that you want to restore.

Select the file/folder that you want to restore either by using Search or browsing, using Add files, or Add folders, and press Next. At this point, you can choose to restore either to the original location or to a new location. Press Start restore. If you choose to restore to the original location and a copy of the file/folder exists there, you will be prompted to select from the following three options:

* Copy and Replace (Overwrites the existing file/folder)
* Don’t copy (Skips the restore of this file/folder)
* Copy, but keep both files (Restores the file with a different name)

You can also choose to have restore deal with all further conflicts the same way by checking the Do this for all conflicts box.
Previous Versions

Vista now includes the ability to restore to a previous version of a file on the local hard drive. Previous versions of local files may be restored from shadow copies that are automatically created every day or from a backup. So, it might be possible to restore a document to its previous state without the need to use backup media.

Right click on the file you want to restore, select Restore previous versions from the menu, and click the Previous Versions tab. You will see a list of the file’s available previous versions, if any, displayed along with the date it was created and the location.

If the shadow copy is given as the location, then you can highlight the file version in the list and open it, restore it or save a new copy without backup media. As you can see, the new Previous Versions feature of Vista is useful for restoring individual files when accidental changes have been made that need to be reversed.
Complete PC Backup and Disaster Recovery

Complete PC Backup introduces a new concept to Vista that was previously only available via third-party applications, such as Symantec Ghost. It allows a user to create a complete image of their hard drive for the purpose of restoring all files, settings, configuration and programs, should a hard drive fail completely. You should create an image of your hard drive once you have completed the initial installation of the operating system and installed and configured all of the required programs and settings. After that, make an image once every six months or immediately after you have made major changes to the system.

Images are created in Microsoft’s Virtual Hard Drive format. All you need to create an image is plenty of recordable DVDs to write the image or an additional hard disk with enough free space.

To start a Complete PC Backup, go to the Start Menu, type backup in the search box, and press Enter. Select Back up computer from the Backup and Restore Center window and wait for backup devices to be located. Choose your preferred backup media (hard drive or DVD-R/RW), and press next. If your system has more than one disk, you will be prompted to select the disks you want to back up. If not, you will be taken straight to the confirmation screen, a summary of disks that will be backed up and how many DVD’s will be required. Press start backup.

VHD images may be restored to a hard drive/partition either by inserting the Vista DVD while the computer is booting up, or from a pre-installed Windows PE Recovery Environment.

Boot from the Vista DVD and change the language and input preferences, if required, and press Next. Select Repair your computer. If an existing installation of Vista is found on the hard drive, it will be displayed. If you burned the VHD image to DVD, you should insert the disk now or make sure the hard drive where you stored the image is connected. Click Next, and then select Windows Complete PC Restore from the System Recovery Options menu.

Windows will search for VHD images and present you with the most up-to-date images it can find. You can manually select another image if required. Press Next, and you will be presented with a confirmation screen. Before you continue with the restore operation, you should be aware that this is a destructive process and cannot be reversed, so check the Format and repartition disks box, and then Finish. Another dialog box will appear to confirm that you really do want to erase all of the information on the disk. Check the box, and press OK. At the end of the restore process, your machine will reboot into the restored image.

Although Complete PC Backup is designed for full system recovery if a hard drive fails, for example, it is possible to restore individual files by mounting the VHD image using the VHDMOUNT tool that is included with Microsoft’s Virtual Server 2005:

vhdmount /m "d:\backup.vhd"
Russell Smith is an independent consultant based in the United Kingdom who specializes in Microsoft systems management.


IT Takeaway
Vista’s new backup and restore facilities are easy to use and an improvement over Windows XP, but should not be considered a replacement for centralizing data and backup to a file server. Vista’s backup utilities will work in the following scenarios:

• Use Complete PC Backup for disaster recovery if you do not already have a system for automating the deployment of images for installing operating systems
• Train users in the new restore feature, Previous Versions, to help reduce their reliance on IT support for restoring files
• Configure Vista backup using the Backup files wizard if there is data stored throughout your desktop computers
• Centralize data and backup functions on a file server, if possible

-->Read more...

