Other posts in this series:

Implementing App-V – Part I: Introduction to Application Virtualization

Implementing App-V – Part II: Choosing and Preparing the Environment

Implementing App-V – Part III: Integrating Clients

Ok, we had a good look about the entire App-V platform so far: Explanation about application virtualization and the components involved in App-V (Post I); installation of the App-V Server including some troubleshooting tips (Post II); integrating App-V client components, testing the default application and some troubleshooting about this process as well (Post III).

Now it is time to sequence some real applications and deliver them to clients. As always, I’m going to start with an easy one, so you can see all the tricks involved to get the things working. But first, we must prepare the App-V Sequencer machine.

As we’ve seen in Post I, the main component involved in the sequencing process is the App-V Sequencer.

Sequencer Quick Checklist

• Use the same base operating system for both, Sequencer and Target (client) machines. Microsoft does not support using different type of OS between these two. Off the record: I’ve used many applications that worked perfectly when this requirement was not fulfilled.
• The Sequencer machine must have a second partition available. The common use for this one is to assign the Q:\ drive letter.
• Sequencer and Client machine must have the same Windows Installer version.
• In the Sequencer machine ensure that the directories %TMP%, %TEMP% (user temporal data) have sufficient space, since the application use this directory to store temporal sequencing data.
• Before sequencing an application you should close all other programs, including Antivirus.
• As a recommended best practice, use VirtualPC or any other type of virtual machine for the App-V Sequencer. Combine this using snapshots or differencing disks to always have available a fresh OS to deploy applications. 

For more information about the sequencing process and requirements, check the Sequencing Guide from Microsoft and also the Sequencing Best Practices.

App-V Sequencer Setup

Once you’ve checked all the requirements mentioned above, the installation process is quite simple and straight forward.

App-V Sequencer main window:

Sequencing Applications Step-by-Step

As I mentioned earlier my first pick will be a simple application, this will allow us to get familiarized with the sequencing process. I want to start showing the App-V compatibility with some non-Microsoft applications, I’ll be using Mozilla Firefox.

1. In the App-V Sequencer program window select “New Package”.

2. A new wizard will start, select the package name “Firefox”.

3. In the next window you are ready to get started with the applications installation and capture, so you can start creating the installation folder in the Q:\ drive.

Within this folder, the application will store all the program files and the sequencer will use them to package the application.

Note: You don’t need to place the installer inside this folder.

4. Click on “Begin Monitoring” to start the installation process.

5. The capture process will start by selecting the folder in the Q:\ drive.

6. Once you’ve selected the folder, the virtual environment will start to load, wait for the “Monitoring started. Please begin installation” message appears.

7. Locate the installer and start the installation process.

8. In the installation process, the main step will be in the destination folder option that the program use to place the program files. Select the folder you’ve selected to be monitored. In my case: Q:\Firefox.

9. Once the installation is complete and you verified that the program was installed correctly, get back to the sequencer window and click on “Stop Monitoring” and click on “Next”.

10. In the next window you can add some more files inside the package. This can help you if you are using customized applications, that need to load local files.

In my case I don’t need any.

11. In the next window, the sequencing process detects the applications that compose Mozilla Firefox, in my case the Firefox standard app and the Firefox safe-mode.

You can add new ones, remove the detected and modify the components involved: File type associations and icons.

For every application shown here, we will need to make a small change. Click on each application in the right list, and select the “Edit” option. In the “OSD File Name” you will probably see a long name, like “Mozilla Firefox 1.9.1.3523.osd”.

You need to change this one removing all the spaces in the name, like “Firefox.osd”.

Change this in all applications involved and click on “Next”.

12. The next step is optional, where you can launch the applications for a final check that they are working properly. Click on “Next”.

13. Sequencing process is complete. Click on “Finish”.

14. The package is ready for the final customization regarding the application deployment.

In the App-V Sequencer window, select the “Deployment” tab and change the Protocol option to “RTSP” (this will automatically change the Port to 554), and in the Hostname option select the name of the App-V Server, in my case “appv-server”.

In the Operating System list, you can add all the baselines where this application can become available. And note also the option to generate an MSI package, that you can use it with the App-V Stand Alone mode (explained in Post I of this series) and/or System Center Configuration Manager (SCCM) integration with App-V.

15. Before saving the package, you can explore other options within the Sequencer, like the registry files that are modified by the application.

Once you are done, click on save this package locally.

With the project saved, you can check on the files created and verify that the OSD files were not created with names composed by blank spaces.

Adding the Package to the Server

Now that the package has been sequenced and created, it is time to add it to the server.

1. Copy the files created in the App-V Sequencer to the “content” folder in the App-V Server.

2. In the App-V Server, open the App-V console. Right click in Applications and select “Import Applications”.

3. Select the SPRJ file for the Mozilla Firefox and click “Open”.

4. In the General Information window, accept the default options and click on “Next”.

5. In the “Published Shortcuts” select the shortcuts that the clients will have created.

6. In the “Access Permissions” select the group that will load this application. In my case, I’m using Domain Admins.

7. In the “Summary” window, click on “Finish”.

And now you have the application ready in your App-V Server to be deployed.

Testing the Application

After completing the importing wizard, the application is ready to be deployed in the client machines.

Access the client machine, and if you want to avoid the process of log-off and log-on to test it, locate the App-V Client console (C:\Program Files\Microsoft Application Virtualization Client\SftCMC.msc), select “Publishing Server” and click on “Refresh Server”.

The new icons will appear in the desktop or in the places you’ve selected.

Mozilla Firefox starting

Troubleshooting App-V Published Applications

The most common error about App-V applications I’ve experienced are regarding the firewall exceptions discussed in the Post III of this series. But, there’s also another problem that appears related to the package it self.

If the package that you’ve created, the OSD file name uses spaces between, like “Mozilla Firefox 1.9.1.3523.osd”:

Then most likely when you try to deploy this application, after importing it in the server, you’ll get these errors:

“The package requested could not be found in the system data store or the files associated with this package could not be found on the server”. “Error code: 4513CDC-1690150A-20000194”

To fix this, you’ll need to regenerate the sequenced application as shown above, editing the application information and remove any blank spaces in the OSD file name.

More Resources

• Microsoft Application Virtualization 4.5 Resource Kit Tools
• [Case Study] Sequencing Applications for Deployment at Microsoft
• App-V Sequencing Guide

Other posts in this series:

Implementing App-V – Part I: Introduction to Application Virtualization

Implementing App-V – Part II: Choosing and Preparing the Environment

Implementing App-V – Part III: Integrating Clients

As I mentioned to you before, I presented in the Run Reloaded event that took place here in Buenos Aires in last November. I had the pleasure to give two presentations: Geo Clustering with Windows Server 2008 R2 and Group Policies with Windows 7 and Windows Server 2008 R2.

The event gather some great presentations about several of the new technologies introduced by Microsoft: Windows 7, Windows Server 2008 R2, SQL Server 2008 R2, Exchange Server 2010, Sharepoint 2010, etc.

And the public response was also amazing, thousands of people showed up in this two-day event, that also had several simultaneous conferences given in the Universidad Argentina de la Empresa (UADE).

Multi Site Clustering with Windows Server 2008 R2

I presented this track with Roberto Dilello and we had the chance to revisited a previous track of mine presented in Code Camp 2009.

This time I had the chance to take a deeper review about the multi site clustering architecture, their benefits, requirements and how to configure them in Windows Server 2008 R2 Failover Cluster.

You can download the multi site clustering presentation (Spanish) from here.

Windows 7 and Windows Server 2008 R2 Group Policies

Presented with Leandro Amore, making an overview of the changes made since Windows Vista about the Group Policies management.

Taking a closer look to the ADMX migrator, PowerShell, Starter GPOs, Group Policies preferences, etc.

The group policy presentation can be downloaded from here (Spanish as well).

Cheers!

After presenting at the Code Camp this year, I’ve started to prepare my participation in a new and upcoming event: Run Reloaded – November 24 and 25 – Universidad Argentina de la Empresa (UADE).

This event will officially introduce to the community the brand new Microsoft technologies: Windows 7, Windows Server 2008 R2, SQL Server 2008 R2, Exchange Server 2010, Sharepoint Server 2010, and may others, including devs technologies.

The event is divided in two days, and each day will have the IT and the developers sessions. Here is the schedule and registration links for the IT sessions (Spanish):

Day 1 Registration

Day 2 Registration

More info about Run Reloaded here. 

About my conferences:

- Multi Site Clustering with Windows Server 2008 R2: Taking a little bit deeper about my previous presentation, checking the benefits of geo clusters and what are the necessary requirements. I’ll be presenting it with Roberto Dilello.

- Group Policies with Windows 7 and Windows Server 2008 R2: Reviewing the improvements and features that we can adopt using group policies with the just released operating systems: Windows 7 and Windows Server 2008 R2. I’ll be together with Leandro Amore.

See each other then!

A while ago I had the chance to review GFI Webmonitor, an ISA Server add-on that enhances significantly the possibilities for web access and download control. Now, GFI introduces a great and brand new option within web monitor possibilities: GFI WebMonitor version that does not require an ISA Server installation.

You can download the free 30-day trial here. And even more, once the trial expires, the software switches to freeware mode; where you maintain the monitor features but the security and access control are removed.

Differences with the ISA Server add-on version? None

The first thing I’ve started to wonder about this product is: It doesn’t require ISA Server, so which capabilities and features will be lost? Well I had a great surprise there, not only maintains all the features, but also there a few new ones.

GFI WebMonitor dashboard, same as the ISA add-on version

Reviewing New GFI WebMonitor

As you can see, the dashboard looks the same, but let’s take a closer look about the tool and find out a little bit more.

Installation Process

Same, again. As we’ve seen it in my previous post, the installation is a very simple and intuitive process; the same one is included here. In my environment I’ve installed GFI WebMonitor on a Windows Server 2008, working just as a member server in my lab environment.

At the end of the installation, you’ll get all the necessary hints to start working with GFI WebMonitor.

Based on my configuration, the simple proxy mode is selected

The last message: All that you actually need to configure your clients

Configuring Clients

With the last image, you’ve already had all the necessary information to configure your clients. Just configure your browser proxy server options.

Internet Explorer Proxy Server options

Remember that you can automatically configure these options using Group Policies in your domain. User Configuration > Windows Settings > Internet Explorer Maintenance > Connection > Proxy Settings

Group Policies: Proxy Server option for IE

Configuring the Server

Before start testing your clients with the proxy options, you should verify that the machine working as a proxy has the 8080 port open to receive connection from the clients.

Just add an exception in your firewall to allow traffic

You can also configure in your GFI WebMonitor a few more options related to the proxy settings: Authentications and chained options.

You can use anonymous, basic and integrated authentication for proxy clients

Chained Proxy: When you have a separate proxy or firewall in your network.

The rest of the configurations within GFI WebMonitor, you’ll find the exact same as my previous review:

- Statistics: Nice data parsing showing bandwidth consumption, sites history, users history. One of my favorites within this stats is the “top policy breakers”: users that more times have tried to access content prohibited by your policies.

- White and Black lists. The name isn’t that simple as the configuration needed to block websites and content.

Blacklisting facebook.com

And the clients will receive a message like this:

- Web Filtering Policies: All the policies defined here will allow you to manage access to certain sites and even pre defined categories to specific users, groups or even IP address. Including the time window in which each policy will apply. Pretty simple to configure and set.

- Security: This section represents one of the most powerful within this tool, you get the chance to configure Download Control Policies (which users can download what and when); IM Control Policies (allowing or blocking IM); and my favorite Virus Scanning.

All the content that is downloaded from the clients will be scanned with three different antivirus engines: BitDefender, Kaspersky and Norman antivirus; all of them with databases updated constantly.

Every time a user downloads a file, by default, the window that will appear:

And virus scanning, of course

And GFI WebMonitor also gives you the “Quarantine” section to analyze blocked downloaded content.

One of the new features introduced is the “Hidden Downloads” section. That show downloads which were unattended by users that could reveal malware or unwanted applications within the network.

More Resources and Troubleshooting

Installation and Configuration

- How can I exclude some websites from passing through the GFI WebMonitor proxy?

Troubleshooting

- Mozilla Firefox keeps asking for credentials repeatedly
- Integrated authentication fails with GFI WebMonitor 2009 Standalone Proxy
- Internet Explorer is unable to retrieve my new wpad.dat configuration

Conclusions

- This tool represents a great way to easily use and configure a proxy server in your network in just a few seconds. From the installation process to the web filtering policies, all of them represent very intuitive and simple processes; you don’t need expert knowledge in firewall or proxy servers.

- Removing the ISA Server requirement, you almost have no excuse to give it a try if you are concerned with your current bandwidth consumption and access control.

- The security section gives you a nice bonus and avoiding having viruses or malware within your network. You know the feeling, having just one negligent user can become in several work hours for your help desk department.

If you are considering implementing new security policies in your company, you should know that what people usually access every day on the web it is a significant matter.

Cheers!

Other posts in this series:

Implementing App-V – Part I: Introduction to Application Virtualization

Implementing App-V – Part II: Choosing and Preparing the Environment

Implementing App-V – Part IV: Sequencing Applications

We’ve already talked about Application Virtualization and some common scenarios (Post I), talked about the existing models in App-V and how to install the App-V Management Server (Post II); now it’s time to work with the App-V clients.

I was considering to not include this post and go directly to sequencing applications, but most of the errors and blocking issues that appear in App-V are related on not having a environment properly installed.

The process will start with the App-V Desktop Client installation.

App-V Desktop Client Installation

Select a client machine that will receive some of the sequenced applications and you shouldn’t have any problem with this installation, pretty straight forward:

1. Double click on the installer and most likely you will be needing to install a few components before starting.

2. The wizard starts and click on “Next”.

3. Accept the License Agreement.

4. Select your option for Microsoft Update.

5. Select “Custom” installation option.

6. Accept the default installation path.

7. Data Location, the default preferred drive letter by convenience is used the letter “Q” (avoiding to collide with possible network drives).

8. Then you can select the cache size that the client machine will use. Every time that the client downloads applications, it will use the local cache for every time the application needs to be loaded again in the session. You can use the default option provided.

9. On Runtime Package Policy Configuration use the default options adding the “On Publishing Refresh” option inside “Automatically Load Application”.

10. On "Publishing Server” complete the options used for your App-V Server. And since I won’t be using SSL for the communication, I’m selecting the type “Application Virtualization Server” and “Port” 554.

11. Click on “Install” and we are ready to go.

Testing the Default Application

As we’ve seen it before, once you install the App-V Management Server a default application is installed.

We are going to use it to validate that our environment is ready to go and start sequencing applications. Unfortunately you will need a few steps before publishing the application:

1. First of all, re check the configurations mentioned in Post I of this series:

- Ensure that the Application Management Server service has started.

- The content folder (C:\Program Files\Microsoft System Center App Virt Management Server\App Virt Management Server\content\) must be shared with proper permissions: “Everyone” the “Read & Execute”, “List folder contents” and “Read” access.

- If you have the firewall enabled, ensure that you enable the exceptions for inbound connections with the programs sghwdsptr.exe and sghwsvr.exe. Both located in “C:\Program Files\Microsoft System Center App Virt Management Server\App Virt Management Server\bin\”.

To make a first quick check about the connectivity, you should always start using “telnet appv-server 554” to ensure that the ports are open between the hosts.

What Happens If I Don’t Complete The Requirements?

If any of those are not in place, the error code that you should be receiving when you try to access an application is: “The Application Virtualization Client could not establish a connection to the Application Virtualization Server” “Error code: 4513CDC-19D06A0A-10000004”.

And in the Event Viewer you’ll see a bunch of warning messages and one error: “The Application Virtualization Client could not connect to stream URL ‘RTSP://appv-sequencer:554/application‘” along with the same error code.

2. With all that in place, time to get the application ready. Access the App-V Management console, open the Default Application Properties. In the General tab, the OSD and Icon path must be using a UNC path, like in my case: “\\appv-server\content\”.

3. Shortcuts tab will let you decide where you want to insert the client’s shortcuts.

4. Access Permissions: Here you can select all the domain groups that will have access to this application.

5. Edit the DefaultApp.osd file that is stored within the content folder mentioned. Look for the “Implementation” area and replace the name of the server using the current name of the actual server.

6. Login to the client machine using credentials that belong to the group you just gave access to the application. You will see the Default Applications shortcuts already in place, double click the shortcut.

And there you have it, your environment is ready to receive and launch applications.

Note:

Remember that by default, the applications are refreshed once the user logins to the client computer.

