IAQ Time

You've heard of Frequently Asked Questions, or FAQ's.  But an IAQ list is for Infrequently Asked Questions: The questions that are rarely asked.  That doesn't have any correlation with their importance, however.  It just means that they don't get asked as often.

Why run Active Directory at home?

There are a lot of good reasons actually.  Let me itemize just a few:

- Time and Computer Restriction

If you have kids, you can set their allowed logon and logoff times per day of the week, in one place and it applies wherever they use a computer on your home network.  If they like to sneak onto your other kids' computers, or those of you or your spouse, you can easily lock their accounts down to only one computer.

- Account Management

Rather than making a "Josh" account on three computers and leaving a stale password on all three, you can make one "Josh" account and turn on password policy to force them to change it on a set number of days, and force them to use a complex password.  Go ahead and laugh, but I've seen a lot of home computer hacked into because the users had stupid (or blank) passwords.

- Authentication

Tired of setting up a "Josh" account on three computers so your son Josh can play games on one, save pictures to another, and send print jobs to another?  Well, a single AD account and simple group features will take care of that and leave you plenty of time to do more exciting things, like mowing the lawn.

- Group Policy

Easier configuration management.

Why use WSUS at home?

Two reasons: Better Control, and it's FREE.  You can approve more types of updates for automatic installation than you can with Automatic Updates (aka "Windows Update", aka "Microsoft Update").  If you don't believe me, and you're still using Automatic Updates, and you believe your computers are patched up completely, visit the Microsoft Update site again, and check again.  You could have automatically approved and installed all of them in one place, for all of your home computers, and moved on.  Oh yeah, and it's free.

Why use a Router at home?

If you plug your computer directly into your cable modem, all I can say is "good luck!".  We did some testing in one our labs at an office I used to work at, where we plugged in an XP SP3 computer without a router/firewall, and it was hacked and owned within 45 seconds.  After three more tests, the average turned out to be 50 seconds.  Using Windows Vista, in default configuration, it took about 1 hour and 20 minutes on average.  We didn't test with Windows 7 because it wasn't out yet.  But you get the picture, hopefully.

Most modern home network routers provide a decent firewall capability out of the box.  Nothing is perfect, after all, hackers have penetrated firewalls of some of the biggest corporations, the U.S. military, and even the FBI and CIA web sites.  But then again, the stakes are much higher, so the appeal of hacking those is much higher than anyone wanting to hack YOUR home network (unless you're the CEO of a big company)

Whether you prefer Linksys, Cisco, Netgear, D-link, or whatever, most of the routers sold today offer a fairly good firewall and other features to help secure your network.  They're cheap too.  Use them.

What is the point of following politics?

Politics is an elaborate game designed to keep the public distracted from two main problems in our lives:  (1) Most people aren't happy and are bored, and (2) it makes them believe they have some influence on the outcome of elections, and therefore, some influence on government action.  Once they realize that (2) is false, they occupy that time with things like watching TV shows, sports, and regular consumption of drugs and/or alcohol.

Why doesn't Dave follow a franchise Sports Team like everyone else?

Because I've learned over the years that fans value the team about 10X more than the players do.  Dangle a better contract in front of any NFL, NBA or MLB player and they're gone like a dog chasing a stray chunk of lunch meat.  You can't buy fans away from their favorite teams, but the players, or rather "contractors" (let's face it, that's what they are), have no such allegiances.  The whole thing is disingenuous.  I watch games for pure entertainment value.  I don't give a flying crap who is getting traded to whom, or what so-and-so stats are.

Why does anyone read this blog?

I'm still trying to figure that out.

The Low-Hanging Fruit: 5 Quick Projects for Your Windows Network

So you have a small business environment with a handful of employees and computers. Maybe you have a few dozen computers. Maybe you’re so busy running around tending to user needs and putting out fires that you haven’t stopped to take a breath and prioritize where to dig your trenches yet.

Fear not. I’ve put together a short list of easy projects you can knock out in a few hours that will help shift the burden of your work either into the computers themselves or bestow your users with powers to solve their own problems ( or at least some of them ). Every minute you save each day adds up. The more time you free up, the more time you have to automate other tasks, thereby freeing up even more time. It’s a win-win-win and can easily turn into an exponential curve of goodness for you.


(1) Implement WSUS


Why? It will do a much better job of keeping your computers updated with current patches and service packs than Automatic Updates can ever do. It’s easy to setup. Easy to administer. It gives you a clear view of your environment.

