Microsoft's Patch Vital For Windows Server 2000 Users

Microsoft has released an Internet Explorer patch marked 'critical' for download to fix vulnerability issues that is said to have affected around 2 million users.

The browser's flaw allows a Trojan to take over a victim's computer; it then routes it to infected websites.

The Excel vulnerability affects various versions of Microsoft Office, including Microsoft Office for Mac 2004 and 2008. The IE patch could allow information disclosure or remote code execution if a user views a specially crafted Web page.

Of the "critical" patches, Vulnerability in Active Directory Could Allow Remote Code Execution garnering the most attention. Failure to apply the software could allow remote code execution if an attacker gains access to an affected network.

"This vulnerability only affects Microsoft Windows 2000 servers configured to be domain controllers," Microsoft said in its bulletin. "If a Microsoft Windows 2000 server has not been promoted to a domain controller, it will not be listening to Lightweight Directory Access Protocol (LDAP) or LDAP over SSL (LDAPS) queries, and will not be exposed to this vulnerability."

"It's especially critical for an IT shop that has Windows server 2000 domains and domain controllers," Schultze said. "You might not have them for long as any disgruntled employee can rename the files and take control of those assets without this patch."

Schultze said that Microsoft Security Bulletin MS08-063 and MS08-065, while labeled "important," is more than likely critical for a company's security. Both vulnerabilities allow for remote code execution, a favored target of hackers. MS08-063 in particular is dangerous because it impacts the Microsoft Server Message Block (SMB) protocol.

"That's the file- and printer-sharing protocol," Schultze said. "It's the protocol you use to log in and send something to the printer. So, if I go to my S drive and rename those files and give it a specifically long file name, then the moment that I do that, I can own that file server without human interaction. ... It's the first time in a long time we have seen these server-side vulnerabilities."

MS08-065 is a hole in Microsoft's Message Queuing Service (MSMQ) on Windows 2000 systems. The vulnerability could allow remote code execution on Microsoft Windows 2000 systems with the MSMQ service enabled.

Schultze also noted that five of the 11 bulletins posted by Microsoft are addressing vulnerabilities found in Windows Vista and Windows Server 2008. "This really shows us that these operating systems are impacted by legacy code that goes back to Windows 1998 or earlier," he said.

Customers are also being warned about an e-mail sent out by hackers who are posing as a Microsoft security executive.

Source: .informationweek.com/news/security/app-security/showArticle.jhtml?articleID=211200526

Steps to install Small Business Server 2003 in an existing Active Directory domain

To install a SBS 2003 computer in an existing Active Directory domain, follow these steps:

1. On a Windows 2000 domain, you must prepare Active Directory before you install the SBS 2003 computer in the domain. For more information about how to install a Windows Server 2003 domain controller into an existing Windows 2000 forest, click the following article number to view the article in the Microsoft Knowledge Base:(http://support.microsoft.com/kb/278875/ ) Dcpromo.exe and Winnt32.exe log errors when you create a Windows Server 2003 domain controller in a Windows 2000 domain or forest or when you upgrade a Windows 2000 domain controller that resides in a Windows 2000 forest to Windows Server 2003
2. Start the installation of SBS 2003 by inserting CD 1 into the CD or DVD drive.
3. When the operating system is installed and the computer restarts and continues with the integrated Setup program, click Cancel to stop the integrated Setup program.
   
4. On the SBS 2003 computer, configure a static IP address on the network card and make sure to configure DNS to include the existing server that hosts the Active Directory zone.
   
5. Note Do not create a new forest and do not create a child domain.
   1. Click Start, click Run, type dcpromo, and then click OK.
   2. Click Next two times.
   3. Click Additional Domain Controller for an existing domain, and then click Next.
   4. Enter the credentials for the domain administrator account, and then click Next.
   5. In the Domain name area, type the FQDN for the Active Directory domain namespace that you want to join, and then click Next. For example, type contoso.local. If you are not sure of the FQDN, you can click Browse to select the correct domain.
   6. Click Next to accept the default locations for the Database and Log folders.
   7. Click Next to accept the default locations for the shared system volume.
      
