Posts

Office 2013 Activation error of death solved!

O365 Office 2013 Activation error code 0x8004FC12

This is something that has been annoying me for a while.  It only happens on my home computer and will not go away.  I’ve tried reinstalling setting up new profiles, un-associating my personal O365 account, repairing Office.  I even gave up and started using Office 2010.

The problem doesn’t occur on any of my other Windows 10 machines, yet a search on the Internet shows I’m not alone.  All the forums show frustrated people trying everything, only to end up being told to reinstall a clean copy of Windows 10 (uhh…no).

Luckily, on a tangent day, I decided to check up on the error messages.  To my surprise, I found a promising Microsoft article:

Are you ready for Windows 10?

Recently we started disabling the Windows 10 pop-ups for our MSP clients. We just feel that Windows 10 isn’t ready for the corporate environment. There are a few troubling things about it.

  • The interface. Most people can get used to it relatively quickly, but the desktop environment is more of a touch interface than prior versions.
  • Compatibly. A few days ago I saw a statement from our bank saying not to install Windows 10 for use with their software and products. This totally made sense, as from past experience getting banking and payroll software to work is very tricky.

Home users appear to be enjoying Windows 10, but they aren’t worried about making money based on their computer working. Check back soon for more to come on this topic!

Remote Desktop Services

With businesses attaining more WAN bandwidth and businesses trust with hosted services increasing, Microsoft is investing heavily in Remote Desktop Services.  Renamed from Terminal Services to Remote Desktop Services, it encompasses multiple ways to deliver application access from any location.  Below, you will find information on some of the features and requirements in an RDS deployment.

MS RDS Blog
WAN Optimization
RDP Client / Server features cross reference

Why RDS?

  1. Local-lan connectivity when using applications (e.g. Quickbooks) and when accessing the LAN resources (i.e. loading large files)
  2. Improved security for remote users
    1. Data is stored on the servers, not on laptops. This also means data is backed up consistently.
  3. New user setup is quickly done and without the need to “reimage” existing computers
  4. Portability for remote work
  5. Thin Client support
  6. Business Continuity and Disaster Recovery
  7. Green computing (more effective use of resources)
  8. Non-compliant PCs can connect with minimal security compromises
  9. Encrypted connectivity and application-level access limitation for compliance purposes or restricted access for external partners
  10. Centralize application management (updates, configuration is done in one place)

Functions

On the surface, RDS can be broken down into 2 Functions: Session Hosts and Virtual Desktop Infrastructure (VDI).  When breaking down the session hosts function further, we can include features such as RemoteApps and Remote Session Host (Terminal Services).  Similarly, VDI provides us with Personal Virtual Desktops and Pooled Virtual Desktops.

Virtual Desktop Infrastructure

Personal Desktops
This is geared for full desktop replacement deployments. The user will treat this is as their own personal computer in a VM.

Pooled Desktops
Pooled desktops are similar to deploying VMs in an academic environment. This usually means the VMs are preinstalled with generic applications and users have full administrative access to install their custom applications.  Of course, after they log off, the VM is reverted to it’s original state for the next user. An example usage would be to provide a pool of 10 Windows XP VMs for users to use intermittently due to legacy software incompatibilities.

Remote Session Host (aka Terminal Services)

Web Access – Single sign-on web portal showing RemoteApps

RemoteApp  – A more seamless integration between remote applications and local desktop

    1. Does not require Windows 7 computer to be joined to domain
    2. Updates automatically when the feeds are updated by administrators
    3. Users have to log on only once to create the connection
    4. XML – so can be used in other ways

Capacity Planning

Servers
It’s better to purchase 2 Server than it is to purchase 1 loaded with more memory. The reason is you can load balance between 2 RDS servers and the cost of smaller memory modules is a lot less than of larger ones. Scaling OUT instead of UP is more cost effective, increases Disk IO paths, and creates redundancy.

Processor
Unfortunately, adding processors isn’t a 1:1 improvement. Usually, going from 1 to 2 processors will achieve a 1.8:1 gain, while going from 2 to 4 processors will achieve a 1.65:1 improvement.
If you have each user session taking up 10% of CPU, then the server’s CPU can handle up to 10 users at full load. If you added more CPUs to get a total of 4 CPUs, it would be 10*1.8 (1 => 2 cpu)*1.65 (2 => 4 cpu) = 30 users total. As you can see, it’s not 40 users.

  • Use a processor with SLAT support

Memory
Usually, allocate about 500MB per session for a 64-bit OS. Of course, the best thing to do is to find the working set of a user’s session.

Hardware Integration

Enlightenments

This feature in Windows Server 2008, Vista+ coordinates actions with the hypervisor to make sure that they’re interacting with the hardware as efficiently as possible.  The kernel basically only asks for instructions to be carried out within the confines of it’s child partition instead of all the partitions.  It reduces wasted CPU usage.

VM integration components

These components accelerate VM access to devices.  Without it, the VM will configure hardware device drivers with the emulated devices that the hypervisor presents to it.

SLAT

AMD-V Rapid Virtualization Indexing (RVI) and Intel VT Extended Page Tables (EPT)

Although running RDS in a VM isn’t a problem, it does take up additional CPU cycles to maintain a “shadow” page table.  When this is updated in the VM, the Hypervisor has to update it’s “shadow” page table also.  This can take away precious CPU cycles that will slow down your server.  This is where SLAT-enabled processors mitigate this issue.  It maintains the address mappings in hardware, not software.  Just as hardware raid is file management using hardware, SLAT provides memory address management using hardware.  In the end, both memory usage and processor overhead will decrease.  This enables you to host more VM sessions by a factor of 1.6-2.5 times.  It’s highly recommended to have this for memory intensive workloads like RDS, SQL, IIS, Exchange, etc.

Improved Application Compatibility

  1. MSI package installation – Prevention of simultaneous first-time uses of applications based on MSI installs from blocking each other
  2. Dynamic Fair Share Scheduling – A better way of preventing a single session from starving other sessions for processor cycles
  3. IP Virtualizaton – Allows a session or application within a session to have a unique IP.  Applications with requirements of a discreet IP address can be used.

High-Fidelity User Experience

  1. True multi-monitor support, including varying layouts and landscape/portrait orientations
  2. Aero remoting for single-monitor sessions on Windows 7
  3. Cilent-side rendering of multimedia and audio Windows Media Player files
  4. Improved display of video from Silverlight and WIndows Media Foundation
  5. Bi-directional audio remoting, including sound recording to a remote session

Troubleshooting/Debugging BSOD errors

What happens when you get a Blue Screen of Death (BSOD)?  I’m sure almost everyone just says something like “____ Microsoft!”  Unfortunately, most of the time, you would just be using Microsoft as a scape goat.  Why?  According to Microsoft and other gurus, about 70-80% of crashes are caused by 3rd party drivers.  Yep, all those great toys you have hooked up to your computer and the software that control them are most likely responsible.

I have probably just blown your mind or you are probably full of skeptism.  Hopefully these debugging techniques can make you a believer….

Step 1:  Disable auto-reboot on a crash

Step 2:  Create a memory dump versus a Mini crash dump..  This will allow you to get more information from the dumps.

Step3:  Install Windows Debugger tools

Step4:  Set environment variable to automatically download symbols from the Microsoft symbol servers (WinDBG->Source Symbol Path->”srv*C:symbols*http://msdl.microsoft.com/download/symbols”)

Step5: Open the crash dump file located in C:Windows or C:Windowsminidump

Step6: Run “analyze -v” to get list of drivers in the stack text.  If the driver points to one of the Windows core system files (ntoskrnl.exe, win2k32.sys, etc), then you probably have to dig a little deeper.

