Extracting the details from a CSR certificate request

I'm sure that those of you that have already created, configured and implemented certificates before know the importance of filling in the correct details when creating the certificate request.

The other day I had to create one to secure a website for a customer. But there were a few issues. They had a root certificate authority in place (somewhere in the states), but the site where I was at (Belgium) didn't have any information for me on what I needed to fill in. Viewing the time difference, I couldn't just pick up the phone and call ...

Instead I found this great site that allows you to paste an existing CSR into a tool they created and it extracts all the information you need:
1. Common name
2. Organisation
3. OU
4. City
5. State/Country
6. Country

Very, very cool and handy.

The website you can find here: Check your CSR

Enjoy!

Free PowerShell commands for Active Directory

The good people of Quest have done it again...
On their site, you can freely download a set of predefined Windows PowerShell commands for Windows Active Directory management.
Together with a complete admin guide of 231 pages!

You can download the sources for this on the Quest site.

Here below is a sample script to create AD user accounts:

After you get it installed, you can start a regular PowerShell session and type:
Add-PSSnapIn Quest.ActiveRoles.ADManagement
This will extend the PowerShell for AD.

First we save the plaintext password as a AsSecureString:
PS C:\Users\yl.admin\Documents\PS> $pw = read-host "Enter password" -AsSecureString
Enter password: ********

Then connect to the targeted domain:
PS C:\Users\yl.admin\Documents\PS> Connect-QADService -service 'xyzdcs01.xyz-stage.com' -ConnectionAccount 'xyz-stage\administrator' -ConnectionPassword $pw

Once you establish the connection to AD, you can import the csv file which has the below format:
Name Description
Svc_SP_IntrAP Intranet content web application pool
Svc_SP_IntrSSPAP Intranet farm shared services provider application pool

PS C:\Users\yl.admin\Documents\PS> import-csv C:\myworkspace\user.csv |%{new-qadUser -ParentContainer 'OU=Service Ac
ts,DC=xyz-stage,DC=com' -name $_.name -samAccountName $_.name -description $_.Description}

The accounts specified will show up in your AD.

A collection of all Administrative Templates (ADMX) for Windows Server 2008

Administrative template files in Windows Server 2008 and Windows Vista are divided into ADMX (language-neutral) and ADML (language-specific) files. ADML files are XML-based ADM language files that are stored in a language-specific folder. By default, the %Systemroot%\PolicyDefinitions folder on a local computer stores all ADMX files, and ADML files for all languages that are enabled on the computer.

Microsoft has released the beginning of this week a complete set with all ADMX Administrative templates for WS08.
The set can be downloaded here.

Administrative templates provide Group Policy setting information for the items that appear under Administrative Templates. Group Policy tools use Administrative template files to populate policy settings in the user interface. This allows administrators to manage registry-based policy settings.

A list of the most common Powershell cmdlets for Exchange 2007 (E2K7)

As you all know, the Exchange Management Console for E2K7 is basically only a graphical interface that launches PowerShell commands.
You'll all know the frequently used cmdlets like: Set-Mailbox, Get-DistributionGroup, Disable-Mailbox, ......

But it was hard to find a clear overview of all cmdlets and their actions and parameters. But that has changed, Microsoft has published a "Quick reference" that lists the most commenly used cmdlets together with the actions you can perform with them.
It's displayed in a structural overview that let's you quickly find what you need (examples included).

You can download the Quick reference from the Microsoft website.

Installing SQL Reporting Services uses wrong credentials

For a project I'm leading we were installing a SQL Reporting Services server, no simple feed I found out ...

Everything went fine, until I had to enter the credentials to connect to the SQL instance I had created on a different SQL server.

Little inside info: the reporting server I'm trying to configure is located in our DMZ zone and will be accessed by our external client.
First, the domain in the DMZ is different than the domain we use internally, so both servers were located in different domain.
Secondly, because the client connects to the reporting and thus also to the SQL server, we have removed the SQL permissions of the server administrator and created a specific SQL account for the client which has sysadmin & dbowner rights. That should be sufficient.

Now, coming to the credential step in the reporting wizard, I give up the account & password, but I receive an error message stating that "Login failed for user 'NT AUTHORITY\ADMINISTRATOR'".

Appearently this happens when you want to install SQL Reporting Services on a different server than the SQL server, which is recommended by the way ... (IIS should not be installed on a database server for performance reasons).
By default the credentials of the person logged into the server is what is used for installing the databases, only later is the account you specify in the installation wizard used for running Reporting Services ... GO FIGURE!!

Now, there are 2 things you can do (I had to use both in combination with eachother)
1. Locate the template.ini file and behind the values RSSETUPACCOUNT= and RSSETUPPASSWORD= specify the account and password that has the SQL priveledges.
2. Launch the setup.exe or .msi with the same parameters from a command screen, making it: “C:\RS\setup.exe“ RSSETUPACCOUNT=sa RSSETUPPASSWORD=sapwd.

To install services packs, it's the same procedure.

Hope this helps you out as well as it did for us ...

VMware tools: ESX StorageView

I've already posted on my blog about the MightyCare ESX Patcher. Now with ESX 3.5 it's become a bit obsolete, but those guys are still working on some pretty cool stuff that you can freely use in your virtual environment.

I've downloaded and installed their MCS Storageview tool, which displays all the logical partitions (so not just the vmdk files) of all your running virtual machines on ESX 3.x or VC 2.x.
The tool can also display how much of the logical partition is free space, so the admin can decrease the partitions if needed.


The tool can be downloaded here. You'll see on the page that there are more cool tools to download, such as the snapshot checker.

VMware tools: ESX Config check: security best practices

This tool is a cool, FREE utility that can scan the security of VMware ESX 3.5 hypervisor configurations compared to the VMware Infrastructure 3 Security Hardening guidelines.

Tripwire ConfigCheck ensures ESX environments are properly configured, offering immediate insight into unintentional vulnerabilities in virtual environments and provides the necessary steps towards full remediation when they are not.

Features:
- Ensure recommended ESX configurations
- Discover possible vulnerabilities
- Deploy virtualization safely and securely
- Increase security posture of the entire enterprise
- Easily implement security and compliance best practices
- Reduce configuration drift

This handy freeware can be downloaded here.

Direct connect: the DMZ killer

Very interesting article I read on bink.nu ...

Using Vista and WS08, you can use the IPsec features of IPv6 and NAP to create direct connectivity to the corporate servers while working remote without having to create VPN's or hastle with gateways.

Basically, a home user will have access to AD, file servers, ... without any further configuration, as long as he uses a trusted computer account AND user account.


Original story:
Last Friday, Steve Riley - security architect at Microsoft did an excellent session about various security subjects in Amsterdam. One of the subjects was a technology that I only knew of as highly secret within Microsoft and probably one of the biggest changes in network security to come.

Imagine that corporate end users are able to take their corporate mobile systems to any Internet connected place and work with corporate resources without a VPN or gateway. This enables the users to connect to Active Directory, have their clients managed while at home or traveling. At the same time users get full access to the corporate network without the hassle of extra client software or gateways.

Direct Connect uses IPv6 with IPSec to create save direct connectivity to servers on corporate networks for trusted clients. This is quite a revolutionary approach, as it enables clients from the Internet to bypass the DMZ. The concept relies on IPSec authentication and encryption. Microsoft's new IPSec implementation in Windows Vista and Server 2008 allow IPSec connections to be based on both computer and user credentials, combined with Network Access Protection for system health enforcement. The only thing an edge router has to do, is filter incoming traffic to allow only IPSec initiation requests and subsequent IPSec traffic. Any standard router can do just that.

Steve Riley pointed out that you can build a Direct Connect infrastructure with standard products currently available from Microsoft and that Microsoft will provide more information in the near future. He also mentioned that Microsoft marketing is not yet thrilled, because no extra licenses will be needed to build a Direct Connect infrastructure.

Microsoft is currently running a (secret) pilot with Direct Connect that enables participants to use their corporate laptops to directly work with systems on the corporate network from the Internet.

I told Steve I can't wait for the white paper "How to build a Direct Connect infrastructure" and get instant access to my home systems from any place in the world.

Exchange 2007 (E2K7): Protocols & Storage Design

With Exchange 2007 and the unified messaging coming up big time, I guess more and more IT'ers are reading into this in order to keep up with the new technologies.

Microsoft has put together a ZIP file that holds documents on all Exchange 2007 protocols, which can be downloaded at this link
The documentation is designed to describe each protocol in detail as it is used by the Microsoft Exchange Server system. Each protocol specification documents the technical requirements, limitations, dependencies, and Microsoft-specific protocol behavior.
The documentation also includes a set of companion overview and reference documents that supplement the technical specifications with conceptual background, overviews of inter-protocol relationships and interactions, and technical reference information, such as common data types and error codes.

Also, on Technet, a document has been published that describes best practices how to design storage for various needs: high-availabilty, high capacity, low cost, ...
Certainly very interesting to read: Storage Design

Domain Functional Levels: Overview

In connection to my previous post about the "AD Design Best Practices" and the project I worked on, the Domain Functional Level is a very important factor to choose which has major impacts on the domain.

I often get asked what the differences are between the different levels and, also in the classes I teach. Now except for the obvious ones: universal groups, group nesting and Kerberos authentication, I don't know the other improvements by heart.

If you want to know all the differences between the functional levels, here is a nice short overview table: