FISG - Florida IT Server Group

Using Network Access Protection

2012-01-25T10:21:00.000-08:00

Network Access Protection (NAP) has become the standard when protecting your environment. It is not just a policy to restrict infected computers from the network. But a policy to encourage computers to comply with security and health requirement policies and reduce the risk of malware spreading. Non-compliant clients can be restricted from accessing intranet resources or communicating with compliant computers. Using Network Access Protection (NAP), IT administrators can require client computers to be healthy and comply with corporate health requirement policies. For example, client computers can obtain a full connection to the intranet only if they have recent security updates, anti-malware definitions, and other security settings.

Using NAP requires that NAP-enabled clients submit a health certificate for authentication when creating the initial connection with the Network Policy server. The health certificate contains the computer’s identity and proof of system health compliance. A NAP-enabled client obtains a health certificate by submitting its health state information, either to a Health Registration Authority (HRA) that is located on the Internet, or to an internal HRA server accessible using the infrastructure tunnel.

By using NAP, a non-compliant client computer that becomes infected with malware can still connect to all the specified management servers (for example, DNS, DC, HRA, and remediation servers) through the infrastructure tunnel, but it cannot connect to all other intranet resources. Access to the remediation servers is crucial to remediate the non-compliant state of the client.

How Windows Server 8 can help with compliance

2012-01-11T04:51:00.000-08:00

Windows Server 8 is going to be here before we know it. Microsoft is touting tons of new features and benefits with Hyper-V,continuous availability, PowerShell and so on. Regardless of which side of the upgrade or wait-and-see equation you’re on, the next-generation server OS will no doubt show up in your enterprise eventually. This begs the question: have you stepped back to think about how Windows Server 8 can help your business with compliance and overall information risk management? Based on what I’m seeing, it will certainly help in this regard.

Some noteworthy compliance-related improvements in Server 8 include Hyper-V enhancements around scalability, virtual networking and multi-tenancy including performing multiple live migrations of virtual machines to new hosts. These will be good for business continuity, more granular network segmentation within Hyper-V itself and improved security configuration standardization.

Windows Server 8 also has built-in disk de-duplication which can help with your information classification and retention policies and even reduce compliance and other legal liabilities by helping you better manage – and secure – unstructured information. There’s even an improved chkdsk for disk repairs that runs much more quickly and efficiently.

Perhaps the visibility of a new server OS and the ability to start with a clean slate will prompt network administrators to take advantage of the often-overlooked benefits and capabilities of Windows Server 2008. This is a big compliance gap that many businesses have trouble getting their arms around.

It’s not all rosy with Windows Server 8, however. One concern that stands out to me is regarding the new Metro application model. Arguably not as critical as it will be on workstations where much of the development and execution of business applications is done but the fact is that new types of applications can introduce system complexities that may complicate compliance and security. In addition to traditional Win32, .NET and related applications, we’ll now have a presumably wider attack footprint with new Metro applications based on the WinRT APIs.

Another compliance-related concern is multi-server patching and continuous availability in Windows Server 8 via workflow scripting in PowerShell. When I think of PowerShell, I think of long, convoluted commands that only serve to create further complexities which, frankly, the average network admin can’t afford to take on. Microsoft is attempting to fix that by making PowerShell more streamlined and useful. We’ll see.

Finally, all of Microsoft’s touting of cloud services makes me a little nervous. My concern is that businesses – especially those on the smaller end who don’t have much (if any) in-house expertise – are going to prematurely jump on the cloud bandwagon without asking the tough questions and thinking through all of the cloud’s compliance and security issues.

I do believe that Microsoft has our best interests in mind with Windows Server 8. Incremental improvements in compliance and security are welcome. In fact, in the grand scheme of things, incremental improvements should be our main goal with all things related to managing information risks.

Kevin Beaver, Contributor

Some New Features of a Windows 8 Environment

2012-01-05T07:22:00.000-08:00

We took alittle time in lab to identify some of the new features that are included inthe Developer Preview of Windows Server. So we configured a small lab detailedbelow in Figure 1.

Figure 1

This earlyrelease of the new Windows Server looks to be promising. The quick of ease ofconfiguration and navigation was instantly recognized even to our new added IT Professionals.The Server Manager has been outfitted with a new dashboard as show in Figure 2.

Figure 2

ServerManager is where Network Administrators will be spending most of their timewhen installing, configuring and evaluating a network. So what’s new in ServerManager and why the big hype? For starters you can perform tasks on multipleservers at one time, deploy roles and features remotely, get current status ofyour servers and roles and add remote servers and create custom server groups.Giving an Admin more control over the environment that they are managing.

Adding arole in the Developers Preview of Server can be easily navigated even if youhave never used Server 2008 or Server 2008 R2 before. There is now a pool thatidentifies the servers on your networks that you have added. As you can see inFigure 3 we have only our PDC ready to go so far.

Figure 3

The same listsof roles are readily available with the Volume Activation Service and RemoteDesktop Services newly added. Figure 4 shows an outline of available roles toinstall in this release.

Figure 4

The featuresthat are now available are numerous and too many to mention. Seeing isbelieving and pictures are worth more than a thousand words. Figure 5 and 6shows the complete list of features.

Figure 5

Figure 6

Theinstallation and straight forward and once completed the role that has beeninstalled needs to be configured. The ease of the navigation we just could notget over. The walkthrough is so easy that a newbie to Active Directory DomainServices. We are still eager to know what functionality does the Windows Server8 functional level bring and will keep you posted. The best practices analyzer(BPA) has been added to the role installation wizard. The job of this tool isto verify that all necessary and required components are met before the rolegoes on to be installed. If this feature is kept in the final version it willprove to be a valuable asset to ensure that roles are setup and configured correctly.Figure 7 shows the prerequisite check for the install for Active Directory.

Figure 7

Installing arole from any server to any server is indeed a new nice feature. Given theServer Core installations in a branch office. The addition and removal of rolescan be done once the servers of choice have been added to the server managergroup. This feature will indeed prove to be very helpful when managingdifferent boxes. At the time of this review only Windows Developer computerswere able to utilize this feature. Server 2008 R2 and below cannot. I am hopingthat they add it to final version. Figure 8-11 shows DC1 preparing MEM1 forrole install and completion.

Figure 8

Figure 9

Figure 10

Figure 11

As seen inFigure 11. The post installation of a role can be done from the remotecomputer. And Figure 12 shows the final result on Mem1 with DHCP and NPS readyto go.

