Alexander’s Blog

When it comes to deploying Windows 7, one of the challenges administrators face is trying to figure out which deployment method is the best suited for a particular scenario. Fortunately, Microsoft has documented some guidelines for Choosing a Deployment Strategy in detail. The following table will help you with your decision but you might want to download the complete document here.

Microsoft provides numerous tools for deploying Windows operating systems. It sure would be nice if we could use one tool that included all the functionality in dozens of separate utilities and toolkits. Here are some frequently asked questions that Microsoft has posted on TechNet. These will help you understand what you can and can’t do with all these new deployment tools for Windows 7 and Windows Server 2008.

Here’s something in the news lately that is rather interesting. According to this blog on ZDNet, Microsoft is turning over all Windows 7 and server source code to Russia’s new KGB.

“Microsoft has always carefully protected the source code to its operating systems. In fact, a key distinction between the various Windows variants and open source OSs like Linux and BSD is that Linux and BSD are open source.”

“That’s why a little piece of news covered by ZDNet UK’s Tom Espiner is so astonishing.

According to Espiner, Microsoft has turned over all its source code for Windows 7, along with its source for Microsoft Windows Server 2008 R2, Microsoft Office 2010 and Microsoft SQL Server to Russia’s Federal’naya sluzhba bezopasnosti Rossiyskoy Federatsii. The FSB is present-day Russia’s successor to the infamous Soviet-era KGB.”

“From a security perspective, this is an astonishing act. The agency that took over from the KGB and which has been just recently proven to be conducting long-term spying operations against the United States now has access to Windows source code — while at the same time, most American IT operations don’t.

Not only does this give the Russians the opportunity to find gaps in Windows security — it gives them the opportunity to do so while most American companies and organizations don’t have the same opportunity to find the same gaps and plug them.”

“If Microsoft’s going to give source code to Russia, it should release it to the public. Open source certainly hasn’t harmed Linux’ success and doing so would at least put American IT operators on a level playing field with the Russian secret service.”

I haven’t seen Microsoft’s response to this so far and will let Microsoft explain what exactly is and isn’t shared but I do know that Microsoft has a Product Source Program for the benefit of governments, enterprises, OEMs, developers, faculty & students, system integrators, and Microsoft MVPs like me.

The MVP Source Licensing Program (MVPSLP) is a no-cost program that licenses Microsoft Windows source code to qualified Microsoft MVPs. The program gives MVPs the opportunity to differentiate themselves professionally as Windows platform experts through access to Windows source code. Similarly, there are free programs for enterprises and governments. The Government Security Program (GSP) provides national governments with information to help them evaluate the security of Microsoft products.

I don’t think we should panic over this because Microsoft is run by Americans who love this country. It’s hard for me to believe that they would pass on any information to the Russians, or to any other government for that matter, that could impact our security. Not to mention the fact that all export of such information is subject to the U.S. export approval and over 90% of Shared Source offerings are available for download by anyone. According to Microsoft:

“The Product Source Programs, licenses selected Microsoft product source code to qualifying customers, partners, and governments. Access to source is granted only to those who are eligible and who qualifying under the terms of each program.”

Again, I haven’t seen Microsoft’s response to this but I seriously doubt that Microsoft will release every single bit of Windows code to anyone outside Microsoft…..and definitely not to the new Russian KGB (called FSB). If Microsoft does, they would join the Open Source community and as far as I know Microsoft has no intention of doing that.

My students are always asking me where to get the evaluation copies of various Microsoft products. I’ve put together a list of some of the latest software evaluation downloads. My goal is to try and keep this list updated but frankly it is going to be challenging because Microsoft is known for changing the URLs without any redirection.

1. Exchange Server 2010 (120-Day Trial)
2. Forefront Server Security Management Console
3. Forefront Threat Management Gateway 2010
4. Office Communications Server 2007 R2 (180-Day Trial)
5. Office Professional Plus 2010 (60-day Trial)
6. Project Professional 2010 (60-day trial)
7. SharePoint Server 2010 (180-day Trail)
8. Small Business Server 2008 (60-day trial)
9. SQL Server 2008 (180-day Trial)
10. System Center Data Protection Manager 2010 (180-day Trial)
11. System Center Essentials 2010 Beta
12. System Center Virtual Machine Manager 2008 R2
13. Visio Premium 2010 (60-day trial)
14. Windows 7 Enterprise (90-day Trial)
15. Windows Home Server (30-day Trial)
16. Windows HPC Server 2008
17. Windows Server 2008 R2 Trial Software

WARNING! I should warn you that sometimes when you download a trial software you may think that you are opting out of receiving phone calls and e-mails from Microsoft but you are not. For more information read my blog post: When Microsoft Says No, It May Mean Yes.

Microsoft offers more free products to consumers than any software manufacturer I know. And I am not talking about free evaluation software, I am talking about free tools, utilities and various products and services. Besides software, Microsoft offers these free TechNet and MSDN labs. These are a series of guided, hands-on labs which can be completed in 90 minutes or less.

Today I was installing Exchange Server 2010 Enterprise on a Windows Server 2008 R2 Domain Controller. Although Microsoft recommends that you install Exchange 2010 on a member server if possible, the environment I was working was very small so the Exchange Server 2010 was installed on a Domain Controller. There was an Exchange Server 2007 already in the same forest.

After I installed Exchange Server 2007 SP3 (at least SP2 was required in my scenario) to meet the prerequisites, I was unable to install Exchange Server 2010. During the installation I received the following error, indicating IIS was not installed on the Windows Server 2008 R2 server.

I installed IIS but still received the same error. The event viewer displayed the following warning:

Log Name:      System
Source:        Microsoft-Windows-WAS
Date:          7/10/2010 8:54:01 AM
Event ID:      5153
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer: Exchange.SeattlePro.com

Description: The Windows Process Activation Service (WAS) encountered an error attempting to look up the built in IIS_IUSRS group.  There may be problems in viewing and setting security permissions with the IIS_IUSRS group.  This happens if the machine has been joined and promoted to be a Domain Controller in a legacy domain.  Please see the online help for more information and solutions to this problem.  The data field contains the error number.

Upon further investigation, I discovered that according to Microsoft KB article 946139, this is by design. Translation: This is a FEATURE, not a BUG.

Symptoms

You have a Windows Server 2008-based server that is running Internet Information Services (IIS) 7.0. You set the Windows Server 2008-based server as a domain controller of a Windows 2000-based domain or of a Windows Server 2003-based domain. In this scenario, you cannot resolve the built-in IIS accounts, such as the IIS_IUSRS group or the IUSR guest user account. You can see only the raw security identifier (SID) of the built-in IIS accounts.

Note: This problem does not occur if you set the Windows Server 2008-based server as a domain controller of a Windows Server 2008-based domain.

Reason

This problem occurs because the IIS 7.0 built-in accounts specification for Windows Server 2008 does not exist in earlier domains, such as Windows 2000-based domains and Windows Server 2003-based domains. When the IIS 7.0 server is set as a Windows 2000-based domain controller or a Windows Server 2003-based domain controller, the Windows Server 2008 accounts cannot be resolved.

Detailed Explanation

This TechNet article explains Event ID 5153 in more detail. Essentially, you have to remap the built-in IIS accounts. IIS 7.0 uses several built-in Windows Server 2008 accounts, including the IIS_IUSRS group and the IUSR guest user account. These replace the <MACHINE_NAME>_USR account that was created by IIS 6.0.

A problem occurs when a Windows Server 2008 computer that hosts IIS 7.0 becomes a domain controller (DC) of a non-Windows Server 2008 domain (that is, a DC of a Windows 2000 or Windows Server 2003 domain). When the DC promotion occurs, the new Windows Server 2008 built-in accounts are no longer available to IIS 7.0. Any Access Control List (ACL) that uses the built-in accounts will not be able to resolve to a friendly name, but will instead show their raw SID (Security Identifier) values.

To resolve this issue, run a script that will restore the mapping of SIDs to friendly names for the built-in accounts. The script must be run on the DC while it is connected to its Primary Domain Controller (PDC). This will reestablish access to the built-in accounts that IIS 7.0 requires.

Solution

To resolve this problem, use this sample script. Save it as SamUpgradeTask.js.

Note: You must restart the server after you run this script.

Troubleshooting Tips

After you have taken all these steps you may still get the same error, at least I did, and I know others have been in the same boat. Try these additional steps.

1. Go to Server Manager/Web Server (IIS)/Add role services and check the box for IIS 6 Management Compatibility. If that doesn’t help then go to step 2.

2. Start the PowerShell with elevated privileges (Start, All Programs, Accessories, Windows PowerShell) and run the following scripts one-by-one. You must start the PowerShell with elevated privileges, i.e. Run as Administrator.

Import-Module ServerManager

Add-WindowsFeature NET-Framework,RSAT-ADDS,Web-Server,Web-Basic-Auth,Web-Windows-Auth,Web-Metabase,Web-Net-Ext,Web-Lgcy-Mgmt-Console,WAS-Process-Model,RSAT-Web-Server,Web-ISAPI-Ext,Web-Digest-Auth,Web-Dyn-Compression,NET-HTTP-Activation,RPC-Over-HTTP-Proxy -Restart

Set-Service NetTcpPortSharing -StartupType Automatic