Black Hat Thyself - SBS 2003 (book excerpt)

g'day mates - I am harry brelsford, the author of Windows Small Business Server 2003 Best PRactices (the infamous purple book). I amposting up a few pages per day of this book until SBS 2008 ships for all of us SMB consultants, SBSers, and Microsoft Small Business Specialists (SBSC). Enjoy the read!
Today I speak towards black htting thyself including packet sniffing!
harrybbbbb
Harry Brelsford, ceo at smb nation, www.smbnation.com
###
Black Hat Thyself
So, you think you’re an SBS security hot shot? Perhaps you are. One way to validate whether you’re “hot or not” is to black hat yourself on the inside and outside. That’ll tell you exactly how super you are. In a nutshell, you’d download a port scanner such as GFI’s LANGuard Network Security Scanner (www.gfi.com) and run it against yourself. Figure 5-13 shows how such a scan on the internal LAN might look (revealing tons of information) and Figure 5-14 shows how such a scan might look when run over the Internet, showing only the ports you opened via the EICW. (Talk about a great way to validate your work!)
Figure 5-13
Black hattin’ on the inside.
Notes:
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Figure 5-14
Black hattin’ on the outside.
BEST PRACTICE: Perform this activity on each SBS network you work on (even if it’s only one). Hopefully, you won’t be too surprised by the outcome (in general, SBSers don’t like to be surprised in this area). If you’re a consultant, share the outcome of this black hat exercise with your clients.
Packet Sniffing
Talk about an MCSE-level exercise that works for us SBSers as well: packet sniffing. Here you would install the Network Monitor tool that is native to the underlying Windows Server 2003 operating system, but not installed by default, and then sniff around. To install the tool, perform the following procedure:
1 Log on as Administrator on SPRINGERS1 (password is Husky9999!).
2 Click Start, Control Panel, Add or Remove Programs.
3 Select Add/Remove Windows Components.


1 Select Management and Monitoring Tools in the Windows Com­ponents Wizard.
2 Select Network Monitor Tools and click OK.
3 Click Next.
4 Insert Disc #1 when requested.

8. Click Finish. In Figure 5-15, you can see what the results of a packet sniffing session might look like. This tool can be used to troubleshoot network problems (such as logon problems) and to search for rogue devices (such as another server running network monitoring on your network without your knowledge).
Figure 5-15
The three-finger salute of TCP/IP session establishment is shown here in a Network Monitor session. Look closely at the source and destination address columns (packets 31-33).
BEST PRACTICE: I used this tool once in early 2003 to investigate whether Microsoft automatic update sessions were actually going out into the ether. A client, a well-known Seattle-based author (not me!),
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
believed said updates where going to an offshore site not controlled by Microsoft. The packet analysis facilitated by the Network Monitor tool showed the fears were unfounded. The client then rested easy and allowed his workstation to be automatically updated. I kinda felt like one of the central characters in an old US movie called Ghosbusters and Network Monitor was my tool!
Spam Blocking
Spam blocking fits in the security chapter as well. The malady of “spam” is well known to readers of this book as unwanted e-mail traffic. In fact, the perception of excessive spam on an SBS 2003 network can create unwarranted criticism about SBS 2003 itself, which just isn’t fair.
Spam blocking can be divided into two discussion areas: content filtering and attachment blocking.
Content Filtering
I’ve enjoyed great success using the GFI’s MailEssentials spam blocking program, which more than anything else flexes its muscles in the content filtering department. For example, e-mails with the word “Viagra” are treated as spam and processed accordingly, which might include deletion, move to another folder, etc. MailEssentials is shown in Figure 5-16.
Notes:
Figure 5-16
Meet MailEssentials from GFI. Note that this product is very aggressive out of the box and will sometimes go too far, filtering out legitimate messages.
BEST PRACTICE: Because of the false positives and positive negatives in the world of filtering junk e-mails, the oft-cited security author Roberta Bragg insists that I tell you to send filtered mail to a junk mailbox, instead of deleting it! Right on, Roberta!
Another way to easily engage in a form of content filtering is to utilize the junk mail feature in Outlook 2003. This is a MAJOR IMPROVEMENT in Outlook 2003 and is discussed in Chapter 6.
Attachment Blocking
Of course, the simplest way to invoke attachment blocking is to complete the 15th page of the EICW titled “Remove E-mail Attachments.” I’ll discuss that more in Chapter 6 when you and I look deeper at Exchange Server 2003.
But meet GFI’s MailEssentials once again. Assuming you own this application for its effectiveness in the content filtering area, then consider using it as your attachment blocking tool.
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
BEST PRACTICE: The above statement raises the question about which attachment types to block if you’re using a third party tool such as MailEssentials. This list is easily created by looking at and copying the list from the Remove E-mail Attachments page in the EICW.
And yet another attachment blocking tool is contained within Outlook 2003 itself. Since I don’t want to spill the beans on Chapter 6 yet, I’ll wait to discuss it there. Similarly, you can use the SMTP application filter in ISA Server 2000 to engage in both content filtering and attachment blocking (discussed in Chapter 13).
BEST PRACTICE: I only cite GFI’s spam fighting tool because I know it. The infamous Stu at Sunbelt Software in Tampa FL (www.w2knews.com) markets effective spam blocking tools (“I Hate Spam”) that deserve your purchasing consideration. The SBS-related newsgroups are also a source of information for third-party spam fighting applications (see Appendix A for this information).
Virus Protection
So, would you consider virus protection a germane security topic? You betcha! I’ll discuss this much more in Chapter 11 with some step-by-step procedures using Trend Micro’s OfficeScan suite solution, but I’d be remiss to have a security chapter without emphasizing the importance of virus protection as part of your comprehensive approach to security on your SBS 2003 network.
BEST PRACTICE: I’ll say it here and again later on. Virus protection
is only valid when the data files are up-to-date. More later.
SpyWare
If you want to be humbled in a hurry, download the spyware detection applications from www.BulletProofSoft.com. Install its SpyWatch and SpyWare Remover programs and then, when no one is your witness, run these programs. You might be shocked to see what’s been camping out on your SBS network without your knowledge. Thanks to a student from the Louisville, KY hands-on lab for that tip! Many apparently harmless Web sites accessed by your users are
Visit www.smbnation.com for additional SMB and SBS book, newsletter and conference resources.
really implementing click counters and other spyware nasties. One of the all time greats (or “worsts”) was Gator. An instructor with whom I’ve previously worked on another tour had actually worked for Gator during the dot-com boom and he sends his profound apologies!
FTP Site Notification
And now from the hallowed halls of the Harvard Law School! Did you know that if you dig deep enough into the legal treatise of USA jurisprudence system, you’ll find that long ago, a hacker got off the hook because an FTP site at a company said “Welcome!” Apparently the hacker claimed that he felt invited in to poke around and destroy things. The legal lesson learned here? Prevention! Make the introductory screen of your FTP site say “Authorized Users Only!” or something just as strong.

SBS 2003 NAT\Basic Firewall (book excerpt)

howdy-howdy....harrybbbb here posting up more of my Windows Small Business Server 2003 Best Practices book for your general consumption...hope to havethe whole darnt hing posted up by the time SBS 2008 ships!
harrybbbb
Harry Brelsford ceo at smb nation www.smbnation.com
###
Defining Basic Firewall/NAT
Meanwhile, back in the lecture hall, it’s time to lay one down on you about NAT and the Basic Firewall. You can use Basic Firewall to help secure your network from unsolicited public network traffic, such as traffic sent from the Internet. People who send such traffic might be trying to access your network without your permission. You can enable Basic Firewall for any public interface, including one that also provides network address translation (also known as NAT, an Internet Protocol (IP) translation process that allows a network with private addresses to access information on the Internet for your network).
How Basic Firewall Works
First of all, what is a firewall? Quoting directly from the online help system in SBS 2003: A firewall is a combination of hardware and software that provides
Visit www.smbnation.com for additional SMB and SBS book, newsletter and conference resources.
a security system, usually to prevent unauthorized access from outside to an internal network or intranet. A firewall prevents direct communication between network and external computers by routing communication through a proxy server outside the network. The proxy server determines whether it is safe to let a file pass through to the network. Also called a security-edge gateway.
Next, the Basic Firewall provided via RRAS in SBS 2003 is a stateful firewall which combines dynamic packet filtering of network traffic with a set of static packet filters. Said Basic Firewall monitors traffic that travels through the interface for which Basic Firewall is enabled. If the interface is configured for private network traffic only, Basic Firewall will route traffic among the computers on the private network only. The Basic Firewall will route traffic between a private network and virtual private network (VPN). I define a VPN below in the advanced section.
If the interface is configured for private network traffic and to provide NAT, each packet’s source and destination addresses are recorded in a table. All traffic from the public network is compared to the entries in the table. Traffic from the public network can reach the private network only if the table contains an entry that shows that the communication exchange originated from within the private network. In this way, Basic Firewall prevents unsolicited traffic from a public network (such as the Internet) from reaching a private network. This is a key point, pardner: We’re keeping the bad guy out here.
Service Accessibility
Perhaps you noticed earlier in this RRAS section that adding the additional services by name and port was as easy as dropping beneath the hood and simply selecting from the bevy of services contained on the Services and Ports screen (which you observed in the last step-by-step procedure above). The services on the Services and Ports screen are listed here.
• FTP Server
• Internet Mail Access Protocol Version 3 (IMAP3)
• Internet Mail Access Protocol Version 4 (IMAP4)
• Internet Mail Server (SMTP)

Visit www.microsoft.com/technet for the latest updates for any Microsoft product.