Whether you have one server or two, you can drop WSUS on one of them and setup your own internal software updates management system. Automatic Updates are nice (aka Windows Update, aka Microsoft Update), but there are many update types that you cannot configure to automatically install (root certificates, optional updates, etc.). Plus, when you get WSUS up and running, you will quickly have a simple, easy, clear and concise view of your environment, including a direct view of which computers are getting updates and which are not.

Steps:

1. Download and Install the WSUS 3.0 pre-requisites
   1. Microsoft Report Viewer Redistributable 2008
   2. Microsoft .NET Framework 2.0 (or later)
2. Download and Install WSUS 3.0 Service Pack 2 (x86 or x64)
   1. Do not install on C: (or wherever Windows is installed). Choose a different local drive on the server to install and for storing updates locally.
3. Configure your WSUS options and run an initial Synchronization
   1. Synchronize against Microsoft Update servers
   2. Set the schedule for off-hours (i.e. 2:00 AM)
   3. Select all the update categories except “Drivers” (my opinion only)
   4. Select only the products and platforms you have in your environment
4. Configure a GPO to point your computers to the WSUS server for updates
5. Come back in 24 hours to review the results
6. Revisit the WSUS console every month to review and approve updates

Or use the TechNet guidance if you don’t trust me: click here

(2) Microsoft Security Essentials


Why? It’s a FREE and easy to deploy anti-virus/anti-virus product from Microsoft which also just happens to be pretty darn good. It’s also low-overhead compared with other vendor products in the same category (doesn’t tend to bog machines down nearly as much).

1. Download and Install it on each computer
2. Tip: Configure automatic “definitions” updates via WSUS

(3) VSS and Previous Versions


Why? Instead of users coming to you (email, phone, walk-up) to get deleted or corrupted files restored from backups, you can let them sort through the backups online and get their own restores without bothering you.
How: http://windows.microsoft.com/en-US/windows7/Previous-versions-of-files-frequently-asked-questions


(4) Group Policy Preferences


Why? You can easily configure a huge number of settings for your users with little effort.

• Drive mappings
• Printer mappings
• Shortcuts
• Environment variables
• IE Home Page and Favorites
• Registry keys and values (important: read this too)
• Automatic Updates (or WSUS)
• Screensavers and Lock features

(5) SharePoint Foundation Server 2010


Why? SPF 2010 has to be one of the easiest to implement intranet portal products ever. And it also happens to be FREE. Totally FREE.
Maybe you’ve tried previous versions of the free SharePoint product line like Team Services or WSS, but SPF 2010 is completely different. You can quickly take advantage of document libraries, discussion groups, forms libraries, custom lists, calendars and scheduling, and e-mail notifications.

1. Download and Install SharePoint Foundation Server 2010 (read min. requirements)
2. Get Started building your home page and add new pages/sites to start your journey

Additional Projects to Consider:

• MDT 2010 (Microsoft Deployment Toolkit 2010) and WAIK
• Saved Queries in Active Directory Users and Computers
• More to come… 

WSUS Headaches and a Cure

It's been a long time since I've posted anything on WSUS.  For a while it was the biggest thing I dealt with, but now it's pretty seldom I worry about it.  Until one day when I bought a new internal hard drive for one of my servers and decided to swap it out without doing proper due diligence.

The server had a 500 GB IDE internal drive where WSUS was storing updates and the WinDB data files.  It runs on Windows Server 2008 R2, SP1.  When I swapped the IDE drive with a 1TB SATA internal drive, I didn't properly take down WSUS first.  So the result was a critically broken WSUS setup.  I couldn't uninstall WSUS and couldn't reinstall it either.  The errors were either 0x80004005 or 0x80004325 or something close.  I tried some of the recommended things like switching the "Windows Internal Database" service to use the local system account and reboot.  I tried MSICUU and all sorts of ugly hacking.  The role would not be removed and it would not let me force a new WSUS 3 SP2 install on top of it either.

The fix: Download and install SQL Server 2008 R2 Express, then install WSUS 3.0 SP2 x64 and point the database option to the SQL Express instance.  Bingo!  Back up and running fine.

I'm Not Kidding. I really have no life

Anyone who really knows would nod in total agreement and understanding at this title without hesitation.  While most people arrive at each Friday with the hope and excitement of a weekend and promises of something exciting, or even mildly interesting, to look forward to… I see Monday on the horizon.  I don't go on vacations.  I don't have any serious hobbies, well, besides an occassional jog or bike ride.  Other than that, I sit and read or write program code.

So, here it is on a Saturday night.  Clear skies and stars beginning to pop out.  And I'm building a VM to prepare for swapping out a flaky AD domain controller.  It's the only DC for my network, which although violates my own strong convictions about redundancy and failover planning, it is what it is: a single point of failure.  What's worse is that I broke it.

