daclark's WebLog : Management

Zero Touch Provisioning 2.5 is Available!

daclark — Thu, 06 Apr 2006 01:28:00 GMT

Well, after many months, ZTP 2.5 is generally available through an MS Services engagement. We'll maintain source (features and bug fixes) through a Services engagement model (requiring Consulting Services for initial deployment or Premier Services for maintenance).

Q: What’s new in ZTP 2.5?
• Active Directory ServiceAdapter for WS queries to AD
• Combined status across ZTP+HWS
• Web Services for all ServiceAdapters and Administration
• New Web Parts: Navigation multi-view, Common Services, Pending Requests, Service Description, Administration tool
• Updated UI to match SharePoint styles and templates
• Updated User Controls modified to use Web Services and SharePoint styles/templates
• Sample Call Service Orchestration to batch updates to ZTP
• Sample Bulk Update Manager User Control for querying Active Directory
• Bug fixes increasing scalability and performance

Q: What platform is supported by ZTP 2.5?
• Windows Server 2003 SP1
• BizTalk Server 2004 SP1
• .NET Framework 1.1 SP1
• Windows SharePoint Services 2.0 SP2
• SQL Server 2000 SP4
• SQL Server 2000 Reporting Services SP2
• Systems Management Server 2003 SP1 or SP2

Q: How do I get ZTP 2.5?
ZTP 2.5 is currently only available as a Microsoft Services engagement. Contact your local Engagement Manager or Technical Account Manager to pursue an estimate.

Why Authorization Manager?

daclark — Tue, 28 Jun 2005 15:21:00 GMT

Authorization Manager (or AzMan) is the authorization API built into Windows Server. It provides RBAC AccessChecks to application developers for free and supported by the Windows team. You can use Windows Groups or LDAP queries to assign membership to the role. AzMan supports a centralized or distributed store using Active Directory, ADAM, or XML. For more information on AzMan, check out Role-Based Access Control for Multi-tier Applications Using Authorization Manager.

Comparing machines in SMS

daclark — Thu, 12 May 2005 04:14:00 GMT

Here's a query for comparing Services on two machines. Just Clone the "Compare software inventory on two computers" report and replace the SQL with below.

select (case when inv1.Name0 is not null then @name1 else @name2 end) as Netbios_Name0,
         (case when inv1.Name0 is not null then inv1.DisplayName0 else inv2.DisplayName0 end) as DisplayName0,
         (case when inv1.Name0 is not null then inv1.Name0 else inv2.Name0 end) as Name0,
         (case when inv1.Name0 is not null then inv1.StartMode0 else inv2.StartMode0 end) as StartMode0,
         (case when inv1.Name0 is not null then inv1.StartName0 else inv2.StartName0 end) as StartName0

from ( select s.ResourceID, s.DisplayName0, s.Name0, s.PathName0, s.StartMode0, s.StartName0
from v_GS_Service s join v_R_System sys on s.ResourceID=sys.ResourceID where sys.Netbios_Name0 = @name1 ) as inv1

full outer join ( select s.ResourceID, s.DisplayName0, s.Name0, s.PathName0, s.StartMode0, s.StartName0
from v_GS_Service s join v_R_System sys on s.ResourceID=sys.ResourceID where sys.Netbios_Name0 = @name2 ) as inv2

on inv1.Name0=inv2.Name0 and inv1.StartMode0=inv2.StartMode0

where (inv1.Name0 is NULL) or (inv2.Name0 is NULL) order by DisplayName0, Name0, Netbios_Name0

Here's a query for comparing AddRemovePrograms on two machines. Just Clone the "Compare software inventory on two computers" report and replace the SQL with below.

select (case when inv1.DisplayName0 is not null then @name1 else @name2 end) as Netbios_Name0,
(case when inv1.DisplayName0 is not null then inv1.DisplayName0 else inv2.DisplayName0 end) as DisplayName0,
(case when inv1.DisplayName0 is not null then inv1.Version0 else inv2.Version0 end) as Version0

from ( select s.ResourceID, s.DisplayName0, s.ProdID0, s.Publisher0, s.Version0
from v_gS_Add_Remove_Programs s join v_R_System sys on s.ResourceID=sys.ResourceID where sys.Netbios_Name0 = @name1 ) as inv1

full outer join ( select s.ResourceID, s.DisplayName0, s.ProdID0, s.Publisher0, s.Version0
from v_gS_Add_Remove_Programs s join v_R_System sys on s.ResourceID=sys.ResourceID where sys.Netbios_Name0 = @name2 ) as inv2

on inv1.DisplayName0=inv2.DisplayName0 and inv1.Version0=inv2.Version0

where (inv1.DisplayName0 is NULL) or (inv2.DisplayName0 is NULL) order by DisplayName0, Version0, Netbios_Name0

Understanding output in SDDL

daclark — Tue, 22 Mar 2005 22:39:00 GMT

If you've used the SC command line or worked with ADSI or MIIS, you'll recognize these easy to read strings representing ACLs (like O:AOG:DAD:(A;;RPWPCCDCLCSWRCWDWOGA;;;S-1-0-0)). For those that haven't seen these before, goto a cmd prompt and run the command SC SDSHOW LANMANSERVER from Windows XP Pro or Windows Server 2003. This is a text representation of an ACL called security descriptor definition language (SDDL). SDDL is useful for storing or transporting security descriptor information. The SD string format is a null-terminated, concatenated string with tokens to indicate each of the four main components of a security descriptor: owner (O:), primary group (G:), DACL (D:), and SACL (S:). If you don't want to parse this by hand, you can write quick little tool that helps you parse this information into something more meaningful, like I did.

Interesting config guide for SMS2003

daclark — Tue, 22 Feb 2005 03:38:00 GMT

Microsoft Systems Management Server 2003 Supported Configurations for Service Pack 1