Quality of Service (QoS) gives you control over how your bandwidth is used, prioritizing critical network traffic (such as streaming media) over less important communication (such as e-mail) and limiting the bandwidth used by specific applications. It can also help cut costs by getting more use of existing bandwidth and enabling network consolidation by combining your phone, videoconferencing and wide area network connections with your Internet connection while minimizing performance problems.
How QoS Works

Routers forward traffic between networks. One of the biggest causes of network performance problems (specifically latency) is router queuing. Queuing occurs when a router needs to forward more traffic to a destination network than the network can handle at one time.

By default, most routers work on a first-in, first-out basis. This works well for Web browsing and e-mail, but if real-time communication sits in a queue for more than a few milliseconds, the quality degrades significantly. For example, if the total latency is more than 150 milliseconds, a Voice over Internet Protocol conversation will cut out.

Consider a small business with a 512-kilobits-per-second Internet connection. If a user makes a VoIP phone call while sending an e-mail, the router won’t be able to immediately forward all the traffic across the DSL connection. With first-in, first-out, some of the VoIP packets would need to wait behind the e-mail packets — adding latency and degrading the quality of the VoIP phone call. With QoS, as shown in the following figure, the router forwards all the high-priority VoIP traffic first, and sends the lower priority e-mail traffic only after the high-priority queue is empty.

What’s New in Windows Vista and Windows Server 2008

Routers can distinguish between high-priority and low-priority packets by examining the Differentiated Services Code Point (DSCP) value in each packet. Unfortunately, previous versions of Windows didn’t give systems administrators control over the DSCP values, and almost all traffic had the default DSCP value of 0.
With Windows Vista and Windows Server 2008, you can use Group Policy settings to mark outgoing network traffic with DSCP values. With this capability, a QoS routing infrastructure, and a few QoS policies, database queries from your critical customer service application can soar past e-mail and Web browsing traffic.

You can also use Group Policy settings to throttle traffic from specific applications. For example, if your outgoing e-mail server is filling up your Internet connection every time you send a mass-mailing, you can throttle the e-mail server to use only half the bandwidth — even if your network infrastructure doesn’t support QoS. Policy-based QoS can be very specific, so you could throttle traffic bound for the Internet but allow traffic bound for computers on your high-speed local area network to use all available bandwidth.

QoS policies are focused on controlling outgoing traffic. While you have much less control over incoming traffic, you can also use Group Policy settings to throttle all incoming Transmission Control Protocol traffic for a computer. So, if downloads to your client computers are using too much bandwidth, you can tune Windows to slow down that incoming traffic.
Adding QoS to Your Network

QoS requires careful planning and coordinated efforts from systems and network administration teams. Before you create your policies, follow these high-level steps to create a plan to add QoS to your network:

1. Prioritize the different types of traffic on your network by assigning a standard DSCP value to each, as the example below shows. You don’t need to use every DSCP value. Any traffic you don’t classify will automatically have a DSCP value of 0, which is considered best effort.
2. Work with your network engineering team to configure routers to prioritize traffic based on the DSCP values you specified. This might already be done; some routers have QoS enabled by default for standard DSCP values.
3. Identify the executable file associated with each traffic type. For example, if you want to assign a DSCP value to packets sent by your Internet Information Services Web server, you would specify the executable inetinfo.exe. If you can’t identify the executable file, identify the TCP or User Datagram Protocol port number that the application uses. Finally, decide whether to apply the DSCP values for all outgoing traffic or for only traffic addressed to specific networks or IP addresses.
Tip: Run the command “netstat -a -b” to identify the executable name associated with all network connections.
4. Configure policy-based QoS using Group Policy Objects (GPOs), as described later in this article.
5. If you identify client computers consuming too much bandwidth with incoming traffic, use GPOs to throttle all incoming traffic on those computers, as described at the end of this article.

Typically, QoS will work only on your internal network. Most Internet Service Providers either remove or ignore DSCP values.
How to Configure Policy-Based QoS

To configure QoS policies, follow these steps:

1. Edit the GPO you want to add the policy to, and select the Computer Configuration\Windows Settings\Policy-based QoS node or the User Configuration\Windows Settings\Policy-based QoS node.
2. Right-click the Policy-based QoS node and click Create New Policy.

The Policy-based QoS Wizard appears.

3. On the Create A QoS Policy page, type a policy name and DSCP value. Optionally, select the Specify Throttle Rate check box, and set a throttle rate in either kilobytes per second or megabytes per second. The value you enter must be in kilobytes or megabytes per second, rather than the more commonly used kilobits or megabits per second. One kilobyte is equal to eight kilobits, and one megabyte is equal to eight megabits. Click Next.
4. On the This QoS Policy Applies To page, select Only applications with this executable name if you can identify a specific executable file. Then, type the executable name. If you can’t identify an executable file (for example, the traffic you want the policy to apply to is generated by a service running in svchost.exe), then leave All applications selected. Click Next.
5. On the Specify The Source And Destination IP Addresses page, leave the default settings to apply the policy to all computers. To apply the policy only to specific computers on your network, select Only for the following source IP address or prefix, and then type the IP address or network that identifies the computers that should use the policy. To apply the policy only to traffic being sent to specific computers or networks, select Only for the following destination IP address or prefix, and then type the destination IP address or network. Click Next.
6. On the Specify The Protocol And Port Numbers page, identify traffic based on TCP or UDP port numbers only if you didn’t specify an executable name. If you are configuring a QoS policy for a server, specify the source port. If you are configuring a QoS policy for a client, specify the destination port. For example, if you want to throttle SMTP traffic from an e-mail server, you would select TCP, select From This Source Port Number Or Range, and then specify port 25 (the port number SMTP uses). Click Finish.

How to Throttle Incoming Traffic

While you don’t have direct control over incoming traffic, Windows can use TCP’s traffic control capabilities to slow down incoming traffic. Unlike the policy-based QoS you just read about, this change affects all applications on a computer (including any critical applications). Because of this limitation, you should leave this setting at the default unless you have a computer that’s slowing down your network by downloading large files.

