vBulletin statistics
juni 2008 - Posts - Windows Server blog by Kurt Roggen [BE]

juni 2008 - Posts

Service Pack 1 of System Center Configuration Manager 2007 adds support for running the systems management product on Windows Server 2008.  This update from Microsoft adds the required information for SCCM 2007 in the Security Configuration Wizard so that you can correctly lock down site systems.

"The Security Configuration Wizard (SCW) is an attack-surface reduction tool for the Microsoft Windows Server® 2008 operating system. SCW determines the minimum functionality required for a server's role or roles, and disables functionality that is not required. The Configuration Manager 2007 SP1 Windows Server 2008 SCW template supports both new and updated site system definitions and the required services and ports.

Feature Bullet Summary:

The Configuration Manager 2007 SP1 Windows Server 2008 SCW template adds support for the following new site systems:

  • Out of Band Service Point
  • Asset Intelligence Synchronization Point

The Configuration Manager 2007 SCW template renews support for the following site systems:

  • Fallback Status Point (FSP)
  • State Migration Point (SMP)
  • PXE Service Point (PSP)
  • Software Update Point (SUP)
  • System Health Validator (SHV)
  • Primary Site Server (PSS)
  • Secondary Site Server (SSS)
  • Server Locator Point (SLP)
  • Management Point (MP)
  • Reporting Point (RP)"

Yesterday, I was speaking about “Windows Server 2008: 10 reasons to upgrade” at the Belgian “Community Day 2008” (an event organized by all Belgian Microsoft-focused User Groups).
Here are some of the usergroups present: SQL Server User Group, System Center User Group, Exchange User Group, Visual Studio User Group, Windows Security User Group, etc…

image

If you are wondering what they are, here’s a quick list:

10 Reasons to upgrade to Windows Server 2008

1. Server Management Improvements – Server Manager, PowerShell, Group Policies (GPO/GPP)
2. Deployment Improvements - Windows Imaging, Windows Deployment Services
3. Web & Application platform - IIS 7.0 & .NET 3.0
4. Server Core
5. Security Improvements - RODC, NAP, Bitlocker
6. Failover Clustering
7. Presentation Virtualisation - Terminal Services (RemoteApps, Easy Print, TS Gateway, TS Session Broker)
8. Server Virtualisation: Hyper-V
9. Branch Office Improvements – RODC, Server Core, Role Seperation, DFS-R/DFS-N, Restartable AD
10.Works better together with Windows Vista

Anyway, you can download the full presentation here.

In part 1, we’ve talked about the Group Policy engine refresh cycle, but let’s dive a little bit deeper. 

Both Group Policy Client Side Extension (CSE) and Group Policy Preferences (GPP) Client Side Extensions (CSE) refresh according to this refresh cycle. 
When starting the refresh cycle (manual or automatically), all CSE are called in alphabetical order based on their GUID.  However, the very first CSE that is called is always the registry-CSE. Then the application goes on in alphabetical order. Each extension defines it's own processing behavior.

Below, you can find a sorted list (following the order of application) of all Group Policy CSE (Client Side Extensions) taken from the site of Mark Heitbrink - MVP Group Policy.
All extensions can be found under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions.

Order Client Side Extension (CSE) Name File GP GUID

Background Refresh

1 Registry userenv.dll {35378EAC-683F-11D2-A89A-00C04FBBCFA2} Yes
2 Wireless Group Policy gptext.dll {0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63} Yes
3 Group Policy Environment gpprefcl.dll {0E28E245-9368-4853-AD84-6DA3BA35BB75} Yes
4 Group Policy Local Users and Groups gpprefcl.dll {17D89FEC-5C44-4972-B12D-241CAEF74509} Yes
5 Group Policy Device Settings gpprefcl.dll {1A6364EB-776B-4120-ADE1-B63A406A76B5} Yes
6 Folder Redirection fdeploy.dll {25537BA6-77A8-11D2-9B6C-0000F8080861} Yes
7 Microsoft Disk Quota dskquota.dll {3610eda5-77ef-11d2-8dc5-00c04fa31a66} No
8 Group Policy Network Options gpprefcl.dll {3A0DBA37-F8B2-4356-83DE-3E90BD5C261F} Yes
9 QoS Packet Scheduler gptext.dll {426031c0-0b47-4852-b0ca-ac3d37bfcb39} Yes
10 Scripts gptext.dll {42B5FAAE-6536-11d2-AE5A-0000F87571E3} Yes
11 Process Group Policy For Zone Map / Internet Explorer iedkcs32.dll {4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3} Yes
12 Group Policy Drive Maps gpprefcl.dll {5794DAFD-BE60-433f-88A2-1A31939AC01F} No
13 Group Policy Folders gpprefcl.dll {6232C319-91AC-4931-9385-E70C2B099F0E} Yes
14 Group Policy Network Shares gpprefcl.dll {6A4C88C6-C502-4f74-8F60-2CB23EDC24E2} Yes
15 Group Policy Files gpprefcl.dll {7150F9BF-48AD-4da4-A49C-29EF4A8369BA} Yes
16 Group Policy Data Sources gpprefcl.dll {728EE579-943C-4519-9EF7-AB56765798ED} Yes
17 Group Policy Ini Files / INI gpprefcl.dll {74EE6C03-5363-4554-B161-627540339CAB} Yes
18 Windows Search Group Policy / WDS srchadmin.dll {7933F41E-56F8-41d6-A31C-4148A711EE93} Yes
19 Security scecli.dll {827D319E-6EAC-11D2-A4EA-00C04F79F83A} Yes
20 Deployed Printer Connections gpprnext.dll {8A28E2C5-8D06-49A4-A08C-632DAA493E17} Yes
21 Group Policy Services gpprefcl.dll {91FBB303-0CD5-4055-BF42-E512A681B325} Yes
22 Internet Explorer Branding / Internet Explorer iedkcs32.dll {A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B} Yes
23 Group Policy Folder Options gpprefcl.dll {A3F3E39B-5D83-4940-B954-28315B82F0A8} Yes
24 Group Policy Scheduled Tasks gpprefcl.dll {AADCED64-746C-4633-A97C-D61349046527} Yes
25 Group Policy Registry / Registry gpprefcl.dll {B087BE9D-ED37-454f-AF9C-04291E351182} Yes
26 EFS recovery scecli.dll {B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A} Yes
27 802.3 Group Policy dot3gpclnt.dll {B587E2B1-4D59-4e7e-AED9-22B9DF11D053} Yes
28 Group Policy Printers gpprefcl.dll {BC75B1ED-5833-4858-9BB8-CBF0B166DF9D} Yes
29 Group Policy Shortcuts gpprefcl.dll {C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7} Yes
30 Microsoft Offline Files cscobj.dll {C631DF4C-088F-4156-B058-4375F0853CD8} Yes
31 Software Installation appmgmts.dll {c6dc5466-785a-11d2-84d0-00c04fb169f7} Yes
32 IP Security polstore.dll {e437bc1c-aa7d-11d2-a382-00c04f991e27} Yes
33 Group Policy Internet Settings / Internet gpprefcl.dll {E47248BA-94CC-49c4-BBB5-9EB7F05183D0} Yes
34 Group Policy Start Menu Settings gpprefcl.dll {E4F48E54-F38D-4884-BFB9-D4D2E5729C18} Yes
35 Group Policy Regional Options gpprefcl.dll {E5094040-C46C-4115-B030-04FB2E545B00} Yes
36 Group Policy Power Options gpprefcl.dll {E62688F0-25FD-4c90-BFF5-F508B9D2E31F} Yes
37 Group Policy Applications gpprefcl.dll {F9C77450-3A41-477E-9310-9ACD617BD9E3} Yes
38 Enterprise QoS gptext.dll {FB2CA36D-0B40-4307-821B-A13B252DE56C} Yes

By default, some extensions will refresh in both foreground and background, some don’t.  How can you tell??

Under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions each of the Client Side Extensions has a sub-key.
For example, {5794dafd-be60-433f-88a2-1a31939ac01f} - the CSE for Group Policy Drive Maps – has a key called NoBackgoundPolicy with a value set to 1. This mean the extension will not process in the backgound and thus policy changes only take effect until the next system restart or user logon (read: foreground). 
All extensions with the NoBackgoundPolicy value set to 0 will process in backgound and foreground. If the value does not exist, it will also process in both foreground and background.
For the “GP Preference Files” (GUID {7150F9BF-48AD-4da4-A49C-29EF4A8369BA}), the key NoBackgroupPolicy is not there. This means it will process in the foreground and in the background.

image

Similar logic is used for other registry keys like NoSlowLink (read: do not allow processing acros slow network connection) and NoGPOListChanges (read: Process even if the Group Policy Objects have not changed).

image42_thumb1 image


CONCLUSION

Understanding the Group Policy refresh cycle is important if you are looking at optimizing the background refresh interval to modify the time it takes machines/users to re-evaluate whether new GPO settings have been made. The default refresh interval is different for domain controllers, non-domain controllers and user accounts. The refresh interval can be set anywhere from 7 seconds to 45 days. A longer interval reduces
how often a computer or user refreshes new GPO settings.  45 days is a extreme long time to wait between GPO updates/refreshes. However, if you configure the refresh interval too low, network traffic will increase and the user’s work can be affected. 
The Group Policy refresh cycle takes place in both foreground (startup/logon) and background.  Per Group Policy Client Side Extension (GP CSE), you can optimize this behavior if background refreshes are not required.
Both Group Policies as Group Policies Preferences - which are simply GP CSE - follow the same specified refresh intervals.

With Group Policies (and also Group Policy Preferences), settings are divided into two categories: Computer Configuration and User Configuration.
Computer Configuration settings are applied during startup of the operating system. User Configuration settings are applied during user logon on to a computer.

Once policy settings are applied at startup/logon, the settings are refreshed automatically to ensure they are up-to-date.  During Group Policy refresh, the client computer contacts the closest available
domain controller which provides a list of all the policy objects that apply to the computer and user at different levels (site, domain, OUs). The domain controller does this regardless of whether the version numbers on all the summarized policy objects have changed. By default, the computer processes the policy objects only if the version number of at least one of the policy objects has changed. If any one of the related policies has changed, all of the policies have to be processed again because of inheritance and the interdependencies within policies.

You can also force a refresh manually using gpupdate /force.  This will process all policies again, even if their version number has not changed.

By default, computer Group Policy is updated in the background every 90 minutes, with a random offset of 0 to 30 minutes. So, minimum refresh cycle is 90 minutes, maximum refresh cycle is 2 hours (120 min) and assures the load is spread when machines/users contact their domain controllers at the refresh cycle. This policy covers both workstations and member servers and excludes domain controllers.
You can specify an update rate from 0 to 64,800 minutes (45 days). If you select 0 minutes, the computer tries to update Group Policy every 7 seconds. However, because updates might interfere with users' work and increase network traffic, very short update intervals are not appropriate for most installations.

By default, domain controllers Group Policy is updated every 5 minutes.
You can specify an update rate from 0 to 64,800 minutes (45 days). If you select 0 minutes, the domain controller tries to update Group Policy every 7 seconds. However, because updates might interfere with users' work and increase network traffic, very short update intervals are not appropriate for most installations.

image
Refresh intervals for computers and domain controllers 

By default, user Group Policy is updated in the background every 90 minutes, with a random offset of 0 to 30 minutes.
You can specify an update rate from 0 to 64,800 minutes (45 days). If you select 0 minutes, the user tries to update user Group Policy every 7 seconds. However, because updates might interfere with users' work and increase network traffic, very short update intervals are not appropriate for most installations.

Both User and Computer refresh intervals are typically different.  For example, the computer refresh could take place within 95 minutes and the user refresh could take place within 112 minutes.

image
Refresh intervals for users

Security settings are a exception to the processing rule. By default, these settings are refreshed every 16 hours (960 minutes) regardless of whether policy objects contain changes.
A random offset of up to 30 minutes is added to reduce impact on domain controllers and the network during updates (making the effective refresh window 960 to 990 minutes).

Security settings contain Registry permissions, File System permissions, Restricted Groups, Eventlog, System Services, …
image

Also, if the client computer detects that it is connecting over a slow network connection, it informs the domain controller and only the Security Settings and Administrative Templates are transferred over the network, which means that by default only the security settings are applied when a computer is connected over a slow link.

The way slow link detection (read: threshold) works, is configurable through Group Policy.  However, security settings are always enforced even when a slow network connection is detected.

image
Group Policy Security CSE (Client Side Extension)
image
Group Policy Scripts CSE (Client Side Extension)
image
Group Policy Preference Folder Options CSE

The "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. 
Obviously, updates across slow connections can cause significant delays.

With Group Policy Preferences, you are able to go a step further and to configure the priority of the background refresh.

The MSIT pilot project of Windows Server 2008 Terminal Services was so successful that Microsoft IT went on to test the scalability and performance into the production environment. The environment acts as a SSL-based remote access solution and MSIT was able to create a scalable remote access solution that is accessible by using HTTPS connections from any location worldwide.

Read more: here

TS Gateway

The TS Gateway feature was introduced with Windows Server 2008. TS Gateway is one of the main features that the team wanted to test. The team determined that a successful implementation of TS Gateway was a key component of creating an easy-to-use universal remote access solution by using Terminal Services. 

TS Gateway is a Web server component. It provides the following primary functionalities:

  • It acts as the endpoint of a Secure Sockets Layer (SSL) connection from a Terminal Services client. This feature allows for a connection from the Internet to any Remote Desktop–enabled computer.  The destination resource can be a terminal server farm, a terminal server in a lab environment, or even a desktop computer with Remote Desktop enabled.
  • It performs authentication (TSCAP) and authorization (TSRAP) of the connecting user to determine whether the user is permitted to access the terminal server farm.
  • It performs authorization (TSRAP) of the remote computer from which the user initiates the Terminal Services session to determine whether the connection is allowed.
  • It forwards the user's connection to the destination resource by using Remote Desktop Protocol (RDP).

To perform these actions, the TS Gateway component listens on the Hypertext Transfer Protocol over SSL (HTTPS) port for Terminal Services clients. The Terminal Services client encapsulates the RDP traffic in Remote Procedure Call (RPC) over HTTPS and then sends the encapsulated traffic to the TS Gateway server.  The TS Gateway component unpacks the RDP traffic, creates a session to the destination resource, and then submits the RDP traffic.

TS Session Broker

The TS Session Broker is a Windows Server 2008 Terminal Services component that builds on the functionality that is available in the Windows Server 2003 Terminal Services Session Directory component. TS Session Broker is a supplementary Terminal Services role that provides load-balancing functionality and user session management to a Windows Server 2008–based terminal server farm. TS Session Broker provides the following two main functions:

  • It directs a disconnected and then reconnected session to the correct terminal server.
  • It directs new sessions to the terminal server that has the fewest Terminal Services sessions.

TS Web Access

The TS Web Access is a Terminal Services role that enables users to connect to TS RemoteApp applications or terminal server desktops from a Web browser.  After testing TS Web Access, the MSIT team determined that TS Web Access would provide several advantages to Terminal Services users, such as making TS RemoteApp applications easy to find from a Web-based front end.

The team decided that for its particular environment, the best approach would be to build a Terminal Services portal application to customize the functionality that is available in TS Web Access. This custom Web access portal is named TS Portal.

image 
Customised TS Web Access website or the TS Portal

 

TS RemoteApp

TS RemoteApp is a Terminal Services component that is directed toward the end-user experience with terminal server applications. Instead of running within a terminal server (full) desktop, the terminal server application appears in a separate (seamless) window on the user's desktop. Additionally, other features, such as notification area icons that correspond to the TS RemoteApp application, appear on the user's desktop. The team felt that this technology would enhance the user experience with Terminal Services by providing an almost seamless experience between terminal server applications and the local applications that a user might run on the local desktop.

 

Download:

White Paper PowerPoint Presentation IT Pro Webcast


Step-by-Step Guides:

Related reading: