For real-time updates and insights relevant to SBS and EBS check out VARvid.com. Partner Aaron Booker of the Hardlines Company is posting a steady stream of video interviews from the conference with attendees and MSFT folks, such as this one with Steve VanRoekel about the Essential Servers, or this one with Baldwin Ng about the new Microsoft Assessment and Planning Toolkit.

The post SBS and EBS @ WPC appeared first on Microsoft Windows Server Blog.

So the advisory today is not a security bulletin – there are no patches for IIS or SQL Server or ASP.NET to download. However, we are making available some tools that can help mitigate these attacks while the underlying Web application code is being fixed to follow security best practices for protecting against SQL injection in ASP and ASP.NET. There is a tool from HP that tests sites to help identify pages that might be susceptible to SQL injection attacks, and also a Microsoft Source Code Analyzer from our SQL Server team that actually parses ASP code for data access commands that might be vulnerable to SQL injection.

But the one that I’m most excited about is UrlScan 3.0 Beta. As you may remember, UrlScan originally released with the IIS Lockdown Tool to help mitigate security vulnerabilities that affected IIS 5.0 in Windows 2000 Server. It’s an ISAPI filter that examines HTTP requests to check that URLs and other headers are not being padded with overlong strings or unusual characters as a way to conduct a buffer overflow attack. We haven’t updated this tool since we released UrlScan Version 2.5 alongside IIS 6.0, because most of the functionality is now available in IIS 7.0 as the Request Filtering module. But as of today, you can download 32-bit and 64-bit versions of UrlScan 3.0 Beta, which extends the functionality to also examine the querystring part of the URL (i.e. the part that comes after a “?” in a URL – typically name/value pairs or other parameters that are passed to a script or application). This can therefore help prevent SQL injection attacks while the underlying Web application code is fixed.

Over on the IIS.net site, you can find a full walkthrough of the tool, as well as some great articles by Wade Hilmo (the guy who wrote UrlScan) and Nazim Lala, another member of our IIS security team. They have full details on the tool and other security guidance you can follow to help protect your Web servers and applications.

The post UrlScan 3.0 Beta and Tools to Help Mitigate SQL Injection Attacks appeared first on Microsoft Windows Server Blog.

So what’s new?  First, where the old MOF talked mainly about operations, the new MOF 4.0 describes the entire IT life cycle, including business planning, project organization can use a common language and a consistent framework for planning and coordinating their activities.

The second improvement is to the design of the content.  If you’re looking for a way to overhaul your organizations service management practices, then MOF 4.0 provides that comprehensive view that will help you choose where to start.  However, if you’re just looking for a best practice around one particular area then MOF 4.0 can help as well, with short (25-page) “service management functions” that can give you ideas on improving a particular function in 20 minutes.

The post Microsoft Operations Framework (MOF) 4.0 Available appeared first on Microsoft Windows Server Blog.

Patrick

The post GUI config utility for server core appeared first on Microsoft Windows Server Blog.

The post Windows Server 2008 – RTM!!! appeared first on Microsoft Windows Server Blog.

The post HHH Comic Site Goes Live Today! appeared first on Microsoft Windows Server Blog.

The post Lone Server: Now I Know Who Is To Blame appeared first on Microsoft Windows Server Blog.

Microsoft has conducted a tremendous amount of research on how IT is done in mid-sized businesses (usually 75-250 PCs.)  We visited hundreds of customers, brought them to Redmond, did focus groups, established customer and partner advisory boards, and more.  We got great, detailed input on how this product can help our mid-market customers simplify processes, improve reliability and generally shift their role from “reactive firefighter” to a more strategic, proactive asset to the business.  Some members of our technology adopter program comment in today’s story in eWeek here.

Essential Business Server combines Windows Server 2008, Exchange Server 2007, System Center Essentials, Forefront Security for Exchange, the next version of ISA and SQL Server 2008 (in Premium Edition) into an “all-in-one” solution.  But the product is truly more than the sum of its parts and delivers new technology above and beyond the component products.  Essential Business Server provides a single point of management for all of the components and workloads, as well as third party software applications, and incorporates an incredible amount of best practices.  We estimate set up will require 75% fewer steps than what is required today, for example. In addition, it has a single server license and a single client access license, as well as features to help IT track, manage and re-assign licenses.

Microsoft hardware partners that are already planning to support Essential Business Server include Fujitsu Siemens, HP, IBM and Intel.  Software partners already developing or planning on creating “Add-Ins” for the Essential Business Server console include CA, Citrix, FullArmor, McAfee, Quest, Symantec and Trend Micro.  Microsoft applications will add-in, too, of course.

We’ll be demonstrating Windows Essential Business Server at TechEd:  IT Forum next week in Barcelona.  The product is targeted to ship in the second half of 2008.

Joel Sider

The post “Centro” = Windows Essential Business Server appeared first on Microsoft Windows Server Blog.

Other than the folks over at Brian Madden, not too many people blogging from Citrix iForum. That ashame because there’s alot of good content on app delivery and Citrix’s plans to virtualize desktops (i.e., VDI) and datacenters (i.e., Xen). I’ll post some photos from this morning’s keynote later today. But it was the first time I’ve seen Peter Levine (former CEO of XenSource, now GM of Citrix’s virtualization group) speak. His big message was “10 minutes to Xen” and showed a couple slick demos of XenMotion and XenCenter. He also referenced the hypercall API news that Mike Neil announced on stage just prior to Peter speaking.

As for the booth, traffic was decent yesterday (photo below). We’re demoing Vista Enterprise Centralized Desktop, Windows Server 2008 terminal services (aka, presentation virtualization), SoftGrid, SCVMM and Viridian. The top questions were:

• Do I still need Citrix if I deploy TS in Windows Server 2008? Answer: depends on your situation, but yes for many scenarios. If you use Citrix today, you’ll likely keep doing so.
• What’s the difference between MS SoftGrid and client-side Citrix Presentation Server? Answer: lots of similarities in that they both offer application virtualization and streaming. SoftGrid is fully integrated into System Center (management tools), uses group policy/AD to provision apps to the user, and supports disconnected/mobile users. In the end, you’ll want to kick the tires of both. Note that SoftGrid is available via MS desktop optimization pack (MDOP) for Software Assurance.
• What’s the status of work with XenSource on Viridian? Answer: The interop work is progressing well, as is similar work with Novell. I’d imagine seeing fruits of these labors at upcoming release milestones. FYI – this question is in reference to our July 2006 announcement.

Patrick

The post From Citrix iForum: Hypercall API open season appeared first on Microsoft Windows Server Blog.

A colleague, Dan Reger, pointed me to a new IDC white paper on Windows Server x64 adoption. The white paper is titled, “Understanding the Business Benefits Associated with x86 64-Bit Windows Server.”

The paper explains both the value of pairing x64 editions of Windows Server with today’s widespread x64 server hardware and how Windows Server 2008 will mark the inflection point for the transition to 64-bit computing.  The whitepaper includes several customer case studies and ROI analysis, illustrating that customers can recoup investment in their x64 transition within 6 months. And remember, Windows Server 2008 is scheduled to be the last 32-bit Windows server OS.

Virtually all new x86 hardware servers shipping today are 64-bit capable, yet most people are currently choosing to limit those systems with 32-bit operating systems and software.  As IDC says, “One of the biggest missed opportunities among today’s customer base may be the lack of use of 64-bit x86 Windows Server solutions to boost performance, scale, and utilization rates.”

There are variety of benefits, and few barriers, to going 64-bit.

Deployments requiring scalability – such as large scale virtualization – will benefit from x64 system’s direct access to more RAM.  However, there’s no need to deploy 2 TB of RAM to benefit from x64 – the larger virtual address space relieves kernel memory pressures as well (e.g. no more 128 MB limits on paged pool and non-paged pool).

Deploying a 32-bit solution on a 64-bit platform represents a lost opportunity to benefit from the scalability – and reduced costs – associated with a 64-bit solution.  However, customers who need to preserve existing 32-bit applications can do so – maintaining high-performance while experiencing benefits from their x64 hardware and operating system.  WOW64 provides a 32-bit environment for such applications, and x64 processors maintain high performance by allowing such applications to run without emulation.

And since new servers are already 64-bit capable, there’s little or no marginal cost associated with deploying a 64-bit solution.  Windows Server licenses provide the capability to run either the x86 32-bit or x64 editions – no marginal cost there, either.  The paper illustrates that customers can save roughly 20% in IT infrastructure and operations costs by moving to x64.

It’s true that drivers on 64-bit Windows Server systems – and applications with kernel drivers – must be 64-bit.  However, after more than two years of x64 Windows Server availability, the release of x64 editions of SQL Server 2005, Office SharePoint Server 2007, BizTalk Server 2006, Commerce Server 2007, Windows CCS, plus Exchange Server 2007’s release as an x64-only solution, the 64-bit server ecosystem is ready for prime time.

The paper is a good read, and makes persuasive arguments to actively plan your server environment’s transition to 64-bit.  Give it a look.  After all, “IDC believes that customers deploying new Windows Servers today should carefully consider the benefits and relatively nondisruptive experience that 64-bit Windows deployments can offer.”

Patrick

The post IDC publishes whitepaper on x64 Windows Server adoption appeared first on Microsoft Windows Server Blog.