Keep IT simple - Use RDWeb instead of Site-to-Site VPN

So you have a couple of users moving from the main office to a new office (say they're moving to the public works garage) that is located miles away from the main office. These users need to still be able to use the business application but don't need anything else from the business network and security isn't a high concern. At the remote office the two users will need basic internet, ability to print, and have access to the business application; nothing else is needed. What do you do? Do you buy an expensive firewall to build a site-to-site vpn connection to the main office? Or, since you already have RDWeb implemented for remote use of applications, do you use RDWeb? The cheapest and most efficient solution would be to go with RDWeb. If you're not familiar with RDWeb, I suggest you do some reading on it, but for now know that RDWeb is a feature of Windows Server that builds a portal to essential applications and remote desktop access your employees need either remotely or locally.

Why do I say use RDWeb instead of the VPN connection? Well because RDWeb is simpler. What you can do is give the two users computers with encrypted hard drives, a solid anti-malware solution (I suggest malwarebytes PRO along with Microsoft Security Essentials\Defender and then have OpenDNS at the border), and decent internet bandwidth to give them a great working environment. RDWeb will provide access (securely) to the work application(s) and they can use it almost 99% the way they used it before at the main office. For situations like this, RDWeb trumps the other method of site-to-site VPN because it requires less setup, equipment, and time.

I know for other situations where high-security is a primary concern, file shares are needed, printers are manged from the main network, etc. RDWeb may not be the ideal choice but for a situation like the one described above where the two users just need access to the business application(s) then RDWeb is the clear winner I think. It was the winner at work. The situation described above is a real-world scenario. My work will have a new public works garage and two of our users will be leaving the main office to work out at the new garage. We already have RDWeb in place for remote users so the two users will access the business application through our portal.

One of the things to keep in my mind with any project, especially IT projects, is to keep the solution simple.

Don't be scared of virtualization

Occasionally I talk with an IT guy who is scared to death of virtualization. Why the fear? Well the typical answer I get is that "it's complicated" or "expensive" or "I have no experience with it; going forward with it would be risky." If you're a virtualization tech of any stripe you'll know these worries can be easily erased. My own work experience with Hyper-V is a great answer to these techs who are scared (no offense) of virtualization. Why do I say don't be scared? I say don't be scared of virtualization because 1) you have no reason to be and 2) virtualization is super helpful for the most ordinary of IT projects.

At work we needed to implement Server 2008 R2's RDWeb services to enable our work application to be available to users who are away from our main office and for users who needed to access the application when they're sick, on vacation, etc. When the concern was approached to me, I immediately thought of R2's RDWeb services and pitched the idea to a group of people who were not interested in buying a new server. They assumed to use the RDWeb service we would need to purchase new hardware and that just wasn't going to happen (I work for local government and money is tight!). I told them they didn't have to worry about purchasing new hardware because of Hyper-V! We were limited to the 2008 version of Hyper-V, so we aren't able to use features like dynamic memory and bandwidth management but the point I made to them and want to make here is that even 2008's Hyper-V can make the simplest of IT projects, e.g. rolling out RDWeb, even simpler and much, much cheaper than going with new hardware. The only purchase made was five Remote Desktop Services CALs! The rest of the project requirements were already owned by us which was awesome. If we didn't go the virtualization route we would have made a lot of purchases in hardware. So I added the Hyper-V role to an existing Windows Server 2008 machine, configured the RDWeb virtual machine, installed a copy of Windows Server 2008 R2 on the VM, installed and configured RDWeb on the virtual machine, made the necessary configurations in our Sonicwall TZ210 and then we were all set. Virtualization made that project so much easier than the alternative which is to buy new hardware, make room for that hardware, oh and convince the treasurer and company to make those purchases. For us, the project only cost us a couple of hundred dollars and RDWeb has helped us out a lot. Virtualizaton was the obvious route to take.

Don't be scared of virtualization! Implementing Hyper-V, Citrix, or VMWare doesn't mean you have to setup live migrations, virtual storage, virtual networks, VDI, or whatever else is intimidating to you; all it can mean is that you're going to use a virtual machine instead of a physical machine for your project. Try it out, even if it's in a lab at first. You can download trial copies of Server 2012 and Windows 8 to tinker around with virtualization if you haven't yet. Keith Mayer has awesome lab exercises for you to try and I know from personal experience that his lab exercises are awesome because I've used them multiple times! Again, don't be scared of virtualization because the benefits and range of uses are too great for you to not use because you're a little intimidated. 

Disk Management refresher

In Windows Server 2012, disk management is arguably defeated by server manager, powershell, and storage spaces. However, not every business (small, medium, or large) is going to make a quick move to Server 2012. What that means is that the IT pro needs to know the basics.

I found this great post at TechNet on implementing disk management. In it the reader will learn disk terms and how to use disk management for creating and managing basic and dynamic disks, software RAID, enabling quotas, and enabling encryption.

Enjoy!

Implementing Disk Management

A Server 2012 Core Survival Guide - Fun!

Runas Radio has a very cool podcast on DHCP high availability in server 2012. The tech in the podcast interviewed has a blog and he is currently doing a series of posts on what he called, "A Server 2012 Core Survival Guide." It's an interesting series so far because of the scenario for the series.

You are a server administrator with a Windows Server 2012 deployed with only the core interface. You cannot Remote Desktop, Remote PowerShell, or ping the box. You still have access to the console by walking up to it.

So each post has that scenario in mind. Check it out.

Bruce Adamczak PFE Blog 2012 Core Survival Guide

Customize an RDP file for a Specific RDWeb user

Do you have some rdweb users who would like to rdp to their desktop from the rdweb portal, but are uncomfortable with the method used in the rdweb portal? It's kind of a long process to login to rdweb, mouse over to 'remote desktop' then plug in the desktop information, etc. What if the user had an rdp file that looked and acted like an app in the remoteapps list? That would be great you say? Then let's do it.

*There might be an easier way than this and if there is please let me know about it*

First, launch remote desktop connection.
Input the user specific information in the fields.

Second, save it as an rdp file.

Third, (only do this if your user's desktop has dual-monitors) open the rdp file in notepad to add some information.
If you user's desktop has dual monitors and the system is Windows 7 ultimate or enterprise then add the following to the end of the rdp file that is opened in notepad: use multimon:i:1

If the users' desktop has dual monitors and running pre-Windows 7 ultimate or enterprise (e.g., windows 7 pro or Windows Vista) then add the following to the end of the rdp file: span monitors:i:1

What is the difference between span and multimon?

From MSDN blog

"Span mode, introduced in Vista, allows the remote desktop to span across all monitors on the client as long as the monitors are arranged to form a rectangle. The remote session created when using span mode is still a single-monitor session. With multimon support, each monitor on the client machine is viewed as a distinct monitor in the remote session. Due to this fundamental difference, span mode has some restrictions that true multimon does not:
1. The primary monitor must be leftmost.
2. The set of monitors must form a rectangle (i.e. identical vertical resolution, and lined up in exact straight line).
3. The total of the resolutions must be below 4096x2048 (ex. 1600x1200+1600x1200 = 3200x1200)."

Multimon "...for Remote Desktop Services allows users to open a Remote Desktop connection expanded across all the monitors on the client computer regardless of the client monitor configuration. With this feature, the user can fully utilize all the monitors connected to the client computer for the Remote Desktop connection thereby providing extra desktop space and an almost seamless experience with the client desktop that is much improved over “Span mode”. "

Fourth, add the rdp file to the remoteapp programs list in your rdweb server.
Go to "remoteapp manger."
Click "add remoteapp programs."
Next.
Browse.
Make sure "all files (*.*)" is selected in the dropdown box. After you've found your custom rdp file select Open.
Next and finish.

Fifth, customize view permissions for the rdp file.
Under remoteapp programs in remoteapp manger, right click the rdp file then select properties. Select user assignment then select "specified domain users and domain groups." Click add. Since this is a specific user rdp file select the appropriate user profile for the rdp file.
OK it.
Then OK in remoteapp properties.

