• Deploying Windows 7 – Part 5: MDT 2010 Enhancements (from WindowsNetworking.com)
• Windows 7 Deployment Class from author of DeployVista.com (a blog with more deployment info)
• The Deployment Guys (Microsoft Technet Blog)
• MDT 2010 Webcast (a webcast from the Deployment Guys blog above)

First I downloaded MDT 2010 from Microsoft, installed it and then opened the Deployment Workbench. You’ll need the AIK (Automated Installation Kit) for Windows 7 as well for some of the steps later, which is huge (1.7 GB), so you might as well get that started downloading now, too.

What I did to learn is I found some Microsoft pages with info on MDT and some videos that showed the basics, and I watched/followed one of them, but I don’t recall exactly which video it was that I found. You don’t want to focus on the AIK, I did a while back and it’s more for OEMs like Dell making system images for presale. Similar tools; the MDT uses AIK but has the Workbench that you do most stuff from (or that I did most stuff from :-)

I did read the help in Workbench a lot, and did some Googling, plus that walkthrough video that I can’t seem to find. The documentation built-in to MDT is actually pretty good, I recommend digging in. The basic idea is you need to know what steps to go through in the Deployment Workbench. You aren’t necessarily creating an “image” for deployment as you are making the installation more automated, providing install media from a network share and also packaging some applications with silent installs together. You can optionally build a Windows 7 box, capture it with ImageX, and pull that into MDT to deploy (with or without additional applications installed during deployment) but I didn’t go that far, I’m using a stock Windows 7 Enterprise image (I imported both the 64-bit and 32-bit install discs).

Basically in MDT, you go to Deployment Shares, and create a new one. You’re basically creating a network share that will hold all the install files. You take the Windows 7 DVD for example, and Import it into the Operating Systems “subfolder” of the Deployment Share you create within MDT, and it copies the disc into a subfolder of that share for you and lets you set some properties and name the image. I haven’t done so, but there’s another folder called Out-of-Box Drivers you can import drivers into for your specific hardware.

As for application install after deployment, there were two applications I couldn’t get to install silently and thus won’t work to be installed automatically. Those two apps were iTunes and Shelby v5 (our Church Management System). Shelby doesn’t have a silent install option but it’s easy to manually install afterwards. iTunes is supposed to pass your arguments to it’s .exe installer into the .msi files inside, but it failed for me every way I tried it (always left some component uninstalled) so I gave up. You can use 7-Zip to extract the iTunes install file into it’s component .msi files and manually install them (careful of the order) if you want, which works but is “unsupported” by Apple (not that I’ve ever contacted them for support). For now, I’m not installing iTunes automatically either. I spent a few hours on iTunes so I’m pretty confident of how messed up it is :-)

In general, anything you can install silently with command line arguments will work, and anything else won’t. For Adobe Reader, I downloaded Adobe’s Customization yep Reader works fine; I actually used the Adobe Customization Wizard to make an .mst (MSI transform) and install the version with the transform so my preferences are applied and the transform automatically specifies a silent install (based on how I configured it in the wizard).

Within MDT’s Deployment Workbench, inside your Deployment Share’s Applications folder, you add applications that you want to be able to select to install during each deployment. You can create folders to organize the applications (as they display for you to select during deployment), and you can show or hide applications as you wish. You can also crate Application Bundles, which basically install a group of other applications you’ve already defined. You can use both features together to create applications but hide them (even in their own folder, like “Linked Only” or “Bundled Only” or some such), but put them all in a bundle with one name for easy selection at install time. I also created separate folders for apps that have both a 32-bit version and a 64-bit version so I can select the apppropriate one for each system as needed.

For example, I created a Mozilla Firefox application, and one each for Adobe Flash 10 ActiveX and Plugin versions (you must complete a licensing agreement just as for Adobe Reader to get the .msi versions of the ActiveX and Plugin versions of Flash for deployment like this). I hid them and put them in a subfolder, but created a “Firefox and Flash Player” app in the root that is just a Bundle that installs all three at one time, and it works great.

