Few points to note about installing 2010 SP1 in hosting mode:

• The installation can only be done in command line.
• You need to use /InstallWindowsComponents while running the setup to install all windows components required for Exchange. This will not install the pre-requirements only the windows components! Always install the pre-requirements first.
• You need to use /Hosting switch while running the setup to install Exchange in hosting mode.
• 2010 SP1 is required.
• Exchange Management Console will not be installed.

Exchange 2010 SP1 doesn’t support the following features in Hosting mode (from Technet):

• Exchange Management Console
• Public Folders
• Unified Messaging Server role
• GalSync
• Federation
• Business-to-Business features such as cross-premises message tracking and calendar sharing
• IRM
• Outlook 2003 support (EnableLegacyOutlook)
• Edge Transport Server role
• Same forest upgrade from Exchange 2007
• Resource forest
• Parent-child domains
• Discontiguous namespace
• Disjoint namespace

Here is based on the blogs zerohoursleep and howexchangeworks how its done! This step-by-step tutorial that will guide you to installing your first Exchange 2010 SP1 multi-tenant organization to a fully operational mode.

Lab setup

For this lab I am using 2 servers running Microsoft Windows 2008 R2 one of them acting as a domain controller for the lab domain lab.com and the other will be running all roles of Microsoft Exchange 2010 SP1 CAS,HUB and Mailbox.

Of course in a live environment exchange roles will be most probably split among multiple servers but the concept is pretty much the same.

I will assume that the Domain Controller is already installed and that the exchange server to be has already Windows 2008 R2 installed with all the required patches to deploy Exchange 2010 SP1.

Installing Exchange 2010 SP1 in hosting (or multi-tenant) mode

Installing Exchange prerequisites on Windows 2008R2

I am used to this script to automate installation of the prerequisites since I find it very clean.
We will start by running the powershell administrator “right click -> run as administrator” and allow the script execution using

Set-ExecutionPolicy unrestricted

Running the script will then offer you a menu, in my case I need to select option 6 since all roles will be installed on the same server and restart the machine after.

Installing Exchange

As you may already know Exchange 2010 multi-tenant can only be installed using the command line by adding the /hosting parameter, we will initiate the installation by running

setup.com /m:install /r:m,ca,ht /installwindowscomponents /hosting /on:ExchLab

Let me first explain the above command

• /m stands for /mode and we are running the installation mode
• /r stands for /roles and we want to install the m (mailbox) ca (client access) ht (hub transport) roles. Of course you will need to change this if you don’t want to install all roles
• /hosting is required to tell the setup to run the hosting installation
• /on stands for /OrganizationName and you will define here the name of your Exchange organization. I called mine ExchLab

We will now wait for the installation to finish

A few differences with Exchange not hosted

The first thing I have noticed after the installation is differences in Active Directory Users and Computers like the presence of a brand new Organizational Unit “Microsoft Exchange Hosted Organizations”

And the addition of new Exchange Security groups (plus the absence of the UM one)

Now of course the absence of the Exchange Management Console should have been first however this I was expecting since it is all over the place so I was expecting this.

A look at Service Plans

Before doing a jump start and create an organization we need to take a look at some files located on your CAS server called Service Plans.

Service plans are located by default in “C:\Program Files\Microsoft\Exchange Server\V14\ClientAccess\ServicePlans” of your CAS server and they define the different services your hosted organization provides to its customer.

We have 2 things to notice here

1. Since the files are located on the CAS then editing a file means updating it on all your CAS servers
2. You have 2 kinds of files the .ServicePlan files that actually defines all permissions you give to an organization and the .csv file that maps Hosting Plans with Service Plans

.ServicePlan files

Each .SevicePlan above presents a set of permissions/features/quotas etc.. and their names are self explanatory. However if you need to change or create you own ServicePlan the file itself is an xml file, just start with the HostingAllFeatures_Sample.ServicePlan and remove any entry you don’t want and/or change any value.

N.B.: Make sure NOT to use the sample plans if you edit them since they will replaced by any update done on the server.

.csv file

The other kind of file in this folder is the ServicePlanHostingRemap.csv that is pretty simple as it maps a specific hosting plan name and offerID to a service plan defined above. Nothing really complicated her but definitely worth a look

Creating your first organization

So now that you have grasp the general idea about ServicePlan files let’s create our first organization. We will start by first creating the Serviceplan whitin ServicePlanHostingRemap.csv file we have just discussed. Because i am using the sample i won’t but normaly i would delete the samples and create your own here.  

Then running the command.

$c = get-credential

This will prompt you for a username and password, you can input any fake username you want since only need and use the password from this command. The password specified is going to be used for the administrator of the organization you are about to create.
Then run

New-organization -name TestOrg -DomainName TestOrg.com -ProgramId HostingSample -OfferId 2 -location en-US -AdministratorPassword $c.password

Let’s focus on this command a bit

1. Name parameter defines the Organization name you are about to create
2. DomainName parameter defines the SMTP domain of this organization, so users in the TestOrg organization will have emails @TestOrg.com
3. ProgramID is coming right from the .csv file we have just discussed so this organization will have the HostingSample hosting plan<
4. OfferID is also defined in the .csv file above, so we need to match HostingSample with ProgramID 2 we are giving to this organization the HostingAllFeatures_sample ServicePlan
5. AdministratorPassword: As you can notice the parameter is only concerned with the password of this organization’s administrator, not the username, so we are using on the password provided in the get-credentials command only by using $c.password

That was not that complicated right ! But what happened on the Active Directory side ?

As you can see a dedicated OU was created for the TestOrg organization with its Administrator user and its own Security groups. Pretty cool hein !
Don’t worry yet about the extra user “Antoine Khater” we will see how to create it in the Part 3 of this tutorial.

Deleting an Organization

To finish today’s article I will go over the process of deleting an organization.

Deleting all mailboxes

You will not be allowed of purging an organization as long as it has mailboxes so we will need to, as a start, delete all the mailboxes of the organization. You will now notice that the “get-mailbox” command has, in hosting mode, an extra parameter -organization. So to delete all mailboxes in the TestOrg organization we will run

get-mailbox -Organization TestOrg | remove-mailbox

Deleting the organization

Now that the organization is empty of all mailboxes it can be deleting using

Remove-Organization TestOrg

And as you can imagine in will do all the cleaning from Active Directory as well.

Managing mailboxes as a hosting company

Creating mailboxes

We need to make the difference here between you, as a hosting company, creating users in a specific organization and the Organization Administrator creating users for its own organization.

To create, as a hosting company, users for a specific organization you will need to use the powershell command new-mailbox that, also, got new attribute -Organization.
Assuming I want to create a new mailbox for myself in the Organization “TestOrg” the command will be

New-Mailbox "Antoine Khater" -UserPrincipalName akhater@testorg.com -Organization TestOrg

As you can see the mailbox was created with the quotas define in the service plan of the TestOrg organization and with an email address of akhater@testorg.com, and you can guess it will be located in the TestOrg organizational unit in Active Directory.

Deleting mailboxes

Well this is a really funny one and I think it is a bug actually. The remove-mailbox cmdlet didn’t get the -organization parameter which make it impossible to delete a mailbox unless you use the combination of get-mailbox and remove-mailbox as follows

get-mailbox akhater@testorg.com -Organization TestOrg | remove-mailbox

Managing Organization as Organization Admin

Well I know that most hosting companies provide their customers with panels to do the management however exchange 2010 provides a decent management interface which is nothing but the Outlook Web App ECP.

Remember that administrator password we have used when we first created our TestOrg in earlierof this tutorial? Well it is now time to use it …

From the web browser reach https://casserver/ecp and logon with the organization username/password.
(one thing I’ve noticed is that now the OWA authentication page asks by default for the email address instead of Domain\Username)

After logging on you have the option to manage your organization

And there you will presented with the options of Creating new mailboxes/managing Mailboxes/reseting password and even creating SMTP rules and tracking emails

A look at address lists

I would like to add that, even if address list segregation is not supported yet on Exchange 2010 SP1, when installed in hosting (or multi-tenancy) mode each user will only see their Global Address Lists accounts that belongs to the same organization. So a user in the TestOrg organization will not see users in any other organization and vice-versa.

Receiving email

It is well known that if your exchange 2007/2010 is internet facing you will need to add “Anonymous” to the permission groups of the “Default Receive Connector” on your Hub transport server. Exchange 2010 running in hosted mode is no exception however there is no Exchange Management Console anymore to do this change so we will need to do it through powershell by running the following command. Of course don’t forget to replace “Exchange” by your Hub server name.

Set-ReceiveConnector -PermissionGroups 'AnonymousUsers, ExchangeUsers, ExchangeServers, ExchangeLegacyServers' -Identity 'Exchange\Default Exchange'

Sending emails

Sending external emails

We also know that Exchange 2007 / 2010 will not send external emails before creating a send connector, so we will create on using powershell also.

To create a Send connector using DNS MX for routing. You will also need to replace “Exchange” by the name of your Hub server

new-SendConnector -Name 'To Internet' -Usage 'Custom' -AddressSpaces 'SMTP:*;1' -IsScopedConnector $false -DNSRoutingEnabled $true -UseExternalDNSServersEnabled $false -SourceTransportServers 'Exchange'

To create a Send connector using smarthost relay for routing. You will also need to replace “Exchange” by the name of your Hub server and 1.1.1.1 by the IP of the smarthost

new-SendConnector -Name 'Using SmartHost' -Usage 'Custom' -AddressSpaces 'SMTP:*;1' -IsScopedConnector $false -DNSRoutingEnabled $false -SmartHosts '[1.1.1.1]' -SmartHostAuthMechanism 'None' -UseExternalDNSServersEnabled $false -SourceTransportServers 'Exchange'

Sending Inter-Organization emails

Well this is where things are new! I started by simply sending an email between 2 users in different organizations and, instead of reaching its destination, it went directly to the unreachable queue !

What does it mean?
Well it means that Users in different organizations are treated as completely independent, the user will not be resolved “locally” in Active Directory and delivered it will use the send connectors just like any other alien domain.

How to solve this?
Well I am sure there are a lot of ways to do this but, since I am in a lab environment with only one server I have created a send connector for all the organizations smtp domains and set it to use the loopback IP address as smart-host connector

new-SendConnector -Name 'TestOrg' -Usage 'Internal' -AddressSpaces 'SMTP:testorg.com;1','SMTP:lab.com;1' -IsScopedConnector $false -DNSRoutingEnabled $false -SmartHosts '[127.0.0.1]' -SmartHostAuthMechanism 'None' -UseExternalDNSServersEnabled $false -SourceTransportServers 'Exchange'

Well congratulations, if you made it that far you should have now a fully functional Exchange 2010 SP1 hosted environment. I hope this was of help.

Tech blog ConceivablyTech spotted the date on Mozilla’s official release schedule yesterday and a message to developers from Mozilla senior engineering director Damon Sicore indicated the first and only Firefox 4 release candidate would likely ship as the final version of the browser. Firefox 4 RC1 was made available on March 9.

”As of now, there are no known issues that would stop us from shipping RC1 as final…March 22nd is the day we would ship.  Both IT and Marketing have indicated that March 22nd is an acceptable final launch date.  If at any time we discover issues that would block final release, we would issue an RC2 as soon as possible, reset the ship date, and communicate to everyone,” he said.

Despite Mr Sicore’s mention of the possibility of a second release candidate, Mozilla planning notes indicate the company would most likely push Firefox 4 out the door on March 22 and follow-up with an incremental update to fix any minor issues.

”Several issues have been identified as potential ridealongs, meaning we might do a 4.0.1 release,” the notes said.

The final version of Firefox 4 was originally scheduled to ship in November 2010, but repeated delays saw the release schedule revised on more than one occasion. Given that rather chequered history, it remains to be seen if Firefox 4 will actually ship on March 22 as planned.

Based on the Gecko 2.0 engine, Firefox 4 will bring an updated user interface, new ways to organize tabs, a revamped add-on manager, support for HTML5 video standards, multitouch support on Windows 7 and a range of performance and security enhancements.

Mozilla has indicated a desire to move to a faster release schedule following Firefox 4, with mozilla.org co-founder and Mozilla CTO Brendan Eich telling developers users could be running the fifth version of Firefox just months after Firefox 4 is released.

Consumer end-users can find general information about Windows 7 SP1 at the following Microsoft website:

http://windows.microsoft.com/windows7sp1

Public downloads will be here

Windows 7 Service Pack 1

To obtain Windows 7 SP1, visit the following Microsoft website:

http://windows.microsoft.com/installwindows7sp1 (http://windows.microsoft.com/installwindows7sp1)

Windows 2008 R2 Service Pack 1

To obtain Windows 2008 R2 SP1, visit the following Microsoft website:

http://go.microsoft.com/fwlink/?LinkID=199583

The following documentation for Windows 7 and Windows Server 2008 R2 Service Pack 1 is provided here.

Deployment Guide for Windows Server 2008 R2 with SP1 and Windows 7 with SP1.doc 213KB Download

Hotfixes and Security Updates included in Windows 7 and Windows Server 2008 R2 Service Pack 1.xls 465KB Download

Installing Windows Server 2008 R2 with SP1.doc 94KB Download

Release Notes for Windows 7 with Service Pack 1.doc 87KB Download

Release Notes for Windows Server 2008 R2 with Service Pack 1.doc 87KB Download

MS KB Information about Service Pack 1 for Windows 7 and for Windows Server 2008 R2

The purpose of these settings is to set up a specific NIC for IMA use when You have multi homed XenApp Servers.
Registry Values to Set;

Purpose(s) is specify if the server has several NICs or not;
Registry Hive : HKLM\Software\Citrix\IMA
Value : MultipleNICMySelf
Type : REG_DWORD
Data : 1 (1 = This Server has several NICs)

Purpose(s) is to specify the NIC to dedicate;
Registry Hive : HKLM\Software\Citrix\IMA
Value : NICToUse
Type : REG_SZ
Data : Mac adress of the desired NIC (example : 00-C0-4F-74-68-E5 )

If one of the previously specified reg values is set on any server you’llo have to set the following reg value to ALL SERVERS within the Farm.

Purpose(s) is to specify that IMA will try to communicate with all remote server NICs
Registry Hive : HKLM\Software\Citrix\IMA
Value : MultipleNICOtherServer
Type : REG_DWORD
Data : 1

App-V general information

APP-V Techcenter, your starting point when you need more information about APP-V| Microsoft Technet
APP-V whitepapers, part of APP-V Techcenter | Microsoft Technet
Tech forum with all App-V related information, not only limited to APP-V | Appvirtguru.com
App-V information, clear overview on APP-V components | app-vsupport.com
App-V FAQ overview | http://blog.stealthpuppy.com/appv-faqs

App-V learning resources

Some App-V learning video’s | Blogcastrepository
Application Virtualization (App-V) Video Series | Microsoft Technet
TechNet Virtual Labs: System Center | Microsoft Technet
App-V certification, there’s no “stand alone” APP-V certification. Skills being measured are based on MDOP | Microsoft Learning

App-V sequencing & recipes

Application Virtualization message-board, not only limited to App-V | Appdeploy.com
The Microsoft App-V Sequencing Recipe Forum | Microsoft Technet
Stealthpuppy recipe/sequence resources | App-V recipes
TMUrgent recipe/sequence resources | App-V recipes