   8. Type the Directory Services Restore Mode administrator password, and then click Next.
      
   9. On the Summary screen, click Next to start the Dcpromo.exe program. This process may take several minutes.
   10. Click Finish to complete the Dcpromo.exe program, and then click Restart Now.
   11. Log on to the computer after it restarts and confirm that the computer has been successfully promoted to a domain controller. To do this, click Start, click Run, type cmd, and then click OK.
   12. At the command prompt, type gettype, and then press ENTER. The output should read as follows:
       
       

       Host Name: ServerNameName: Windows Server 2003 for Small Business Server
       Version: 5.2 Build 3790
       Role: Domain Controller
       Components: Not Installed

6. Install the DNS server service. To do this, follow these steps:
   1. Click Start, point to Control Panel, and then click Add/Remove Programs.
   2. Click Add/Remove Windows Components.
   3. In the Windows Components list, double-click Networking Services.
   4. Click to select the Domain Name System (DNS) check box, and then click OK.
   5. Click Next, and then click Finish.
      
   
   
7. Promote the SBS 2003 computer to a global catalog server. To do this, follow these steps:
   1. Click Start, point to Administrative Tools, and then click Active Directory Sites and Services.
   2. Expand Sites, expand Default-First-Site-Name, expand Servers, expand your SBS 2003 computer, right-click NTDS Settings, and then click Properties.
   3. Click the General tab, click to select the Global catalog check box to assign the role of global catalog to this computer, and then click OK.
   4. Open Event Viewer to the Directory Services event log and wait for event 1119 or 1869 with a description that states that this domain controller is now a global catalog.
   5. Restart the computer.
      
      Note Do not restart the computer or remove any other global catalog servers until you receive event 1119 or 1869. If you do this, it will cause adverse effects as there will be no global catalog servers available to process requests.
8. After the new computer is successfully promoted to a global catalog server, remove any other global catalog servers in the domain. To do this, follow these steps:
   1. Click Start, point to Administrative Tools, and then click Active Directory Sites and Services.
   2. In the console pane, expand Sites, and then expand Default-First-Site-Name.
   3. Expand Servers, expand any computers other than your SBS 2003 computer, right-click NTDS Settings, and then click Properties.
      
      Note You may have to repeat this step more than one time if more than one computer is listed, other than the SBS 2003 computer.
   4. On the General tab, click to clear the Global catalog check box to assign the role of global catalog to this computer, and then click OK.
      
      Note If the Global catalog check box is not selected, go to step 8.
   5. Restart any computers where you removed the global catalog server role.
      
      Note Wait for the account and the schema information to replicate to the new global catalog server.
9. Transfer the FSMO roles to the SBS 2003 computer. To do this, follow these steps for each FSMO role:
   1. Transfer the Relative ID (RID) Master role. To do this:
      1. Click Start, point to Administrative Tools, and then click Active Directory Users and Computers.
      2. Right-click your organization name, click All Tasks, and then click Operations Masters.
      3. In the Operations Masters dialog box, click the RID tab.
      4. In the Operations Masters dialog box, click Change.
      5. Click Yes to confirm that you want to transfer the role, and then click OK.
   2. Transfer the PDC Emulator role. To do this:
      1. Click Start, point to Administrative Tools, and then click Active Directory Users and Computers.
      2. Right-click your organization name, click All Tasks, and then click Operations Masters.
      3. In the Operations Masters dialog box, click the PDC tab.
      4. In the Operations Masters dialog box, click Change.
      5. Click Yes to confirm that you want to transfer the role, and then click OK.
   3. Transfer the Infrastructure Master role. To do this:
      1. Click Start, point to Administrative Tools, and then click Active Directory Users and Computers.
      2. Right-click your organization name, click All Tasks, and then click Operations Masters.
      3. In the Operations Masters dialog box, click the Infrastructure tab.
      4. In the Operations Masters dialog box, click Change.
      5. Click Yes to confirm that you want to transfer the role, and then click OK.
   4. Transfer the Domain Naming Master role. To do this:
      1. Click Start, point to Administrative Tools, and then click Active Directory Domains and Trusts.
      2. Right-click Active Directory Domains and Trusts, and then click Operations Master.
      3. In the Change Operations Master dialog box, click Change .
      4. Click Yes to confirm that you want to transfer the role, and then click OK.
      5. Click Close to close the dialog box.
   5. Transfer the Schema Master role. To do this:
      1. You can use the Schema Master tool to transfer the role. However, the Schmmgmt.dll file must be registered to use the Schema Master tool as an MMC snap-in. To register Schmmgmt.dll, click Start, click Run, type regsvr32 schmmgmt.dll, and then click OK.
         
         Note You receive a message that confirms that the registration was successful.
      2. Click Start, click Run, type mmc, and then click OK.
      3. Click File, and then click Add/Remove Snap-in.
      4. In the Description area, click Add.
      5. Click Active Directory Schema, click Add, and then click Close.
      6. Click OK.
      7. Right-click Active Directory Schema, and then click Change Domain Controller.
      8. In the Select DC area, click Specify Name, type the name of the SBS 2003 computer, and then click OK.
      9. Right-click Active Directory Schema, and then click Operations Master.
      10. In the Change Schema Master dialog box, click Change.
      11. Click Yes, click OK, and then click Close.
      For more information, click the following article number to view the article in the Microsoft Knowledge Base:
      (http://support.microsoft.com/kb/324801/ ) How to view and transfer FSMO roles in Windows Server 2003
10. Move the site licensing server to the SBS 2003 computer. To do this:
    1. On the SBS 2003 computer, click Start, point to Administrative Tools, and then click Active Directory Sites and Services.
    2. Expand Sites, and then click Default-First-Site-Name.
    3. Right-click Licensing Site Settings, and then click Properties.
    4. Click Change, type the name of the new SBS 2003 computer in the Enter the object name to select area, and then click OK.
    5. Click OK to close the Licensing Site Settings Properties dialog box.
       
       For more information, click the following article number to view the article in the Microsoft Knowledge Base:(http://support.microsoft.com/kb/273475/ ) Licensing in Windows 2000 and differences with Windows NT 4.0
    
    
11. Wait for the new Active Directory objects to replicate to the SBS 2003 computer. The time this takes depends on the Active Directory size and on network performance. You can view the Directory Service event log to verify that replication has completed successfully. The SBS 2003 integrated Setup program may not continue if replication has not completed or if replication has failed.
    
    To test replication, you can create a new test user on a domain controller and after several minutes confirm the object has been replicated to the SBS 2003 computer. You can also force replication from a domain controller. To do this:
    1. On the SBS 2003 computer, click Start, point to Administrative Tools, and then click Active Directory Sites and Services.
    2. In the left pane, expand Default-First-Site-Name, expand Servers, and then expand the domain controller that you want to replicate from.
    3. Click NTDS Settings. One or more objects are listed in the right pane. One of those objects is a link to the domain controller you want to replicate from. To see the "friendly" name of the object, right-click the object and view the name. Right-click the domain controller object, and then click Replicate Now. The replication is performed immediately.
12. Change the DNS settings on all domain controllers to point to the new SBS 2003 computer as the primary DNS server. To do this, follow these steps.
    
    Note Follow these steps on all domain controllers in the Active Directory, including the SBS 2003 computer.
    1. Click Start, point to Control Panel, point to Network Connections, right-click the internal network connection, and then click Properties.
    2. Click to select Internet Protocol (TCP/IP), and then click Properties.
    3. Change the preferred DNS server. Type the IP address of the SBS 2003 computer as the preferred DNS server. Also, make this change on the SBS 2003 computer.
       
       Note The alternative DNS server can point to the previous preferred DNS server as long as it is a server that hosts the Active Directory zone.
13. On the SBS 2003 computer, insert the SBS 2003 CD 1 into the CD or DVD drive and continue with the integrated Setup of SBS 2003 and its components.
14. If you already have Microsoft Exchange Server installed in the organization, the integrated Setup installs Exchange Server into the existing organization. If you already have an Exchange 2003 Server or an Exchange 2000 Server in your organization, and you plan to retire that Exchange Server, you can move the mailboxes and public folders to the new Exchange 2003 Server before you retire the old Exchange Server. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    822931 (http://support.microsoft.com/kb/822931/ ) How to remove the first Exchange 2003 Server computer from the administrative group
    
