Top of the morinng to ya! I am up and at 'em here in Seattle on the 520AM ferry enroute to the airport and some time in the San Francisco area...really starting to spend more time down there what with the hot technology sector (can u say SOMA?). So a quick post from Chapter 8 of my Windows Small Business Server 2003 Best Practices book - as u might know - I am posting up several pages per day from this book into the WILD for your reading pleasure. Why do I do this? Because I am a nice person! I will keep posting until SBS 2008 ships!
Today we explore the Remote desktop Protocol (RDP) in the mobility realm of SBS 2003.
cheers...harrybbbb
harry brelsford, smb nation's ceo www.smbnation.com
Microsoft Small Business Specialist (SBSC), MBA MCSE MCT CNE CLSE CNP
Did u know I host my big annual conference in early OCtober in Seattle!
###
Exploring RDP
Oops! I almost forgot some more stuff on RDP that I wanted to share (this has an advanced tone to it). RDP allows for separate virtual channels for carrying device communication and presentation data from the server, as well as encrypted client mouse and keyboard data. RDP uses its own video driver on the server-side to render display output by construction rendering information in network packets using the RDP protocol and sending them over the network to the client. On the client-side, it receives the rendering data and interprets them into the corresponding Win32 Graphic Display Interface (GDI) application programming interface (API) calls. On the input path, client mouse and keyboard messages are redirected from the client to the server. On the server-side, RDP uses its own virtual keyboard and mouse driver to receive these keyboard and mouse events.
Without encrypting the display protocol, it would be very easy to “sniff” the wire to discover the user’s passwords as they log on to the system. Allowing an administrator to log on using a non-encrypted protocol exposes the entire domain resources that are now vulnerable to hackers, especially if connecting over a public network without a VPN. It is both darn interesting and important to note
that protocols using “scrambling” to protect data are just as vulnerable to this
sort of attack as protocols that send data using clear text. The activity involved in sending and receiving data through the RDP stack is essentially the same as the seven-layer Open Standards Interconnection (OSI) model for the LANs on this planet. Data from an application or service to be transmitted is passed down through the protocol stacks, sectioned (sounds like a Ginsu knife commercial with slicing and dicing, eh?), directed to the channel (through MCS), encrypted, wrapped, framed, packaged onto the network protocol, and finally (really and truly) addressed and sent over the wire to the client. The returned data works the same way only in reverse, with the packet being stripped of its address, then unwrapped, decrypted, and so on (and on and on) until the data is presented to the application for use (Whew!). Key portions of the protocol stack modifications occur between the fourth and seventh layer, where the data is encrypted, wrapped and framed, directed to a channel and prioritized.
Lastly, every version of RDP uses RSA Security’s RC4 cipher, a stream cipher
designed to efficiently encrypt small amounts of varying data size. RC4 is designed for secure communications over networks and is also used in protocols such as SSL, which encrypts traffic to and from secure Web sites. By default, Windows XP Remote Desktop and Windows Server 2003 Remote Desktop and Terminal Services use high (128-bit) encryption to encrypt most data transmissions in both the client-to-server direction and the server-to-client direction.
BEST PRACTICE: Don’t forget the 128-bit encryption point raised here.
It is frequently brought up in technology conversations about SBS.
Showing posts with label RWW. Show all posts
Showing posts with label RWW. Show all posts
Friday, August 15, 2008
Thursday, August 14, 2008
RWW Security Summary in SBS 2003
Hello gang - today I have a shorter post-up from my Windows Small Business Server 2003 Best PRactices book - it is a summary of Remote Web Workplace security.
enjoy...harrybbbb
Harry Brelsford, ceo at smb nation, www.smbnation.com
did u know we have a raging conference comin' to Seattle in early October: SBS 2008 and EBS 2008 launch party!
Microsoft Small Business Specialist (SBSC) and MBA
###
RWW Security Summary
Before moving on and looking at Outlook 2003 remote approaches, oblige me and view the following RWW security summary:
• SSL connections required for access to the Web site.
• User authentication required for access to the Web site.
• Log out allows users to close sessions and clear any cached logon credentials.
• Timeout feature automatically closes sessions after a period of inactivity.
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
• Public or shared computer mode provides additional safety requirements in those environments (browser version checking, shorter timeouts).
• Web site is throttled through IIS.
• Web site files are strongly ACL’ed (governed by the Access Control List) to prevent unauthorized editing.
• Remote Desktop connections are encrypted and send only mouse clicks and keystrokes over the connection.
• Reduces or eliminated the need for VPN connections at the business.
BEST PRACTICE: Use the above list as “talking points” when talking about RWW.
enjoy...harrybbbb
Harry Brelsford, ceo at smb nation, www.smbnation.com
did u know we have a raging conference comin' to Seattle in early October: SBS 2008 and EBS 2008 launch party!
Microsoft Small Business Specialist (SBSC) and MBA
###
RWW Security Summary
Before moving on and looking at Outlook 2003 remote approaches, oblige me and view the following RWW security summary:
• SSL connections required for access to the Web site.
• User authentication required for access to the Web site.
• Log out allows users to close sessions and clear any cached logon credentials.
• Timeout feature automatically closes sessions after a period of inactivity.
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
• Public or shared computer mode provides additional safety requirements in those environments (browser version checking, shorter timeouts).
• Web site is throttled through IIS.
• Web site files are strongly ACL’ed (governed by the Access Control List) to prevent unauthorized editing.
• Remote Desktop connections are encrypted and send only mouse clicks and keystrokes over the connection.
• Reduces or eliminated the need for VPN connections at the business.
BEST PRACTICE: Use the above list as “talking points” when talking about RWW.
Wednesday, August 13, 2008
RWW under the hood in SBS 2003
Good evening folks - been a crazy busy day but I am honoring my commitment to post up several pages per day from my Windows Small Business Server 2003 Best Practices book (the purple book). I really like the part of Chapter 8 where we debunk, prove and otherwise party on with Remote Web Workplace.
Looking forward to SBS 2008 and more madness!
cheers...harrybbbb
Harry Brelsford, ceo at smb nation, www.smbnation.com
Microsoft Small Business Specialist, MBA, MCSE, CNE, MCT, MCP, CLSE and CNP - whew - I am tired!
ps - funky groovy fall conference is less than 60-days away in Seattle!
###
Under the Hood RWW Architecture
Specialists like specialist in the professional world, perhaps because there is an element of mutual respect. So when this SBS specialist (yours truly) needed some help digging deeper in this subject area, I went to fellow SBS 2003 hands-on lab instructor Beatrice Mulzer from Florida. Beatrice is an RWW nicher and provided the screen shots in this section showing a glimpse of how things work under the hood with RWW.
First off, it helps to see a Visio diagram that outlines the RWW architectural experience. This is shown in Figure 8-10.
Visit www.smbnation.com for additional SMB and SBS book, newsletter and conference resources.
Figure 8-10
This diagram outlines the RWW mechanics.
Now for the step-by-step figures that bring definition to the chart above.
Notes:
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Figure 8-11
Initial connection to SBS 2003 external Web page over port 80. Note HTTP in the Address field of Internet Explorer.
BEST PRACTICE: Note the above figure (Figure 8-11) assumes that you have selected the Business Web option on the Web Services Configuration page in the EICW. We did NOT do this back in Chapter 4 for the purpose of SPRINGERS. But please heed this advice, as imparted to me by the Microsoft program manager who owns this area. IN THE REAL WORLD, Microsoft discourages you from opening port 80 in the EICW via the Business Web selection. Rather, they’d rather have the address for RWW typed by external users be the FQDN followed by /remote (e.g., springers1.springersltd.com/ remote). The /remote component of the address makes the external listening port become 443 and the address is appended to HTTPS.
Another real worldism for NOT opening port 80 if you can help it. Beside exposing your IIS root to the world (and Web search engine crawling), you also expose RWW to Web search engine crawling. This is something you probably don’t want to do, as it might be the source of future vulnerabilities and attacks (as of this writing, this hasn’t been exploited). A really interesting exercise to see this in action is to go to Google and search on the terms “remote web workplace” and view the results. You’ll see pages of hits returned with Remote Web Workplace highlighted. These are SBS 2003 sites that have opened port 80 (again, likely via the Business Web selection on the Web Services Configuration page in the EICW). Stunning how many RWW sites you’ll see.
Finally, if you must have port 80 open because you really do host a business Web site and you’ve accepted the risks, then please consider using a robots.txt file to restrict Web search engine crawling. Details on robots.txt at www.robotstxt.org/wc/robots.html and in Chapter 10.
Notes:
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Figure 8-12
Approving the security certificate (SSL) pop-up to log on to Remote Web Workplace (this process started by selecting the Remote Web Workplace link). Note the port switch from port 80 to port 443. This would be the case when you’ve published your root page via the Business Web selection on Web Services Configuration in the EICW.
Figure 8-13
The SSL pop-up was approved and the RWW logon dialog box appears. Session traffic is over port 443 and the HTTP protocol has switched to HTTPS at this point.
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Figure 8-14
An RWW session underway with HTTPS and port 443.
BEST PRACTICE: Did you look closely at the above figure and see the entry titled “View Server Usage Report”? How did that appear? If you have run the Monitoring Configuration Wizard (which you will do in Chapter 12) and the user (in this case Beatrice) has permission to view the server usage reports, this option will appear on the RWW page.
Notes:
Figure 8-15
Internally accessing the WSS Home page (Intranet) over port 443 under RWW. Protocol is HTTPS. Note that external access to WSS is over 444 (which isn’t being depicted in this figure).
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Figure 8-16
When you click the Connect to my computer at work, port 4125 is used for the Remote Desktop session traffic (note port 4125 doesn’t become active and listen until you click this Connect to my computer at work button; listening actually occurs on port 443). This is in addition to port 443 that remains open (ports 4125 and 443 are simultaneously open under this scenario). At this juncture, some background voodoo is performed by SBS to authenticate you and prove you are who you say you are (that’s about as well as I can explain it in this introductory text).
BEST PRACTICE: A common question in the Fall 2003 SBS hands-on labs related to which ports on a hardware-based firewall/router needed to be opened to allow RWW traffic through. RWW uses the following ports for its entire experience: 443, 444, 4125. Port 80 would be used if you published the root page (not recommended). And by the way, the other SBS-related port you’ll need open is 1723 (VPN, which I discuss more later).
By the way, you can see the port 4125 setting for RWW in the
Registry at:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SmallBusinessServer\RemoteUserPortal
and look at the Port key where the REG_DWORD value is 4125.
Another common question concerns whether you must first establish a VPN connection to drill down and take control of your Windows XP Pro workstation via Remote Desktop. The answer is no. You are using RDP over HTTP, not VPN tunneling to access the Windows XP Pro workstation.
So hopefully a few pictures here have saved over a thousand words. I thought that by starting with a diagram and then witnessing the port traffic, you could “feel” RWW first hand under the hood. More of this good stuff in my advanced SBS 2003 book in the second part of 2004.
Looking forward to SBS 2008 and more madness!
cheers...harrybbbb
Harry Brelsford, ceo at smb nation, www.smbnation.com
Microsoft Small Business Specialist, MBA, MCSE, CNE, MCT, MCP, CLSE and CNP - whew - I am tired!
ps - funky groovy fall conference is less than 60-days away in Seattle!
###
Under the Hood RWW Architecture
Specialists like specialist in the professional world, perhaps because there is an element of mutual respect. So when this SBS specialist (yours truly) needed some help digging deeper in this subject area, I went to fellow SBS 2003 hands-on lab instructor Beatrice Mulzer from Florida. Beatrice is an RWW nicher and provided the screen shots in this section showing a glimpse of how things work under the hood with RWW.
First off, it helps to see a Visio diagram that outlines the RWW architectural experience. This is shown in Figure 8-10.
Visit www.smbnation.com for additional SMB and SBS book, newsletter and conference resources.
Figure 8-10
This diagram outlines the RWW mechanics.
Now for the step-by-step figures that bring definition to the chart above.
Notes:
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Figure 8-11
Initial connection to SBS 2003 external Web page over port 80. Note HTTP in the Address field of Internet Explorer.
BEST PRACTICE: Note the above figure (Figure 8-11) assumes that you have selected the Business Web option on the Web Services Configuration page in the EICW. We did NOT do this back in Chapter 4 for the purpose of SPRINGERS. But please heed this advice, as imparted to me by the Microsoft program manager who owns this area. IN THE REAL WORLD, Microsoft discourages you from opening port 80 in the EICW via the Business Web selection. Rather, they’d rather have the address for RWW typed by external users be the FQDN followed by /remote (e.g., springers1.springersltd.com/ remote). The /remote component of the address makes the external listening port become 443 and the address is appended to HTTPS.
Another real worldism for NOT opening port 80 if you can help it. Beside exposing your IIS root to the world (and Web search engine crawling), you also expose RWW to Web search engine crawling. This is something you probably don’t want to do, as it might be the source of future vulnerabilities and attacks (as of this writing, this hasn’t been exploited). A really interesting exercise to see this in action is to go to Google and search on the terms “remote web workplace” and view the results. You’ll see pages of hits returned with Remote Web Workplace highlighted. These are SBS 2003 sites that have opened port 80 (again, likely via the Business Web selection on the Web Services Configuration page in the EICW). Stunning how many RWW sites you’ll see.
Finally, if you must have port 80 open because you really do host a business Web site and you’ve accepted the risks, then please consider using a robots.txt file to restrict Web search engine crawling. Details on robots.txt at www.robotstxt.org/wc/robots.html and in Chapter 10.
Notes:
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Figure 8-12
Approving the security certificate (SSL) pop-up to log on to Remote Web Workplace (this process started by selecting the Remote Web Workplace link). Note the port switch from port 80 to port 443. This would be the case when you’ve published your root page via the Business Web selection on Web Services Configuration in the EICW.
Figure 8-13
The SSL pop-up was approved and the RWW logon dialog box appears. Session traffic is over port 443 and the HTTP protocol has switched to HTTPS at this point.
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Figure 8-14
An RWW session underway with HTTPS and port 443.
BEST PRACTICE: Did you look closely at the above figure and see the entry titled “View Server Usage Report”? How did that appear? If you have run the Monitoring Configuration Wizard (which you will do in Chapter 12) and the user (in this case Beatrice) has permission to view the server usage reports, this option will appear on the RWW page.
Notes:
Figure 8-15
Internally accessing the WSS Home page (Intranet) over port 443 under RWW. Protocol is HTTPS. Note that external access to WSS is over 444 (which isn’t being depicted in this figure).
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Figure 8-16
When you click the Connect to my computer at work, port 4125 is used for the Remote Desktop session traffic (note port 4125 doesn’t become active and listen until you click this Connect to my computer at work button; listening actually occurs on port 443). This is in addition to port 443 that remains open (ports 4125 and 443 are simultaneously open under this scenario). At this juncture, some background voodoo is performed by SBS to authenticate you and prove you are who you say you are (that’s about as well as I can explain it in this introductory text).
BEST PRACTICE: A common question in the Fall 2003 SBS hands-on labs related to which ports on a hardware-based firewall/router needed to be opened to allow RWW traffic through. RWW uses the following ports for its entire experience: 443, 444, 4125. Port 80 would be used if you published the root page (not recommended). And by the way, the other SBS-related port you’ll need open is 1723 (VPN, which I discuss more later).
By the way, you can see the port 4125 setting for RWW in the
Registry at:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SmallBusinessServer\RemoteUserPortal
and look at the Port key where the REG_DWORD value is 4125.
Another common question concerns whether you must first establish a VPN connection to drill down and take control of your Windows XP Pro workstation via Remote Desktop. The answer is no. You are using RDP over HTTP, not VPN tunneling to access the Windows XP Pro workstation.
So hopefully a few pictures here have saved over a thousand words. I thought that by starting with a diagram and then witnessing the port traffic, you could “feel” RWW first hand under the hood. More of this good stuff in my advanced SBS 2003 book in the second part of 2004.
Tuesday, August 12, 2008
RWW procedure in SBS 2003
Hello! I am Harry Brelsford, the author of Windows Small Business Server 2003 Best Practices (da' purple book). I am posting up several pages per day of this book until SBS 2008 ships.
Today we explore the Remote Web Workplace (RWW) usage procedure in SBS 2003.
enjoy....harrybbbb
Harry Brelsford | ceo at SMB Nation | www.smbnation.com
Microsoft Small Business Specialist (SBSC), MBA< MCSE< MCT< CNE and other stuff!
PS - we have a raging fall geeky conference in Seattle in early October...SBS 2008 and EBS 2008 launch party!
###
RWW Procedure: Daze and Amaze!
As you start this procedure, there is a big assumption you will introduce a remote computer into the SPRINGERS scenario (so far you’ve worked with the SPRINGERS1 server machine and the PRESIDENT client computer). A favorite way to describe the mobility area in SBS 2003 time frame is to say you’re using a laptop over WIFI from a Starbucks coffee shop to access the office network!
What you need is a client computer that is not part of the SBS 2003 network and could be considered as being on the “outside” (not on the 192.168.16.x subnet). In Appendix D, you’ll receive guidance for setting this up as a virtual network using either VMWare or Virtual PC from Microsoft. To facilitate this, I created a Windows XP Pro workstation in a workgroup called HASBORN (the machine name is NormLap). I assigned the static IP address of
207.202.238.225 with a Class C subnet to this external client computer. The naming isn’t as important here as the concept of having an external client computer up and running in the SPRINGERS storyline.
1. Log on as NormH to the remote computer (in my case, NormLap) with the password Purple3300 (in this case, Norm is a local user in the Windows XP Pro workgroup model). Also - please make sure the PRESIDENT workstation is powered on and running. And I guess the SBS 2003 server machine (SPRINGERS1) better be running too! That’ll make this procedure infinitely easier to complete!
BEST PRACTICE: Later on, when you attempt to connect to PRESIDENT from NormLap, you’ll appreciate the following. If PRESIDENT were not powered on and attached to the network in
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
our case, you’d receive an error in the Remote Desktop connection process the reads: “Connectivity to the remote computer could not be established. Ensure that the remote computer is on and connected to the Windows Small Business Server Network.”
1 Launch Internet Explorer from Start, Internet. Type in the following address in the Address field: springers1.springersltd.com.
2 If you did not select the Business Web on the Web Services Configuration page in Chapter 4 when you ran the EICW, you’d receive a 403 error saying that the page could not be displayed. If you did publish the root page by selecting Business Web on the Web Services Configuration page, the Welcome page appears as seen in Figure 8-1. You will now plow through each link. But notice that the address line reads “http” at this point. This is important as you progress through the examples.
Figure 8-1
The external public Web page on an SBS 2003 server machine. It kindly welcomes you aboard! This occurs when you publish the root Web page over port 80 in SBS 2003 (which is not recommended).
BEST PRACTICE: Slow down there, pardner! How did a FQDN address resolve itself in our simple SPRINGERS methodology when I didn’t point you to an authoritative DNS server to resolve the address? Did I brain hiccup on ya there? Nope! I got sneaky and entered the following HOSTS file entry on the NormLap workstation:
207.202.238.215 springers1.springersltd.com
Note the host file on a Windows XP Pro is located by default at: c:\windows\system32\drivers\etc
1 Click My Company’s Internal Web Site and nothing will happen. This was designed to be a simple placeholder for you to place a link to your company’s Web site. It will not access the internal Web site despite the name of this link (the command being executed is http:// companyweb which is an internal, not external reference). Click Back to return to Welcome.
2 Click Network Configuration Wizard. This is an internal LAN process to join the computer as an Active Directory object on the network. This certainly has a time and place, but you’re going to defer on the opportunity to do this now because I want to maintain the sanctity of my methodology whereby NormLap is truly an external client computer. In fact, this wont’ work externally. Click Back.
3 If you clicked Remote Web Workplace, you’d access RWW from the public root Web page. But read on.
4 So now I want to reverse course and do things properly! In the Address field, type springers1.springersltd.com/remote and click Go. You’ve commenced your connection to RWW.
5 Click OK when you see the Security Alert dialog box.
6 Another Security Alert dialog box appears and relates to the self-signed security certificate described in Chapter 6. Click View Certificate and select Install Certificate. Click Next when the Certificate Import Wizard launches. Click Next on the Certificate Store page (the default selection is Automatically select the certificate store based on the type of certificate). Click Finish followed by OK. Click OK to close the Certificate dialog box. So what did you just do? You installed the certificate in Internet
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Explorer on the external client computer. Finally, click OK to clear the Security Alert dialog box that greeted you at the start of this step.
BEST PRACTICE: If you purchase a real signed certificate (e.g. Verisign), the stuff in the step above won’t happen. Consider that a best practice (Microsoft is supportive of purchased real certificates).
10. The Remote Web Workplace logon dialog box appears (Figure 8-2). Type NormH in the User name field. Type Purple3300 in the password field. Observe the other settings (using a public/shared computers, broadband connection). Click Log on.
BEST PRACTICE: Notice the Address line has switched to HTTPS. It’s self-signed security certificate time, baby! Observe the little golden padlock on the lower right of IE. HUMOR ZONE: Back before July 2003 (when Microsoft went to stock grants), stock options for full-time Microsoft employees (“blue badges”) have been referred to as the golden handcuffs, so this must be the origins of the golden padlock for IE in HTTPS mode!
Figure 8-2
The Remote Web Workplace logon page.
11. Observe the official Remote Web Workplace page that has four menu options by default (Figure 8-3). The first selection, Read my company e-mail, simply launches Outlook Web Access, which I’ll discuss a little later in the chapter. The fourth option, Download Connection Manager, is also discussed later in the chapter. For now the focus is on the middle two options. So click Connect to my computer at work.
Figure 8-3
The infamous Remote Web Workplace welcome page. The ability to connect to your computer is only one of four options on this menu.
BEST PRACTICE: Exactly how does the RWW welcome page get built and know what options to display? In part, the RWW welcome page menu options are built from the options you select on the Web Services Configuration page in the EICW (refer to Figure 4-10). Another element is that an Active Directory query is run to look for computer objects. If none are found, the link to connect to desktop computers is suppressed. If you haven’t completed the Remote Access Wizard from the To Do List in Server Manager, the Connection
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Manager link is suppressed. That’s what does it for mere mortals, but read on.
If you want to manually light up links in RWW, you can flip the DWORD value in the Registry for any menu link. Go to the following SBS 2003 Registry location in the Registry Editor (REGEDIT):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SmallBusinessServer\RemoteUserPortal
and then drill into the two folders (AdminLinks, KWLinks) and look at the DWORD values (these line items list each RWW menu link). Choose the AdminLinks folder when you use RWW as Administrator. Select the KWLinks folder when you use RWW as a user who has Mobile User template membership or Power User template membership.
12. Click Yes when asked by the Security Warning dialog box to install the Remote Destkop Active X control. This control will install in the background. Note this is a one-time event that runs the first time you perform this procedure. You won’t see it again.
13. Select PRESIDENT from the Computers list. Click the Optional Settings link and observe the settings. Select the Enable files and folders to be transferred between the remote computer and this computer and Hear sounds from the remote computer on this computer. The options you have just selected are self-explanatory. Your screen should look similar to Figure 8-4 (I realize the figure is slightly cropped). Click Connect.
14. Click OK after reading the Remote Desktop Connection Security Warning (Figure 8-5).
15. On the Log on to Windows dialog box that appears for the PRESIDENT client computer, type NormH as the user and Purple3300 as the password. This step is identical to logging on to a Terminal Services server machine from a remote location, so it’s likely within your comfort level.
Figure 8-4
Explore the options on the page where you select the computer you want to log on to remotely.
BEST PRACTICE: Hold the phone! Didn’t you observe in step 13 that the RWW session had you log on as NormH yet you were challenged and had to log on as NormH in the Log on to Windows dialog box? This relates to the fact that user authentication credentials from the RWW sign on (step 10) aren’t being passed on to step 15.
Technically speaking, here is what’s up. The Remote Desktop ActiveX Control can only accept credentials in clear text before connecting to a client. Once you connect, the channel is encrypted, and passwords are sent securely. Microsoft could not allow people to have their credentials stored in clear text on a client ever, which is what would have to occur in order to automatically sign you in. It’s too risky. Who knows? Maybe in the future this pass through will be securely perfected, saving that step. Good news, though. The step
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
does preset your user name for you, saving you some typing (e.g., not having to type NormH again).
Figure 8-5
Approve this security warning which speaks towards local drive mappings.
16. You are now using the PRESIDENT machine at work as NormH. THIS IS SO COOL (NormH’s exact words as he sipped a triple cappuccino at Starbucks!). Go ahead and perform a simple action such as launching his Outlook 2003 e-mail client from Start, E-mail and perhaps launch Microsoft Word from Start, All Programs, Microsoft Office, Microsoft Office Word 2003 (the result would be similar to Figure 8-6).
BEST PRACTICE: Can anyone log on to any client computer on the SBS 2003 network using this RWW-based work from home or Starbucks approach? Nope! Remember back in Chapter 4 that the Add User Wizard process made the assigned user a local administrator and eligible to log on to the client computer via the Remote Desktop capability in Windows XP Pro (see from Start, right-click My Computer, select Properties, select Remote tab and explore the Remote Desktop section of the tab sheet). Bottom line: You have to be allowed to log on to a client computer.
Figure 8-6
Working remotely, Norm has hijacked his desktop machine back at SPRINGERS and typed a document in Word 2003. Cool!
BEST PRACTICE: By the way, I remember a heated debate between individuals at the Fall 2003 Miami SBS 2003 hands-on lab regarding the Remote Desktop logon behavior in RWW. It was like witnessing a beer battle with one side claiming the brew was less filling, the other side insisting the brew tasted great. One party claimed that the auto-logoff that occurs, for example, on Norm’s PRESIDENT machine (assuming it was logged on at the time back at the office) when Norm uses RWW to initiate a Remote Desktop session is a flaw. His point was someone could be working on PRESIDENT and receive no prior notification they are being logged off (work could be lost, etc.). The other party to the debate saw the situation much differently and claimed it was a feature! Performing this log off on the local desktop when a Remote Desktop session via RWW
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
commenced enforced security and prevented snooping. So one man’s flaw is another man’s feature!
Oh-oh. Just one minor clarification to the story above. When Norm, who is working remotely, commences the Remote Desktop session, he will receive a notice that he’s about to log off the local user (in this case we’ll say Linda). It’s Linda who doesn’t receive the log off notification (Linda just finds herself being logged off).
17. Let’s pretend you walked up to the counter and ordered another triple cappuccino. The line was long with worker bees and it was over 20 minutes before you returned to your remote session on your laptop (e.g., NormLap). You’re greeted by Figure 8-7. Why? Because back in Step 9 at the RWW logon box, you told SBS 2003 that you were logging on from a public or shared computer. Knowing that, SBS 2003 will terminate your session after 20 minutes of idle time (a private or non-public computer has two hours). Note that you will always receive a RWW warning that you’re about to time out at the remaining one-minute mark. Click on the Return to the Remote Web Workplace link.
Notes:
Figure 8-7
Oops. You took to much time getting the cappuccino and were logged off for security purposes!
BEST PRACTICE: When you were auto-logged off, this wasn’t just a termination of the Remote Desktop session with the PRESIDENT desktop machine. No sir! This was a total log out from RWW (that’s going back a couple of steps there).
18. Complete the logon (again) to RWW in a manner similar to Step 10 above as NormH. Select Connect to my computer at work. Select PRESIDENT and click Connect. Log on as NormH using the Purple3300 password. Whew! You’re returned to the Word 2003 document shown in Figure 8-6. Yes Virginia, Windows XP Pro has session maintenance upon disconnect or forced logoff.
BEST PRACTICE: Note that RWW will display a list of Windows XP Pro machines with Remote Desktop and Windows 2000 Server/ Windows Server 2003 machines running Terminal Services in
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Application Sharing Mode here. This is accomplished by a background query that pools network membership for machines that meet this specific criteria. This is an SBS 2003 feature and not found in the full Windows Server 2003 network. Yee-haw.
And by the way, if you connect to a server machine running Terminal Services in Application Sharing Mode via RWW, it will be over port 4125, not port 3389 (the traditional way). You read it here first.
19. You will now disconnect properly! Close Word 2003 (save the file if you like). Close Outlook 2003. Click Start, Disconnect. Select Disconnect when the Disconnect Windows dialog box appears. When you perform this step, a local user could log on to the machine again and commence working (e.g., Linda uses the desktop computer again).
20. You are returned to RWW’s screen displaying computer names. Click the Main Menu link.
21. Click on the Use my company’s internal Web site link.
22. Complete the connection dialog box that appears as NormH in the User name and Purple3300 in the Password field.
23. The Windows SharePoint Services (WSS) Home page appears as seen in Figure 8-8.
Notes:
Figure 8-8
The WSS Home page as you left it in Chapter 7 but viewed via RWW.
24. Select Log Off. Then click Close. When asked to close the window in the Microsoft Internet Explorer dialog box, click Yes.
Notes:
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Today we explore the Remote Web Workplace (RWW) usage procedure in SBS 2003.
enjoy....harrybbbb
Harry Brelsford | ceo at SMB Nation | www.smbnation.com
Microsoft Small Business Specialist (SBSC), MBA< MCSE< MCT< CNE and other stuff!
PS - we have a raging fall geeky conference in Seattle in early October...SBS 2008 and EBS 2008 launch party!
###
RWW Procedure: Daze and Amaze!
As you start this procedure, there is a big assumption you will introduce a remote computer into the SPRINGERS scenario (so far you’ve worked with the SPRINGERS1 server machine and the PRESIDENT client computer). A favorite way to describe the mobility area in SBS 2003 time frame is to say you’re using a laptop over WIFI from a Starbucks coffee shop to access the office network!
What you need is a client computer that is not part of the SBS 2003 network and could be considered as being on the “outside” (not on the 192.168.16.x subnet). In Appendix D, you’ll receive guidance for setting this up as a virtual network using either VMWare or Virtual PC from Microsoft. To facilitate this, I created a Windows XP Pro workstation in a workgroup called HASBORN (the machine name is NormLap). I assigned the static IP address of
207.202.238.225 with a Class C subnet to this external client computer. The naming isn’t as important here as the concept of having an external client computer up and running in the SPRINGERS storyline.
1. Log on as NormH to the remote computer (in my case, NormLap) with the password Purple3300 (in this case, Norm is a local user in the Windows XP Pro workgroup model). Also - please make sure the PRESIDENT workstation is powered on and running. And I guess the SBS 2003 server machine (SPRINGERS1) better be running too! That’ll make this procedure infinitely easier to complete!
BEST PRACTICE: Later on, when you attempt to connect to PRESIDENT from NormLap, you’ll appreciate the following. If PRESIDENT were not powered on and attached to the network in
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
our case, you’d receive an error in the Remote Desktop connection process the reads: “Connectivity to the remote computer could not be established. Ensure that the remote computer is on and connected to the Windows Small Business Server Network.”
1 Launch Internet Explorer from Start, Internet. Type in the following address in the Address field: springers1.springersltd.com.
2 If you did not select the Business Web on the Web Services Configuration page in Chapter 4 when you ran the EICW, you’d receive a 403 error saying that the page could not be displayed. If you did publish the root page by selecting Business Web on the Web Services Configuration page, the Welcome page appears as seen in Figure 8-1. You will now plow through each link. But notice that the address line reads “http” at this point. This is important as you progress through the examples.
Figure 8-1
The external public Web page on an SBS 2003 server machine. It kindly welcomes you aboard! This occurs when you publish the root Web page over port 80 in SBS 2003 (which is not recommended).
BEST PRACTICE: Slow down there, pardner! How did a FQDN address resolve itself in our simple SPRINGERS methodology when I didn’t point you to an authoritative DNS server to resolve the address? Did I brain hiccup on ya there? Nope! I got sneaky and entered the following HOSTS file entry on the NormLap workstation:
207.202.238.215 springers1.springersltd.com
Note the host file on a Windows XP Pro is located by default at: c:\windows\system32\drivers\etc
1 Click My Company’s Internal Web Site and nothing will happen. This was designed to be a simple placeholder for you to place a link to your company’s Web site. It will not access the internal Web site despite the name of this link (the command being executed is http:// companyweb which is an internal, not external reference). Click Back to return to Welcome.
2 Click Network Configuration Wizard. This is an internal LAN process to join the computer as an Active Directory object on the network. This certainly has a time and place, but you’re going to defer on the opportunity to do this now because I want to maintain the sanctity of my methodology whereby NormLap is truly an external client computer. In fact, this wont’ work externally. Click Back.
3 If you clicked Remote Web Workplace, you’d access RWW from the public root Web page. But read on.
4 So now I want to reverse course and do things properly! In the Address field, type springers1.springersltd.com/remote and click Go. You’ve commenced your connection to RWW.
5 Click OK when you see the Security Alert dialog box.
6 Another Security Alert dialog box appears and relates to the self-signed security certificate described in Chapter 6. Click View Certificate and select Install Certificate. Click Next when the Certificate Import Wizard launches. Click Next on the Certificate Store page (the default selection is Automatically select the certificate store based on the type of certificate). Click Finish followed by OK. Click OK to close the Certificate dialog box. So what did you just do? You installed the certificate in Internet
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Explorer on the external client computer. Finally, click OK to clear the Security Alert dialog box that greeted you at the start of this step.
BEST PRACTICE: If you purchase a real signed certificate (e.g. Verisign), the stuff in the step above won’t happen. Consider that a best practice (Microsoft is supportive of purchased real certificates).
10. The Remote Web Workplace logon dialog box appears (Figure 8-2). Type NormH in the User name field. Type Purple3300 in the password field. Observe the other settings (using a public/shared computers, broadband connection). Click Log on.
BEST PRACTICE: Notice the Address line has switched to HTTPS. It’s self-signed security certificate time, baby! Observe the little golden padlock on the lower right of IE. HUMOR ZONE: Back before July 2003 (when Microsoft went to stock grants), stock options for full-time Microsoft employees (“blue badges”) have been referred to as the golden handcuffs, so this must be the origins of the golden padlock for IE in HTTPS mode!
Figure 8-2
The Remote Web Workplace logon page.
11. Observe the official Remote Web Workplace page that has four menu options by default (Figure 8-3). The first selection, Read my company e-mail, simply launches Outlook Web Access, which I’ll discuss a little later in the chapter. The fourth option, Download Connection Manager, is also discussed later in the chapter. For now the focus is on the middle two options. So click Connect to my computer at work.
Figure 8-3
The infamous Remote Web Workplace welcome page. The ability to connect to your computer is only one of four options on this menu.
BEST PRACTICE: Exactly how does the RWW welcome page get built and know what options to display? In part, the RWW welcome page menu options are built from the options you select on the Web Services Configuration page in the EICW (refer to Figure 4-10). Another element is that an Active Directory query is run to look for computer objects. If none are found, the link to connect to desktop computers is suppressed. If you haven’t completed the Remote Access Wizard from the To Do List in Server Manager, the Connection
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Manager link is suppressed. That’s what does it for mere mortals, but read on.
If you want to manually light up links in RWW, you can flip the DWORD value in the Registry for any menu link. Go to the following SBS 2003 Registry location in the Registry Editor (REGEDIT):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SmallBusinessServer\RemoteUserPortal
and then drill into the two folders (AdminLinks, KWLinks) and look at the DWORD values (these line items list each RWW menu link). Choose the AdminLinks folder when you use RWW as Administrator. Select the KWLinks folder when you use RWW as a user who has Mobile User template membership or Power User template membership.
12. Click Yes when asked by the Security Warning dialog box to install the Remote Destkop Active X control. This control will install in the background. Note this is a one-time event that runs the first time you perform this procedure. You won’t see it again.
13. Select PRESIDENT from the Computers list. Click the Optional Settings link and observe the settings. Select the Enable files and folders to be transferred between the remote computer and this computer and Hear sounds from the remote computer on this computer. The options you have just selected are self-explanatory. Your screen should look similar to Figure 8-4 (I realize the figure is slightly cropped). Click Connect.
14. Click OK after reading the Remote Desktop Connection Security Warning (Figure 8-5).
15. On the Log on to Windows dialog box that appears for the PRESIDENT client computer, type NormH as the user and Purple3300 as the password. This step is identical to logging on to a Terminal Services server machine from a remote location, so it’s likely within your comfort level.
Figure 8-4
Explore the options on the page where you select the computer you want to log on to remotely.
BEST PRACTICE: Hold the phone! Didn’t you observe in step 13 that the RWW session had you log on as NormH yet you were challenged and had to log on as NormH in the Log on to Windows dialog box? This relates to the fact that user authentication credentials from the RWW sign on (step 10) aren’t being passed on to step 15.
Technically speaking, here is what’s up. The Remote Desktop ActiveX Control can only accept credentials in clear text before connecting to a client. Once you connect, the channel is encrypted, and passwords are sent securely. Microsoft could not allow people to have their credentials stored in clear text on a client ever, which is what would have to occur in order to automatically sign you in. It’s too risky. Who knows? Maybe in the future this pass through will be securely perfected, saving that step. Good news, though. The step
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
does preset your user name for you, saving you some typing (e.g., not having to type NormH again).
Figure 8-5
Approve this security warning which speaks towards local drive mappings.
16. You are now using the PRESIDENT machine at work as NormH. THIS IS SO COOL (NormH’s exact words as he sipped a triple cappuccino at Starbucks!). Go ahead and perform a simple action such as launching his Outlook 2003 e-mail client from Start, E-mail and perhaps launch Microsoft Word from Start, All Programs, Microsoft Office, Microsoft Office Word 2003 (the result would be similar to Figure 8-6).
BEST PRACTICE: Can anyone log on to any client computer on the SBS 2003 network using this RWW-based work from home or Starbucks approach? Nope! Remember back in Chapter 4 that the Add User Wizard process made the assigned user a local administrator and eligible to log on to the client computer via the Remote Desktop capability in Windows XP Pro (see from Start, right-click My Computer, select Properties, select Remote tab and explore the Remote Desktop section of the tab sheet). Bottom line: You have to be allowed to log on to a client computer.
Figure 8-6
Working remotely, Norm has hijacked his desktop machine back at SPRINGERS and typed a document in Word 2003. Cool!
BEST PRACTICE: By the way, I remember a heated debate between individuals at the Fall 2003 Miami SBS 2003 hands-on lab regarding the Remote Desktop logon behavior in RWW. It was like witnessing a beer battle with one side claiming the brew was less filling, the other side insisting the brew tasted great. One party claimed that the auto-logoff that occurs, for example, on Norm’s PRESIDENT machine (assuming it was logged on at the time back at the office) when Norm uses RWW to initiate a Remote Desktop session is a flaw. His point was someone could be working on PRESIDENT and receive no prior notification they are being logged off (work could be lost, etc.). The other party to the debate saw the situation much differently and claimed it was a feature! Performing this log off on the local desktop when a Remote Desktop session via RWW
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
commenced enforced security and prevented snooping. So one man’s flaw is another man’s feature!
Oh-oh. Just one minor clarification to the story above. When Norm, who is working remotely, commences the Remote Desktop session, he will receive a notice that he’s about to log off the local user (in this case we’ll say Linda). It’s Linda who doesn’t receive the log off notification (Linda just finds herself being logged off).
17. Let’s pretend you walked up to the counter and ordered another triple cappuccino. The line was long with worker bees and it was over 20 minutes before you returned to your remote session on your laptop (e.g., NormLap). You’re greeted by Figure 8-7. Why? Because back in Step 9 at the RWW logon box, you told SBS 2003 that you were logging on from a public or shared computer. Knowing that, SBS 2003 will terminate your session after 20 minutes of idle time (a private or non-public computer has two hours). Note that you will always receive a RWW warning that you’re about to time out at the remaining one-minute mark. Click on the Return to the Remote Web Workplace link.
Notes:
Figure 8-7
Oops. You took to much time getting the cappuccino and were logged off for security purposes!
BEST PRACTICE: When you were auto-logged off, this wasn’t just a termination of the Remote Desktop session with the PRESIDENT desktop machine. No sir! This was a total log out from RWW (that’s going back a couple of steps there).
18. Complete the logon (again) to RWW in a manner similar to Step 10 above as NormH. Select Connect to my computer at work. Select PRESIDENT and click Connect. Log on as NormH using the Purple3300 password. Whew! You’re returned to the Word 2003 document shown in Figure 8-6. Yes Virginia, Windows XP Pro has session maintenance upon disconnect or forced logoff.
BEST PRACTICE: Note that RWW will display a list of Windows XP Pro machines with Remote Desktop and Windows 2000 Server/ Windows Server 2003 machines running Terminal Services in
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Application Sharing Mode here. This is accomplished by a background query that pools network membership for machines that meet this specific criteria. This is an SBS 2003 feature and not found in the full Windows Server 2003 network. Yee-haw.
And by the way, if you connect to a server machine running Terminal Services in Application Sharing Mode via RWW, it will be over port 4125, not port 3389 (the traditional way). You read it here first.
19. You will now disconnect properly! Close Word 2003 (save the file if you like). Close Outlook 2003. Click Start, Disconnect. Select Disconnect when the Disconnect Windows dialog box appears. When you perform this step, a local user could log on to the machine again and commence working (e.g., Linda uses the desktop computer again).
20. You are returned to RWW’s screen displaying computer names. Click the Main Menu link.
21. Click on the Use my company’s internal Web site link.
22. Complete the connection dialog box that appears as NormH in the User name and Purple3300 in the Password field.
23. The Windows SharePoint Services (WSS) Home page appears as seen in Figure 8-8.
Notes:
Figure 8-8
The WSS Home page as you left it in Chapter 7 but viewed via RWW.
24. Select Log Off. Then click Close. When asked to close the window in the Microsoft Internet Explorer dialog box, click Yes.
Notes:
Visit www.microsoft.com/technet for the latest updates for any Microsoft product.
Monday, August 11, 2008
Remote Web Workplace (RWW) in SBS
Good Monday to u. I am posting up several pages per day of my Windows Small Business Server 2003 Best Practices (SBS) book and today we getting further into the mobility chapter. Specifically - I introduce Remote Web Workplace aka RWW (tomorrow we will delve into some procedures on it).
cheers...harrybbb
Harry Brelsford, Author, Consultant and CEO at SMB Nation www.smbnation.com
Microsoft Small Business Specialist (SBSC), MBA, MCSE, MCT and other non-sense!
PS - did u know I hold a fall conference for SBSers in Seattle? :)
###
Remote Web Workplace
Not only does travel, which is “remote” by its very nature, allow you to learn firsthand the mobility solutions in SBS 2003, it affords the opportunity to meet SBSers worldwide who have different viewpoints to contribute. Across this book, such diverse insights have been interjected in a technical realm. Every day, SBSers worldwide are thinking of ways to work with SBS 2003 not imagined by the SBS development team in Redmond, Washington, or yours truly on Bainbridge Island. In this case, the insight is humorous, wherein some SBSer known only to the SBSers above, started pronouncing RWW as “arrr-wuuuwuuu,” an admittedly silly saying that seems to have found traction.
BEST PRACTICE: Rumor has it that, in Redmond, this area is called RUP (rhymes with pup, like puppy). If you call Microsoft Product Support Services (PSS), you could say RUP and arrr-wuuu-wuuu, but your coworkers who overhear the telephone call might look at you kinda funny.
BEST PRACTICE: Two initial thoughts on RWW are important to carry forward. First, when you access the external Web page that is exposed on the external interface of your SBS server machine, it is a Welcome Web site that greets you. This assume you opened Port
Visit www.smbnation.com for additional SMB and SBS book, newsletter and conference resources.
80 by selecting Business Web on the Web Services Configuration page in the EICW (not recommended). This is NOT RWW at this point. Rather, you select RWW from the Remote Web Workplace link from the Welcome Web site. Better yet, you can access RWW by addressing it via the FQDN/remote (discussed more later). Second, a point of confusion amongst SBS 2003 hands-on lab attendees in the Fall of 2003 was that RWW offers only the ability to take remote control of your desktop at work. That’s only part of RWW. This will be revealed herein, but it’s good to have this little chat first. Forward!
cheers...harrybbb
Harry Brelsford, Author, Consultant and CEO at SMB Nation www.smbnation.com
Microsoft Small Business Specialist (SBSC), MBA, MCSE, MCT and other non-sense!
PS - did u know I hold a fall conference for SBSers in Seattle? :)
###
Remote Web Workplace
Not only does travel, which is “remote” by its very nature, allow you to learn firsthand the mobility solutions in SBS 2003, it affords the opportunity to meet SBSers worldwide who have different viewpoints to contribute. Across this book, such diverse insights have been interjected in a technical realm. Every day, SBSers worldwide are thinking of ways to work with SBS 2003 not imagined by the SBS development team in Redmond, Washington, or yours truly on Bainbridge Island. In this case, the insight is humorous, wherein some SBSer known only to the SBSers above, started pronouncing RWW as “arrr-wuuuwuuu,” an admittedly silly saying that seems to have found traction.
BEST PRACTICE: Rumor has it that, in Redmond, this area is called RUP (rhymes with pup, like puppy). If you call Microsoft Product Support Services (PSS), you could say RUP and arrr-wuuu-wuuu, but your coworkers who overhear the telephone call might look at you kinda funny.
BEST PRACTICE: Two initial thoughts on RWW are important to carry forward. First, when you access the external Web page that is exposed on the external interface of your SBS server machine, it is a Welcome Web site that greets you. This assume you opened Port
Visit www.smbnation.com for additional SMB and SBS book, newsletter and conference resources.
80 by selecting Business Web on the Web Services Configuration page in the EICW (not recommended). This is NOT RWW at this point. Rather, you select RWW from the Remote Web Workplace link from the Welcome Web site. Better yet, you can access RWW by addressing it via the FQDN/remote (discussed more later). Second, a point of confusion amongst SBS 2003 hands-on lab attendees in the Fall of 2003 was that RWW offers only the ability to take remote control of your desktop at work. That’s only part of RWW. This will be revealed herein, but it’s good to have this little chat first. Forward!
Subscribe to:
Posts (Atom)
