Dan also has some useful tools for encoding video content on his blog, both of which are worth taking a look at.

Workstation Migration Assistant

The Workstation Migration Assistant is a visual wrapper for Microsoft’s User State Migration Tool, designed to simplify the capture / restore process for your end-users, and at the same time being highly configurable so that it can be customised to suit your organisations needs.

Some of it’s features include:

• Migrate via a pre-defined network storage location, external USB drive, or user-specified location. USB drive detection is automatic, and you can decide whether drives below a certain size are ignored (ie, memory sticks)
• Optional Hard Disk Health Check will run a CHKDSK prior to capture and fix errors if any are found
• Optional Encryption using a pre-defined company encryption key, or per-user customised encryption (for highly sensitive data that can’t be stored on a server without being encrypted)
• Use different configurations for “XP Only” (XP > XP) migrations via Standard (XP > Vista and Vista > Vista)
• Automatically run pre and post-capture / restore scripts and programs (very useful to further configure machine settings)
• Migrate domain only accounts, or domain and local
• Automatically exclude certain domain or local accounts from the migration
• Automatically send log files to an e-mail address via SMTP after the migration
• On-screen status during every stage of the migration, including ETA
• Option to limit migrations to a certain size, i.e. if over 20GB of data to backup, then fail and inform user. This is also overridable
• Automatic checks for USMT installation and optional download
• Command-line automation

It requires .NET Framework 2.0 on both the capture and target machines | Download

Software Compliance Tool

The Software Compliance Tool is a small application designed to reduce the overhead in managing unwanted applications in a business environment. While Windows Vista and Windows 7 have made a lot of headway in easing reduced user rights into the Enterprise, it’s still very common that Local Administrator rights are given to end users. The reasoning for this is usually to work around application compatibility (both external and in-house). However, this introduces the ability for end users to install whatever they want on their computers, including games, peer-to-peer software and security vulnerable applications. It is the company’s responsibility to ensure that copyrights are not infringed, and that their network is secure.

The Software Compliance Tool will try to automatically remove any applications which are contained on your custom-built “blacklisted applications” policy.

Some of the features include:

• Can automatically remove most Windows Installer (MSI) based installations
• Uninstall Strings for non MSI-based installs can be supplemented with switches (ie, “/S” for silent)
• Blacklist allows partial name matches (ie, “Mozilla” will blacklist all Mozilla applications)
• Blacklist allows version matches (ie, allow all versions greater than v1.6.5, remove all previous versions)
• Blacklist, but allow exclusions based on Active Directory Users or Groups
• Blacklist policy is encrypted to prevent tampering or reading by users
• AD Exclusions list is cached and encrypted, to allow running SCT off-domain
• Simple SQL logging to allow tracking of policy breaches (and potentially further action for repeated breaches)
• Extremely fast execution. Can be run from your Active Director login scripts

It requires .NET 3.5 to run, and must be run as a local administrator to successfully uninstall applications. | Download

They purchased a (at the time) a state of the art system and spent a big chunk of change thinking it would last them forever.  Fast Forward 10 years and that same system that cost them hundreds of thousands of dollars is now worth 30K (if they found a sucker on the street) and they were spending thousands of dollars every month on maintenance for the ancient piece of equipment sitting on the wall.  They were stuck with a dinosaur and were quickly falling behind their competitors.

At the time they had four options.

1. Invest a significant amount of money into a upgraded phone system
2. Move to a “Virtual PBX” a fairly new type of phone service, mainly used for home based businesses
3. Stick with the Dinosaur they know and continue to fall behind their competition
4. Move to a unproven, unknown “Hosted” solution.

Looking back I believe they should have chosen the Virtual PBX option.  This would have allowed them to take advantage of the new features coming to market as well as keeping their costs down and without replacing equipment.  It also would have allowed them to keep ahead of the game by taking advantage of the new features as they come to market instead of waiting for upgrades to a proprietary phone system.

These Virtual PBX systems have come a long way since I first started to research them.  I have been given a 90 day free evaluation of the new Mobile service by RingCentral and I am impressed at the progress these services have made.  They allow small companies to get the services provided by a enterprise class phone switch without making the large investment up front.

Do you think Virtual PBXs are the route of the future?  How would this technology help your company?

Never fear, Intel hears your cries for extreme power. Intel is readying it’s launch of Nehalem-EX processors for this month. The new processors will boast 8-cores, 16 threads and support for up to 8 processor sockets on a single board.

The Intel announcement states:

• 45nm process
• 8-cores per CPU
• 16 threads per CPU
• Up to 8 sockets
• QPI Architecture with four links
• 24MB of shared cache
• Memory controller integration
• Turbo Boost Technology
• 9 times the memory bandwidth of current Xeon 7400’s
• 16 memory slots per physical processor
• 2.3 billion transistors

]]> http://js-kit.com/rss/techvirtuoso.com/p=1011 0 http://techvirtuoso.com/2010/03/08/not-everything-made-by-cisco-is-made-of-gold/ http://techvirtuoso.com/2010/03/08/not-everything-made-by-cisco-is-made-of-gold/#comments Mon, 08 Mar 2010 20:14:36 +0000 Jake Sonelly http://techvirtuoso.com/?p=1005 The scenario:  You’ve found yourself working at a company that is experiencing phenomenal growth.  The employees have actually decupled in the past year and show no signs of slowing in the near future (on this note, when was the last time you saw the “decupled” in print?). You have inherited a network that is truly a Frankensteinian creation that not even the original architects understand any more.  You have noticed that you neither have a working firewall nor a decent VPN system, though Cisco VPN is used by a handful of key employees to connect to a Cisco 1800 series router.  The IP scheme for the organization, which spans three sites, is using the 192.x.x.x address space. You wish to straighten everything out with a minimum of downtime and as seamless as possible for the end-users.  What do you do?

Well, instead of telling you what to do, allow me to tell you what not to do.  Not just that, let me drill into your collective skulls what not to do.  Are you ready?  Here it comes:

Do not, and this is key, so write it down… do not buy a Cisco SA 500 series device.

Did you get all that down?  Now, I know some of you are thinking, “Wait a minute there, sir!  Cisco makes excellent business systems!  I am shocked at your lack of understanding!”  For those of you saying that, you have probably used something like the Cisco ASA 5505 to wrangle your network and think Cisco walks on water.  It’s okay… until recently I was one of you.  I’m here to tell you that putting the SA 500 in the same category as the ASA 5505 is akin to putting your child’s refrigerator “art” in the same category as the Mona Lisa (sorry, moms).

Here’s the lowdown on this “Security Appliance” that will be the bane of your existence.   First, the unit is essentially and enhanced and rebranded Linksys product meant for small businesses.  Now, I like that Cisco bought Linksys when it comes to home and small business products and up until meeting this hardware from hell, I had thought the merger would never go wrong. So what is so wrong with something like this?  Well, if you like certain features like a command-line interface, support for any VPN client other the Linksys (whoops, I mean, “Cisco”) QuickVPN and other things you’ve come to expect from a Cisco device, than you’ll understand the issue I have with this product.

Second, the price points for these units are right up there with the vastly superior ASA 5505.  You’re paying the same price for this Yugo of a device as you would for one equaling a Camaro.  Why would someone in their right mind do something like this?  Let me tell you how someone could be misguided into purchasing this unit.  Unlike the ASA 5505, the SA 500 allows you to integrate Verisign’s One-Time Password service for VPN access.  Now, I understand how OTP is a good thing, but for a medium-sized company, I’ve found tying VPN access to AD Authentication (using IAS) is not a bad alternative (especially if you’re using best security practices and least user access).

So, let’s say you are okay with the lack of Cisco VPN support and you’re young, so you love purely web-based GUI interfaces (This is you if you’ve ever thought “Command line… what is this, 1985?”).  What other issues would you run into?  Well, for one, the SA 500 doesn’t allow you to activate support for QuickVPN unless you’re on a 10.x.x.x network.  So, you know, you would have to redo your entire corporate IP scheme.  If that isn’t doing it for you, keep in mind that there is a big difference between Cisco VPN and Linksys/Cisco QuickVPN:

The SA 500 still looking that great to you?  Remember that since there is no CLI, you’ll be unable to simply copy the config from your old Cisco Switch over to your new model, so there will be considerable downtime.  This will be far from seamless and, I would expect, cause massive amounts of user headache.

So, if you’re going to be buying a new Cisco device, and your company has more than 10 – 20 users… do everyone a favor and purchase a Cisco ASA 5505, everyone will thank you.  Now then, I need to get back to trying to hammer this square peg into this round hole here.

Today I saw a tweet from @DellServerGeek about a new technology that Intel has developed in partnership with RealVNC for the new Intel vPro 2010 series chips.  This amazing technology will allow IT Support to be able to connect to a machine, even when the machine can’t boot and resolve the users issue without the need for a technician to be sent out on site.  This KVM over IP technology has been around for some time in the server realm with DRAC cards from Dell or Lights-out boards from HP but I believe this is the first time it has been tried on Desktop/Laptop machines.

This new technology will not only allow the remote technician to take control of the machine but also will give the technician the option to turn the machine on or off remotely as well as rebooting the machine when it does not respond to keyboard or mouse gestures.  You can also use the IDE Redirection option to remotely boot to a cd or image.

Check out the RealVNC site for videos and more detailed information!

There seems to be two schools of throught about all of this.

1. Lock the user out of everything that would prevent malware from being installed or the user installing software they’re not suppose to, at the expense of user frustration and IT time spent approving and installing software requested by users.
   Basically, the users are stupid and cannot be trusted. IT will have to monitor them.
2. Give the user access to everything and let them install whatever they want, at the expense of user frustration and IT time spent removing software they’re not suppose to have and malware that have been installed as a result.
   Basically, trust the users and clean up after their messes when they don’t understand what they’re doing.

In an educational setting, specifically in higher education, you have a lot of competing interests. You’re a business, selling a product (education) and have to compete with other businesses (schools) to gain more customers (students) — therefore, security like what you’d have at any enterprise is necessary. However, you have a group of highly educated and often times very ego-centric individuals called faculty that feel they have a right to gain access to anything and everything in order for them to independently do their job without interruption from IT, or having to ask them for assistance. I would imagine it’s something like working with engineers, but in this case 95% of the people have no idea how to use a computer. Last but not least, the university is an ISP, providing Internet access to students and employees on their personal machines. But that’s a topic for a future entry.

The idea that users need administrative access to their computer or that they somehow have a right to it is wrong in my opinion. When I go into my office, I have services provided to me by other departments on campus that I do not have full control over. If I need a light bulb replaced in my office, do I have a key to go do it myself or do I just call Physical Plant and have them come over? Sure it’d be faster and probably easier for plant to just go take care of it myself. Just because you can give someone full access to a machine, and they’re used to it at home, doesn’t mean they should have that access at work.

I have full access to the thermostat at home (well, I take that back… my wife does… I’m just a user there too) but I can’t just go adjusting the HVAC system at work how I want.

We make as much software as possible that we’ve pre approved user-installable through Group Policy Software Deployment and soon though System Center once we have that up and running. Our staff maintains a repository of approved software installs that require us to do it, so when the user cannot do it themselves it only takes us a few minutes. If a user walks up to our support center, we can usually get the software installed on their laptop right away. We’ve given our Help Desk very easy to use remote access software and can usually get stuff installed for them within 24 hours, if not as soon as they call in or email.

Does malware still get installed on systems where users lack administrative access? Yes. Which brings me to another point.

You also need to look at the amount of damage that can be done in the time period where a user with administrative access disables anti-virus to install something, or even where the AV client doesn’t detect it and the user isn’t aware enough to see what has happened. A few years ago, the malware was about annoying the user or deleting files, but as it has changed to becoming a security breach where data can be stolen often without the user even seeing they’ve been infected.

My wife works for a multinational accounting services firm, where she and her co-workers have access to information that would probably make any hacker wet their pants with excitement. Yet, they have administrative access to their company issued laptops, since they spend most of their time outside of the corporate office. In one case, she told me where one of her co-workers went weeks with a system she knew was infected with porn-popups, yet was “too busy” to do anything about it, like take it into the office and let IT look at the system. Did she know better? Despite required company IT education and training, probably not. Did my wife? You betcha.

That infection may have been harmless, or just designed to generate traffic to your friendly neighborhood porn site, but would the next one be so lucky? Sure, you may put good AV on systems and monitor them daily, but they can’t catch everything. It seems like we should be fighting to do everything in our power to prevent this from happening, even if it means it’s more difficult for the user and IT. The risk of not doing so outweighs the easy of use.

Do your users have administrative rights? Why or why not?

I got an early Christmas present in July when someone pointed me to this blog post on Google Apps blog.  FINALLY they have setup a work around for the “on behalf of” problem.  I immediately started to go through in my head how this was all going to work.  I did a Google Search on setting up Google Apps to see what other users were doing and I found an article about a completely different approach to managing emails.  Users are setting up a domain on Google Apps and setting their main email as the catchall for the domain.  Brilliant!  Now, when I sign up on a website I use thewebsitename@mydomainname.com and can have my filters automatically tag the emails coming in.  Also, if the website sells my information or gets hacked and I start getting spam I can blackhole the email account and decrease the amount of spam I receive on a daily basis to almost nothing.

Catchalls have been around for sometime and I am surprised over time other users haven’t figured out the benefits of using a catchall email account with a domain like I have setup in this situation.  This is a great setup for any user or a small business who wants to look like more than a one man shop.

I have previously used the Startech KVM over IP product as well as one of their switched PDU’s and I was not impressed.  The pricing fit into our budget but I didn’t want to buy crappy equipment jut because it fit into our price range.  After looking through the CDW website I found a solution from Aten that I liked so I contacted my CDW rep to schedule a demo.  He also said I should look at a Belkin solution and a Avocent solution all within the budget.

In the mean time Belkin had a demo available on their web site.  I signed up for the demo and it worked pretty well but I was hoping for a more robust solution so I waited for the Aten demo to be setup.

The Aten demo started off like most demos, with a power point presentation written word by word by a sales representative.   The technician that was supposed to be joining the call was running late and after the sales rep. finished his power point, he hunted down the technician and got him on the phone.  The technician shared their screen and logged into one of their units.  He jumped around a lot and the connection between him and the KVM device was severed twice during the 20 minute demo.  He claimed it was network issues at his local site and nothing to do with the Aten equipment.

After the warm and fuzzy feeling disappeared after seeing the bad Aten demo I asked my CDW rep to get a representative from Avocent on the phone.  We scheduled a demo with Avocent and everything went very well.  I was very impressed with their product and everything worked the way it should.

I figured I would end this post with a little bit of advice to any sales representatives reading this.  If someone asks for a demo of your product this is your chance to close the deal.  Make sure everyone is on time, you don’t just read directly from a power point AND when it comes time to show your product it actually works.  I would say if you could only choose one of these points to excel at… the last one is the most important.

I own an IT consulting firm, and as you can imagine, that means that I am not always in the office, and don’t always have connectivity available. With my BlackBerry, it was as simple as loading the Sprint SmartView software on my laptop (similar applications are provided by most carriers) and using my BlackBerry’s data connection. However, SmartView doesn’t work with the Samsung Moment, and Sprint has made the (poor) decision to do away with tethering or “Phone-As-Modem” options on their Simply Everything plans which are required plans for their smartphones. I speculate that their reason for doing away with tethering is an effort to drive customers to the increasing number of mobile broadband devices that they carry, including the new Novatel MiFi 2200 router, but I’ll save that gripe for another post.

So it seems that all is lost, I can no longer tether my phone to my laptop to use the data connection, and that’s a deal breaker. Weighing my options, door number one, I stay with BlackBerry and keep on trucking, but that’s not going to be a long term solution as Sprint will eventually drop tethering from my account. Door number two, I buy another device with another data plan, and I’m good to go. But why? Why should I have to fork out the money for another device, have something else to carry around, power, charge, and pay a monthly fee to use when I have a perfectly capable connection hanging on my belt, that I’ve been using for over a year, especially when I know full well that the only reason Sprint is making this change is to try to dig deeper into the pockets of smartphone carrying business professionals. Sprint, I’m still not against you, but I found door number three and I’m taking it (yes, it’s a line from National treasure).

One of the great things about the Android platform is the Android Market and the incredible amount of software that is available, more often than not, for free. One of these applications is June Fabrics PdaNet, a tethering application that is available for several platforms, including Android. Setup is painless on both the phone and the PC, but useage is a little different than what I was used to. The most noticeable difference, which I’ve already hinted at, is that you actually install PdaNet on both the phone and the PC that you wish to use it with. Once installed on both, you connect the phone to the PC via USB or bluetooth (Android 2.0 required for bluetooth tethering on the Android platform), launch the application on your phone and enable your connection method, right click the PdaNet tray icon on your PC, and select Connect.

That’s it, you are now using your phone’s data connection on your PC. PdaNet is one of the many applications available on the Android Market that provides a paid version and a “lite” or free version. The paid version gives you full use of your data connection, while the free version restricts you to http web access only. If you’re on the go as much as I am, you’re going to want the full version. The good news is that it’s cheap, $29.00 one time. I was paying an extra $15 a month for tethering when Sprint offered it.

This was one of the most crucial obstacles to overcome in order for me to be able to transition to the Android platform as a mobile business professional. Next time I’ll discuss some of the other applications and tools that I have found to make Android the platform for business now and in the near future.

First, let me say that I had not been looking to leave the BlackBerry/Exchange family, but I was holding out for a full screen BlackBerry with a physical keyboard, a slider if you will. Those of you who follow mobile devices closely, especially those who follow BlackBerry hardware, are well aware of the numerous design concept drawings, mock-ups, etc. of a BlackBerry slider that have been floating around for at least a year. Never revealing just exactly when we would see such a device, RIM has only been willing to confirm that several design options have been considered. This secrecy is nothing unusual among device manufacturers, but the lack of information and an opportunity provided by a competitor presents a precarious position, and, in this case, caused a long time RIM fan to jump ship.

One of my fellow TechVirtuoso staffers, Eric Iles, made the move to the Palm Pre when it first came out earlier this year. He had several problems with the device that caused him to go through a few of the phones before getting one that seemed to work without issues. Even though Eric finally worked through the issues he was having with the phone and seemed to finally have a working unit, he still wasn’t happy with the device, or the lack of applications available. Eric ended up switching to the HTC Hero, Sprint’s first offering on Google’s Android platform. I visited the local Sprint store several times and played around with the Hero. I really liked the look and feel of Android, and HTC’s custom Sense UI is very aesthetically appealing. The only thing I couldn’t get used to, and it turned out to be a deal breaker for me, no physical keyboard. This wasn’t a huge surprise for me. I have never liked typing on any touchscreen phone. My daughter has a Samsung Instinct, I hate it. I’ve used friends iPhones, hate them too. I have big fingers, and no matter how much I “train” the phones, I always seem to spend more time hitting backspace than I want. So, the HTC Hero was a no go for me. Then along came Polly, err… Moment.

Having told Eric that I couldn’t get used to the on screen keyboard, he directed me to a Sprint press release announcing the Samsung Moment, a slider Android based phone, that was due out on November 1st. Monday, November 2nd, I was at the Sprint store. Having gotten my hands on the HTC Hero several times, and having read as much online as I could, I was somewhat familiar with the overall functions of the Android OS. I was more interested in how the Samsung Moment felt, how the keyboard worked, and whether or not I would be able to type on it reliably. I spent about 20 minutes looking over the Moment, and decided to make the jump, and just to make sure I saw it through and wouldn’t have a crutch to fall back on, I let Sprint buyback my BlackBerry Curve. I was going Android.

Once the transactions were complete, the new phone configured, my next concern was getting my e-mail, calendar, contacts, etc. setup on my new phone. I ran my own Exchange server and my own BlackBerry Enterprise Server, and was considering setting up ActiveSync and just moving forward. Once again, Eric offered up a suggestion, that I should take a look at Google Apps, and moving my e-mail and letting Google host it. Our TechVirtuoso e-mail is Google hosted, as was our e-mail at our previous venture, and we’ve had nothing but positive results with it. After I thought about it for a day or two, I thought, why not. It takes the responsibility off of me, it will simplify the unison of data between my devices, and if I don’t like it, it’s easy enough to switch it back. Back, don’t think that’s a direction I’ll be taking.

Signing up for Google Apps Standard (free) Edition is simple, and in doing so, provides the opportunity to try Google Apps Premier free for 30 days. This is key, because Google Apps Premier gives you access to Google’s migration tools which provide you with easy solutions for migrating your existing data from another server, such as a Microsoft Exchange Server. So, I signed up for my Google Apps Standard account and registered for the free 30 day trial of Google Apps Premier, setup the Exchange migration to pull my existing contacts, calendar, e-mail, etc. from my Microsoft Exchange Server, and let it run overnight. The next morning the transfer was complete, and I canceled my 30 day trial of Google Apps Premier, reverting my account to Google Apps Standard. I now have all of my mail, contacts, calendar, etc. transferred over to my new Google hosted e-mail service, it’s automatically synchronized on my phone, my laptop, any PC for that matter, as I just log into my account via the web and there it is, wherever I am.

This is where I start experimenting with the Android platform, and finding out for myself just how useful and business friendly it is. I’ll save those thoughts for my next post, so stay tuned!