Final session of the day was on "Upgrading to Exchange 2007". Sadly, it was primarily about upgrading FROM Exchange 2003, but it did raise a couple of significant tid bits worth knowing.
Firstly, Exchange 2007 apparently doesn't have any mail routing configuration - it uses the Active Directory Sites and Servers configuration to determine which site is which, and follows the same replication topology that AD uses. This means that we'll need to consider this when designing the AD structure, and also lock down the topology against changes. If we went down the Exchange path, routing and replication changes would need stricter change controls involving both teams.
Secondly, Exchange cluster/failover changes require having the same operating system on both halves of the cluster. And, in-place upgrades of the OS are NOT supported for Exchange 2007 servers. In practical terms, this would mean that a ceentralised Exchange cluster built on Windows 2003 servers would have a lot of challenges when the time came to upgrade to OS to Server 2008. We'd basically need to build a new cluster, set up connectors and migrate the mailboxes individually. The user mailbox would be unavailable during the move.
So, to defer the pain, it would be easiest to deploy onto Windows 2008 servers, so we'd want a WST supported 2008 build first.
Tuesday, November 4, 2008
Microsoft TechEd 2008, Day 2, 15:30
Attended a session with Steve Riley, Senior Security Strategist with Microsoft Security. The session we called "Privacy: Who, What, Where?"
Most of the content covered was general in nature, and more covered risks associates with spyware, RFID chips, security breaches and such. The key message was that, in general, customers to a company don't seemed to be aware or concerned about information disclosure. As such, there is currently not much economic incentive for companies to take privacy and data security seriously. Often, it's cheaper to take the risk and pay government imposed fines rather than do the right thing.
Bitlocker, of course, rated a mention. Steve did say that now BDE supports additional fixed disks and removeable drives (as of Windows 7) that there is little benefit in using both BitLocker and Windows Encrypted File System - both mitigate against the same risks. Neither, though, will protect against documents being e-mailed or taken off a system using unencrypted devices.
One of the technologies to look at would be Windows Rights Management Server. Having a policy enforced by RMS would help manage the risk of a document "escaping" the network (or CTM.)
Most of the content covered was general in nature, and more covered risks associates with spyware, RFID chips, security breaches and such. The key message was that, in general, customers to a company don't seemed to be aware or concerned about information disclosure. As such, there is currently not much economic incentive for companies to take privacy and data security seriously. Often, it's cheaper to take the risk and pay government imposed fines rather than do the right thing.
Bitlocker, of course, rated a mention. Steve did say that now BDE supports additional fixed disks and removeable drives (as of Windows 7) that there is little benefit in using both BitLocker and Windows Encrypted File System - both mitigate against the same risks. Neither, though, will protect against documents being e-mailed or taken off a system using unencrypted devices.
One of the technologies to look at would be Windows Rights Management Server. Having a policy enforced by RMS would help manage the risk of a document "escaping" the network (or CTM.)
Microsoft TechEd 2008, Day 2, 12:30
The last session was on Exchange 2007 troubleshooting. Most of it was too techy to blog here, and primarily of interest only if we move to Exchange.
But they also covered off the general troubleshooting fundementals, these being (and I'm paraphrasing here):
Know your stuff;
Have a baseline, and proactively monitor systems to check for changes;
Think of the implications before you make a change.
We all know these things, but it's still good to be reminded occasionally.
Oh, and the other thing is that most of Exchange 2007 - and Windows 7 - advanced administration involved scripting in PowerShell. So, it's time to learn yet another scripting language!
But they also covered off the general troubleshooting fundementals, these being (and I'm paraphrasing here):
Know your stuff;
Have a baseline, and proactively monitor systems to check for changes;
Think of the implications before you make a change.
We all know these things, but it's still good to be reminded occasionally.
Oh, and the other thing is that most of Exchange 2007 - and Windows 7 - advanced administration involved scripting in PowerShell. So, it's time to learn yet another scripting language!
Microsoft TechEd 2008, Day 2, 10:15
First session was about Windows 7. A few new things, but evolutionary not revolutionary (tick that one off!)
One key technology is "DirectAccess" - need to get more information about this but apparently this, when used in conjunction with Windows Server 2008 R2, will allow seamless and secure access to corporate networks without needing a VPN. I have my doubts on what their definition of "secure" is, but will research further while I'm here.
Bitlocker encryption is being extended to removable disks/USB drives, and can be enforced by group policy - you can prevent a user writing to a USB device unless it's BitLocker protected. Someone should tell the UK Government this. Another advantage, of course, is that recovery keys can be backed up to Active Directory for easy recovery in the event of a forgotten password.
They've also made the Application controls (allowing only whitelisted applications) more flexible, - still could be a nightmare to implement first time, but would help prevent users from self-installing apps down the track.
One key technology is "DirectAccess" - need to get more information about this but apparently this, when used in conjunction with Windows Server 2008 R2, will allow seamless and secure access to corporate networks without needing a VPN. I have my doubts on what their definition of "secure" is, but will research further while I'm here.
Bitlocker encryption is being extended to removable disks/USB drives, and can be enforced by group policy - you can prevent a user writing to a USB device unless it's BitLocker protected. Someone should tell the UK Government this. Another advantage, of course, is that recovery keys can be backed up to Active Directory for easy recovery in the event of a forgotten password.
They've also made the Application controls (allowing only whitelisted applications) more flexible, - still could be a nightmare to implement first time, but would help prevent users from self-installing apps down the track.
Monday, November 3, 2008
Microsoft TechEd 2008, Day 1, 19:00
Session MGT327 - System Centre and the Desktop
This session revolved around desktop management using Microsoft System Center Operations Manager. There wasn't much new information here - new for me, but most of it is information Mat already got from 1E
There were a few interesting tid-bits to watch out for, though. They cited a survey that said users generally only report 10% of application or workstation crashes to the helpdesk, of which only half of those (if that) ever get escalated past first level.
One of the features they're promoting is having the Dr Watson / Windows Error reporting subsystem upload crash reports to a Windows Sahre, where Operations Manager can analyse and report on them. This allows better visibility as to where there may be faulty hardware or a buggy device driver, which can be prioritised for repair or escalated to the vendor.
They spoke a great deal about the system installers and software distribution too, and driver management has been given a lot of attention, both in system upgrades and slipstreaming them into new installs.
Application distribution now supports multicasting, which may make NMC happier. You can also schedule a maintenance period (on a user/group or site level), to better manage application distribution and patching. Wake on LAN is also supported, so updates can be downloaded to desktop machines overnight.
There's also a bit of work done with Intel's vPro chipset, which can allow SCOM to do remote hardware inventory while a machine is powered down. Even to the point of changing BIOS settings or even re-flashing the BIOS.
Other conference notes:
1) There are discounts on Microsoft Press books - 30% off, with an additional 5% if you buy 3 or more. So, if there's anything you want me to get, let me know.
2) I've noticed a reasonable number of people using netbooks here, predominantly the Asus EeePCs but a few others. I suppose it makes a lot of sense, given that they're light weight and have good battery life.
This session revolved around desktop management using Microsoft System Center Operations Manager. There wasn't much new information here - new for me, but most of it is information Mat already got from 1E
There were a few interesting tid-bits to watch out for, though. They cited a survey that said users generally only report 10% of application or workstation crashes to the helpdesk, of which only half of those (if that) ever get escalated past first level.
One of the features they're promoting is having the Dr Watson / Windows Error reporting subsystem upload crash reports to a Windows Sahre, where Operations Manager can analyse and report on them. This allows better visibility as to where there may be faulty hardware or a buggy device driver, which can be prioritised for repair or escalated to the vendor.
They spoke a great deal about the system installers and software distribution too, and driver management has been given a lot of attention, both in system upgrades and slipstreaming them into new installs.
Application distribution now supports multicasting, which may make NMC happier. You can also schedule a maintenance period (on a user/group or site level), to better manage application distribution and patching. Wake on LAN is also supported, so updates can be downloaded to desktop machines overnight.
There's also a bit of work done with Intel's vPro chipset, which can allow SCOM to do remote hardware inventory while a machine is powered down. Even to the point of changing BIOS settings or even re-flashing the BIOS.
Other conference notes:
1) There are discounts on Microsoft Press books - 30% off, with an additional 5% if you buy 3 or more. So, if there's anything you want me to get, let me know.
2) I've noticed a reasonable number of people using netbooks here, predominantly the Asus EeePCs but a few others. I suppose it makes a lot of sense, given that they're light weight and have good battery life.
Microsoft TechEd 2008, Day 1, 17:30
Attended session UNC205 - Exchange Online Administration and Management, which was basically an overview of the user management for Exchange online.
Interesting stuff, though how scalable the website is to a large company is not clear. One thing that did come across yet again is that everything is Active Directory centric, and to use any of MS's cloud offerings requires allowing them to store an AD replica on their systems.
On the plus side, they do have a single sign-on tool that works with (an auto-configures) Outlook, Live Messenger and Sharepoint.
Oh, and I had a chocloate donut during the break. Is that too much detail? Karoona said that communication is really important....
Interesting stuff, though how scalable the website is to a large company is not clear. One thing that did come across yet again is that everything is Active Directory centric, and to use any of MS's cloud offerings requires allowing them to store an AD replica on their systems.
On the plus side, they do have a single sign-on tool that works with (an auto-configures) Outlook, Live Messenger and Sharepoint.
Oh, and I had a chocloate donut during the break. Is that too much detail? Karoona said that communication is really important....
Microsoft TechEd 2008, Day 1, 15:30 - Keynote speech by Brad Anderson
The keynote focussed on a number of areas, but the major ones were virtualisation, Operations Manager and cloud services.
They made quite a big deal about the HyperV and Live Migration - mentions of VMware were noticeably absent from that part of the speech! Basically, there's not much in that space that we don't have already.
Upcoming, however was application virtualisation which did raise one or two interesting ideas. EUT (well, Mike) is already looking a little at virtualised applications for deployment purposes, but one of the ideas mentioned for forthcoming technology is to run virtualised server applications. The idea is that you can hot-migrate an running application from Windows server to Windows server, between physical and virtual. Key point there is that you could migrate the application off, patch and/or reboot the server operating system, then migrate back, which might have interesting implications for server uptimes and SLAs.
Operations Manager Virtual Machine Manager was the next major topic - VMware did rate a mention here, mainly because it can manage both VMware and MS environments, and can manage physical and virtual hosts, something that VirtualCenter can't do. It can also drill down to applications and services (primarily web services), and report availability across multiple servers too. Given the renewed push for Service catalog and application SLAs, this could be a useful reporting tool. But, naturally, you need to put in the runt work to model the applications and dependencies first!
Cloud Services was the final major thing - going forward, MS is developing all their services such that they can be run locally or in the cloud (Microsoft's Cloud!), and migrated between. One of the demos they did showed moving 5 user mailboxes from Exchange running locally to Exchange Online - including content - with no end user reconfiguration or intervention. Naturally, they didn't talk about security or firewall ports required, but I'm sure the info is available somewhere.
Subscribe to:
Posts (Atom)
Posts