• IP Security (IKE)
• IP Security (IKE NAT Traversal)
• Post-Office Protocol Version 3 (POP3)
• Remote Desktop
• Secure Web Server (HTTPS)
• Telnet Server
• VPN Gateway (L2TP/IPSec - running on this server)
• VPN Gateway (PPTP)
• Web Server (HTTP)

And if you insist, you can always add different services via the Add button on the Services and Ports tab just like you could back in the EICW.
Get Certified!
A cool feature that is managed by the Web Server Certificate page in the EICW is the ability to easily install a self-signed certificate on your SBS 2003 server machine.
BEST PRACTICE: Note the self-signed certificate is not the same as installing and configuring Certificate Services to create a certificate authority. (You can see via Control Panel, Add/Remove Programs, Windows Components that Certificate Services HAS NOT BEEN INSTALLED and configured after the Web Server Certificate page in the EICW is complete.) As author Roberta Bragg put it to me, it’s “kool” but it’s not Certificate Services. This is important to understand and perhaps you’d want to proceed to install Certificate Services for other purposes such as e-commerce. That suggestion begs the next point.
So, do you need to continue to pay the SSL King (Verisign) his ransom in the world of SBS 2003? The answer is perhaps not if you were using Certificate Services as your certificate authority. So, save those dollars to be spent on something more meaningful like taking your spouse/partner out to dinner (a real nice dinner in Vegas with your Verisign savings!).
Real world speaking, this self-signed Web certificate will be most noticeable in two ways to users. First, the address in a Web browser (known as the URL) will start with the prefix HTTPS. Second, you’ll typically need to approve the certificate when a security dialog box appears as a user commences a Web session on the SBS 2003 server. And how do you explain this to the same real-world users? Tell them this is akin to logging on to their bank (e.g., Wells Fargo) or brokerage firm (e.g., ETrade).
BEST PRACTICE: The Web Server Certificate page in the EICW is dramatically reducing the number of keystrokes you had to perform in the SBS 2000 time frame to achieve the “nearly” same kind of security-related functionality (granted, I’m comparing apples to oranges here for a few minutes, but go with it). Again, a self-signed certificate and Certificate Services are not the exact same thing.
In my now retired Advanced SBS 2000 Workshop, I demonstrated the keystrokes necessary to (1) install Certificate Services from Control Panel, Add/Remove Programs, Windows Components, (2) create a self-signed certificate, (3) apply the certificate to the appropriate locations (e.g., root of the default Web site in SBS 2003 that houses OWA), and (4) apply the SSL setting to child objects (e.g., the Public folder under IIS). Note these steps, in the SBS 2000 time frame, were documented in the following documents:
• a white paper titled “Step-by-Step Guide for Setting Up a Cer­tificate Authority”
• the following KBase article: “Turning on SSL for Exchange 2000 Server Outlook Web Access” (Q320291)

Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
• KBase article: “How to Force SSL Encryption for an Outlook Web Access 2000 Client” (Q279681)
This kinda stuff is now handled via the Web Server Certificate page in the EICW (at least as far as the typical SBS network is concerned). Note the enterprise security folks reading this book would of course beg to differ and point out huge differences in a self-signed certificate and Certificate Services, such as the ability to issue certificates for IPSec (which our little ol’ self-signed certificate can’t do). Enough said.
Advanced SBS Security Topics
No chapter worth its security salt could be devoid of a few advanced security topics even though said topics are beyond the scope of this introductory volume on SPRINGERS! While my future advanced SBS 2003 text will delve deeper and fly further on a single tank of gas, try on a few of the following advanced security topics for size. Security is of such importance that this is one time we can clearly take a respite from the SPRINGERS story line and explore:
Hardware-Based Firewall
Yes, Virginia, there is native SBS 2003 support for hardware-based firewalls. It’s kosher as well and you’ll be accepted in the open and affirming SBS community. Best of all, when you select the router option in the EICW as you set up the network connection (see the third screen regarding connection type in the EICW), you’ll be able to take advantage of a really cool SBS 2003 feature: It automatically configures hardware-based routers as part of its wizardry! Say what? This isn’t a misprint. What occurs is this. If your hardware-based firewall is Universal Plug and Play (UPNP) compliant (this is an industry standard) and you provide sufficient credentials (that allow you to configure the hardware-based firewall itself), then the EICW will open the correct ports to support the services you’ve selected that need access from the Internet.
Dual-Firewall
Another popular configuration with SBS 2003 is to implement a dual firewall. In this case, you’d use the built-in firewall capability in SBS 2003 and then supplement that on the network border with an additional firewall. Note this additional firewall is typically hardware-based, but could very well be a software-based firewall from another vendor. A view of a dual firewall scenario is shown in Figure 5-12.
Figure 5-12
This is your road map for implementing a dual-firewall scenario with SBS 2003.
BEST PRACTICE: You could implement a dual firewall scenario with either SBS 2003 standard edition (with the RRAS NAT/Basic Firewall) or SBS 2003 premium edition (with ISA Server 2000 discussed later in Chapter 13).
What Is a VPN?
No, this isn’t a trick question. Many readers of this book might not actually know what a VPN is. Don’t believe me? Then you should have been there during the filming of an SBS setup video at Microsoft Studios on 158th Ave NE in Redmond the day we forgot to define VPN in the script. An important marketing manager discovered this omission and we had to play some Hollywood magic to splice in a short lecture on VPN connectivity in the post production phase. Needless to say, this drove up the video costs and since that day, I’ve never forgotten to add this lecture in any chapter where it makes sense.
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Here is the official definition of a VPN taken from the online help system in SBS 2003: The extension of a private network that encompasses encapsulated, encrypted, and authenticated links across shared or public networks. VPN connections can provide remote access and routed connections to private networks over the Internet client computers. However, computers that are part of a private network will not be able to detect computers outside of the private network, and computers that are not part of the private network will not be able to detect computers that belong to the private network.
Relating VPN connectivity to security is the next step. You might be saying “Who cares?” at this point. Both you and I care. When the shoe fits, establishing a VPN connection using either the point-to-point tunneling protocol (a poor man’s encryption method) or layer-two tunneling protocol (a rich man’s encryption method that requires a certificate authority) creates a secure link between a remote computer and the SBS 2003 network. Essentially, you can compute with less worry from afar.
BEST PRACTICE: I’ll touch on VPN connectivity in Chapter 8 again with step by step procedures. And don’t forget you actually configured server-side VPN connectivity in Chapter 4 when you completed the Configure Remote Access link. Be advised much deeper discussion is beyond the scope of this introductory SBS 2003 volume. Look for richer VPN discussion in my advanced SBS 2003 text due in mid-2004.

Chapter 5 Security standard discussion [bookexcerpt]

Hello from WPC Houston! We now start Chapter 5 of Windows Small Business Server 2003 Best Practices. As you may know, I am posting up several pages per day of my purple book until SBS 2008 ships! BTW - that date is now defined as November 12th.
Enjoy the read....harrybbbb
Harry Brelsford
CEO, SMB Nation, www.smbnation.com
###
Chapter 5 Standard SBS Security
This chapter honors the all-important security discussion. Up until most recently, every year was dubbed the “Year of Security” by the popular media. That moniker has finally been retired with Microsoft announcing this as the “Year of SMB” with the launch of SBS 2003 in October 2003 at the Worldwide Partners Conference (WWPC) in New Orleans, Louisiana, USA.
BEST PRACTICE: With the completion of your basic SBS 2003
network for SPRINGERS over the last few chapters, if might be easy to believe your job as the SBSer is largely complete. But in reality your job has only begun! Did you know that the moment you completed the deployment of your SBS 2003 network, it was already badly and sadly out of date! “What?!” you say. Don’t be angry - this isn’t personal. SBS 2003 standard edition was released to manufacturing (RTM) on Tuesday, September 16, 2003, at 11:00am Pacific Standard Time. And SBS 2003 premium edition RTMed on Wednesday, October 1, 2003. On those respective dates, both products instantly started to age and become out of date from a patch management point of view. That is, a patch released on October 7, 2003, (as an example) would never be included out-of­the-box at startup in either of the original RTM SBS 2003 editions. You need to apply this update.
More encouraging words. This isn’t about working yourself out of a job when it comes to SBS, but rather about the fact that more work lies ahead of you than behind you. Most security tasks in the chapter are typically performed on an ongoing basis over the life of the computer network.
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Of course this chapter continues the SPRINGERS methodology whereby you are deploying an SBS 2003 network for the imaginary Springer Spaniels Limited company.
Introduction
So many folks in the SBS community equate security with a firewall it’s scary! If you were do conduct a focus group and engage in a word association game whereby you said the word “security” to a panel of SBSers, you’d be shocked, awed, amazed, and dazed at how many would utter the word “firewall.”
Truthfully, security is much more like a multi-headed Hydra beastie from Greek methodology. Certainly a firewall is one component of security, but it only joins other security elements as listed below:
• Computer. Obviously much security attention will be devoted to mak­ing the computer system as secure as possible, including completing a secure setup, keeping all devices updated with the latest patches, using the security features and best practices that ship with SBS, and even supplementing SBS security with additional tools. All of this is dis­cussed in the chapter.
• Physical. Later in the chapter, the physical element of security is dis­cussed whereby you might find yourself running to secure your SBS server machine (which someone could easily walk away with).
• Management practices. Do you have a written security policy so that employees are educated on what workplace behaviors are acceptable or unacceptable?
• Personal practices. I’ll only mention this here, but look at how you conduct your own affairs. Do you use a 900MHZ cordless telephone that neighbors can hear over a baby monitor (especially when you read your credit card)? Do you allow a minimum-wage valet to park your luxury car (and perhaps plant a “bug” from your business competitor)? Get paranoid right now about your personal security. Be aware of your surroundings. Enough said.