App-V related blogs

App-V team blog | Microsoft Technet Blog
The Official Microsoft Virtual World Blog | http://blogs.technet.com/virtualworld/
The Official Microsoft MDOP(where App-V for Desktop is part of) blog | http://blogs.technet.com/mdop/
Kirx.org | http://www.kirx.org/app-v/app-v-en.html
Aaron Parker’s Stealthpuppy on application virtualization and more | http://blog.stealthpuppy.com/
Confessions of a Guru | tmurgent.com
Kevin Kaminski’s blog at MyITforum| myitforum.com
Application Distribution Blog by Nicke Källen, Microsoft MVP on App-V | Viridisit website
German App-V website maintained by Microsoft employee Sebastian Gernert | blogs.msdn.com/sgern
Independent App-V Blog | http://www.softgridblog.com/
DesktopControl Blog |http://www.desktopcontrol.info/

App-V Tools

App-V Best Practice Analyzer | Microsoft Download Center
App-V ADM Templates, also check-out the ADM add-ons from Login Consultants| Microsoft Downloads
App-V Resource Kit tool, you will need this when using Dynamic Suite Composition | Microsoft Technet
Great resource with tools and instant apps for your demo’s | virtualapp.net
The App-V tools from Login Consultants, you need to register before you can download the tools | Login Consultants Tools
Application Virtualization Central, with tools, training videos and much more | tmurgent.com
Download sequenced applications free | http://www.instantapp.net/

App-V troubleshooting

General troubleshooting App-V | Microsoft Technet Blogs
The Microsoft Online Help for Application Virtualization | Microsoft Technet

When you jump to “Home” (I still have to get used to that) you’ll find the new RDP plug-in at the Solutions and Applications section.  Here you can configure the RDP behaviour like screen size, username, domain and port. When the setup of the global setting is done, it’s time to put the plug-in to test.

Just right click one of your virtual machines and check-out the context menu, you’ll see an extra option appears called Connect over RDP. Just select the new menu option and your RDP connection will initiate.

Password – you can now set a password to be used for all connections, allowing automatic logon.
Security Warning – Security Warnings can be disabled by ticking the relevant tick box.

Download is here;  http://xtravirt.com/vsphere-client-rdp-plug-in

They have created a little Jing movie which shows the new version of the Plug-in in action.

George Stathakopoulos, Microsoft Security, confirmed the news in a company blog posting. “Given the significant level of attention this issue has generated, confusion about what customers can do to protect themselves and the escalating threat environment Microsoft will release a security update out-of-band for this vulnerability” said Stathakopoulos. He also added that Microsoft will share specific timing of the release tomorrow.

The vulnerability was unveiled when Google went public that they were targeted in a sophisticated cyber-attack. The breach, involving Internet Explorer 6, resulted in the theft of intellectual property. Due to the attack, and the background behind it, Google announced it will no longer be providing censored results for its Chinese Google search engine. Currently Google offers censored search results as part of an agreement with the Chinese government.

Since the news of the un-patched flaw broke, Microsoft has been on damage limitation. This week Microsoft began urging businesses and consumers to upgrade to Internet Explorer 8, explaining that the security benefits are far greater than that of Internet Explorer 6. Both the French and German governments warned their populations to cease using Internet Explorer due to the un-patched flaw. Currently the flaw exists in Internet Explorer versions 6, 7 and 8 but exploit code is only available for Internet Explorer 6. The patch, when released, will protect all affected versions of Internet Explorer.

Should you stop using Internet Explorer?

Microsoft has had a torrid time over the past week as governments and customers question the security of the popular web browser, Internet Explorer.

The issues began when Google went public that they were targeted in a sophisticated cyber-attack. The breach, involving Internet Explorer 6, resulted in the theft of intellectual property. Due to the attack, and the background behind it, Google announced it will no longer be providing censored results for its Chinese Google search engine. Currently Google offers censored search results as part of an agreement with the Chinese government.

The news created waves across the world and last week Microsoft admitted that an un-patched Internet Explorer 6 vulnerability was one of the vectors used in the targeted attacks against Google. To many the news wasn’t surprising. Internet Explorer 6, released in August 2001, is over eight years old. It has been subject to a number of high profile vulnerabilities over the years. The alternatives that exist in the marketplace today are not only much more improved in terms of features and standards support, but crucially, offer a greater safety net for online browsing. If you’re still using Internet Explorer 6 then quite frankly, you’re mad.

Ed Bott wrote, shortly after the admission by Microsoft, that any IT pro allowing IE6 use in a corporate setting is “guilty of malpractice” and I couldn’t agree more. However, unfortunately in a corporate setting it’s not always as easy as hitting an upgrade button. Most corporate infrastructure is based on a global directory, email and intranet websites as the core ways of communication between employees. Updating and maintaining internal only (intranet) websites is always a challenge for corporations as many will have been left untouched for years with code specific to aged Internet Explorer versions. Websites is only the beginning; there are also custom applications and systems that utilize Internet Explorer that could be incompatible with Microsoft’s latest versions.

This week Microsoft began urging businesses and consumers to upgrade to Internet Explorer 8, explaining that the security benefits are far greater than that of Internet Explorer 6. However, for corporations and web designers there’s a continued reminder that for many years Microsoft ignored emerging and defined web standards in Internet Explorer, especially in version 6. Developers originally griped about the lack of standards support for Cascading Style Sheets (CSS) after the introduction of Internet Explorer 6 in 2001. At the time the software giant dominated the browser marketplace and many would argue its actions slowed down web development. Flash forward to 2010 and it’s a whole different ball game. Microsoft’s market share is slowly ebbing away thanks to competitive and promising offerings from both Mozilla and Google. Microsoft improved its web standards support in Internet Explorer 7 and 8 and now it plans to extend that with 9, due later this year. But is it too little too late?

The question of whether to stop using Internet Explorer is one that many businesses and consumers are likely asking this week. Both the French and German governments warned their populations to cease using Internet Explorer due to the un-patched flaw. Currently the flaw exists in Internet Explorer versions 6, 7 and 8 but exploit code is only available for Internet Explorer 6. The reason IE 7 and 8 are both unaffected for now is due to the increased security of the software. Internet Explorer 7 introduced a phishing filter, protected mode to run the browser in a sandbox at low level security rights (vista only) and improved management of ActiveX controls. Microsoft improved security in IE8 by running the browser frame and tabs in separate processes and per-site ActiveX controls. Both IE 7 and 8 also include support for Data Execution Prevention (DEP) that prevents buffer overflow attacks.

So do these attacks mean you should stop using Internet Explorer? Simply put, no. Although it’s true that a vulnerability exists, Microsoft is currently working on a patch to resolve this as soon as possible. If you’re still running Internet Explorer 6 then it’s definitely time to upgrade. Neowin spoke to Cliff Evans, head of security and privacy for Microsoft in the UK yesterday. Evans urged consumers and businesses to “look at this vulnerability in a broader context and think about what the risk is.” He argued that although the vulnerability exists, it’s highly unlikely that the average business or consumer would be targeted by the type of attack Google experienced. Evans insisted that “normal organisations have little to fear” over the recent attacks and that Microsoft recommends all businesses and consumers upgrade to Internet Explorer 8, especially if they are currently using 6. I questioned Evans over corporations who may be stuck on Internet Explorer 6 for compatibility reasons but he urged them to look at their upgrade plans again. According to data from Net Applications (December 09), as a percentage of Internet Explorer use, IE6 maintains 36.57% and IE8 36.27%. Internet Explorer 7 lags behind with 27.11%. With Internet Explorer 6 still the most popular of all Internet Explorer variants, Microsoft is going to have a tough time convincing people to upgrade. Evans would not commit to a release date for the fix but said it was more likely that it would be distributed as an out of band patch shortly or as part of Microsoft’s monthly “patch Tuesday” which is due on February 9.

Source: http://www.neowin.net/

Microsoft Office 2010 will become available in a x86 and x64 version. Sharepoint 2010 will only be available in x64 version only.

Microsoft is planning to release the  Microsoft Office 2010 products in Q1 next year (2010).

More information about the Office 2010 products on http://www.microsoft.com/office/2010/

Here’s a handy little app that I just stumbled across thanks to MakeUseOf: CNET’s TechTracker. If you use a lot of desktop applications, you may have trouble keeping up with which programs are in need of an update. Not only do updates deliver critical bug fixes and security patches, they often deliver great new features and improvements, too. But keeping up with tons of apps – especially if they’re shareware or freeware programs – can be difficult. That’s where TechTracker comes in.

On the 8th of October Technet_live was being held in The Hague, this included the Windows 7 introduction in the Netherlands. Steve Ballmer, CEO of Microsoft presented the Keynote. NGN-member Alex Warmerdam filmed the whole keynote with his mobile phone, and got to ask Steve Ballmer a question as well.

Since Active Directory was included as part of Window Server 2000, administrators have often asked for  a simple way to roll back mistakes, whether that is the incorrect deletion of the wrong user account to the accidental removal of thousands of objects by deleting an OU. Before the release of Windows Server 2008 R2 there were a number of ways using built-in or third-party methods to restore Active Directory objects, but typically they were not as quick or complete as say retrieving a deleted email or file.

Microsoft has included with their release of Windows Server 2008 R2 the facility, under the correct conditions, to enable a Recycle Bin for Active Directory and allow simple restoration of objects which have been erroneously removed. In this article we will briefly cover some of the options prior to 2008 R2 and then examine how to enable the new Recycle Bin and restore objects from it.

Pre-Windows Server 2008 R2

The 2008 R2 Recycle Bin for Active Directory is a great motivating point for upgrading your forest and domain(s) to the latest version, but this is not always a quick process in many enterprises so it is worth knowing what options are available prior to this version. Like many things it’s a lot better to examine and plan for possible resolutions before a significant mistake happens that you need to deal with. Retrieving Active Directory objects typically falls into two available categories, authoritative restore from a backup or tombstone reanimation.

Authoritative Restore

The Microsoft KB article 840001(http://support.microsoft.com/kb/840001) details how to perform the restoration of a user account using a system state backup of a domain controller. Typically, you would use a global catalog so that you can also restore all group membership information.

Tombstone Reanimation

The above article also details how to recover an account when you don’t have a system state backup by using tombstone reanimation which was introduced with Windows Server 2003 – you can retrieve objects from the Deleted Objects container where they are kept after deletion until their tombstone period expires. Obviously regular system state backups of Active Directory are critical for your full disaster recovery procedures, but taking advantage of tombstone reanimation means you can get objects back quicker than having to go through the full authoritative restore process.

You could use the procedure in the article which utilises the ldp.exe tool, but there are other methods around which you may find simpler.

• The article itself links to a Sysinternals tool, ADRestore (http://technet.microsoft.com/en-us/sysinternals/bb963906.aspx), which is a command line tool for reanimating objects.

• The free ADRestore.Net, a GUI tool made by Microsoft PFE Guy Teverovsky. http://blogs.microsoft.co.il/blogs/guyt/archive/2007/12/15/adrestore-net-rewrite.aspx.

• Quest produces a freeware product Object Restore for Active Directory, an easy to use GUI tool. http://www.quest.com/object-restore-for-active-directory/ (Note: there is a commercial version with more features, Recovery Manager for Active Directory.)

• Quest also produces a cmdlet library for managing Active Directory with Windows PowerShell (http://www.quest.com/powershell/activeroles-server.aspx). As of version 1.2 a number of the cmdlets had a Tombstone parameter added to them so that a search of objects would also include items which have been tombstoned. These results could then be piped through to the new cmdlet Restore-QADDeletedObject to undelete the object represented by the tombstone.  For instance the command Get-QADUser –Tombstone -LastChangedOn  ((Get-Date).adddays(-1)) | Restore-QADDeletedObject would restore all user accounts deleted yesterday.

The drawback with tombstone reanimation is that because most of the object’s attributes are removed at the time of the object’s deletion, a restored object using this method requires many properties of the account, such as address fields and group membership, to be manually repopulated. Whilst this is obviously preferable to re-creating an account from scratch it does not make for a quick overall process. However, you will at least get back the objectGUID and objectSid attributes which means there would be no need to re-configure a user’s workstation profile.

The original release of Windows Server 2008 introduced snapshot backups for Active Directory. You can take point-in-time snapshots of your Active Directory with the NTDSUTIL command line utility which utilizes Volume Shadow Copy to provide a snapshot. It is then possible to mount this snapshot using different ports on the same domain controller as the live Active Directory database and use standard tools to compare the two. This could really make the tombstone reanimation a lot simpler because after restoring the object you could view two versions of Active Directory Users and Computers side by side and view the properties of the restored object from a previous time, so making it simpler to repopulate properties.

The Directory Service Comparison Tool (http://lindstrom.nullsession.com/?page_id=11) takes advantage of these snapshots and makes the repopulation process more streamlined.

For those with Microsoft Exchange messaging environments, once you have the Active Directory account back, you can use the Reconnect Mailbox feature within Exchange to tie the restored account back up with the mailbox. This is of course providing you have a similar tombstone retention period for mailboxes that you do for AD accounts.

Active Directory Recycle Bin

The real reason you decided to read this article though was not so that we could spend time going over all the possible options for how you can piece together restored AD objects, but rather to find out how the Recycle Bin is going to make your life as an Active Directory administrator easier without necessarily the need for these different tools. The key differences from previous versions of Windows Server are that by default you get all of the attributes back and the tools to use are PowerShell cmdlets, which are quickly becoming a more essential part of every Windows administrator’s standard toolkit.

Firstly though the Active Directory Recycle Bin is not enabled by default and has certain domain and forest wide requirements before it can be enabled.

• Firstly, all domain controllers within the Active Directory forest must be running Windows Server 2008 R2.
• Secondly, the functional level of the Active Directory forest must be Windows Server 2008 R2.

Naturally organizations are typically cautious when upgrading Active Directory and these types of infrastructure projects don’t tend to happen quickly, but the Recycle Bin could be one of the features which gives you more weight behind a decision. You should also be aware though that enabling the Recycle Bin is a onetime only move, there’s no easy way to disable it again, so careful consideration of this decision must be taken.

It’s worth noting that if you are making a fresh forest install of Windows Server 2008 R2 the Active Directory schema will already include all of the necessary attributes for the Recycle Bin to function. If however you are upgrading your domain controllers from previous versions of Windows Server then you will need to run the well known procedure of adprep /forestprep and adprep /domainprep (for each domain) and possibly adprep /domainprep /gpprep (for Group Policy preparation)

before you can introduce Windows Server 2008 R2 domain controllers into the environment.

So let’s go ahead and run through all the steps we need to get the Recycle Bin enabled. Firstly, ensure that all of your domain controllers are running Windows Server 2008 R2 and then we need to use PowerShell; the great news with Windows Server 2008 R2 is that version 2 of PowerShell is installed by default and is placed directly on your taskbar.

