In this series, we will move through the content blueprint of the Microsoft Windows Active Directory Configuration (70-640) exam objectives with an eye toward preparing you to pass this Microsoft Certified Technology Specialist (MCTS) exam.

Microsoft Exam 70-640 – Configuring DNS Zones  / Domain 1, Subobjective 1

For each exam domain, I will give you two blog posts. One blog post represents a nutshell summary of the content underlying the first domain in the 70-640 certification exam blueprint: Domain Name System, or DNS. The second blog post presents a representative practice exam question that covers one topic from each content domain.

The screenshot above shows the relevant section from the 70-640 exam blueprint on configuring DNS zones.

What we will do here is cover each of the aforementioned bullet points by providing (a) very brief definitions of each technology; and (b) links to relevant Microsoft resources to foster your certification study.

The first domain in the 70-640 exam is all about Domain Name System, or DNS. Suffice it to say, you should have a pretty comprehensive understanding of how Windows Server 2008 DNS works (from the server and client sides) before you tackle the 70-640 test.

In your exam study, please be sure to focus on every single item listed in each bullet point. In other words, make sure you are comfortable with all of the following aspects of configuring DNS zones:

• Dynamic DNS (DDNS) and traditional DNS
• Secure DNS
• TTL configuration
• GlobalNames, Primary, Secondary, stub, and AD-integrated zones
• SOA record configuration
• Forward and reverse lookups

Dynamic DNS (DDNS)

DDNS is a feature of the Windows Server 2008 DNS Server that enables DNS clients to automatically register and unregister their host names and IP addresses. The convenience is that an administrator doesn’t have to manually tend to the DNS database, which was the case many years ago.

Relevant Links:

• Understanding Dynamic Update
• Dynamic Update

Non-Dynamic DNS (NDDNS)

NDDNS is (potentially) useful in very small and/or high security networks in which the DNS administrator wants to be able to control DNS client registrations by hand.

Relevant Links:

• Eliminate Manual Updates of DNS Records by Configuring Dynamic Update and Secure Dynamic Update
• Step-by-Step Guide for DNS in Small Networks

Secure Dynamic DNS (SDDNS)

SDDNS enables Windows Server 2008 DNS administrators to apply access control lists (ACLs) to their DNS zones, thereby preventing non-domain member computers and other unauthorized devices from registering with DNS. SDDNS should not be confused with DNSSEC, which is a completely different technology that was added in Windows Server 2008 R2. In a nutshell, DNSSEC is a collection of industry-standard protocols that add data integrity and enhanced authentication to DNS.

Relevant Links:

• Secure Dynamic Update
• Dynamic Update and Secure Dynamic Update
• Introduction to DNSSEC

Time to Live (TTL)

The TTL is a value that is attached to every resource record that specifies how long client devices should cache the data contained in the record. In other words, if my client computer receives a resolution request for yahoo.com from the Yahoo DNS server with a 1-hour TTL, then my computer will store that resolved IP address in memory for 1 hour before requesting refreshed data. We configure the DNS zone’s default TTL by modifying the properties of the Start of Authority (SOA) resource record.

Relevant Links:

• Resource Records Reference
• Configuring Caching and Negative Caching

GlobalNames

GlobalNames is a new DNS zone type that helps businesses decommission their WINS servers. GlobalNames allows for what Microsoft calls “single label name resolution.” Thus, “legacy” domain computers can communicate using DNS names that mock their deprecated NetBIOS name counterparts.

Relevant Links:

• Providing Single-Label DNS Name Resolution
• Deploying a GlobalNames Zone

Primary and Secondary Zones

In traditional DNS, primary and secondary zones are considered to be authoritative for a given DNS domain. The difference here is that updates occur on the primary DNS server and are propagated to secondary DNS servers during the zone transfer process. In other words, primary DNS zones are read/write, and secondary DNS zones are read-only.

Relevant Links:

• Understanding Zone Types
• Change the DNS Zone Type

Active Directory-Integrated Zones

AD-integrated zones were a big deal when Microsoft added them to Windows Server. Here we can dynamically replicate DNS zone data to all domain controllers within a domain or even across multiple domains within a forest because the zone data is embedded into the Active Directory database instead of being stored in flat files. Another advantage here is that every DNS server (that is to say, domain controller) can make changes to the DNS zone data. Hence, there is no concept of a read/only secondary zone.

Active Directory-Integrated Zones

Relevant Links:

• Active Directory-Integrated Zones
• Primary and Active Directory-Integrated Zones Differences

Stub Zone

A stub zone is a read-only DNS zone that contains only enough resource records to identify the authoritative DNS servers of another zone. We use stub zones in Windows Server 2008 DNS to speed up name resolution in split-domain networks. For instance, the 4sysops.com domain DNS server might have a stub zone for the 4sysopsbackup.com domain. The first domain having a shortcut method of resolving the remote domain’s DNS servers dramatically cuts down on DNS resolution lookups.

Relevant Links:

• Creating and Managing a Stub Zone
• Add a Stub Zone

Start of Authority (SOA)

The SOA record is the most important record in a DNS zone. SOA records contain the global parameters of the zone, including the aforementioned TTL, zone serial number (used in zone transfers), and other critical DNS metadata.

Relevant Links:

• The Structure of a DNS SOA Record
• Modify the Start of Authority (SOA) Resource Record for a Zone

Zone Scavenging

Zone scavenging refers to the Windows Server 2008 feature whereby the server periodically scours its authoritative DNS zones and purges outdated resource records. This process can also be initiated manually by an administrator.

Relevant Links:

• Understanding Aging and Scavenging
• Enable Aging and Scavenging for DNS

Forward and Reverse Lookup

In DNS, forward lookup pertains to the resolution of a target system’s IP address from its host name. Reverse lookup involves name resolution of a host name from a given IP address.

Relevant Links:

• Managing a Forward Lookup Zone
• Reverse Lookup

Conclusion

I hope that you find this approach to 70-640 exam certification study fruitful. Please feel free to leave your questions and comments;

In the next post I will provide a sample practice question for the Configuring DNS Zones topic.

• Windows Server 2008 R2 Server – The perfect workstation OS (15)
• Active Directory Recycle Bin – Restoring deleted AD objects in Windows Server 2008 R2 (2)
• Active Directory Recycle Bin – Restore AD objects in Windows Server 2003/2008 (0)
• Windows Server 2008 R2 Server Core – Sconfig and other new features (2)
• How to raise the Active Directory domain functional level to Server 2008 R2 – Part 1 (0)

• Windows Server 2008 Foundation is available through Original Equipment Manufacturers (OEMs) only. As I understand it, this means you won’t be able to buy the operating system alone. You can only get it pre-installed, along with server hardware.
• Windows Server 2008 Foundation supports only up to 15 users. It doesn’t require client access licenses (CALs), and you can’t buy additional licenses if you have more than 15 users in your organization. However, you need Terminal Server CALs or Rights Management CALs if you intend to use these server roles.
• There are upgrade paths to higher-end versions of Windows Sever. Microsoft didn’t say yet if you have to then re-install the Windows Server 2008.
• Paul Thurrott says the price range will be between $150 and $200 for the software, and together with the server, you probably won’t pay more than $1000 for a Windows Server 2008 Foundation machine.
• Windows Server 2008 Foundation supports Active Directory, but you can only install a single domain controller.
• Windows Server 2008 Foundation will support all major server roles except Hyper-V.
• You can run it only on single processor machines. The CPU can have multiple cores, though.

I think that Windows Server 2008 Foundation is an interesting option for small businesses. The price of the operating system is significantly lower than any other Windows Server edition. Server vendors will offer low cost servers that target small businesses. It probably won’t take long until the first Windows Server 2008 Foundation machines under $500 will be available.

However, I believe such licensing models are anachronistic. I think, cloud providers show how licensing will work in the future. The number of different Windows editions is increasing steadily because Microsoft’s price models are too inflexible. There is always a “product gap” because some businesses don’t fit into any of Microsoft’s licensing patterns.

What if I have 16 users in my organization? Do I really have to pay twice or three times as much as a company with 15 users? Why can’t I use Hyper-V if I have a small business, for a reasonable price? Why can’t I buy the Windows Server 2008 Foundation without hardware and install it on an old PC?

It certainly makes sense to offer Windows at a lower cost for small businesses. The best way would have been to reduce the price of the server software itself, and increase the price for the CALs. If I only have five employees in my company, I certainly don’t want to pay for 15.

Furthermore, I believe that Microsoft should unbundle operating components. If I don’t need the Internet Information Server or Hyper-V, why should I pay for it? The Internet allows software vendors to cut their products into smaller pieces. In former times, when I bought software, I went to the nearest computer shop and grabbed one of those colorful cardboard boxes. Of course, it doesn’t make sense to put each software feature into a new cardboard box. Therefore, bundling software, like Microsoft does it with Windows Server 2008 Foundation, was the only option.

That was yesterday. Nowadays, we download software. Technically, it would be no problem to offer Hyper-V or IIS as an extra download. Many small vendors show how the software business works nowadays. Download the software, pay via PayPal, done. No Ph.D. in licensing required.

I believe that many organizations install Microsoft software illegally because their licensing is much too complicated. Another major reason is that many perceive Microsoft’s price model as unfair. If I only need a simple file server, why do I have to pay for all the other server roles? Isn’t it easier to go to Pirate Bay instead of buying another cardboard box? Therefore, I think it is in Microsoft’s own interest to adapt their licensing model to the Internet age.

Update: More information about Windows Server 2008 foundation can be found here.

• Microsoft Exam 70-640 – DNS Zones – Overview (2)
• Windows Server 2008 step-by-step guides – Don’t waste your time (3)
• New features in Windows Server 2008 (0)
• Download Windows Server 2008 RTM? (6)
• Some more better-together features of Windows Vista – Server 2008 (9)

I skimmed over the Server Manager step-by-step-guide. In this manual, they still talk about “Windows Server Virtualization (wsv)” even though wsv was already renamed to Hyper-V in November. It seems as if even Microsoft’s own employees can’t keep up with the pace by which their marketing renames their products. Even worse is that this paper doesn’t mention that Hyper-V is still in beta. I wonder, if the author of this paper was aware of this fact. Of course, the reader is also kept in the dark that meanwhile there is an update of Hyper-V which has to be downloaded separately.

I did not search for other outdated information in those guides, but I think there is a high probability that the above case is not the only one. There is nothing more annoying than following an inaccurate step-by-step guide. If something doesn’t work as it is supposed to be, you can waste a lot of time only to find out later that the guide is incorrect.

I mentioned before on this blog that it seems like Microsoft can’t cope anymore with the complexity of all its products. I think, instead of trying to enter the Internet advertising market at all costs, they should focus on their core products and adapt them to the online world. If the Yahoo! deal is really successful, I expect more confusion around Microsoft’s products. It is all getting too big.

• Microsoft Exam 70-640 – DNS Zones – Overview (2)
• Windows Server 2008 Foundation – Why Microsoft’s licensing policy is outdated (3)
• New features in Windows Server 2008 (0)
• Download Windows Server 2008 RTM? (6)
• Some more better-together features of Windows Vista – Server 2008 (9)

I’ve been blogging about Server 2008 for quite some time now. Below you’ll find a list of those posts discussing new features. I also recommend skimming over Microsoft’s new white paper: Changes in Functionality from Windows Server 2003 with SP1 to Windows Server 2008. The word file has 341 pages. So you could say it is a free e-book about Windows Server 2008. Of course, you won’t find any critical comments there.

German speaking readers might also have a look at the comprehensive article about Windows Server 2008 I wrote for Computerwoche. I added another chapter about the Terminal Services recently. You will find even more critical words there than in my blog posts.

All in all, I think that Server 2008 is a more interesting product than Windows Vista. Particularly, the consequent modularization, the new Terminal Services, Network Access Protection and Server Core are new functionalities that convinced me, even though I found a couple of shortcomings, too.

• Some more better-together features of Windows Vista – Server 2008
• Windows Server 2008 and Windows Vista – better together?
• Windows Server 2008 prices
• Review: Works With Tool (WWT) for Windows Server 2008
• Windows Server 2008 NAP (Network Access Protection) infrastructure
• Windows Server 2008: Network Access Protection (NAP) essentials
• Windows Server 2008 Terminal Services: Changes of remote administration mode
• Windows Server 2008: Terminal Services new features – Part 2
• Windows Server 2008: Terminal Services new features – Part 1
• Windows Server 2008: Changes in DNS server functionality
• Windows Server 2008: Create and view Active Directory snapshots
• Windows Server 2008: Restartable Active Directory Domain Services (AD DS)
• Windows Server 2008: The disadvantages of RODCs
• Windows Server 2008: How to install and configure an RODC
• Windows Server 2008: Read-Only Domain Controller (RODC)
• Windows Server 2008: Active Directory Auditing
• Windows Server 2008: Fine-grained password policies
• Another top 10 list of Windows Server 2008 features
• Windows Server 2008: Windows Firewall with Advanced Security
• Windows Server 2008: Server roles and Server Manager
• Windows Server 2008 (Longhorn): Getting started with Server Core
• Windows Server 2008: Server Core essentials
• Windows Server Server 2008: 10 most important new features
• The hypervisor of Windows Server 2008: How virtualization works in Microsoft’s new server OS

• Microsoft Exam 70-640 – DNS Zones – Overview (2)
• Windows Server 2008 Foundation – Why Microsoft’s licensing policy is outdated (3)
• Windows Server 2008 step-by-step guides – Don’t waste your time (3)
• Download Windows Server 2008 RTM? (6)
• Some more better-together features of Windows Vista – Server 2008 (9)

As expected, only the more privileged can download Windows Server 2008 RTM at the moment. I guess, their subscriptions have to be justified, next might be Volume Licensing customers, and only then comes the evaluation version.

Well, I can certainly wait a few more days. I have been testing the beta of Windows Server 2008 in detail before and I am quite pleased to see how stable it is. We only need the final to start with compatibility testing. I am also curious to see if there is a new beta version of Hyper-V. You probably have heard that Microsoft’s new virtualization solution will only come out in 180 days.

I think that Windows Server 2008 adoption will be much faster than with Vista. The reason why Server 2008 came out before Vista SP1 is that drivers are not such an issue for servers. There are simply not as many devices as for desktops and laptops. Hardware compatibility problems were probably the number one reason why many downgraded to XP.

Software compatibility is also not that problematic for Server 2008. Vista and Server 2008 share the same architecture. Thus, most software vendors should already be prepared. In particular, many of the bigger software companies operating in the server field are supposed to be ready for Server 2008 by now.

• Microsoft Exam 70-640 – DNS Zones – Overview (2)
• Windows Server 2008 Foundation – Why Microsoft’s licensing policy is outdated (3)
• Windows Server 2008 step-by-step guides – Don’t waste your time (3)
• New features in Windows Server 2008 (0)
• Some more better-together features of Windows Vista – Server 2008 (9)

First of all, I should note that I was quite surprised how difficult it is to find out what these “better-together features” really are. Microsoft’s marketing texts give hints, but they also do their best to disguise the real benefits of Vista+Server 2008. Journalists tend to just copy Microsoft, often without really understanding what it is all about.

I should also mention that my first post about this topic was not 100% correct either. In a comment of my original post, Aaron pointed out that NAP has indeed a feature you can’t have on Windows XP. The NAP agent for XP is not able to verify if Windows Defender is up-to-date. However, he was wrong about the support for Cisco’s NAC. He was probably also wrong about the support of network level authentication in RDP 6.1. I didn’t try this feature, but at least Remote Desktop Connection 6 for XP seems to have it. Aaron was right, though, about the lack of Aero support in RDC 6 for XP. Aero is certainly not available for XP. I think, this demonstrates how difficult it is to get correct information about this topic. And the main reason certainly is that Microsoft wants to push Vista sales with Windows Server 2008.

Anyway, here are the additional Vista+Server 2008 features I found:

Transactional NTFS and Transactional Registry

Vista and Windows Server 2007 both support Transactional NTFS and Transactional Registry. This feature enables applications to group together sets of file and registry operations with a so-called transaction. Basically, that means that a whole set of file system or Registry related operations is executed or none at all. So if the computer crashes before the transaction is completed, you’ll get a system in a consistent state after the reboot. The point is that the operations included in a certain transaction might run on a Server 2008 machine and on a Vista computer. Thus, this feature will improve reliability of applications running on the server and the client if they support Transactional NTFS and Transaction Registry.

Policy-based Quality of Service (QoS)

Vista and Server 2008 allow you to prioritize network traffic using Group Policy. You can assign priorities for applications, IP addresses, and TCP ports. In networks with limited capacity, traffic throttling can turn out to be quite useful if you have to deal with bandwidth sensitive application such as real time conferencing. Even though you don’t need Windows Server 2008 to work with QoS on Vista, there might be cases where you want to prioritize network usage on the server and the client. More information about the QoS feature of Vista can be found in this white paper.

Caching of server resources

Microsoft listed other features which I am unsure what they actually do or what makes them special in a Vista-Server 2008 environment. For instance, the fact that Server 2008 allows clients to cache locally “server resources” “so that they are available even if the server is not”. I have absolutely no idea what these “server resources” are supposed to be. The first thing that comes to mind is the caching of a network share. But that is already possible with Windows Server 2003. Please, let me know if you know more about this topic.

Windows Search

Another feature often mentioned is Windows Search. Vista and Server 2008 come with a new indexing service allowing you to not only search for files on the desktop but also on network shares much faster than under XP/Server 2003. This is certainly a nice feature. However, if you look at this comparison table, you will see that you can have the same feature with Windows Desktop Search. Of course, you have to install it first on your clients and your servers. With Vista/Server 2008 you save this work.

Terminal Services Gateway

TS Gateway is a new feature of Windows Server 2008 that allows RDP clients to establish an encrypted connection to a Terminal Server via HTTPS. That is certainly also a nice feature, but it is supported by Remote Desktop Connection 6 for Windows XP as well. So if this is the only new feature you need, it probably won’t be enough reason to convince you to move your clients to Vista.

The strategy of Microsoft’s marketing seems to be just randomly listing features of Vista or Server 2008 to convince customers that both operating systems work better together. You could as well include Internet Explorer 7 or the Windows Firewall which Windows XP/2003 RTM lack.

Anyhow, there are certainly some interesting Vista+Server 2008 features. My research about this topic just showed that you shouldn’t just buy anything you read about it in IT magazines and especially if it comes from Microsoft.

• Microsoft Exam 70-640 – DNS Zones – Overview (2)
• How to store a laptop battery properly to save it from an early death (13)
• How to charge and discharge laptop batteries to extend their lifetime (26)
• How to take care of your laptop battery to prolong its lifespan (7)
• Windows Server 2008 Foundation – Why Microsoft’s licensing policy is outdated (3)

A part of this post is based on Microsoft’s article about Vista and Server 2008. During my research, I found a couple of articles in IT magazines that for the most part just rephrased that MS article. This is a pity because Microsoft’s paper is a bit misleading. It often cites Vista features that work together with Server 2008, but will also be supported by Windows XP. One example is the support of Network Access Protection (NAP) which will be available for Windows XP SP3. Of course, if you want to use these features you have to install the corresponding components on XP first, which you can avoid if you already deployed Vista. Other examples are the new RDP client (Remote Desktop Connect 6) and IPv6 support. However, since you can have these features for free on XP machines I don’t count them as arguments for deploying Vista together with Server 2008.

Okay then, here are the features I found thus far that could make Windows Vista and Windows Server 2008 a better team.

User interface

Vista and Server 2008 share about 70% of their code base. The similarities of these two operating systems are obvious. Even though you usually won’t use Aero on Server 2008, the user interfaces of both operating systems are quite similar. So if you are familiar with Vista, you will find your way on Server 2008 pretty fast. If you only have to deal with one kind of user interface in the future, it will make your work easier.

New core features

This is not only applicable to the user interface, but also to many new features. Examples are the new Event Viewer, the Reliability and Performance monitor or the new Task Scheduler. Thus, the learning curve for admins that are familiar with Vista is quite flat as far as the core features are concerned.

Patch management

The common code base also affects patch management. That is, you’ll often have the same patches for both operating systems which might reduce the amount of time you need to test them before you deploy them in your network.

OS deployment

In my view, the most important new feature of Vista is its new imaging technology. You can clone one and the same image to every kind of hardware. This allows you to create the images in a virtual environment using VMware Workstation or Virtual PC and deploy it to all your PCs regardless of whether they are old or new, desktop or laptop with AMD or Intel CPUs. Windows Server 2008 has the same cloning capabilities. This means that you can rely on just one deployment method for all your machines if you only have to support Vista and Server 2008. OS deployment with Windows XP/2003 works quite different and is much more time consuming. This is especially true if your organization still relies on unattended installations.

Event log forwarding

Vista and Server 2008 both support event subscriptions. This feature allows you to subscribe to the event logs of multiple machines. The Event Viewer has a filter which enables you to subscribe to only those events that interest you. If you only have Vista and Server 2008 in your network, then you can monitor the event logs of all your clients and servers on a single machine. It is possible to do that on a Vista machine, but it probably makes more sense to collect all event logs that are important for you on a Windows Server 2008 computer. Of course, you can do this also with third party software such as EventSentry or LogMeister on Windows XP/2003.

Event log structure

The new Event Viewer is certainly a nice improvement, but it is still not a match for sophisticated event-log monitoring solutions. But even if you use a third party event log tool, you’ll benefit from the extended logging capabilities of Vista and Server 2008. You probably know that Vista and Server 2008 offer a lot more event logs than Windows XP/2003. This will certainly simplify troubleshooting and also improves security because it will be much easier to stay informed about what is going on in your network. Since the event log structures of Vista and Server 2008 are so similar, it will be much easier, if you only have to deal with their event logs. Event log management can get quite complicated. If you have to monitor the event log of different kinds of operating systems, it will certainly be more time consuming.

Network-performance improvements

Both Vista and Server 2008 have a new network stack with a couple of interesting new features. In most cases, these new features only come into play if both parties support them. Since Vista usually connects to a Windows server in a corporate environment, you can only benefit from these improvements if you run Vista and Server 2008 together.

One example is the Receive Window Auto-Tuning feature. Expressed in simple terms, the TCP receive window specifies how much data can be sent by the transmitter before requiring an acknowledgment. If the available bandwidth is high, a larger TCP receive window is possible. Auto-tuning means that the receive window is adjusted automatically to the available bandwidth. Hence, in networks with changing bandwidth you will see an improved average network throughput rate with this feature.

Another example is SMB 2 (Server Message Block). SMB is the application-level protocol that is used in Windows networks for accessing file or print shares. Windows Vista and Windows Server 2008 support SMB 2. If a Vista machines connects to Windows Server 2003, it will use the older SMB version and if it is Windows Server 2008, SMB 2 will come into play. SMB 2 has a couple of new features that improve network performance. It allows multiple actions in a single request (reduces the number of round-trips), supports larger buffer sizes (improves performance with large files), and supports “durable file handles” (reduces interruptions in case of short network outages).

XPS support

Vista clients can render print jobs locally using the XPS format (XML Paper Specification), Microsoft’s PDF alternative. This reduces the load on your printer server if it supports XPS. I didn’t try this feature yet, but as far I understand it, only Windows Server 2008 supports it and not Windows Server 2003. Please, let me know if you have more information more about this topic. My research about it was not really successful.

AES encrypted Kerberos tickets

Windows domains use the Kerberos protocol for authentication. Kerberos supports ticket encryption using AES (Advanced Encryption Standard) since version 5, but Microsoft has implemented it only now in Vista and Server 2008. This should improve security in Windows domains. However, AES encryption is only used if client and server run Vista/Server 2008, and if the server that issues the Kerberos tickets, i.e. the KDC (Key Distribution Center), runs Windows Server 2008, too. In all other scenarios, the old method using the weaker encryption method, i.e. RC4 or DES (Data Encryption Standard) is used. More information about this topic can be found in the Active Directory blog.

Heterogeneous environments are more error-prone

The last subject is a typical example of how mixed environments with different Windows version can cause troubles. With two different authentication methods, things get more complex and are therefore more error-prone. Another example is the different ways roaming user profiles are handled in Windows Vista/Server 2008 and Windows XP/Server 2003. You will have to invest some extra efforts, if you want to allow your users to logon on different Windows versions.

Organizations moving their whole infrastructure to Vista and Server 2008 will have less administration costs because of the similarities between the operating systems. I remember quite well when we started installing the first Windows 2000 machines. Windows NT and Windows 2000/XP didn’t really fit together. So we wanted to get rid of NT as fast as possible. I think, it won’t be any different with Vista and Server 2008. The more homogenous your network is, the easier it is to manage. Therefore, if you want Server 2008 you’ll also want Vista. Of course, you always have the option to just stick with Windows XP and Windows Server 2003. But to my experience, it is only a matter of time until you discover a must-have feature of Vista or Server 2008 for your environment. And if you start deploying either Vista or Server 2008, you will soon be in a situation where you want to move your complete network to the new versions.

Please, let me know if you are aware of other features that can only be used if Vista and Server 2008 are deployed together. I am also curious about the opinions of the Vista skeptics. Do you believe that you can get some of the above-mentioned features with Windows XP and Windows Server 2003? Are these features important or can you easily do without them?

• Microsoft Exam 70-640 – DNS Zones – Overview (2)
• How to store a laptop battery properly to save it from an early death (13)
• How to charge and discharge laptop batteries to extend their lifetime (26)
• How to take care of your laptop battery to prolong its lifespan (7)
• Windows Server 2008 Foundation – Why Microsoft’s licensing policy is outdated (3)

I find it a bit strange that false release dates about Microsoft products are published, often. Usually, the authors claim to have this information from Microsoft insiders. Are they just inventing those release dates or are even Microsoft employees sometimes confused about them? The fact that McClaws, a Microsoft employee, mentioned the false ship date in his blog, is an indication for the latter. When he removed this post, I already suspected that it was just a hoax.

Since Service Pack 1 for Vista will probably be released together with Windows Server 2008, I suppose, it will also be available only at the end of February. I think there is a fair chance that Windows XP SP3 will come out around the same time.

• Microsoft Exam 70-640 – DNS Zones – Overview (2)
• Windows Server 2008 Foundation – Why Microsoft’s licensing policy is outdated (3)
• Tweets: Windows 7 video fake – Sysprep for Windows XP SP3 (0)
• The Windows XP SP3 confusion – Is Windows bloated or its market? (6)
• Is Windows XP SP3 available or not? (16)

I added the page views behind the title of the article. The numbers are from Google Analytics. Note that they do not represent the absolute page views in 2007 since I started using Google Analytics only at the end of March.

1. How to disable Vista’s desktop search indexing (Windows Search) 49299
2. Expanding a virtual VMware disk 42539
3. Install Windows Server 2003 Adminpak (Administration Tools Pack) on Vista 34035
4. Adminpak for Windows Vista 33013
5. Vista x64 vs. Vista x86 – 32 bit or 64 bit Vista edition? 29714
6. ioDrive: 640 GB flash card almost at the speed of DRAM – The end of hard drives? 27027
7. Windows Vista 32-bit versus Vista 64-bit 21264
8. Resize a Virtual Disk with VMware Converter 15763
9. Vista compatibility update for the Adminpak 12174
10. Three ways to reset a Windows Vista admin password 11378

I must admit that I was a bit surprised that the most read article was about Vista’s desktop search indexing. It appears to be one of the new Vista features that were a flop.

However, the most popular topic was another one. Three articles about the Adminpak problem made it in the top ten. I still don’t understand why Microsoft neglected this issue. Aren’t the admins the ones who have to be persuaded first to move to a new operating system version?

Also interesting is the number of people that have had problems with expanding VMware disks. When I first came across this issue I couldn’t believe that VMware didn’t offer a simpler solution.

Not so surprising is that many were unsure if they should install Vista x86 or Vista x64. I suppose that the 64-bit edition will soon gain more popularity. At the moment 3GB are enough for most users. However, I think that in one year many power users will already thirst after more memory.

So what are the prospects for 2008? I guess the number one topic will be Windows Server 2008. I already posted a lot about it and I am sure there will be more to blog about it as soon as its final becomes available. By the way, my German speaking readers (I know there are many) might be interested in an article about Windows Server 2008 I am writing for the German magazine Computerwoche. I am constantly extending it since it is a wiki entry.

Another thing I will concentrate on in 2008 is finding new sponsors for 4sysops. You might have realized that I removed Adsense some weeks ago. It simply didn’t perform well recently. Blogging is certainly fun, but it is even more fun if you can earn a little with it. So I also have to say thanks to my new sponsors Special Operations Software and NETIKUS.NET.

Ok then, enough blogging for this year. Happy new year!

• Microsoft Exam 70-640 – DNS Zones – Overview (2)
• Why only (I)T will matter (8)
• Poll results: IT employment (2)
• Five tips to persuade management about a new investment in IT (1)
• FREE: vWorkspace Desktop Optimizer – Optimize VDI performance (0)

• Microsoft Exam 70-640 – DNS Zones – Overview (2)
• Windows Server 2008 Foundation – Why Microsoft’s licensing policy is outdated (3)
• Windows Server 2008 step-by-step guides – Don’t waste your time (3)
• New features in Windows Server 2008 (0)
• Download Windows Server 2008 RTM? (6)

Group Policy Preferences allow you to configure many more details than with regular Group Policies. I will blog more about it next week.

It seems to me that an RC1 domain controller boots up and also shuts down much faster than under Windows Server 2003. You probably realized that domain controllers usually need quite some time until they are ready to shutdown. The Active Directory database of my test machine did not have much data, though.

It is interesting to note that Windows Server 2008 RC1 is released at the same time as Vista SP1 RC1. Obviously, they are connected. I think, it is predictable that many organizations will deploy Vista SP1 and Windows 2008 together.

• Microsoft Exam 70-640 – DNS Zones – Overview (2)
• Windows Server 2008 Foundation – Why Microsoft’s licensing policy is outdated (3)
• Windows Server 2008 step-by-step guides – Don’t waste your time (3)
• New features in Windows Server 2008 (0)
• Download Windows Server 2008 RTM? (6)

These seem to be the main points of Essential Business Server:

• Editions: There is Standard Edition and Premium Edition
• The Standard Edition comes with three server types: Management Server, Messaging Server, Security Server; The Premium Edition has a Database Server also.
• Management Server: Windows Server 2008, System Center Essentials
• Messaging Server: Windows Server 2008, Exchange Server 2007 and Forefront Security for Exchange Server
• Security Server: Windows Server 2008, Exchange Server 2007 gateway, ISA (Internet Security and Acceleration) Server
• Database Server: Windows Server 2008, SQL Server 2008 Standard Edition
• Licensing: There is a unified server license and a special EBS CAL (Client Access License), maximum is 250 clients; there is an upgrade license available to unlock the EBS restriction
• Management console: lets you monitor the health of all servers, track down problems, and “points administrators in the right direction to get tasks accomplished; third party vendors can utilize this console
• Remote Web Workplace: remotely access email and shared resources

Considering that the Windows environment gets more and more complex, it makes sense to offer such a product which can help administrators of smaller businesses handle their servers in an easier way. However, one also has to take into account that the majority of Windows shops probably prefer the regular products. So if you run into problems, you can never be sure if it is just an EBS issue.

• Microsoft Exam 70-640 – DNS Zones – Overview (2)
• Windows Server 2008 Foundation – Why Microsoft’s licensing policy is outdated (3)
• Windows Server 2008 step-by-step guides – Don’t waste your time (3)
• New features in Windows Server 2008 (0)
• Download Windows Server 2008 RTM? (6)

• Microsoft Exam 70-640 – DNS Zones – Overview (2)
• Windows Server 2008 Foundation – Why Microsoft’s licensing policy is outdated (3)
• Windows Server 2008 step-by-step guides – Don’t waste your time (3)
• New features in Windows Server 2008 (0)
• Download Windows Server 2008 RTM? (6)

The update should be available on Microsoft Connect. Unfortunately, I wasn’t able to access it. Perhaps it isn’t available to the public yet. I am curious in what way WSUS is integrated in Server Manager.

It is certainly nice if you can manage all Windows-related backend apps with one central management tool. However, it would be even more interesting if you can install and download non-Windows products via Server Manager.

I find this feature in yast very useful. It saves a lot of time if you don’t have to search and download all prerequisites for a certain application, separately. With yast, you can just search for the tool you want to install and it will then tell you what other components have to be installed. It then downloads the latest versions of all programs and installs them in the right order. Of course, you can update everything via yast, too.

If you were able to try the WSUS integration in Server Manager, please let us know how this works exactly.

• Microsoft Exam 70-640 – DNS Zones – Overview (2)
• Windows Update errors – A troubleshooting guide (2)
• FREE: WSUS Offline Update – Update Windows and Office without an Internet connection (1)
• FREE: WSUS ClientManager for Workgroups – Add computers to a WSUS server (0)
• Turn off automatic Windows Update reboots (10)

Of course, the reason is not that producing Vista was more expensive than Windows Server 2008. Both operating systems have much in common. You could say that Windows Server 2008 just has some additional features. The market for Windows 2008 is smaller than for Vista, but Microsoft is growing faster here. Since there is a bigger demand, they could have raised the prices.

However, there is only one reason why Microsoft keeps the prices low for server products. In the desktop market customers don’t have much choice, mostly because competitors are too weak here. In the server market, things look a bit different. But Microsoft is on the right track when it comes to having a monopoly in this market as well. And that’s likely to happen soon. Windows Server 2008 could be a milestone in this project.

For us customers, this means nothing good. This could be the last time we’ll enjoy these relatively modest prices:

• Windows Server 2008 Standard, $999 (with five Client Access Licenses, or CALs)
• Standard without Hyper-V, $971 (with five CALs);
• Enterprise, $3,999 (with 25 CALs)
• Enterprise without Hyper-V, $3,971 (with 25 CALs)
• Datacenter, $2,999 (per processor)
• Datacenter without Hyper-V, $2,971 (per processor)
• Windows Server 2008 for Itanium-based Systems, $2,999 (per processor)
• Windows Web Server 2008, $469

• Microsoft Exam 70-640 – DNS Zones – Overview (2)
• Windows Server 2008 Foundation – Why Microsoft’s licensing policy is outdated (3)
• Windows Server 2008 step-by-step guides – Don’t waste your time (3)
• New features in Windows Server 2008 (0)
• Download Windows Server 2008 RTM? (6)

WWT has an easy-to-use wizard that guides you thru the software evaluation process. It works a little like a software packager. WWT compares the system before and after the installation of the application. It will then give you information about the files installed such as their location, their version number, if they were signed, etc.

Next you have to check the functionality of your application. WWT will display a form where you have to answer several questions about the results of the test. For example, you have to tell WWT if the system and the application remained stable, if you experienced data loss and so on.

WWT can create an HTML report or you can store the results of your tests in a submission package which you could send to your software vendor. If they also use WWT they can examine the results of your test this way.

I doubt that we will use WWT to test our applications. The tool certainly can’t perform automated tests. If you really want to know if an application is working properly under Windows Server 2008, you have to check its functionality, manually. I wouldn’t use software anyway on a new OS if this isn’t supported officially by its vendor. And if you want to create a report of an evaluation process of a self-developed application, you usually have to add application specific data. WWT doesn’t offer a way to include such information.

• Microsoft Exam 70-640 – DNS Zones – Overview (2)
• Windows Server 2008 Foundation – Why Microsoft’s licensing policy is outdated (3)
• Windows Server 2008 step-by-step guides – Don’t waste your time (3)
• New features in Windows Server 2008 (0)
• Download Windows Server 2008 RTM? (6)

Citrix announced that they will support Microsoft’s VHD (Virtual Hard Disk) format. This is not really surprising since XenSource already declared that long before Citrix acquired them. However, it’s new to me that Citrix’s Presentation Server, Desktop Server and virtual appliance solutions will also use the VHD format. VMware will certainly notice this with interest.

The ongoing cooperation between Citrix and Microsoft revives the acquisitions fantasies that were spreading on the Web for quite some time now. Actually, when I first saw Winframe, the predecessor of Metaframe, I already expected that Microsoft would buy them. This was before Microsoft had its own terminal server solution. If they buy them now, then XenSource would belong to Microsoft. That’s an interesting thought.

• Microsoft Exam 70-640 – DNS Zones – Overview (2)
• Hyper-V upgrade – Conclusion (4)
• Hyper-V upgrade – The process (2)
• Why I am upgrading from Hyper-V 1.0 to 2.0 (0)
• SCVMM 2012 review – Part 6: Self-service empowerment, service deployment and conclusion (1)

There are two different kinds of SHV policies with respect to updates. One is called “Automatic Updates” and the other one “Security Update Protection“. The latter offers two other options: “Windows Update” and “Windows Server Update Services“. And below that you will find this: “Note: Clients may always get their updates from Microsoft Update“. What the hell is the difference between Automatic Updates and Security Update Protection using Windows Update? And what’s about Microsoft Update? Isn’t that another update service? If you are confused now, then you should read ahead. If not, then you are released for today.

The most important difference is the one between Windows Update and Microsoft Update. Windows Update allows you to patch Windows and Microsoft Update patches Windows and some other Microsoft applications (Microsoft Office, SQL Server, Exchange). In Windows XP/2003 you only can use Microsoft Update if you have the latest Windows Update Agent installed. You can do this thru Windows Update configuration which you can find in the Help and Support Center. Microsoft Update is then enabled by default, but you can disable it by clicking on “Change settings”. In Vista, you can change this setting in the Control Panel under System. Okay, that’s easy, so far.

But what is “Automatic Updates” then? Windows Update and Microsoft Update are also Web sites where you can download updates manually. “Automatic Updates” is not another service, it just means that the Windows Update Agent schedules the download updates automatically, regardless of whether you are using Windows Update or Microsoft Update.

However, “Automatic Updates” can mean something else sometimes. In Windows XP/2003 it is the name of the service of the Windows Update Agent. Now guess how this service is called in Windows Vista and Windows Server 2008? Its name is “Windows Update”. Note that this Windows Update service not only downloads from Windows Update but also from Microsoft Update. So sometimes “Windows Update” and “Automatic Updates” just refer to the same thing, i.e. to the Windows Update Agent service.

To come back to my starting point, why does NAP distinguish between Automatic Updates and Windows Update?

If you enable Security Update Protection, it just means that the NAP client is compliant if it got the latest security updates installed, regardless if they were downloaded from a WSUS server, Microsoft’s patch management solution, from Windows Update or Microsoft Update. However, you can also restrict the possible download source to Windows Update or WSUS.

If you check Automatic Updates in the NAP configuration, it only means that the Windows Update Agent is set to download updates automatically no matter if the download source is Windows Update, Microsoft Update or your local WSUS server. Note that even if Automatic Updates is activated, the client might not have the latest updates installed, for example if it wasn’t online for some time.

In my view, Microsoft’s terminology is quite confusing. Why not just one Update service and one term for it? Well, I hope that after blogging about it, I won’t get confused again about this.

• Microsoft Exam 70-640 – DNS Zones – Overview (2)
• Windows Update errors – A troubleshooting guide (2)
• FREE: WSUS Offline Update – Update Windows and Office without an Internet connection (1)
• FREE: WSUS ClientManager for Workgroups – Add computers to a WSUS server (0)
• Turn off automatic Windows Update reboots (10)

According to Malone, Windows Server 2008 is feature complete now. This probably also means that the new hypervisor will really become part of the operating system even though the final of WSV supposedly will only be released within 180 days of the release of Windows Server 2008. Perilli is speculating that Microsoft is planning a hypervisor version for Vista. That could mean that WSV might not only replace Virtual Server 2005 but also Virtual PC 2007 in the long run.

I always wondered how the hypervisor will be integrated in Windows Server 2008. I read before that WSV will be just another server role. Although this seems to be true, adding the WSV role changes more than usual. It will transform the OS in hypervisor mode which means that Windows will be moved to the so-called parent partition.

This is comparable to VMware’s ESX Server. VMware just utilizes a version of Red Hat Linux instead of Windows. One advantage of WSV over ESX will be that the device driver support for Windows is a bit better. ESX will certainly have more advantages, especially because Microsoft dropped some very important WSV features (live migration capabilities, support for up to 32 processor cores, hot-adding of storage, networking hardware, memory, and processors).

• Microsoft Exam 70-640 – DNS Zones – Overview (2)
• Hyper-V upgrade – Conclusion (4)
• Hyper-V upgrade – The process (2)
• Why I am upgrading from Hyper-V 1.0 to 2.0 (0)
• SCVMM 2012 review – Part 6: Self-service empowerment, service deployment and conclusion (1)

If you have read already some of Microsoft’s white papers about this topic, you’ll realize that my description is quite simplified. But, I think, it is easier to understand and memorize this way.

NAP client The NAP client consists of three layers: the System Health Agents (SHA), the NAP Agent, and the Enforcement Clients (EC). There are also APIs allowing third-party vendors to integrate their own SHAs and ECs in Microsoft’s NAP infrastructure.

System Health Agent (SHA) The SHA checks if certain system health requirements are fulfilled. The SHA that comes with Vista and Windows Server 2008 can verify whether the following conditions are met: Windows Firewall is on; antivirus and antispyware software are installed, enabled, and updated; Microsoft Update Services is enabled, and the most recent security updates are installed. If the system is not in the required state, the SHA can then start a process to remedy the situation. For example, it can enable Windows Firewall or contact a remediation server to update the antivirus signatures.

NAP Agent Sometimes this component is also called Quarantine Agent. It maintains the health state information and facilitates the communication between the SHAs and the ECs.

Enforcement Client (EC) Sometimes you will also find this as the Quarantine Enforcement Client (QEC). Each NAP enforcement method has its own EC. So there is a DHCP EC and an IPsec EC, for example. Usually, they are integrated with the corresponding service client. So the DHCP EC is a part of the DHCP client. Its main function is to communicate with the server side NAP infrastructure, thereby, enforcing the quarantine of the client if the health requirements are not met. It is the only client component that interacts with the NAP infrastructure on the server side.

Let’s look at the server side of the NAP infrastructure.

Enforcement Server (ES) This can also be referred to as the Quarantine Enforcement Server (QES). The NAP ES communicates with its corresponding NAP EC. Each enforcement method has its own ES and is integrated in the corresponding service. For example, the DHCP ES is a part of the DHCP Server. Essentially, the ES has the same functions as the EC. It is the interface between the server side NAP infrastructure and the client side, and ensures that noncompliant clients are quarantined. For example, the DHCP ES would make sure that a DHCP server issues the network mask 255.255.255.255 to noncompliant clients. This way they can’t access other computers in the network.

NAP Server A NAP server is just another name for a NAP-enabled server component. So a DHCP server supporting NAP is a NAP server, for example. Don’t confuse it with a NAP Health Policy Server.

NAP Health Policy Server (NPS) The NPS consists of the NPS Service, the NAP Administration Server and the System Health Validator (SHV) components.

System Health Validator (SHV) Each SHV has a corresponding SHA on the client side. It is here where you define the health requirements for your whole network. Windows Server 2008 comes with just one SHV allowing you to choose among the health requirements mentioned above (Windows Firewall enabled, antivirus software updated etc). Third-party vendors can integrate their own SHVs here.

NAP Administration Server The NAP Administration Server is kind of a distributor and integrator for NAP information. Information that comes from the NPS service is distributed to the different SHVs. Each SHV only receives the information which is relevant for it. The information that comes from the different SHVs is integrated in one message and passed on to the NPS Service.

NPS Service The NPS Service communicates with the NAP Server using the RADIUS protocol. It is kind of an interface between the NAP server and the NAP Administration Server.

The figure below is a simplified representation of the NAP infrastructure. It assumes that just one enforcement method (DHCP) is used and no third party extensions are involved. The arrows signify the communication paths between the NAP components.

Related: Windows Server 2008: Network Access Protection (NAP) essentials

• Microsoft Exam 70-640 – DNS Zones – Overview (2)
• Windows Server 2008 Foundation – Why Microsoft’s licensing policy is outdated (3)
• Windows Server 2008 step-by-step guides – Don’t waste your time (3)
• New features in Windows Server 2008 (0)
• Download Windows Server 2008 RTM? (6)