Figure 12

So far wecan expect some great new features to make our admin job a little lessstressful and more productive. Be sure to be on the lookout for Window ServerDeveloper Preview NAP enforcement of a Windows 8 client.

By Adnan Cartwright

Florida IT Server Group

Processors: What to Expect From CPUs in 2012

2011-12-27T20:45:00.000-08:00

What does the future hold for processors? We expect more speed and less power consumption, lurking behind unassuming code names such as Ivy Bridge, Piledriver, and Tegra 3.

As the brains of most every modern computing gadget, the central processing unit or CPU is an indispensable part of every desktop, laptop, phone, or tablet. The processor crunches the numbers and assigns the tasks, and it's one of the chief pieces of hardware that determine how thick your laptop is or how long your phone’s battery will last.

Every year, these slabs of silicon get smaller, stronger, and more energy-efficient. That’s good news for gadget mavens, as devices become faster, lighter, and generally more impressive as a result. Next year will be no exception. In this article, I’ll look at what’s expected from Intel, AMD, and Nvidia. It’s a bit too soon to tell how things will shake out--expect big announcements from the CES tech trade show in January--but I’ll try to fill in some of the blanks.

Crossing the Sandy Bridge

In the desktop and laptop markets, there are two major players: Intel and AMD. Of the two, Intel has gained more traction this year, bringing a number of powerful, popular components to market--with the promise of much more to come in the next year.
Intel operates on what it calls a “tick-tock” cycle. With every "tick," Intel introduces a new manufacturing process. In 2010, Intel’s “Clarkdale” desktop processors reduced the company’s Nehalem microarchitecture to 32 nanometers, delivering improved performance and energy savings. With every "tock," Intel introduces a new microarchitecture. In 2011, we got Sandy Bridge CPUs, which deliver superior performance to their Clarkdale predecessors while cutting power costs and improving the integrated graphics performance.
We’ll see the next “tick” in 2012, when Intel shrinks the Sandy Bridge microarchitecture down to the 22-nanometer process. The resulting new CPUs, code-named Ivy Bridge, promise even better power savings and performance, much as the last two processor generations did.

Smaller Is Better

Most of the information we have about Ivy Bridge comes from the Intel Developer’s Forum held earlier this year, plus the occasional leaked PowerPoint presentation. Of primary importance is Intel’s die shrink, which moves from the 32-nanometer process to the 22-nanometer process. Switching to a smaller die size allows processor manufacturers to create chips that draw less energy.
Earlier this year Intel unveiled the 3D “tri-gate” transistor technology that it has implemented to make the transition to the 22-nanometer process. The new transistors are smaller, faster, and more power-efficient, and will be key to the performance gains that Intel claims we’ll see with Ivy Bridge.
But what does all of that mean for you? Simple: An Ivy Bridge CPU will supply performance similar to that of a Sandy Bridge CPU while consuming less power, and it will offer greater performance while consuming the same amount of power. That means you'll see laptops that provide better battery life without sacrificing speed, as well as faster desktops that are easier on your utility budget.

Under the Hood

Intel's Desktop Platform RoadmapIntel has offered no confirmation of what the Ivy Bridge lineup will look like, but leaked reports obtained by Xbit Labs give some information on the new processor line’s naming convention, as well as its CPU frequencies. The new CPUs will purportedly follow the standard naming convention for Intel’s Core processors, falling into the 3000 series (Sandy Bridge was the 2000 series).
A refresher: Traditionally Intel divides the Core platform into three segments--Core i3 at the low end, Core i5 for the midrange, and Core i7 at the high end. Following that designation is a model number. You may also see a suffix at the end of the model number: K for unlocked processors, S for “performance-optimized” processors, or T for “power-optimized” processors. The S and T variants are generally for OEM use only--expect to see them in desktops and laptops on retail shelves. An unlocked, higher-end Ivy Bridge CPU, for example, could be named the Intel Core i7-3770K.
We also know that Ivy Bridge will be compatible with the LGA 1155 socket--great news for Sandy Bridge owners, who may not need to buy an entirely new motherboard to upgrade. And if you just dropped a few hundred dollars on Intel’s Sandy Bridge Extreme Edition processor, don’t worry: When I met with Intel representatives, they told me that Ivy Bridge Extreme Edition will use the LGA 2011 socket, so you too have a clear upgrade path.
Other notable enhancements include an upgraded graphics core built into the CPU, allowing DirectX 11 support with Intel’s integrated graphics. We don't have many concrete details yet, but with every microarchitecture iteration we’ve seen, Intel’s integrated graphics improve. Ivy Bridge CPUs will also bring native support for USB 3.0 and Thunderbolt, which we hope will mean greater adoption of those connectivity technologies across desktops and laptops of all makes and models.
We've heard no word on when Ivy Bridge CPUs and products equipped with them will arrive, but you can expect to see them sometime around the second quarter of 2012. We’ll certainly know more in January, once Intel releases a few more details at CES.

Beyond Bulldozer

Now, what about AMD? The budget-minded processor manufacturer is focused on its Fusion APUs (Accelerated Processing Units), which combine CPUs and GPUs onto a single piece of silicon. AMD has its work cut out for it over the next year, however.
In October, AMD pulled the curtain back on its long-awaited Bulldozer architecture. Unfortunately, Bulldozer had a rather disappointing launch, and my own testing showed that the best chip technology that AMD could muster failed to outdo Intel’s midrange offerings.
The company will follow up the Bulldozer microarchitecture with Piledriver, an enhanced variant of the Bulldozer core. Actual details are slim, and code names for individual desktop and laptop lines abound, but we do know that AMD will be looking to boost the performance per watt and will be baking in stronger GPU cores. Piledriver is still expected to be a 32-nanometer architecture, which puts AMD at something of a disadvantage in light of Intel’s 22-nanometer Ivy Bridge.
We aren’t expecting to see Piledriver until sometime around the middle of 2012. Bulldozer arrived only a few months ago, after all. Once again, expect more news from the AMD camp around the CES time frame (CES starts the week of January 8).

Bite-Size CPUs

I’d be remiss to discuss processors without touching on the mobile market. Tablets and smartphones are the gadgets du jour, and although consumers might be a bit more concerned about aesthetics and apps than about their portable bauble’s innards, quite a bit of power is at play inside.
It seems like only yesterday we were wondering what to do with more than two cores in our cellular phones. In 2012, quad-core processors will rule the day, with chip manufacturers such as Nvidia and Qualcomm leading the charge.

Nvidia Tegra 2Nvidia’s Tegra 3 is one of the first quad-core mobile CPUs to come to market, and the latest in Nvidia’s Tegra system-on-a-chip line. The system consists of an ARM Cortex A9 CPU with an integrated 12-core GeForce GPU to power the graphics. Expect a deluge of Android tablets to use these chips, as device manufacturers pile on the features in a never-ending arms race.

Qualcomm will be introducing quad-core Snapdragon S4 chips in time for the 2012 holiday season. These chips will support tablets running Windows 8. The S4 will be built on the 28-nanometer process, down from the 45-nanometer process that Qualcomm used on the current-generation S3 chips. Expect improved performance and reduced power consumption.

By Nate Ralph, PCWorld

PowerShell v3 has some great GUI

2011-12-21T14:23:00.000-08:00

When you look at a command-line window – all text, a flashing cursor, and no toolbar or ribbon of any kind – you don’t think that it is a “graphical user interface (GUI).”That’s certainly the case with Windows PowerShell v3, which first shipped with the Windows 8 Developer Preview and which is now available as a Community Technology Preview(part of Windows Management Framework 3.0) that installs on Windows 7. But the real beauty of PowerShellis the fact that, under the hood, it’s neither GUI nor command-line interface (CLI). It’s a little bit of both – and v3 proves it.

A little bit of helpPerhaps you’re a bit confused on how to use the Get-WmiObject cmdlet. Asking for Help Get-WmiObject provides the dense information shown in Figure 1 – which might or might not be helpful, depending on whether or not you can uncross your eyes and make sense of it all.

Figure 1: Help Get-WmiObject

But run Show-Command Get-WmiObject and a new, GUI-based prompt appears. Each parameter set is broken out onto its own tab, and each parameter is broken out onto its own line. Required parameters have a simple "*" next to their names, and switches are displayed as checkboxes. Easy. When you’re done, you can either run the command or copy it to the clipboard, making it easier to paste it somewhere else and incorporate other commands. Figure 2 shows what it looks like.

Figure 2: Show-Command Get-WmiObject

Fancy outputPowerShell v3 still includes the handy Out-GridView cmdlet (figure 3), which accepts the output from other cmdlets and constructs a GUI-style table. With clickable column headers for sorting, and with the ability to dynamically filter what’s shown using the built-in “Add criteria” button, this grid view will be all the GUI you need for displaying many different types of output.

Figure 3: Out-GridView cmdlet

Better editingThe PowerShell team has made its biggest GUI investments in the new PowerShell Integrated Scripting Environment (figure 4). Finally, we’ve got the pop-up “IntelliSense” code-completion and hinting features we’ve always wanted. The system even shows a brief version of a cmdlet’s help, reminding you what it does and how it’s used.

Figure 4: Integrated scripting environment

A Commands browser on the right-hand side provides a complete list of every command loaded into the shell, and can be filtered to just include the commands from a particular add-in module like Active Directory. Given that the toughest part about a command-line environment is figuring out what commands you have to work with, this new browser should make it a lot easier to discover and use commands.

Welcome to the WebBut wait: there’s still more GUI to be had in v3, and this time it’s of the Web variety. The new PowerShell Web Access interface is an optional feature that’s installed on a server (Internet Information Services is a pre-requisite for this feature). Once configured, you’ll get a complete Web-based command-line window that’s even pretty usable on a small device like an iPhone. Punch commands into a textbox near the bottom of the screen, hit Enter, and the command executes – with the output displayed in a scrollable, CLI-like window that occupies most of the screen.
I imagine that PowerShell Web Access (PWA) will be installed on a “bridgehead” server within the data center. Since it supports multiple simultaneous connections, any number of administrators could use it to remotely access data center resources, run scripts, execute commands, and otherwise get their jobs done. PWA even supports tab completion, helping to complete cmdlet and parameter names as you type – which is especially welcome when you’re trying to hammer out a long one-liner on your Android phone’s tiny keyboard! You even get a command history, just like you were using the normal PowerShell console.

PWA supports all of the usual IIS authentication mechanisms – digest, basic, integrated, and so forth – and can of course be secured by means of an HTTPS connection, so it looks like it could become a really useful, secure means of giving administrators low-level access to the environment.

It’s a CLI! It’s a GUI! It’s a floor wax!Okay, maybe it won’t shine your floors, but PowerShell v3 is certainly starting to break down the traditional model of a command-line shell. With GUI features in just the right places to make the shell easier to learn, v3 continues to offer plenty of power and expanded reach across a number of administration areas.

By Don Jones

Windows Server 8: What We Know So Far

2011-12-15T04:45:00.000-08:00

I know it is not as glamorous or flashy as Windows 8 with its Metro UI, and touchscreen magic, but Microsoft has some other tricks up its sleeve for this BUILD conference. The day 2 keynote focused on Windows Server 8 which is just as bold an evolution--if not moreso--than its desktop sibling.

While Microsoft seems to be focused on moving the familiar Windows desktop OS to a hybrid that straddles the line between desktop and tablet, the new Windows Server 8 is geared toward delivering a hybrid experience of its own--straddling the line between traditional data center and cloud computing.

Windows Server 8 is radically changed and updated just like its desktop sibling.Microsoft stresses that the latest and greatest version of its Windows Server OS will be both more reliable, and more manageable. Aside from being affordable and/or cost-effective, there isn't much more you can ask for from a server OS than one that is reliable and manageable.

That said, here is a quick look at a few of the highlights we know so far based on the BUILD keynote and demos:

GUI on the Fly. With Windows Server 2008 and Windows Server 2008 R2 you have to decide up front whether you want to run the full Windows Server 2008 OS--GUI, Internet Explorer, and all--or just the stripped down server core. In Windows Server 8 you can run the leaner, meaner server core, bit still have the option to flip the GUI on when you need to work with the system.

Metro UI for Server Manager. This doesn't really do anything for reliability, but you could construe it as a benefit for manageability to have the same tiled Metro interface that is common across Windows Phone 7, and the upcoming Windows 8. The consistency of interface across all environments will make it that much more intuitive to work with Server Manager.

Simplified Direct Access. Direct Access is arguably one of the coolest features of Windows Server 2008…potentially. It is like VPN on steroids and lets remote, roaming PCs stay persistently, and virtually connected to the network through firewalls from just about anywhere with an Internet connection. Unfortunately, it has never really caught on and lived up to that potential--in part because it is too complicated for most organizations to properly configure and maintain. With Windows Server 8, Microsoft promises to make Direct Access as simple as flipping a switch.

There are tons more tweaks and changes coming in Windows Server 8. There are improvements to networking performance and management, improvements to Active Directory, improvements to data storage handling, improvements to virtualization, and more.

As Windows Server 8 moves from this early stage of development, through beta, to official release, we will explore the updates and new features in much more detail.

By Tony Bradley, PCWorld

Managing Biometrics Windows Server 2008 R2

2011-12-07T08:54:00.001-08:00

Introduction

We’ve known for a long time that the traditional user name and password authentication method, alone, doesn’t provide the best security. It can be made better by instituting length and complexity requirements and setting expiration periods, and Windows domain administrators have been able to do this through Group Policy settings since Windows NT. But multi-factor authentication will always be better, and arguably the best method of positively authenticating a person is via fingerprints and other unique physical characteristics. Yes, it is possibly to spoof biometric information, but it’s difficult. You can’t share a biometric identifier as you can a password or make a copy of it as you can with a card or token. Another advantage is that it’s always with you; you can’t lose it or leave it behind when you need it.
The problem with using biometrics for system or domain logon is that until recently, there was no built-in support in either Windows Server or the Windows client operating systems for using or managing biometrics. You had to use third party software, and there was little consistency or interoperability across biometrics programs. Every device vendor provided its own proprietary drivers, client software, SDK, management tools, etc. The good news is that that’s changed. Windows 7 and Windows Server 2008 R2 include the Windows Biometric Framework (WBF), which provides native support for biometric technologies, specifically fingerprint devices.

WBF Components

WBF consists of several components:

Driver interface definition, Windows Biometric Driver Interface (WBDI), through which user applications can interact with biometric devices.
Windows Biometric Service (WBS), for managing fingerprint devices and operating between the software application and the biometric device to keep the biometric data separate from the client application.
Pluggable expansion platform.
Client API, through which applications enroll, identify and verify user identities.
User experience components.
Management components for local configuration or centralized domain-wide configuration, including the Biometrics Devices Control Panel and the Biometrics category in Device Manager, Group Policy.
Distribution component, including ability of vendors to distribute WBF drivers and components through Windows Update.

Developers can find out more about the Windows Biometric Framework API and how to use it here .

Biometric Scenarios

The two standard supported scenarios for Windows 7 client computers include biometric logon (to local computer or domain) and elevation of privileges through UAC by biometrics.
For the extra security of strong multi-factor authentication, the fingerprint template can even be stored on a smart card and used to authenticate the owner of the card, integrating with third party solutions such as Protiva .NET Bio’s “Match-on-Card” technology where the fingerprint verification is performed on the card. Read more about that here.

Enabling Biometric Logon in Windows 7

To set up biometric (fingerprint) logon to a Windows 7 computer, you first need a fingerprint reader. This can be an add-on device, or a reader that comes built-in (as is the case with many modern laptops). The proper drivers for the device must be installed. Windows 7 comes with drivers for a number of biometric devices. If yours isn’t one of them, Windows will attempt to find the correct drivers on the Windows Update site. If that doesn’t work, check the web site of the device vendor (or the computer vendor for built-in devices).
Once the drivers are installed, the next step is to set up the biometric software with your fingerprint data. Follow these steps:

Log on to the user account with which you want to use biometric logon.
Click Start | Control Panel.
In Classic View, click the Biometric Devices applet. If you don’t see this applet, check Device Manager to ensure that your biometric device is listed.
In the dialog box, click “Use your fingerprint with Windows.”
Next, you’ll be asked to provide your password. Do so and click OK.
The Fingerprint Reader enrollment dialog box requests that you click the finger you want to set up. You can set up one, some or all of your fingers. It’s usually a good idea to set up more than one, as sometimes the reader may not recognize one of your fingers (perhaps because it’s dirty or oily or injured) but will recognize a different finger.
Next you’ll be asked to swipe the finger on the reader so the reader can get a good reading. A successful swipe will result in a green checkmark; an unsuccessful swipe will result in a red X. You’ll need three successful swipes to proceed.
After three successful swipes, you’re notified that the finger is set up for logon and access functions and you can click Finish.
You can repeat the process to enroll other fingers.

Now you need to test and ensure that the fingerprint logon works. Log off (or lock the computer). Instead of your photo and a credentials box for entering your password, you’ll now see a fingerprint icon, as fingerprint logon has been set as the default logon method. Don’t worry; if it doesn’t work, you can click the “Other credentials” button and log on with your username and password as usual.
Swipe one of the fingers that you set up and the system should log you on.

Managing Biometrics in a Windows Server 2008 R2 Domain

Administrators can enable, limit or block the use of biometric devices in a Windows Domain by using Group Policy. In the Group Policy Management Editor on Windows Server 2008 R2, in the left pane right click the Group Policy Object (GPO) you want to configure (for example, the default domain policy) and select “Edit,” as shown in Figure 1.

Figure 1
In the left pane, expand Policies, then Administrative Templates: Policy definitions, then Windows Components, and click Biometrics as shown in Figure 2.

Figure 2
In the right pane, you’ll see four choices:

Allow the use of biometrics
Allow users to log on using biometrics
Allow domain users to log on using biometrics
Timeout for fast user switching events

Note that this same Group Policy settings are available in the Local Group Policy Editor on Windows 7 and Windows Server 2008 R2 computers. The permissions and behaviors of biometrics can be configured in the local policy; however, domain policy will override local policy.

Allow the Use of Biometrics

If you enable the “Allow the use of biometrics” policy setting, this makes the Windows Biometric Service available to user applications. This means users will be able to run biometric applications on their Windows 7 clients or on Windows Server 2008 R2 servers. This setting does not enable users to log on with biometric data; it only allows them to run the biometric-enabled applications.
If the policy is not configured, WBS will still be available, as that is the default. If you don’t want it to be available (thus prohibiting users from running biometric applications), you need to explicitly disable this policy setting. This prevents users from using any of the biometric features in Windows 7 and Windows Server 2008 R2. To enable or disable the policy setting, double click it or right click it and select “Edit.” There you have three option buttons: Not Configured, Enabled and Disabled. Click the one you want and then click Apply and OK.

Allow users to log on using biometrics

If you enable the “Allow users to log on using biometrics” policy setting, users will be able to log onto their computers by swiping a finger. They will also be able to elevate User Account Control (UAC) permissions with a finger swipe (if they are logged on with an administrative account). This only allows users to log onto the local computer; it does not enable them to log onto the Windows domain.
As with the previous policy, the default of Not Configured has the same effect as selecting Enabled, so if you don’t want users to be able to log onto their computers or elevate privileges using biometrics, you’ll need to explicitly disable the policy setting. This is done in the same way we edited the policy setting above.

Allow domain users to log on using biometric

The purpose of this policy setting is self evident; if you enable it, users who have domain accounts will be able to log onto the Windows domain, or elevate privileges with a logged on domain account, by swiping a finger. The default here is different from those above. Because in a domain, the principle of least privilege applies, domain users can not use biometrics to log on by default. Thus the “Not Configured” selection in this case has the same effect as the “Disabled” selection, and you will need to explicitly enable the policy setting if you want domain users to be able to log onto the domain using biometrics.

Timeout for fast user switching events

You can use this policy setting to set a specified time period (in seconds) for which a fast user switch event stays active before the switch happens. The default time period is 10 seconds. The maximum time period you can configure is 60 seconds. You need to enable the policy setting to change the specified time period.

Meet the Windows 8 Task Manager

2011-11-10T07:41:00.000-08:00

Design simplicity is the key for Windows 8, and Microsoft recently discussed on its blog the streamlining of yet another popular Windows feature: Task Manager. The new Task Manager echoes the design simplicity that Microsoft showed off earlier with the new copy-file dialog box.
Microsoft says three goals guided development of the new Task Manager, which is intended to appeal to nontechies and power users alike. The company says it wants to create a Task Manager that is optimized for common tasks (such as killing apps and processes) and has a modern and functional interface, without eliminating power users' favorite functions.
For most users, that means Windows 8 won't inundate you with a long list of unfriendly-looking processes, as the Task Managers in Vista and Windows 7 do. Instead, the new OS will show a simplified list of programs that you can expand if you need to go beyond simply killing an app.

A Simpler Task Manager

After studying user habits in Windows 7, Microsoft found that 85 percent of all Task Manager usage centers on the Applications and Processes tabs. This discovery isn't especially surprising, since most people use the Task Manager to close out an application or process that isn't responding.

Force Quit dialog box in OS X 10.5 Leopard. Source: MacworldSo instead of seeing a long list of information you don't need, all you'll see when you open the Windows 8 Task Manager for the first time is a simple list of applications. No tabs, no menu bar, no statistics--just applications. If a program is having a problem, a 'Not responding' note will appear next to the application name. This approach is similar to Apple's interface for killing applications in OS X.
Microsoft has simplified the basic Task Manager so much that you won't even get a double prompt asking whether you're certain you want to kill a process. If you click the 'End Task' button in Windows 8, the operating system will kill the process and tell the program to shut down. Microsoft warns you to be careful with the new Task Manager, though, because Windows 8 won't prompt you to save your work before shutting something down.

Details, Details

Power users looking for more information on what's going on in their system can still get that by clicking the 'More details' button. This action will open a more familiar tabbed view for the Task Manager, but Microsoft has made some important tweaks to this view as well.
First, all processes are grouped by type, such as all those for a certain application, all background processes, or all operating system processes. As with other Windows groupings, you can click on the left side of each app or process to expand the list and drill deeper into what your computer is running. This arrangement will let you see, for example, how many Outlook windows are open, or how many processes a specific service is running in the background.

Microsoft also highlights--right at the top of the detail view--percentages for CPU, memory, disk, and network usage. The top indicator for each category shows your overall usage, and then breaks it down by groups.
A heat map also helps you identify which applications are sucking up system resources. The more CPU or memory an application uses, for example, the darker its statistics appear in the detail view.

Windows 7 Task ManagerProcess names are friendlier, appearing in plain language instead of cryptic terms such as "splwow64.exe." Did you know that name means "Printer driver host for applications"? I sure didn't, but I will in Windows 8.
And if the friendlier names don't help you understand why your printer driver host is causing problems, you can access a 'Search the Web' option when you right-click a process. Clicking the search option will open your default browser to a search-results page with information about the mystery process.
Microsoft has made some nice-looking improvements to the Task Manager, and simplified its view for those users who don't need a high level of detail. But here's another interesting change: In the process of simplifying the Task Manager, Microsoft is adding an extra tab in the detail view compared to Windows 7. How's that for simplification?

By Ian Paul, PCWorld Oct 14, 2011 9:34 AM

Windows 8: Here's What We Know So Far

2011-09-01T04:18:00.001-07:00

Details about Windows 8, Microsoft's newest operating system expected in 2012, have been leaking out thanks largely to Microsoft previews and a stream of blog posts on the company's Building Windows 8 blog.
The new OS is said to be Microsoft's biggest Windows refresh since Windows 95, when desktop PCs reigned supreme and most laptops cost nearly $3000. Now, Microsoft wants to update Windows for a consumer technology world that is obsessed with online services and touch-centric devices such as the iPad and Android smartphones.

Windows 8: TL;DR* (*Too Long; Didn't Read)

So far, Microsoft has detailed a brand new touch interface for Windows 8 with the traditional desktop UI hiding underneath. The new OS also will run on both ARM and Intel processors, opening up a range of Windows 8-powered devices such as desktops, laptops, and tablets.

Windows 8 also is expected to have an OS X-style Mac App Store, and should include further integration with Microsoft's growing range of online services such as SkyDrive, Office 365, and the free Office Web apps. Other improvements include USB 3.0 support and an overhauled version of Explorer, Windows' file management tool.

Here's a look at everything we know so far about Window 8.

Get in Touch With Windows 8

The most dramatic change for Windows 8 is Microsoft's emphasis on a new Windows Phone 7-inspired touch interface. Windows 8's new start screen has large panels that are ideal for touchscreens, but that also can be manipulated by a mouse.

The Microsoft Windows 8 start screenThe traditional Windows interface with the start button, task bar, and desktop is still available and will come up any time you load a legacy app such as Microsoft Excel 2010. You can also run new Windows 8 touchable apps alongside traditional Windows apps. Microsoft said HTML and JavaScript will be the primary development language for new Windows 8 apps.

ARM and Intel

Windows 8's touch-centric interface may give traditional mouse-and-keyboard desktop fans the chills, but the new UI could help Microsoft compete in the tablet arena. Starting with Windows 8, Microsoft will design its operating system to work not only with Intel's x86 chip architecture, but also with ARM processors. ARM chips are very popular in the mobile device market and should help Microsoft's partners put Windows 8 on a range of so-called post-PC devices such as tablets.

An ARM processorThe big question, however, is whether people will be willing to give ARM-based Windows devices a chance. Apple's iPad is the most dominant device in the new generation of one-panel touch tablets. And the consensus among critics and device makers is that people are looking for slates running mobile operating systems such as iOS, Android, and the QNX-based OS on the Blackberry PlayBook. Can Microsoft succeed in the tablet arena by offering Windows with a new touch overlay? I guess we'll find out in 2012.

App Store

You can expect to see an integrated app store in Windows 8 that should let you download new software for your device with just one click. Earlier in August, Microsoft revealed on the Building Windows 8 blog the details of various engineering teams working on the new OS, and the list included an "App Store" team. It's not clear what the app store team is working on, but chances are it will be a product similar to the Mac App Store available for Mac PCs running OS X 10.6 (Snow Leopard) and 10.7 (Lion).

App Preview

Speaking of Apps, some Microsoft partners are already hard at work designing touch-based apps for Windows 8 tablets. ZDNet uncovered a purported early design for a USA Today Windows 8 app that has a very Metro UI look and feel to it.

A mock-up of a Windows 8 appAnother Windows 8 mock-up shows an app presumably designed with in-flight entertainment consoles in mind that offers access to news, weather, and videos.

Clouds in Windows 8

Also part of Microsoft's list of Windows 8 engineering teams was a group called "Windows Online." It's not clear what that team might be doing, but there are a large number of online services that Microsoft could integrate into Windows 8, such as Office 365, Office Web Apps, Windows Live and Azure. Some integration with these so-called cloud services already exists, but there are still annoying shortcomings in Windows such as an easy way to mount your SkyDrive as a local drive accessible via Windows Explorer. Dropbox can do it, so why can't Microsoft?

USB 3.0 Support

USB 3.0 promises data transfer speeds that are up to 10 times faster than the current USB 2.0 standard, and USB 3.0 also uses less power than its predecessor. You can already take advantage of speedier USB 3.0 ports in Windows 7 thanks to third-party drivers. But starting with Windows 8, Microsoft plans on including native support for USB 3.0.

Windows Explorer: File Management Basics

The new interface for file copy information in Windows 8Microsoft has spent a fair amount of time recently talking about its overhauls to Windows Explorer for the next iteration of Windows. The new Windows Explorer will improve its file management basics such as copy, move, rename, and delete functions, which make up 50 percent of Explorer's usage in Windows 7.

The new interface puts all your basic file management functions into one window instead of having separate windows for each function. This will make it easier and more efficient to handle moving around several large files at once, such as photos and videos.

If you're copying or moving files, you can also get an expanded view to see throughput graphs and how many bits have already been transferred. Microsoft also claims its time estimates to completion will be more accurate in Windows 8.

Finally, Microsoft has improved the filename collision dialog to make it easier to figure out which files you'll be overwriting when a new file has the same name as a file already sitting in your destination folder.

Exploring Ribbons

The Windows 8 version of Explorer is also getting Microsoft's ribbon interface in a bid to make the file management tool more touch friendly, efficient, expose useful commands, and to reintroduce popular Explorer features from Windows XP. Microsoft has also optimized the new Explorer for widescreen displays and will add about 200 keyboard shortcuts for power users.

Explorer gets the ribbon interface in Windows 8.The new Windows 8 Explorer will have three main tabs--Home, Share, and View--along with a File menu on the far left side. Explorer's primary Home tab in Windows 8 includes 84 percent of the commands users employ most often, Microsoft says, such as "Move to" and "Copy to" for moving and copying files. Microsoft has also exposed the command "Copy path" for people who want to paste a file path into another Explorer window to access a file quickly or email a link to a file sitting on a corporate server.

The Share tab offers one-click access to the "Email" and "Zip" commands, as well as other options such as "Burn to disc," print and, in a nod to the 1990s, fax. The new Explorer will also show you who has access to a currently selected file on your HomeGroup or enterprise network.

Explorer's new File menu gives power users quick access to the command prompt as well as an option to open the command prompt as an administrator. Both options open a C prompt with the file path set to your currently selected folder such as My Documents or Desktop.

There are also contextual menus in Windows 8's Explorer that only show up when you are doing specific tasks. If you open up Explorer to look at photos, for example, under the "Manage" tab you'll see options to rotate the currently selected photo, start a slideshow, or set a photo as your background.

Opening up an Explorer window to look at your computer's connected drives will give you options to format, optimize, and clean up your hard drive, eject an external thumb drive, or activate Windows' Autoplay feature. Windows 8's Explorer will also include XP's 'Up' button that allows you to move backwards through your file directories.

That's all for now, but Microsoft is expected to reveal more details about Windows 8 during the company's BUILD conference that starts September 13 in Anaheim, CA. We'll keep an eye on Microsoft's blogs for more Windows 8 news.

By Ian Paul, PCWorld

Using Windows 7 Part 1

2011-07-02T07:14:00.000-07:00

Windows 7 has had some fine tweaks made to it. There were many complaints about what Vista was and Microsoft heard and delivered. The real question is. Now that you have the features you asked for why are you not using them? An edition of Windows 7 is not just another version of Windows XP or Vista. It is in a category all by itself. Security is my area of expertise but the functionality that Windows 7 brings to the table is not seen implemented hardly or even at all. Company A has migrated from Windows XP Professional to Windows 7 Professional. Their main achievement for the upgrade was to reduce cost and potentially gain a return on investment by increasing user productivity and enabling features like AppLocker and Branch Cache. Also, keeping in mind that these features are only available in the versions of Windows 7 Ultimate and Enterprise.

Bit Locker functionality and Direct Access has been thrown out of the window because of this upgrade path. There is an old saying, “If you do not know where you are going. Any road will take you there.” Now Company A has upgraded to Windows 7 along the wrong path for their needs. Mobile users are present and need software updates as well as any new policy that the company has deployed. So far this is a debacle. Company A is now in the same position as they were before the upgrade. Huge downloadable files are still coming over the WAN, mobile users are not protected as Bit Locker is not enabled, Direct Access cannot be used as it is not supported in Windows 7 Professional (at the time of this article being written).

Now Company A has to reinvest finances to upgrade to Ultimate or Enterprise. In this case scenario I do not see the Return on Invest. How will this upgrade path support the company within 3-4 years?
These features are the very foundation for moving to Windows 7 in the first place. There is a greater ease in deployment. Better manageability using tools like RSAT federation searches, credential manager, and recovery from a failed system. Even the option to use AppLocker, even though most users hate it has been removed from your list of options.

Well you might say our company has saved on power a little and because Windows 7 does a great job of maintaining itself there are fewer helpdesk cost. Let’s look at the bigger picture. Company A is still spending money over the WAN. Computers are still not protected from known threats. The risk of company data being easily stolen is present with no PKI or Bit Locker encryption. Windows 7 coupled together with Windows Server 2008 R2 is a match made from heaven. Using roles such as AD CS, WSUS, NAP, and DFS. You pretty much have an infrastructure that will let you know when something is broken and wrong before the user gives the Help Desk a call.

You asked for it now you have it. Windows 7 brings to the table what we have been asking for, for a long time. The real question is when will you start taking advantage of this cost saving software? My advice is to follow the six P’s. Prior, Proper, Planning Prevents, Poor, Performance. Take your time and plan out your Windows 7 infrastructure for the future knowing that you can take advantage of using all of the features with one upgrade. Spend money once and your CFO will be a very happy person.

Adnan Cartwright

CEO Integrity Solutions Inc

Finding IPv6-capable network appliances

2011-06-10T08:59:00.000-07:00

When it's time for a product refresh, how do you find network appliances that are IPv6 capable to future-proof your enterprise WAN? Do you look for the IPv6 Ready Logo or the USGv6? In particular, why are so many wide area network vendors slow to incorporate IPv6 capabilities into their WAN accelerators?
SearchEnterpriseWAN.com spoke to book author and Blue Coat chief scientist Qing Li, who led the WAN appliance vendor to deploy an IPv6 internal network, pushed the team to participate in World IPv6 Day and advised how to develop a WAN optimization solution to accelerate IPv6 traffic—the first and only currently in the industry. We asked what enterprises can do to find WAN devices and services ready for an IPv6 migration and how World IPv6 Day—June 8, 2011—motivates vendors to create network hardware devices that are IPv6 capable.

What is holding network vendors back from deploying IPv6-capable network appliances?

Qing Li: [Vendors] need to figure out what kind of features need to be built into appliances and solutions, how customers can really benefit from those features and how much to charge for them. That was a real challenge for Blue Coat, because you have a chicken and egg situation: If I build a feature, is my customer going to use it? But if my customer doesn't use it [it makes no sense to build it]. I think this was a real challenge for many network vendors. Because Blue Coat started [with] the problem much earlier, we were able to work with the customers from the beginning, and come up with a solution set that was very specific to each market sector: the service provider, enterprise and government.

Will World IPv6 Day motivate the network appliance vendors to create more IPv6-capable devices?

Li: Absolutely! There's definitely a huge amount of motivation for hardware vendors. In Blue Coat's case, many larger organizations are leveraging Blue Coat's solution to participate in the event, because Blue Coat is the first vendor to offer [IPv6] Secure Web Gateway and the first vendor to offer [a] WAN optimization solution in a native IPv6 infrastructure. That gave us motivation to deliver those IPv6 functionalities to our customers as quickly as possible. Having a Blue Coat solution prominently displayed during that day is very important, and this goes for other vendors as well. We offer various IPv6 capabilities and solutions for in the [IPv6] infrastructure and also in the application space.

Why is it difficult for WAN optimization vendors to accelerate IPv6?

Li: You really have to look at all of the capabilities in the existing IPv4 offering. For example, international organizations with offices in APAC, EMEA and North America expect that when they apply IPv6, all those wonderful things in terms of WAN optimization and application acceleration in IPv4 will also be available to them in IPv6. This means having a solution that says IPv6 Ready is more than just a low-level support. That solution must have the application intelligence to be able to understand both v4 and v6 characteristics and how the applications and content are delivered over those infrastructures. That takes quite some time to perfect, especially for the transitional types of [IPv6] solutions. It took us nearly three years to really make our solution for WAN optimization very comprehensive and mature. So if a vendor hasn't started, say, two to three years ago, they are way behind. And guess what? The customer expectations are very high. They expect the same set of capabilities in terms of WAN optimization for both v6 and v4, and when they are ready to adopt IPv6, that secure WAN optimization capability must be ready for them to deploy.

For enterprises that have routers and other network hardware appliances that are not IPv6 capable, is there a specific logo they need to look for or any specifications that will enable them to deploy IPv6?

Li: [While] the IPv6 Ready Logo Program is very important, you really have to look at the solution in terms of what capabilities actually apply to you. There are a lot of standards out there about IPv6, and a hardware appliance vendor may say, ‘Here is a giant list of RFCs and standards that we support in a product, but we have no IPv6 Ready Logo certification.’ You need to look at the list and ask whether all of the functionalities apply to you and whether your needs are covered in that list.
One example is IPv6 privacy extension … [which] is very important for individual end consumers. IPv6 privacy extension provides anonymity to users when they go on the Internet so that a hacker or observer does not have a good ability to correlate traffic that you generate today versus the traffic that you generated the day before or a week ago. That's great for privacy for individual users, but that functionality is not applicable to enterprise environments. Why? Because if individual users within an organization can generate dynamic IPv6 addresses—then there are global addresses—and [they are] able to create secure tunnels to the outside world, that's a security risk. Today, a common thing that we see is that even though IPv6 has this great plug-and-play capability, enterprises actually control how IPv6 addresses are being assigned to individual work stations and to individual users within an enterprise environment.

So, a logo certification is great. A giant list of standard and support is wonderful, but for any organization, they really have to look at the services and applications that are deployed today and how those new IPv6 solutions might help them support those applications to support those services. Because one of the things that has been holding IPv6 adoption back is not the routers, not the switches, not the links or the firewalls—it's the lack of [IPv6] services and content support at a higher layer.

Tessa Parmenter, Site Editor

Hybrid cloud computing explained

2011-04-28T13:34:00.000-07:00

A few years ago, the IT world was focused on public cloud computing. In 2010, after IT directors expressed concerns over public cloud security issues, the focus shifted to private clouds. And now, because everyone wants operational flexibility, hybrid clouds are at the top of the wish list.
Several recent cloud surveys confirm these high levels of interest in hybrid cloud. A Unisys survey in January 2011 indicated that 21% of IT organizations are focusing on hybrid clouds, and a 2010 Sand Hill Group survey of over 500 IT managers indicates that hybrid cloud use will triple over the next three years.
Examining hybrid cloud architecture
So what is a hybrid cloud? For starters, it is a composition of at least one private cloud and at least one public cloud. The private cloud can be an on-premises private cloud or a virtual private cloud located outside the enterprise data center. In the illustration below, we provide one of the simplest macro views of a hybrid cloud -- a single on-premises private cloud and a single off-premises public cloud:

The black circles in the illustration represent active virtual server images and the white circles represent virtual server images that have been migrated (using safe connections). The arrows indicate the direction of migration. Enterprise users are connected to the clouds using safe connections, which can be virtual private networks (VPNs) or secure HTTP browsers.
A hybrid cloud could also theoretically consist of multiple private and/or public clouds. The enterprise data center denoted in the illustration may have active servers (virtualized or physical) that are not included in the private cloud.
What is driving hybrid cloud computing?
Hybrid cloud interest is powered by the desire to take advantage of public and private cloud benefits in a seamless manner. Some of the risks associated with public and private clouds, however, can also be issues in hybrid clouds. The benefits and risks of public, private, and hybrid clouds include:

Public cloud benefits:

- Low investment hurdle: pay for what you use
- Good test/development environment for applications that scale to many servers

Public cloud risks:

- Security concerns: multi-tenancy and transfers over the Internet
- IT organization may react negatively to loss of control over data center function

Private cloud benefits:

- Fewer security concerns as existing data center security stays in place
- IT organization retains control over data center

Private cloud risks:

- High investment hurdle in private cloud implementation, along with purchases of new hardware and software
- New operational processes are required; old processes not all suitable for private cloud

Hybrid cloud benefits

- Operational flexibility: run mission critical on private cloud, dev/test on public cloud
- Scalability: run peak and bursty workloads on the public cloud

Hybrid cloud risks:

- Hybrid clouds are still being developed; not many in real use
- Control of security between private and public clouds; some of same concerns as in public cloud

Addressing the hybrid cloud challenge
The challenge of hybrid computing is to provide seamless operation across platforms, cloud application programming interfaces (APIs) and hypervisors. Users prefer to use their data center tools to manage hybrid cloud environments. Ideally, they want to be able to create applications, or move existing applications between the clouds in a hybrid cloud environment, without having to change anything serious like networking, security policies, operational processes or management/monitoring tools. This is a problem because, due to issues around interoperability, mobility and differing APIs, tools, policies and processes, hybrid clouds generally increase complexity.
In the second half of this two-part tutorial on hybrid cloud, we take a look at the most prominent hybrid cloud options available on the market and determine the best use case for a hybrid cloud computing offering.
ABOUT THE AUTHOR:
Bill Claybrook is a marketing research analyst with more than 30 years of experience in the computer industry, with the last 10 years in Linux and open source. From 1999 to 2004, Bill was Research Director of Linux and Open Source at Aberdeen Group in Boston. He resigned his competitive analyst/Linux product marketing position at Novell in June 2009 after spending over four and a half years at the company. He is now president of New River Marketing Research in Concord, Mass. He holds a doctorate in computer science.

SQL Server backup error

2010-12-13T16:31:00.000-08:00

Hello All,

Ray is having some issues with his SQL Server backup. All SQL experts that can assist please lend a helping hand. The FISG member that solves his problem will receive a book of his or her choice from O'Reilly. Here is Ray's issues:

I have a question regarding an error I am receiving while trying to backup one of our SQL 2008 databases. I'm writing you because I couldn't find where to ask this on the FISG website.

My error message:

"Backup of file 'XXXX' is not permitted because it contains pages subject to an online restore sequence. Complete the restore sequence before taking the backup, or restrict the backup to exclude this file.

BACKUP DATABASE is terminating abnormally.". Possible failure reasons: Problems with the query, "ResultSet" property not set correctly, parameters not set correctly, or connection not established correctly.

I have been "googling" and reading blogs and can't seem to find any solutions. If you could spread the word, I would greatly appreciate it. Thanks.

SharePoint 2010

2010-07-31T09:46:00.001-07:00

Microsoft SharePoint 2010 provides many next generation features out of the box including Social and informal collaboration, Activity tracking, improved document management, Self Service based Content Management, Solution Sandboxing, Metadata and Taxonomy features, Commenting, Improved Workflows and Enhanced Business Intelligence features among others. With these features, SharePoint 2010 can be easily utilized to quickly implement business solutions and portals. Moreover, SharePoint 2010 can help bring together the informal and formal interactions within your organization and help retain skills, capture informal knowledge, promote organizational learning and easily allow your organization to be open, efficient and harness the power of end user participation. What are your thoughts on SharePoint 2010 and the new technology it brings?

Hyper-V Inside and Out

2010-04-27T16:41:00.000-07:00

Hyper-V is the latest and greates when it comes down to virtualization technology. As time progresses the use of this technology will become wider and in greater demand. Some of the many feature of Hyper-V such as Core Parking, Snapshots, Differencing Disk and Virtual Networks is an IT Professionals dream come true. Learning all of the features of Hyper-V will be a great benefit for those who are getting ready or are managing VLAN's today.

2010-01-13T10:26:00.000-08:00

Realizing the Potential of a Server 2008 R2
and Windows 7 Infrastructure

-by Adnan Cartwright

As new technology is presented we are often caught up in the new features that are advertised or pinpointed to catch our attention. The focus is placed on maybe two or three features that basically sell the item we shell out hundreds of dollars for. The question here is. Are you really getting the full potential out of your software or application?

There are many features and other strong points that either goes unnoticed and it is in this points I would like to speak about. We know Server 2008 R2 and Windows 7 is a match made in heaven. They complement one another so well. Because of this new found integration we have new features such as Direct Access, Branch Cache, App Locker, and Bit Locker. But, what about the other features that we hear so little of if any about?

I am talking about the features that would make your job as an Administrator, IT Professional or even a Technician easier to perform. Yes, I am talking about features like the new AD - Active Directory Administrative Center. The 300 newly added GPO’s at least at the time of this writing. It may be more now! The new power shell console that Microsoft has so graciously added, and tuned up for your scripting and batch creating pleasure. With Server 2008 R2 and Windows 7 there is more under the hood to utilize than we actually realize. We are looking forward to a new way of using technology to make our lives easier and more productive.