Aaron Tiensivu's Blog

I'm very excited and pleased to get the award again this year! Last year, three months after I received the MVP for "Windows Shell", which is now called Windows Desktop Experience, I was notified that I was nominated for Office Communications Server. Confused, I e-mailed my MVP lead to see if this was even possible.

Three months after that, I was nominated for Forefront Client Security, and I was confused again. A few e-mails between the various MVP leads and my secondary competencies were assigned to OCS and Forefront. I was wondering which of the three would "win" this year on July 1st, or if I would get the nod again at all.

I've always been hard to pigeonhole which has been a benefit and a detriment from time to time. It is a benefit because it means I'm practically 100% billable all the time on the job because I can handle a wide range of technologies, but it is also a detriment because sometimes you have to pick which area you want to focus on. I have a bad habit of trying to master every product, if only for my own personal curiosity.

Instead of getting typecast as "Jack of all trades - master of none", I'd much rather be known as "Jack of all trades - master of everything Microsoft except MIIS/ILM and custom Sharepoint sites".

The way I tend to view things - I work on things that I'd normally be messing around with at home anyway, but I have the added benefit of getting paid to do it. People are no longer surprised to get e-mails from me at 3am because I happened to be up late at night working on a problem someone else was experiencing or trying to figure out a better way to do something.

Work and home life tend to blend together sometimes and it is always a delicate balance. Thankfully, I have a wonderful family that understands my "Mad Scientist" ways when I'm debugging problems or having them try out a new program or operating system on their computer. I wouldn't be a MVP without them.

I'm excited for the upcoming year. I'm seeing more Exchange 2007 and Office Communications Server adoption in Michigan, and nationwide. I've been learning more about Cisco CallManager and CUPS integration with every new OCS project. It is a great cross-brand/cross-practice challenge at times, but the end results are worth it.

Forefront Stirling is progressing well and should be a hit once it reaches RTM. I'm seeing more people interested in Microsoft Deployment and Vista rollouts. I've been brushing up my presentation skills and dipping my feet into public speaking, like last month's West Michigan NT User group meeting.

A small update from 7.0.0, mainly bug fixes. 7.0.1 improves support for users of the VoiceOver feature in Mac OS X, and it fixes user interface issues that appear when Messenger is used with some European languages.

You can download it from here.

It is a little bit funny that this whitepaper came out this week because I was just having a long and involved conversation with people internally on the best way to go about doing this in challenging environments.

Things get interesting when you start throwing OCS Edge servers into the mix, and thankfully this whitepaper addresses some of those concerns:

Official description:

This paper answers questions about Microsoft® Office Communications Server 2007 with specific regard to its integration into the perimeter network (also known as DMZ, demilitarized zone, or screened subnet).

You can download it from here.

This update bundles the following features: Windows Server 2008 support, SQL Server 2008 support, enhanced support for sharing tape libraries and better tape utilization.

Features Added:

1. Support for backing up virtual machines on clustered Virtual Server 2005 R2 SP1 hosts
2. Support for sharing tape libraries between multiple DPM servers
3. Better tape utilization of tape capacity by co-locating data from multiple protection groups with similar retention range
4. System state protection for Windows Server 2008

Download the x86 version here, and the x64 version here.

I suspect you'll will have to integrate this hotfix into your base image before you can install the 64-bit versions of these operating systems, but it is doable.

You might be wondering - why bother with 64-bit on a low powered VIA CPU? Tiny media center PCs stuffed with a lot of RAM come to mind. I am a big fan of 64-bit, ever since AMD came out with the instruction set and Exchange 2007 went 64-bit only for production.

I had a feeling someone would figure this out eventually and leave it to the clever modders over at NGOHQ to figure it out.

There is supposed to be a download available sometime this weekend to unlock the ability. It is only a matter of time until the lawyers come out and put a stop to this, I suspect.

It will help prevent an error that happens when the VMBus tries to load in the guest OS. I've just made it part of my build process in general because telling Server 2008 and Vista to detect the HAL at every boot doesn't really make much of a difference in boot time. I'm hoping in Windows 7 / Server v.Next that this is just the default anyway.

This tidbit of information is also useful if you end up taking the MCTS: Virtualization certification test.

You can read more about the issue and workaround here.

It came out a little bit ahead of schedule, but hopefully that just means they can work on R2 to add back all the interesting features I was looking forward to when Hyper-V was originally announced.

You can read the KB article about it here.

Read the release notes here.

Download the x86 binaries here and x64 binaries here.

Many sites have been victims of SQL injection lately and this updated URLScan for IIS is a nice way to help prevent the attacks until the underlying code can be fixed. Here are a few excerpts from the 3.0 Beta release:

As our next measure, we are today releasing a beta for a new version of UrlScan - version 3.0 - that can reach these SQL requests and block them. This release includes a GoLive license, so you can deploy it on your production servers. UrlScan version 3 is compatible with the configuration files for the existing UrlScan version 2.5, so you if you are already running UrlScan, everything will still work as it did - except you'll have new options. Also, since its been just over 5 years since UrlScan 2.5 shipped, we've taken the opportunity to add some frequently requested features. The new set of features in version 3 are:

1. Support for query string scanning, including an option to scan an unescaped version of the query string.
2. Change notification for configuration (no more restarts for most settings)
3. UrlScan can be installed as a site filter. Different sites can have their own copy, with their own configuration.
4. Escape sequences can be used in the configuration file to express CRLF, a semicolon (normally a comment delimiter) or unprintable characters in rules.
5. Custom rules can be created to scan the URL, query string, a particular header, all headers or combination of these. The rules can be applied based on the type of file requested.

