Miscellaneous

The OCS Edge Server: how many NICs do I need?

Devin L. Ganger — Thu, 14 Aug 2008 18:01:26 GMT

There are a lot of people out there who want to try to get around Microsoft's recommended configuration for the OCS Edge Server roles. For whatever reason, they don't like the thought of have two network interfaces, one on a publicly routable IP network, the other on the private network. I've talked in the past about some of the reasons why this configuration is not only recommended, but actually a good idea, but let's just say it took a lot of talking and thinking before I accepted that notion.

MVP Jeff Schertz has done a fantastic job of walking through the various permutations people have come up with, separating what will work from what won't, and explaining the pros and cons of each variant. I highly recommend this post.

I also want to amplify a point he makes: having multiple interfaces (whether physical or virtual) on the same subnet will cause interesting and otherwise inexplicable weirdness on a Windows machine. I'll write up the situation I'm seeing in a bit (not OCS!), but let me be clear: it's caused me all sorts of problems. Run, do not walk, away from any "solution" that requires this.

First Look at Microsoft Online Services: the Sign-In tool

Devin L. Ganger — Mon, 28 Jul 2008 18:30:18 GMT

Continuing from my previous post on MOS...

I didn't really mention this in the previous post, but MOS is designed to provide a hosted alternative to the server-side applications. One of the goals is to continue working with existing native clients and client access methods, so (for example) you can access your Exchange Online mailbox through OWA (running from MOS), through Outlook, or even through EAS/Windows Mobile. In order to do this, though, your client applications need to know how to talk to MOS and provide the proper credentials.

You can do this the hard way or the easy way. The hard way is running around and reconfiguring each application by hand and teaching your users how to use a separate set of credentials. The easy way is to use the MOS Sign-In tool, a little .NET 3.0 application that runs on the client desktop. It interacts with Outlook 2007 RTM/SP1, LiveMeeting 8, and IE7+.

When this application is run, it will invite the user to logon to MOS. The first time they do so, they're required to change their password. It then detects the apporpriate applications, offers to configure them to work with MOS, and then just sits quietly on the desktop, providing a seamless SSO experience.

To be continued...

First look at Microsoft Online Services: adding domains

Devin L. Ganger — Mon, 28 Jul 2008 18:21:46 GMT

I'm at an airlift here in Redmond for the new Microsoft Online Services (MOS), Microsoft's hosted services platform. Right now, MOS offers a combination of hosted Exchange (OWA, Outlook, and even EAS!), hosted SharePoint, and Live Meeting. We've just gone through an overview of the service, and it looks cool -- enough so that I'm now seriously considering switching my personal domains over to it (especially since they offer the ability to synchronize with your Active Directory deployment).

MOS is currently in beta and you can go sign up for a time-limited trial. There's only a certain number of trial accounts active at any given time, so your trial request may not be provisioned immediately; however, you can go to https://mocp.microsoftonline.com and sign up for one. You'll need a Windows Live account.

As you might imagine, MOS allows you to associate one or more DNS domains with your online account. When you register for your account, you're asked for a domain. This domain is not verified and, in fact, seems to be used simply as an internal administrative tag -- once your account and service is set up, you have to specifically add DNS domains. Adding them is a fairly simple process:

Register your domain name with a registrar.
Provision your domain with a DNS provider (often combined with step 1).
Add the domain name to your MOS Admin Center.
Run the verification wizard and add the auto-generated CNAME to your domain's DNS zone.
Validate the domain in the MOS Admin Center.
Start provisioning users with this domain, enable inbound e-mail on this domain, etc.

The verfication step is an important piece, because this helps MOS make sure that you're using a domain you're actually in control of. Otherwise, malicious people could sign in and hijack your domain, which would suck. The way Microsoft does this is actually simple and elegant: they generate a unique CNAME record (that looks very much like a GUID), and ask you to add this CNAME record, pointing back to a server under their control, to your zone. This has lots of advantages:

It's pragmatic. If you can add a CNAME record to a zone file, you effectively control the domain.
It avoids the nastiness that can result in WHOIS-based verification and allows people who register domains to continue using proxy companies, hiding their personal info from WHOIS spammers.
It's relatively easy. You simply have to add a simple record to your DNS; if you can't do this (or your DNS hoster can't do it for you), then you have much bigger problems managing your DNS and verifying your DNS domain under MOS is the least of your problems.
It's low-impact. The generated CNAME is highly unlikely to be queried during normal operations by your users; only MOS is likely to be looking for it. It doesn't require you to repoint your MX records or otherwise make major modifications to your infrastructure if all you want to do is start using online SharePoint and Live Meeting.

Note that just because you add a domain to MOS doesn't mean you have to use it for email! That's a separate operation, which is a two-step process of enabling inbound email for that domain and then updating your MX records appropriately.

More on other MOS functionality coming later...big thanks to the event staff for their kind permission for me to blog!

DPM 2007 Rollup packages now available

Devin L. Ganger — Thu, 10 Jul 2008 02:34:31 GMT

While I was away on vacation last week, Microsoft finally released the DPM 2007 Rollup packages to Microsoft Downloads. (I blame Jason Buffington; I'm sure he waited until I was out of office.) There are both x86 and x64 packages; both require you to download three separate files.

In addition to various bug fixes, this rollup (also known as a "feature pack") provides the following new functionality:

Official support for protecting Windows Server 2008 servers (and supported applications, such as Exchange Server 2007, running on Windows 2008), including protecting the system state.
You get support for backing up clustered Virtual Server 2005 R2 SP1 environments. Before, the cluster itself was not seen as a cluster by DPM, and depending on your configuration you may have needed to do some funky scripting.
Better tape handling. You can now share tape libraries between multiple DPM servers, reducing the cost of long-term tape retention and allowing better utilization of high-end tape libraries. You can also put multiple protection groups on a single tape; DPM 2007 RTM would start a new tape as it began writing each protection group, even if the previous tape was not fully used. This could get expensive.

I haven't yet been able to confirm whether the cleaning tape bug Tim noted has been fixed in this update, but I suspect not.

Applying this update is a four-step process:

Install the main DPM update (DataProtectionManager2007-KB949779.exe)on your DPM servers.
Install the SQL Server update (SqlPrep-KB949779.msp) on the machine hosting the SQL Server database for DPM. In a default install, this is the same machine that is your DPM server.
Update the agents on your protected servers to version 2.0.8107.0. You can push them out through the console or manually run the .msp update package on your protected machines (using any supported push mechanism). You will need to restart the protected machines for the new agent version to take effect.
Update the DPM Management Shell update (DPMManagementShell2007-KB949779.msp) on all of your DPM management stations (including the DPM servers themselves).

Although the official instructions give the update steps in the previous order, I have run all three udpates on my lab DPM servers before updating the agents on my protected servers, and as long as Microsoft doesn't say that's not supported, that's the way I'd recommend doing it -- that way, all of your PowerShell tasks are using the updates even if you don't have all the protection agents pushed out yet.

Hyper-V in the hizzouse!

Devin L. Ganger — Fri, 27 Jun 2008 03:28:20 GMT

Everyone's being so coy in the Windows blogosphere today. "As you may have heard..." Heck with that; this is wicked cool. Hyper-V has Released To Manufacturing ... and is already available for download. As the link explains, it'll start coming down the Windows Update pipe July 8th. If you don't want your Windows Server 2008 machine to be updated yet, don't be blindly accepting updates.

Why wouldn't you want to get it first thing?

You're running a previous version of Hyper-V. If so, be aware that upgrading your VMs is not automatic. It's not a horrible process, but it will take some time. You have to manually export each VM, remove the VMs from the server, upgrade the server, re-import the VMs, then update the Integration Services. The more VMs you have, the more time this will take.
You're running some software that is not yet compatible with Hyper-V RTM but works with an earlier build. In this case, you want to wait until that software has a patch available.

I fit into both categories. I think I'm going to wait until I'm back from vacation to do it.

Oh, yes, just because Hyper-V is now RTM doesn't mean that you can go run to install Exchange 2007 on it in production. See Scott Schnoll's post for more info.

masteringdpm.com back online

Devin L. Ganger — Mon, 23 Jun 2008 15:26:49 GMT

Things got hairy enough last week that I forgot to post, but my hosting provider got the problem sorted out and the website is back online.

masteringdpm.com temporarily down

Devin L. Ganger — Wed, 18 Jun 2008 18:43:45 GMT

If you've tried to get to masteringdpm.com in the past couple of days, you may have gotten a cryptic error message instead of a site with DPM goodness. I'm working with my hosting provider to get it put back up ASAP and will post again once it's back up.

Welcome, Mike Rand!

Devin L. Ganger — Tue, 17 Jun 2008 19:46:23 GMT

Just a quick shout-out to fellow 3Sharpie Mike Rand, who just posted his first post to the 3Sharp blog site last week. Mike's a super-smart developer here with mad SharePoint skills; I can't imagine why he hasn't blogged sooner than this, but I hope to see him posting more frequently! He's also pretty good at foosball.

A .NET add-on for working with Exchange Web Services

Devin L. Ganger — Mon, 16 Jun 2008 18:10:20 GMT

I just got word that Independentsoft has come out with a beta version of an EWS client API for the .NET Framework and .NET Compact Framework. I've not looked at it yet, but I'm particularly hopeful about having a good way to work with EWS from Windows Mobile devices.

Exchange Web Services (EWS), introduced in Exchange 2007 and enhanced in Exchange 2007 SP1, is Microsoft preferred interface for all future programmatic reach into the Exchange store. While EWS is a Web service, it can be pretty complicated to work with. Luckily, we've done some work with EWS here at 3Sharp; Paul's been presenting some developer training sessions on EWS in partnership with Microsoft. We've found that Inside Microsoft Exchange Server 2007 Web Services has been a valuable reference on EWS.

One of the challenges for EWS development is that the schema and object model is pretty complex when compared with the typical Web service, enough so that you need to use special Visual Studio proxy classes when you use .NET to work with EWS. This, by the way, is very likely the cause of the compatibility issue I found between EWS and SharePoint Designer -- Designer's proxy classes aren't the EWS-aware ones.

3Sharp, Podcasting, and You

Devin L. Ganger — Mon, 09 Jun 2008 18:25:11 GMT

The talented people at 3Sharp are one of the best reasons to work here. Our Platforms Group is just one piece of the pie here; we've got some top-tier development talent who can make SharePoint stand up and dance. Those guys down the hall have been working hard on a little surprise they like to call the Podcasting Kit for SharePoint, which Microsoft has just released on Codeplex as indicated in their press release. 3Sharpies John Peltonen, David Gerhardt, and Paul Robichaux are also blogging about it, so if you’re interested, check them out.

I've been hearing bits and pieces, but last week I got to sit down and take a good look at what they're doing. Wow. This is some cool stuff that is going to make sharing podcasts, video talks, and other knowledge sharing content a lot easier. I can't wait until I can start using it; I've already lined up some content that I can put up and I'm already thinking of some more I can do.