If you want to avoid this process, in the client computer access “C:\Program Files\Microsoft Application Virtualization Client” folder and double click “SftCMC.msc”. Inside “Publishing Servers” right-click the name of the server and select “Refresh Server”.

With that, any update on the applications published should be shown in the client.

In a few days more, I’m publishing the fourth part of the series: sequencing applications.

Other posts in this series:

Implementing App-V – Part I: Introduction to Application Virtualization

Implementing App-V – Part II: Choosing and Preparing the Environment

Implementing App-V – Part IV: Sequencing Applications

Microsoft Press introduced a great technique to get more readers: Giving away free books, as simple as that. And this time with a great proposal: Introducing Windows Server 2008 R2.

Even though it is a short book (200 pages) you’ll see that there are several topics that you might be interested in. Here are the chapters involved:

• Chapter 1    What’s New in Windows Server R2
• Chapter 2    Installation and Configuration: Adding R2 to Your World
• Chapter 3    Hyper-V: Scaling and Migrating Virtual Machines
• Chapter 4    Remote Desktop Services and VDI: Centralizing Desktop and Application Management
• Chapter 5    Active Directory: Improving and Automating Identity and Access   
  Chapter 6    The File Services Role
• Chapter 7    IIS 7.5: Improving the Web Application Platform
• Chapter 8    DirectAccess and Network Policy Server
• Chapter 9    Other Features and Enhancements

You will find several information about important improvements introduced in this version, like: Hyper-V R2 (Live Migration and storage hot add feature); VDI; IIS 7.5; BranchCache and DirectAccess.

Enjoy!

Again, another excellent Microsoft event took place last month: Code Camp 2009. And I had the great pleasure to participate with two conferences, Hyper-V and Windows Server 2008 R2 Clustering.

Code Camp Buenos Aires series officially began in 2007 and appeared as a great opportunity for students and academic cells interact directly with the community, not only participating in conferences but also preparing small demos and telling their story about their work with Microsoft’s technologies.

I had the chance to participate in all of them, but this year’s Code Camp represented the biggest event of the series, with over 50 conferences regarding IT, developing, gaming, methodologies. Here’s a quick review of my participation:

Hyper-V Para Suegras

Translated in “Hyper-V for Mother-In-Laws” (don’t ask me, ask Alejandro Ponicke, he came up with the title). I presented this one with a good friend of mine, Alberto “Beto” Ortega.

The main idea resided in present an introduction to virtualization and Hyper-V with the main features included in Windows Server 2008 R2. Using also a small review of Hyper-V clustering and Live Migration.

The presentation for Hyper-V (in Spanish) can be download it from here.

Desmitificando Clustering en Windows Server 2008 R2

Translated in “Demystifying Clustering in Windows Server 2008 R2”. Here, I had the chance to go a little further about Hyper-V clustering and presented the main idea and benefits of clustering with Windows Server 2008 R2.

We’ve made a small review about the process in Windows Server 2003 and the process using Windows Server 2008 R2, features included like cluster validation, Clustered Shared Volume (CSV), Geo Clusters, clustering myths and best practices. And also we’ve discussed about clustering with SQL Server, using a demo of a SQL Server 2008 R2 (CTP August) cluster.

The presentation for clustering (Spanish also) can be download it from here.

As always, I had a lot of fun and I’m looking forward for the next event: Windows 7 and Windows Server 2008 R2 Official Launch (late November). We’ll see each other then!

Here’s some of the crew involved: Miguel Saez and Alejandro Ponicke

Cheers!

Fresh and free new book available from Microsoft Press and Microsoft TechNet! Deploying Windows 7: Essential Guidance.

This book contains ten chapters from Windows 7 Resource Kit, so if you ever read one of these Resource Kits, you would know that the content it is very complete and interesting. Some of the topics discussed in this free book:

• Planning Deployment
• Testing Application Compatibility
• Developing Disk Images
• Migrating User State Data
• Deploying Applications
• Volume Activation
• Using Windows Deployment Services (WDS)
• Using Microsoft Deployment Toolkit (MDT)

I know, I know, I was missing the free e-books offers from Microsoft too.

Here’s a little bonus: Microsoft also published as a free download the Chapter 23 of the Windows 7 Resource Kit, “Supporting Users Using Remote Assistance”.

To review some of my posts about deploying Windows 7, check this category:

http://blog.augustoalvarez.com.ar/category/microsoft-deployment-toolkit-mdt/

Cheers!

The arrival of Windows Server 2008 R2 and Windows 7 is just around the corner and I don’t have to tell you that there are a lot of expectations. Common users are concentrating almost all the attention with the client operating system, but I can assure you that having those new platforms, Windows Server 2008 R2 and Windows 7, will give a new perspective for all users and IT guys.

One of the highlights that you can watch having this two boys together is BranchCache, focused mainly in optimizing your WAN bandwidth using special cache options.

As the name says it, BranchCache works in scenarios with branch offices where clients interact and request files from the headquarters. A common and current scenario is related when you access an internal website with the servers located in the main office, each branch office client will request the files directly with the headquarters every time a user intends to communicate with the site, significantly affecting the WAN link with the same data transmitted over and over.

BranchCache is a simple idea that caches every content downloaded from the main office using a server or other branch clients, so every time that a second client tries to download the content, the request is directly handled within the branch office optimizing the WAN link and downloading time.

How Does It Work?

There are no complex configurations and you can even use an option that does not include a server. There are two types of BranchCache deployment options: Distributed Cache (no server) and Hosted Cache Mode (Windows Server 2008 R2 server involved as the cache server).

Keep in mind that the environment will only work with Windows Server 2008 R2 and Windows 7 clients.

Distributed Cache

Windows 7 branch office clients store a copy of the content that is downloaded from the main office, and makes it available to other clients in the branch office every time that they try to retrieve those files.

Hosted Cache

Within this scenario, all the cache content is stored and controlled in a Windows Server 2008 R2 that retrieves all the requests made from branch clients and keeps all the data locally to answer any other requests for the same content.

Microsoft recommends to use this mode on branch offices with over 10 clients.

What About Cache Authorization and Updates?

These are common questions that you may be asking yourself right now:

Q: If the files are stored in a local cache within the branch office (distributed among clients or on a server), that means that all branch users will have access to these files?

A: No. There is an authorization phase that the requestor must complete before receiving the file. In a distributed BranchCache mode, when the client requests the data, the server (main office) authorizes, or not, the cache content to be delivered to the branch office client. In a Hosted Cache mode, the cache server keeps identifiers with the permissions for each cached content, giving access only to authorized clients.

Q: What about if the file changes when it was already cached by clients or a server? The file is distributed out-to-date to branch clients?

A: No. Whenever a change is made on a folder that is distributed with BranchCache, a new identifier (the same used for access authorization) it’s send to branch cache clients (if the mode is set as Distributed Cache); or send it directly to the cache server (if the mode is configured as Hosted Cache).

Configuring BranchCache

In this section I’ll give you small step-by-step BranchCache procedure. There are basically three steps to complete the environment:

1. Configure the headquarters Windows Server 2008 R2 that contains the data that must be cached.

2. Configure the Windows 7 branch clients that will use the cached content.

3. Configure the Windows Server 2008 R2 as Hosted Cache server, if that’s the option you selected for your environment.

The complete reference to achieve this deployment can be found in BranchCache Early Adopter’s Guide.

1. Configuring the File/Web Server

a. Add the feature from Server Manager: BranchCache.

Remember, it’s a feature not a role.

b. If this is going to be a file server, you must add the “File Services” role and the service “BranchCache for remote files”.

c. Configure the Group Policy to enable BranchCache.

Active Directory it is not a requirement for BranchCache, but surely it is recommended for centralized management. You can use an Active Directory or local policy to apply to this server.

The GPO can be located in Computer Configuration > Policies > Administrative Templates > Network > Lanman Server > Hash Publication for BrandCache

The options when you Enable this GPO are self explained: For all shares, files shares tagged and disallow hash publications.

2. Client Configuration

Ok, now you have the server configured to be able to distribute the BranchCache shares. Now it’s time to configure the clients to understand this type of cache. It is easily done with Group Policies, and again, this can be done in a domain environment by linking GPOs or just using Local Group Policies.

a. Access GPOs editing MMC: Computer Configuration > Policies > Administrative Templates > Network > Turn on BranchCache > Enabled.

b. On the same GPO list, you’ll find the rest of the necessary configurations according to the chosen model.

If you are using Distributed Cache, enable “Turn on BranchCache – Distributed Caching Mode”. And the same for hosted cache, “Turn on BranchCache – Hosted Cache mode”.

c. [optional] You can also set other interesting values using this set of GPOs, like latency values or setting a percentage of your disk space dedicated to this cache.

d. Ensure that you have configured the firewall inbound policies to allow BranchCache connections. More info about this on the document mentioned above: BranchCache Early Adopter’s Guide.

3. Configure the Cache Server

For obvious reasons, the communication between the parties involved must be secured and the data available must be guaranteed as updated and correct. That’s why if you are using Hosted Cache Mode, a certificate will be present to achieve a SSL communication and guarantee that data is not modified by an attacker.

It is important to note that the presence of a Certificate Authority (CA) server it is not a requirement, the certificate can be prepared directly from the file/web server and then imported to the Hosted Cache server.

a. First, enable the BranchCache feature from Server Manager.

b. Deploy the certificate inside Certificates (Local Computer) > Personal.

c. Access the certificate properties, the details page will show you the “Thumbprint” field. Copy to the clipboard.

d. Link the certificate to BranchCache with “netsh”:

NETSH HTTP ADD SSLCERT IPPORT=0.0.0.0:443 CERTHASH=<thumbprint> APPID={d673f5ee-a714-454d-8de2-492e4c1bd8f8}

More Resources

Here are some other guides and interesting links you can find about this feature.

• BranchCache Early Adopter’s Guide
• BranchCache Home
• [Screencast] BranchCache in Windows 7
• Windows 7 Features: BranchCache

That’s pretty much in this BranchCache overview and kind of walkthrough.

Cheers!

Other posts in this series:

Implementing App-V – Part I: Introduction to Application Virtualization

Implementing App-V – Part III: Integrating Clients

Implementing App-V – Part IV: Sequencing Applications

After the first post about App-V and application virtualization technologies we had a nice review about the platform. So, if you feel like this type of technology can add some value to your organization, let’s start playing around.

Before you begin, let’s talk about the available models in App-V that will help you choose the strategy according to your platform. The architecture is prepared to support almost any scenario, including low-bandwidth branches offices or even offline deployments.

App-V Models

Stand-Alone Mode

This is the minimalist mode of App-V with no infrastructure required but the machine that packages the application, “sequencer” from now on, and the App-V Desktop Client.

Sequencing the application adds all the necessary files into one package and generates an MSI file that you can use to deploy manually, by group policy or using SMS/System Center Configuration Manager.

This mode is focused when you have several offline users (do they even exist at this point?), or when you have already SCCM deployed and you don’t want to add a App-V Server.

Streaming Mode

This model it is also focused on platforms that do not want Management Servers. The components present here are the streaming server, sequencer to package applications and the App-V client.

The Streaming Server as the name says it, streams the applications to the clients on demand. The server does not use a SQL database, the permissions are set and maintain based on ACLs (access control lists).

You can use it on low-bandwidth links like branch offices to optimize the application deployment.

Full Infrastructure Model

The full model contains the full set of components in App-V: Management Server, Sequencer, Streaming server and App-V Client. In most cases, the streaming server it is completely optional since the application streaming can be executed from the Management Server, delivering applications on demand to users.

Using a Management Server will add the applications shortcuts publication within the process of deployment. And includes more features for reporting, using a SQL database.

Applications in this model are associated to security groups in Active Directory. And you can also manage centrally the applications licenses.

We are going to focus this set of posts in a Full Infrastructure Model, using a Management Server, Sequencer and a App-V Desktop Client.

Enough with the explanations, let’s get to work.

Installing App-V Management Server

The process it is a little tricky, but we’ll try to set clear all the necessary requirements before running the installation wizard.

Pre-Requisites

This is the list of minimum requirements:

• Windows Server 2003 SP1 or superior
• IIS 6 role installed with ASP.Net
• .Net Framework 2.0
• MMC 3.0
• SQL Server 2005 Express SP2

Before proceeding with the installation take a closer look to what are the SQL and IIS configurations necessary that we are going to review next.

Here’s the environment that I’ll be using:

• Active Directory and DNS platform in place.
• Windows Server 2008 (32-bit)
• IIS 7 role installed with ASP.Net
• SQL Server 2005 Express SP2.

SQL Special Considerations

The SQL Express can be installed with the default options, but, as I mentioned it before, there are a few SQL configurations that needed to be set before the App-V installation process:

1. Open SQL Server Surface Area Configuration Tool from the SQL Server Start Menu folder.

2. Click on Surface Area Configuration for Features.

3. Inside of “CLR Integration”, click the option for “Enable CLR Integration”.

4. Inside of “OLE Automation” click “Enable OLE Automation”.

5. Close “Surface Area Configuration for Features”.

6. Click “Surface Area Configuration for Services and Connections”.

7. Inside “Remote Connections” select “Local and Remote Connections” and set “Using both TCP/IP and named pipes”.

8. Restart the SQL Server services to apply all changes.

IIS Considerations

Since I’m using Windows Server 2008 and IIS 7 for the Management Server installation, there are a few considerations about it.

• Install ASP.Net feature with all pre-requisites.
• Windows Authentication feature enabled.
• IIS 7 Management Tools with Management Service and IIS 6 Management Compatibility features installed.

Step-by-Step App-V Management Server Installation

One completed the pre-requisites and considerations, let’s start with the installation.

1. With the App-V installation media, double click the setup executable.

2. Welcome page, click on “Next”.

3. Accept the License Agreement and click on “Next”.

4. Select “Custom” setup type.

5. Here you can modify installation components (not recommended) or change the installation directory. Click on “Next”.

6. Select the SQL Server instance where the database will be stored. In my case, I’m using the same server with one instance. Click on “Next”.

7. Select “Create a new database”. Maintain the suggested database name “APPVIRT”. You can also modify the location for the database files. Recommended for this type of server to store the database on a different hard drive than the operating system.

8. Leave deselected the option for “Use enhanced security”. You can set secure connections with this server, that will require of course for a certificate. Out of the scope in our case.

9. Leave the default value for the RTSP (Real Time Streaming Protocol): 554.

10. Select the group that will have full access to the App-V Management Server console. In my case, I’m selecting only “Domain Admins” to give access. This option can be modify later.

11. Select the provider group, that by default will have access to the enabled applications. In my case, I will select only “Domain Admins” and later personalize each application for each group.

12. Select the folder where the applications packages will be stored. Leave the default “C:\Program Files\Microsoft System Center App Virt Management Server\App Virt Management Server\content\”. Click on “Next”

13. On the “Ready to Install the Program” window click on “Install”.

After a few moments you will have the App-V Management Server fully installed.

14. Recommended: Reboot the server.

IMPORTANT: If any of the pre-requisites and considerations mentioned above are not completed, you will receive a message like this when you start the installation:

“Error 25109. The installation program could not create the configuration data store. Please see the installation log file for more information”

Post-Installation Procedures

There are basically three more tasks to execute after the App-V Management Server installation is completed to guarantee the proper functionality:

1. Once the server is rebooted, you will need to verify the “Application Virtualization Management Server” service. If you are running on a virtualized environment, you will need to manually start the service.

2. Share the “content” folder created for the applications packages (by default C:\Program Files\Microsoft System Center App Virt Management Server\App Virt Management Server\content\). Give to “Everyone” the “Read & Execute”, “List folder contents” and “Read” access.

3. If you have the firewall enabled, ensure that you enable the exceptions for inbound connections with the programs sghwdsptr.exe and sghwsvr.exe. Both located in “C:\Program Files\Microsoft System Center App Virt Management Server\App Virt Management Server\bin\”.

Note: If these firewall exceptions are not in place, you will also have problems with App-V clients trying to receive and execute the application packages. We’ll check that later.

And yes, you can now open the “Application Virtualization Management Console” and start working with the platform.

Make sure that you deselect the “Use Secure Connection” if you didn’t install a certificate for App-V.

Other Resources

As an interesting option to evaluate your App-V Management Server environment is the Microsoft Application Virtualization Best Practices Analyzer.

It verifies general configurations in your Management and/or Streaming Server 4.5, and notify about possible anomalies as a diagnostic tool. Requires the presence of Microsoft Baseline Configuration Analyzer to generate the reports.

In this example, the warning generated is about the database been stored in the same place as the Management Server.

I’ll be reviewing in the next posts how to prepare clients and applications to be deployed by App-V. I’ll be using Microsoft Office 2007 as the sequenced application.

Other posts in this series:

Implementing App-V – Part I: Introduction to Application Virtualization

Implementing App-V – Part III: Integrating Clients

Implementing App-V – Part IV: Sequencing Applications

Cheers!

Continuing with their 25th Anniversary Microsoft Press prepared for us their final release for free E-Books (yes, these two and you won’t be getting this exciting offers anymore):

“Office Communications Server 2007 R2: Resource Kit”

If you are not very familiar with the communications suite, here’s a short topic review that is included in almost 900 pages:

• Overview and server roles
• Key deployment scenarios: VoIP, basic IM, conferencing, voice mail, etc.
• Planning and Deployment
• General administration and monitoring
• Backup and restore
• Troubleshooting.

And as for previous released, the offer also includes the developers e-book:

“Programming for Unified Communications with Microsoft Office Communications Server 2007 R2”

Remember that these downloads are available for a short period of time.

Enjoy!

Microsoft finally released Windows Vista and Windows Server 2008 SP2. The last SP for Vista was released 14 months ago and 800 bugs away. Windows Server 2008 SP1? Was already included in the final version of the operating system.

Download Links

Yes, Vista and Windows Server 2008 SP2 it is included as the same update.

Windows Server 2008 Service Pack 2 and Windows Vista Service Pack 2 – x86

Windows Server 2008 Service Pack 2 and Windows Vista Service Pack 2 – x64

This update will appear in Windows Update starting June 30. And if you are asking about getting the media installation for Vista or Windows Server 2008 with the SP2 slipstreamed, you will need an MSDN or TechNet Subscription.

Improvements and Changes Applied

Applications compatibility

• Solved several issues presented on common applications like ZoneAlarm or Spysweeper.

Hardware

• Support for 64-bit CPU from VIA Technologies.
• Solving performance issues with wireless connections after sleep mode.
• Ability to record Blu-Ray media.
• Bluetooth 2.1

Operating System Experience

• Windows Search 4.0 included
• SP2 has no limit on the number of half open outbound TCP connections.

Enterprise Improvements

• WebDav redirector options increased.
• Improved Power Management. Including Group Policy settings.
• Terminal Services license keys improved backward compatibility.

To check the full list of improvements, check this link.

As an important notes:

1. If you have installed a previous beta for this SP2 or the RC, you will need to remove to install the final version.
2. The SP2 it is not a cumulative update. So having the SP1 installed it is a requirement.

Cheers!

Other posts in this series:

Implementing App-V – Part II: Choosing and Preparing the Environment

Implementing App-V – Part III: Integrating Clients

Implementing App-V – Part IV: Sequencing Applications

Virtualizing applications it is not a very common requirement for most administrators or companies. These solutions doesn’t seem like a “must” in any given environment, but why? One of the main reasons it’s related to the benefit/cost equation it’s not quite clear for most of us.

With these posts I’ll try to give a small introduction to the technology, explain the environment, provide a step-by-step deployment for App-V and the benefits that could apply to your organization.

What is Application Virtualization?

Application virtualization represents the technologies that permits to remove the complexity of deploying and maintaining applications for desktop users by providing:

• Applications centralized management. Facilitates the process of deploying, updating and removing applications. 
• Removing potential conflicts on desktop clients. Each application deployed using this type of technology runs in a isolated environment.
• Capability to capture a set of interconnected applications into a single package to be distributed among clients.

Common Scenarios

Let me give you a few common scenarios where application virtualization applies:

Scenario A

Problem: You are using a company’s application that requires some special configurations every time that is deployed, and that is also interconnected with other applications (for example: A local database engine, Java Runtime Environment or some other particular requirement). It demands you several hours every week to support end-users for deploying or troubleshooting configurations.

Solution: Providing application virtualization you can guarantee end-users to always have the same configuration deployed, no matter when or where; since you only need to configure it once and then wrap up the entire set of applications into one package.

Scenario B

Problem: You have a dynamic base operating system image that changes constantly, there are several type of base images according to the users, and you not have deployed Microsoft Deployment Toolkit (MDT) combined with System Center Configuration Manager (SCCM) to maintain images. You have two options: Manually and locally change the desktop image on every client by installing or removing applications; or providing end-users with local administrator privileges to achieve some kind of auto-management (don’t get me started on that).

Solution: Implement application virtualization with a clean base image will help you to minimize the impact every time there’s a change. With a centralized management of the applications you can make all the necessary changes and implement those instantly. Adding also granularity on the type of images, special applications can only be distributed to selected group of users.

Did you read the scenario problems and feel like “been there, done that”? Then you definitely should continue reading these posts.

Existing Platforms

There are several platforms provided to achieve application virtualization, the most common are:

• Microsoft Application Virtualization (App-V). Formerly known as SoftGrid.
• VMWare ThinApp.
• Citrix XenApp.
• Symantec Software Virtualization Solutions (SVS).

To name a few differences among them:

• ThinApp is the only one that supports 64 bits OS deployments.
• App-V, SVS and XenApp use a set of kernel mode drivers and supporting services to manage virtualization process. ThinApp includes the entire virtual environment directly into the application package.

This set of posts will be focused on reviewing the components and process within an App-V environment. As well as providing an step by step deployment.

App-V Components

App-V is the solution provided by Microsoft to achieve a secure, scalable and high performing applications deployment. Here’s a quick review about which components are involved.

App-V Management Server

In charge of delivering sequenced applications on-demand to selected clients. Any Management Server needs a SQL data store (multiple Management Servers can access the same data store) where it retrieves information like application assignments, records and permissions within the App-V management environment.

App-V Management System

Composed by the App-V Management Console and the App-V Management Service. It represents the communication channel between the MMC and the SQL data store, controlling any read/write requests to the database. It can be installed together with the Management Server or in a separate computer with IIS.

App-V Sequencer

In charge of producing the application package. It is basically a tool installed on a computer (preferred using the same OS as App-V clients) that captures the installation of the applications to generate the package, that consists in several files: Open Software Description (.osd file that links other files); sequenced application file (.sft file); icon files (.ico); XML manifest and a project file (.sprj). Optionally an MSI file can be included for offline deployments, but we’ll see how to do that later.

App-V Streaming Server

This server will have a the role of streaming applications to the clients where these do not have an acceptable connection to the Management Server, like a branch office. Streaming applications is the only functionality enabled for this server, and it represents, on most cases, as an optional role to be installed.

App-V Client

Installed on the end-user operating system, interacts with the App-V Server. Manages package streaming into cache and publishing refresh. Stores user-specific information related to the virtual applications in each user profile, so every time the client reboots the machine, the virtualized applications conserves last changes made. This client it is also represented with “Terminal Services” version, the only obvious reason is that the applications are published using Terminal Services virtual desktop.

Here’s a graphical description of the entire App-V environment

Resources

Here are some of the recommended resources you can find about the technology

• Application Virtualization 4.5 Documentation
• Microsoft Desktop Optimization Pack Home Page
• Microsoft Application Virtualization 4.5 Resource Kit Tools
• App-V Team Blog
• Planning and Deployment Guide for the Application Virtualization System

On the next posts I’ll use more practical examples and show you how to deploy an entire environment for virtualizing application. Stay tuned.

Other posts in this series:

Implementing App-V – Part II: Choosing and Preparing the Environment

Implementing App-V – Part III: Integrating Clients

Implementing App-V – Part IV: Sequencing Applications

Cheers!

Disclaimer: Remember that these books are available as a free download for a limited period of time. 

Microsoft Press released two new e-books to continue celebrating their 25th anniversary:

Windows Server 2008 Terminal Services Resource Kit

On this book you’ll find detailed information about what’s new in Windows Server 2008 regarding Terminal Services and common scenarios to use a Terminal Services ecosystem.

As an always requested topic regarding to Terminal Services, you’ll see how the applications publications works within these environments, using Terminal Services RemoteApps (TS RemoteApps).

Some of the topics:

• Planning and installing Terminal Server environment.
• Creating and maintaining user work environment.
• Installing and Publishing Applications.
• Terminal Services ecosystem management.

Also, on the devs side again, you can find this another “best practices” book:

“The Practical Guide to Defect Prevention”. Techniques to meet the demand for more reliable software.

Enjoy and don’t forget to share the links.

Cheers!

For those that never heard about GFI WebMonitor; it’s an ISA Server (2004 or 2006) “add-on” that helps you monitor in real time the network traffic inside your organization, it also complements with ISA Server giving you the chance to directly configure white/black lists, set some access rules to the internet and scan all the traffic for virus and malware.

In this post I’ll try to review the functionality, pros and cons, as well as the process of installing and configuring.

GFI WebMonitor 2009 Requirements

I’m evaluating the GFI UnifiedProtection Edition (that combines WebFilter and WebSecurity) in one package.

Hardware

• Processor: 1.8ghz
• Memory: 2GB RAM
• Hard Disk: 10/15 GB free

Operating System and Software

• Windows Server 2000 SP4 / Windows Server 2003
• ISA Server 2004 SP3 / ISA Server 2006
• Internet Explorer 6 or later
• .Net Framework 2.0

GFI WebMonitor Installation

You can download the trial version for GFI WebMonitor from this link.

The installation process it’s simple, you shouldn’t have any problem with this.

Access Permissions. Here you can set from which of the IP address the GFI web configuration will be accessible. Take note that you can specify the users that can access it.

Mail Settings. Configure it to receive mail notifications about when, for example, a user is trying to infringe a configured policy in WebMonitor.

Testing mail notifications.

Once the installation is complete, two new access rules are configured in your ISA Server Firewall Policy: One to allow access to the WebMonitor tool from a browser, and the other for updates.

GFI WebMonitor Dashboard

You can access the main window from the Program Menu of from your web browser.

Always having a dashboard it’s a good idea, specially with this kind of tool. Making a quick look here you’ll get most of the necessary information that WebMonitor provides: Bandwidth consumed, active connections, blocked content, etc.

Including also a graphical presentation of the data, that, of course, helps you a lot to discover any anomaly.

Monitoring

Within this section you’ll find all of data parsed and sorted in a very user-friendly way. They are pretty much self-explained.

All of this information is sorted also from a calendar, so if you want to take a look from previous dates, just use the “<” “>” buttons from upper right corner.

Active and Past Connections.

Bandwidth Consumption and Distribution.

Top Policy Breakers. Users marked that tried to access or download blocked content. In my case, only IPs are showing but remember this tool is highly integrated with ISA Client and ISA Server authentication that associates traffic with specific users.

If that’s not enough for you, check the charts options for specific URLs:

White/Black Lists

By default, there are a few sites configured already in the white list.

As an interesting option, you also have a “temporary white list” to allow specific sites for a few hours.

When a black listed site is trying to be browsed, the client will receive this message.

Web Filtering Policies

Here you can create rules and policies for your network traffic. You have a “Default Web Filtering Policy” that allows all contents from all categories; you can modify this one or create a new one for a specific user or IP.

Creating a new policy it’s quite simple and intuitive.

Policy name and schedule.

Categories to be blocked and allowed by the policy.

Applies to (users, groups or IPs).

Notification options when a user intents to access blocked content.

To define a website category a query is run to the WebGrade Database, that also receives updates periodically.

You can also run queries manually to the database and find out the category for a specific site.

Web Security Policies

These policies have the same functionality that the filtering policies, but are defined for file downloads, IM access and virus scanning.

Download Policies

By default, all content is allowed for download.

As an alternative policy to blocked downloads is the “quarantine” option.

IM Control Policies

This an option that is constantly asked and requested by ISA Server administrators, how to block IM on their networks.

Unfortunately, using this tool, you can only block MSN and Live Messenger traffic using HTTP connections.

Virus Scanning Policies

By default any suspicious download will be scanned by three different antivirus engines: BitDefender, Kaspersky and Norman; that, of course are updated constantly.

The default files that are scanned: Microsoft Office documents, PDFs, ZIP and RAR, executables and MSI.

Whenever any of these files are downloaded, the client will open the GFI WebMonitor Secure Download window that validates the file it’s not infected. 

Download and virus scan completed.

Conclusions

Pros

• It is one of the best monitoring tools for bandwidth consumption available in the market. With a nice data parsing as well.
• It represents a great complement for ISA Server access and deny rules.
• Rules and policies are very easy to add and configure.
• Minimum overhead in network connectivity.
• Antivirus Integration: This is probably my favorite feature. Has almost the same functionality than an corporative antivirus solution that controls any suspicious packet in the network.

Cons

• Hardware requirements. It is not recommendable to use GFI WebMonitor on a machine with less than 2gb of RAM.
• Even though the data parsing is great, there’s no easy way to export those reports to a document or even a CSV file.
• There are no options available for export/import WebMonitor configurations. It is not possible to replicate the same configuration on another server or make a backup in a simple way.

If you are an IT Administrator that continuously perceive that your network is slow or it does not has the performance that it should, this tool can give you a lot of help. As a bonus, it will simplify configuring access rules and provide you with an excellent protection with 3 antivirus engines scanning packets.

But if you are using a small resources machine as your gateway, don’t bother installing it, it would give you a lot more problems than solutions.

Hope that you find this useful,

Cheers!

No news to you if I tell you that Windows 7 RC has just become available for download to the public (starting May 5th, you can download it from here).

So if you had the chance to read my previous review about Windows 7, you would now that having this operating system installed all this time has been a real good experience to me and my Lenovo ThinkPad W500. This time I want to share with you the experience of installing this release candidate on my laptop.

So, what’s new on the RC?

You are probably wondering what changes have been introduced in this version compared to the previous beta. I won’t lie, nothing much.

Did you hear the rumor that said that the RC was going to introduce a significant change in the UI? Didn’t happen.

Windows Media Player: Media Streaming. You can now stream music or video using the internet. Sharing the media with other friends and using Windows Live ID. That’s actually quite nice and using a smart technology adapting the streaming to your connection.

More icons on Taskbar: You can now place around 30% more icons on taskbar (depending on your resolution).

IE8. You can uninstall IE8 from Windows Features.

Windows XP Mode (Beta) was also introduced as a feature to download for Windows 7 RC. It is an interesting move to achieve the always controversial application compatibility and motivate people to an early adoption to Windows 7. Basically the feature it’s a Windows XP SP3 virtual machine, for Virtual PC of course, that works together with the operating system and application virtualization. You can download the beta from here.

Plus another things like fixing some minor bugs, adding drivers support, more wallpapers and themes.

Hands-On

Ok then, back to our case, I’ve started the installation on my ThinkPad W500.

Installation Process

Of course, nothing changed in the basic process that you’ve seen so far.

But great news for all the W500 users, the video driver does not crash on the last phase of the installation.

For those that also tried previous beta versions of Windows 7, as we discussed in some comments on previous post, noticed that in the last part of the installation process the screen goes black (the operating system didn’t crash, the installation continues but with no display) and there’s nothing you can do  (you cannot start in safe mode because the installation did not complete). The only resolution, complete the installation completely blind.

Well that problem it’s not present in the RC version.

Regarding to the video adapter, let’s check on the other devices.

Drivers

Here’s where I noticed another good news after the installation was completed. My “Device Manager” looked like this:

I know, nothing promising. But, Windows Update showed me right away the next updates available:

Ok, now we are talking 7. Let’s install them.

There was no need on installing it manually or selecting compatibility mode. After that, my Device Manager looked like this:

Close enough, but we can do better than that. So, I’ve downloaded and installed these drivers:

• Local Manageability Service and Serial Over LAN (Intel AMT 4.0)
• Management Engine Interface (Intel AMT 4.0)

And yes, the drivers for “PCI Serial Port” and “PCI Simple Communications Controller” disappeared from “Other Devices”.

On the other hand, the video adapter driver shows ATI Mobility Radeon HD 3650 with the yellow exclamation mark. Installing ATI™ Mobility FireGL™ V570? No luck.

ATI released video drivers for Windows 7, but for now there’s no availability for FireGL family.

Software

Another good news is that I was able to install Mozilla Firefox without using the compatibility mode, like I shown on the first post.

Other software installed without any problem:

• Microsoft Office 2007 SP2
• Foxit Reader
• WinRAR
• Twihrl and Adobe AIR
• ImgBurn
• Windows Live

Unfortunately, Google Chrome still needs to be configured manually to actually work: Add to the execution file path the following “–in-process-plugins”.

Using Microsoft Outlook Connector, I’ve noticed an issue with Office 2007. Whenever you minimize the Outlook window, and if the option is set to “Hide When Minimized”, if you open again Outlook from taskbar or tray, you’ll see that the Outlook Connector option disappeared. The same thing happens if you use Xobni, once you minimize it, the option disappeared and the add-on is closed.

Cool Links

Here are some interesting links to read about Windows 7. I’ll add a few more in the next days.

• Windows 7 Setup Secrets (Recommended!)
• Anti-virus available for Windows 7 from “Security Software Providers”
• Windows 7 Beta hotkey cheat sheet

Conclusions

• Even though there are no big differences between the first official beta (build 7000) and this one (build 7100), still it is my preferred operating system to use, more than Windows Vista or XP.
• I’ve noticed also a performance improvement from previous builds.
• Stability it’s another characteristic I’ve noticed using it on the ThinkPad W500. Even though I’ve installed and uninstalled drivers and software, I haven’t seen any program nor operating system crash.
• Still waiting for a acceptable solution for the video drivers.

Haven’t tried it yet? What are you waiting for?

Cheers!

Check also:

Windows Embedded Standard 2009 Step-by-Step Deployment – Part I

Windows Embedded Standard 2009 Step-by-Step Deployment – Part II

After reviewing the necessary steps for preparing our environment (Post I) and building a custom image for a thin client (Post II); we’ll prepare the remote boot process as well as the remote boot server that will deploy that image on diskless devices.

If you prepared the same environment with the XP Embedded version, the process does not have much differences.

1. Set the Image Ready

Even though the building process of the image is complete, we need to run a few steps to set the image ready for deployment.

The First Boot Agent (FBA) needs to be executed one time to complete this process. By booting the image one time, the FBA makes a hardware detection and finishing some other tasks like network configuration. Also, these tasks executed by the agent can be customized; check this link about FBA. 

The image is already built, so we are going to take those files to a new disk (virtual in my case) and boot a client machine from there.

1.1 Add a second disk to the machine acting as Remote Boot Server. Create a new partition and set it to “Active”.

1.2 Copy the image files to that new logical disk.

1.3 Like I said, I’m using a virtual environment, so my next step would be to create a new virtual machine, attach the virtual hard disk as primary and start the virtual machine.

Since FBA contains several tasks to execute, could take a few moments to complete.

Soon as it completes, this message should appear: “Machine Released! Click to shutdown or reboot.”.

1.4 Select “Shutdown”. And I bet the next window will get you back some good old memories :)

Here comes an important note if you are planning a remote boot environment:

Since we’ve added the “System Cloning Tool” component and the image task sequences are now complete, every time this image is now booted will generate a new computer name, SID and other tasks that the fbreseal process executes to guarantee that there’ll be no cloned images on your environment. Quite similar as the sysprep process.

And it means that this image cannot be booted any more, otherwise the fbreseal process will be lost for next deployments.

1.5 Now you can attach the virtual disk back to the Windows Embedded remote boot server.

2. SDI Loader

The Storage Device Image Loader will be in charge of emulating those set of files to act as booteable storage for your clients.

2.1 Open SDI Loader from Windows Embedded Studio.

2.2 Click “Yes” to install the SDI Driver.

2.3 Click on “Add Disk” to generate a new .sdi file where the image will be stored.

2.4 Choose name and location for the file.

2.5 Choose the size of the file. This .sdi file should be, at least, 25% bigger than the image size.

Once it’s selected, the new device is added to SDI Loader and to your operating system as a new drive.

2.6 Open “Disk Management” to prepare the new virtual drive added to the system. Initialize disk.

2.7 Prepare the new volume following the wizard selecting it as “Primary Partition”.

2.8 Copy the image files (from the virtual disk that was used to boot one time) to the new virtual partition.

3. SDI Manager

Ok, now it is time to use some of options from the SDI Manager, that let us handle offline .sdi files.

We will generate a new SDI file that “Remote Boot Manager” will use to deploy on remote devices and machines.

3.1 Open a “cmd” and locate Windows Embedded Utilities “C:\Program Files\Windows Embedded\utilities”.

3.2 Create a new .sdi file using “SDImgr.wsf: cscript SDImgr.wsd /new c:\ramdisk.sdi”

With the new file created, the next step is to read the image files located in the virtual partition (in my case, this partition is associated with the F:\ drive) to complete the process.

3.3 From “cmd” run: “cscript SDImgr.wsf c:\ramdisk.sdi /readpart:F:”

64bits Operating System Issue

The SDI driver has an issue if you are using x64 operating system, like Windows Server 2008. If you try running any of the SDI Manager options, like the ones mentioned above, you will see this error:

“ActiveX component can’t create object: ‘SDIAUT.SDI’”

Even though the script used by x86 and x64 operating systems is the same, on a 32bit environment you won’t see this issue.

4. Configuring Remote Boot Manager

Remote Boot Manager and the DHCP role configured earlier, will be in charge of answering remote and diskless clients with the proper boot image.

4.1 Place the “ramdisk.sdi” file configured earlier inside this folder “C:\Program Files\Windows Embedded\Remote Boot Service\Downloads”.

4.2 Open "Remote Boot Manager” from Windows Embedded Studio.

4.3 Click “Yes” to create a new configuration file.

Once the Remote Boot Manager window opens, you need to add each client device or machine with their specific MAC Address. For that, we’ll take a look at the virtual machine client’s configuration.

4.4 To achieve booting from the network when you are using Hyper-V, you need to add a “Legacy Network Adapter” on the client machine and specify an static MAC Address.

4.5 With that, you are ready to complete the data from Remote Boot Manager.

Client MAC Address: Assigned statically.
Description: (optional).
Boot Server: Default value (0.0.0.0) to select local machine.
Boot Program: startrom.n12. This program will request F12 confirmation for booting from the network. You can also select startrom to access directly to the boot image without requiring confirmation.
Boot Image: ramdisk.sdi. Remember that the image should be placed inside “C:\Program Files\Windows Embedded\Remote Boot Service\Downloads”.
Boot Parameters: (optional).

Now your environment is set to go.

Make sure that your client machine has the correct configuration to boot from the network.

Loading the image remotely.

Windows Embedded image booting.

Desktop ready for use.

Enjoy!

Check also:

Windows Embedded Standard 2009 Step-by-Step Deployment – Part I

Windows Embedded Standard 2009 Step-by-Step Deployment – Part II

Cheers!

Check also:

Windows Embedded Standard 2009 Step-by-Step Deployment – Part I

Windows Embedded Standard 2009 Step-by-Step Deployment – Part III

After reviewing Post I we’ve set our environment to start building the images.

The process it’s practically the same that we executed on XP Embedded (Post I, Post II and Post III). And again, as I mentioned before, this deployment is oriented to Embedded images booting on diskless devices, so there will be steps that are not necessary if you are not looking for a remote boot environment with Windows Embedded Standard 2009 images.

Building the Image

1. Get hardware information from your target

This step is done with Target Analyzer, that is just an .exe file that compiles all of the hardware necessary information to be included on the image you are building. With the information gathered here, the corresponding drivers will be added to the image.

Since I’m using virtual machines in the same physical server, I’m going to collect hardware data in the same machine where I’m going to build the target image.

1.1 Open a cmd and focus on “C:\Program Files\Windows Embedded\utilities”.

1.2 Run “tap.exe”.

You’ll see that the program recollects information about your devices, and creates a new file on the same folder called “devices.pmq” containing all that data. 

Target analyzer collecting information

The files devices.pmq contains all the hardware information

2. Adding the Drivers to the Image

The image builder from the Windows Embedded Standard 2009 suite is still Target Designer.

2.1 Open Target Designer from Windows Embedded Studio.

2.2 Select create a new image and we are going to name it Embedded2009

Now you have to start creating the image from scratch and the first thing we are going to do is import the hardware information we gathered from Target Analyzer.

2.3 From “File” menu select “Import” and select “devices.pmq” created recently.

2.4 On the “Import File” window click “Start” and the importing process will begin.

Once it’s completed, you can check any warnings generated. In my case, there are several warnings regarding virtual machines synthetic drivers, those can be ignored for now.

The image now is loaded with a bunch of hardware components that the image will use.

3. Using Design Templates and Adding Components

3.1 Check on the Target Designer left pane and expand the “Design Templates”.

Here you’ll find common templates used when you are creating Embedded images. To find more information about each one, right click on the component and select “Help”.

I’m going to select the “Thin Client” component. You can drag and drop the objects to your customized image or right-click and select “Add”.

This component will generate the necessary requirements that, when the dependency check is run, will add other components included on the database. We’ll see that step later on this post.

Since we are using a remote boot environment, two special components are needed to achieve it: RAM Disk Driver (will allow booting from RAM) and System Cloning Tool (will include a kind of sysprep step, called fbreseal, to make each image unique and avoid cloning SID, computer name, etc each time is deployed).

3.2 From the left pane, use the “Search” box and insert “RAM Disk Driver”.

3.3 The component is shown. Right-click on it and select “Add”.

3.4 Repeat the step for “System Cloning Tool” component.

Here’s the chance for you to add any other special component that you want on your image.

.Net Framework 3.5

Silverlight 1.0

Or even more, you can set some of the components properties at this stage. For example: Windows Firewall.

Access Windows Firewall component settings

In here you’ll find much more options that the ones shown on XP Embedded

Turn on/off the Firewall by default on your image

Setting Firewall’s exceptions

Authorizing applications

Opening ports

4. Checking and Solving Dependencies

The main step of the building process is checking the dependencies that are created soon as you add a component to your image.

At this point you’ve configured your image with the proper drivers, customized it adding components and setting their properties; now let’s check what dependencies are been set.

4.1 From “Configuration” select “Check Dependencies”.

4.2 In the “Dependency Check” windows click on “Start”.

The process will start, it will take a few moments to complete. At the end of the process, you’ll see in the lower pane window all the messages that need attention before building the image.

Just double click on each of them to select the proper component to be added and solve the dependency.

Here are some of the common messages that you should see:

Component: “Base Component”. To solve it I’m selecting an standard component “Standard PC”.

Component: “Compression and Expansion Tools”. Solving it with “NTFS” component.

Component: “Regional and Language Options”. “English Language Support” to resolve.

Component: “Windows Logon”. I’m selecting “Explorer Shell”.

Soon as you click on “Add” on your last dependency, your image would seem to be ready to the build process, but not quite.

Since you’ve add new components with the dependency check, it’s highly recommended that you run the dependency check again for the new ones.

Soon as you finish this new “Dependency Check” and new and highly important component will appear to be added.

Select your boot loader. In my case I’m using the default loader for XP and 2003 environments: “NT Loader”. If you are trying to protect from any change to your boot environment, you can select “EWF NTLDR” component.

5. Building the Image

Ok, now that we’ve resolved all of the dependencies on our image, we can start building it.

5.1 From “Configuration” select “Build Target Image”.

5.2 Select the folder where the image will be stored. The default folder is “C:\Windows Embedded Images”. Click on “Build”.

Once the build process is complete, you can check the files and folders created.

And verify the image size. In my case is 255mb.

Now the image is completed and ready to be used on any of your targets.

Check the next post about preparing the same image for remote boot on diskless devices.

Check also:

Windows Embedded Standard 2009 Step-by-Step Deployment – Part I

Windows Embedded Standard 2009 Step-by-Step Deployment – Part III

Cheers!

Windows Small Business Server 2008 Administrator’s Companion

But you should know that this book is going to be available for download for a short period of time: April 15 to April 22. So you better hurry up and get yourself a copy!

The SBS platform that was introduced with Windows Server 2003 is oriented to small-medium organizations (between 5 and 75 computers) and gives you all the possibilities and solutions that you may need to use on your organization within a single server: Active Directory, Exchange Server, Internet Information Services (IIS), Sharepoint, SQL, Terminal Services, etc. Avoiding, this way, to consider the implementation of several servers and their hardware and licensing costs.

Also, on the devs side, you can find this book also available:

Microsoft® Visual Basic® 2008 Express Edition: Build a Program Now!

Enjoy!

Windows Embedded Standard 2009 Step-by-Step Deployment – Part II

Windows Embedded Standard 2009 Step-by-Step Deployment – Part III

I’ve been reviewing, for a while now, the opportunities that Embedded operating systems has to offer. If you take a look to previous posts of mine that I’ve prepared about XP Embedded you’ll find a quick introduction to the platform + the steps for building, preparing and deploying XP Embedded images in your environment, including deploying it on diskless devices (remote boot):

Preparing and Installing Windows XP Embedded Images – Part I: Setting up the Environment

Preparing and Installing Windows XP Embedded Images – Part II: Building Images

Preparing and Installing Windows XP Embedded Images – Part III: Using Remote Boot

Windows Embedded 2009 Standard Overview

Windows Embedded 2009 Standard is the newest version of the Embedded operating systems released by Microsoft, succeeding Windows XP Embedded. These operating systems are oriented to special devices or computers, where you need a secure, small, reliable and manageable OS. WES 2009 contains the same kernel as Windows XP with a few improvements:

• Windows XP kernel with SP3 included
• Internet Explorer 7
• Windows Media Player 11
• Silverlight 1.0
• .Net Framework 3.5 (including also 1.0, 1.1 and 2.0).
• IPv6 support

For more information about Windows Embedded Standard 2009 check the following links:

- Windows Embedded Standard 2009 Home
- [PDF] Windows Embedded Standard 2009 Overview
- [PDF] Windows Embedded Standard 2009 Datasheet
- [PDF] Windows Embedded Kiosk Solutions
- Download Windows Embedded Standard 2009 Trial

So, after a quick review, let’s start with the step-by-step guide for building and deploying Windows Embedded 2009 Standard images, including the remote boot process.

Requirements

We will consider installing all the WES roles within the same machine, including the DHCP server (necessary for the remote boot environment).

Valid Operating Systems

- Windows XP Pro SP2 or higher
- Windows Server 2003 SP1 or higher
- Windows Vista
- Windows Server 2008

Roles

- DHCP Server available on the network
On our case we’ll have this role on the same machine.

 

Valid Database Engines

- SQL Server 2005 SP1 or higher
- SQL Server 2005 Express Edition SP1 or higher *
- SQL Server 2008
- SQL Server 2008 Express Edition

* : Windows Embedded Standard 2009 installation media already includes the SQL Server 2005 Express Edition SP2.

 

 

 

DHCP Configuration

Remember that this role and configuration it’s used only to achieve remote boot on diskless devices. It’s to necessary if that’s not your environment.

The same procedure used for XP Embedded is needed. Check this link for more information.

C:\WINDOWS\system32>netsh
netsh>dhcp
netsh dhcp>server \\<server_machine_name>
netsh dhcp>add optiondef 60 PXEClient String 0 comment=PXE support
netsh dhcp>set optionvalue 60 STRING PXEClient 

To verify the correct configuration, an option should be added and set on your DHCP server. You can check it on the DHCP Snap-In > Server Options.

Windows Embedded 2009 Standard Installation Step-by-Step

Well the process is quite simple, so you should not have any problem following it. But you’ll probably find a small issue within the procedure, let’s take a look:

1. Using the WES 2009 media, start the wizard from the autorun menu.

2. Insert the Product Key that you were given when you registered for the download.

3. Select “Custom” installation.

4. On the components to be installed, check also the entire feature for “Remote Boot Service”.

5. For the TFTP server, select “On this machine”.

6. Accept the default directory and click on “Next”.

7. Now select the SQL Server where the DB should be stored. I’m selecting it the local SQL Server Express instance already installed. Click on “Next”.

8. On the summary click on “Install”.

Here’s where you should find a problem. In the middle of the installation process this message will appear:

Windows Embedded Standard Error: WeUpdate. 
D:\Setup\WMP11.exe failed. Return value = 0×40

(Also the message could appear using other components besides WMP11, Windows Media Player).

The log file should have this message:

Windows XP Embedded Service Pack 3 Installer
Cannot connect to the database – please check the database.
Setup cannot continue.
No objects or files were imported to the database (local)\SQLEXPRESS.
WEUpdate Exiting with return code: 64
*** End of Run ***  

Solution

Wait 5-10 minutes and click on “Retry”.

You don’t believe it? Check this MSDN article about it. It’s related about how the installer access and closes the database during the installation process.

After that the installation should complete normally and you can access Windows Embedded 2009 Standard from the Start Menu.

We’ll review the rest of the process on the following posts.

Check also:

Windows Embedded Standard 2009 Step-by-Step Deployment – Part II

Windows Embedded Standard 2009 Step-by-Step Deployment – Part III

Cheers!