We also have plans to update the IIS 7 request filter to add these features. In the interim, UrlScan 3 is fully supported on IIS 7.

You can read more about it and download it from here.

Download the x86 version here and x64 version here.

Through a strange sequence of events, chance meetings, and a short amount of time to prepare, I presented Vista SP1 to a group of about 40+ users at the West Michigan NT Users Group.

I was pretty amazed at the amount of people in the region were interested in hearing me give a presentation, but the main goal was to drive user group membership and give people some real world/candid advice from hands-on deployment of Windows Vista in a business/enterprise environment.

And, of course, there were plenty of goodies given away to WMNTUG audience members, including:

Xbox 360 “extravaganza” “out of the box” experience – Xbox 360 Elite, four wireless controllers, Xbox Live year subscription and Halo 3 (qty 1)

Zune 8gb (qty 2)

22” Flat Panel Monitor (qty 2)

Vista Ultimate w/SP1 - licensed "not for resale" (qty 10)

Thankfully, I did not need to put on an asbestos suit and everyone was really nice and had interesting/thought-provoking questions afterwards. I talked for about a half hour with my 25 slide PowerPoint and then we had a 30 minute question and answer session.

I'm now a member of the user group too. I also bumped into a few familiar faces from old Atari 8-bit/ST club from the early/mid eighties, when I was only about 7 years old. Back then, I was just a snot nosed kid looking for a copy of LucasArts Rescue on Fractalus! for my Atari 130XE, but this time I was presenting in front of everyone.

Pretty neat.

It also reminded me of the time my dad and I bought a 48KB RAM upgrade kit for my Atari 400, which upgraded it from 4k to 52k. It even had a toggle switch to enable and disable the extra 4k of RAM because some programs wouldn't work correctly with that extra little bit of RAM. It was our first adventure with a soldering iron and set me down the path to where I am today.

These are buried on Microsoft's website and I didn't even knew they existed until today. It allows you to pre-configure some settings in a GPO that would normally be filled in/defined by the end user. This helps automate configuration of the Live Meeting client and Conferencing Add-in for Outlook on a domain, and I am a fan of automation.

The .ADM file is available from here.

This hotfix fixes an issue that may occur when you run Microsoft System Center Data Protection Manager (DPM) 2007 in a Windows Server 2008 environment. After you install this hotfix, you can run Data Protection Manager 2007 together with Windows Server 2008-based computers.

Note: You must install this hotfix package to obtain support for Data Protection Manager 2007 in Windows Server 2008.

If you have setup your ISA reverse proxy correctly, you should be able to use a web browser from an external Internet connection to your OCS Front End root path without an "Error 500 - Service Principal Name Incorrect" error.

If you receive that error, it most likely means that your OCS pool/front end internal certificate is incorrect in some way. Make sure the "This rule applies to this published site" field under the "To" tab in the ISA rule matches the Subject Name and the first Subject Alternative Name (SAN) of the OCS pool internal certificate. ISA 2006 RTM "ignores" any SAN entry below the first one.

Keep in mind that the 'Web Components' of OCS 2007 are just a published IIS web site on the front end server(s). If you recreate the internal certificate, you will have to use the IIS manager for the 'Default Web Site' to assign the new certificate to the front end web site. Using the Certificate Wizard inside the OCS snap-in will not do it for you.

When ISA 2006 SP1 is released, it is supposed to support SAN SSL certificates closer to the way Exchange 2007 and OCS 2007 them.

Once you are past that stage, you should be able to browse with your web browser to https://myisa.contoso.com/Etc/Place/Null/SlideFiles/Blank.png and receive a 704x528 blank PNG image. Of course, replace myisa.contoso.com with the actual external FQDN of your setup.

Download the October 2007 version and delete the version that came out in late July 2007.

Unfortunately, it is still distributed inside the Office Communications Server and Client Documentation Rollup MSI that you can download from Microsoft. The MSI has never been updated to include the new documents that have been updated since the original July 27, 2007 release.

A good example of one of the changes in the October 2007 document, and where the original July 2007 version is incorrect:

The documentation in the July 2007 edition says:

1. To set the external URL for the Web farm, type the following command:
Lcscmd /web /action:updateexternalpoolurls /externalwebfqdn: /poolname:

The documentation in the October 2007 edition says:

1. To set the external URL for the Web farm, type the following command:
Lcscmd /web /action:updatepoolurls /externalwebfqdn: /poolname:

Guess which one actually works?

Hardcore OCS wizards would, of course, fire up wbemtest.exe and directly set the WMI variables, but I like command line tools better.

Resolution #1 in KB 938288, is a good example of WMI editing for Office Communications Server 2007.

This download comes as a pre-configured VHD. This download enables you to evaluate Microsoft Forefront Codename "Stirling". This fully functional pre-configured VHD provides you with a trial software that will automatically expire after 30 days.

Forefront codename “Stirling” is an integrated security system that delivers comprehensive, coordinated protection across endpoints, messaging and collaboration servers, and the network edge that is easier to manage and control.

You can download it from here.