Technical Clinic with David Overton

http://uksbsguy.comdoverton@microsoft.com

AgendaAgenda

3 Questions3 Questions

Windows Mobile problemsWindows Mobile problems

ISA Server 2004 and branch officeISA Server 2004 and branch office

Group Policy UsageGroup Policy Usage

N.B. Send your Q&A questions via N.B. Send your Q&A questions via the keyboard during the the keyboard during the presentation and I will answer at the presentation and I will answer at the endend

CloseClose

Question 1Scott

Situation Windows XP Pro SP2 PC with SBS2003 w/SP1 &

Exchange SP2  Syncing over the air with Exchange is working fine but

when the device is connected to the PC via USB I get error 8501008:

“The Proxy Server you have specified is incompatible with your device.  Specify the correct proxy server in your connection configuration.  Support code: 8501008”

Note A solution to this would be great.  But what I’m really

after is a general understanding of what’s going on when a Mobile 5.0 device is connected by the USB cable.

Diagnosis tool

We need to make sure ActiveSync is up to date and that general connectivity is provided (i.e. can I browse the web)

http://www.microsoft.com/windowsmobile/help/activesync/default.mspx

When a device is connected

Clean up ActiveSync and Phone

Connect the device

Fails to connect as needs proxy information

Check the settings on the client

Question 2(a)Angus

I would like to see info on exactly what we need to get push email to work?

Also some real world data on how much bandwidth this will take.

What is Needed

Windows Mobile V5.0 device Messaging and Security Feature Pack ActiveSync V4.1 Exchange 2003 w/SP2 SSL Certificate that matches the roots

accepted on the device Data contract with your mobile provider Configuration changes to the SBS Server

Windows Mobile 5.0 and Exchange 2003 SP2

http://uksbsguy.com/r.ashx?5 http://www.microsoft.com/technet/

prodtechnol/exchange/2003/sp2mobility.mspx Direct Push technology Wireless support for contact information Remotely enforced security policy Local device wipe

Steps to make it work

Step 1 - Installing ActiveSync® 4.1 Step 2 - Enabling mobile services for users Step 3 - Configuring the firewall and Web services Step 4 - Deploying an SSL certificate Step 5 - Configuring Windows SBS 2003 for MSFP Step 6 - Configuring device synchronization Step 7 - Testing the deployment

Ensure users and Firewall are configured

Configure Exchange and ActiveSync

1.Ensure Exchange Server 2003 SP2 is installed2.Open Exchange System Manager.3.Expand Global Settings.4.Right-click Mobile Services and click Properties.5.Verify that the Enable Direct Push over HTTP(s) check box is selected.

Question 2(b)

ISA2004 SP2 has problems - elaborate on them.

  ISA2004 VPN site to site with SBS2003PE

dual NIC to Win2K3 single NIC branch office member server, any tested appliances etc?

Request Smuggling Error Code: 502 Proxy Error. The HTTP request includes a non-supported

header. Contact your ISA Server administrator. (12156) Sending response headers that include both Content-length: and

transfer-encoding: chunked RFC-2616 defines those two headers for the purpose of providing

quantitative content validation for the receiver and states *very clearly* that the server MUST NOT combine them in the same response.

Some sites are either failing outright or rendering poorly because ISA rejects those responses as RFC-2616 clearly states don't combine those headers and doing so is a demonstrably malicious act.

As it turns out, there are quite a few legitimate sites out there that violate this part of RFC-2616 and so we have had to rethink our answer to this problem.

If this is hitting you, call PSS and request a patch against KB915045

http://isainsbs.blogspot.com/

Authentication behaviour changes Error message when you try to connect to a Web site

that is published by using ISA Server 2004 Service Pack 2: "403" or "500" With authentication methods enabled:

Basic, RADIUS, Outlook Web Access Forms-Based Web listener is configured to listen for HTTP traffic The Require all users to authenticate check box is selected

for the Web listener You connect to the published Web site by using HTTP

ISA Server 2004 SP2 does not enable traffic on the external HTTP port if the Web listener is configured to request one of the above kinds of credentials

http://support.microsoft.com/kb/912122/en-us

ISA appliances

“Tested” ISA to ISA, yes http://www.microsoft.com/isaserver/

hardware/default.mspx Key learning's

Check security at every level – be paranoid http://uksbsguy.com/r.ashx?8

Ensure all certificates are trusted (try browsing to the “other” sites

Question 2(c)

Since the DFS-R enhancements will not be in SBS2003 R2, what is the best way to set up a branch office and sync email, files/folder and DC information? Also, can you share any real world bandwidth and tips/tricks? 

Site to site scenarios

Running Multiple Servers in a SBS environment

http://uksbsguy.com/r.ashx?7

Consider a Domain controller

E-Mail – use Outlook Files, Use Sharepoint or DFS* Authorisation, make it a DC Local Backup – almost certainly

Question 3

Is it possible to stop “My Documents replication” for just one user? The tool in SBS impacts all users

GPO Information

Group Policy Objects (GPO) are inherited from the Organisational Units (OU) above by default

You can create OUs to have different policies, so by moving accounts around, you change the policies that impact that user

This has been discussed on the UKSBSGUY.com forums - http://uksbsguy.com/forums/thread/104.aspx

Demo of GPO changes

Close

Please continue to sign up for these and post questions

Please continue the feedback, either on http://UKSBSGUY.com so it is public, or via e-mail to me (doverton@microsoft.com)

If you are not an SBSC member, join athttp://www.microsoft.com/uk/partner/sbsc

Thank-you for listening