TechX World *Nix Integration

By Karin Cornils

And for those of you who have been holding out for some news on integrating other systems into the Windows World, here’s a few notes from the TechX World San Francisco, held in May.

Since almost all Windows IT organizations also support Mac, Linux, Unix, or other *nix (non-Windows) systems, there’s an increasing need for directory integration, cross-platform monitoring and management. And solutions for these needs are beginning to mature.

On the monitoring side you have options ranging from the high-end HP OpenView framework system to open source systems, of which Nagios is one of the more popular. In between those, some of the big players are Quest Big Brother, IPswitch Whatsup Gold and Netiq. One thing to keep in mind is that open source is already very good at component monitoring, but not yet good at the end-to-end transaction and state monitoring.

The world of monitoring is also starting to expand its scope -- metrics are starting to be developed for SOA (Service-Oriented Architecture) and BSM (Business Service Management). SOA monitoring involves keeping track of loosely coupled, asynchronous applications communicating with each other. And BSM is starting to address an issue of growing importance these days – managing IT from a business perspective.

Moving over to the topic of Management solutions, I want to touch on directory integration solutions; since AD has taken such a dominant position, with an estimated 90% of IT organizations to have implemented AD by 2010, it makes some sense to develop solutions that play nicely with it. So many vendors have begun extending Group Policy to the management of *nix platforms.

Active Directory Group Policy (GP) is mostly used for security configuration, logon scripts, desktop lockdown, IE and Firefox configuration and software deployment. Its strength is that is very granular and scaleable. Its downside lies in how loosely coupled it is – you can’t say for sure when a machine has pulled down a policy, but future versions of Longhorn may bring task scheduling into GP. Since GP is essentially LDAP-enabled, it’s an architecture open to non-Windows platforms and easily extended to non-Windows configuration items. Some of the big players that have products which extend GP to Unix and Linux platforms are Centeris, Quest, and Centrify (which also supports Mac integration). None of these products require schema mods. It’s pretty impressive to see an install.sh from a Linux command prompt completing an installation and joining AD within 10 seconds, and then seeing that machine show up in the Active Directory Users & Computers console.

On the open source side, most of the integration approaches involve some form of Samba. With a combination of Samba3, Kerberos, OpenLDAP, and Winbind, for instance, you can join and provide single sign-on for Linux servers and workstations to a Windows AD domain. Open source solutions have not yet gotten to the level of extending AD group policy to non-Windows machines.

Windows Server Longhorn Roadshow

by Karin Cornils

No, none of us own stock in Microsoft, but that doesn’t mean we’re not keeping our ear to the ground for what’s happening in Windows world. And we’re bringing you more news from the front from the Windows Server Longhorn Roadshow that came through Santa Clara in April.

The next Windows Server version “Longhorn”, currently in Beta, seems particularly interesting in its virtualization technology and modular Server Core deployment options as well as improved management and security enhancements. Following is a very brief overview of some of our favorite Longhorn highlights.

Server Management

• Streamlined installation process: Can you believe an installation process that isn’t interrupted by configuration tasks requiring user intervention? Time for a coffee break?


• Server Manager Console: The Console provides a single unified console for managing a server’s configuration, system info, roles, and displaying status, etc.


• Windows PowerShell: By integrating command-line shell and scripting language, this reduces the complexity and time required to automate system admin tasks.
  

IIS7

• Modular feature-based installation: IIS7 is made up of over 40 separate feature modules, only half of which are installed by default, allowing granularity in choosing the features needed, improving performance and security.


• Improved diagnostics & troubleshooting: These allow developers or admins to see real-time diagnostic state info and detailed trace events through the entire request processing pipeline.
  

Security

This is another topic too wide to do justice to here, that we’ll just list a couple of highlights for:

• NAP - Enforced client health: NAP allows admins to configure and enforce health and security requirements before allowing clients access to the network.


• RODC: The Read-Only Domain Controller (RODC) is back – for installation in remotes sites that may have lower levels of physical security.


• Firewall enhancements: The Windows Firewall has been expanded for interception of both incoming and outgoing traffic. The integration of firewall and IPsec settings simplifies security settings and helps prevent policy overlap.

Server Core (aka first non-big-fat-Windows-OS)

This is a super cool version of Longhorn, allowing administrators to install minimal installations of Windows Server with specific functionality, without the overhead or security impacts of unneeded features. This results in reduced software maintenance, updates and patches, reduced attack surface, and reduced hardware and management needs. Below are the roles Server Core can be configured as:

• Windows Server Virtualization


• DHCP server


• DNS server


• File server


• Active Directory Services


• Windows Media Services


• Print Management

And our number one favorite Longhorn trait….

Windows Server Virtualization (WSv)

WSv uses a low-overhead virtualization architecture based on a 64-bit Hypervisor. The use of Virtualization-aware hardware (Intel VT and AMD Pacifica) further increases guest op system performance. The following features make it feasible to virtualize formerly virtual-unfriendly workloads with I/O intensive, memory heavy applications like Exchange Server and SQL:

• 64-bit host and guest operating system support


• Server Core support: WSv can use a Server Core Longhorn installation to minimalize the overhead and maximize server processing capability to running VMs.


• Pass-through disk access: The old school virtualization used to require 2 hops from the guest virtual machines through the virtual machine manager and the OS to get to the hardware. Microsoft’s WSv now supports pass-through disk access allowing guest operating systems to directly access local or iSCSI SAN.

And of course there are tons of other extras which are beyond the scope of this brief overview, such as enhancements in the areas of failover clustering, network load balancing, windows backup, terminal services, etc – you might want to check out the following link for more details.

http://www.microsoft.com/windowsserver2008/highlights.mspx

Jammin' with Exchange 2007

By Karin Cornils

Despite the inevitable hype dished out at any Microsoft event, the amount of practical information at Microsoft’s recent Exchange 2007 Roadshow in San Francisco was actually worth the trip. For those of you, like me, responsible for implementing and maintaining Exchange 2007 (a.k.a. Ex2k7), here are the nut and bolts found among the junk.

Wait for SP1?
Exchange 2007, released to market December 2007, seems to be quite happily deployed at many rapid deployment sites. Nevertheless, some of you planning an upgrade may want to wait for Service Pack 1 because it will fill in some current feature gaps, such as public folder access and deleted item recovery in OWA and Exchange Management public folder configuration, not to mention the new features the Service Pack will provide. Note also that current Exchange 2007 deployments do require an Active Directory schema change prerequisite.

New Features
Everybody who gets email from Microsoft knows that they are touting Ex2k7’s high availability, 64-bit architecture and support for Unified Messaging. But some of the less publicized features are worth mentioning, too:

Exchange 2007 uses PowerShell, a powerful scripting engine which allows access to the configuration settings and internal status info. The Ex2k7 administrative console runs on top of PowerShell, so any task that can be done in the console can be accomplished at the command line or by running a script.

Mobile access uses direct-push synchronization support which downloads new items immediately rather than at scheduled intervals, providing a viable alternative to BlackBerry. Also, Windows Mobile 6.0 allows searches on entire Ex2k7 mailboxes rather than just on items cached on devices.

Packaging, Licensing, and Pricing
In case you’ve had trouble figuring out the configurations, here’s a quick summary, including one gotcha.

Server licensing comes in Standard and Enterprise editions. The Standard Edition has a maximum of five storage groups and 5 databases per mailbox server. The Enterprise Edition has a maximum of 50 storage groups and 50 databases per mailbox server.

EE also allows for failover clustering, including allowing Cluster Continuous Replication to cluster nodes in separate geographical locations.

Client access licensing also comes with Standard and Enterprise CALs, but you may have to buy both. The Standard CAL grants rights to either edition of Exchange’s main server features, such as email, calendars, public folders, and OWA. If you want access to unified messaging, premium journaling, managed folders and forefront security, however, you will have to get Enterprise CALs in addition to buying Standard CALs.

Upgrade Path Issues
Because of the change to the 64-bit version, in-place server upgrades are not possible. Also implementing unified messaging may involve complex integration with your PBX system. Proceed with caution.

Deployment Notes
The Exchange 2007 server deployment involves implementing as many as five different server roles, including Client Access Server (CAS), Hub Transport Server, Mailbox Server, Unified Messaging Server (UM) and Edge server. The first three are required. The last two are optional.

All of these roles except Edge server can be put together on a single server. The Edge server has to be on a separate server, but it is not required. If you have an anti-virus/anti-spam front-end solution already, you can use that in place of Edge server.

The upgrade process first involves the aforementioned AD prep schema changes, followed by deploying the server roles in this order : CAS, Hub Transport, Mailbox, then the options, Edge and UM, if desired.
The best approach is to put ISA in the perimeter and use that to pass traffic to the CAS server. The only ports that need to be open between ISA and CAS are ports 80 and 443 (for encryption).

You can replace OWA and RPC/HTTP servers right away with CAS. It will automatically detect EX2k and Ex2k3 servers and present them with the current version of OWA rather than OWA2k7.

Miscellaneous Notes (In no particular order)
Microsoft said that the 64-bit upgrade could reduce the I/O demand by as much as 70%.

Cluster Continuous Replication (CCR) provides high availability. If you have the Enterprise edition with SP1 you get Standby Continuous Replication (SCR) which allows replication of databases from an active node to standby servers or clusters in a local or remote location.

Databases are now portable. They are no longer tied to a specific server the way they were with Exchange 2003. The databases are still ESE, but the STMs are gone and the transaction logs are 1 MB rather than 5 MB.

Recipient Update Service (RUS) has disappeared in Ex2k7. In the transition to Ex2k7, however, you need to repoint RUS to Ex2k7 in order to successfully decommission Ex2k3. The disappearance of RUS with 2007 is very nice – new mailboxes immediately get addresses and are seen in the GAL (except in cached mode clients).

You still need Public folders until you decommission Ex2k3 – after which they are optional.

Administrative Groups have also disappeared in Exchange 2007 - with the exception of those needed for compatibility with Ex2k and Ex2k3.

All Exchange management is now handled via the Exchange Management Console.

Exchange 2007 does not use IIS SMTP. Microsoft rewrote SMTP.