To specify the inbound TCP throughput level, follow these steps:

1. Edit the GPO you want to configure, right-click Computer Configuration\Windows Settings\Policy-based QoS, and then click Properties.
2. On the Inbound TCP Traffic tab, select the Specify the inbound TCP throughput level check box. Then, a level from 0 (to slow down traffic as much as possible) to 3 (the default setting, which is maximum throughput).
3. Click OK.

Tony Northrup is a developer, security consultant and author with more than 10 years of professional experience developing applications for Microsoft Windows.

-->Read more...

• 0 comments »

Organizations have spent years and invested huge sums of money to secure and protect network resources within their environment. Antimalware applications on the perimeter and at the desktop protect computers from viruses, worms and other malware threats. Network and personal firewalls secure computers against unauthorized network traffic.

The basic, essential layers of security are fairly universal and relatively effective at guarding the network against outside threats and malware attacks. However, a newer threat to network security bypasses the traditional network defenses. Portable media, specifically USB flash drives, are capable of transporting malware and infecting devices on the internal network. They also pose a significant risk of information leakage or data loss.

With capacities up to 8 gigabytes for USB flash drives smaller than a person’s thumb, and even higher capacities available for USB storage devices that fit easily into a pocket, users can store huge amounts of sensitive or confidential data. In addition, the drives’ small size puts them at risk of being stolen, lost or misplaced, which puts the data at even greater risk than if it were on a notebook computer.

Organizations need to take proactive steps to define the acceptable use of portable storage devices such as USB flash drives within the environment, and then put the tools and technology in place to help monitor and enforce the policy and protect the network and data from the risk posed by USB flash drives.
Define Acceptable Use

The first step in restricting or controlling the use of USB flash drives within your environment is to develop a written policy. The policy should outline what, if any, are the acceptable uses for portable storage devices. You should also spell out specific actions that are banned or include a blanket statement that any action not specifically allowed is, by default, banned.
Most organizations already have an acceptable use policy defined, which users must agree to and sign. The acceptable use policy (AUP) essentially defines how users are allowed to use the Internet, e-mail, telephones, and other communications and network resources. Users must read and agree to abide by the AUP. The AUP is an official document that should have the approval and support of both the legal department and the human resources department.

Defining the acceptable use of USB flash drives and other portable storage media, and ensuring that users have read the policy and agree to abide by the policy help educate users about the risks of using portable storage devices and give the organization more solid grounds for taking action against users who abuse or ignore the policy.
Restricting USB Flash Drives

Group Policy is an effective tool for managing computers on your network and enforcing security policies. Unfortunately, there are no default Group Policy settings for restricting or denying the ability to use USB flash drives and other portable storage devices. The good news is that you can extend Group Policy to add that functionality yourself.

Microsoft Knowledge Base article KB 555324 (http://support.microsoft.com/kb/555324) provides detailed instructions to create an administrative template (.adm) file that you can add to Group Policy to enable the ability to block the use of USB flash drives, CD-ROM drives and floppy drives. If you copy the text from the Knowledge Base article (below) into Notepad and save it as an .adm file, you can add the template to Group Policy.

CLASS MACHINE
CATEGORY !!category
CATEGORY !!categoryname
POLICY !!policynameusb
KEYNAME "SYSTEM\CurrentControlSet\Services\USBSTOR"
EXPLAIN !!explaintextusb
PART !!labeltextusb DROPDOWNLIST REQUIRED

VALUENAME "Start"
ITEMLIST
NAME !!Disabled VALUE NUMERIC 3 DEFAULT
NAME !!Enabled VALUE NUMERIC 4
END ITEMLIST
END PART
END POLICY
POLICY !!policynamecd
KEYNAME "SYSTEM\CurrentControlSet\Services\Cdrom"
EXPLAIN !!explaintextcd
PART !!labeltextcd DROPDOWNLIST REQUIRED

VALUENAME "Start"
ITEMLIST
NAME !!Disabled VALUE NUMERIC 1 DEFAULT
NAME !!Enabled VALUE NUMERIC 4
END ITEMLIST
END PART
END POLICY
POLICY !!policynameflpy
KEYNAME "SYSTEM\CurrentControlSet\Services\Flpydisk"
EXPLAIN !!explaintextflpy
PART !!labeltextflpy DROPDOWNLIST REQUIRED

VALUENAME "Start"
ITEMLIST
NAME !!Disabled VALUE NUMERIC 3 DEFAULT
NAME !!Enabled VALUE NUMERIC 4
END ITEMLIST
END PART
END POLICY
POLICY !!policynamels120
KEYNAME "SYSTEM\CurrentControlSet\Services\Sfloppy"
EXPLAIN !!explaintextls120
PART !!labeltextls120 DROPDOWNLIST REQUIRED

VALUENAME "Start"
ITEMLIST
NAME !!Disabled VALUE NUMERIC 3 DEFAULT
NAME !!Enabled VALUE NUMERIC 4
END ITEMLIST
END PART
END POLICY
END CATEGORY
END CATEGORY

[strings]
category="Custom Policy Settings"
categoryname="Restrict Drives"
policynameusb="Disable USB"
policynamecd="Disable CD-ROM"
policynameflpy="Disable Floppy"
policynamels120="Disable High Capacity Floppy"
explaintextusb="Disables the computers USB ports by disabling the usbstor.sys driver"
explaintextcd="Disables the computers CD-ROM Drive by disabling the cdrom.sys driver"
explaintextflpy="Disables the computers Floppy Drive by disabling the flpydisk.sys driver"
explaintextls120="Disables the computers High Capacity Floppy Drive by disabling the sfloppy.sys driver"
labeltextusb="Disable USB Ports"
labeltextcd="Disable CD-ROM Drive"
labeltextflpy="Disable Floppy Drive"
labeltextls120="Disable High Capacity Floppy Drive"
Enabled="Enabled"
Disabled="Disabled"

The default directory for storing templates is %windir\inf. After you have saved the .adm file, you need to import it into Group Policy so that you can apply the settings. Follow the steps below to import it:

1. Using Group Policy Editor, open your GPO (Group Policy Object).
2. Under Computer Configuration, right-click on Administrative Templates.
3. Select Add/Remove Templates.
4. Click Add and browse to the directory where you saved your .adm file.
5. Select your new template and click Open.
6. Click Close to exit the Add/Remove Templates console.

