scandals of an ITian

Been thinking about writing a blog post about this for a while but found the same article here

Microsoft Forefront TMG – Best Practice Analyzer.

and here Forefront TMG (ISA Server) Product Team Blog Post

Whenever I make some significant changes to the TMG on our Essential Business Server at work , I run this to get a good overview of anything that I have missed.

Essential Business Server 2008 comes with Exchange 2007.

One of the most used features for EBS at work is the Outlook Web Access by our remote users. Of course it’s sometimes much more easier than opening Outlook first thing in the morning before heading to work to have a quick glance at your emails.

OWA works straight out of the box just like RWW on your EBS installation. But I have been having issues with users complaining about the following screenshot while opening contacts info at the top right hand corner of the window.

To fix the issue

1. Log onto TMG either from the Management box or from the Security Server
2. Scroll to the rule that Mentions the Outlook Web Access rule and right click and click on Configure HTTP as shown

   

3. At the bottom of the window is an option called “Verify Normalization” un tick the option as shown

   

4. Apply the changes to the TMG

   

5. Wait for the synchronization to complete which will be a minute or two depending on your configuration

   

That’s it!

Log back onto your OWA and type an users name and tada contact info

Cheers

Microsoft has published a case study based on the implementation and advantages of EBS 2008 currently running at my work environment. Read about it here http://3.ly/njC

Big shout out goes to Nick King, Larry Karr and Rebecca Warner for making this happen.

Cheers

Aben

Forefront Threat Management Gateway is the new revamped face of ISA servers which used to perform the functions of Edge Security gateway servers for networks. Its core functionalities include providing protection from WAN/Internet based threats and also providing means for secure Internet connectivity for Small to Medium Size organizations.

It is a critical part of the Essential Business Server package by being part of the Security Server.

One of the functionalities for Forefront TMG would be its reporting functionality which is able to provide either a :-

1. One time Report
2. Recurring Report

solely depending on the needs of the network administrator. There are also options around customized reports for:-

1. Summary Contents
2. Web Usage Contents
3. Application Usage Content
4. Traffic and Utilization Content
5. Security Content
6. Malware Inspection Content

On EBS 2008 you may come across the following problem when trying to generate a report.

To fix the issue open IIS Manager 7.0 and click on Application pool and select ReportServer$ISARS and choose advanced settings either from the right hand actions pane or by right clicking the option and choosing advanced settings as shown below

Under the advanced settings change the value for Enable 32-bit Applications from False to True as shown below

Close all the windows including IIS 7.0 manager. Once that is done go back to Forefront TMG and try to run the report as shown below

The generating report window will pop up next

Once that is compelted the report will open up inside the browser as shown below.

These reports can be configured to save on a network share or have it emailed out via the exchange server.

The objective of this blog post is to give an inside tour of the EBS 2008 setup that I currently look after and also to kick start the EBS 2008 series of posts.

History:-

When I joined the firm that I currently work for about a year ago we were using:-

1. Lotus Notes for Email
2. Mail Marshall and Web Marshall for Anti-Spam and Proxy services.
3. Windows 2000 Domain
4. Several Windows 2003 servers performing several functionalities for the network.
5. Symantec Anti-Virus
6. Mix of XP SP1 and SP2 machines.

We were part of a domain forest that was maintained and looked after by a government entity down in New Zealand. So policies and procedures had to be followed based on a wider scale and was quite limited and not to the needs of our organization.

Finally towards the end of 2008, the management made a Strategic decision to move the whole infrastructure out of this forest and take complete ownership of the network. Search for a solution lead to EBS 2008.

Reasoning:-

1. Best and complete solution for Email, Security and Management for an SME size organization.
2. Affordable than buying the different applications separately for eg: Exchange server 2007, Windows 2008 Server, Forefront Threat Management.
3. Customized and optimized installation procedure.
4. Provided more functionality and features than SBS 2008.

Planning and Testing Phase:-

Due to the nature of the setup of the network, the EBS 2008 network had to be built completely separate from the existing infrastructure. This meant going out shopping for a couple of IBM blade servers, Cisco Router, SAN drives and a brand new ISP. I know paradise for an IT pro

The purchases were completed and work was started on the planning stages of EBS. EBS 2008 standard consists of 3 different servers and the premium version has an additional server. Since we had licenses for SQL Enterprise Edition the need to purchase Enterprise version of EBS did not suffice.

The standard version consists of the following:-

1. Management Server
2. Security Server
3. Messaging Server

And the enterprise version consists of all the above servers in addition to a Windows 2008 Standard Server with SQL server 2008 Standard. This blog post at this stage would only cover EBS 2008 Standard.

One of the initial problems that I faced at the initial planning stages was that I needed 3 different blades to host EBS 2008. I could only free 2 blades and would have been overkill with the amount of RAM. Even if I could come up with another blade I had issues assigning a second network card to any one of the blades to perform the functionalities of Security Server which requires 2 sets of Network cards.

Answer: Virtualization

I clearly remember that it was during that month that Citrix went on to releasing Citrix Hypervisor Version 5 for free with Enterprise features. With both the blades on Citrix Hypervisors I started to build the EBS 2008 test environment. (Install number 1). Ran into a lot of issues with I/O, networking and so forth (sorry it was quite a while back) and I was desperate for another solution. I had already implemented ESXI on some of the servers in the old network and so was comfortable with it. But I guess I was like a kid in a candy store when Citrix announced its release.

ESXI was easy in a lot of ways. It is a straight forward product for SME’s who want to get the benefits of virtualization but don’t want pay for the enterprise features of ESX. Yes there is a new player on the group and a post on Hyper V vs. Esxi deserves another day.

Installation of EBS 2008:-

This was happening in March 2009. There wasn’t much documentation available for EBS 2008. Got all the stuff from TechNet printed out and read it a few times over. There isn’t much information available in the documentation towards Clean new Installs and of course couple it with a lot of ignorance led to a few sleepless nights. But finally my test installation number 8, yep number EIGHT went smooth and I was happy with it.

Had a lot of help from these boys up on twitter who I would reckon are at this stage EBS 2008 guru’s @philippmuller , @PortlandITGuy , @michaelsainz , @nztechtweet , @LeonSodhi and I am sure I am missing a few more around here but at the end of the post will be a list of all the resources for EBS 2008 available on twitter.

Funny enough the final production installation for EBS 2008 was completed when I took a couple of days off and went to AKL to relax. Since our setup involved placing a router in front of the security server, meant that towards the end of the installation of the security server I had to do a couple of things

1. Replace the DHCP service from the router.
2. Change the IP address of the router so that it could be swapped with the internal IP address of the security server or the EBS 2008 LAN IP.

The above steps involved me talking with @kathrynwilson24 over the phone and getting her to copy paste a few pages of Cisco config. But finally the installation was stable and ready.

Since the ISO’s were all loaded up onto the Esxi Datastores meant that there was no need for physical proximity with the server room. This is quite the boon for SME’s who have maximum of 2 or 3 IT pro’s working for them. Since the ISO’s are always present on the server meant that the ability to do remote backup and restore of VM’s was quite simple and easy.

EBS installation though would seem like quite a straightforward process, is in fact not an easy one to tackle or at least it wasn’t one for me. But with each installation I grew more knowledgeable about what shouldn’t be done or how to fix some certain installation bug such as the .net sp3 installation just wouldn’t for the love of GOD install on its own. The trick around it was also quite neat though!

3^rd party software’s that’s used with EBS network

1. Shadow Protect for Backups
2. Trend Worry Free Business Security Advanced
3. Esxi Hypervisor
4. Twitter (lol)

I am currently writing posts on Shadow Protect and Trend and how they been with EBS 2008 but that is for later. Cut the story short they have been perfect and would recommend them with a blind eye.

Additional Information for EBS:-

There is a lot of information about what Essential Business Server 2008 available

EBS Homepage , EBS Team Blog , EBS Technical FAQ , Facebook Page

There is also a Yahoo user group focussing solely on EBS and SBS 2008 products. There are lot of posts on technical issues and solutions faced by several EBS users from around the world.

Folks to follow on Twitter who are nothing less than Guru’s on EBS 2008:-

@philippmuller , @PortlandITGuy , @michaelsainz , @nztechtweet , @LeonSodhi , @stevenabanks , @ababinchak , @thirdtier , @WindowsEBS , @markstan , @carlcs , @nking .

There had been an issue identified with XP Sp3 machines not being able to connect to remote machines within an SBS or EBS environment via Remote Web Workspace.

Some classic signs of the issue and various options that I had tried out in vain

1. When you click connect to your default remote machines the following box pops up

   

2. When following the error message and various steps available online to enable the add-on you don’t get to view the add-on in the first place.

   

3. You could also follow the procedure of deleting a few registry keys that would enable you to view the add-on from the manage add-ons from IE

   

4. You add the website to your trusted lists and it still doesn’t connect
5. There are scripts available that are used to install the RDP 6.1 ActiveX
6. @markstan helped me out heaps and we even tried this solution
7. After all my nagging I think @markstan went on vacation because of me as seen from his tweet

   

8. Another thing I had noticed was the clean untouched XP SP3 VM that I build and manually updated with IE8 and latest updates didn’t seem to suffer from this.

So I setup the calendar appointments with my 4 users that had this issue to bring their different laptops back to the office. These guys are teleworkers and only come in couple of times a month to the office. So you could probably understand their frustration and of course mine.

But then on 27^th October the RDP Gods decided to take pity on me and sent message via @nathanm with this tweet

All my test machines were powered up, installed RDP 7 from here and life returned back to normality.

The ActiveX issue was fixed and I had a couple of happy EBS RWW users going home in less than 20 minutes.