It works from a AD services standpoint.  And SP1 seems to have fixed that annoying problem I've had to deal with in the Server Manger console that puked up an error every time I tried to access "Roles" or "Features".  Feh.  All the fixes I'd tried before that worked for a few hours at most, then the problem would return.  SP1 seems to have been the real fix.

But what I "broke" was WSUS.  You see, when you configure WSUS to maintain a local updates cache, and you swap out the drive which contained that cache without doing proper due diligence and preparation, well, it leaves WS08 R2 unable to do ANYTHING with it.  I had a 500 GB IDE drive stuffed in the server and it was running out of space, so I bought a 1TB SATA drive and swapped it out.  Then I tried to get WSUS to use it.  Ha ha ha ha …. so unfunny.  You can't even uninstall it after that happens.  Well, you can (by using the vice grip approach with MSICUU), but it still won't allow you to reinstall it.  Take my advice, and don't do that kind of transplant surgery without doing it right.

So, my hair-brained plan is to stand up and join a new DC, transfer the FSMO roles, reload the original DC and switch it all back.  Maybe.  I'm still dealing with how to address some technical issues with DNS, and GPO settings, but whatever.  It's not like I have anything else going on. 

So, if you're sitting at a friend's house, or at a bar, movie theater, pub or eatery, and even the slightest whisp of thought passes your brain suggesting you lead a boring life… think again.

Flashback: The Level 5 Sessions

I had to pause for a bit and reflect on 2008 and 2009 a bit.  2008 in particular was one of the worst years of my life aside from 1987 (father passed away) and 1997 (mother passed away).  I experience my first time being laid off from a job.  I have never been fired from any job in my life, so getting laid off, and on very short notice was not only a shock, but, well, I'm sure some of you are well aware of how that feels when you have a family and are barely keeping up on bills.  That put us so far behind that I'm sure we can ever catch up, but who knows.

In 2007, a mutual friend got me in touch with Brian S. Tucker.  We had a few conversations about some ideas Brian had and what he was hoping I could do to help him make those ideas work.  Mind you, these were all his ideas, and I was only one of quite a few other players involved.  Brian had a crazy idea (at the time) to start a web site devoted to subscription-based training videos for various Microsoft platform products.  The first phase was a free upload site called BlogcastRepository.com but his ideas was to develop a premium service called the "Level 5" Guides, which would involve paid monthly subscriptions.

2008 wasn't all bad, at least not after April. When Brian heard I was unemployed and having a tough time finding another job, he got in touch with me and helped push me to produce more content and help promote his site and become a win-win situation.  The combination of having someone keeping me involved and working towards a goal, kept me away from depression and solitude.  Those may sound trivial, but when you're laid off during cold weather months, and all your friends are busy at their jobs, your life can be come very lonely and scarry. 

I can't stress enough how important it is to just stay busy.  Especially if you can get outdoors as well.  I did that while still hunting for another job. But early-2008 was not a good time to look for a job.  Every single place I went to had a freeze on hiring due to fears of how far the economy was going to sink.  Everyone kept trying to encourage me with things like "with your skills" or "with your background" … "you should have no problem finding another job".  But that actually made it worse because the more rejections I got (or stark silence) the more I began to doubt my skills and marketability.  Human nature: Easy to study, much more complicated to experience.

Brian put himself, and his family's future on the line, to finance and push to make the dream a reality.  They endured a ton of shit with banks, developers, business people and trying to market their idea to both content authors and potential subscribers.  It was a stretch to assume it could be successful, and there were times when it didn't appear it would work out, but they never gave up or let pessimism creep in.

This happened within a few weeks of being laid off, and I used that down-time to gear up, ramp up, and man up to producing 17 sessions on WSUS 3.0 and 18 sessions on Windows Server 2008.  The latter of which was just barely out of beta/CTP when I recorded those.  Looking back they were very basic and almost embarrassingly amateur, but at the time it was all I had.  I needed to pay the mortgage, feed the kids and keep the electricity and water turned on.  Brian came through, and when I needed it most.  He didn't hand me any crying towels or pat me on the back either.  He knew my predicament and still insisted on me doing my best, just like everyone else who participated.  That gave me back much-needed respect and at least a little self-confidence.

Together with Edwin Sarmiento, Abhishek Joshi, Andy Dominey, Dennis Rietvink and a few others (very few), we pushed into what was at that time uncharted territory.  But it worked.  I was humbled by the credentials of these other guys, and Brian himself.  I wasn't sure if I belonged in that group, but Brian convinced me to step up.  The margins paid to us from the subscription sales weren't a lot but they absolutely saved me and my family.  That picture above was my rig and recording "studio" in our garage during that time.  It truly is worth a thousand words to me.

