Next I checked the ISA 2006 event logs. I started seeing a lot information events about packets dropped because of invalid data. These packets were coming from the servers configured in the root hints. It seemed odd, as they were literally filling my event logs. I stumbled across this¹ gem. Windows Server 2008 comes with a new protocol called EDNS turned on by default. These EDNS UDP packets are often well over 512 bytes. ISA 2006 apparently has issues handling these packets. Quickest solution: turn off EDNS.

EDNS can be turned off by the following command from an elevated command prompt: “dnscmd /config /enableednsprobes 0″

Immediately after disabling EDNS, clients had normal DNS lookups again. No more failed page lookups resolved by a refresh. There was one catch though: web browsing was drastically slow. In some cases it appeared an “ipconfig /renew” would fix it briefly, but for the better part of the day web browsing was slow. What was particularly odd was that speed tests would report the performance that we expected from our lines. After some Googling, I found this² Microsoft KB which describes slow web browsing performance between ISA and SBS 2008. While I don’t have SBS in my environment, I thought it might be related. I ran the hotfix, and after it did its thing, it restarted the firewall. I’m not sure whether the hotfix or the firewall restart (or both) was the solution, but after that our browsing performance was speedy again!

The point I’d like to make here is that Google may be phasing out Windows 7, not because of any inherent security flaws, but that it’s possible that licensing and maintenance costs are the driving factor to phasing out Windows. Perhaps Google feels that it could spend less effort maintaining internal security by using a Linux or Unix-based OS.

While an OS itself can be secure as a rock, there is always a human factor involved. Even the most intelligent individual makes foolish decisions and actions at times. It is very difficult to protect the user from him/herself. It is very difficult to explain that some emails requesting their information are legitimate, and others are not. Or that some website popups only look like an application window, and are not to be clicked on.

These days, attackers find information more valuable than random destruction and wreaking havoc among systems. Consequently, the majority of attacks are designed to infiltrate and recover information, while doing their best not to alert the user. After all, why turn off the information hose as long as it’s producing information?

Consequently, one of our primary concerns should be the interaction the user makes with their computing device. If it is not possible to easily educate them on legitimate activities or requests vs. illegitimate ones, make it easy for them to understand how to control what is happening. For instance, even when they provide an administrator password to a seemingly legitimate prompt, there should be no lasting, hard to control activity. For example, an application editing the Windows Registry should not be permitted to alter settings outside the application scope (sandboxing). An educated user is a safer user. We need to do more to educate our users on the safe usage of computers, and teach them how to discern legitimate activity from illegitimate. I also believe that the OS has a place in educating the user to an extent, and providing them with easy to understand control over changes they’ve made/approved.

Windows 7 has improved the control over this particular example, but unfortunately at the expense of user understanding and interaction. Linux, Unix, and OS X on the other hand, sandbox applications and their configurations, requiring minimal administrator level permissions. Consequently, the user has to very explicitly and conscientiously make a decision whenever an application requires an administrator permission level. The controls to manage any permanent changes are very easy to use in OS X. A user deletes an application, and it no longer is capable of executing. There are no core registry changes that the user needs to be concerned about removing. Configurations are in individual text files, specific to each application. I digress however.

I do not run antivirus on my Macs. However, I run a network firewall (LittleSnitch) that informs me of network traffic going in & out. Just because my OS provides fewer attack venues, and is fairly secure, does not protect me from accidentally/foolishly approving a change which will transmit my personal information.

Realizing this, one needs to shift their perception of how to view client platform security. Theoretical analysis is good. However, practical application is what should define security evaluation. Which platform is more secure in practice? Anyone can justify any OS’s security. However, the proof is in the pudding. For example, Unix has been used for government/financial servers for a long time. Windows Server has been used, and I would argue that the Windows servers have proved themselves much more vulnerable over an extended period. Just ask any system administrator.

Take a look at Linux. If there is any platform with serious potential vulnerability, it would be Linux. Since the code is so open, and written by so many uncoordinated, imperfect people, there is vast potential for holes. However, in practical usage, it is one of the most secure platforms available. When holes are found, they are quickly patched by the open source community. Most Linux users are reasonably tech-savvy, and don’t fall for many of the same social engineering tricks that Windows users do. It is arguably a secure platform.

This also leads to another point. The bigger the target, the more attackers will aim at it. Just because you are a smaller target does not mean you are less secure. Even if you are more vulnerable, the fact that you are being attacked less provides security. I for one do not want to be the tank shot at on the battlefield. I’d prefer to be the sniper, vulnerable, but inconspicuous and hardly fired upon.

Articles such as the recent PCWorld piece¹ hyping how the iPhone was first to fall in the PWN2OWN contest, and how the Macs and iPhones are no less vulnerable than Windows, are worthless drivel. One needs to accept that everything can be broken. Even RSA1024 was recently broken². However, the fact that a platform was broken/hacked (by methods devised in the months prior) does not mean it is less secure in practical usage. I have yet to have one of my Mac installations infected or broken, while the Windows 7 install (which I only use to manage home servers or test a site in IE) has been attacked twice, and infected once.

Let’s stop defending our idealistic points and accept reality shall we? Mac, Linux, and Unix are all platforms that can be violated. However, in practical usage, they are more secure than the Microsoft Windows platform.

There are no 128 bit capable processors available. Microsoft is building for a market that hasn’t even started yet. They’ve barely transitioned to 64 bit! Windows 7 is the first Windows OS that has a truly viable 64 bit market. Manufacturers have had a few years to develop 64 bit drivers, and consequently, it is far more likely that you can install Windows 7 x64 now than you could install Windows XP x64. Add to that that almost every new computer ships with a 64 bit processor, and you have yourself one viable market. Software developers also now have mature SDK’s, and have had a few years to transition to 64 bit computing.

Microsoft has finally shipped Windows 7, with a much shorter timeframe than Windows Vista did. I suspect that they are going to try to maintain such an active pace, shipping software every 18-24 months or so, rather than the 5 years it took for Vista. There is no way that either the hardware market or the software market will be remotely ready for 128 bit computing in 2 years. Yes, they may make it ‘functional’, like XP x64 was ‘functional’, but it will not truly be 128 bit. I suspect that Windows 9 will be as 128 bit mature as Windows Vista was 64 bit mature. Don’t expect true 128 bit computing till Windows 10.

We ran into a few issues this past week while applying our Windows XP image to the new T400 laptops. When the computers were turned on, all the USB ports worked except one. And Windows kept complaining about a PCI driver not being installed, even though on the reference machine it worked fine. There were no yellow warning signs in device manager about devices missing drivers.
We traced the problem back to the BIOS. It seems that someone had made changes to the BIOS on the reference machine before it was handed off to me to create an image. They had disabled the Fingerprint reader without disabling the ‘Pre-Desktop Authentication’, and set the USB sleep mode to something different than the defaults. We now have to change the BIOS settings to match the reference machine on every laptop out of the box. Somewhat frustrating. We’re now two full days behind schedule.

Another issue that I personally had this week was related to the workstation component of the rollout. I was informed that the rollout schedule has been cut practically in half. That works… we just need to push a little more. Two days later I got another shocker… We had decided on the DC7800′s to be our standard workstation. After two weeks of testing the image created for the demo machine, the decision was made to change (the day before the new DC7800′s were to be coming in) to the DC7900′s, as DC7800′s were in short supply, and we’d get the $400 more DC7900′s for the same price. This means we need to create a brand new image for the 7900′s, literally days before they come in, as well as proceeding as close to deployment schedule as possible. I foresee a lot of problems stemming from lack of testing.

Tomorrow I’m off to school (it’s reading week). Someone made off with my school hard drive, so my Windows Server 2003 Administration coursework is all lost. I now have to recreate most of it, as it’s required for the second half of the semester.

On a positive note, the Windows Deployment Services server (my baby and setup) is performing quite well. We can freshly image computers from start to finish in about 45 minutes. I’m quite proud of my work to be honest. Even better, although I’m the only one familiar with creating/capturing images to it, and managing it, it was very easy for the others on the IT team to use it after a cursory reading of my documentation. A product is functioning the way it should when others can use it with a cursory reading of documentation.

Anyways, I’m off to sleep. Time for some mental relaxation.

After my post this morning about the new Windows Vista Deployment & Administration guide, I thought perhaps I should post a list of some of the resources I’ve used over the past year in my own experience with the Vista Deployment. Beside each name and link, I’ve written a brief summary of what I used it for.

• Group Policy Team Blog: I used this extensively for learning about the new features and benefits of Windows Vista GP. Useful resource on GPP, RSAT, and GPMC. Also used for learning about the new ADMX templates.
• GuillaumeD’s Blog: I used this for learning about some Microsoft Deployment Toolbench database and task sequence customizations and deployments. Also contains some news about virtualization (HyperVisor).
• JaLaBlog: I used this extensively while in the early stages of learning MDT. An invaluable resource for people new to MDT.
• Rob’s Blog: Useful general information about Windows Vista and Server 2008.
• The GPO Guy: Invaluable resource on Group Policy in Windows Vista.
• Todd’s Blog: A few interesting posts on general administration tips.
• Windows Server 2008 Blog – Kurt Roggen: Very interesting resource if you’re looking for information on Server 2008.
• Realtime Community – Vista: Lots of interesting tips and tricks on customizing/fixing Vista.
• WindowsVistaPlace: I used this for information mostly about SP1.

So… a few useful sites and resources if you’re doing anything similar. Enjoy.

• Microsoft concentrated on bringing too much new technology into Vista. This caused them to delay, delay, and delay again. When a customer is waiting for something new, time becomes critical.
• Microsoft publicized too many features initially. And the features they publicized ended up being most of the ones they had to drop.
• Microsoft concentrated so much on the back-end of Windows Vista that they forgot the front-end. It’s as though they worked and worked and worked on the internal features, and then suddenly realized that they needed to provide something attractive to the end user. So they made it transparent on the user side, and added Flip3D. A transparent user interface is not enough to provide the customer with satisfaction. And a ‘cool’ new way of switching that provides absolutely no usability benefits and only eye candy is waste… it won’t keep a customer.
• Microsoft concentrated so much on the back-end features that they left performance to the end. With the release of SP1 Windows Vista became faster, but before SP1 it was a complete resource pig. And when customers have to use a poorly performing OS for a year before getting fixes, they are less likely to change their perceptions of it, no matter how much you improve.

So… what is Microsoft going to do with Windows 7, in light of what we just talked about? Here are my predictions / views:

• Microsoft is not publicizing features early on this time around. Smart move. Let the buzz build the same way that Apple via ‘leaked’ info from developers and software pirates.
• Microsoft is concentrating more on the front-end this time around. They brought a lot of incredible IT features and benefits to Vista, and these will just get slid in with Windows 7. Now they are concentrating on providing real value to the end user, and not just IT.
• Microsoft is NOT going to let timelines slide the way they did with Vista.
• Microsoft is concentrating on performance this time around. New end user features + performance… what could be better for OS perception and adoption?
• Microsoft is concentrating on Web integration vs Office integration this time around. With Windows Vista they brought tight integration with Office and Sharepoint… now it is time to bring that sort of integration to the Web.

I may add more thoughts to this page. In the meantime, feel free to leave a comment on what you think of Windows 7.

More Intuitive User Experience

• Faster application launching via new Start Menu
• Search in every Explorer window
• Live icons: Actual thumbnails of a file’s contents make it easier for the user to find documents
• Details Pane: All the metadata from a document is easily available (Author, creation date, etc)
• ClearType by default on all monitors (Helps reduce strain on eyes)
• Breadcrumb bar: (User education will allow them to navigate through hierarchal folders more efficiently)
• No more flickering or tearing thanks to Aero
• Navigation Pane: We can set up maps to specific OHA network folders so they’re always accessible to the user
• Command Bar: Possible that it will help some of our older users, as it provides task oriented features listed and easily available. However, this is not a selling point, as there’s a good chance that the users will continue to just double-click.

Search

• We can build pre-build custom saved searches in the navigation pane to help users find their content across the network more easily.
• Redirected Folders: We can redirect the Desktop and Documents folder to the file server, reducing users saving content on their local machine. Search will still work over these folders.
• Offline Folders: We can set it up so that our mobile users can have certain folders that always get synced to the local computer. E.g., project folders, etc.
• Distributed network search: Our users will be able to perform a distributed search, meaning they can find content across the network, provided they have appropriate permissions.
• Office SharePoint offline documents: With Office 2007, you can take SharePoint libraries and documents offline via Office Outlook, and you can search over that content as well.
• In XP folder redirection, the server copy is always open for read and writes, using up bandwidth. In Vista, the copy is cached, and all writes are written to the server, but all reads are read from the local hard drive.
• Delta Sync syncs only the changes to a document rather than the full document when a document is being resolved in a sync.

Internet Explorer

• Better security (IE7 runs sand-boxed in Vista)

Windows Defender

• Integrated anti-spyware (This will really help cut down on the spyware that gets installed on our systems)

Network Awareness

• Contextually relevant network experience for mobile users (I.e., away from OHA, or in the office. We can configure different security/sharing settings for each)

Windows Mobility Center/Presentation settings

• Puts Display Brightness, Volume, Power, Wireless, External Display, Projector, and Synchronizing settings all in one panel
• Presentation settings: You can set the presentation settings so that when in a presentation (either projector or Meeting Space) default background image, volume, and screensaver settings are applied
• Built in Network Projector Support (Combining wireless with a network projector would provide for a much smoother user experience in the meeting room, both for our users or for guests)

Sync Center

• Vista provides a central place for users to sync their mobile device and Offline Folders, Exchange, Outlook, and other documents

Remote Assistance

• Vista makes Remote Assistance much easier for the average user, requiring far less input, and is much more intuitive. It allows users to initiate screen sharing to an admin. We could set this up at OHA so that a user has an icon on their desktop or in the help menu or start menu where they could click, and call us up that way. Or we could just use it if the co-op student or one of us IT people has issues and needs further help from a team member. With IPv6 set up on the server, we may possibly be able to set up Remote Assistance away from the office.

Windows Meeting Space

• Now THIS is where I feel we could really benefit at OHA. I would pay for this application alone. With proper configuration, we can provide users with a much better experience in the meeting room. Windows Meeting Space allows users to easily set up an Ad Hoc wireless network between them. Users can share files, their screen contents, videos, documents, etc easily. It brings a whole new strength to the interaction in the meeting room.
• Windows Meeting Space also uses IPv6, meaning users can leverage it across the internet provided IPv6 ISATAP is set up on Server 2003.
• Windows Meeting Space abides by the rules set up by the Attachment Manager. This allows the admin to limit the file types allowed to be shared. It also can track usage, activity, etc in a session.
• Using ‘Sessions Near Me’ makes it extremely easy for users to join Meeting Space sessions occurring near them on the network or ad hoc networks. It’s all password protected as well.
• Multiple users can work on a single document together during a session, and then all of them can save a copy of the ‘final’ version at the end to their local computer. This allows everyone to have the same version.

Rights Management Services

• With Office 2007 and Vista’s integrated support for Windows Rights management, we can train users ( or not) to apply appropriate permissions to the documents. For example, if someone has written a highly confidential document, they can apply Rights Management to it to only allow particular users from AD to view it. If the document is leaked outside the organization to another person, that person will not be able to view it if they haven’t been approved/given a password.

Remote Access

• Remote Desktop Connection allows for easy remote access. An IT admin can place an icon for the application on the desktop. Running it will set up an automatic Terminal Services Remote connection in the background without need for a VPN.
• Combined with Server 2008′s Terminal Services Gateway, the user will be able to access corporate networks from home, quickly and easily.
• By eliminating the need for a VPN connection, Vista enables the IT admin the possibility to grant granular and secure remote access to specific remote corporate resources. (Terminal Server based applications and desktops designated, rather than full access)

Deployment

• Vista is built on around a file based image, rather than sector based. This allows IT admins to customize the image to a greater degree, servicing individual components. Oddly enough, this is one of my favorite features of Vista.
• Multiple installation images can be stored in a single file on the server, helping save space and keep organized.
• Windows PE. The Preinstallation Environment allows the admin to do a network boot from a client computer, and then run a series of diagnostics or other operations on the computer without actually needing to carry around a service disc.
• Script-based installations allow extensive support to enable remote and/or automated scenarios.
• Desktop Optimization Pack allows virtualized, network-available services. OHA can use this for some apps which are rarely used, such as MS Visio.
• Asset Inventory Service allows an easy way to pull all asset inventory information into an easy to manage location. This would be extremely useful, as we currently have issues with keeping track of our assets and the current user assigned.

Increasing Automation

• Task scheduler can be used to notify the support center of problems on a specific event.
• Administrators can use Task Scheduler to launch a script or application every time the user locks their computer.
• Tasks are run in sequence.

Networking

• NAP client integrated allows an organization to establish baseline security requirements on the client computers. If the health level is not met, we can force the client to update before they are allowed access to company resources.
• BITS allows distributed Windows Updates.
• Numerous networking improvements to use less bandwidth and increase network efficiency.
• Better Quality of Service management via Group Policy.

Control over usage of removable storage devices

• With Group Policy for Removable Storage, we can control what data gets transferred to and from removable storage on a per-user basis.
• We can prevent what devices are allowed to install, by Device ID, Device Class, or Device Manufacturer.

Windows Sidebar

• We can put in gadgets to enable users to see their Outlook 2007 information at a glance.
• We can possibly create or install other gadgets so that users have access to other important information as well.