Step7: Additional helpful debug commands to run to find the culprit

kv – Looks at stack of current thread.  This is used for misdiagnosed analysis.  Look for suspicious drivers

lm kv – Shows version information (dates, etc) of currently loaded drivers to find updates for.

!vm – Check pool usage (if close to maximum, then it’s a leaky driver)

!thread – looks at currently running threads

!process 0 0 – summary level display of processes during crash

!irp <irp from IRP List from !thread> – Associates drivers thread (it’s a hint to investigate)

!poolused (needs to enable on xp and earlier) – Use with Strings

!deadlock

 

 

Debugging mode (F8) – Use when no crash dump created…, needs to connect using usb (modify boot.ini) or serial from another system running windbg

Windbg – File->Kernel Debug

Debug -> Break to connect to crashed system

.dump (saves dump information)

 

Hung system troubleshooting (computer freeze)

– Use crash on control-scrl-scrl (registry setting)

– Check other processors on multiple processors

lm kv <driver name from stack>

Windows Server 2008 SSL VPN (SSTP)

Now-a-days, every business is mobile, which means a VPN connection is most likely needed.  The problem is when clients travel to hotels or other countries, where firewall compatiblity and configuration can cause connectivity issues.  Fortunately, there is an answer for this: SSL VPNs.  Since an SSL VPN connection is secure and allowed on almost all firewalls, remote users will have a much more reliable connection mechanism; no matter where they are.  To top it off, SSL VPN (SSTP) is a feature natively bundled with Windows Server 2008.  How cool is that?

How does SSL VPNs help?

  • A NAT device doesn’t need to support PPTP in order for it to work.
  • Specific ports aren’t required to be open on the firewall (think hotels and other countries).
  • Connectivity can be made through web proxy servers.
  • The small footprint VPN client is easily accessible.

Clients supported: Vista SP1+, Windows 7, Windows Server 2008

What are the high level steps involved to setting up Windows Server 2008 SSL VPN connections (SSTP)?

  • Obtain a certificate to be used for your connections (just as if you are installing an SSL certificate for your website)
  • Install IIS on the VPN server
  • Request a certificate for the VPN server using the IIS Certificate Request Wizard
  • Install the SSL certificate
  • Install the RRAS server role on the VPN server
  • Enable the RRAS Server and configure it to be a VPN server
  • Configure the User Account to allow dial-up connections
  • Update DNS (ie. vpn.company.com)
  • Configure the Client to use SSTP and Connect to the VPN Server using SSTP

How-To configure Windows 2008 for SSTP VPN
1.  Install IIS on VPN server with all security settings marked for installation
2.  Create a Certificate Request in IIS console
a.  Make sure common name is actual Internet Hostname clients will connect to (e.g. vpn.company.com)
3.  Cut and Paste the certificate request into your SSL provider’s website
4.  Install any Intermediary certificates and your SSL certificate per your SSL provider’s instructions (DO NOT bind the certificate to a website in IIS)
5.  Install Routing and Remote Access
6.  Load the Routing and Remote Access MMC and run the wizard to enable it (Select Custom -> VPN if you are using only 1 NIC)
8.  Enable Dial-In access for the remote user’s AD account
9.  Enabled SSL connection (port 443) from the outside
10. Update DNS for the domain with the common name of the certificate
11. Test the SSL VPN connection by choosing SSTP in the vpn network connection properties

If the connection doesn’t work, make sure the proper certificate is bound following:
1.  Make sure the right certificate hash is bound (netsh http show  ssl)
a. If necessary, delete and readd the correct certificate binding…
1. Remove binding from IPv4 (netsh http delete ssl 0.0.0.0:443)
2. Remove binding from IPv6 (netsh http delete ssl [::]:443)
3. Delete registry entry for the hash (reg delete hklmsystemcurrentcontrolsetservicessstpsvcparameters /v sha256certificatehash /f)
4. Add binding from IPv4 (netsh http add sslcert ipport=0.0.0.0:443 certhash=<replace with your cert hash> appid={ba195980-cd49-458b-9e23-c84ee0adcd75} certstorename=MY)
5. Add binding from IPv6 (netsh http add sslcert ipport=[::]:443 certhash=<replace with your cert hash> appid={ba195980-cd49-458b-9e23-c84ee0adcd75} certstorename=MY)

Helpful links to configuring SSTP VPN:

  • A step-by-step guide to setting up your own SSTP server is to be found here.
  • Troubleshooting help can be found here, here, and here.

The case of Windows 7 not wanting to install on your hard drive partition

As an IT Consultant, I often find myself mucking with the latest and greatest things before I would even consider recommending them to clients.  The down side to this is the time spent during a Saturday afternoon trying to install Windows 7 Professional 64-bit on my home desktop.  I was so impressed with the RC1 version, that I wanted to deploy it to my single desktop (can’t be worse than Vista… heheh)

Apparently, Windows 7 is very picky about the hardware/harddrive/partition/MBR it’s installed on.  When I ran the installation, my hard drive and the system partition would be displayed, but I could not get it to actually start the installation..

I tried the following, but to no avail:

  • Installed latest drivers
  • Deleted partition
  • Reformatted newly created partition
  • Removed external hard drive and USB key so the only thing left was a single 200GB HD and an IDE cdrom.
  • Using diskpart to set the new partition as an ACTIVE partition

Looking at the setup logs (Shift-F10 -> notepad windowspanthersetupact.log), I saw a bunch of “not system disk”, “not primary partition”, “not enough space”, “not good enough” errors…

Finally, I tried to think outside of the box.  I decided to repair my MBR and Boot record the old fashion way.  I booted off a Windows XP SP2 CD and ran the recovery console.  Once in, I ran “fixmbr” and “fixboot”.  I then rebooted into Windows 7 setup and was able to click Next to continue with the Windows 7 Professional installation.

Hopefully, this technique would work for most of you.  If it still doesn’t work for you, try making sure there’s no USB keys or any other storage device connected when you install.

What does Server 2008 SP2 and Vista SP2 have to offer?

Below is a quick rundown of all the goodies in the new Service Pack for Windows 2008 and Windows Vista.  Of course, SP2 includes all hotfixes and other updates post SP1, but unlike traditional methods, Windows Server 2008 SP2 and Windows Vista SP2 uses the same Service Pack executable, which makes it easier to deploy.

Although this update provides minimal changes, it’s always recommended to do a test rollout before deploying in full.

Warning:

This was taken from Information about Service Pack 2 for Windows Vista and for Windows Server 2008

After you install SP2, a sound device or some other hardware device may no longer work. If this behavior occurs, just install an updated driver for the device. To do this for a sound device, follow the steps in the following Microsoft Knowledge Base article:

948481 How to troubleshoot sound problems that you experience after you install a Windows Vista Service Pack

What it has to offer:

  • Bluetooth 2.1 Support
  • Wi-fi – Uses Windows Connect Now technologies for wireless connectivity and improves on resuming wireless connectivity from a sleep state
  • Power Management – Microsoft touts a 10% increase in power management efficiencies
  • exFat file system extension – Now includes UTC timestamps which helps with file synchronization across time zones
  • Blu-ray data burning capability – Not for making movies, but for backing up files
  • Windows Search 4.0 – faster, better support for Group Policy, able to index encrypted files
  • VIA 64-bit processor support

Windows Server 2008 offerings:

  • Hyper-V 1.0 versus a prelease version
  • Addresses Terminal Server license key issues

Most useful part about SP2:

Service Pack Clean-up Tool (compcln.exe) – Deletes older versions of the RTM and SP1 based files

Requirements:

SP1 has to be installed prior to updating.

Where to get it:

Windows Server 2008 SP2/Vista SP2 (x86, 32bit)

Windows Server 2008 SP2/Vista SP2 (x86, 64bit)

Microsoft Office 2007 Service Pack 2 – Briefing

Backgrounder:

Like everything Microsoft, downloading and applying updates and patches are the key to keeping your computer running efficiently.  Today, we are focusing on Microsoft Office 2007 Service Pack 2.

It has been more than a year (December 2007) since Microsoft has released a single service pack to keep computers up-to-date without having to download a bunch of little patches.  This significantly reduces deployment times for any oganization.  Furthermore, while most service packs are just a compilation of previous released patches and fixes (through February 2009), Office 2007 SP2 will also include feature enhancements and performance enhancements.  Will the PDF support mean the end of downloading Acrobat Reader?  We’ll see…

Release Date:

End of April 2009.

Changes, Fixes, Patches, Enhancements:

  • Support for Open Document Format (ODF), XML Paper Specification (XPS) and Portable Document Format (PDF).
  • Improved Outlook Calendaring reliability.
  • Improved Outlook performance.
  • Enabling Object Model support for Charts in Microsoft Ofice PowerPoint 2007 and Microsoft Office Word 2007.
  • Improved cryptographic functionality by supporting all cryptographic algorithms offered by the operating system.
  • Improved functionality in Microsoft Office Excel 2007 charting mechanism.
  • Ability to ungroup SmartArt graphics (and as a result, the ability to add animations to them in PowerPoint 2007).
  • Ability for Visio 2007 to export UML models to an XML file compliant with the XMI standard.
  • Tool that enables the uninstallation of Office client Service Packs

Where can you get it?

Direct File Download Link

Downloads page link

Release info link

What can Windows Server 2008 do for you?

I know there are many websites that lists a bunch of features of Microsoft’s latest Windows Server 2008.  I also know that these lists sometimes forget the fact that technology in the workplace is only as good as the business value benefited from it. I understand that during these tough economic times, migrating and upgrading your systems to Windows Server 2008 will be an option that is heavily scrutinized.  Hopefully, this blog entry will help you create an informed decision for your business.

Below are the features that stand out to me when deploying Windows Server 2008. I will try to explain how these features can translate to a more secure, efficient, and stable network.

Active Directory

  • Restartable Active Directory Domain Services (RADDS)
    Essentially, this increases uptime for a domain controller and it’s installed services. Currently, when security patches must be applied, offline defragmentation or authoritive restores must be performed, the entire server has to be rebooted.  This equates to significant downtime for ALL the services provided by the server. If this was a heavily used server, such as a file server, a lot of users would end up calling the IT department.Scenario:

      Lets say an Active Directory object needs to be restored from backup. Previous to Windows Server 2008, a server would have to be restarted in Directory Services Restore Mode.  During this time, ALL services provided by that server would be offline. Then, once the restore is complete, we must restart the server again. Now, with RADDS, you only need to stop the service, perform the restore, and restart the service.  Meanwhile, your other services are still working.

Translated Value:

    Increased uptime, Simplified restoration of Active Directory objects.

Business Circumstance:

    This is useful for all businesses.
  • Read-Only Domain Controller (RODC)
    Back in the good ‘ol NT4 days, Microsoft had primary and backup domain controllers (PDCs and BDCs).  The backup domain controllers would be Read-Only.  Then, they touted the multi-master capabilities of Active Directory for Windows 2000/2003. What they didn’t tell you was the best solution was “C. All of the Above“. In Windows Server 2008, we can have multi-master domain controllers AND read-only domain controllers. When would you use either of these scenarios?  Well, you would want multi-master replication for Fault Tolerance and Management Simplicity.   Now, an RODC would allow for increased security since the LDAP database can not be tampered with. Unfortunately, there are limitations that might negate the benefits of this.  Essentially, the RODC needs to have access to a writable Domain Controller in order to perform basic functions, such as DNS updates, password changes, and user authentication (if not cached on RODC). There could also be software compatibility issues.Translated Value:

      This is a feature that’s great to have, but wouldn’t benefit an existing organization tremendously.

Business Circumstance:

    This is most useful for medium/large businesses with multiple locations.

OS Enhancements

  • NTFS Self-Healing
    As with previous operating systems, when a file on the NTFS filesystem becomes corrupt, there’s no way to know unless you a) run chkdisk b) try to open the file.  Of course, if you periodically run chkdsk to detect corruptions or try to open a corrupt file, you would have to reboot your server to fix it. This is not the case with Windows Vista and Windows Server 2008.  In 95% of the cases, it will automatically detect a corruption in your filesystem and attempt to fix it at the same time.  This eliminate the need to reboot.  I’m sure everyone knows the disadvantages of having to reboot a computer by now (read previous sections).Translated Value:

      Higher uptime, important data is recovered

Business Circumstance:

    This is useful for all businesses.
  • Server-core
    Everyone can agree that Microsoft has it’s GUI advantages over Linux, while Linux has it’s high stability and security aspects due to it’s lack of “fluff”.  Well, as Linux tries to enter the Desktop market, Microsoft is trying to imitate Linux with Server-core. IT provides a minimal (non-GUI) OS environment for running specific server roles, which reduces the attack surface for those server roles.  Similar to Linux, in which you would manage your server from an SSH connection, Server Core could be managed from the local command console, Terminal Server connection, or using the MMC console. Once again, Server-core can only provide a subset of the full roles available to a full installation.  Server-core can provide the following roles: Active Directory Domain Services (AD DS), Active Directory Lightweight Directory Services (AD LDS), DHCP Server, DNS Server, File Services, Print Services, Streaming Media Services, Internet Information Services (IIS), Windows Virtualization.Translated Value:

      Increased security and performance gains, and ease of deployment due to low footprint.

Business Circumstance:

    This is most useful for medium/large businesses with multiple locations.
  • Terminal Services Gateway (TS Gateway)
    Lets say you had to remotely connect to multiple servers at the Office, yet you are prevented from using a VPN connection. What do you do?  Well, there are many ways around this, including the use of 3rd party applications, but Microsoft has blessed us with their solution. A TS Gateway securely proxies applications running the RDP protocol (Remote Desktop, Remote Applications, etc..) through SSL encryption.  This negates the typical firewall configurations necessary to allow VPN tunnels to be created.Translated Value:

      Mobile Office is even more robust. You can truly access your servers and workstations from anywhere.

Business Circumstance:

    This is most useful for businesses running Terminal Services or those with lots of servers.
  • Terminal Services Remote Application (TS Remote Application)
    Aligned with their virtual application technology, TS Remote Application uses the RDP protocol to allow users access to specific applications stored on a server. Instead of using more computing resources than necessary and  providing access to an entire Desktop, users can now be limited only to the capabilities of the application. Advance connection policies can be set in place to maintain compliance with security policies set within the company.Scenario:

      Accounting staff requires access to the Quickbooks server when they are offsite.  Using a VPN connection alone is not an acceptable solution since the data transfer size is too large. The use of Remote Desktop through a VPN connection would work, but that can cause unecessary confusion for users. With TS Remote Application, the Quickbooks application RDP file can be exported on a users’s desktop.  When they run the file, either locally or remotely, they will see the Quickbooks applications open on their computer. This application is actually running on the remote computer, but the interface is exactly the same as if they opened it locally on their computer.

Translated Value:

    Granular access to applications, secure access to network resources, improved capacity and performance for Terminal Services applications

Business Circumstance:

    This is most useful for businesses running Terminal Services or those with lots of servers.
  • Windows Deployment Services (WDS)
    This service allows is the needed replacement for Remote Installation Services (RIS). Windows Deployment Services enables you to deploy Windows operating systems, particularly Windows Vista, using images and PXE booting. I know there are 3rd party applications that provide this capability in a more simplified manner, but they are often too costly. Once setup, WDS is a pretty cool application.  It works well and have few heart-stopping limitations.Translated Value:

      You can setup new Microsoft workstations quickly and in an automated way.

Business Circumstance:

    This is most useful for new businesses or ones that are growing in the near future.
  • Hyper-V
    Here’s the deal.  The IT industry is realizing that on average, the load on a server is pretty low due to minimal resource usage and advancing. This results in wasted Energy Costs and lower Return on Investment (ROI) in the hardware. Hyper-V is a hypervisor-based virtualization technology that allows servers to run multiple instances of Microsoft and certain Linux distributions. What is sometimes overlooked when it comes to virtualization is the ease and consistency in obtaining a solid backup and recovery of files using snapshoting technologies.  Also, the management of these virtual servers are simplified since there is only one platform to work off of.Translated Value:

      Increased efficiency of resources, increased stability, reduction in cost for new server deployments, High availability, increased security.

Business Circumstance:

    This applies to all businesses.  From consolidation to saving on energy costs, virtualization is beneficial for all businesses.

Windows 2008 Server – Easily Secure your FTP server

Today, it’s all about security. If you aren’t practicing good security, you are probably going to be held accountable for the information that sneaks into your network, and especially the information that can find its way out of your network.

Script kids and hackers alike all begin their first “hacking” by targeting what’s easy – The poor, unsuspecting FTP server. All day long, doing its job of blindly sharing and accepting files. Here are the four key parts of FTP (and its cousin Telnet) that make it insecure.

  • Clear-text transmission: all communications are done in clear text, including usernames and passwords
  • Weak client authentication: both FTP and Telnet authenticate users through usernames and passwords, which, time and time again, have proven to be unreliable authentication methods. There is no support for more advanced authentication methods such as public/private key, Kerberos or digital certificates
  • No server authentication: this means that users have no way to be sure that the host they are communicating with really is the FTP server and not an attacker impersonating the server
  • No data integrity: problem here is that, assuming the same scenario as above, anyone could alter and corrupt the data being transmitted between the server and the client without being noticed

So you have your brand new shiny server with tons of disk capacity, and a clean install of Windows 2008 Server. You’re tasked with setting up the new company FTP site. If you have experience with setting up IIS and FTP services on Windows 2000/2003 server, then you know exactly how easy it is to setup FTP service. With Windows 2008 server, securing your FTP server became just as easy. And the benefits, immense!

Windows 2008 Server utilizes the method FTPES aka FTP Explicit mode. In explicit mode, an FTPS (FTP Secure) client must “explicitly request” security from an FTPS server and then step-up to a mutually agreed encryption method (usually the minimums are defined on the server). It currently isn’t packaged onto the Windows 2008 server install media, but information and the download can be found here http://www.iis.net/downloads/default.aspx?tabid=34&g=6&i=1619
Without this extra handshaking and communication, your server-to-FTP client communication is susceptible to snooping and hijacking. With these simple steps, your server avoids the pitfalls listed above, that plague many FTP servers out on the web.

Securing your new Windows 2008 based FTP server comes down to these steps:

  • Make sure your users and clients have a current FTP client that supports the few FTPSecure methods.
  • Install IIS7 on your Windows 2008 Server
  • Install the required Microsoft extras (all available on the “roles” menu) for Microsoft FTP Publishing Service for IIS 7.0.
  • Install the Microsoft FTP Publishing Service for IIS 7.0 update. Now you’re nearly 80% complete
  • Create and apply security ACL’s to your FTP repository. The top 10 rules that very much still apply today are published at http://www.windowsecurity.com/articles/Secure_FTP_Server.html
  • Create a self signed server certificate, or purchase a server Certificate and import.

Tada, you’re done! Now your Windows 2008 FTP server is protected. From beginning to end, Connection, Authentication, Authorization, Data Request, Data transfer. It’s all encrypted.