The new settings from your .adm template should now be visible and available for you to use in your GPO. The .adm templates are imported and applied at the GPO level, so you will need to import the .adm template to the GPOs that the computers or users you are trying to manage are linked to.
Encrypt Portable Data

Even if you restrict access to USB flash drives or other portable storage devices through Group Policy, the fact is that these devices are fairly inexpensive, are simple to use, and can increase productivity and efficiency if used properly. Rather than creating a blanket policy that such devices are simply not allowed or implementing a GPO that denies access to portable storage for all Users and Groups, you will probably want to allow their use under certain circumstances and by certain users.

One solution is to issue company-sanctioned USB devices to those users who are authorized to use them. Some devices, such as the Lexar JumpDrive Secure II (http://www.cdw.com/shop/products/default.aspx?EDC=852700), provide password protection and 256-bit AES encryption to protect the data in the event that the device is lost or stolen. Another device, the SanDisk Cruzer Profile (http://www.cdw.com/shop/products/default.aspx?EDC=824282), provides biometric security for your portable data. It comes complete with a fingerprint scanner and requires biometric authentication before providing access to the data it contains.

Alternatively, you can use normal, unencrypted USB flash drives but provide software that will ensure the data stored on them is secure. Pointsec Protector (http://www.cdw.com/shop/products/default.aspx?EDC=1221712) helps you lock down USB ports and can be configured to ensure that any data written to removable storage is properly encrypted. It also provides some flexibility and control over how the data is accessed once it is on the USB flash drive.
Control Access to Data

A broader solution for protecting data and guarding against information leakage or theft is to use Windows Rights Management Services. WRMS will not work for every organization, but it will for organizations that are running Windows Server 2003 networks and rely primarily on Microsoft for their desktop operating systems and office productivity applications.

WRMS allows you to implement security that is persistent and continues to protect the data no matter where the data goes. With WRMS, you can mark an e-mail or a Word attachment as confidential and apply security to control how the information is accessed. You can designate that only certain users can view the information and restrict them from editing, copying, printing, saving or forwarding the information.

If a user does not usually have rights to certain data but needs access to sensitive information for a specific project or deliverable, that access can be provided on a short-term basis with a pre-defined expiration date. Once the expiration passes, the user will no longer be able to access the data even if they have copied it and taken it home to their personal computer.

Diving into all of the functions and benefits of WRMS is beyond the scope of this article. Suffice it to say that WRMS can be a powerful tool in your arsenal for securing data and protecting against information leakage. For more information about WRMS, visit Microsoft’s Windows Rights Management Services Web site: http://www.microsoft.com/windowsserver2003/technologies/rightsmgmt/default.mspx.
Embracing Portable Storage Securely

It might seem simpler to just issue a draconian mandate that portable storage devices are not allowed. Sticking your head in the sand and pretending that USB flash drives don’t exist doesn’t make the risk go away, though. Users still own them and can easily bring them into the office and connect them to computers on your network without your knowledge.

It is much better to embrace the technology. Learn about the advantages of using such devices and understand the risks. Determine how they improve efficiency and increase productivity for your users and define a policy to restrict and control their use to specified users or tasks. Most important, though, for those who ignore policy and bring in USB flash drives from home, or for those who are authorized to use them but lose their USB flash drives or have them stolen, implement security controls and technology to restrict the ability to use them and to secure and protect the data that is stored on USB flash drives.
Tony Bradley, a Microsoft Most Valuable Professional in Windows security, is a computer security consultant with BT INS in Houston and author of Essential Computer Security.

-->Read more...

• 0 comments »

With Group Policy objects, you can change hundreds of default settings in Microsoft Windows — from color schemes to desktop security — and create a complex hierarchy of GPOs to configure settings based on the user and the computer’s location, organization and purpose in Active Directory environments.

Here’s how to define, edit and prioritize multiple local GPOs.

First, not all computers can join a domain. For example, public computers (such as a kiosk in a library) are frequently attacked and could put the entire domain at risk. Windows XP and earlier versions of Windows had a single local GPO that applied settings to the client computer and all users that logged on to the computer. Therefore, if you needed to lock down the desktop environment to prevent guests from opening the Start menu, you also made it impossible to manage the computer when logged on as an administrator.

Windows Vista now supports multiple local Group Policy objects (MLGPOs) so that you can apply different settings to administrators, non-administrators and specific users.
MLGPO Types

Windows Vista supports the following local GPOs:

* Local Computer Policy: Just like earlier versions of Windows, Vista supports local computer policy that always applies, regardless of which user is logged on. This policy contains both the Computer Configuration and User Configuration nodes. All other local GPOs contain only the User Configuration node.
* Administrators Policy: Settings configured in this policy apply only to users who are members of the local Administrators group.
* Non-administrators Policy: Settings apply to all users who are not members of the local Administrators group.
* User-Specific Policies: You can configure GPOs that apply to only a specific user account.

Any user who logs on will have, at most, three local GPOs: the local computer policy, a user-specific policy, and either the administrators or non-administrators policy. Oddly, you cannot create local GPOs that apply to local groups, such as “backup operators” or “guests.”
GPO Priorities

Local GPOs are applied in the following order, with later policies overriding conflicting settings in earlier policies:

1. local computer policy;
2. administrators and non-administrators policies;
3. user-specific policies.

For example, if you set the desktop to blue in the local computer policy but set it to red in the administrators policy, it will appear red when an administrator logs on. If you set the desktop to green in the user-specific policy, that setting would override all other local GPOs.

If the computer is a member of an Active Directory domain, domain GPOs always override conflicting settings in local GPOs. If you want to completely disable local GPOs, enable the following setting in a domain GPO:

computer configuration\administrative templates\system\group policy\turn off local group policy objects processing
To remove a local GPO, right-click it from this dialog box, and then click Remove Group Policy Object.
How to Edit Local GPOs

To edit one of the local GPOs in Vista, log on as a member of the administrators group and follow these steps:

1. Click Start, type MMC, and then press Enter. Respond to the User Account Control prompt that appears.
2. In the blank console, click the File menu, and then click Add/Remove Snap-In.
3. In the Add or Remove Snap-Ins dialog box, under Available Snap-Ins, click Group Policy Object Editor. Then, click Add. The Select Group Policy Object wizard will appear.
4. On the Welcome to the Group Policy Wizard page, click Browse.
5. On the Browse for a Group Policy Object dialog box, choose a GPO:
* Local Computer Policy: On the Computers tab, click This Computer.
* Administrators Policy: On the Users tab, click Administrators.
* Non-administrators Policy: On the Users tab, click Non-administrators.
* User-Specific Policies: On the Users tab, click the user account you want to configure.
6. Click OK, and then click Finish.

You can now use this custom management console to edit the GPO you selected. To simplify editing, add any useful local GPOs to the console, and then save the console for future use.
Copying Local GPOs Between Computers

It’s not as easy as managing GPOs in a domain, but you can copy most GPO settings between standalone computers running Vista. First, use the Group Policy Object Editor to configure the local GPOs on the primary computer. Then, copy the GPO settings to your target computers. The technique you use to copy the data depends on whether your settings are within the Security Settings node or the Administrative Templates node. (Just a reminder: The Group Policy Management Console can be used only with domain GPOs.)
Security Settings

If you edit the local computer policy and update any settings within the computer configuration\windows settings\security settings node, use the secedit command-line tool to copy the settings to the target computers:

1. Export the security settings from the primary computer by running the following command:
secedit /export /cfg secsettings.inf
2. Copy the secsettings.inf file to each of your target computers, and perform a full backup.
3. On each target computer, run the following command to import the security settings from the primary computer:
secedit /configure /db secsettings /cfg secsettings.inf /overwrite
4. To ensure all settings are applied, restart the target computers.

Administrative Templates

If you edit any of the local GPOs and update settings within the Administrative Templates node, manually copy the settings to the target computers by following these steps:

1. For any GPO you edited, copy the contents of the folder listed in the following table to the target computer. These folders are hidden and require administrative privileges to access. For user-specific policies, you must change the folder name to match the service set identifier (SSID) of the user on the target computer.
2. On the target computer, run gpupdate /force to apply the new Group Policy settings.

The registry.pol file stores most of the GPO data. To view these files directly, use the free PolViewer utility available at www.gpoguy.com/polviewer.htm.
GPO Folder
Administrators %windir%\system32\grouppolicyusers\s-1-5-32-544\
Non-administrators %windir%\system32\grouppolicyusers\s-1-5-32-545\
User-specific policies %windir%\system32\grouppolicyusers\\
Local computer policy, computer config. %windir%\system32\grouppolicy\machine\
Local computer policy, user config. %windir%\system32\grouppolicy\user\

Troubleshooting Local GPOs

You can troubleshoot problems with local GPOs using most of the same tools you use for Active Directory GPOs, including:

* Resultant Set of Policy: A Microsoft Management Console snap-in that analyzes all Group Policy settings, displays the effective settings, and allows you to isolate the Group Policy objects that define any setting.
* GPResult: A command-line tool that provides a list of active GPOs, including both domain and local GPOs, among other useful information.
* Event Viewer: Vista adds an event to the System Event Log when policies are applied, and stores detailed processing information in the applications and service logs\microsoft\windows\group policy\operational event log. The Operational Event Log replaces the userenv.log file used in earlier versions of Windows.
* Group Policy Log View: A tool that exports Group Policy event data into a text file. You can download GPLogView at go.microsoft.com/fwlink/?LinkId=75004.

IT Takeaway

GPOs are the most efficient way to configure the hundreds of settings on a Windows computer. XP and earlier versions of Windows had only a single local GPO, and any settings configured in that GPO applied to all users. Therefore, you couldn’t use the local GPO to harden the desktop environment because you would also prevent administrators from managing the computer.
•Vista solves this problem by providing three levels of local GPOs: the local computer GPO, the administrators and non-administrators GPOs, and GPOs for individual users.
• With Vista, you can lock down a computer without locking yourself out.


Tony Northrup is a developer, security consultant and author with more than 10 years of professional experience developing applications for Microsoft Windows.

-->Read more...

• 0 comments »

Photo: Richard Robinson
A document management system comes in handy in case of an audit, says Member One Federal Credit Union IT Specialist Tonya McEnheimer.
Most businesses work with more documents than ever, and managing them all is often a costly and complex process.

“There is a demand within our credit union for document management,” says Tonya McEnheimer, information technology specialist at Member One Federal Credit Union in Roanoke, Va. “Paper is challenging. We do not have enough space for it, and it would be a big help to have a document management system, so that we could retain data and documents and retrieve them immediately if we were audited or if a member needed a document.”

Windows SharePoint Services 3.0 is a free Web-based application from Microsoft for Windows Server 2003 that provides collaboration, workflow, document management and security features through a Web browser or via direct integration with Microsoft Office XP 2007. WSS allows users to create virtual work spaces for individual projects that can be used, among other things, to store and manage related documents. Document work spaces contain a default document library, called Shared Documents. Each document library can have individual settings that control functions, such as document versioning and security.

But while it is free, WSS is resource intensive and requires a server with a minimum of 1 gigabyte of random access memory. WSS introduces an extra level of complexity, especially having to maintain a database, which will require extra work from the IT department.

This product is a good fit for organizations, such as Member One. “We run a financial platform to process transactions with its set of rules, and Microsoft for just about everything else,” says McEnheimer. “We keep one drive open for end users and use it for storing documents, and we restore those documents from tape backups.”

WSS includes document versioning, approval, document check in/out and control on copying and distributing documents. Here are the basic steps for developing a secure WSS environment:
1) Creating a Document Management Work Space

Once WSS has been installed, the first task is to log onto the default top-level Team Site (using the account that you used to install WSS, which is the first default WSS user) and create a document work space (essentially a sub-site of Team Site) for a new project: Project X. The top-level Team Site will be opened automatically once the configuration wizard has completed. You can browse to the site anytime by simply typing http://<> into a browser window. It is also necessary to add this site to the list of Trusted Sites under the security tab in the Internet Options control panel applet if you are browsing the site from the server.

From the Team Site home page, click Site Actions, and select Create. Under Web Pages, select Sites and Work Spaces. In the New SharePoint Site window, you will be able to configure various options for the new work space. Give it a title (Project X) and URL (projectx). Select Document work space as the template.
2) Configuring Security

There are two options for configuring security on the new work space. In a simple environment, it is likely that you will have one top-level site with several work spaces. Let’s assume that each work space will have access restricted to a specific group of users. In this scenario, it is best to select Use unique permissions. Leave the navigation options as default, and press Create.

One of the biggest advantages of using WSS to manage document security is that it allows trusted users to control access to document libraries, or individual documents, rather than relying on the IT department to configure access control lists on files and folders. Transferring this responsibility should be made with careful consideration, however.

The Set Up Groups for this Site window allows you to set up three basic groups for controlling user access. Visitors are allowed to view documents, members may create new and edit existing documents, and owners have full control over the work space. It is possible to configure granular security down to individual documents, but the simpler you can keep things, the better. To start with, these three basic groups should suffice. By default, a new group unique to the new work space will be created for members and owners. To configure a unique group for visitors to the Project X work space, rather than allow visitors who are granted view permission to the top-level Team Site to view content in the Project X work space, simply select Create a new group, and a default name will be assigned. Press OK.

Let’s add a user to the Project X Members group. From the Project X home page, select Add new user where it says Groups. In the Users/Groups box, you can add a user to a specified group by entering the user’s name in the following format: \user. Press the Check names icon under the box, and your entry should be underlined if it can be matched. Make sure Add users to a SharePoint Group is selected under Give permissions, and select Project X Visitors [Read] from the menu. Press OK.

It may be necessary to access your work space through its unique URL rather than via the top-level Team Site, for instance, http://<>/projectx. It will depend on the account you are using to access the site and whether it has access to the top level.
3) Configuring Document Versioning, Check I/O and Approval

From the Project X home page, click the default Shared Documents library, and then Settings > Document Library Settings. Under General Settings, select Versioning settings. Configure the settings shown in the table below, and press OK.
Content Approval Yes
Document Version History Create Major and Minor Versions
Require Checkout Yes

Go back to the Project X home page, and select Add a new document under the Shared Documents library. After adding a new document, you will see that it is necessary to check the document in to WSS. You can check it in immediately to allow others to edit it by clicking Check In. You can now edit the document in Word by clicking on the document icon on the Project X home page. If you are using Word 2007, you will notice that it is necessary to check the document out before you can edit it. Simply click on the Check Out button at the top of the screen. You will be notified that you are now working with an offline copy of the document, so you can disconnect from the network and continue working until you’re ready to check the document back in with WSS. The document management pane in Word 2007 gives you the opportunity to check the document back in to WSS when you are ready. Publish a new major version, and press OK.

If you return to the WSS Project X home page and view the document’s history from the drop down menu, you will see there are now two versions of the document: the original draft (version 0.1) and the new major version (version 0.2), which is pending approval. Once the document has been approved, version 0.2 will become version 1.0 automatically. You need to have appropriate rights in order to approve a document, which can be done from the same drop-down menu used to view the document’s history.
4) Working with Document Libraries Offline

If you have Outlook 2007, you can take whole document libraries offline by clicking on the document library from the work space home page (shared documents in this case), and in the Actions menu select Connect to Outlook. You will be presented with a new folder in Outlook that contains a list of documents from the library. You can then edit any document offline, and when you reconnect to the network, simply open the document from Outlook, and you have the option to upload the modified version to WSS.
5) Document Backup and Recovery

Backup of WSS, its database and all other components, is straightforward. From the SharePoint 3.0 Central Administration site, which can be found under administrative tools in the control panel, log on as an administrator, select the Operations tab and then Perform a backup. If you select the top level (Farm), everything required to restore WSS to its present state will be backed up. Continue to Backup Options from where you can choose the type of backup and the file location. There is a command-line tool (stsadm.exe), which can be used to automate various WSS operations including backup.

WSS Version 3 contains a two-stage recycle bin. The Project X work space contains a user recycle bin where items are retained for 30 days if a user deletes a document. There is also a site recycle bin where items that are purged from the user’s recycle bin can be found and restored if necessary by an administrator. This facility should minimize the need to restore documents from backup and further protect critical business data.

But McEnheimer says this feature makes it easier to retrieve documents that users delete by mistake. “A common problem for end users is the mistaken deletion of an important document,” she says. “If the recycle bin has been emptied, the last resource is retrieval from a stored backup, which is very time consuming. WSS gives IT staff a break by allowing quick and easy access to deleted files.”

From the work space (or user) recycle bin, which can be found in the menu on the Project X home page, you can select Site Collection Recycle Bin from the top of the screen. At the Site Collection Recycle Bin, you then need to select Deleted from end user Recycle Bin under Select a View. If you choose to restore a document from the Site Collection Recycle Bin, it will be put back to its original location in the work space.
Hardware Requirements for WSS

Hardware requirements for Windows SharePoint Services 3.0 vary depending on many factors, such as how WSS is deployed (e.g., standalone or farm installation), the number of concurrent users and the volume of documents that need to be stored. Before deciding on how to deploy WSS and what hardware specifications will be required, it is important to understand how WSS will be used. For a standalone WSS installation, during which the Web application and database are running on the same server, 2 gigabytes of RAM are recommended with dual processors 3 gigahertz or faster.

Make sure you plan for future growth from the outset. If you want to store 100GB of documents, you need to have 130GB of disk space available for Structured Query Language server. If you decide to enable document versioning, a copy of each version is stored in the database. You also need to take into account the space required for database log files and consider leaving 25 percent free disk space on each volume. To help control the amount of disk space used, you can create quotas for SharePoint sites to limit the amount of storage they will use. Warning e-mails may also be sent when the amount of storage used reaches a given level.

If WSS is to be used intensively or you require flexibility for future growth, WSS may be installed in a server farm topology, in which the front-end and database server roles are hosted on one or more computers. The recommended hardware requirements for the front-end server (the server that hosts the WSS Web application) are the same as for a standalone WSS installation. Requirements for the database server are that it should host SQL Server 2000 SP3a, or higher, or SQL Server 2005 SP1, or higher. Recommended processor requirements for the standard edition of SQL Server 2005 are a single processor 1GHz, or faster, and a minimum 1GB of RAM. Realistically, these are minimum requirements, however.

To determine whether your WSS installation is secure and set up correctly, you can run the Best Practices Analyzer for WSS against your server. This tool may be accessed at http://go.microsoft.com/fwlink/?LinkID=83335&clcid=0x409.

The tool is run from the command line and generates an HTML report. Simply run the downloaded executable and extract the files to a convenient directory. From the command line, change the working directory to the location where the files were extracted from and run the following command:

sharepointbpa.exe -cmd analyze -substitutions SERVER_NAME

Replace with the name of the WSS server. The report will be generated in the same directory, detailing any issues with the configuration.

Additional security is provided with the ability to block certain file types from being stored in the WSS database. From Central Administration > Operations > Blocked File Types, you may add or remove file extensions to determine whether users can save and/or retrieve certain file types.


IT Takeaway
• Will Your Users Really Benefit from WSS?
WSS introduces many useful features, but you should consider whether it would benefit your users and whether they will need training to use it. It is not the most intuitive system. Consider the way your users work with documents and how security is managed by the IT department on your file servers. How does this compare with the facilities WSS has to offer?
• Consider the Extra Resources and Increased Costs Involved in Hosting WSS
WSS is resource intensive and requires a server with a minimum of 1GB of RAM. WSS introduces an extra level of complexity, which will require extra work from the IT department.
• What Is the Difference Between Windows SharePoint Services and SharePoint Portal Server?
SharePoint Portal Server is based on and requires Windows SharePoint Services. It lets large organizations integrate multiple WSS sites and applications into one portal with advanced features, such as search indexing across multiple sites and single sign-on.

-->Read more...

• 0 comments »

BizTech’s crack team of information technology professionals offers 10 guaranteed proven techniques that will enable your desktops to move as if they were powered with Flintstone-era technology instead of dual-cores. If you recognize any of these end-user behaviors, you can share the consequences and help others avoid bringing their machines to a screeching halt.

1 Ignore patch updates.
Who needs a stinking patch? Never patch your computer using Microsoft Corp.’s update utility. None of the latest viruses or other forms of malware ever take advantage of these vulnerabilities anyway. Besides, you’re smart enough to know those patches are part of the Microsoft Evil Conspiracy.
–Dr. Jeff Sheen, senior corporate network engineer for Sogeti

2a Visit gambling sites.
Many gambling Web sites will expect you to — and in some cases trick you into downloading software in order to play. While this software in many cases isn't malicious, some will sit in your system tray even when you aren’t playing and can inundate you with pop-ups and “free offers,” all the while soaking up memory and degrading your system’s overall performance.
– Jason Holbert, Tier II desktop support technician at Harcros Chemicals

2b And don’t forget the porn sites.
Similar to their gaming cousins, lots of porn sites will open all kinds of windows and pop-ups in addition to tricking you into downloading applications. These applications sometimes transmit data regularly to other Web sites. This robs you of computing cycles, and slows performance while increasing security risks.
– Jeff Gross, author of Texxors.com

3 Ignore EULA’s and Privacy Policies (especially on free software).
It’s free, after all, so why bother reading the End-User License Agreement and all that legal stuff? Except that you’ll often find that, along with your “free” program, anywhere from 15 to 20 other files are installed from various adware vendors. There are a few great and truly free programs out there, but typically adware is the difference between the free and paid versions of software.
– Phil Leiter, IT manager at Cumberland Associates LLC

4Download free screensavers, toolbars, browser helpers, unknown cleaners and any software offered from pop-up ads.
Since you’ve decided to ignore the EULA, these are the programs for you. Remember, if it costs nothing, it’s usually worth nothing. Even toolbars bundled from legitimate sources such as Google will rob you of computing cycles.
– Jeff Gross

5Download peer-to-peer file-sharing clients.
Since peer-to-peer relies primarily on the computing power and bandwidth of the active users within the P2P network, it has the potential to consume huge amounts of PC resources in the form of CPU cycles and memory, which, in turn, can tax the average system to the point where it slows to a crawl. So download Limewire and Kazaa onto your work desktop, which can effectively punch a huge hole in your security schema by bypassing your company’s firewall. Misconfigurations can result in wide open TCP/IP ports, a notorious method of introducing malware or spyware into a network. Once infected, one PC can infect other PCs on the network.
–Douglas Schweitzer, an Internet security specialist and author of several information security books

6Open as many programs as possible for as long as possible.
Computers are capable of doing many millions of things at a time, so running lots of programs that are unnecessary or fun will only add to your own enjoyable day. If you get enough programs running, you will even get built-in breaks during the day while your porn loads. Whatever you do, don’t run defrag or reboot the system. Rebooting will only force you to re-download all of those picture files again, and since it took so long the first time, you’d only lose productivity, right?
–Dave Howe, vice president of systems at Howe Lumber Co.

7Load up your System Tray
Nothing says “Ready to Go!” like 20 little icons standing by in the System Tray. Great examples of these are animated cursors and screen shots. Except that all of those little icons represent programs running in the background and taking away resources before you start your first program. Most of these programs are a part of larger applications — the annoying and often unnecessary part. Get the System Tray under control by running MSCONFIG, click the Startup tab and uncheck the programs you know are not critical. (Unchecking does not delete the program, but prevents it from starting).
– Phil Leiter

8Keep drivers from old printers.
Keeping old print drivers running in the background will slow things down. Many printers have toolbox programs that run and wait for print jobs or monitor the condition of your printer. And you guessed it — it’s using resources. Get rid of them. Even for printers you have, it’s only necessary to run the basic driver without installing tons of other stuff. If you don’t use the printer, remove the driver, the software toolbox and whatever else is associated with it.
– Jeff Gross

9Run lots of Internet video loops.
Everyone loves blooper reels and funny videos. Have them on constantly, so when coworkers come by, you can show them the latest and funniest. Don't worry that there won't be people walking by, because they are sure to be hunting for the IT person since their Internet is running slowly at the moment also.
– Dave Howe

10Keep your PC warm.
Try to place your desk as close as you can to a radiator or baseboard to keep your feet and PC warm. If you have a desk with one of those cut-outs for a PC, be sure to push it as far back as possible to keep the case exhaust air from blowing all over the place. Use the top of the PC, or any space in front of it, to store books and papers and such. In no time your PC will fill with dust and the overheating will bring your system to a screeching halt.
– Phil Leiter

-->Read more...

• 0 comments »

Troubleshooting problems often requires you to look at dozens of different settings, and that’s if you can even remember all of the important settings. In Windows Vista, you can use data collector sets to quickly capture a snapshot of a computer’s configuration, including the following:

* System state
* Registry values
* Log files
* Configuration files
* Windows Management Instrumentation (WMI) management paths
* Performance counter data
* Event trace data

Windows Vista includes built-in data collector sets that you can use to capture information about a system’s status, or you can create your own data collector sets to capture custom settings and log files. These data collection sets can help you streamline the troubleshooting process in your organization, even if the problems relate to custom applications.

First, create the data collector set on your computer based on one of the existing templates, and add custom data collectors to gather any files or registry keys used by internal programs. Then, use the Logman tool to export the data collector set to a file. Distribute that file to the computers you manage, and run Logman again to import the file. Data collector sets never forget to check an important setting, so they can substantially increase thoroughness of troubleshooting while decreasing the time it takes to solve a problem.
Built-in Data Collector Sets

Windows Vista includes the following data collector sets:

Local Area Network Diagnostics: Use this data collector set for troubleshooting problems with wired network connections. It logs network configuration data, network performance counters, and performs network diagnostics tracing.

Wireless Diagnostics: Use this data collector set for troubleshooting problems with wireless network connections. It logs the same data as LAN Diagnostics, and adds wireless network information.

System Performance: Use this data collector set if your Windows Vista computer is having random slowdowns, unexplained paging, or short battery life. It logs processor, memory, disk, and network performance counters, and performs kernel tracing.

System Diagnostics: Use this data collector set for general hardware or software troubleshooting, including Stop errors (also known as blue screens), hardware problems, and driver failures. It logs the same data as System Performance, and adds detailed system configuration information.
Figure 1: Access data collector sets from the Computer Management console or from the Reliability And Performance console.
How to Use the Standard Data Collector Sets

To use the built-in data collector sets, follow these steps:

Click Start, right-click Computer, and then click Manage. Respond to the User Account Control prompt that appears.

In the Computer Management console, expand System Tools, Reliability And Performance, Data Collector Sets, and then System.

Right-click a data collector set and then click Start, as shown in figure 1. A green arrow appears over the data collector set’s icon, indicating that it is currently running. Eventually, the green arrow will change to an hourglass while the data is being processed.

After the data collector set has finished running (or after you right-click it and click Stop), right-click the data collector set again, and then click Latest Report.
Figure 2: Reports summarize the results found by the data collector set.

Windows Vista displays the report generated by the data collector set, as shown in figure 2.
How to Create Custom Data Collector Sets

The built-in data collector sets are perfect for troubleshooting general computer and networking problems. While they might log far more data than you really need, there is little chance that any settings or counters related to the core operating system are missing.

What the built-in data collector sets will not capture is information about your applications. Fortunately, you can create your own custom data collector set based on one of the built-in data collector sets, and extend it to capture registry settings, log files, and configuration files for the applications you troubleshoot most. To create a custom data collector set, follow these steps:

In the Computer Management console, expand System Tools, Reliability And Performance, and Data Collector Sets. Right-click User Defined, click New, and then click Data Collector Set. The Create New Data Collector Set wizard appears.

On the “How Would You Like To Create This New Data Collector Set?” page, type a name and click Next.
Figure 3: Most custom data collector sets should be based on one of the standard templates.

On the “Which Template Would You Like To Use?” page, click one of the templates. Click Finish, as shown in figure 3 (the remaining wizard pages are not important).

By default, your custom data collector set will have all of the data collectors from the template.

Add your own ata collectors by following these steps:

In the Computer Management console, expand User Defined. Right-click your custom data collector set, click New, and then click Data Collector. The Create New Data Collector appears.

On the “What Type Of Data Collector Would You Like To Create?” page, type a name, click one of these options, and then click Next:

Performance counter data collector: Logs performance counters, such as processor or network utilization.

Event trace data collector: Stores event trace information from a Windows Vista event trace provider. Typically, you should add all event trace data collectors that might be related to a problem, because it is better to have too much information than not enough.

Configuration data collector: Stores registry keys, WMI management paths, or the system state.

Performance counter alert: Creates an alert if a performance counter reaches a threshold that you specify.

Follow the prompts that appear to create your data collector.

Configure your data collector set to automatically run at a scheduled time, to stop running after a number of minutes, or to launch a task after running by following these steps:

Right-click your custom data collector set, and then click Properties.

On the Properties dialog box, click the Schedule tab. Using this tab, you can configure your data collector set to automatically run on a scheduled basis. This is useful for proactively monitoring computers. For example, you could configure a data collector set to run daily. Then, if a user experienced a problem that started several days ago, you could look through the recorded reports to determine what may have changed.

Click the Stop Condition tab. Use this tab to configure how long the data collector set runs for.

Click the Task tab. Use this tab to configure a task to run after the data collector set. Use Task Scheduler to create a task that will run. For example, you might create a task that sends the report to you as an attachment to an e-mail message.

Click OK to close the Properties dialog box.

For example, to capture the Office 2007 configuration settings, select Configuration data collector in the Create New Data Collector wizard, and then specify the HKEY_CURRENT_USER\Software\Microsoft\Office registry key to capture all Office-related settings. Then, to capture Word’s Normal template, view the data collector’s properties, click the File Capture tab, and add the %appdata%\microsoft\templates\normal.dot path.

As with the built-in data collector sets, you can generate a report by right-clicking your custom data collector set, and then clicking Start.
Automating Data Collection Set Configuration and Capturing

Of course, you wouldn’t want to manually create a data collector set on every computer. Once you create a data collector set on one computer, use the Logman.exe command-line tool to export the data collector set to a file:

Logman export -n "Office 2007 Configuration" -xml "Office 2007 Configuration.xml"

Then, you can store the XML file on a central server and use a logon script to add the data collector set to computers with a command, such as the following:

Logman export -n "Office 2007 Configuration" -xml \\server\share\Office 2007 Configuration.xml

Lastly, you can use the “Logman update” command to replace an existing data collector set, or use “Logman start” and “Logman stop” to control data collection.
Tony Northrup is a developer, security consultant and author with more than 10 years of professional experience developing applications for Microsoft Windows.

-->Read more...

• 0 comments »

Previous Versions, a file restore feature available by default as part of Windows XP (Service Pack 2) and Windows Server 2003, restores files stored on Windows Server 2003. On Vista, it can also restore local files. You can also install Previous Versions on Windows 2000 (Service Pack 3 or higher) and Windows XP (pre-Service Pack 2) by downloading the Shadow Copy Client software from Microsoft’s Web site at http://www.microsoft.com/downloads/details.aspx?
displaylang=en&familyid=e382358f-33c3-4de7-acd8-a33ac92d295e.

On Windows Server 2003, Shadow Copies can be scheduled per storage volume to let users see a history of previous file versions when connecting to a share on the server from Windows XP or Vista. This feature allows users to roll back to an older version of a file if unwanted changes were made. Giving users the ability to restore previous versions of files may help alleviate the reliance on the information technology department from restoring files from backup.
Figure 1

Figure 2

Figure 3

Figure 4

Before configuring Shadow Copies you should consider how often you want to create a Shadow Copy of a volume (the default setting is twice a day), and how much extra storage space you’ll need. Ideally, Shadow Copies should be stored on a separate disk for improved performance, but by default they are stored on the source volume and you can set a size limit. A maximum of 64 Shadow Copies can exist per volume before old copies are automatically overwritten.
Configuring Shadow Copies on Windows Server 2003

Go to My Computer and select any volume shown under Hard Disk Drives. Click the Shadow Copies tab and highlight the source volume for which you would like to enable Shadow Copies (figure 1). Click Settings, and you will see that by default the storage area for Shadow Copies is the same as the source volume. On this file server, I have a volume on a separate disk that I will dedicate to Shadow Copies, so I will select F:\ from the drop down Located on this Volume and select No Limit under Maximum Size, because there is nothing else on the disk (figure 2). If the volume you select for storing Shadow Copies contains other data, you should consider enforcing a limit.

Click Schedule, and on the drop down menu at the top of the dialog box you will see that there are two default scheduled tasks to create Shadow Copies at 07 a.m. and noon, Monday through Friday. My users work on the weekend, so I will modify both tasks to include Saturday and Sunday under Schedule Task Weekly, and then press OK. Press OK again on the settings dialog box. Back to the Shadow Copies tab, let’s kick off the first Shadow Copy by pressing Create Now, making sure the source volume is still highlighted (figure 3).
Training Employees to Restore Their files from Shadow Copies

Before showing users how they can use Previous Versions to restore files, you should explain a little about how it works, what the feature can do and what it can’t do. Make sure your employees know the following:

* How often Shadow Copies of their files will be created
* In Windows XP, Previous Versions may not be used to restore a file that has been deleted
* In Windows Vista, they can use Previous Versions to restore local files that have been backed up if users are storing files locally and Vista’s backup is enabled
* Shadow Copies of files are not stored indefinitely
* Approximately how many Previous Versions of files will be available at any time based on the storage space allocated for Shadow Copies and the frequency with which they are generated
* They can view previous versions of files, copied them to an alternate location, or replace the file in its existing location

To demonstrate the Previous Versions feature, use this example:

Suppose a user creates a file at 10 a.m. on a shared network drive that is hosted on a storage volume where Shadow Copies are enabled. After lunch at 1:30, the user changes the file, has second thoughts, and wants to revert to the “before lunch” version of the file. Our schedule automatically created a Shadow Copy of the volume while the user was at lunch, so an older version of the file will be available to restore.

On Windows XP or Vista, right click on the file you want to restore, and select the Previous Versions tab. You will see an older version of the file available to restore, along with the date and time it was created (figure 4). You have the option to view the older version of the file, restore it to an alternate location (Copy), or overwrite the file with the older version.

Previous Versions does not provide true document versioning because copies are created based on a schedule, but it can save time and let uses restore their own files in certain situations.
Russell Smith is an independent consultant based in the United Kingdom who specializes in Microsoft systems management.

-->Read more...

• 0 comments »