    To move the mailboxes and public folders, follow these steps:
    1. On the existing Exchange Server in the organization, open Exchange System Manager. To do this, click Start, point to All Programs, point to Microsoft Exchange, and then click System Manager.
    2. At the top of the tree in the left pane, right-click the Organization Name (Exchange) icon, and then click Properties.
    3. Click to select the Display administrative groups check box, click to select the Display routing groups check box, and then click OK.
    4. Expand the Recipients container, and then click Recipient Update Services.
    5. Double-click each entry, and then enter the name of the new Exchange Server that is running on the SBS 2003 computer in the Exchange server area.
    6. Expand Administrative Groups, expand Administrative Group Name, expand Routing Groups, and then expand First Routing Group.
    7. Click Connectors, right-click your SMTP connector if it is present, change the server that is listed in the Local bridgeheads area to the new SBS 2003 computer, and then click OK.
    8. In the left pane, under First Routing Group, click Members.
    9. In the right pane, right-click the new SBS 2003 computer, and then click Set as Master.
    10. In the left pane, expand Administrative Groups, expand Administrative Group Name, expand Servers, and then expand the Exchange Server that existed before you added the new Exchange Server on the SBS 2003 computer.
    11. Expand First Storage Group, expand Mailbox Store, and then click Mailboxes.
    12. Select all the mailboxes, right-click the mailboxes, and then click Exchange Tasks.
    13. In the Exchange Task Wizard, click Move Mailbox, and then click Next.
    14. Click to select the new SBS 2003 computer in the Server list, and then click Next.
    15. Specify how you want the Move Mailbox procedure to handle corrupted messages, and then click Next two times to re-home all the mailboxes to the new SBS 2003 computer.
        
        Note This procedure also re-homes the public folders to the new SBS 2003 computer.
    16. Click Finish.
    17. As soon as replication is successful, remove Exchange Server from the computer that is to be retired. If the computer that is to be retired is also a domain controller, run the Dcpromo.exe program to remove this computer from the domain before you physically retire it.
        
        Note You must instruct all Exchange Server users to point to the new Exchange Server.
15. Run the Dcpromo.exe program on the SBS 2003 computer to join the existing domain.

For More Info: http://support.microsoft.com/kb/884453/en-us

Data Recovery Options in Windows 2000 Server

If your Windows 2000 Server crashes, you may not have to take the long way back to data recovery. Jim Boyce explores several options that may be able to solve a server problem in a fraction of the time.

Backup in Windows 2000 Server is the first and the strongest line of defense against data loss.

But server crashes happen anyway, and when they do, you don't want to spend hours restoring your server for an error that could be fixed in five minutes. Here are some tools and methods you can use to restore a crashed server as quickly as possible.

If the computer won't boot, try to start it in Safe Mode. With Safe Mode, the operating system loads only the basic set of drivers and services needed to boot. Once you're in Safe Mode, you can check the logs to get an idea about what's preventing a normal boot.

If Safe Mode isn't working, you can use Last Known Good configuration. When Windows 2000 boots successfully, the operating system creates a copy of the registry keys under HKLM\System\CurrentControlSet, which are involved in that boot process.

If neither of these methods work, take a look at the Recovery Console. Recovery Console is a command prompt mode from where you can copy and replace missing or corrupted files. The Recovery Console mode can also help you fix master boot record problems.

Before you return to the backup method, try the Emergency Repair Disk, which stores a backup copy of the Boot.ini file and some critical registry keys. This may be very useful if administrators have made regular updates.

Source: zdnetasia.com/techguide/windows/0,39044904,39380334,00.htm

SonicWALL Announces Security Solutions for Windows Essential Business Server

SonicWALL, Inc. a secure network infrastructure company, announced the availability of its Email Security and Network Security Appliance(NSA) Series for Microsoft Corp.’s Windows Small Business Sever (SBS) and Windows Essential Business Server (EBS). The SonicWALL technologies, which complement SBS and EBS, deliver a comprehensive security package that ensures SMBs have access to enterprise class-products at affordable prices.

“Microsoft aims to provide its customers a selection of products that offer them the best solutions available in the industry and Windows Essential Server Solutions continues this momentum.” said Russ Madlener, director, Windows Server Group at Microsoft Corp.. “We are pleased SonicWALL is building out additional functionality and ensuring that our mutual customers have a robust IT deployment to meet their specific needs.”

Email Security

SonicWALL’s Email Security offerings help companies of all sizes protect themselves from spam, viruses, phishing and other harmful threats in email attacks by combining the powerful protection of threat management, content filtering, policy management and compliance infrastructure functionality. The new solution brings this high-performance and easy-to-use protection against all forms of email security threats to the millions of SBS users. Available as a hardened appliance or as Windows software, SonicWALL Email Security protects inbound and outbound e-mail for organizations of less than 25 to over 100,000 users. SonicWALL Email Security for Windows Small Business Server is the latest offering in the line, specifically optimized for the Microsoft server environment to meet the needs of small businesses with an easy-to-install, easy-to-manage solution.

Network Security Appliance Series

The SonicWALL Network Security Appliance (NSA) Series applies next-generation Unified Threat Management (UTM) to enable complete protection at the network perimeter without compromising performance levels to SBS and EBS and its users. The NSA appliances incorporate SonicWALL’s patented Reassembly Free Deep Packet Inspection (RFDPI) and multi-core processing to block threats, such as hackers, viruses and spyware as well as controlling user access to the server.

“SonicWALL has worked hard to create a large portfolio of products that protect firms of all sizes from a vast array of security threats.” said Patrick Sweeney, Vice President at SonicWALL. “Taking these technologies and integrating them with Windows Small Business Server and Essential Business Server is key to our SMB customers.”

Source:pcmag-mideast.com/NewsDetail.aspx?id=2321

Microsoft Rolls Out New Small Business Server Options

Microsoft has announced new server software that it said provides small and medium businesses with enterprise-quality capabilities while helping them to save money, increase productivity and grow their businesses.

While designed specifically for small and midsized companies, Windows Small Business Server 2008 (SBS 2008) and Windows Essential Business Server 2008 (EBS 2008) include Microsoft's high-end server technologies delivered in a way that smaller companies can make the most of them.

“Around the world, small and midsize businesses are the engine that drives economic growth and opportunity,” Steve Ballmer, CEO of Microsoft, said in a company statement. “To help these businesses succeed, Microsoft has focused on creating integrated, affordable server solutions that are optimized to meet the needs of companies with limited IT resources. Small Business Server and Essential Business Server deliver a comprehensive set of capabilities that will help small and midsize business thrive and grow.”

Designed for small companies with up to 75 people/computers, SBS 2008 server software integrates a variety of Windows functions to help small businesses better secure data and increase employee productivity regardless of location.

Based on Windows Server 2008 Standard technology, SBS 2008 incorporates:-

• Exchange Server 2007 Standard Edition for messaging and collaboration
• SharePoint Services 3.0 for online collaboration workspace and productivity tools
• Forefront Security for Exchange Server to handle e-mail security
• Windows Server Update Services 3.0 for network updates and protection
• Windows Live OneCare for Server to manage viruses, hackers and other digital threats
• Microsoft Office Live Small Business to help take your business online
• Microsoft SQL Server 2008 Standard for Small Business, a database available in the Premium edition

The server software offers a range of features including anytime/anywhere access to your PC and its data, including e-mail, files, business applications, and more. It's also designed to let your employees share Internet access, printers, fax machines and other network resources. Click here for SBS 2008 pricing information.

Microsoft designed EBS 2008 for midsized companies with up to 300 people or computers. It's meant to simplify and automate common IT tasks, and a unified administration console gives IT managers more control over an integrated network infrastructure.

Windows Essential Business Server 2008 also incorporates the applications found in SBS 2008, and Microsoft said it provides the following features:

• Significant costs savings compared to buying stand-alone products.
• Remote access, anti-spam, antivirus protection and improved messaging technologies improve productivity both in and away from the office
• An integrated setup saves time and reduces installation steps from days to hours Simplified licensing with a single server license and Client Access for all included products.

Steven VanRoekel, senior director of the Windows Server product group, noted that both server products help small and mid-sized companies compete in tough economic times.

"Small companies have the same needs and face the same challenges as big business, but they lack the staff, resources and time to manage IT environments," VanRoekel said. "The new EBS 2008 and SBS 2008 products are an integrated, affordable, enterprise-quality solution that can help small and midsized companies become more productive, cut costs and be more competitive." Click here for EBS 2008 pricing information

Via: itmanagement.earthweb.com/entdev/article.php/3785346/Microsoft+Rolls+Out+New+Small+Business+Server+Options.htm

Options for passing a driver into the Windows Server 2008 install program

Windows Server 2008 makes this process a little more flexible. Here are various ways that a driver can be passed into the setup program.

• IDE floppy disk: I'm going old school here, but the Windows Server 2008 setup can read from the floppy drive during the installation process.

• USB floppy drive: The Windows setup can read from a USB drive, or the computer's BIOS will enumerate the floppy drive as an A:\ drive. It's somewhat of a cover song of the old school approach.

• USB flash drive: The Windows Server 2008 install will recognise USB storage devices, and you can have the driver located on the removable media.

• Map a network drive: This is a little more advanced, but if you boot the server from a Vista PE bootable environment, map a network drive, and then run the setup.exe program interactively from a network location that you copied from the Windows Server 2008 DVD, you can browse to another network resource for a driver for the mass storage controller. This is especially beneficial if the Vista PE boot environment can be booted from a CD instead of a DVD, which is helpful for servers without a DVD drive. (

• Place the driver on an existing file system: If you can boot the server currently, make a drive partition of NTFS or FAT, you can put the driver on that drive and ensure it is available to the Windows Server 2008 install. Don't make it available on the C:\ drive, but some location at the end of the drive. If you need to resize your drives after installation, no worries -- Windows Server 2008 makes that quite easy as well with new sizing tools .

• Additional optical drives: If your server has a DVD and a CD drive, you can make a simple disk that has the driver files contained there and browse to that location during the Windows Server 2008 install.
  

The list goes on, but this will cover most of the common scenarios for interactive Windows Server 2008 installations.

Source:builderau.com.au/

Four Windows Server 2008 Storage Improvements

With the release of Windows Server 2008, Microsoft is making a number of improvements to the server's underlying storage mechanisms.

Here are four of these improvements and what they mean for the typical IT organisation.

SMB 2.0

First shipped with Windows Vista, SMB 2.0, alternatively known as the Common Internet File System (CIFS), is also included in Windows Server 2008 and sports a number of improvements over its predecessor.

To work with older systems, Windows Server 2008 supports both SMB 1.0 and SMB 2.0 and automatically uses the version most appropriate for communication. SMB 2.0 is used only between Windows Server 2008 systems and with Windows Vista systems. SMB communication with all other operating systems uses SMB 1.0.

BitLocker Drive Encryption

Included in Windows Server 2008 is Microsoft's BitLocker Drive Encryption software. BitLocker is also included in Windows Vista Enterprise and Ultimate editions but, for Windows Server 2008, Microsoft has made improvements to the technology (which are likely to be extended to Vista when Service Pack 1 is released).

Under Vista, BitLocker can be used to encrypt the contents of the operating system volume. If you have multiple volumes of data on your desktop computer, however, BitLocker — at present — cannot be used to protect anything except the operating system volume. In Windows Server 2008, this limitation has been removed and all server volumes can be protected via BitLocker.

Full-disk encryption is usually considered primarily for mobile computers that can be easily stolen, but this technology should also be considered for use in branch offices or areas in which physical security cannot be guaranteed.

Self-healing NTFS

It's a bad day when you have to reboot a file server just to run chkdsk.exe to correct a minor corruption in NTFS. You have to schedule downtime for a server, maybe come in after hours or, in a worst-case scenario, interrupt your users while you perform this task during the day. But no more: with Windows Server 2008 comes an online NTFS corruption repair tool. While it is not a silver bullet for volume repair, it does correct many problems without having to reboot the server to run chkdsk.exe. Self-healing NTFS is enabled by default in Windows Server 2008 installations.

Symbolic links

Earlier, I mentioned that SMB 2.0 supports symbolic links. The fact that SMB 2.0 has this feature is great but it would be utterly useless without the same feature being included in the operating system. As such, symbolic links have been added to Windows Server 2008 — a feature that is long overdue. A symbolic link is simply an object in the file system that points to another object in the file system. A symbolic link appears as a normal file or directory object and can be used by an application as if it were the actual object.

Unix and Linux users have been able to use symbolic links for a very, very long time, and this feature can make it much easier to administer a system and share data.

Source:resources.zdnet.co.uk/articles/0,1000001991,39292799,00.htm