There often arises a need to figure out what may have changed on a system, either due to a specific issue or even to compare the difference between two systems. Today I would like to introduce you to the Windows System State Analyzer utility. Unless you are a developer or tester, you probably have never heard of this tool, as it is part of the Windows 2008 R2 Logo Software Certification and Windows 2008 R2 Logo Program Software Certification toolkits.

The basic functionality of the System State Analyzer tool is to allow you to compare two snapshots taken at different points in time. This allows you to compare the state of a machine both before and after an application install for instance.

Ask the Performance Team

Mike here again to help bring clarity to something we are seeing with Windows Server 2008 R2 and existing Group Policy central store. Before that discussion, let us cover some background information.

ADMX Files and the Group Policy Central Store

Microsoft introduced the ADMX file format with Windows Vista and Windows Server 2008. This XML-based file format replaced the token-based ADM file format used by earlier versions of Windows to define administrative templates. Group Policy uses administrative templates to represent registry-based policy settings that appear when editing Group Policy. The content included in administrative templates describes the user interface used by Group Policy editors and registry locations where Windows stores policy settings. Windows Server 2008 R2 and Windows 7 provide a new set of administrative template files in the ADMX format.

Ask the Directory Services Team : Windows 7, Windows Server 2008 R2 and the Group Policy Central Store

Consider the following scenario.  You have an Internet Information Services (IIS) 6.0 web server running on Windows Server 2003 Service Pack 2.  The Microsoft update KB973917 gets installed on the server.  After installing KB973917, the IIS 6.0 application pools cannot start up successfully.  An inspection of the event logs show that the IIS worker processes are terminating unexpectedly, showing event messages similar to the following:

Event Type: Warning
Event Source: W3SVC
Event Category: None
Event ID: 1009
Date:  12/9/2009
Time:  10:55:01 AM
User:  N/A
Computer: WEBSERVER01
Description:
A process serving application pool ‘DefaultAppPool’ terminated unexpectedly. The process id was ‘1234′.
The process exit code was ‘0xffffffff’. 

Internet Information Services 6.0 may not function correctly after installing KB973917

Are your file servers full of stale data slowing down your backups and taking up valuable space? Do you have no time to figure out how to deal with it or which piece of software you need to buy to do it for you? In Windows Server 2008 R2, this is a 5 minute job and requires no extra software.

The File Server Resource Manager (FSRM) has long been a tool to help IT administrators manage their storage allocations. In Windows Server 2008 R2, FSRM has become even more powerful with the addition of File Management Tasks. Simply setup the FSRM Role Service (part of the File Server Role) and navigate to FSRM’s File Management Task section.

The Storage Team at Microsoft – File Cabinet Blog : Dealing with stale data on File Servers

I wanted to call your attention to four new blog posts this morning from Nir Ben Zvi (Senior Program Manager Lead, Microsoft File Server Team) and Matthias Wollnik (Program Manager, Microsoft File Server Team) introducing the Windows Server 2008 R2 File Classification Infrastructure (FCI). This new Windows feature, highlighted in today’s keynote during TechEd 2009, allows you to define classification properties, automatically classify files, automate file management tasks (like file expiration) and generate reports that show the distribution of these properties on the file server. The File Classification Infrastructure also provides a great opportunity for partners to extend these out-of-the-box abilities, including the possibility of seamless integration of multiple partner solutions.

Check all the details at:

• Windows Server 2008 R2 File Classification Infrastructure – Managing data based on business value
  http://blogs.technet.com/filecab/archive/2009/05/11/windows-server-2008-r2-file-classification-infrastructure-managing-data-based-on-business-value.aspx
• Classifying files based on location and content using the File Classification Infrastructure (FCI) in Windows Server 2008 R2
  http://blogs.technet.com/filecab/archive/2009/05/11/classifying-files-based-on-location-and-content-using-the-file-classification-infrastructure-fci-in-windows-server-2008-r2.aspx
• Dealing with stale data on File Servers
  http://blogs.technet.com/filecab/archive/2009/05/11/dealing-with-stale-data-on-file-servers.aspx
• Customizing File Management Tasks
  http://blogs.technet.com/filecab/archive/2009/05/11/customizing-file-management-tasks.aspx

If you are attending TechEd 2009, be sure to pay Nir and Matthias a visit in the File Services booth, attend the session "WSV329 – Managing Cost and Mitigating Risk on File Servers" on Thursday at 4:30 PM and check the hands-on lab "WSV13-HOL – How to Reduce Cost and Risk on File Servers Using the New File Classification Infrastructure".

Jose Barreto’s Blog : Windows Server 2008 R2 File Classification Infrastructure (FCI) at TechEd 2009

1. Deploy the Windows 7 OS in an automated, repeatable pattern
2. Reduce the headache of application deployment by using a combination of Windows Application Virtualization (App-V) and Windows Presentation Virtualization (Terminal Services)
3. Create a new AD Structure so that we can change the way we deploy group policy
4. Use the new User Migration utility to migrate user settings while keeping the files local to the pc (no more copying to the network and back down when the image is complete)
5. Leave Citrix. The value add of Citrix has been reduced with each new Microsoft release as you get more and more of the functionality built-in to Windows.
6. Deploy DirectAccess on Server 2008 R2 to manage clients remotely and provide a consistent experience.
7. Deploy Forefront Sterling

So far, we are focusing our initial efforts around a consistent experience for IT Administrators, as this is our first test group. Here is the scenario I envision:

1. Our image administrator makes enhancements to the base image of the OS.
2. I boot my laptop (or desktop up) and the user migration tool runs and partitions a space for all of my local settings and files
3. The new image is put on the computer
4. The computer is joined to the domain
5. The computer uses group policy to configure OS Settings and Preferences, and deploy a minimum number of apps (I am mainly thinking infrastructure type apps here, like the App-V client of Forefront Client Security)
6. App-V is used to stream down any app that I might run while disconnected (Like Visio, or VLC Media Player)
7. All of my administrator consoles and applications are delivered as TS RemoteApps with icons on the Start Menu. Any app that would be useless to me when disconnected from the network (Like AD Users and Computers or Group Policy Manager) would be published as a seamless TS RemoteApp
8. One off software that I installed manually would need to be re-installed manually, but all of these setup files would already be on my computer because I would have migrated the installation source from the old pc.

Once we are happy with the IT Administrator First Install Experience and the IT Administrator Rebuild Experience, we will focus our efforts on the end user experiences.

When you use the fully qualified domain name (FQDN) or a custom host header to browse a local Web site that is hosted on a computer that is running Microsoft Internet Information Services (IIS) 5.1 or IIS 6, you may receive an error message that resembles the following:

HTTP 401.1 – Unauthorized: Logon Failed

This issue occurs when the Web site uses Integrated Authentication and has a name that is mapped to the local loopback address.

To work around this issue, use one of the following methods.

Method 1: Specify host names

Note We recommend that you use this method.
To specify the host names that are mapped to the loopback address and can connect to Web sites on your computer, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. In Registry Editor, locate and then click the following registry key:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

3. Right-click MSV1_0, point to New, and then click Multi-String Value.
4. Type BackConnectionHostNames, and then press ENTER.
5. Right-click BackConnectionHostNames, and then click Modify.
6. In the Value data box, type the host name or the host names for the sites that are on the local computer, and then click OK.
7. Quit Registry Editor, and then restart the IISAdmin service.

Method 2: Disable the loopback check

Follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. In Registry Editor, locate and then click the following registry key:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

3. Right-click Lsa, point to New, and then click DWORD Value.
4. Type DisableLoopbackCheck, and then press ENTER.
5. Right-click DisableLoopbackCheck, and then click Modify.
6. In the Value data box, type 1, and then click OK.
7. Quit Registry Editor, and then restart your computer

You receive error 401.1 when you browse a Web site that uses Integrated Authentication and is hosted on IIS 5.1 or IIS 6

Upgrade Plugin
Downloading update from http://downloads.wordpress.org/plugin/download-monitor.2.2.3.zip
Unpacking the update
Removing the old version of the plugin
Could not remove the old plugin
Plugin upgrade Failed

With some help from Patrick Burch, I found out this can be fixed by providing Physical Path Credentials in IIS. In previous versions of IIS, you could only use this feature when using UNC paths. It mainly existed as a way to connect to a virtual directory on a remote machine using a fixed set of credentials. In IIS 7, this feature was expanded so that it could also be used with local directories. I have searched for a good security guide on IIS 7 with WordPress, but most of what I have seen is geared towards WordPress on Apache. So, I have played around with a couple of settings to try to enable one click plugin upgrades while at the same time keeping a secure configuration. 

DISCLAIMER: I have to admit that I have not read the security guide for WordPress, and I am only mildly familiar with the new security settings in IIS 7. So there is a possibility that what I have done to fix this problem may open some kind of security hole. You must make your own determination when changing security settings on your servers. I am only reporting what worked for me to fix a specific issue. I will not be held responsible for security changes you make to your own systems.

1. Make sure your Application Pool identity is a user account (not Network Service)
2. In IIS Manager, right-click on your website –> Manage Web –> Advanced Settings
3. Click the … button in the Physical Path Credentials box.
4. Specify the account you are using for the Application Pool Identity
5. Find the wp-content folder under your web site, right click and choose Edit Permissions…
6. Go to the Security Tab, then click Add and enter the Application Pool Identity account. Give the account modify rights
7. Click OK until you have closed out of the security dialog
8. Reset IIS
9. Test plugin update

We could have given rights to just the plugins directory, but you will still need the ability to do uploads as well, so I just went with wp-content

Please feel free to comment if you are an expert on this subject and see problems with this post.

The IIS 7.0 PowerShell Provider is a PowerShell Snap-In that allows you to manage IIS7 configuration and run-time data. It gives easy access to Web-Sites, Application Pools, Web Applications, Virtual Directories, request in flight, Worker Processes and .NET Application Domains within Worker Processes.

Follow the subsequent walkthroughs. They cover the comprehensive functionality of the IIS 7 PowerShell Provider using common scenarios. It is recommended that you start with the basic walkthroughs first to understand how IIS 7.0 PowerShell Provider works.

http://learn.iis.net/page.aspx/428/getting-started-with-the-iis-70-powershell-snap-in/