Visit www.smbnation.com for additional SMB and SBS book, newsletter and conference resources.
Security is an evolving, ongoing concern that you “did” yesterday, “do” today, and “will do” tomorrow. It never ends and at no time can you become complacent and utter that our small business is completely secure. In fact, at the end of this chapter, I only point you to more intense security resources to march forward with.
BEST PRACTICE: Truth be told, achieving complete security on your SBS network is never truly possible, as my friend security author Roberta Bragg has reminded me. But a high level of computer security can be achieved by just turning both the server machine and client computer off (although Roberta cautions that wake-on LAN technologies might work around even this approach). The next level down on the security food chain would be to simply unplug the SBS server machine from the Internet. But since most of us live in the real world, are merchants of some trade, and seek to conduct business and consummate transactions, we have to be reasonable and practical and find a balance between security and business functionality. That might be a different experience for different people, but I want to set the framework for that decision making.

SBS 2003 Guest Column and End of Chapter 3 [book excerpt]

hi - my name is harry brelsford and I am the author of the purple book (Windows Small Business Server 2003 Best PRactices). I am posting up a few pages of this SBS book per day unitl SBS 2008 ships. My laptop battery islow as I am working at the Denver airport about to board my flight to Houston for the Microsoft Worldwide PArtner Conference (WPC).
Today we complete Chapter 3 with a guest column from my main man Frank Ohlhorst!
cheers....harrybbbb
Harry Brelsford, CEO at SMB Nation www.smbnation.com
###
Guest Column
Another Take On Internet Connectivity
By Frank J. Ohlhorst
With broadband connectivity becoming commonplace for most any small business, consultants will need to carefully consider the implications of high speed internet access for their customers. SBS2003 does a great deal to leverage those broadband connections ranging from the ability to share the connection with client PCs to hosting web based services to incorporating remote access. But consultants will find that there are some limiting factors when it comes to today’s broadband connections.
The first problem encountered often revolves around the lack of a static IP address assigned from the broadband purveyor. Most cable companies and a good portion of DSL providers supply a dynamic IP address for the broadband connection device (DSL Modem or Cable Modem), that prevents a friendly URL from being assigned to the SBS2003 network in question. In other words, consultants can not offer their customers the ease of using “mysbs2003­network.com” as a solution for connecting to the customer’s network. Simply put, dynamically assigned external IP addresses have the net effect of eliminating many of the advantages offered by SBS2003 for remote users. Luckily, consultants can turn to a Dynamic DNS service to solve that connectivity problem.
Dynamic DNS services are available from several vendors, with key players being Tzolkien’s TZO service (www.tzo.com), Dynamic DNS Network Services’ DynDNS (www.dyndns.org), No-IP.com’s No-IP service (www.no-ip.com), and Deerfield’s DNS2go service (www.dns2go.com). All of those vendors share a common concept and functionality, the service works by running a small client application on the SBS2003 server, which is then used to inform the Dynamic DNS provider with the public IP address of the network. That information is then used to associated a URL with the public IP address and is updated
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
whenever the IP address is dynamically changed and viola, the site now has a valid URL.
Simplicity is the key for keeping Dynamic DNS working, most of the services on the market rely on a small client application that can be quickly installed and configured, that client application should also be configured to run as a service and auto launch on startup. Some further configuration is often needed, for sites running a firewall or ISA server, it may be necessary to open some ports to allow the Dynamic DNS service to work.
Another option is to not use a Dynamic DNS client at all, how is that possible? Many of the broadband routers coming onto the market are now building Dynamic DNS clients in. Key players there include Linksys, D-link, SMC, Buffalo, Zyxel and several others. That offers the advantage of moving the client software off of any servers or PCs and eliminates the need for opening additional ports, also it brings the advantage of being able to remotely administer the router if desired.
Once the URL dilemma is solved, there may be some other issues to contend with, namely blocked ports. Many ISPs are now blocking incoming and outgoing TCP/IP ports, effectively eliminating the ability for broadband users to host websites, host email servers and the like. That becomes a significant problem for those looking to leverage those very features found in SBS2003.
The solution to that problem can also be found with the Dynamic DNS service providers, some of which support port redirection or forwarding. Simply put, if an ISP blocks port 80 (HTTP web traffic), simply redirect that traffic to another port, say port 81. That feat is accomplished by the dynamic DNS service provider capturing port 80 traffic at their site and redirecting it to a port of your choice.
Port redirection does require some integration work, namely modifying applications to listen for traffic on different ports than normal, for example you would have to “instruct” IIS to look for traffic on port 81, instead of the default of port 80. For those using broadband routers, that whole process can be simplified if the router supports port redirection, then the router can be instructed to listen for traffic on port 81 and then redirect that traffic to port 80 on the server’s internal IP address. The same goes for Email, FTP and other services.
Visit www.smbnation.com for additional SMB and SBS book, newsletter and conference resources.
The moral of the story here is not to let an ISP’s restrictions or lack of features prevent consultants from providing customers with all of the features SBS2003 has to offer. By using a Dynamic DNS service, the two major problems associated with broadband are easily overcome, blocked ports and dynamic IP addresses are no longer a brick wall for leveraging key features of SBS2003, such as remote access, email and hosting.
Summary
Whew! You’ve made it through four demanding chapters and your reward is a functional and operational SBS 2003 network. In this chapter, you greeted the Server Management console and completed much of the To Do List. This included important wizards to connect to the Internet, configure remote connectivity and adding users and computers. This “stuff” was foundation and allows you to confidentially continue forward with the SPRINGERS methodology. And most important of all, you started to completed the To Do List in order, something that is very important in the SBS world. I started earlier by offering you congratulations and I end on the same note. The next chapter is the all-important security topic!
Visit www.microsoft.com/technet for the latest updates for any Microsoft

Workstation Installation Procedure for SBS2003

Happy July 3rd everyone - I am harry brelsford, author of Windows Small Business Server 2003 Best Practices and I enjoy posting a few pages of my book per day for your reading pleasure. I hope to have the entire book posted up by the time SBS 2008 ships!
Today we look at the keystrokes to add a workstation to the SBS 2003 network!
cheers and Happy 4th of July!
harry brelsford, ceo at smb nation, www.smbnation.com (I am also a Microsoft Small Business Specialist! aka SBSC)
###
SBS Workstation Setup Process
The SBS workstation setup approach is a four-step process, and compared to the SBS server machine installation, it is relatively simple. Another interesting point is that, whereas you perform the SBS server machine setup only once, you perform the SBS workstation setup multiple times. I’ve found that such repetition breeds familiarity; your comfort level increases with this process.
Of the four steps, the first two (running the Add User Wizard and then the Set Up Computer Wizard) are performed on the SBS server machine via the To Do List. The last two steps are performed on the SBS workstation. Run the setup program over the wire via a Web browser and install the client applications. This process is detailed in Figure 4-21.
A quick SBS 2003-specific comment for you: If you have worked with SBS in the past, say SBS 4.5, you will be very pleased to see that SBS 2003 has greatly simplified the add user and computer processes. This was accomplished in part by adding the bulk entry capability, using user account templates, and eliminating the “magic” setup diskette. All this and more will be displayed and discussed in a moment.
Figure 4-21
SBS Workstation setup process.
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
The step-by-step process for adding users and client computers commences right here, right now!
1 Again, assuming you’re logged on as the Administrator at the server machine SPRINGERS1, you will click the Add Users and Com­puters link from the To Do List.
2 Click Next at the Welcome to the Add User Wizard.
3 On the Template Selection screen, pick Power User Template, as

seen in Figure 4-22 and click Next. Figure 4-22
There are several templates to select from, including the new Mobile User Template.
BEST PRACTICE: There is an interesting design feature in the bulk add capability that relates to the Template Selection screen in Figure 4-22 above. If you look closely, the language clearly states that the selected template will be applied to all users. Furthermore, each user inherits the templates settings (as you would expect). But, we’ve got a slight problem if you were lead to believe that, using the bulk addition capability, we could add all of the SPRINGERS
users all at once. Such is not the case, because if you revisit the User List in Chapter 2, you see that two users are “power users” and the rest of the users are “users.” This translates into the following: You will need to run the Add User Wizard twice in the SPRINGERS methodology in order to add users that fall into two template categories.
Oh - and fear not that I’m ignoring the Mobile User Template. I elevate a user’s template-based permissions to that level in Chapter 11 using a cool new role transfer wizard.
BEST PRACTICE: You may look at the specific properties for each of these user templates to answer any questions you have. Such questions are often focused on exactly what settings are being invoked by selecting one template as compared to another template. However, viewing these properties can only be done when running the Add User Wizard in single-user mode (not bulk-add mode, which is the default from the To Do List). So you would click the User object under Standard Management in the Server Management console followed by a click on Add a User. Then select Display selected template’s default settings in the wizard checkbox on the Template Selection screen. You should do this while adding at least one of your users, so you better understand the background process that is occurring.
Interestingly, you can create your own user templates for use in SBS. This would make sense where you want to model a particular group of users around an application or function. For example, you might want to give users in the bookkeeping department access to the shared folder containing the data. This is done by selecting the Add Template button on the Template Selection screen (this button appears in the Add User Wizard in both single user and bulk add mode). The Add Template Wizard will commence. To learn more about adding a template and even importing and exporting templates between SBS server networks (e.g., multiple SBS customer sites),
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
click User Templates under Standard Management on the Server Management console.
Finally, just when you’d have enough template talk, I draw your attention to the fact that you are not required to use a template at all when running the Add User Wizard in single-user mode (select Do not use a template to define user settings on the Template Selection screen). When running the Add User Wizard in bulk-add mode, you must select a template (there is no option for bypassing template usage).
1 On the User Information screen, select Add. Complete the Specify the user information dialog box that appears in Figure 4-23. Click OK.
2 Click Add again on the User Information screen and complete the Specify the user information dialog box for Bob Easter in a manner similar to the above step. Click OK when complete.

Figure 4-23
Adding the first power user, Norm Hasborn.

1 Click Next after you’ve completed the entry of the two power users on the User Information page.
2 Select Set up computers now on the Set Up Client Computers page. Click Next.
3 Add the computer names PRESIDENT and CAREFEED01 by typ­ing one name at a time in the Client computer name field on the Client Computer Names page and clicking Add. Click Next.
4 Accept the default selection of all client applications being selected on the Client Applications page. Select the After Client Setup is finished, log off the client computer checkbox as shown in Figure 4-24. Click Next.

Figure 4-24
Accepting all of the settings on the Client Applications page.
10. Click Next on the Mobile Client and Offline Use page. Although this functionality isn’t part of the SPRINGERS methodology, you might consider these capabilities in the real world (functionality described under More Information). Click Next.
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
11. On the Completing the Add User Wizard page, be sure to click the here link and name the configuration page Add Users1.htm as part of your network notebook exercise. Click Finish.
BEST PRACTICE: Speaking of documenting the SBS 2003 network, there are a two other logs you would want to know about right now. These are located in \%System Drive%\Program Files\Microsoft Windows Small Business Server\Support\
*add_user_wizard.log. This log documents how users were added to the SBS 2003 network.
* scw.log. This log documents how client computers where configured for the SBS 2003 network.
A more technical log, SBSClientApps.log, can be viewed at \%System Drive%\Program Files\Microsoft Windows Small Business Server\Tools\. This log reports on internal application execution milestones.
Notes:
12. CAREFULLY read the Finishing Your Installation dialog box and
click OK. This is shown in Figure 4-25. Figure 4-25
A dialog box that hints at a next step you will perform on a client computer.
BEST PRACTICE: When you read the dialog box in the step above, you’ll note that you’re not being asked to actually go to the URL of http://SPRINGERS1/ConnectComputer at this time. Rather, the dialog box is telling you to go to a client computer and perform this action. I’ve seen people read this information far too rapidly and launch Internet Explorer on the SBS server machine and type in the URL to connect the computer. This happened repeatedly in the SBS 2003 hands-on lab tour in the US in the fall of 2003. You can not successfully run the connect computer command on the server machine, because the server is already connected to the network.
13. Click Close. Now repeat the above steps to add the remaining SPRINGERS users (listed in Chapter 2 in the User List) in one more pass using the User Template (this is the common template for all of these users). You will answer Yes when asked if you want to run the Add User Wizard again to add more users. Figure 4-26 displays the User Information screen you should have as part of this process.
Notes:
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Figure 4-26
Now you can really see the “bulk-add” capabilities in the Add User Wizard with all of these names displayed!
BEST PRACTICE: Note an interesting tidbit as you add all of the users for SPRINGERS. When you get to the Client Computer Names screen, there will be many client computers listed that have already been auto-named for you. This is typically the user name followed by “01” (e.g., BarryM01). Of course, this isn’t what we intend for the workstation naming with SPRINGERS (the User List in Chapter 2 provides that names), so you will use the Remove button to remove those names and then add the proper client computer names (SPRINGERS names computers by job function and then places 01 at the end).
So, let’s finish discussing the To Do List and then proceed to attach the client machine to the SBS network.

SBS 2003 Workstation Installation Plan

Happy July Day to you! I am Harry Brelsford, the author of Windows Small Business Server 2003 Best Practices (SMB Nation Press) and it my pleasure to post up a few pages of thisbook per day. My goal is post the entire book by the time SBS 2008 ships!
Today we start the SBS 2003 workstation installation plan. In previsous installments of this book, we planned for and installed the SBS 2003 server machine.
Have fun and enjoy the read.
Cheers....harrybbbb
Harry Brelsford, Small Business Specialist (SBSC) and CEO of SMB Nation www.smbnation.com
###
Notes:
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Workstation Installation Plan
The following tasks are necessary to be completed prior to performing the SBS hands-on workstation configuration tasks, such as adding users and setting up the workstations. These tasks include the following:
1. Setting up a staging area. Be sure to find a place to set up the work­stations if you purchase new workstations for your SBS network.
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
This workstation staging area is typically a conference room. If you are converting from an existing network, or the users already have their workstations in place, you probably won’t need a workstation setup area.
BEST PRACTICE: If you indeed use a workstation staging area, it is very helpful to have a network hub (connected to the SBS network) in the center of your work area. That way, as you build each workstation, you can complete the workstation setup tasks in a good ol’ blue-collar assembly line-like fashion. It’s very efficient.
2. Building the new workstations. If you have new workstations, physi­cally build the workstation by unpacking all the components from the shipping boxes (monitor, computer, and keyboard). Be sure to reseat each adapter card inside the new workstation in case it came loose during shipping. After connecting all the workstation compo­nents, turn on the power and verify that the workstation is functional. I recommend that you check the workstation BIOS settings similar to how the server BIOS was observed in Chapter 3. (You typically press the Delete key during the power-on phase to see the BIOS settings.)
BEST PRACTICE: Be sure to confirm that the workstations you specified and ordered while you read Chapter 2 are the same as the workstations now in your possession. And does each workstation have a network adapter card as specified and ordered?
Whether the workstation is new or not, take a moment to confirm that your workstation meets the minimum system requirements specified by Microsoft for participating on an SBS network (see Chapter 2 for discussion on this). In particular, make sure that you have enough hard disk space to accommodate the SBS client applications you intend to install in a few moments. The most popular SBS workstation setup error I’ve witnessed is a shortage of hard disk space on the client workstation. Unfortunately, you aren’t always advised of such space shortage problems until well into the SBS client workstation setup process. The workstation space requirements in SBS have grown to over 300 MB if you install each client component.
Visit www.smbnation.com for additional SMB and SBS book, newsletter and conference resources.
3. Completing the installation of the workstation operating system. New workstations typically have no operating system completely installed. As of this writing, the workstation would likely have a par­tial installation of Windows XP Professional. This is typically the case when you purchase from name-brand manufacturers, such as HP. With true clone workstations (sometimes called “white boxes”), such as the PC that your Uncle Chas built, it might or might not have any operating system (here it varies on a case-by-case basis). Regardless, it is essential that each workstation have a functional operating system, such as Windows XP Professional (my bias). So now is the time to make sure that each of your workstations indeed has a supported operating system installed and ready to run. In fact, the SBS client applications and networking functionality cannot be fully installed on a workstation until a supported workstation operat­ing system is installed. Recall from Chapter 2 that SPRINGERS has standardized on Windows XP Professional for its workstation oper­ating system on a company-wide basis.
BEST PRACTICE: Be sure to check the SBS site at Microsoft (www.microsoft.com/sbs) for which client operating systems are supported by SBS 2003. Because this list changes over time and will not stay current as of this writing, I’m simply directing you to the Web site.
However, I do feel secure sharing with you that the following operating systems are not supported by SBS 2003 in any way, shape, or form: OS/2, CP/M, Apple DOS, and Apple ProDOS. If you have such a workstation, do yourself a favor and strongly consider purchasing an Intel-based workstation running one of the supported operating systems so that you can participate on the SBS network.
And perhaps the “wild card” in this whole workstation equation will be XBOX from Microsoft. Wouldn’t it be cool to have XBOX as a client computer on an SBS 2003 network?
4. Testing the workstation’s network connectivity. Perform a work-station-level green light test: Plug a network cable (that is, CAT5
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
10BASE-T cable) into the workstation’s Ethernet network adapter card jack. Make sure the other end of the network cable is connected to an active hub connection (for example, the hub in your worksta­tion staging area). Much like the testing you performed on the server in Chapter 3, make sure that both the hub and workstation network adapter card jack have a green or active light. If you use existing workstations on an existing network, you can also perform this test with little effort. Simply turn on the existing work­station and see whether the network adapter card jack is green or active. Then trot over to the network hub and confirm the same.
5. Completing the workstation installation worksheet. Be sure to revisit the SBS network user list shown in Chapter 2 (see the “User List” section and complete the Workstation Installation Worksheet for each user. The Workstation Installation Worksheet has been completed for Norm Hasborn, SPRINGERS president (see Table 4-1). The entries for the remaining employees are provided in Appendix C.
BEST PRACTICE: Remember that it is far better with SBS to populate each wizard page field, even if that means you enter N/A (Not Applicable or Not Available) because you don’t have valid data to input. That way, you know at a later date that you didn’t overlook any user and computer setup configuration field. Also, SBS user and computer setup configuration information is used in other areas of the SBS network, making it important to complete each and every user and computer setup configuration field.
Notes:


Chapter 4 ☛ SBS 2003 Deployment and Management Tools Visit www.microsoft.com/technet for the latest updates for any Microsoft product. Table 4-1: SBS Workstation Setup Sheet Setup Field Input/Value/Description Where Used User’s Full Name (First, Last) Norm Hasborn Add User Wizard Logon Name NormH Add User Wizard Telephone 206-123-1234 Add User Wizard Password Purple3300 Add User Wizard E-mail alias NormH (default) Add User Wizard Exchange Server SPRINGERS1 (default) Add User Wizard Exchange store Mailbox Store (SPRINGERS1) (default) Add User Wizard Description for User Founder and President Add User Wizard Allowed to change password No Add User Wizard (Y/N)? SBS User Template Power User Add User Wizard Workstation NetBIOS PRESIDENT Set Up ComputerWizard SBS Programs to Install Complete: Set Up ComputerInternet Explorer Wizard Outlook 2003 Shared Fax Client Operating System Windows XP Professional Set Up ComputerWizard Verify available workstation Yes Misc hard disk space based on SBSPrograms to install listedimmediately above (forexample, 300 MB required) Turn off programs at work­Yes/No? Misc station such as anti-virus programs. SBS server-based Shared NORMH Misc. Folders this user will access. USERS COMPANY ACCOUNTING OLD APPLICATIONS Printers HP5 Misc.
4-41



Network Protocols
TCP/IP
Misc.
IP Address (Static or Dynamic)
Dynamic
Misc.
Mapped Drives
S: SPRINGERS1\NORMH T: SPRINGERS1\USERS U: SPRINGERS1\ ACCOUNTING V: SPRINGERS1\OLD W: SPRINGERS1\ APPLICATIONS
Misc
Workstation Shares (shares on workstation)
N/A
Misc.
Additional Applications to install (for example, GreatPlains Dynamics accounting):
Great Plains Dynamics client FRX Report Writer
Misc.
Special configuration issues
Triple-check security. This is the president’s PC.
Misc.
Comments
Complete this one last afterall other workstations.
Misc.
Tested Logon (Y/N)
No
Misc.
Repairs/ReconfigurationNeeded

Misc.

BEST PRACTICE: Remember that the workstation name is typically based on job title or function. Thus, the workstation names associated with the users at SPRINGERS are closely related to the user’s job title. This naming convention is helpful when you have staff turnover, but the jobs remain the same.
Another useful practice, although not used with SPRINGERS, is to name machines after something neutral, such as fruits. A former client, Larry P, did this because he observed that while people change jobs, machines don’t. The same job titles typically keep the same machine. Or sometimes you have people leave and the job is restructured with a new title. You get the point. Hey, if I’m going to have a machine named after a fruit, I want the machine named KUMQUAT01!
Note that for all users, access to the Internet is allowed by default just as it was in SBS 2000 (such wasn’t the case in SBS 4.5).

Houston WPC - Here I come!

Howdy y'all...
I am writing this as I drive across Washington state uising my tablet PC andverizon aircard. I am with my family starting the LONG drive to Crested Butte Colorado to be followed by my flight to Houston TX. I will be presenting on the public sector panel on SMB Day (next Monday) and then having much fun as a media member at the larger WPC conference. Needless to say - I will be very busy BUT I always enjoy BSing with like-minded SBSers and SMB consultants....so pull up a chair and shout hello....I would love ot find out what you think (even how you think!)
With that said - I will post my bloggage from thecar over the next few daysenroute to Colorado. Be safe out there!
harrybbbbbbb
Microsoft Small Business Specialist (SBSC), author of Windows Small Business Server 2003 Best Practices and ceo atsmb nation (www.smbnation.com).

SBS 2003: Activate Your Server and Add CALs

hi there - I am harry brelsford, author of the infamous SBS 2003 purple book and I am posting up a few pages per day until SBS 2008 ships.
Today we activate the SBS 2003 and add Client Access Licenses (CALs) - all from the amazing To DO List
cheers...harrybbb harry brelsford, ceo at smb nation, www.smbnation.com
###
Activate Your Server
In the real world, you would now click the Activate Your Server task on the To Do List and complete it. Because you are creating an imaginary network for SPRINGERS, let’s not do that and say we did! Seriously, when you make a second pass at your SBS network, you will, of course, complete this task.
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Server activation can occur online or via the telephone. Server activation is required because your server will otherwise become inoperable 14 days after creation if it isn’t activated.
Add Client Licenses
Here again, in the real world, you’d likely add more client access licenses (CALs) in order to support the full staff at your small business site. Earlier I spoke to licensing and its improvements (purchase online, device and user CALs, etc.).
In the case of SPRINGERS, we’re gonna keep it simple and not dig deeper into your hip pocket to make you purchase CALs. Remember, this is a sample network to learn SBS 2003. Later, when you’re “live,” you’ll proceed to purchase the required CALs you need.
BEST PRACTICE: Now select the Done checkbox on the To Do List
for the two tasks discussed immediately above.

Configure Remote Access in SBS 2003 [Windows Small Business Server 2003 Best PRactices book excerpt]

Happy Friday readers! Harry Brelsford here, author of the infamous purple book! I am posting up a few pages per day of this book until SBS 2008 ships!
Today we discuss configuring remote access from the SBS 2003 TO DO LIST (what a computing paradigm eh?)
cheers...harrybbbb
harry brelsford, ceo at smb nation, www.smbnation.com
PS - check out our huge three-day fall conference in Seattle at the above URL
###
Configure Remote Access
Welcome back. Time for more step-by-step.
1 Click on the Configure Remote Access link.
2 Click Next at the Welcome to the Remote Access Wizard.
3 Verify that Enable remote access is selected and VPN access is

checked as shown in Figure 4-19. Click Next. Figure 4-19
This is the magic moment for facilitating VPN remote access.
4. On the VPN Server Name page, the Server name field is automati­cally populated with springers1.springersltd.com (this information was extracted from the EICW). After confirming you screen looks like Figure 4-20, click Next.
BEST PRACTICE: So, do you always have to VPN in via the FQDN you’re entering in Step 4 above? No! You can also ring up the SBS server machine by simply typing in the wild-side IP address to commence a VPN session. In the case of SPRINGERS, this would be
207.202.238.215.
Figure 4-20
You are defining the FQDN that allows access to the server over the Internet.
5. Click the “here” link on the Completing the Remote Access Wiz­ard and save the configuration as VPN.htm in the My Documents folder (similar to the steps you undertook at the end of the EICW). Click Finish. After a few minutes the remote access configuration process will be completed, at which time you will click Close.
BEST PRACTICE: Before you and I become forgetful, please select the Done boxes on the To Do List for the Connect to the Internet and Configure Remote Access tasks.

CEICW completion in SBS 2003

Hello loyal readers - today we complete the CEICW in SBS 2003. Thanks for reading.
Harrybbbbbb, author of Windows Small Business Server 2003 Best Practices
Harry Brlesford SMB Nation www.smbnation.com
###
11. On the Web Server Certificate, select Create a new Web server cer­tificate and complete the Web server name field by typing springers1.springersltd.com. Your screen should look similar to Fig­ure 4-11.

Figure 4-11
Creating the full Internet name for external clients to receive security certification.
BEST PRACTICE: What you’ve done in Figure 4-11 is provide the fully qualified domain name (FQDN) that can be accessed directly over the Internet. Remember, you’ll need a resource record (“A” record) registered in the DNS at your ISP which points to the IP address of your wild side network adapter card to make the FQDN functional in this scenario. In the case of SPRINGERS, the IP address
207.202.238.215 would point to springers1. springersltd.com via an A record at the ISP. Whew!
Oh - another war story. Perhaps you completed the original online SBS 2003 hands-on lab that was released in mid-July 2003 with the release candidate software (microsoft.granitepillar.com/partners). In that hands-on lab, there was an exercise where you completed the EICW. On the Web Server Certificate page of the EICW, you configured the Web server name field with Denver.wood­grovebank.local. So what’s wrong with that picture? The *.local domain extension as part of your FQDN entry can’t be referenced externally. So that would be a mistake. One way that you could satisfy your own curiosity about this matter would be to click the More Information button. The first sentence that describes the first option (Create a new Web server certificate) spells it out clearly by saying “...access your server from the Internet.”).

12. Select Enable Internet e-mail on the Internet E-mail page and click Next.

13. Select Use DNS to route e-mail on the E-mail Delivery Method page and click Next. This is the most common setting when using Simple Mail Transport Protocol (SMTP)-based e-mail, and it is indeed part of the SPRINGERS story line.

Notes:
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
14. On the E-mail Retrieval Method page, select Use Exchange and verify that E-mail is delivered directly to my server. Click Next. This is shown in Figure 4-12.
Figure 4-12
In the case of SPRINGERS and in the real world, you typically have your e-mail delivered directly to the SBS server machine.
Notes:
15. On the E-mail Domain Name page, type springersltd.com in the E-mail domain name field. This is shown in Figure 4-13.
BEST PRACTICE: Here again, if you took the online SBS 2003 hands-on lab available after mid-July 2003 (microsoft.granitepillar.com/ partners), you might recall that you were instructed on the E-mail Domain Name screen to enter a third-tier domain name (e.g., denver.woodgrovebank.com). There is a problem with this instruction in that you only want to enter a second-tier domain name (e.g., woodgrovebank.com).
Figure 4-13
Enter springersltd.com for the register Internet e-mail domain name.
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
16. On the Remove E-mail Attachments page, confirm that Enable Exchange Server to remove Internet e-mail attachments that have the following extensions. Then observe that all of the file name extensions are selected. This is shown in Figure 4-14. Click Next.
Figure 4-14
This is a really cool new feature in SBS 2003: the ability to block harmful e-mail attachments!
BEST PRACTICE: Exactly what are these harmful e-mail attachments, anyway? And how are they blocked? Are the attachments blocked on POP3 e-mail in addition to SMTP e-mail? The answers to all your questions can be found by clicking the More Information button on the Remove E-mail Attachments page. Take a moment to do that now.
17. On the Completing the Configure E-mail and Internet Connec­tion Wizard page, click the link at the bottom titled here. You will proceed to create a network notebook.
18. As seen in Figure 4-15, a Web page displaying the EICW configura­tion information appears when you select the “here” link in the prior step. Select File, Save As and save the file as EICW Configura­tion.htm in the default location (My Documents). Click Save.
BEST PRACTICE: A few comments about this “network notebook” capability in the SBS 2003. First, major hats off to the SBS development team for adding this capability, because every SBS and SMB consultant I know worth their salt has always wanted to do a better job of documenting their network! More important, if you’re the second SBS consultant at a customer’s site, you’ll be mighty appreciative if your predecessor had taken the time to perform this type of documentation.
Second, at the end of any native SBS 2003 wizard, you are presented with a “here” link to facilitate the creation of this network notebook. So, no excuses for not taking an extra moment to literally click “here” and document that network!
Third, look at the default naming in Figure 4-15 below. Notice it’s a sorta hokey looking file name. That’s why you rename the file to be more descriptive in Step 18 above. Fourth, you’re going to plop all of these network notebook files in a folder that becomes your de facto notebook binder.
Oh - you can still follow my advice from my prior book (Small Business Server 2000 Best Practices) and simply select the configuration information via your mouse on the completion page (Step 17) by typing CTRL-C to copy it to the operating system clipboard and then selecting CTRL-V to paste it into a text document (say in WordPad).
Notes:
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Figure 4-15
Displaying network configuration information.

19. Close the Web page displaying the configuration information and click Finish back on the completion page. The EICW configuration process will take several minutes. Click Close at the end of the con­figuration process.

20. A dialog box will appear notifying you that password policies have not been enabled on the network. Let’s go ahead and do that now, so click Yes.

Notes:
21. Select all checkboxes on the Configure Password Policies dialog
box (Figure 4-16) and click OK. Figure 4-16
Implementing meaningful password policies reflects security improvements in SBS 2003.
22. Click OK when notified that your server is connected to the Internet and immediately apply the latest critical and security updates. This is a great reminder and much appreciated. In the real world, you would do exactly what is being suggested (with SPRINGERS, I’m assum­ing you’re building this on a test network possibly without a real Internet connection, so please make the necessary adjustments). When you click OK, Internet Explorer will attempt to connect to the Microsoft update site. In the case of SPRINGERS (assuming you aren’t truly connected to the Internet) simply close the Web page. I discuss the updating process in Chapter 5.
BEST PRACTICE: By the way (BTW), if you launch Internet Explorer on the SBS 2003 server machine (SPRINGER1) prior to launching and completing the EICW, you will see the Web page displayed in
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Figure 4-17. Interestingly, it is a Web page describing the process of
how to complete the EICW.
Figure 4-17
Internet Explorer encourages you to complete the EICW when you first launch it on an SBS 2003 server machine.
Notes:
After your run the EICW, the default Web page programmatically changes to CompanyWeb, as seen in Figure 4-18. Note that it’ll take a moment the first time you launch Internet Explorer post-EICW, as some background page-building activity will occur.
Figure 4-18
Post-EICW, the default Web page becomes CompanyWeb.
It’s been a long haul so far in this chapter, and we’ve got a long way to go. Take a break and I’ll see you back here after a cup of coffee.

Connect To The Internet with SBS 2003 (The TO DO LIST) [book excerpt]

howdy y'all - I am harry brelsford, author of Windows Small Business Server 2003 Best PRactices and the CEO of SMB Nation (www.smbnation.com).
I am posting up a few pages per day of my book until SBS 2008 ships!
Today we work further into the Connect to the Internet option on the SBS 2003 To Do List.
cheers....harrybbbb
PS - did I forget to mention we have a three-day conference in Seattle this October featuring SBS 2008? :)
###
Connect to the Internet
Continuing our way down the list, we actually have to “pause” on the list in the case of SPRINGERS, because we have a second network adapter card installed on our server machine that needs to be configured. You’ll recall that two network adapter cards were present back when you installed SBS 2003 in Chapter 3. To configure the network adapter card, before continuing with the Connect to the Internet link, please perform the following tasks.
1 Log on as Administrator on SPRINGERS1 with the password Husky9999! and click the Start button.
2 Click Control Panel, Network Connections and select Network Connection. This is the second network adapter card because the primary local network adapter card is called Server Local Area Con­nection by default. A Network Connection box will appear inform­ing you the card is being enabled.
3 When notified by another Network Connection dialog box that the network adapter card can be configured by the E-mail and Internet Connection Wizard, click Cancel to not launch such a wizard, and allow the network adapter card to be configured manually.

BEST PRACTICE: So exactly what gives in Step #3 immediately above? Here’s the deal. If you click Yes in the prior step, the E-mail and Internet Connection Wizard starts as you would expect. Then, when you get to the fourth screen of said wizard, the darn second network adapter card has been automatically enabled to receive its IP address dynamically. Truth be told by me to you, but it’s unlikely in most cases that you’d want to acquire your IP address dynamically on the wild-side NIC (aka second network adapter card). Rather, you are far more likely to input a static IP address that your Internet Service Provider (ISP) gave to you for use on your SBS 2003 network. And that’s the scoop, mates!
4. This is where the strange get weird. You’ve clicked Cancel, which killed the process underway from the steps above. Please repeat Step #2 again to select the Network Connection from the Network
Visit www.smbnation.com for additional SMB and SBS book, newsletter and conference resources.
Connections option in Control Panel. The Network Connection Status dialog box will appear.
1 Click Properties. Network Connection Properties will appear.
2 Select Internet Protocol (TCP/IP) and click Properties.
3 Complete the General tab of the Internet Protocol (TCP/IP) Prop­erties sheet to reflect the following information (as shown in Figure 4-4). IP address is 207.202.238.215, Subnet Mask address is

255.255.255.0 and the Default Gateway address is 207.202.238.1. Make the Preferred DNS server 209.20.130.35 and make the Alter­nate DNS server 209.20.130.33. Click OK.
Figure 4-4
Correctly configuring the second network adapter card for the SPRINGERS SBS network.
Note on page 4-21 I will explain how the Preferred DNS server field is reset to
192.168.16.2 by the EICW overriding your settings in Step #7 above.
8. Click Close twice (to return to your desktop).
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
It’s now time to configure the e-mail and Internet connectivity capabilities in SBS 2003. Perform the following:
1 Click Connect to the Internet from the To Do List in Server Management.
2 The Welcome to the Configure E-mail and Internet Connection Wizard page appears. Take a moment to read about the information that is required to complete this wizard by clicking on the Required Information for Connecting to the Internet link (then close the help screen that appears). Click Next.
3 On the Connection Type screen, select Broadband and click Next as seen in Figure 4-5.

Figure 4-5
Select the Broadband choice on the Connection Type screen.
1 Select A direct broadband connection beneath My server uses: on the Broadband Connection page. Click Next. See Figure 4-6.
2 On the Network Connection page that appears, confirm that the ISP network connection reflects Network Connection with the IP address

of 207.202.238.215. Confirm the Local area network connection re­flects the IP address of 192.168.16.2. This is shown in Figure 4-7. Click Next.
Figure 4-6
You will select a direct broadband connection for SPRINGERS.
Notes:
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Figure 4-7
Take an extra moment to confirm your page looks like this figure. This is where you define the local area network connection (the “inside”) and the outside Internet network connection (the “wild side”).
6. The Direct Broadband Connection page appears. Confirm your screen looks similar to Figure 4-8 and click Next.
Notes:
Figure 4-8
The bottom three fields are editable on the Direct Broadband Connection page.
BEST PRACTICE: So even though my advanced SBS 2003 book won’t be out until mid-2004, a few gurus are reading this book and might ask this question after reviewing the Direct Broadband Connection page in the EICW: “Why do you accept the ISP DNS IP address settings and not point it back to 192.168.16.2 to utilize the DNS service in SBS 2003 as a well-known TechNet article states?” The same question was asked by an angry student whom we’ll call Jeff in Dallas, Texas, at a late-September 2003 SBS 2003 hands-on lab. Turns out Jeff thought he was being duped by the EICW because he wanted to point the wild-side NCI cards back to the DNS of
192.168.16.2. Fair enough. But Jeff, you might be surprised to know that the EICW does this internal referral thingy after running, because it’s the darn EICW that configures the DNS in SBS for forwarding out to the ISP’s DNS servers.
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.

1 Select Enable firewall on the Firewall page and Click Next.
2 On the Services Configuration page, select E-mail, Virtual Pri­vate Networking (VPN) and Terminal Services, and FTP. This is part of the SPRINGERS methodology and something you might not do for every customer site in the real world. Your screen should look similar to Figure 4-9. Click Next.

BEST PRACTICE: When you select the VPN-related checkbox, you’ll receive a notice that the server is not configured for remote access through VPN. You will further be advised that you’ll need to run the Remote Access Wizard in order to do this. This message is normal, helpful, and actually points to the very next link on the To Do List that you and I will complete for SPRINGERS in the next section.
Figure 4-9
Selecting what services will be accessible via the Internet.
The Web Services Configuration page appears. This is where you’ll select which Web services are externally accessible. In the case of SPRINGERS, we’ll select the radio button titled Allow access to only

the following Web site services from the Internet and select every­thing EXCEPT Business Web site (wwwroot) and click Next. This has effectively selected all of the checkboxes you see in Figure 4-10.
Figure 4-10
Completing the Web Services Configuration page.
BEST PRACTICE: Call it a case of Miami madness or “mean season” malfeasance, but there I was delivering the SBS 2003 hands-on lab in Miami, Florida in early October 2003 and being blamed by a student that an exercise involving Remote Web Workplace didn’t work. How could this be? If you look closely in Figure 4-10, the default settings on the Web Services Configuration page include the Outlook Web Access and the Remote Web Workplace screen. What gives here?
The student didn’t append the URL with /remote. You’ll learn more in Chapters 8 and 10 on this topic.
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
And now for the rest of the story. Microsoft and I agree that you do not want to expose your root page to the Internet - EVER - unless you are going to host a Web site. Because the SPRINGERS methodology does not include Web site hosting, you’ve made the correct selections in Figure 4-10.

10. Approve the dialog box that advises you that the site will be acces­sible via the Internet. To do this, click Yes.

Watch Redmond - it is late June

Hey - it is late June in Redmond and you know what that means. A flood of reorganization announcements, *retirements* and departures for personal reasons :)

Stay tuned...the fun is only starting!

harrybbbbb
Harry Brelsford
CEO at SMB Nation
www.smbnation.com

SBS 2003 To DO List explored [Windows Small Business Server 2003 Best Practices book excerpt]

howdy - i am harry brelsford (ceo, smb nation at www.smbnation.com) and I am the author of the infamous SBS 2003 purple book. I am posting up a few pages per day until the SBS 2008 product ships - so enjoy in good health.
Today we start our journey to look at the famous To Do List in SBS 2003 and review the Security Best Practices link.
cheers...harrybbbbb
###
To Do List: In Order!
So with the finer points of Server Management console behind us, it’s time to get down tonight! Let’s start by planning the SBS 2003 Methodology ballad. Few things in the deployment of SBS exemplify the notion that SBS is a ready-made network in a box (or SMB consulting practice in a box for us consultants) than the existence and brilliance of the To Do List. We’ll spend tons of time walking through the To Do List here.
But back to the brilliance part. The To Do List has been engineered to be your deployment approach for all of the SBS servers you’ll ever install. You start at the top and work your way to the bottom. This structured approach, whether you install one or 1000 SBS server machines, should be honored. Don’t be like a Boeing IT employee here in Seattle who likes to say, while installing SBS 2003 at her church over a weekend, “I don’t use the To Do List or the Server Management console at Boeing, so we’re not going to use it here on this holy site!” Such pompous thinking is truly short-sighted in successfully deploying SBS 2003 and can result in an unsatisfactory outcome. But BY FOLLOWING THE TO DO LIST, you can be assured of a positive outcome each and every time when you set up SBS 2003. You heard this breaking news here first!
So that said, let’s start at the top and work down the To Do List. You’ll start by noticing the To Do List is divided into Network Tasks and Management Tasks. That’s because the SBS development team, in its wisdom, determined that folks wanted to see it play out that way with task sets divided between network and management.
BEST PRACTICE: Note that you and I will indeed complete the To Do List in order as part of the SPRINGERS methodology. You would expect this. However, I don’t have to walk through the entire To Do List in this chapter; instead, I’ll take you through the first seven links. I leave the Configure Fax, Configure Monitoring, and Configure Backup links to be completed in order in later chapters.
Remember the mantra, mates: Always complete the To Do List in order!
Network Tasks
There are five items under Network Tasks on the To Do List that we’ll walk through right now.
View Security Best Practices
Talk about a future book! You could clearly write a thick tome on security on small business networks, but I’ll leave that for another day. Rather, I point you to this link as a “primer” on top-of-mind security best practices to consider as you move forth in deploying your SBS network. In fact, it’d be good to visit this link with each SBS server you deploy so that you don’t overlook a security best practice. When you select View Security Best Practices, you’ll read details on the following 16 topics:

1. Protecting your network from the Internet by using a firewall

2. Configuring password policies

3. Configuring secure remote access to the network

4. Renaming the Administrator account

5. Implementing an antivirus solution

6. Managing backups

7. Updating your software

8. Running security tools

9. Granting access permissions

10. Educating users

11. Not using your Windows Small Business Server as a workstation

12. Physically securing the server

13. Limiting user disk space

14. Keeping up-to-date on security information

15. Auditing failed logon events and account lockouts

16. Using monitoring tools

BEST PRACTICE: Regarding item #13 above, you would want to know that SBS 2003 implements a disk quota for users in the Add User Wizard. Specifically, for a user the disk space is limited to 1024 MB and a warning is sent at 900 MB. This can be manually modified later.
When you complete reading this list, please close the Small Business Server Help and Information screen that is open and return to the To Do List. Check
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
the Done box next to View Security Best Practices (you check off each To Do List item as its completed, which is a nice touch!).

Power User Console in Windows Small Business Server 2003 [sbs 2003 book excerpt]

hi - I am harry brlesford and the author of Windows Small Business Server 2003 Best Practices (SBS 2003). My goal is to post a few pages per day of my book for you to read and have the entire thing posted by the time SBS 2008 ships.
Today we discuss the Power USer Console!
cheers....harrybbbb Harry Brelsford, CEO at SMB NAtion, www.smbnation.com
###
Power User Console
And just when you thought they’d taken away the Personal Console from SBS 2000 days, I have news for you. If you really must have your “Personal Console,” which is a dumbed-down version of Server Management called Server Management for Power Users, you can find it at the following location:
%System Drive%\Program Files\Microsoft Windows Small Business Server\
Administration\mysbsconsole.msc Personal console, I mean Server Management for Power Users, is automatically launched when a Power User logs on remotely via Terminal Services to perform server management tasks (this is shown in Figure 4-3). Note the Power User is totally locked into using Server Management for Power Users. If said Power User closes this console, they are immediately logged off the SBS server machine. Period.
Figure 4-3
A power user at SPRINGERS logs on to perform server-related work and uses
Server Management for Power Users.
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.

Advanced Management Console in SBS 2003 [Windows Small Business Server 2003 Best Practices Book Excerpt]

hey-hey - I am harry brelsford, ceo of SMB Nation and the author of Windows Small Business Server 2003 Best Practices. Each day, I am posting up heaps of my infamous purple book until SBS 2008 ships!
Today we discuss the advanced management console (MMC-based) in SBS 2003!
cheers….harrybbbb
Harry Brelsford, CEO SMB Nation, www.smbnation.com
###
Advanced Management
It is under Advanced Management that the “native tools” you need to interact with SBS 2003 are exposed. For those of you who worked with SBS in the 4.x era, you’ll recall that it was more difficult to utilize the native tools (and some native tools even crippled SBS 4.x!). That, of course, changed in the last two SBS releases, wherein native tools are placed front and center for your benefit. The components of Advanced Management, as listed on the left panel of Figure 4-2, are described below.
Figure 4-2
The focus in this figure is the Advanced Management components.
• Active Directory Users and Computers. Ah, every MCSE certifica­tion candidate has likely committed to memory this tool that is the primary interface for managing objects in Active Directory such as users and groups.
BEST PRACTICE: A hands-on lab instructor for whom I have the utmost respect has an interesting take on Active Directory Users and Computers. He believes that it is the primary approach to managing the messaging function on a server computer with Exchange Server 2003 installed. What? I’ll explain this more in Chapter 6, but take a moment to look at the Exchange-related tabs that appear when you view a user object in Active Directory Users and Computers when you’ve selected Advanced Features under the View menu. You’ll see four Exchange-related tabs. Then ask yourself where you do most of your Exchange-related management on a day-to-day basis. I do believe you’ll agree that you do it here, pardner!
• Group Policy Management. Remember that paradigm d’etre we dis­cussed earlier about support for client computer configuration? Yep! That is again manifested by the Group Policy Management page.
• Computer Management (Local). Lots of great reasons to get to know this object, including the ability to manage your hard disks and start and stop services. I’ll explore this tool more in Chapter 11.
• First Organization (Exchange)/SPRINGERSLTD (Exchange). This is System Manager in Exchange Server 2003, where I can’t deny many Exchange-related tasks are performed. Let’s hold off further discus­sion until Chapter 6.
• POP3 Connector Manager. Hail to Charlie, a senior member of the SBS development team who owns the POP3 Connector Manager in SBS 2003. This allows you to download e-mails from POP3 servers (typically located at your ISP). This is discuss more in Chapter 6.
• Terminal Services Configuration. This tool could be used to modify the default Terminal Services configuration in SBS 2003 (which is in Remote Administration Mode). I’ll discuss Terminal Services more in Chapter 11.

Visit www.microsoft.com/technet for the latest updates for any Microsoft product.

• Internet Information Services. Yes - Internet Information Services (IIS) is alive and well in SBS 2003 and the focus in Chapter 10, so I’ll wait until then to dive into the details.
• Migrate Server Settings. This page brings together all the cool settings you can migrate between SBS 2003 servers. This would, of course, benefit an SBM/SBS consultant who has perfect settings that he wants to easily share with customers. More on these settings in Chapter 11 and 12.

BEST PRACTICE: For a real good time, look at the menu shortcuts in the Server Management console. Click Favorites from the upper toolbar and look at the Standard Management and Advanced Management menu items. You might be surprised by what you see, such as the Sessions and Open Files items.
BEST PRACTICE: Don’t forget that the Server Management console in SBS 2003 is based on Microsoft Management Console (MMC)
2.0 and that customization is possible. How? Simply place the Server Management console in Author mode and add a snap-in, such as the SQL Server Enterprise Manager. The location of the Server Manager console on which you would want to perform your modifications is:
%System Drive%\Program Files\Microsoft Windows Small Business Server\Administration\itprosbsconsole.msc
You would right-click the above file and select Author from the secondary menu to make your edits.
By the way, a little SBS culture here. Really, really early looks of SBS 2003 had the console being based on SharePoint technologies (e.g., Windows SharePoint Services). But in the final product, it’s all MMC 2.0, baby!

Standard Management Console - SBS 2003 [book excerpt]

Harry brelsford here, author of Windows Small Business Server 2003 Best PRactices and just posting up more of my book for you, the reader. My goal is to have the entire book posted by the time SBS 2008 ships!
harrybbbb
Harry Brelsford, ceo at smb nation www.smbnation.com
Standard Management
Consider this both the “noun” and the “verb” of the Server Management console. The objects listed here are “things” you do such as faxing. What’s important to understand here is that you are not exposed to the application name at this time (e.g., Exchange). Microsoft has, in its wisdom that I respect here, elected to be task-oriented, such as Backup (i.e., Backup is something that we “do”). The components of Standard Management are described below.
• To Do List. This is covered in extensive detail in the next section but cuts to the heart of the SBS 2003 deployment methodology. Read on whilst I write on.
• Information Center. This is your SBS portal for seeking help or more information. You can click over to Microsoft update site, view internal documentation, click over to the SBS public product Web site at Microsoft and commence an online technical support request.
• Internal Web Site. This allows you to manage your Windows SharePoint Services internal Web site. I’ll feature many of the links on this page in Chapter 7.
• Fax (Local). This obviously relates to the SBS 2003 faxing function which is awesome. I cover this area in Chapter 9.
• Monitoring and Reporting. Covered in more detail in Chapter 12, this relates to configuring the Server Status Report and the Health Monitor tool in SBS 2003.
• Internet and E-mail. This is the page for all matters related to Internet connectivity and e-mail. We’ll spend some time here in Chapters 6 and 10.
• Shares (Local). Not surprisingly, this page displays the folders that are shared on the SBS server including administrative (hidden) shares that end with the dollar sign ($) in the share name. I’ll mention it in Chapter 11 again, but be advised that the View Connected Users on this page is the easiest way to discover who is currently logged on the network.

Visit www.smbnation.com for additional SMB and SBS book, newsletter and conference resources.

• Backup. WOW! Much improved in SBS 2003, this is where the backup and data protection experience commences. Lots of discussion on this in Chapter 11.
• Licensing. A few changes here that I think you’ll like. No longer is client access licensing information hidden on an “About...” dialog box (as it was in SBS 2000). No sir! It’s now presented front and center on the Manage Client Access Licenses from the Licensing link.

BEST PRACTICE: Client Access Licenses (CALs) have really changed in SBS 2003. First, there are two types of CALs: devices and users. Long-time SBSers are familiar with device-based management, where a certain number of client computers are allowed on the network (say 55 PCs based on the number of CALs you have purchased for the SBS 2003 network).
User-based licensing is new to us SBSers and might be implemented under a scenario where device-based licensing doesn’t make sense. For example, imagine a small software development company with ten employees using SBS 2003. Each employee has four PCs for development and testing purposes (for a total of 40 devices). Here the customer is better off by using the user-based licensing and purchasing ten CALs.
So you want more licensing chatter? You can mix and match device and user-based licensing to optimize the amount of bucks you drop on CALs, pardner! And remember that the licensing model is EXACTLY THE SAME as Windows Server 2003 which helped me when I had to learn about SBS 2003 licensing and then proceed to go out and give speeches on it. So in addition to the licensing discussion found at the main SBS 2003 Web page (from the Information Center link above), you are highly encouraged to view the traditional Windows Server 2003 CAL licensing discussion at www.microsoft.com/windowsserver2003/howtobuy/licensing/ caloverview.mspx.
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Other licensing tidbits include the online purchase of CALs and the elimination of the CAL licensing diskette (thank you). You purchase CALs by the five pack (as was the case in the SBS 2000 time frame).
Note in my advanced SBS 2003 book, due mid-2004, I’ll delve deep into the depths of SBS licensing, but for the purposes of this book and SPRINGERS, this is far enough for now! Also be advised that I won’t have you add more CALs to the SPRINGERS network as part of this step-by-step book (even though you add ten users later in the chapter). That’s because I never have you log on more than one user at a time as we work through this SBS tome.
• Users. This link displays the Manage Users page where much of the support and configuration for users can occur.
• Client Computers. This link displays the Manage Client Computers page.

BEST PRACTICE: Aside from your performing client computer management duties here, this is the one place that you can start the Setup Computer Wizard (SCW) natively without having to rerun the Add User Wizard (to which the SCW is chained). Huh? Say that again and don’t use ten dollar words?!?! Okay - what I meant to say is that if you have a user, let’s call her “Sally,” and she purchases a new HP laptop, you really only want to run the SCW to add existing user Sally’s new HP laptop. You don’t need to run Add User Wizard to get to the SCW to configure Sally’s new HP laptop. If this still doesn’t make sense, it will later in the life of SBS when users start to replace client computers. Trust me.
BEST PRACTICE: Each release of SBS has a “paradigm” combined with a “raison d’etre” (which I’ll call a “paradigm d’etre”). In the first releases, SBS was the BackOffice bundle at a competitive price. The SBS 2000 time frame had “server-side stability” as its reason for being. SBS 2003 has a couple of paradigm shifts and I’ll share one here: client computer setup. Here’s what I mean. In the SBS 2000
time frame, there was such an emphasis on the server-side that the client computers were much ignored. The damn Define Computer Applications link from the SBS 2000 To Do List basically didn’t work. And the SBS 2000 To Do List and consoles didn’t natively take advantage of Group Policy Objects (GPOs). That’s all changed in SBS 2003 where client computer setup, configuration, and management received much attention! The results show.
I’ll share another SBS 2003 paradigm d’etre in just a moment.
• Server Computers. This is the interface for the management of server computers.
BEST PRACTICE: There is nothing like timing in business. As I was writing this chapter, I was working with my client, a cardiology clinic, who wanted to move to SBS 2003. In the planning phase, the managing doctor (that’s Dr. Paul to you) held the belief that SBS can be the only server on the network. Such is not the case, as you have member servers and even other domain controllers on the network (as I discussed earlier in Chapter 1). However, you can have only one SBS 2003 server machine on the network.
So, assuming you might have additional server computers on an SBS 2003 network, how might you manage them? From the Server Computers link we’re discussing right here, right now!
• Printers. Printers are printers (what can I say?). Once the primary rea­son we even had networks in small businesses (to share printers), print­ers are managed here. This is also where you manage the fax device that we treat like a printer.
• Distribution Groups. You use distribution groups to send e-mail to a specific set of people. By default, everyone you add to the SBS net­work will appear in the default distribution group named after the information you provided in the Organization field in Figure 3-4

Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
earlier in this book (when you were in the GUI-based phase of the Windows Server 2003 setup). In the case of SPRINGERS, the default distribution group would be called Springer Spaniels Limited.
• Security Groups. This relates to grouping users together for the pur­pose of granting permissions. For example, the folks in the bookkeep­ing department might belong to a security group called Accounting that has specific permissions related to the Timberline accounting folder. Please click over and view all the security groups created by default in SBS 2003. (Hint: There should be 22 security groups by default which would make a great exam question.)
BEST PRACTICE: You might not have known that security groups are actually e-mail enabled by default in SBS 2003. You would care about this because, for instance, the Accounting security group example I mention above might be the same group of people whom you want to receive an important e-mail about a Timberline accounting upgrade, etc., and you wouldn’t need to plop all these folks in a new distribution group to accomplish this. Rather, you could simply e-mail the security group (which should be security@springersltd.com by default once you create such a security group).
• User Templates. User templates are really nothing more than a disabled user account that has certain settings you want to easily apply to new user accounts you are creating. Each of the templates is self-explana­tory by reading the Description field on the Manage Templates page that appears. However, what is interesting is the addition of the Mobile User Template to provide remote access support for worthy users.
BEST PRACTICE: Time for another paradigm d’etre! So another big deal in SBS 2003 is the support for mobile worker bees. The Mobile User Template is only the start of how this paradigm d’etre plays out, and I continue the mobility discussion in Chapter 8.
BEST PRACTICE: Around when SBS 2003 was being released in October 2003, I was teaching a hands-on lab in Orange County, California, when a student, totally enthusiastic about SBS 2003, asked if he could fine-tune a user template on his SBS 2003 network and then deploy it in its exact form at his customer SBS network sites. That is, suppose he sold a customer relationship management (CRM) application that required specific settings, could it be created once and cloned over to his customer base? The answer is yes. You’d create a user template on the master network and use the Export Templates link (to launch the Export Templates Wizard) and get the configuration out to a floppy disk (the export function assumes Drive
A: by default) or a USB hard disk key (my favorite approach to transfer information in the 21st century!).
To import the user template at the customer site, just reverse the process - click the Import Templates link and complete the Import Templates Wizard.

Chatper 4: SBS 2003 deployment tools (book excerpt)

hey gang - I am harry brelsford (ceo at smbnation at www.smbnation.com) and the author of Windows Small Business Server 2003 Best PRactices. I am posting up a few pages a day until SBS 2008 ships!
Today we start chapter four and get into the SBS 2003 management console. Something all Small Business Specialists (SBSC) can related to and use!
harrybbbbb
###
Chapter 4 SBS 2003 Deployment and Management Tools
Congratulations to you, good friends! You’re well on your way to a completed, functional, and optimally performing SBS 2003 network. But a few important deployment and management tasks remain, including completing the items on the To Do List and discovering the powers of the Server Management console. This task area shouldn’t be marginalized. Whereas you possibly performed the SBS 2003 server machine setup out of sight (and hearing range) from your end users, you don’t have that same luxury with the final deployment tasks and the workstation setup phase you are about to undertake. Your role will be very public, and so will the users’ feedback. So, slow down, pardner, and take the extra time needed to get it right.
BEST PRACTICE: Let me take a moment to reiterate a key point to our time together in the SBS tome. As you work through this and other chapters, understand that the book is based on the SPRINGERS methodology (the sample SBS client based on Bainbridge Island, Washington).
The idea is that you spend the time upfront with this book creating a successful SBS network for a sample company following every keystroke in every chapter. It is paramount you try to follow through with each example and task. At the end of the book, you’re a bona fide SBSer as far as I’m concerned. I also understand that your real world SBS experience will be slightly different from mine with my beloved dogs. You’ll work on different equipment under different conditions. In fact, Microsoft reports that the majority of SBS sales
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
are international, so you’re likely setting up SBS in a different country than I or my Springer Spaniels live in. (And, by golly, perhaps your country favors different breeds of dogs - cool!)
More important, where possible I try to compare and contrast different SBS features and functions, but sometimes I’ll bypass some esoteric alternative path to accomplish a task in the spirit of maintaining the purity of my SPRINGERS methodology. All I can say is that some excellent advanced resources that explore every conceivable SBS feature and function, starting with the online help system, exist for your academic researching pleasure. Thanks in advanced for your understanding (and no flames on Amazon, please, as I’ve taken this moment to manage your expectations). Long live SPRINGERS!
Meet Server Management Console
Microsoft has changed (okay - improved) the management console concept in SBS 2003 compared to prior SBS releases. What has occurred is that, based on experience and tons of feedback from SBSers like you, strong emphasis is placed on completing all network deployment and management tasks from the Server Management console, which is displayed in Figure 4-1.
Notes:
Figure 4-1
Meet the Server Management console. Play nice as you’ll be using this interface forever more to manage your SBS-based network.
In a past SBS book, I took tens of pages to describe the SBS console in its various forms and functionality. But in writing these words, I discovered I can quickly convey what the console is all about in far fewer pages, a true testament to the SBS development team trying to simplify the console experience for the SBSer. I liken it to this. I can now describe the Server Management console in a short elevator ride. Let’s now take that elevator ride together as I present the Server Management console by discussing its two major divisions: Standard Management and Advanced Management.
Notes: