SEMblog

Very occasionally, you get to do a job which you really enjoy. Being able to put lots of things that you have learnt over time in a single client deployment and make a very satisfying job. 

At the end of 2010 I completed just such a deployment.  

I could go on for hours about this deployment, as there are so many little things that were done, which I haven't had the chance to do before, or just make it a much better network. As I have complete control over the network, and have done for some time, I can ensure it runs exactly as it should. 

Only 40 users, so enough to use networking kit with. 

First, some background. This particular client is my oldest client. I have had them since about week six of my company. 

Just over 5 years ago I rebuilt their network, replacing their servers with a new domain, and all workstations were rebuilt. This was the first time I could try the locked down workstation method, as they had no proprietary or awkward third party application that "required" admin rights to run correctly. All desktops, and the one laptop didn't leave the building. 

Windows 2003, Exchange 2003 at the back end, on three servers, two HP and a very old clunky IBM which died last year. 

Clients were Windows XP, Office 2003. 

However it was starting to show its age. Three hours to setup a new workstation was becoming a joke, and the cost of server maintenance was getting higher all the time. 

Therefore it was decided that it was time to change the lot, all in one hit. 

Yes, you read that correctly. On the Monday they had the above, by the end of the week it was all changed. 

The first question then is how we could get away with doing a big bang change like this. 

It wasn't the original plan. I was looking at maybe changing the servers this year, then the workstations next. Office 2010 had just been released when planning started. However there was a keenness to do more, introduce laptops for some mobile workers so it was decided to make the change all at once. 

Furthermore, because the workstations were locked down, and were a basic build (Windows XP, Office 2003, AV, and a terminal application), with all relevant data redirected to a server, the amount of work that the move required would be minimal. The key company application is a database system that runs on Unix (which fortunately I have nothing to do with). The workstations are basically an office document and web browsing station. 

Then in a planning meeting I just happened to mention that we could replicate all of their data off site in real time for a lot less than they thought. So replacing the two servers became three, with replication thrown in as well. 

So this and the next two blog postings are a quick overview of what was done. If you would like to see it in action, and want me to do the same for your company, please let me know (UK Only). 

I am going to divide the rest of this blog in to three - workstations (below) and servers and networking which will have separate posts.

Workstations

This is quite easy. 

During the last 12 months of the previous XP/2003 based network, all replacement workstations were bought with the upgrade in mind. Minimum of 2gb of RAM and Windows 7 licences where possible. 

However a number had to be replaced, plus for the first time an active laptop fleet was introduced. 

This initial preparation work though made the initial deployment much easier. 

Desktops were Windows 7 Pro, Office 2010, Adobe Acrobat Reader, AV. The flash player was installed fresh, plus the terminal application. Installing off a memory stick, I was turning each machine around in about 45 minutes. 

Laptops were Dell Latitude, software as above. However we also added built in 3g cards so the users could work anywhere. Part of the plan (which I am not involved in) is to provide a web based access to their core database and inventory system. 

I also suggested, and was taken up, that every user, from the CEO down, was given a mandatory training session. So each staff member did a half day on Windows 7 and Office 2010. We found a local trainer, who created a bespoke course for the client. I explained what I wanted them to know. 

It should be pointed at this point that a large number of staff in this client are rather mature - I think I am still one of the youngest in the building when I go to visit. A change from Windows XP to Windows 7 would be quite different. The training was not only to show them how to do things, but also to simply give them confidence that they wouldn't break it. 

Therefore they were trained how to change the wallpaper, jump lists, gadgets. A brief overview on internet security and the like. They were trained on their actual workstations, so after the training was complete, there was a frantic period of machine change rounds. This meant that when they returned to their desks, things that they had done during training were still there. I felt this was important for adoption of the new platform. 

The new laptop users were given a slightly different course, which gave them a grounding in looking after the laptop. For most of them, this was the first time with a laptop. 

The client operates a conveyor belt system with desktops. New desktops go to the power users, with the slower ones going down the food chain, before eventually being removed. Therefore we started training with the power users on new desktops, while their older machines were rebuilt for the next session, and so on. This meant that during the training sessions I was rebuilding machines the users had just left. It got rather frantic. 

I rebuilt 9 machines in one day at one point, and put in 11 hour days four days on the trot. 

The end result though is that the client now has a complete desktop and laptop fleet that is on the latest OS and Office version, locked down, with the benefits that brings from a management and security point of view. 

In Part Two, I shall go over the server configuration. http://blog.sembee.co.uk/post/Case-Study-2-Part-2-Network-Rebuild-Servers.aspx 

This case study is a little different from the normal deployments I do, because it is a very small installation - only three users. However it is a very high net worth deployment, and has shown to be very successful.

Background

Three people run a company providing professional services to much larger companies. All three live out in the countryside with their families.
The company doesn't have a central office, each spend most of their time with clients, or at home in a study type area.
At the time I was asked to assist, they were using a hosted Exchange solution and files were being stored all over the place. It was becoming a nightmare to manage.

The also wanted to do something about the speed.
Being in the countryside, broadband speed is an issue. None of the three homes has a speed fast enough to run a server. With young families, there was also the concern of other demands on the computer and broadband connection. This introduces problems with dealing with network security and generally trying to split the business computer work from leisure.

I was asked to come up with some kind of solution that would give them a decent speed where ever they are, and also protect their and the client data.

The Solution

The solution I proposed, and implemented in late 2010 was very simple, but highly effective.

Hardware: This was a single Dell PowerEdge server, Eight disks, 30gb of RAM - with space for more.

Software: On to the bare metal I installed VMWARE vSphere 4.1
Then in to the virtual platform I installed six virtual machines:

VM 1: A Linux based firewall called pfSense. This protected the other machines.
VM 2: SBS 2008 Premium. Exchange 2007, commercial SSL certificate, all features enabled and turned on.
VM 3: Windows 2008. SQL Server. This also had BES Express and a monitoring tool for the VMWARE platform from Veeam.

VM 4 - 6: Windows 7 Professional. All three were identical, with Office, Adobe Acrobat Reader, AV and other tools installed.

Each of the workstation installations also had Dropbox installed.

The server was installed in to a data centre, where the data centre was able to provide backup storage for the server. Backup was provided by Backup Assist.

In Operation

The key to this implementation was the Terminal Services gateway feature of Windows 2008 and the RWW feature of SBS 2008.

What this allowed each staff member to do was connect to their virtual desktop in the data centre, from any machine and work. If they had to stop what they were doing, they could just disconnect, and come back to it.
This meant that working on the train, or in a client site was perfectly possible. Each of them had a laptop with 3g cards, wireless etc, so could get access back to the server easily. If the connection dropped for any reason, reconnecting would pick up from where they started.

Dropbox was used to allow files to be moved between the virtual workstations in the data centre and their personal computer. This could be to work on a file locally, copy it to a USB stick, because it contained video or for printing. It was found that the printers at home didn't like RDP very much, so printing was disabled.

The Blackberry devices gave access to email, and crucially the little known feature that allows access to the file system.

Benefits of This Solution

The server was in a secure location, not dependant on one place, with power or broadband issues. Email was quick, and filtering done in the data centre.
No more emailing files to each other, they could be just copied to a network share. This made collaboration much easier.
As all data was stored in the data centre, if the laptop was stolen, was damaged or simply failed, the loss would be small and it would be easy to get up and running again.

At home, if someone was relegated to a child's computer because they were using Daddy's computer for "homework", then the impact was negligible, as all the computer required was the RDP client. The home broadband speed was fine for this kind of work. No concerns with data security while the children are on the computer, as it was all in the data centre.

This also means that the home and roaming computers can be anything, they don't have to worry about compatibility with the "office" . It just needs to be something recent that has an RDP client.

RDP clients are common, one staff member is using it with an Apple iPad. Other tablets are being investigated, and I wouldn't be surprised if a Blackberry Playbook was used when those are released.

Terminal Services

We did consider using a full terminal server, but this was discounted for a number of reasons, the main one being cost of licencing it. However should the company grow, a terminal server can be quickly added to the deployment with little fuss.

Conclusion

A compact single server installation has proven to be very cost effective and given these users performance and security that they are very happy with.

Back in June 2009, I blogged on an authenticated user attack on a client's server.
http://blog.sembee.co.uk/post/Usernames-Tried-During-Authenticated-User-Attack.aspx

As part of that blog post, I included the list of names that were attempted.

The same server was attacked again in the last few days, and the list of usernames attempted changed very slightly. I have included the list below.
So quaint that they were tried in alphabetical order as well.

This list, along with the list from the original attack should be a list of usernames and passwords that you should avoid using, simply to ensure that you don't expose more than is necessary to this kind of attack.

www
vm
visitor
user
testuser
test
sysadmin
sysadm
support
supervisor
sales
operator
office
marketing
mail
info
guest
fax
backup
anonymous
admin
adm
account

With Exchange 2007 and older versions, one of the key elements that an Exchange administrator needed to keep an eye on, and caused confusion for newcomers to Exchange was the amount of white space in the database.
This is reported as free space in the event viewer via event ID 1221 during the night and is the result of content being removed from the database by the online defrag process.

I have written about this event ID and the white space elsewhere:
http://www.amset.info/exchange/event1221.asp

With Exchange 2010, the behaviour of the database has changed.
Instead of doing a online defrag during a fixed time window, it now does it constantly. This means that content that has passed the deleted item retention period, is removed from the database shortly afterwards, rather than waiting for the next online defrag window.

However because the process is running constantly, event ID 1221 isn't written to the event log. Therefore an administrator may not have a clue as to how much of the database is white space, and how much is actual content.

This question can be easily answered, using EMS, as the amount of free space in the database is available via get-mailboxdatabase -Status:

Get-MailboxDatabase -Status | Select Servername, Name, AvailableNewMailboxSpace

This command will show you the name of the Server the database is mounted on, the name of the database (which is unique across the Exchange org with Exchange 2010) and the mount of space available in the database for new content.
The result will be something along the lines of this:

ServerName                     Name                          AvailableNewMailboxSpace
----------                          ----                            ------------------------
SMB-A                             Mailbox Database         27.75 MB (29,097,984 bytes)

The command used -get-mailboxdatabase -status can provide quite a bit of information about the databases in your Exchange org, use the |fl command to see the full list.