Matt Rogish's questions

We have an app that is going to store and serve up a decent amount of data in S3 to a global audience where latency should be minimized. So, we've been doing tests with Amazon CloudFront and have seen favorable results.

However, we need a thin middleware layer (to do security etc.) and we'd like to put that in EC2. Due to security restrictions, this middleware layer will do the file streaming from S3/CloudFront:

S3/CloudFront -> EC2 -> Clients

We can geographically distribute the EC2 nodes (US East/West, and Ireland) but the problem is that a client in the EU would hit our US server and be fed data from there, thus rendering much of the performance benefit of CloudFront moot. I've been digging through the EC2 docs but I can't find a built-in way to get a geographically distributed version of EC2 a la CloudFront.

Elastic Load Balancing sounds like the way to go, but I can't seem to find a way with that to direct based on routing... Preferably, we'd like to keep the amount of stuff outside of EC2/S3/etc. to a minimum (for obvious reasons).

Any ideas how to do that within the EC2/S3 framework? DNS/routing tricks?

Thanks!

We have a custom trigger on a 3rd party app table to help us audit changes. Occasionally that trigger is removed. Looking thru the traces it shows that the 3rd party app is dropping it (for no good reason). The Vendor acknowledges it does this "from time to time" to ensure that no one mucks with their database and is not willing to change their app (understandable).

Okay, I get this, but we really need that trigger. Is there a way to disable drop trigger to their app login for this table/trigger? I can't deny ALTER on the database because their app does create/drop tables. Thanks!

Just curious: How do people "lock down" their network to prevent unauthorized devices from gaining network access?

Is it different in a DHCP vs. static IP network?

What about Windows AD managed?

Edit: I'm not trying to prevent anything per se. Just curious how a "secure" network should be implemented

We like to keep systems upgraded here and have an all 2008 Server Standard (with the exception of a few systems in which the vendor only supports 2003R2) fleet.

For the most part, none of the systems are particularly complex, nor do we have an overwhelming number of systems. A bunch of AD/DNS/etc. systems, some SQL Server boxes, various non-mission-critical servers, and an Exchange server.

Virtualization & HA is all done within VMWare ESX Server so we don't really find the Hyper-V stuff or OS-based clustering all that interesting.

Given that we're all comfy and cozy on 2008 and aren't really taxing the systems we have is there a real need to spend the person-power to upgrade to 2008 R2? Should we just wait the n-number of years until the next major release of Windows Server? Assume all of our hardware is relatively new and is expected to be in-service for the useful life of the hardware.

Thanks!!

EDIT: We're running XP Pro on 100% of the desktops but as they age out will be replacing them with Win7. Our group/domain policy is very simple and (in our testing) wouldn't require any changes for Win 7. No foreseeable plans to massively change our office/workstation/etc. topology.

Over the ages we've accumulated mailboxes of users who have since left the company. Due to concerns at the time (they have important stuff in the mailboxes, we need to get to it) the SOP was to leave the account ACTIVE and change the password to something that the rest of the department (or individuals) knew. They'd then connect to this account either via delegation or actually logging into it via Outlook.

This seems horrifying to me on many levels (security, efficiency, etc. etc.) and I want to get away from it in the easiest manner possible while still allowing people to view the emails, contacts, etc. stored in these accounts.

To that end, what should I do to accomplish this task?

My feeling is that I should: somehow dump the user mailbox, address book, etc as a PST or other stand-alone file, place it on a file share, and have the concerned users connect to it via that (then disable the user account and purge the mailbox).

Is that the way to go? Should I do something else? What are the steps to perform these tasks (where do I go in System Manager, etc.). Thanks!

Vanilla Windows Server 2008 x64 Standard DC (AD, DNS). I was remoting into my DC to do a bit of work and, thru force of habit, logged into the server using a regular domain account, not a domain admin. I was shocked to see that I was able to RDP into this box! Why would that be? I'm looking thru the policy and for Domain Controllers "Allow log on through Terminal Services" is "Not Defined". The user account I was using is not a member of the Domain Admins group. Is there any other policy modeling I can use to figure out why this user account was able to log into a domain controller?

SQL Server 2005 dropped a user from one of our mirrored databases after we recovered from a simple Windows-update induced restart of the machine.

I checked and the login is not in the mirror server (it is in the primary). If the system experienced a failover, would that explain why the user was removed from the user DB upon recovery back to the primary? I can't find anything in the doc that would indicate that SQL server would DROP orphaned users (http://msdn.microsoft.com/en-us/library/ms175475%28SQL.90%29.aspx). Is there anything I should look for in the logs?

Edit: Setup before failure: PRIMARY - Login OK. User in database OK. MIRROR - Login does not exist. User does not exist in database.

After failure: PRIMARY - Login OK. User does not exist in database. MIRROR - Login does not exist. User does not exist in database.

EDIT: After the recovery of a DB system after WINDOWS UPDATES reboot last week, we noticed a trigger was missing from one of our tables, as was another user. I am 100% confident this is NOT our doing (we only have two sa's and I am one of them). WHAT THE HECK IS GOING ON? This has to be a bug with SQL Server 2005 mirroring.

After much negotiation with AT&T Business (and tremendous pressure from dissatisfied BB users) we recently switched from BlackBerries to the ubiquitous iPhone. How best can we secure the data on the iPhones to help prevent a mis-placed phone from being a major problem?

I know there's the Mobile Me service that can remotely wipe the phones, but setting up and managing dozens of accounts (and PAYING for them) is time consuming, costly and not easily centrally managed.

Are there apps out there, or some other way, to help increase iPhone security when used in a business setting? Remote wipe, encryption, etc.

Thanks!!

Right now all of our network printers are funneled thru a single Windows server. The printers are then deployed to the desktops via Group Policy.

However, should this server fail then the networked printers all go "poof" and no one can print. Obviously, some sort of AD-based replication would be fantastic -- having a "warm standby" is OK but there's no easy way to re-direct the print jobs: unless we add BOTH printers to the clients, but then that's annoying "Which printer should I use, 'Main Printer on Server1' or 'Main Printer on Server2'?". For that reason I'd like to avoid end-user workarounds and hopefully handle it somewhere upstream.

Thoughts?

I've tried my servers and they don't see the patches that Microsoft has released. Usually Windows Update automatically installs them on Wednesday, so it must be something late in the day -- yet I can't find this info anywhere on either the Wikipedia page or on Microsoft's site for Patch Tuesday. Anyone have authoritative source for the time of day they are released?

The wiki discussion page for Patch Tuesday laments this as well:

"What time exactly are the updates released? I never seem to notice them till wednesday, and I see nothing as of yet (14:03 UTC) today. --Zilog Jones 13:03, 11 July 2006 (UTC)")

For a small Active Directory managed network (say 30-50 DHCP clients) should I have a domain controller (and then somehow another one as a failover) hand out IPs via DHCP or should I just let my router do it?

Just an update, fyi: We have two brand-new machines running as AD, DNS, etc. servers so we've got a nice setup going there. Just wondering if it makes sense to check the "DHCP" box on one or both of them as well, and turn it off in our router.

Drafting up an email retention policy for our MS Exchange 2003 system. Curious as to what other people have as a policy -- how many days to keep online, delete, etc. Thanks!

If I have a Windows 2008 or 2003 domain controller in a remote office (and its own AD site) that gets stolen, what sorts of things should I do to my main network or domain (if anything) in response?

The VPN is keyed off of the IP address of the network so there's nothing that would allow them to gain remote access to the primary network. I assume, at a minimum, I'd want everyone to change their passwords, but what else?

We have all of our corporate servers co-loc'd in a secure data center about an hour away that serves many Terminal Services remote apps to our local clients. We have a speedy network connection between our office and the data center and average about 99.9% uptime (during normal business hours) per year. However, there's always the opportunity for the internet to go down and thus all of our remote apps will cease to function.

Also, the remote apps must run from the data center (assume that there is a very very good reason for this that I cannot break) so placing a local copy is not possible.

Unfortunately our office is poorly wired: we only have a single "last mile" provider in town nor is it feasible to run new fiber to the building.

So, I need some short-term recovery techniques to get us thru a minor outage (lasting at most a single day). Anything more than a day and we'll go to a pre-designated off-site facility to continue operation.

We do have Cisco Client VPN capability so any IP-based network should suffice. I'd like to keep recurring maintenance costs to a minimum since it would be seldom used.

We have at most 15 people using Terminal Services and then about another 20-30 using the internet. The core requirement would be to keep those 15 people going; the rest of the office can continue to function (albeit at reduced output) without internet but if this solution can cover them that's a bonus.

I have a couple of different options that I can think of:

1. Cable modem. It's not particularly fast but it's fairly cheap to maintain on a monthly basis. Would be easy to go into the networking closet and swap out the internet to our gateway router. I don't know whether or not they'd piggy back on the same fiber to our location, though.
2. Wireless LAN. Something that uses the 3G wi-fi in the area. This seems like the most convenient but are there plans out there that don't cost $1M a month to maintain (something very cheap and then a reasonable bump up when we used it would be best) and require extensive hardware costs?
3. Satellite. Is that even fast enough to use RDP?
4. Consumer individual Wifi. What about AT&T (etc.) USB wifi cards? They are certainly fast enough to run a single user's RDP; the cards themselves are pretty cheap but the networking plans add up $$ really quick..

Is there another option I'm overlooking? What do you have for primary internet connectivity loss recovery (provided another last-mile provider is out of the question)? Thanks!!

On one (or more) of our Windows Server 2003 R2 servers the "Server" and "Workstation" services keep stopping. There's nothing in the event viewer that would indicate why (no errors). I recall seeing it once on one server but after I started the services it hasn't had any problems since. However, on one of the other servers they stop all the time.

They are in a remote data center (with a 2008 DC on-site) that is a replication site (the primary DCs are over here). The server has quad NIC's with 2 disabled, one plugged into the switch (static IP, Windows Networking enabled) and one plugged into another server (static IP, windows networking enabled, no DNS, etc.).

What sort of troubleshooting can I do to diagnose this? Any other ideas why these services would keep stopping?

Edit: All the servers are completely patched (Autoupdate is turned ON) and two separate on-demand virus scanners reported no issues. They are servers and firewalled off from the general internet so generally not much is run on them.

Right now we have about a 25-30 PC network, connected to the internet with a run-of-the-mill SonicWall Firewall/Router device. There isn't much filtering / blocking other than outgoing SMTP (for viruses etc.). I recall reading that at some point a network/company reaches critical mass and needs to send things through a web proxy/gateway... but not why!

My guess is maybe for content filtering (don't visit porn sites, etc.) and/or virus stuff (so they don't download virus infected files), but do we need a dedicated device for that? Why won't things like Cisco ASAs do the job? What other reasons would we have for doing that? How might I determine if/when we need to move to a web proxy?

Currently we have no plans of monitoring/limiting web access and each desktop has antivirus installed.

Scenario: We want to use SQL Server 2005 Standard's version of DB mirroring along with a witness server in an Active Directory domain environment. The database is fed from a 3rd party app server that cannot be modified apart from the DB connection string.

Two questions related to this:

1. How can we make the failure somewhat invisible (or at least, require less manual work) to our 3rd party app server spending as little money as possible? My thinking is set up DNS "sqlserver.ourdomain" that points to the primary and use that in the connection string. Then should it fail, we change DNS to point to the mirror and re-start the app server. Not invisible or automatic but is cheap and seems like it ought to work.
2. How do we push transactions from the secondary back to the primary after failure and re-promote the primary? This process must take into account "undoing" the failover mode in #1. Obviously if we go with the DNS option above we'd re-point DNS to the primary but how do I get the system back as before -- with the primary up to date from the mirror and the mirror demoted back to mirror?

We have a beefy Windows 2008 x64 server (4 x 4 core CPU, 32GB RAM) running SQL Server 2005 64-bit. We have a small (6GB) but very important database that is somewhat slow to access until the pages are cached in memory (the usage is very much random I/O so the odds are very low a given page is in memory and the end users complain about the initial slowness). The disks are fast enough (local 15K SAS) but I guess the app is somewhat clumsily written (it's a COTS solution) so I am wondering if there's a way to "force" a database in memory in SQL Server 2005 (2008 is not supported by the vendor, so we shouldn't upgrade to that yet) to help avoid the initial cache-filling blues?

My current method is that I run a SELECT * from each table in a script to get data pages in memory but some objects (indexes, Full text search, etc.) are not cached by this method (and modifying the script to interrogate indexes and write appropriate WHERE clauses to cache is boil-the-ocean complex).

I added an additional iSCSI SAN as a backup to our existing ESX Server storage array (homegrown, so no fancy NetApp or EMC software to manage this). Any way to automagically sync up the VM images in case the primary SAN fails? (vranger?)

We have about 12-14 Win200[3,8] servers online at a time (some VMs are transient). Most of these run some scheduled tasks. How can I get a list of all scheduled tasks running on each server and, more importantly, the domain user they are running as? We could certainly log into each server and ask, but am wondering if there's some powershell or other system to do this (or something in Active Directory?)

A nice to have would allow this to run on our Windows XP Desktops, too... Not a requirement but more of a FYI. Thanks!