Category Archives: Technology

My experience with the 70-640

Posted on by

I decided early last year it was time to update my MCSA to the MCITP:SA (which is actually being changed back to MCSA next July). Upon reviewing the material, I saw they were now including R2 information. Since I didn’t feel like relying solely on Technet for R2 material, I figured I would wait another year and give Microsoft time to get a revamped R2 book out there.

Earlier this year we had a budget approved to upgrade our infrastructure to Server 2008. It seemed like the perfect opportunity to purchase the Server 2008 R2 books and crank through the material via labbing and through real life experience.

Over the next four months, I put my mind into exam mode. I’ve developed a pretty solid system ever since I began taking certification exams back in 2005. I first read through a chapter, go through the chapter again taking handwritten notes, convert the notes to digital form, and end with studying the digitized notes each day until the exam. I’ve found by the time I near the end of the book I’ve memorized a good portion of the first half or two-thirds of the book.

The exam required a ton of labbing. I focused on ADCS, ADRMS, and ADFS since those were the three technologies I had the least amount of experience with. DNS has always come easy for me, so I didn’t spend much time on it. After a few months, I had grasped the material and was ready to take the exam.

I heard Microsoft was changing the format of the exams to make them a bit more difficult, and the changes were noticeable. I won’t go into that because I don’t want to violate the NDA. However, there is a video out there from the head of Microsoft’s certification department that talks about the planned changes.

At the end of the day, I scored 858/1000. I was hoping for something in the 900s, but a pass is a pass. I’ve made my notes available here for anyone who is interested.

On to the 70-642!

Configuring EFS with ADCS Server 2008

Posted on by

Over the past few months I’ve been studying for the 70-640. I decided to put the CCNA on hold since I’m in the process of building a new Server 2008 network. From what I’ve gathered from reviews of the exam from my friends over at Tech Exams, the exam really focuses on AD CS.

In the process of studying for the exam, I’ve been labbing AD CS like crazy. Over the past few days I’ve been setting up a virtual lab similar to the advanced lab detailed in the AD CS Step-by-Step Setup Guide.

Today I decided to play with certificate autoenrollment and EFS. I couldn’t find anything on the web that gave the full details on how to set everything up, so I figured I would write up the process to save others the time it took me to round up all the info.

I’m not going to go into how to setup AD CS, as there are plenty of guides out there that will walk you through the process. With that in mind, let’s begin.

Step 1: Duplicate the EFS Recover Agent certificate template

First and foremost you’re going to want to setup a recovery agent. You’ll be able to use this account to decrypt any documents that users encrypt with EFS. This can be useful in situations like where you have to restore an encrypted document from a backup or if a user somehow manages to lose his or her private key. Due to the power of this account, you’re going to want to make sure to lock it down.

Open up Server Manager, expand the ADCS role, click on the Certificate Templates node, and right-cick on the EFS Recovery Agent template and select Duplicate Template. Choose the Windows 2008 Enterprise option (the test lab is a pure 2008 network). On the general tab check off the option to publish the certificate to Active Directory. I would recommend this option for most certificate templates. Make sure your Request Handling tab looks like the one pictured below:

EFS Recovery Agent - Request Handling tab

Microsoft now recommends you use ECC algorithm rather than the RSA (see Microsoft Changes in EFS). This will require you to change the encryption algorithm on the Cryptography tab from RSA to one of the ECDH variants. Next, tweak your security settings to make sure the accounts you plan on using have the enroll permission. Hit Apply and OK to close the window.

Step 2: Duplicate the User and Basic EFS certificate templates

You’ll want to do this is the same way you duplicated the template in step 1. The General, Request Handling, and Cryptography tabs are going to have the same settings we discussed above. Make you properly configure your security settings. I would recommend giving users autoenroll on the User certificate. Google will produce a number of guides for configuring autoenroll of certificates.

Step 3: Add the templates to the issuing CA’s certificate templates

Open up Server Manager on your issuing CA, expand the issuing CA node, right-click the Certificate Templates node and select New -> Certificate Template to Issue. Select the three templates you created and hit OK.

Step 4: Issue the EFS Recovery Agent certificates

Log on to a computer as the account(s) you want to set as recovery agents, open a new MMC and add the Certificates snap-in, and select the Current User option. Once the snap-in opens, right click over the Personal node, select All Tasks, and Request New Certificate. Select the default policy you are presented with, check off the EFS Recovery Agent template you created, and select Enroll.

At this point you should backup EFS Recovery Agent certificate and private key as detailed in this article. Store the backup in a secure location.

Step 5: Configure EFS PKI settings in the Default Domain Policy GPO

You’ll now want to configure the GPO that will push your EFS settings out to the clients. I’m going to place the settings directly into the Default Domain Policy.

Open GPMC and navigate to the node listed in the screenshot below. Right-click over the Encrypting File System node and hit Properties. Configure as shown in the screenshots below.

EFS GPO - General

On the certificates tab, select the custom Basic EFS template you created.

EFS GPO - Certificates

Leave the Cache tab settings as is unless you have a reason to change them. Click Apply and OK to close the window.

Now you’ll need to add the EFS Recovery Agent. Right-click over the Encrypting File System node and select “Add Data Recovery Agent”. Find the accounts you issued the EFS Recovery Agent certificates for and select them.

At this point, you’re done! You have successfully setup the infrastructure for EFS with Server 2008 AD CS. If you autoenrolled the User and Basic EFS certificates, users will be able to encrypt once they reboot their computers. Otherwise, they will need to request them using Web Enrollment or through the Certificates snap-in.

If you end up having to use the EFS Recovery Agent to decrypt an encrypted document, make sure you remember to load the EFS Recovery Agent certificate and private key for the recovery account on the workstation you are logged into. You would accomplish this by exporting the certificate in the same manner as backing up the key. After that, you would open the Certificate snap-in, right-click the Personal node, select Import, and choose the exported certificate.

This was a real learning experience for me and was very useful in reinforcing a number of AD CS concepts. On to Web Enrollment!

*A few additional helpful tips.

  • If you receive “parameter is incorrect” when trying to encrypt a document,
    check the User and Basic EFS certificate templates to make sure you selected an ECC algorithm.
  • If you receive “access is denied” when trying to decrypt an encrypted document using an EFS recovery agent account, verify that you have loaded the private key for the EFS recovery agent certificate on the workstation. This error also occurs if you changed the recovery agent certificate and the item was encrypted before the change. You can verify this by checking the thumbprint of the certificate (details tab when you double-click a certificate) against the recovery agent thumbprint of the encrypted document (right-click document -> Advanced button -> Details button).

Citrix headaches

Posted on by

One of our clients is beginning to utilize the Citrix XenApp Fundamentals installation we put in a year ago, and we ran into an interesting error when attempting to setup a new user with access. As a bit of background, the client is using Citrix XenApp Fundamentals 3.0 with Windows Server 2008 SP 32-bit. and the user we granted Citrix access to has been an Active Directory user for over three years. There were only two users utilizing the Citrix connection and it had been working flawlessly.

We setup the new user with Citrix access and had them attempt to connect. Once the user selected an application, we ran into an interesting issue. Instead of receiving the streamed application like normal, the Explorer interface ended up popping up with the following error message:

“You have started Windows Explorer in your ICA Seamless session. This will obscure your local Explorer desktop.
to re-enable this ICA Seamless connection, please logoff and restart the Seamless remote application.”

We knew off the bat that the existing users were having no issues, so that meant it was either the user’s computer, the user’s profile, the user account, or an issue with adding new accounts to Citrix. We opted to eliminate the Citrix issue first and granted another AD user permission on the Citrix server and logged in without an issue. Next, we tried logging into Citrix using that new AD account from the affected user’s computer, again no issue. Lastly, we tried logging in with that user’s account from another computer and we received the same error. We now knew the problem was related to the user’s Active Directory account.

After a bit of Googling, we came across some KB articles from Citrix. Unfortunately, we couldn’t find an article that fit our issues. The Citrix community forums were a bit more helpful and we tried a few fixes suggested by community users such as the following:

  • Delete the profile for the affected user account.
  • Delete the registry key for the affected user from HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionProfileList
  • Restart the server
  • After removing the profile and the profile registry key, restart the computer, and copy the Default user profile from a working Windows Server 2008 install

None of the above fixes seemed to do the trick. After some more searching I ran across a blog post from James Scanlon. His fix applied to XenApp 5 running on a Server 2008 SP2 install, but we figured it was worth a try at this point. The fix involves clearing an attribute for the affected Active Directory account. We hopped on the domain controller, opened ADSI edit (ADSIEDIT.MSC), expanded domain and organizational unit nodes, and right-clicked on the user and choose to edit the properties. The culprit in this scenario was the userParameter attribute, which from what I understand is used to set user specific settings for terminal services. This value was either corrupt or previously set to a value that was no longer valid. After clearing the value we had the user try logging again, and lo and behold, the application was now streaming correctly.

It must not be a common occurrence, because I wasn’t able to find many references to it on a web. So either my Google skills were suffering due to lack of caffeine, or it’s not a common error. Whatever the case, the problem is solved and all is right in the world!

A taste of the cloud with Symantec.cloud Email Security

Posted on by

Recently, I had a chance to demo three of Symantec’s cloud services: Symantec.cloud Email Security, Email Encryption, and Endpoint Security . Since there do not seem to be too many detailed reviews of Symantec’s cloud services floating around on the Net, I figured I relay my experiences with the service.

Today I will be talking about Symantec.cloud Email Security.

Symantec.cloud Email Security

Host based anti-malware is all well and good, but stopping malware from ever entering network is even better. That is where the Email Security portion of the Symantec’s cloud services comes in. The service aims to provide anti-spam, anti-virus, image control, and content control of email through a single cloud-based service managed using a web-based client portal.

Setup was fairly easy, it involved filing out some paperwork with information about the network and submitting it to Symantec to aid in the configuration of the client portal. After about two weeks, we were provided with an email with further instructions of how to configure the mail servers. The service requires directing the mail server to send all mail to Symantec through a TLS-encrypted connection, adjusting MX records to point to Symantec’s servers, and optionally locking down SMTP ports to allow traffic to and from only Symantec servers. Performing all three of these tasks has the added benefit of decreasing the attack surface of the network by locking down SMTP and providing additional confidentiality of email data as it flows between the company’s network and Symantec’s mail servers (I’ll talk more about this when I review the Encryption portion of the service). Symantec support replied quickly to any problems we ran into during the setup.

Once everything was in working order, we were provided access to the web-based portal. (click on images and select expand to full size)

The summary window provides graphical representations and statistics showing total incoming and outgoing email, emails containing viruses, spam, blocked images, and blocked content. It is pretty typical of the summary windows you encounter in any type of enterprise level security software, nothing too special. Although it is neat to watch the amount of spam rise and fall depending on the day of the week (it seems even spammers enjoy taking the weekend off.)

The anti-virus piece of the service utilizes Symantec’s vast database of virus signatures to detect and remove viruses from email. The added benefit of this is better detection of zero-day threats since you are not sitting waiting for the DATs to be released and pushed to your local gateway anti-malware solution. There is not much configuration to this portion of the service.

The anti-spam portion of the service uses typical anti-spam lists, as well as heuristics and a signature system. From our testing, the lists catch close to 50% of the spam using the lists and the heuristics and signature system each catching about 25%. We were really impressed with the effectiveness of the filter. Almost no spam made it through and we had a false positive only about 1 out of every 10,000 emails.

The configuration options are pretty typical of any anti-spam solution. Email can be sent to a quarantine hosted by Symantec, sent along through with an appended header, blocked, or sent to a bulk email address. The quarantine feature was pretty nice, as each user can be setup with access to his or her quarantined emails to restore any false positives. Another available option is to give a single user control over the quarantines of multiple users. The only downfall to this option is control of the quarantines cannot be shared among users. Hopefully that is a features Symantec will add in the future.

The content control feature of the service is really intense as can you can see from the screenshot below. I won’t go too in depth into it because I didn’t spend too much time playing with it. Suffice to say it is pretty awesome. Want to know if your users are sending personally identifiable information out over email without encrypting it? That can be done, even so far as scanning Microsoft Office and OCR’d PDFs. Suspect a certain users of sending company info out of the network without permission? Setup a rule to copy his or her email with specific attachment types to another email address for further review.

The system uses templates to detect patterns and the templates can be created by the user or with help by Symantec . We had Symantec help us create a template to detect bank account numbers and tested it by sending some Excel documents through the system with fictitious account numbers. The system caught the emails with the pattern and notified us of the email address used to send the email. These caught emails can be let through, tagged, logged, deleted, redirected to the administrator, or copied to the administrator. I can see this coming in handy when trying to prevent a data breach of confidential information or during an internal investigation of an employee’s email activities.

I didn’t play with the image control feature of the service. It looks to be as intense as the content control from the little that I looked at.

If you are in need of a customized report from the system, you can request Symantec to create one for you. I didn’t end up utilizing this feature, so I can’t say what the response time from support is.

Overall, I was really impressed with the service. The spam filter was amazing and the anti-virus seemed solid. I can think of a thousand usages for the content control and can’t wait to play with it further. Cost isn’t too bad, about $4,000 / year for 50 users. If you are looking to free up some server resources, consolidate software packages, and possibly increase your network security, Symantec’s cloud Email Security service is something to look at.