As the site began to grow in popularity, and more subscribers came aboard, we were soon facing the dilemna of what to do next.  What topics should we focus on?  What features should we dive deeper into?  We emailed subscribers to get feedback, but hardly anyone replied.  At that point Brian had to take on additional consulting work (which he had already been doing for quite a few years) in order to fund the business to a higher level.  In mid-Summer 2009, he took a job in Washington, D.C. where soon after he suffered a heart attack, and was recovering in the hospital, when he took a turn for the worse and passed away in August 2009.

Since Brian's passing, the site was not being managed and spammers began to victimize it badly.  Subscribers were asking what to do about cancelling payments and what the future was.  Unfortunately, I had no answers, and neither did any of the other authors.  We were as confused as anyone else.  In any case, I miss Brian and will never forget how much he helped me and many others in his short life.  May he rest in peace.

In May of 2010, Mike Rood contacted me to begin the process of finding who was managing or owned the site.  He was able to negotiate the purchase of the site from Julie Tucker.  I haven't heard anything since August 2010.  I e-mailed Mike to find out what the latest news is, so I hope to have something good to report soon - finger's crossed.

Let’s play “Guess WTF?”!

Why would I set this network to use the following User Account Control (UAC) configuration?  What are two good reasons for doing this?

If nobody guesses or makes crude comments and tasteless jokes, then I will have to step in and take care of the dirty work myself.  Hey, it is Friday after all.

Attention Geek-Nerds: Take This Quiz

Which of the following tools is a “push” technology, rather than a “pull” technology?

A) System Center Configuration Manager Software Distribution

B) WSUS Update Deployments

C) RSS News Reader Updates

D) All of the Above

E) None of the Above

How to Automate

Some people know me only for packaging and re-packaging software (yes, that is a real term).  Some know me only for Active Directory and Group Policy.  Some know me only for WSUS.  Some know me only for SMS and ConfigMgr.  Some know me for developing custom web portals and web applications.  Some know me for writing scripts.  Some know me for developing desktop and server applications.  Some know me for technical documentation and developing manuals.  Some know me for reviewing AutoCAD programming books.  Some know me for telling very stupid jokes and picking my nose.  But in reality, if I had to categorize my most best job title it would be “systems automation”.  I stopped picking my nose in public in the third grade, and it’s been downhill ever since.

I’ve never believed that computers were intended to be driven around like shopping carts.  It’s counterintuitive to require a lot of people to keep computers working.  Charles Babbage was aiming for a world where the machines would do our work “FOR US” not “WITH US”.  He started this by inventing what we now call “software”.  I’m sure when he was bolting together his amazing carpet loom contraption that he hadn’t anticipated where that would lead.

One of my favorite jobs I ever had, aside from industrial delivery services, was as a “business systems manager”.  I was tasked with automating as many processes in our IT environment as possible.  Period.  Whether it was tying together HR systems with Active Directory, or contracts with finance, or IT with assets, or assets with HR, or mobile devices with SOX monitoring, or automated diagnostics and change management.  It didn’t matter.  If it involved humans pushing buttons or typing things, and it could be done automatically somehow, I went after it.  I loved it.  But that all unraveled with a strange merger and divestiture of the company, and well, whatever.  What’s done is done.  That was a rare job indeed.  I don’t think I will ever see another one like as long as I live.  Today, it’s all about specialization.

Now, I know what you’re thinking: This is the most boring shit I’ve seen you write about yet.  No wait, the other thinking: What would you expect?  If you automate everything, then you put IT staff out of work.  Wrong!  Wrong! Wrong!  The idea is to free the IT folks from mundane bullshit work so they can brainstorm and innovate.  This is how you turn IT from a “cost center” into a “revenue center”, or at the very least, an engine for producing competitive advantages and reducing costs.  Remember, “virtualization” didn’t spring out of someone saying it was “cool”.  It got its wings from impressing the business folks with how it could reduce costs, speed things up, provide better protection and redundancy, and do it in less space.

So, this was going to be about automating Windows.  Or automating things in the Windows environment (Active Directory, patch management, software delivery, asset management, etc. whatever).  But when I laid out the same 8-step model I’ve used for almost 20 years, it was obvious that it applies to anything and everything.  It’s simply a model for automating any process or related processes.  I could break down each step, but the more I thought about it, it’s perfect “as-is”.  I don’t need to explain anything more.  If you don’t understand a particular step, think about it harder and it should become clear.  One thing to note is that in this model there are no weighted steps.  Every step is as critical and important as the others (although, Step 2 is the hardest).  If you skip one or half-ass it, it will half-ass you right back.  Enjoy!

Dave’s 8-Step Automation Gyration Contemplation:

Step 1 – Diagram Current Processes

Step 2 – Fix Broken Processes!!

Step 3 – Update the Diagram

Step 4 – Connect the Dots

Step 5 – Take Baby Steps

Step 6 – Build, Test, Deploy

Step 7 – Monitor and Refine !!!

Step 8 – Document !!!!

Headaches: Windows Server 2008 R2 + WSUS + zzzzz

No sleep.  Been up beating my head against a wall but finally found some relief.

My lone WS08R2 domain controller/WSUS host was having issues.  It would go into perpetual "downloading updates" when doing either manual update check against MS-Updates, but the status always said 0%.  I could let it run for days and it wouldn't get beyond that.  So I ran across this article, and it helped.

Basically: Stop the BITS and Crypto services, then stop Update Service.  Then rename \Windows\catroot2 to catroot2.old and SoftwareUpdates to SoftwareUpdates.old.  Then restart the services and run an update check.  Ba-da-bing!  It worked!

However, I'm still having an issue with the Server Manager failing to display Roles or Features.  It tries to enumerate them and fails with a useless error.  The Windows Modules Installer service keeps stopping also for no apparent reason.   Still digging.  But I'm going to bed for now.  Screw this.

WSUS Updates: "Important" Drivers

The WSUS Team blog posted an announcement regarding a new category to be added within the Drivers category which will be called "Important".  I'm glad they did this and it will be a huge benefit to anyone using WSUS to update drivers.  Until now, it's been a vast sea of murkiness.  This should help bring the meaningful ones to the front and help admins out greatly.  They also reminded us how you can import your own drivers into WSUS if needed.  Nice to be reminded of that. Below is a copy of the original blog post…

WSUS Admins –

We would like to notify you of a change you will see starting next week.  If your WSUS settings are configured to synchronize the “Drivers” update classification then your server will start syncing drivers designated as “Important.”

Important drivers are ones known to address a critical issue. Typically they fix a reliability issue that impacts use of the device or stability of Windows. Important drivers are subject to additional scrutiny and testing, relative to drivers offered optionally through WU to unmanaged clients. For more information, refer to the Windows Logo Program criteria for Important driver updates.

In the past, we heard feedback from the WSUS community that too many drivers for variants of similar hardware were crowding the admin consoles, because the drivers appeared identical in the admin console.  Because of this feedback, we temporarily stopped targeting drivers to WSUS servers. We developed a solution to consolidate drivers that are applicable to multiple Plug and Play (PNP) IDs into a single driver update for you to manage and distribute. This drastically reduces the number of driver updates that need to be published, while ensuring you are receiving the latest driver updates that are proven to fix known issues. Even with this improvement, you will still see multiple driver updates for the same changes in some scenarios, but this should be less burdensome than before.

As a reminder, you can import any driver update to your WSUS server using the “Import updates…” action in your admin console.  http://catalog.update.microsoft.com/v7/site/faq.aspx

- WSUS team

A Comment Regarding BlogcastRepository.com

I have continued to receive e-mail from readers asking about what has happened with BlogcastRepository.com and the video tutorials, etc. Rather than continue to respond to each one, I wanted to post something for all so that it clarifies things a bit.

I was approached by Brian S. Tucker back in late 2007 via email to join his collective venture to provide tutorial videos and blog posts about various Windows Server platform products and technologies.  My role was to record and post 15-18 videos on WSUS 3 and Windows Server 2008, which at the time were either still in public "beta" or only recently RTM/RTP.  My videos were posted and registrations began ramping up.  Brian enlisted a few more authors to cover other products like SQL Server, App-V/SoftGrid, and he continued handling SCCM and SCOM.  Things were good.

Brian S. Tucker (there are other Brian Tuckers out there so I still use the "S." initial to avoid confusion) passed away in August of 2009, while working on a project at a client site in Northern Virginia.  The obituary is posted below.  I'm afraid I do not know a lot of details about how he passed away, nor about his remaining family, nor the status of the web site.  I have e-mailed every contact address I had to try to find out what is/was going on with the web site, existing accounts and pending registrations.  I have not been successful in getting a single response to any of my e-mails.  I do not know if anyone is currently minding the shop, or if anyone is planning to assume the management of it in the future.  I just don't know what's going on at all.

If you have more information about this, please share with the rest of us if you can?

Thank you!  And may he rest in peace.

[original obituary…]

Copied from http://www.veteranstoday.com/modules.php?name=News&file=comments&op=Reply&pid=25962&sid=8661&mode=thread&order=0&thold=0

Fairfax, Va. - Brian Straehley Tucker, age 38, of Glen Carbon, died on Wednesday, Aug. 12, 2009, in Fairfax, Va., of circumstances related to a heart condition. He was born in New York, N.Y., on Oct. 21, 1970, the son of Joyce Hudson of Kiawah Island, S.C. and William S. Tucker, Jr. of Charleston, S.C. and step-son of Martha Tucker of Charleston, S.C. and W. Thomas Hudson, Jr. of Kiawah Island, SC.

Brian graduated from Summit High School, in Summit, N.J., and attended Southern Illinois University, in Edwardsville.

Brian served in the U.S. Navy from 1990 - 1994 and in the U.S. Naval Reserve from 1994-1998 and was the recipient of the National Defense Service Medal for his service during the Gulf War and Operation Desert Storm.

Brian was employed as a Computer Systems Engineer for Intrinsic Technologies, LLC of Lisle, Illinois since 2005.

Brian was an avid motorcycle enthusiast and enjoyed traveling with family and friends.

Brian was a loving and devoted father and is survived by his daughter, Chelsea C. Tucker of Edwardsville; parents and step parents; sister, Lynsey Tucker of New York, N.Y.; grandparents William S. Tucker and Vivian O. Tucker of Blytheville, Ark., and Eleanor K. Casato of Lakehurst, N.J., step-sisters, Lynn Matthews of Charlotte, N.C., and Lisa Grasing of Kansas City, Kan.; step-brothers, Judson Matthews of
Charleston, S.C.; Will Hudson of Portland; and Matt Hudson of London, England; loved ones, Julie A. Tucker; Joshua P. Lager; Brian L. Lager and Chad N. Lager of Edwardsville; and many devoted friends and colleagues. A family memorial service will be conducted in Chelsea, Vt.

Microsoft Updates: A Microcosmic View of a History of Bad Judgement?

In the narrow context of being my past days as a small business network admin, I did a fair amount of work with SUS, WUS and WSUS through the years.  I even published some video tutorials over at www.BlogCastRepository.com which may or may not still be in operation.  I used to post a fair amount of topical content and forum feedback over at http://www.wsus.info/ as well.  And I maintain my family home computers with WSUS as a regular habit, because I like it that much.  It’s easy to setup and use and works great.  But when I occassionally review the latest catalog of Products, I’m reminded of some of Microsoft’s bad judgement (as if I never made any bad decisions, right).

Just take a look at the current WSUS products listing as of October 2009.  Amazing.  Look at it for a few minutes before you continue on to my rant beneath it.  Otherwise, my rant will not make much sense.

All Products
	Microsoft
		BizTalk Server
			BizTalk Server 2002
			Host Integration Server 2000
			Host Integration Server 2004
			Host Integration Server 2006
		Developer Tools, Runtimes, and Redistributables
			Report Viewer 2005
			Report Viewer 2008
			Visual Studio 2005
			Visual Studio 2008
		Exchange
			Exchange 2000 Server
			Exchange Server 2003
			Exchange Server 2007 and Above Anti-spam
			Exchange Server 2007
			Exchange Server 2010
		Expression
			Expression Media 2
			Expression Media V1
		Forefront
			Forefront Client Security
			Forefront code named Stirling Beta version
			Forefront Threat Management Gateway, Definition Updates for HTTP Malware Inspection
			Forefront TMG MBE
			Threat Management Gateway Definition Update for Network Inspection System
		HPC Pack
			Compute Cluster Pack
			HPC Pack 2008
		Internet Security and Acceleration Server
			Firewall Client for ISA Server
			Internet Security and Acceleration Server 2004
			Internet Security and Acceleration Server 2006
		Live Search
			Search Enhancement Pack
		Microsoft Research AutoCollage
			Microsoft Research AutoCollage 2008
		Microsoft System Center Data Protection Manager
			Data Protection Manager 2006
		Network Monitor
			Network Monitor 3
		Office Communications Server And Office Communicator
			Office Communications Server 2007 R2
			Office Communications Server 2007
			Office Communicator 2007 R2
		Office
			Office 2002/XP
			Office 2003
			Office 2007
		SDK Components
			CAPICOM
		Silverlight
			Serverlight
		SQL Server
			SQL Server 2000
			SQL Server 2005
			SQL Server 2008
			SQL Server Feature Pack
		System Center Online
			Category for System Center Online Client
		System Center Virtual Machine Manager
			System Center Virtual Machine Manager 2007
			System Center Virtual Machine Manager 2008
		Systems Management Server
			System Center Configuration Management 2007
			Systems Management Server 2003
		Virtual Server
			Virtual PC
			Virtual Server
		Windows Essential Business Server
			Windows Essential Business Server 2008 Setup Updates
			Windows Essential Business Server 2008
			Windows Essential Business Server Preinstallation Tools
		Windows Live
			OneCare Family Safety Installation
			Photo Gallery Installation and Upgrades
			Sign-in Assistant Installation and Upgrades
			Windows Live Toolbar
			Windows Live
			Writer Installation and Upgrades
		Windows Small Business Server
			Windows Small Business Server 2003
			Windows Small Business Server 2008
		Windows
			Windows 2000
			Windows 7
			Windows Defender
			Windows Internet Explorer 7 Dynamic Installer
			Windows Internet Explorer 8 Dynamic Installer
			Windows Media Dynamic Installer
			Windows Server 2003, Datacenter Edition
			Windows Server 2003
			Windows Server 2008 R2
			Windows Server 2008 Server Manager Dynamic Installer
			Windows Server 2008
			Windows Server Manager - Windows Server Update Services (WSUS) Dynamic Installer
			Windows Ultimate Extras
			Windows Vista Dymamic Installer
			Windows Vista Ultimate Language Packs
			Windows Vista
			Windows XP 64-Bit Edition Version 2003
			Windows XP x64 Edition
			Windows XP
		Works
			Microsoft Works 8
			Microsoft Works 9
			Works 6-9 Converter

Ok, first off: Do the product names really have to be THIS fucking long?!  Really?  It’s getting beyond stupid into the realm of seriously embarrassing.  The fact that their competition isn’t beating the shit out of them just on this point is another embarrassment on their part.  Apple?  Come on, this is WAY too easy.  I’m talking easy as a white kid from Encino walking into a Crips hang-out with cash hanging out of every pocket and staggering drunk.  Can you see where this would go?

Google, Apple, IBM, EMC, Symantec, RedHat, they should all be lining up with their brass knuckles ready for a beating.  Jobs himself would be collecting the entry fees at the door of course (he’s not a beater anyway, Schiller would handle that for him).

Second, just looking at the categorization for a bit, you should see some real head-scratchers.  Just under the “Windows” category there are some really bizarre placements.  Why is all the IE stuff there?  What the hell is “XP 64-Bit Edition Version 2003” anyway?  I can’t find that on any of their product pages.  Why is Defender here? And, why aren’t Silverlight and CAPICOM up under the Developer Tools and Runtimes category?

Third, what’s up with the splitting up of the System Center catalog?!  I thought the marketing focus was on their coherence and complimentary aspect.   Looking at this you’d think they were all made by other companies and hate each other.  Maybe they won’t sit next to each other on the bus, like quibbling siblings or something.  And what happened to Windows Server 2003 R2?  Is it gone?  No longer supported?  And why isn’t Live Search under the Windows Live category as well?

Very bizarre stuff.  But the one thing that always jumps out at me with the most irony and melancholic despair is “Windows Ultimate Extras”.  It’s like the last sad clown to stroll off the circus floor back through the curtains when the spotlights are shut off.

Someone really needs to crack the whip and clean house on this mess.  It’s really that bad.  So bad, that I’m embarrassed for them and I don’t even work for them in any respect whatsoever.

The entire list needs to be cleaned up, re-organized, re-sorted, and it would not only work better for WSUS admins (and System Center ConfigMgr admins) but would put a little more lipstick on this squealing pig of marketing history.  I’m not saying WSUS is the pig.  I’m referring to the company’s history of naming products.  I could go on, but it’s making my head hurt.

WSUS 3.0 SP2 Upgrade from SP1

I ran an in-place upgrade of my WSUS 3.0 server from SP1 to SP2 RC.  It went well, but after the upgrade finished, it fired up the setup wizard and when it got to the step where it tries to initiate a connection to Microsoft, it just ran and ran and ran and wasn’t going anywhere.

So a quick check showed that the Update Services service was stopped, even though it was marked as Automatic (but no auto-restart).  Once I started the service again, the wizard continued on just fine and everything is working fine.  This led me to the following solution:  Wrap the upgrade inside a script to handle it all.

Dim objShell, objWmiService, colItems, objItem, r

Set objShell = CreateObject("Wscript.Shell")
' refer to the release notes for options DO NOT accept these blindly!
r = objShell.Run(1, "cmd /c WSUSSetup.exe /g /q DEFAULT_WEBSITE=1", True)
Wscript.Echo "Upgrade has been initiated..."
' check if the WSUSService service is running, force a start if not
query = "SELECT * FROM Win32_Service WHERE Name='WSUSService'"
Set objWMIService = GetObject("winmgmts:\\.\root\CIMV2") 
Set colItems = objWMIService.ExecQuery(query,,48) 
For Each objItem in colItems
    If objItem.State <> "Running" Then
        r = objShell.Run(1, "cmd /c sc start WSUSService", True)
    End If
Next

This is just ONE way to do this of course.  There are many others.  I know that I could have used another WMI method invocation on the service to request the start action.  But I’ve found some issues with that which I cannot explain (at least not on Windows 7 or Windows Server 2008 machines), where the good old SC.exe command seems to do just fine.  It’s also fewer lines of code.

Force WUAUCLT /DETECTNOW on a remote computer

You could use the Batch_Remote script I posted yesterday to do this. But for times when you just need to manually kick off a request to a specific computer, using Sysinternals' PsExec...

psexec \\computername -s wuauclt.exe /detectnow

(yes, replace "computername" with an actual computer name. And don't forget to run it using an account that has admin rights on the remote computer).

Installing WSUS 3.0 Sp1 on Windows Server 2008 SP1 SM

Good article with easy to follow instructions. Works great. Lasts long time. :)

Read article

Script Code: Batch Running WUAUCLT "DetectNow"

Suppose you want to reach out and force a bunch of computers to run an Automatic Updates self-check right away. You could:

• Put on some comfortable shoes, grab a drink and start running around
• Delegate this to someone you don't like
• Write a script to do it for you

BAT file using PSExec:

@echo off

c:\pstools\psexec.exe \\pc1,pc2,pc3 "%windir%\system32\wuauclt.exe" "/detectnow"

Save the .BAT file and run it using an account which has local admin rights on each of the computers. The problem with this approach is that the exit code is only returned for the last computer in the list. One way around this is to parse the list of computers and run psexec against each one separately. Then you can capture the exit code to see if it was successful or not.

I could use FOR %% in a BAT script and use the ERRORLEVEL variable to check on the result of each request. But I'm lazy and resort to what I know best: VBScript or KiXtart.

Const computers = "pc1,pc2,pc3"

Const pstools = "c:\sysinternals\psexec.exe"

Const rmtCmd = "%windir%\system32\wuauclt.exe"

Const rmtArg = "/detectnow"

Set objShell = CreateObject("Wscript.Shell")

count_good = 0

count_all = 0

For each computer in Split(computers, ",")

    count_all = count_all + 1

    cmd = pstools & " \\" & computer & " " & rmtCmd & " " & rmtArg

    wscript.echo "connecting to " & computer

    Set oExec = objShell.Exec(cmd)

    Do While oExec.Status = 0

        WScript.Sleep 100

    Loop

    If oExec.ExitCode = 0 Then

        Wscript.Echo vbTab & "process was initiated"

        count_good = count_good + 1

    Else

        Wscript.Echo vbTab & "process failed"

    End If

Next

Set objShell = Nothing

Wscript.Echo count_all & " attempted"

Wscript.Echo count_good & " completed"

You could do this in KiXtart, or Powershell or pretty much any scripting language.

Caveat: Because everything in life comes with a caveat (or three), you need to be aware that any remote scripting requires that you make sure things are in order before it'll work. Firewalls, port exceptions, user privileges, etc. Enjoy!

Score Card: 99 Percent Secure

According to Secunia's PSI utility scan, all four of our home computers are in great shape.  I maintain them with a mix of WSUS and GPO settings to keep things locked down, yet not obnoxiously oppressive for the wife and kids to have fun.  I'm glad I put WSUS into our network way back when 3.0 was in beta.  It's been fantastic.  

Some have asked why not just set each computer to use default 3:00 AM automatic update settings. The answer?  Because AU doesn't support optional updates which are often "vital" in my opinion.  Things like certain application updates and root certificates updates to name a few.  AU doesn't do that sort of stuff.  Kind of like comparing a microwave oven to a "real" oven.  Sometimes the bigger stuff needs a bigger oven.  In my case, three were 100 percent.  One was 98 percent, so I call that 99 since I use Enron math.

Recent Blog Postings

I just wrapped up two blog posts on The BlogCastRepository today. This one on WSUS and another on Windows Server 2008. They were fun to write and I needed the escape for a few minutes. I was thinking how cool it must be to earn a living writing articles like that. I can only imagine.