Sophos does not need updating!

Came across this popup from Sophos.  Apparently, it doesn't need updating but it subsequently downloads and installs three update packages!

Multicast vs. Unicast performance

Recently at a customer site, we decided to compare the performance of multicast and unicast.  The environment for the test consisted of the following pieces:

• Windows Deployment Services (WDS) server running on Windows Server 2008 R2.
• 24 Dell Precision T3400 client computers.
• A 10/100 switched network, with all computers using 1GB network adapters.
• PXE boot.
• Windows 7 Enterprise image.

The situation?  A lot of machines need to be reimaged soon.  The team will reimage about 20 or 30 machines at a time.  We wanted to determine the fastest way to accomplish the imaging.

Results
Multicast - 41 minutes
Unicast - 9.5 minutes

We monitored the network performance and WDS showed quite a bit more network usage during the multicast than during the unicast deployments.  So, based on this customer's configuration and imaging process, Unicast is the preferred choice.

There are important considerations though:

1. Is the imaging taking place during business hours?
2. Is the imaging limited to 50 computers or less at one time?
3. Does the network support multicasting?

I think there is a breakeven point, at which multicast becomes superior to unicast (even when the imaging is taking place after business hours) - but I have a feeling it is when imaging is taking place on more than 100 computers at a time.

Error message - bigger than unlimited?!

I came across this error today:

Microsoft.Exchange.AirSync.AirSyncPermanentException

Exception message: The size of attachment 10:15811:0 is bigger than unlimited, which is the size limit that is defined in the Exchange ActiveSync mailbox policy.

Renew or replace ISA 2006 SSL certificate for CSS in workgroup

Even though ISA 2006 feels old these days, there are still a lot of people running it.  It works, it is stable, and it typically cost money to go to the latest version (TMG or UAG).  Every so often, I run across ISA arrays in a workgroup.  The configuration is slightly different than a domain-based ISA array and requires a little bit more maintenance.

One common issue is renewing (typically replacing) the SSL certificate that the CSS uses in workgroup mode.  The process isn't as straight forward as it should be and I've run into customers that don't even realize that there is an SSL certificate for the CSS (until ISA stops accepting configuration changes or other issues crop up). 

Richard Hicks has a an overview of the process which got me thinking about putting a bit more detail out there (much of this information is available elsewhere, but typically spread across multiple sites). 

First, see Richard's post:
http://tmgblog.richardhicks.com/2009/03/05/isa-server-2006-workgroup-deployment-certificate-renewal/

I added a few comments (awaiting moderation as of right now) earlier this evening.  Basically, a few details that you might find handy:

1.  A lot of people struggle with obtaining the .PFX file.  GoDaddy and others typically offer .CRT files.  You need to complete the SSL install on the original IIS server which will install the certificate (with private key) on the server, then export it from the Certificates MMC (and during the export, you can choose to include the private key which will get you the required .PFX file).

2.  ISACertTool isn't really installed.  It is extracted.  And it is best to extract it to the program directory where ISA is installed (default is C:\Program Files\Microsoft ISA Server).  Otherwise, the tool will complain about a missing .DLL.

3.  To simplify the procedure, copy your .PFX file to the same directory (C:\Program Files\Microsoft ISA Server).  Then, you won't have to specify a path when you use the /st switch.

4.  If you are using a public CA (as is typical with ISA implementations), you won't need to worry about the root CA certificate in most cases (as those will be there by default with  your Windows operating system installation).  Some might argue that you can use an internal certificate (or generate one from an internal CA) but at $17.95 a year, there are benefits to the public CA (centralized management of all ISA certificates, not just external certificates is one example).  I typically opt for the public CA.

Finally... it is important to test and verify... BUT... if your old cert isn't expired, how do you verify now?  The best way I've found is to launch the Certificates MMC, specify the local computer (ISA CSS), then specify a service account (which should be ISASTGCTRL).  The old and new certificate should be listed there (which indicates a successful installation.  Of course, the ISACertTool should give you a success message too.  Then, add a reminder to your calendar for the day after the old cert expires - you can run through additional testing and clean up the old cert (delete from Certificates, etc.).

Restart in a long long time (funny dialog message)

Might as well post this one too.  After pushing out some updates to a client machine, I got the common restart dialog but this one had a funny sense of time:

Funny Microsoft error message

I was creating a trust recently and came across a funny error:

OCS 2007 R2 - server issues - limited calling

So I ran into a small issue with an OCS environment recently.  All of the MOC clients were showing a small red exclamation point in the tray icon with a message indicating server issues and limited calling.  Combined with that, 4 of the OCS services were stopped and wouldn't start.  The 4 services were:  Office Communications Server Conferencing Announcement, Office Communications Server Conference Attendant, Office Communications Server Outside Voice Control, and Office Communications Server Response Group.  Some Google searching revealed a lot of people running into similar issues (but with different symptoms or slightly different error messages).  I was finally able to narrow down the fix when I ran into Event ID 33020 stating that the CAA's private contact object is missing.

The fix?  Deactivate all 4 applications in OCS and reactivate (using the same information that they were originally activated with).  This is a very quick and easy process.  Then, start the 4 services.  Thereafter, users had to log out out OCS and log back in and the red exclamation point was gone and full functionality resumed.