Fixing SBS 2003 RWW for Console Access From XP SP3, Vista SP1 and Windows Server 2008

Sick of waiting for Microsoft to release a fix to RWW to enable Console access to SBS 2003 and any other Windows Server 2003 systems connected to your SBS network? So am I. So I’ve fixed it. Process is as follows:

Navigate to C:\Inetpub\Remote

Make a copy of tsweb.aspx

Open tsweb.aspx in your favorite editor (mine’s Notepad++)

Line 304 looks like this:

MsRdpClient.AdvancedSettings2.ConnectToServerConsole = console

 

Replace it with this:

version = MsRdpClient.Version
if strcomp(version,"6.0.6001") < 0 then
  MsRdpClient.AdvancedSettings2.ConnectToServerConsole = console
else
  MsRdpClient.AdvancedSettings2.ConnectToServerConsole = false
  MsRdpClient.AdvancedSettings6.ConnectToAdministerServer = console
end if

 

Save the changes. You can now establish console sessions to your SBS 2003 box and any other Windows Server 2003 boxes on your SBS network.

If anyone’s got a better way for displaying code in a Blogger page I’d be interested in knowing about it.

The Power of Community (Susan Bradley, You Rock!)

April was a bad month for me. My father was hospitalised on Monday 7th and I spent the early part of that week trying to help Dad work out what he was going to do after leaving hospital. My father was fiercely independent and had been living independently up until that point. Things got worse on Thursday 10th when Dad was told that his kidneys were shutting down. I'd organised a flight for Friday, but due to a bird strike I wasn't able to get there until Saturday morning. My father had passed away during my flight over on the Saturday. Renting a hire car turned out to be a painful process, but the drive from the airport to the hospital was great as I was able to recollect all the good times I'd had with my father. I've still got a great image of my father with his large black-framed glasses, thinning hair, his close cropped beard and a cheeky smile showing his broken, yellow teeth. The look he'd give after saying something pithy.

My sister had recently separated from her husband and was looking after her three children, so the task of packing up my Dad's rental place, organising the funeral and carrying out the executor role fell primarily on me. I was able to get the flat emptied, organise those tasks that needed doing locally and organising the funeral all in five days so I could get home to my 8-month pregnant wife.

During this time I still had work commitments. Most of the tasks I was able to delegate accordingly with the exception of a budget submission for a client that was going to be performing asset transfers to a new entity in their new financial year and also required moving from SBS 2003 due to the 75 CAL limit. I was recommending an SBS 2003 to Essential Business Server migration, but due to the lack of pricing details I wasn't able to come up with software licensing costs. My alternative was to price up the SBS 2003 Transition Pack as well as full priced versions of the SBS components. The Transition Pack got tricky as the SBS licenses were Open Licences with Software Assurance at Government pricing. The Transition Pack was Retail license only. As you can see this got ugly early.

In a fit of desperation I sent an e-mail to the SBS Diva, Susan Bradley, asking if she knew of anyone that would be able to assist me with working out the best transition method license-wise. Not only did Susan find me a group of people who were able to provide answers to some of the questions I was posing but she also sent me some very nice e-mails of support during the flat-clearing stage. Susan also kept an eye on the replies I got and followed up with me to ensure I was getting useful feedback. Pretty amazing seeing that I only met Susan once in person at the SMB Security Summit in Sydney last year and other communication via e-mail and blog comments.

This epitomises the power of community (and just how amazing Susan Bradley is!). Engaging with like-minded people, building relationships and helping one another. Now I'm not saying that I pretend to know Susan, but her blog demonstrates her generous nature, her attention to detail and her professionalism. Without this record I never would have sent her the e-mail asking for assistance. I sent the e-mail knowing that I could rely on the answers to be correct.

This trust is the most valuable attribute you can develop when engaging in community activities. Opinions are great as they help define you and your world view to others, but trust is developed by providing high quality and correct information. And when the information isn't correct or incomplete, then prompt apology and providing correct information is paramount to re-establish trust. On top of this consistency is important. If you look at Susan Bradley's blog you get all of this and more.

So in my roundabout way I'm really trying to publicly acknowledge Susan for her amazing contribution in what was a very difficult time for me. Susan you are a LEGEND! You are the glue for the SBS community and I thank you very much for the help you have provided me and I hope that I'm able to repay the generosity that you extended to me. If not to you directly, then to the others in the SBS community by means of paying it forward.

SBS2003 Remote Web Workplace, Console Access and That Awful /admin Change

OK, those of us that have worked with SBS2003 for quite some time tend to put Remote Web Workplace (RWW) right up there on our list of favourite SBS features.
The best feature I like is the pre-authenticated access to enable RDP proxy to the servers in the SBS network (although the use of port 4125 can be a pain behind some firewalls). The "Log on to or resume the console session of the remote computer" allows me to effectively remotely manage the server as though I was on site.

This is particularly useful when dealing with programs that require Session 0 - commonly known as console - access (for a concise description of terminal services history and session 0, see the Terminal Services Sessions: Then and Now article or the Wikipedia Terminal Services entry).
Over the last few months, I'd been finding that the Patch Tuesday reboots on the boxes I'd been RWW'ing to had resulted in hung systems, similar to what Susan Bradley's September 2006 blog entry records. Today, I saw the Ask the Performance Team's blog entry on The Reboot that Wasn't. This seemed to detail exactly what was going on with me, but I'd been enabling the "Log on to or resume the console session of the remote computer" option. So surely this wasn't my problem - or was it?
So I did some digging. I picked a Windows Vista RTM box, a Windows Vista SP1 box, a Windows Server 2003 SP2 box and a Windows Server 2008 box. I tried RWW'ing to my SBS 2003 box on each of them with the "Log on to or resume the console session of the remote computer" option set.
The results were as follows:

Windows Server 2003	Session 0
Windows Vista RTM	Session 0
Windows Vista SP1	Session 1
Windows Server 2008	Session 1

What's going on here? Shouldn't that be Session 0 for all those RWW clients?
No, not exactly. The problem we're seeing here is that the Remote Desktop Client (version 6.1) found in Windows Vista SP1 and Windows Server 2008 has dropped the /console switch and replaced it with /admin. The description of this change can be found in MSKB 947723 and also at the following Terminal Services Team Blog entry (same entry as the KB article, but with user comments). This change also extends to the programmatic interfaces that RWW uses.
As I commented in the Terminal Services Team Blog entry, this change was unwarranted, as the /console switch could have been left alone and have the code handle graceful fallback from the security-enhanced console access in Vista SP1 and Windows Server 2008 to the Session 0 access in Windows XP and Windows Server 2003.
So, the Terminal Services team has broken console access from RWW. Doesn't say much for the QA process when an entire product feature that relies on the Remote Desktop Client isn't tested for regression.
So what can be done to mitigate this? Well, you can use something like CopSSH on the SBS box and ssh to it, then use an ssh tunnel to connect to the SBS box using RDP (a how-to guide can be found on this Remote Desktop and SSH page). Or you can allow direct RDP access to the SBS 2003 box, which is very useful if you're running the Premium Edition and using ISA Server as you can leverage the ISA Server lockdown mode - which means you get RDP access when ISA's in lockdown and you can also tighten up RDP access to a restricted set of computers when ISA's running normally. For Standard Edition, or non-ISA Premium Editions, RDP restriction should be done by your firewall device.
For a hardware solution, something like an iBoot remote power management device might be useful to help with those hang on shutdown problems.
Anyway, patching over RWW can be problematic - see the Repeat after me.... you don't patch over RWW blog entry and the Some months you can't patch over RWW blog entry for some reasons why patch over RWW is bad.

Small Business Server 2003 - The Dreaded 5 CAL Reset Issue

A runaway process on SBS2003 decided to fill up all the disk space on C: in the early hours of the morning. The fallout from this was the System log was corrupt and the SBS license data was reset to the default 5 CALs.
The System log was easy to fix - reboot the server.
The SBS license data was an absolute pain. I'd never run the "Back up licenses" utility in the Licensing section of Server Management. Microsoft have KB article 888818 discussing this, which is either re-enter the licenses, restore the C:\WINDOWS folder or restore a backup of the licenses.
The first wasn't an option as I was offsite and the person with the key to the safe wasn't in. The second was just not viable - why Microsoft couldn't specify which file/folder needed restoring I don't know. The third would have been OK if ever I had run it.
After much stuffing about I found that the SBS2003 licenses are kept in the licstr.cpa file in the WINDOWS\system32 folder. Thankfully, Microsoft actually keep an automatic backup of this in autolicstr.cpa. The simple process was to stop the License Logging Service, rename licstr.cpa to licstr.cpa.old, then copy autolicstr.cpa to licstr.cpa. After this I started License Logging Service and used Server Management to confirm that the licenses had been restored.