MDM SP1 SCW Manifests

Before deploying servers into the production environment at work, we run the Security Configuration Wizard to harden the Operating System. Hardening involves such things as disabling unnecessary Services, adjusting authentication methods and setting Windows Firewall Exception in an effort to reduce the overall attach surface of the Operating System. While Server 2003 SP1 includes a number of default templates, additional templates are available for download on the Internet.

As part of the MDM deployment that I'm involved with, I've been looking to harden the servers before they go live. The MDM Dev Team at Microsoft were kind enough to create manifests and bundle them in the MDM SP1 Server Resource Kit. I've yet to try them but I expect them to function as the others do. The MDM SP1 Resource Kit can be downloaded here.

64bit VM on a 32bit OS with VMware Workstation

I'm in the process of deploying MS SCMDM SP1 and have decided to first install the various components (MDM Gateway, Enrolment and Management Servers) in a isolated local VMware Environment before doing the live install. I stumbled upon a problem with running the 64bit Windows 2003 OS on my 32bit Windows XP laptop OS. Basically VMware Workstation was complaining that the CPU on the laptop was not compatible with the 64bit OS that i was trying to run on the VM.

There was two steps to resolve this;

• Enable Intel Virtualisation Technology in my laptop's BIOS
• Power off the laptop and then power on (a hot restart was not enough for this BIOS option to be recognised.)

There's also a handy CPU tester from VMware which will check your Host CPU for 32/64bit compatibility. It can be found here

Sysprep Answer File Location in VMware ESX 3.5/VC 2.5

I was looking for the file location of the Sysprep answer files in Virtual Centre 2.5 used with ESX 3.5 when creating a new Customisation Specification for a X64 VM Template but couldn't find it. I realise Customisation Specifications can be accessed in VC via Edit > "Customisation Specifications..." but really wanted to know where and how they were stored.

Not being able to find anything on net, I asked a colleague. He pointed out that they reside in a table in the VC SQL DB called 'VPX_CUSTOMIZATION_SPEC'.

Relocating SQL Server System Database Files

I have built a fair few SQL Servers over the last few years and always look to relocate the System DBs from their default location in the Install folder. The following MS KB article explains how to move the TempDB, MSDB, Model and Master on SQL Server 7, 2000 & 2005. Article is here

SCOM SNMP Monitor Issues

While creating a test SNMP Probe which produced alerts, we encountered issues around how to match the returned SNMP value for a Cisco Device's CPU OID.

To return the SNMP value you can use;

"/DataItem/SnmpVarBinds/SnmpVarBind[1]/Value" without the quotes.

The URL for the article is here

Also we found issues when using expression matching on numeric values returned via SNMP. this is due to the wizard creating the rules to expect String datatypes rather than Integer. The article can be found here.

I'm in the process of trying to configure Kerberos Constrained Delegation in ISA 2006 for a Web Server which will use Client Certificate Authentication.

I found this article over at Technet which i thought was very useful.

WSUS 3.0 SP1 Clients Being Overwritten

We've recently deployed WSUS 3.0 SP1 at work and found an interesting issue regarding our Virtual Machines. It appears that the VM's were overwriting eachother in the WSUS console.

We did a little reading and found this by Stephen Farrar. It appears that the Sysprep process that we used to commission our VMs on ESX does not strip out the [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\SusClientId] entry in the Registry and therefore all of our VMs have the same ID.

I've written a VBScript which first of all deletes the key, stops and starts the Automatic Updates service and then forces the client to re-register with the WSUS Server. This seems to resolve the issue.

Option Explicit

Dim strRegKey, WshShell, strServiceName
Set WshShell = WScript.CreateObject("WScript.Shell")

'Delete Automatic Update Client ID

strRegKey = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\" _
& "CurrentVersion\WindowsUpdate\SusClientId"
WshShell.RegDelete strRegKey

'Restart Automatic Update Windows Service

strServiceName = "wuauserv"
WshShell.Run "Net Stop " & strServiceName, 0, True
WshShell.Run "Net Start " & strServiceName, 0, True

'Force the Client to report to the WSUS Server
WshShell.Run "wuauclt.exe /detectnow /resetauthorization"