Now, say all of this was for Jane Austen. She will login to the RDWeb portal, see the file you've added to remoteapp programs for her profile, run it then have access to her work desktop. This is much easier compared to the default route.

Make file explorer available in RDWeb

I thought this was pretty cool. This may not be anything new for RDWeb pros, but I discovered this possibility the other day and thought, "Why not share this on my blog?"

First things first: I haven't found a way to make the file explorer match the logged in user's profile, e.g. if jausten logs in to RDWeb, runs file explorer then she will see all of the available folders instead of only seeing her own documents folder. Why? Because this file explorer is the file explorer on the RDWeb server instead of the file explorer that is in jausten's ad profile. Make sense?

Login to your RDWeb server.
Launch remoteapp manager. 
Click add remoteapp program. 
In the "choose programs to add to the..." window, click browse 
In the "choose a program" explorer window browser to c:\windows then choose explorer.exe
Next
Finish 

File explorer is now a part of the remoteapp programs on your RDWeb site. Cool. Just remember to tell your users not to treat the file explorer as their work drive for their own documents. Then why add the file explorer to the remoteapps list? Example: if your rdweb users are on a team then they can share their project files there.There are other examples I'm sure.

Please let me know if you are going to or have done anything with file explorer in rdweb beyond what I have done in this blog post. I would like to hear about it.

Hyper-V 3.0 Best Practices Checklist

The Ask PFE Platforms blog has an excellent post on Windows Server 2012 Hyper-V best practices and it's actually in-depth. I'm only sharing the "general" section for the host not the vms because there are many things to checkoff your roll-out list before you even get to the "deep" things of rolling out a Hyper-V environment.

Excerpt from the blog post:
GENERAL (HOST):
⎕ Use Server Core, if possible, to reduce OS overhead, reduce potential attack surface, and to minimize reboots (due to fewer software updates).

• For more information: http://msdn.microsoft.com/en-us/library/windows/desktop/hh846313(v=vs.85).aspx

⎕ Ensure hosts are up-to-date with recommended Microsoft updates, to ensure critical patches and updates – addressing security concerns or fixes to the core OS – are applied.
⎕ Ensure all applicable Hyper-V hotfixes and Cluster hotfixes (if applicable) have been applied. Review the following sites and compare it to your environment, since not all hotfixes will be applicable:

· Update List for Windows Server 2012 Hyper-V: http://social.technet.microsoft.com/wiki/contents/articles/15576.hyper-v-update-list-for-windows-server-2012.aspx

· List of Failover Cluster Hotfixes: http://social.technet.microsoft.com/wiki/contents/articles/15577.list-of-failover-cluster-hotfixes-for-windows-server-2012.aspx

⎕ Ensure hosts have the latest BIOS version, as well as other hardware devices (such as Synthetic Fibre Channel, NIC’s, etc.), to address any known issues/supportability
⎕ Host should be domain joined, unless security standards dictate otherwise. Doing so makes it possible to centralize the management of policies for identity, security, and auditing. Additionally, hosts must be domain joined before you can create a Hyper-V High-Availability Cluster.

· For more information: http://technet.microsoft.com/en-us/library/ee941123(v=WS.10).aspx

⎕ RDP Printer Mapping should be disabled on hosts, to remove any chance of a printer driver causing instability issues on the host machine.

• Preferred method: Use Group Policy with host servers in their own separate OU
• Computer Configuration –> Policies –> Administrative Templates –> Windows Components –> Remote Desktop Services –> Remote Desktop Session Host –> Printer Redirection –> Do not allow client printer redirection –> Set to "Enabled

⎕ Do not install any other Roles on a host besides the Hyper-V role and the Remote Desktop Services roles (if VDI will be used on the host).

• When the Hyper-V role is installed, the host OS becomes the "Parent Partition" (a quasi-virtual machine), and the Hypervisor partition is placed between the parent partition and the hardware. As a result, it is not recommended to install additional (non-Hyper-V and/or VDI related) roles.

⎕ The only Features that should be installed on the host are: Failover Cluster Manager (if host will become part of a cluster), Multipath I/O (if host will be connecting to an iSCSI SAN, Spaces and/or Fibre Channel), or Remote Desktop Services if VDI is being used. (See explanation above for reasons why installing additional features is not recommended.)
⎕ Anti-virus software should exclude Hyper-V specific files using the Hyper-V: Antivirus Exclusions for Hyper-V Hosts article, namely:

• All folders containing VHD, VHDX, AVHD, VSV and ISO files
• Default virtual machine configuration directory, if used (C:\ProgramData\Microsoft\Windows\Hyper-V)
• Default snapshot files directory, if used (%systemdrive%\ProgramData\Microsoft\Windows\Hyper-V\Snapshots)
• Custom virtual machine configuration directories, if applicable
• Default virtual hard disk drive directory
• Custom virtual hard disk drive directories
• Snapshot directories
• Vmms.exe (Note: May need to be configured as process exclusions within the antivirus software)
• Vmwp.exe (Note: May need to be configured as process exclusions within the antivirus software)
• Additionally, when you use Cluster Shared Volumes, exclude the CSV path "C:\ClusterStorage" and all its subdirectories.
• For more information: http://social.technet.microsoft.com/wiki/contents/articles/2179.hyper-v-anti-virus-exclusions-for-hyper-v-hosts.aspx

⎕ Default path for Virtual Hard Disks (VHD/VHDX) should be set to a non-system drive, due to this can cause disk latency as well as create the potential for the host running out of disk space.
⎕ If you choose to save the VM state as the Automatic Stop Action, the default virtual machine path should be set to a non-system drive, due to the creation of a .bin file is created that matches the size of memory reserved for the virtual machine.  A .vsv file may also be created in the same location as the .bin file, adding to disk space used for each VM. (The default path is: C:\ProgramData\Microsoft\Windows\Hyper-V.)

• Note: Hyper-V in Server 2012 will now only use the .bin if you choose to save the VM state as the Automatic Stop Action.
• Change to .bin usage in Server 2012: http://blogs.msdn.com/b/virtual_pc_guy/archive/2012/03/26/option-to-remove-bin-files-with-hyper-v-in-windows-8.aspx

⎕ If you are using iSCSI: In Windows Firewall with Advanced Security, enable iSCSI Service (TCP-In) for Inbound and iSCSI Service (TCP-Out) for outbound in Firewall settings on each host, to allow iSCSI traffic to pass to and from host and SAN device. Not enabling these rules will prevent iSCSI communication.

To set the iSCSI firewall rules via netsh, you can use the following command:

Netsh advfirewall firewall set rule group=”iSCSI Service” new enable=yes

⎕ Periodically run performance counters against the host, to ensure optimal performance.

• Recommend using the Hyper-V performance counter that can be extracted from the (free) Codeplex PAL application:
• http://pal.codeplex.com/
• Install PAL on a workstation and open it, then click on the Threshold File tab.
• Select "Microsoft Windows Server 2012 Hyper-V" from the Threshold file title, then choose Export to Perfmon template file. Save the XML file to a location accessible to the Hyper-V host.
• Next, on the host, open Server Manager –> Tool –> Performance Monitor
• In Performance Monitor, click on Data Collector Sets –> User Defined. Right click on User Defined and choose New –> Data Collector Set. Name the collector set "Hyper-V Performance Counter Set" and select Create from a template (Recommended) then choose Next. On the next screen, select Browse and then locate the XML file you exported from the PAL application. Once done, this will show up in your User Defined Data Collector Sets.
• Run these counters in Performance Monitor for 30 minutes to 1 hour (during high usage times) and look for disk latency, memory and CPU issues, etc.

Check out the entire thing and bookmark it! :D Click here.

Windows Server 2008 R2 RDWeb Resources

This is the first post of February 2013 and it's already the 19th. I can't believe it. I haven't posted in a while, but it's not because of laziness: I've been working on RDWeb for my work. Along the way I found some very helpful and not so helpful resources. I'll only list the helpful links.  Do note that these links may not solve your problem and that I'm not endorsing *every* solution mentioned in the links. The answers labeled "best answer" or "chosen answer" helped me in the forums. I didn't try every solution that is mentioned in the links below.

My main focus for deploying Remote Desktop Services was to make our local applications available to users located outside our network so that's the focus of the links below. 

Getting Started
Deploying Remote Desktop Web Access Step-by-Step Guide

Resources on Troubleshooting Outside Access Problems
External Users Can't Connect to Apps in RDWeb
TS Gateway "the computer can't connect to the remote computer"
External Access to RDWeb Problem
How to resolve external FQDN to a local IP when behind a firewall
RD Gateway/Web Access Outside the Firewall
Your computer can’t connect to the remote computer because the Remote Desktop Gateway server address is unreachable or incorrect. Type a valid Remote Desktop Gateway server address.
Can't Access Through Gateway
Remote Desktop Gateway is Temporarily Unavailable

Licensing
Remote Desktop Services Licensing

Customizing the RDWeb website
Customizing RDWeb

Troubleshooting Remote Desktop from RDWeb
Remote Desktop via RDWeb

Configure Server 2008 VPN Behind Sonicwall TZ 210

You want to use your Server 2008 as a VPN for accessing remote applications and data at your workplace instead of your VPN firewall or a router that has that option? Understandable. Exciting that you found this post huh? No? Only useful? Well, okay.

First, install the server role.
The server role isn't called 'vpn' or anything like that. Go to Start > Server Manager > Add Roles > Select Network Policy and Access Services > Next > Next.

Select Remote Access Service > Next > Install > The Service takes a long time so make a sandwich or a salad if you're a vegetarian. When it finishes, click close.

Now go to Start > Administrative tools > Routing and Remote Access > The Server will have a red "south" Arrow on it > Right Click the Server and Select "configure and enable routing and remote access"

Next > Select "Custom Configuration" > Next.

VPN Access > Next

When prompted select "Start Service" > service will start > you can now close the Routing and Remote Access Console.

Make sure the user has 'dial-in access' in Active Directory Users and Computers. For example find Joe Smith in Active Directory. Go to his properties. In the dial-in tab, click "allow access."

Now we must go to the Sonicwall device.
Since the Server 2008 box is behind our firewall we must open the correct port and protocol to Server 2008. TCP Port 1723 and GRE (Generic Routing Encapsulation) to be exact.

You will need two rules in your Sonicwall. The first one is NAT.

Source original - any
Source translated - original
Dest original - your public IP
Dest Translated - your vpn server internal IP
Service original - pptp
service tranlated - original

The second rule is a firewall rule.
Wan to Lan
Source - any
Destination - my external IP
Service - pptp
Action - allow

These two rules cover the TCP port 1723 and the GRE protocol requirements.

Now you need to connect your remote client to the VPN server (your server 2008 box).

The following is for Windows Vista and Windows 7 machines.
Click on Start > Control Panel > Network and sharing Center > Connect to a Network > Set up a Connection or Network > Connect To a Workplace > Next.

Use My Internet Connection (VPN) > Enter the public IP address of the VPN server > Enter a Name for the Connection > Next > Enter your Domain Logon details > Connect.

I hope this helps. I couldn't find a single post covering all of this. There might be one out there. I couldn't find one so that's why I wrote this post. Enjoy!

Excellent Group Policy How-To

I've been testing Window Server 2012 via the "Early Experts" class, which is a very cool class, and experienced this very informative, super user-friendly TechNet how-to article on Group Policy. I'm not a GP guy. What I mean by that is that my job doesn't require a deep understanding of GP, only a foundational level understanding of GP, so I don't know the really cool things you can do with GP for your network(s). After going through this how-to for Server 2012 I now understand some deeper things about GP.

The how-to is for Server 2003, but it works for Server 2012 at least for the part we are at in Administering GP.

Check it out here.

I highly suggest going through, at your own pace, the Windows Server 2012 Early Experts challenge.