After you have installed Active Directory Domain Services the Active Directory specific cmdlets are available to use via a module; modules essentially are the evolution of snapins from version 1 of PowerShell. To access these cmdlets you can either open the Active Directory specific version of the PowerShell console from the Administrative Programs menu, or the method I would prefer, use the Import-Module cmdlet. (Tip: You could add the below expression to your PowerShell profile so that the cmdlets are available every time you open PowerShell)

PS> Import-Module activedirectory

Once complete all of the Active Directory cmdlets will be at your fingertips. As previously discussed we now need to get the functional level of the forest up to the level of Windows Server 2008 R2. The most common way to do this previously was through Active Directory Domains and Trusts.

Now though we can do this through PowerShell. The Get-ADForest cmdlet will return information about your forest and the Set-ADForestMode cmdlet will enable you to raise the current functional level – since it is such a significant change to your environment you will be prompted to confirm that you wish to go ahead.

Now that our forest is at the correct functional level we can enable the Recycle Bin, to do so we use the Enable-ADOptionalFeature cmdlet. This must be either run on the DC with the Domain Naming Master FSMO role or directed at that server with the –server parameter. Again you will be prompted to confirm your command since the action is irreversible.

Now that we have the Recycle Bin enabled it’s time to go check out how we recover some deleted objects. In this environment we have a very simple AD structure with a couple of test accounts to illustrate the example.

Let’s take the situation where an administrator accidently deletes the Users OU. One of the most common reasons this can happen is because it is actually possible to delete OU’s from the Group Policy Management tool, not just Active Directory Users and Computers – so an administrator might think they are removing a GPO and in a bad moment delete the wrong item and remove a whole OU. The administrator is prompted for what they are about to do, but I have seen it happen more than once!

The initial release of Windows 2008 Server actually included a new checkbox ‘Protect object from accidental deletion’. In the example of the OU below any attempt to delete the OU will be met with an Access is denied response and the administrator will actually have to remove the tick from that checkbox before the OU can be deleted.

However, what you would naturally expect to happen as a consequence of the Protect object from accidental deletion would be any user or computer account created in that protected OU would also be supported by the same mechanism. Unfortunately by default they are not, so as a good practise you would either need to build that into your account creation process or programmatically check and set that checkbox on all accounts in the OU on a regular basis.

Consequently, in the above example if we accept the warning to delete the OU we are greeted with an Access is denied message since the OU has protection set.

So we were saved from deleting the OU, but all of the unprotected child objects were deleted.

(For the purposes of this article I now remove the Users OU by first clearing the checkbox for protecting the object from accidental deletion.)

We can browse the current contents of the Active Directory Recycle Bin using the Get-ADObject cmdlet, directing it at the Deleted Objects container and using the –includeDeletedObjects parameter.

We can see from the resultant output that we have both the Users OU in there and the two user accounts. So let’s try restoring one of the user accounts back, to do so we need the Restore-ADObject cmdlet and supply the ObjectGuid property of the user account.

Oh dear, it failed to restore, but PowerShell tells us that it failed because the object’s parent no longer exists either, i.e. we need to first restore the Users OU. (Note: an alternative would be to use the  -targetpath parameter and re-direct the restore to a different OU)

To restore the Users OU we can use the same cmdlet (Restore-ADObject) as to restore users, just supply the ObjectGuid of the OU.

The Users OU returns.

Now we just need to get those user accounts back. Rather than have to type out the ObjectGuid for each account we wish to restore we can instead create a search which will match all of the accounts we wish to restore and then use the PowerShell pipeline to send those results to the Restore-ADObject cmdlet.

The user accounts are back in the Users OU.

If we check the properties of the account we can confirm that different from tombstone re-animation we get all of the properties back.

Active Directory Recycle Bin PowerPack for PowerGUI

Although the Recycle Bin is a great new feature within Windows Server 2008 R2 Microsoft is already getting feedback that there is no GUI for managing it. Whilst a lot of administrators are comfortable with PowerShell, some may still prefer to use a GUI based management tool for these tasks. Fortunately a great tool to plug this gap has already been provided by the community; PowerShell MVP Kirk Munro has created the Active Directory Recycle Bin PowerPack for PowerGUI (http://www.powergui.org/entry.jspa?categoryID=21&externalID=2461). This free tool has bundled up scripts using the previously demonstrated Active Directory PowerShell cmdlets and provides a graphical front end for administration.

Simply download the PowerGUI tool plus the Active Directory Recycle Bin PowerPack and import it into PowerGUI. Open up the PowerPack and you will have a graphical view of the current contents of the Recycle Bin with the ability to drill down through Organisational Units. Options for restoring single items or recursively are provided in the Actions column as well as alternate restoration paths and emptying items from the Recycle Bin.

It is also possible to use the Configure recycle bin action to set the values for DeletedObjectLifetime, the amount of days objects reside in the Recycle Bin, and TombstoneLifetime, the amount of days objects can be restored using Tombstone Reanimation after they have left the Recycle Bin. In Windows Server 2008 R2 both of these values default to 180 days, in some earlier versions of Windows Server this value was 60 days and if you upgrade those domain controllers it will remain the same so you may wish to change the values – you can use the Modify action to do this.

For this example I have deleted from Active Directory the Resources and Users containers and the two user accounts which you can see nicely in the below screenshot using PowerGUI.

This time we will restore the account Joe Bloggs, but to an alternative location using the Restore to…. Action. (Remember: this is done in PowerShell using the –targetpath parameter of the Restore-ADObject cmdlet) Simply input the path to the Organisational Unit you wish to restore the object to. In this example we use the default Users container as the target location.

The user has been restored to the alternate location; this is particularly useful if we did not wish to bring back the entire OU(s) as we did previously.

If however, you do wish to bring back the contents of an entire OU and everything below it there is an action, Restore (recursive).

Using the Restore (recursive) action in this scenario brings back both the Resources and Users OU’s as well as the single account remaining in it, Jane Smith.

Hopefully in a future release of Windows Server this functionality will be provided out of the box, the most natural home would be a viewable container within Active Directory Users and Computers, until then the Recycle Bin PowerPack for PowerGUI will prove very useful.

Summary

One of the most requested features for a long time with Active Directory has been a Recycle Bin. Microsoft has finally delivered this with the release of Windows Server 2008 R2. It may not be a feature that enterprises get to use for a little while given the system requirements of all 2008 R2  Domain Controllers and your Active Directory Forest at 2008 R2 functional level, but it could be one of those compelling reasons that enables you to pursue an upgrade.

Administration is via the new Active Directory PowerShell cmdlets which Microsoft is using to provide a consistent command line interface across all of their products. Although currently there is no native GUI for these administration tasks, the Active Directory Recycle Bin PowerPack for PowerGUI enables administrators to leverage the underlying PowerShell functionality and provide a graphical interface for carrying out these tasks.

Microsoft Forefront Unified Access Gateway (UAG) is a secure application gateway, to manage, control, and optimize remote access for managed and non-managed endpoints, to corporate applications and resources. Forefront UAG RC0 provides a number of new features, including support for migration from Forefront UAG Beta 2.

Forefront UAG provides the following:

• Remote access: Using Forefront UAG you can allow and control access to internal resources and applications from a range of managed and unmanaged client endpoints.
• Application support: Forefront UAG provides broad application support for a wide range of Microsoft and third-party applications. Application optimizers, consisting of predefined settings and values, provide optimum settings for accessing a specific application via Forefront UAG.
• Access control: Forefront UAG provides granular access control, to ensure that only client endpoints complying with corporate health guidelines can access internal applications and resources.
• Authentication: Forefront UAG provides frontend and backend authentication mechanisms. Frontend authentication allows you to pre-authenticate users using a wide range of authentication mechanisms, ensuring that only authenticated traffic reaches published application servers. In addition, Forefront UAG provides a single sign-on experience for authentication to backend applications.

For additional questions visit our TechNet forum. Follow us on our blog too; we’re planning on providing you with lots more information on features and how to get it up and running.

Find more information about Forefront UAG as follows:

• To read the Forefront UAG documentation, visit the Forefront UAG TechCenter library (http://technet.microsoft.com/en-us/library/dd861463.aspx)
• To read about up-to-date issues, visit the Forefront UAG Product Team blog (http://go.microsoft.com/fwlink/?LinkId=156512)
• For Beta 2 support issues, visit the Forefront UAG forum (http://go.microsoft.com/fwlink/?LinkId=156513)
• Forefront UAG RC0 provides a number of new features, including support for migration from Forefront UAG Beta 2. If you want to migrate a Forefront UAG Beta 2 configuration to RC0, ensure that you run the UAG_RC0_4_0981_2.msp file after running Forefront UAG Setup.

Download here: http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=a3f5729a-3989-4f60-980f-1b87dd198988

Google has released its third major revision of Chrome. The updated browser boasts a 150% (25% over its most recent stable release) increase in javascript performance since the launch of version 1. Other new features include a redesigned “new tab” page, an improved omnibox, themes capability, and HTML5 features.

Since Google has released Chrome it has taken a 2.8% market share. It is expected that the market share will continue to grow as more people become aware of the browser. Also, Google has been marketing its browser heavily to users who also use other Google products such as Gmail or Google search.
The browser marketplace is packed with heavy hitters from Microsoft, Apple, and Google. All of which are backed by massive corporations with seemingly unlimited resources. Other well known browsers that also provide serious competition to Chrome are Firefox and Opera.
The competition in the browser market place keeps all the competitors on their toes as they try to gain or maintain their current market share. With Google releasing an updated browser you can be sure that their competitors are watching closely.

Download Google Chrome 3 here: http://dl.google.com/chrome/install/195.21/chrome_installer.exe

Source : http://www.neowin.net

Users can browse in the visual search by products, sports, consumer electronics, famous people, entertainment, reference and many more categories. The updated search makes it easier for users to find what they are looking for through the stylish 3D flip image layout.

Bing now helps users sort through their choices by “Most popular on Bing”, eliminating choices for you to help decide on what to buy. The decision engine can now help expand your search by taking your queries and turning out wider results. Bing will take queries such as “NFL Players” or “MLB Players” and locate as many results of player’s images by face. Bing can also help narrow down user’s queries by sorting players by position, team, salaries and more.

Bing Visual Search requires Microsoft Silverlight to be installed to use the newest version of Bing.

Test out the new beta of Bing at http://www.bing.com/visualsearch