• 0 comments »

By Douglas Schweitzer
3/23/2007


With Apple’s Mac OS X, security is built in by default. But unless users intentionally enable specified network services individually, they remain disabled — an established best practice.

Organizations with standard desktop system arrays find the OS X operating system’s default security settings more than adequate. Nevertheless, for users whose systems’ demand higher security controls, OS X can be modified. Although Mac OS X has two interfaces, the graphical user interface is most commonly used for configuration, with the command line available for further tweaking.
Controlling Network Access

Like its Microsoft Windows alternative, OS X comes with a built-in firewall known as ipfw. Under Mac OS X 10.2 and later, one can simply open the System Preferences panel, click on Sharing and then click the Firewall button. There, you can enable or disable firewall features to suit an assortment of needs.

From a security standpoint, logging should be enabled, particularly for users who intend to regularly carry out log audits. Logging allows managers to clearly detail specifics such as what particular events transpired, as well as by whom they were carried out and when. Mac OS X logs data in the /var/log directory by default. To determine whether or not your firewall is logging in the Mac OS X, go to sysctl net.inet.ip.fw.verbose and check the setting. When it is set to 1, logging is enabled. Alternatively, a 0 setting means logging is disabled. To change the setting to enable logging, enter the command: sudo sysctl -w net.inet.ip.fw.verbose=1; to change setting to disable logging, enter: sudo sysctl -w net.inet.ip.fw.verbose=0.
Now that you have logging enabled, you’ll want to review the aforementioned logs for nuggets of information. Go to Applications, then Utilities and click in the Console utility icon. From the File menu, choose the ipfw log (located under /var/log) or any other log you wish to open.
TCP Wrappers

Transmission Control Protocol Wrappers (also known as tcpd) carry out several functions of system security. Mac OS X arrives with TCP Wrappers already installed and users need only edit the configuration files to reap their benefits. Note that even though TCP is built in, it is not enabled — to enable tcpd, enter the commands touch/etc/hosts.allow/etc/hosts.deny to create both /etc/hosts.allow and /etc.hosts.deny configuration files. The usr/libexec/tcpd (wrapper) sends inetd (inet daemon) to the configuration files to request access. Most users prefer to deny any access which is not specifically allowed by adding all:all to the /etc/hosts.deny command.

The TCP Wrapper jumps into action at the initial network connection, accepts the connection for the specified service, then logs the details of the request and/or connection and permits or denies access to the incoming service request according to the access control rules in place. The tcpd can control TCP and User Datagram Protocol-based services and authorizes users from a list of established network users.
Encrypt Files Using FileVault

FileVault, a built-in Mac OS X feature, uses the 128-bit Advanced Encryption Standard to encrypt (as well as decrypt) data stored in a user’s home folder. FileVault is a preferred location for storing critical data; if your computer is stolen or lost, the encoded data that resides within the home folder remains secure. Users gain access to files only after the system has authenticated them and they have logged on. In that case, the files are automatically unencrypted upon opening. To access FileVault, go to the System Preference tab and click on the Security icon.
Get to the Root of Security

By default, the root account is disabled without a password within Mac OS X. Users are encouraged to assign a password to the root account as soon as practicable, as failure to do so leaves the system fair game for attackers to access the system and enable the root account. To enable or disable the root account:

1. Go to Finder, select Go, and choose Applications.

2. Open Utilities, then NetInfo Manager.

3. In the NetInfo Manager window, click on the lock.

4. Log in an Admin user name and password, then select OK.

5. Select Security, and Enable Root User.

6. The first time a user selects this prompt, “NetInfo Error” will appear, as a root password has not yet been set and is still blank. Select OK.

7. Enter a strong root password you wish to use and select Set.

8. Re-enter the password and select Verify. Root user is not enabled.

9. Select Security, then Disable Root User to disable.
Freebies that Help

A network intrusion detection system called Snort is available free for Mac OS X. Lightweight and easy to configure (an available GUI utility makes it simple), Snort performs real-time protocol and traffic analyses and can monitor packet-logging on Internet Protocol networks. Like tcpdump, Snort can handle packet-sniffing, but it also can log packet data, a boon for organizations that require traffic debugging. Snort’s plug-in design means there are no command lines to key in or compiling required for configuration; everything is included and preset.

HenWen, a network security package developed by Nick Zitzmannis, lets Mac OS X users configure and run Snort in a snap. HenWen was developed so users could maintain software for scanning undesirable traffic their firewalls might miss. HenWen is available at seiryu.home.comcast.net/henwen.html. Other Snort features include: detection of buffer overflows, Common Gateway Interface attacks, Server Message Block probes, stealth port scans, content searches and matches, and OS fingerprinting probes.
Douglas Schweitzer, A+, Network+, iNet+, CIW, is an Internet security specialist and author of several information security books.

-->Read more...

• 0 comments »

Let users connect plug-and-play printers without the need to manually install third-party drivers.
By Russell Smith


Photo: Les Szurkowski /
Jupiter Images

Managing printers is a task that most systems administrators love to hate. It’s not enough that sysadmins have to install and configure print servers; usually they also must fix paper jams and replace toner.

Now, developments in Microsoft Windows Server 2003 (Release 2) have made managing networked printers easier via group policy. With the increase in notebook computer use and remote workers, most administrators must oversee both networked machines and end users’ own machines that are connected to the company network.

To give end users rights to install printers (only where preapproved and digitally signed drivers are made available) without relying on the information technology department for the manual install of local printers and drivers, BizTech suggests this method for installing the correct drivers in the background when a device is connected for the first time.

Step 1
Making third-party drivers available to Windows

The first task — if you haven’t done so already — is to collect all the driver files for the printers you support and make them accessible on a network share. The driver files (.inf and all other related files) must be dropped in to the root of the network share.

The next step is to try and remove the need for an administrator (or users) to manually install any printer drivers. Most modern printers are plug and play. With Windows XP, it is generally considered better to install the printer driver before connecting the device. (If the driver isn’t available to Windows when the printer is initially connected, Windows sometimes detects an incorrect driver or generic driver, and the printer won’t work.)

To make sure the driver is available to Windows when the user connects to the printer, you can modify the system registry to include the network path where you store drivers. The DevicePath registry key needs to be modified to:

hkey_local_machines\software\
microsoft\windows\currentversion\devicepath

The default value for this key is %system root%\inf, which is where Windows stores built-in drivers. But you can add to this default string. For instance, if you store your drivers on a network share, you can modify the key as shown:

%systemroot%\inf;\\servername\drivers

Use RegEdit to modify the DevicePath key. Don’t forget to include the semicolon separating the two values in the string.
Step 2
Modifying the registry across multiple machines

To modify a registry key across multiple machines, there are various scripted methods that you can deploy using group policy. For simplicity’s sake, you might want to use the free Policy Maker Registry Extension tool from DesktopStandard, a Microsoft subsidiary. To download it, go to www.desktopstandard.com/ PolicyMakerRegistryExtension.aspx.

Install the extension on a system that you use to administer your domain and create a new group policy object called “DevicePath.” In the Group Policy Object Editor under Computer Configuration > Computer Settings, right click Registry and select New > Registry Wizard. Select the computer for which you modified the DevicePath registry key (either a local or remote system) and select Next. Finally, navigate to the DevicePath key and choose Finish (see Screenshot 1).


Screenshot 1

If you fully expand the new setting in the Group Policy Object Editor, you should see that the default action is to update the registry key. The registry extension can also be used to delete, create and replace registry keys — along with some other useful features.

Before you link the policy to an organizational unit, you will need to deploy the Registry Extension Client Side Extension to all machines that will be affected by this policy. This can be achieved using the included MSI package and a group policy object. You’ll find the MSI package for the client side extension located on the machine where you installed the original registry extension:

c:\program files\desktopstandard\policymaker\
client\polregcl.msi

If you don’t already have a network share for distributing software, create one. Next, set up a group policy object to install the Registry Extension CSE, called “Reg Extension,” and edit the policy. Under Computer Configuration > Software Settings, right click Software Installation and select New > Package. Browse to the polregcl msi package on the appropriate network share and select Open. Set the deployment method to Assigned and select OK. You should now see the assigned package in the right-hand pane of the Group Policy Object Editor.

Once you’re happy with the policy settings, link it to the organizational unit where your workstation computer accounts are located (see Screenshot 2). The client extension will install automatically the next time machines affected by the policy boot.


Screenshot 2

Once the Registry Extension CSE has been installed across your systems, the Device­Path group policy can be linked where necessary. You should note that once the registry key has been updated, users must reboot before their systems will detect drivers in the new location.
Step 3
Making drivers available offline

Now that you have updated the DevicePath registry key across all your desktop and notebook systems, you need to ensure that the “drivers” share is always available — even when the notebooks are not connected to the network. Chances are that your users will connect their shiny new printer at home. Again, using group policy, it’s possible to force a share to be available offline.

Most sysadmins will be familiar with the concept of offline files. This is the same concept, but you are forcing the share to be synchronized for offline use on all systems where offline files are enabled — most likely, users’ notebooks.

Edit your DevicePath group policy object. In the Editor, configure the setting “Administratively assigned offline files,” which can be found under Computer Configuration > Administrative Templates > Network > Offline Files. Open the setting and enable it. Click the Show button and add the UNC path to your network share in the top box and then press OK (see Screenshot 3). Assuming offline files synchronization is working on your notebooks, the share should now be available even when the notebook is disconnected from the network — as it is cached locally.


Screenshot 3

Now you can drop driver files into the share on your server, and your users can take their notebooks home and connect plug-and-play printers. The correct driver will be installed without the need for any user interaction.

Are there any restrictions to this method? Yes. Drivers must be digitally signed for a standard user to complete printer installation. If the drivers are not signed, the installation cannot be completed until an administrator logs on. Don’t assume that this method will work for every printer model. Although in theory there is no reason why it shouldn’t work, I recommend you test each printer before making promises to users about hassle-free home installation.

Another restriction is that all the driver files must be dropped into the root of the network share that you create for drivers. This makes it difficult to manage the files. Optionally, you could add a separate UNC path to the DevicePath registry key for each device. That approach also could become difficult to manage. Some devices — especially varieties that can scan, fax and make tea — potentially require software in addition to the driver for full functionality. Consider these alternate methods:

1. Use printui.dll to pre-install drivers for a local printer. This requires that you know in advance if a printer will be connected to a specific machine and that you run a script or batch file with the necessary command lines.

2. Find a way to add the driver files to the %systemroot%\inf path on each machine. This is easy to do if you have a standard image for deploying Windows, but it can be difficult to update and maintain.
Best Practices

Ideally, your IT policy should state which printers the company supports. That will ensure the IT department can effectively maintain the hardware and make it easier to resolve technical difficulties. Approve printers only when the manufacturer provides digitally signed drivers. Also avoid devices where additional software is necessary, especially if it cannot be run under a standard user account.

Finally, ensure that you test everything thoroughly in a preproduction lab before making changes to your live systems. Group policies and registry modifications should always be deployed with caution.
CEO Takeaway
An IT policy to control the connection of hardware devices to company equipment is the best way to ensure that the tech team supports users effectively and minimizes total cost of ownership. Before you roll out a printer policy, answer these questions:

• How many different models of printers does the IT department manage locally?
• Do you have digitally signed drivers, and is additional software required for functionality?
• Should drivers be managed in the initial image build or dynamically after Windows deployment?
• Do you want to deploy a third-party tool for managing registry keys via group policy or use a scripted solution?
• Can the IT staff configure and link group policy objects and modify the registry?


Russell Smith is an independent consultant in the United Kingdom who specializes in Microsoft systems management.

-->Read more...

• 0 comments »