The Deployment Share has another “subfolder” in the tree called Task Sequences. You’ll want to create a Task Sequence for each OS (one for 32-bit and one for 64-bit in my case), giving each sequence a unique number (I just started at one, then used two for the second one, etc.). Make it a Standard Client Task Sequence (the default in the wizard), select the OS version at the next step, and optionally specifiy a product key (you can enter this during deployment or after install as well). Fill out some basic organization name info and default IE homepage, then set a Local Administrator password (optional–I left this blank here and specify it at install time in the wizard as well), and click Next one last time to create the Task Sequence.

Once your apps are defined as well as your task sequences, and your operating system install images are imported, right-click on the name of the deployment share under the Deployment Shares root in the Workbench, and choose to Update Deployment Share. This wizard will create the stuff needed to actually deploy from the share, including the LiteTouch boot images (images are also created in .wim format, and I imagine you can set it up in WDS (Windows Deployment Services) on Windows 2008 (or 2003 with updates) to use PXE booting to deploy as well if you want to get into that). I’m using the boot CD method. After the Deployment Share Update completes, use Windows Explorer to browse to the deployment share folder, and then go to the Boot subfolder. You should find a LiteTouchPE_x86.iso file and a LiteTouchPE_x64.iso file as well as the .wim versions and .xml configuration files as well. Burn the .iso files to CDs (Windows 7 support right-click-and-burn for ISOs, plenty of free options for other OSes).

Now you can boot whichever version you want on a computer, and depending on the architecture version of the CD each will only give you the OS options that are compatible on the deployment share. Basically you boot to a UI from the LiteTouch boot disc that asks for username/password/domain to access the Deployment Share. The share location is all hardcoded during the Update Deployment Share process. I don’t have it in front of me and haven’t done it since Monday, but the basic steps it goes through are: It asks for computer name, and whether you want to join the domain (if you do, it prefills the same user/pass/domain you entered earlier for share access which is handy). Then you pick which OS from the list, and on the next screen it shows you a list of apps in the folders you set up earlier (this list is pulled from the share, so if you Update the share later with app changes you don’t need to burn the disc again, in case that’s not obvious). You just check the boxes of the ones you want (like I have a 32-bit and 64-bit 7-Zip app, and I have to select which. Also, my VIPRE antivirus app has two installers depending on if I want it to be in the Laptops or Desktops group by default, so I pick the right one as well).

Then hit Finish, and come back in about an hour or so depending on the system, and it’s logged in as Local Admin with a status window showing you any errors (or not) from the app installs. I just did it for a new laptop on Monday, was very easy! I still had to install some drivers since I didn’t add them to the deployment share.

Here are the apps I got to install silently: Adobe Reader 9.2, Firefox 3.5.5, Flash Player 10 (plugin & ActiveX), CDBurnerXP 4.2.7.1801, Pidgin 2.6.4, LogMeIn Free 4.0.982, RDP Enable Script (custom batch file that enables RDP and firewall hole for it), VIPRE, 7-zip, and Office Enterprise 2007 (customized with .mst). The Deployment Workbench will actually let you create an Office 2007 customization and run the wizard and everything for you right from the app properties, which is nice, though I had my own .mst already that I used. For each app I created I selected the option to create an Application with Source Files so it would copy the whole install folder to the Deployment Folder. Also, there’s some stuff you can do that lets you automatically run the USMT on XP for example, backing up user profile to a folder on the hard drive or on the network, then have the MDT deployment run USMT again restoring state after the install, all automatically…I saw it in the video I watched but didn’t get it working (I didn’t try).

Here are the silent install commands I used for the apps I got working, for reference:

Adobe Reader 9.2
msiexec /i AcroRead.msi ALLUSERS=TRUE TRANSFORMS=AcroRead.mst /quiet
Microsoft Office Enterprise 2007
setup.exe
You can use the Office Products tab when editing the application definition to customize the app, or if you already have a .mst transform, put it in the Updates folder inside the Office installation structure and it will be automatically applied, no need to pass it in as an argument.
CDBurnerXP (the .msi, available as a separate download)
msiexec /i cdbxp_setup_4.2.7.1801.msi AI_DESKTOP_SH=0 AI_QUICKLAUNCH_SH=0 AI_STARTUP_SH=0 VIEWREADME=0 /qn
Pidgin
pidgin-2.6.4.exe /DS=0 /SMS=1 /S
LogMeIn Free (I’ll leave you to get it; the way I do it it prompts for the account to join it to after install, but it’s possible to find ways to make it auto-join to a LogMeIn.com account)
msiexec /i LogMeIn.msi /qn
Sunbelt Software VIPRE Enterprise (create MSI deployment files from the console)
MSIEXEC /I SBEAgent-ProfileNameHere.msi ALLUSERS=TRUE /quiet
7-Zip 32-bit (.msi is available if you dig on their site as a separate download, default for 32-bit is .exe)
msiexec /i 7z465.msi /qn
7-Zip 64-bit
msiexec /i 7z465-x64.msi /qn
Mozilla Firefox
Firefox Setup 3.5.5.exe -ms
Adobe Flash Player 10 for IE (ActiveX)
msiexec /i install_flash_player_10_active_x.msi /qn
Adobe Flash Player 10 for Firefox (Plugin)
msiexec /i install_flash_player_10_plugin.msi /qn
Java (get the FULL OFFLINE installer here) (thanks to Justin Moore for finding this one and commenting!)
jre-6u17-windows-i586-s.exe /s ADDLOCAL=ALL

I hope that’s helpful to someone! Or maybe me in the future :-)

Also, it’s much easier for an Exchange 2010 and Exchange 2007 box to cohabitate on a network and still allow ActiveSync and OWA access than doing the same with Exchange 2007 and Exchange 2003 (which requires a separate Exchange 2007 CAS, or Client Access Server). Granted, making it work with the ISA firewall was a little tricky, but with a little experimentation it went well and is working fully. So well in fact, that only my Mac user and my Blackberry user are on the old 2007 box now until I stuff is compatible (in the Blackberry case) and I can babysit the migration (in the Mac user’s case, with Entourage–Snow Leopard isn’t an option on our PowerPC hardware). Those will come soon enough. But frankly with Google for the help docs and processes (there’s a lot of good information directly from Microsoft out there already!), the process only required two remote nights working until 3:30am, and some time during one day to work out the ISA stuff to keep ActiveSync and OWA working.

I’m not going to elaborate on the entire installation process here. Microsoft documents it well, it requires installing Exchange 2010 on a new server (no in-place upgrades) to do the transition (that’s how I prefer it anyway, and with virtualization that’s easy!). But it was mostly smooth, similar to 2007 in many ways (different enough to require some reading but familiar enough it was much easier to pick up than 2007 was from 2003). And, as I discovered this morning, for Outlook 2003 clients to connect, you should also run this in the Exchange PowerShell console:

Set-RpcClientAccess -Server [servername] -EncryptionRequired $false

Otherwise, Outlook 2003 will stare at you (or, rather, the user) blankly and not connect (at least if you have internal encryption to Exchange disabled, which I do–I didn’t test enabling it).

Do I recommend going with 2010 now? Yes, as long as stuff you use like Blackberry and Mac supports it or you’re prepared to learn how to make it work. Also, your “now” may not be the day of General Availability depending on the size of your environment and current needs and plans :-)

Any thoughts? Do you think I should have gone with Exchange 2010 the week it was released? I think it’s a reasonably well proven product even though I didn’t participate in the testing myself like I did with Windows 7. Are you migrating soon? (Microsoft likes to call moving from one version to another of the same software a “transition.” I like the term “migration” better, but whatever. They reserve that for when you “migrate” from one of their competitors. I don’t care :-)

However, there is a flag you can set on a moderated object that will allow a moderator for a “parent” group to moderate an email once regardless if subgroups also require modification. Think a moderated all-staff list that contains a moderated group for a specific department; by default both the all-staff moderator and the department list moderator would have to approve a message to all-staff before the department recipients would receive it. If you’d rather have some groups like all-staff set so whoever moderates a message to that group auto-approves any subgroups as well (this is precisely why I wanted it, although we don’t have moderated subgroups yet), that’s why they added the flag called “BypassNestedModerationEnabled” which you can set to true with PowerShell.

The problem is, the few places that talk about that flag online call it a completely different name! Sure you can do “get-help Set-DistributionGroup -full” to see all the options (there are many) or you can find the same help online, but it’s not easy to track down if you’re looking for the wrong setting name! The correct syntax to enable this moderation bypass on a group (from within the Exchange PowerShell console) is:

Set-DistributionGroup -Identity "[group name]" -BypassNestedModerationEnabled $true

However the Exchange Team’s official blog says in it’s moderation post, in the FAQ section where it mentions nested approvals (near the end of the post), “If you set the BypassModerationEnabled flag to $true on the parent group, any messages sent to that group will bypass moderation by child groups.” Close, but it’s actually the BypassNestedModeration flag. If you do some searching, you’ll find a TechNet article called Understanding Moderated Transport which, again near the end in the Handling Multiple Moderated Recipients section, says, “To do this, you set the AutoApproveNestedDLEnabled parameter of the moderated distribution group to $true.” Which provides an even farther-off version of the same thing! At least with the correct version, you can more easily look it up in the TechNet Set-DistributionGroup topic where is is correct!

It’s likely the incorrect articles were both correct at the time they were written, during beta and release candidate cycles of Exchange 2010, with the final flag name being changed in the generally available version that came out this past Monday. I don’t know for sure as the GA version is all I’ve run, but it seems a likely explanation given that the articles are almost a month (the TechNet one) and five months (the Exchange Team blog) old. But apparently I’m the first person to write about it outside of them (that Google knows about).

I talked to my Zones sales rep, Eric Inabnit (Eric.Inabnit@zones.com, or 800-258-0882 ext. 3361), about it to see what the real deal was. He did some checking, and like James found out from his CDW rep, it appears that Adobe is consolidating their Educational and Non-Profit SKUs to simplify things, but it appears the pricing will stay relatively similar to its present levels, with a few minor adjustments. To quote Eric, he is hearing that, “they will be combining the nonprofit and academic price sheets to simplify management on their end. They are saying that if you qualified before you will still qualify, your sku’s will most likely change however pricing changes if any, will be negligible.”

Adobe will be shutting down its entire licensing system from October 7th to October 14th, however, so you cannot retrieve your license information for existing licenses nor can you order new licenses during that time. I can live with that, I wasn’t planning on any October Adobe orders.

This is good news, and while it’s by no means the final word, it does make me worry less about the potential budget impact it might have on churches! Adobe’s products are already some of the highest-priced software packages we buy that aren’t for servers (and frankly, much of our software (Microsoft, especially) costs a lot less than some single Adobe licenses), even with the reasonably significant non-profit discount.

If I discover any additional information I’ll update this post; send me any new information if you’ve got it! (Leave a comment or mention @dszp on Twitter.) Thanks, James, for bringing the Adobe changes to my attention and checking into it as well.

I recently purchased Veeam Backup 3.0 to back up my three VMware ESXi Free hosts. Veeam Backup is awesome and their version 3.0 is the first version to support the free ESXi version! I love the deduplication and compression and the ease of use when making backups! On March 31st, VMware released ESXi 3.5 Update 4, which added drivers for some very nice NetXtreme quad-port Gigabit Ethernet cards, which I have in two of my three VM host servers but have been unable to use until they released an updated version with built-in drivers for that hardware.

So I upgraded yesterday when Update 4 was released (I actually just did a point release update to new Update 3 firmware the night before…doh!). The new NICs work great and now I have redundant paths to the SAN! (In one case I now have more than one NIC in the whole box that was doing SAN and LAN just on VLANs, so it’s quite nice to have multiple NICs available now!)

I was going through and upgrading VMware Tools on all of my virtual machines (the new release adds some driver support for enhanced NICs to Server 2003 and a few other minor things). One of my Linux CactiEZ VMs was being a bit picky with the yum package I was trying to install so after some troubleshooting I figured I’d restore a virtual machine from Veeam Backup (granted not 3.0.1 which I believe is out, I have the original 3.0 release installed right now) to get an earlier state and see if it helped to start fresh (my other thought was there was a repository issue but my older CactiEZ 0.4 yum was working just fine, it was my CactiEZ 0.6 box I recently set up that was having issues (it runs CentOS 4.7)).

But my restore fails, with an error relating to not being able to create the directory on the ESXi host to restore the virtual machine. The exact error is along the lines of:

Failure to restore item “VM Name Here” Cannot make directory ‘[datastore] VM Name Here’ on ‘ha-datacenter’. Soap fault. fault.RestrictedVersion.summaryDetail: ‘<RestrictedVersionFault xmlns=”urn:intervalvim25″ xsi:type=”RestrictedVersion”></RestrictedVersionFault>’, endpoint: “

The simpler error is in the status dialog box, “Restore error: Restore VM failed: Cannot make dir…”

I dig a little deeper and notice that the last couple of backup jobs scheduled to run overnight for some virtual machines have all failed completely. Nothing updated, and when I force a backup to start now it fails quickly for all VMs with an error along these lines:

Releasing VM files

CreateSnapshot failed, vmRef 224, timeout 1800000, snName “VEEAM BACKUP TEMPORARY SNAPSHOT”, snDescription “Please do not delete this snapshot. It is being used by Veeam Backup.”, memory False, quiesce True

fault.RestrictedVersion.summary

So, I’ve submitted a support ticket. Fortunately, right now I have nothing urgent that needs to be restored (CactiEZ is more of a plaything right now, at least my new 0.6 install), although obviously not keeping backups up to date is not a good thing.

I guess I’ve been running ESXi without Veeam (Veeam’s only been running for…maybe a month?) for long enough that I wasn’t considering backups when I did my ESXi upgrades, so I’ll admit first-day upgrading is jumping the gun. But Veeam is a VMware partner as far as I know, and I don’t know why they haven’t been able to work with VMware around this release to verify that their software works…it’s not like this is ESXi 4, it’s just an Update release of 3.5. At least an announcement of the incompatibility with a warning about upgrading sent to customers would have been nice, although it’s not something that was promised or anything.

I’ll keep this updated (here or in the comments) as the “story” progresses! Tomorrow I will also look into making sure I’m on the very latest point release of Veeam Backup to see if that makes a difference…just don’t have the energy left tonight to do anything else, I was up until 5:30 am last night doing a P2V of our nursery checkin system (long but successful!).

One of my goals for the new system is redundancy. If something goes down, I’d really like a second system around to stay up and running, in particular when using virtualization it does create bigger single points of failure (one phyical server going down takes down multiple virtual servers), which is one of its biggest weaknesses. This can be mitigated by using shared storage (hence the SAN) and multiple servers that can take on the virtual machines the “down” physical machine can’t run temporarily, even if it runs a bit slow from the additional load (even better if your secondary server is not heavily loaded!).

Having the R805 would be great, but my next-best server is a Dell PowerEdge 1800 that’s three years old, with a single Xeon 3.0GHz processor and 6GB of RAM. It’s a very nice server, but it wouldn’t be able to shoulder a load the R805 could handle easily so it would only be able to run absolutely critical machines. Additionally, the Xeon processor is too old to support Intel’s VT (Virtualization Technology) extensions that make running a virtual server hypervisor easier, and allows 64-bit guest operating machines to run. If we make the move to Exchange 2007, there would be no backup server for it to move to, and it would be one of our most critical servers!

VMware’s ESXi hypervisor runs just fine on the PowerEdge 1800 (as long as you don’t need 64-bit guests); I have it running now with a couple of VMs and it’s barely breaking a sweat. It will work even better on the nice “new” PowerEdge 1950’s, but the other thing that having VT-capable processors will help me with hypervisor selection options. If I don’t end up running the now-free VMware ESXi, which I’ve tried and like but keeps you from using some of the really cool features unless you buy their Virtual Infrastructure/Virtual Center packages (these easily get into the same price as the hardware for both servers I bought!). Microsoft’s new Hyper-V virtualization platform (separate entirely from the old Microsoft Virtual Server product) is capable of running only on processors supporting VT, and now I’ll have two of them, the magic redundant number. It does preclude using the PowerEdge 1800 as an third backup, but down the road it will offer some of the similar moving of “live, running” virtual machines from host to host, and Microsoft is releasing their Virtual Machine Manager (VMM) soon as well for management, which will be siginificantly more cost-effective for us given charity pricing than VMware’s Virtual Center. But some of this stuff isn’t going to be here right away, and VMware’s solutions aren’t necessarily lacking anything we desperately need. What’s the answer? For now, it’s keep researching, maybe even try both when the servers arrive, and see which is the best fit for us. Microsoft certainly wants to take over the market and they’ve been successful in other areas in doing so after entering late, but it’s way too early to tell in this case, in my uneducated opinion! I do think VMware will be around for a while, and is not a poor choice from a longevity perspective yet.

Licensing is the only “kicker” with my new servers. Microsoft licenses (that link has a cool calculator, but it gives retail and not charity prices!) their Microsoft Server Datacenter software per socket (physical processor) in each server. So if you have a dual-processor system, you buy two licenses. The R805 is a dual-processor system, but the 1950s are as well, and I just doubled my processor count and therefore licensing cost! That’s OK, I’m likely going to, for now, use the Datacenter license from the PE 1800 for one processor in one of the new servers and use a Server Standard license on the PE 1800 for now that I’ll be freeing up by virtualizing to pre-licensed VMs. This will just add around $500 to the cost of getting a second server, making the hardware and licensing increases in going from one to two servers come in right at $800. That’s not bad for a second server, doubling your quad-core processing power and RAM as a consequence!

Because these servers were in the Dell Outlet, where items in your cart last only 15 minutes unless you modify them, the server have now been purchased and are estimated to ship on October 1st. I’m still waiting to pull the trigger on the MD3000i SAN and I’m still researching backups (which just had its budget cut a bit with this server swap!). I did hear from my Zones rep that October 1st begins Microsoft’s new fiscal year, and they will be announcing any pricing changes at that time. Pricing on Datacenter could go up, or stay the same (well, it could go down but how likely is that? Exactly!). Since I have the servers for sure now, I may go ahead and grab the Datacenter licensing before the end of the month for that reason if I can (my boss is out of town at the moment; he approved the server purchase earlier waiting to change airplanes at an airport in the Bahamas on a business trip. No, he called me first for some technical assistance, I didn’t bug him until I had him on the phone already. Yes, I should have asked if he needed an assistant for his business trip :-)

So, one more step completed in the process, many remaining. Also, I’m possibly going to need (or want very much to have) a cheap or free server rack that I can pick up locally. Just saying, if you happen to be throwing one away and are nearby :-)

Yep. That’s right. In case Firefox, Opera, and Safari all don’t satiate your burning desire to be rid of Internet Explorer (even if it is improving with age, after it started to ripen at least), Google said they are releasing the beta of a new web browser called Chrome today, Sept. 2nd, 2008. It’s been in development for two years, and they’re beta-testing it with thousands of webpages automatically after each build. How? Well, they have this little archive of webpages stored somewhere… :-)

They accidentally leaked the news a bit early but have now come clean and written a blog post announcing it, and have released the original leaked “comic book” describing the project, which will be open source and they claim has pulled from both Mozilla (Firefox) code and Apple’s Safari WebKit rendering engine. The comic book is very descriptive and indicates that each tab of the browser will run in a separate process, which will reduce memory usage over time and allow multi-threaded JavaScript, as well as allowing individual tabs to crash without taking down the whole browser. If this works as advertised, a few tab-users I know (with myself as the number one offender!) may flock to this quite a bit faster than users have moved to, say, Flock. Sorry, couldn’t resist…pun fully intended :-D

I, for one, will be grabbing the beta ASAP and taking it for a spin. As long as rendering is consistent enough to not intruduce more headaches for web designers (basically, standards-compliant, kind of ), I’m excited to see if it lives up to its claims! And I love testing new software. I’m always amazed at the things I haven’t thought of yet, that others have. Nowhere is it easier and quite flexible to showcase stuff like that than in software! Just bang a few keys, hopefully in the right order, and you have something new. The only thing easier? Web design (which is correspondingly more limited most of the time). Of course, both can be done very badly…

Now I’m rambling. But this is unexpected and exciting news! I would say, don’t knock it ’til you try it, and read the comic :-)

In addition to Remote Desktop, you can also open webpages (HTTP or HTTPS, using Internet Explorer or optionally the Gecko rendering engine that Firefox uses if you download xulrunner…see the instructions within mRemote). And connect to SSH sessions using PuTTY, which comes with mRemote, right inside other tabs.

There are other tools out there that do similar things. Royal TS is one, and in fact was the first one I found (see review from 4sysops here). There are others in the original 4sysops post I linked to, which compared six free RDP clients and mentioned a paid one. mRemote does everything I need in a comfortable way that I’m very pleased with, at my favorite price. It works fine with Server 2008 and Vista, and using the smartsize setting so the remote desktop fills whatever resolution is available inside the mRemote window makes for an efficient work area that’s as large as you can fit on your screen!

If you use Remote Desktop on more than just an occasional basis or to connect to more than one system, you need mRemote, or one of the other similar tools if you find it’s a better fit.

What if you’re away from your laptop or desktop and need to Remote Desktop from just about anywhere you can get cellular data coverage with AT&T? Well, you have to have an iPhone too, but I highly recommend WinAdmin for the iPhone to fill that need. That’s a review I wrote as a part of my iPhone Apps reviews over at my personal blog earlier today, and it ties in well with this full-sized mRemote companion :-) (As you might have guessed, writing about WinAdmin actually sparked the idea to blog about mRemote. They complement each other well! Seriously, I think I hear mRemote telling WinAdmin how it thinks of it fondly as a younger brother, whenever my iPhone is next to my laptop :-)

The obligatory “why I haven’t been blogging”: Busy playing with iPhone :-D Too much fun to waste time writing about other stuff (even writing about iPhone Apps has taken a backseat until today!), but I’ve got a few ideas planned and things to write about up ahead. For now, enjoy having a bit less in your feedreader; I know I’ve been falling quite behind in my own blogreading too! Twitter and the #citrt IRC channel are also to blame in large part, but not in a bad way. I’m not the only one; see Jason Powell’s post about it.

I’m trying to get a 90-day trial of Microsoft System Center Essentials 2007 (SCE) installed. The non-profit charity pricing is under $400, so if I like it I’m hoping to buy it this Fall. Right now, I’d be happy to get it installed! After attempting to install the software (at Service Pack 1) on a virtual Server 2008 machine and failing (you have to install SQL Server Express 2005 with SP2 manually first, which I did, but it kept complaining that I needed to run the Configuration for SQL Reporting Server…which I did! The best I could, at least, but it kept complaining I hadn’t!), I finally switched to a Server 2003 virtual server. 3/4ths of the way through the install it failed saying it couldn’t contact the SQL server (that it installed) so it rolled everything back (the install and the rollback both took an hour!). I’m spending the time installing all the Windows Updates that are available for Server 2003 before trying again, which are a lot! Was trying to try it out quickly and update later, but obviously that’s not going to work! The concept of SCE is very cool but if it’s this hard to install, it better be a whole lot easier to use!

I’m probably the last person to post this, but the Fall 2008 Church IT Roundtable has an official website now! Visit (and subscribe to!) citrt2008.com for updates, details, and links to other update methods like Twitter! It’s being held at Seacoast Church in Mount Pleasant, SC on October 8-10. Be there or be…there streaming online or in the chat or something :-)

I’m getting ready to switch over to Small Business Server (SBS) 2003 Premium from a non-SBS, non-Exchange network at the Assemblies of God Indiana District Office where I work one day per week. It’s been in the works for a long time, but the official switchover is scheduled to happen June 6th and 7th (Friday and Saturday) with the 8th available if spare time is needed and some on-site support on Monday morning the 9th to work through any kinks. I’m confident in things going smoothly, but that could just be a lack of knowledge on my part (see the Dunning-Kruger effect :-) My plan is to get Postini installed in front of Exchange at the same time or shortly thereafter. I may get around to broadcasting some of the switch via webcam, but there will be some internet downtime while ISA 2004 is brought up and configured so we’ll see how that works.

In still other news, I’m going to be trialing FeedBlitz for sending out email newsletters for our Worship and Creative Ministries team in the next few weeks. I’m curious to see how that goes; I know Constant Contact is the well-known name in that space and we’re open to going with them as well. Pricing is the same for our subscriber levels, but FeedBlitz seems to have the corner on social features including publishing email from an RSS feed and now sending out messages via Twitter as well so we’re going to try it first I think.

It gets harder to blog stuff the longer I go without doing so. I seem to pressure myself to “write long, big post with a ton of juicy technical information” as the first post back from an absence. I also seem to subconciously want to post only big, important stuff to avoid wasting time with any smaller things. This contributes to not posting at all! Thus, I will attempt to be less picky about what I’m posting or the length of posts in order to keep going, while still providing some good, solid information! I may also kick up the number of shorter posts with links to other content, or republish the occasional funny comic, but will try to keep the “noise” down. Feel free to leave feedback in the comments about what you’d like to see, one way or another!

One more thing: I have Woopra set up for statistics tracking on this blog now. I don’t run the client often right now, but when I do it allows me to chat with visitors in real time! So if you’re reading this on the website and not via RSS, I can actually initate a chat with you! It’s unlikely, but keep it in mind! If you want to start a chat with me, you can do so via the Google Talk Chatback badge, currently in the sidebar menus on the site. No registration is required. If I’m not at my computer, you won’t get a response, sorry! I try to keep my availability status updated but I don’t always succeed. Try the #citrt channel on IRC or just send me an email (use the Contact Me page) if it’s that important! Blog comments are preferred if it’s a public topic or question, though!

Don’t forget, it’s pre-release code right now and it requires Vista or XP 32-bit editions only right now, and of course Office 2007 (works with Word, Excel, and PowerPoint only). That said, check it out if you can!

One tip I did manage to track down (found this item on the pssh users archived mailing list) was that I could type a Tab character by typing Shift+Space (extensively useful for auto-completion in the bash shell on a full-sized keyboard, but even more so on a thumb board!). There’s a menu option to type a Tab as well, but that does kind of defeat some of the shortcut-ness I was looking for.

pssh does warn that it doesn’t use the best random number generator out there for encryption. I’m all for extra security, but for the few times I will use this I think a targeted attack that manages to crack my SSH tunnel is unlikely, and there are probably weaker links in our webhost-connection security than Secure Shell.

We eventually evaluated the newer version of Presentation Manager that came out once we found out about it (remember this was in place before I started volunteering, and at the time there wasn’t even a full time sound/tech guy, much less a full time IT person on staff!), and although it did make some improvements we did some searching and evaluating and settled on EasyWorship because of the unparalleled text quality, smooth transitions, video support, and of course, ease-of-use (the very liberal licensing policy was also a big factor). EasyWorship was definitely an excellent decision as the software has been very solid overall and is still very easy to use (I should know, while I was still on the tech team I trained many others to use it!). It’s had its bugs like any other software and there are certainly features we’d like to see added (some of our wish list has been addressed in the time we’ve been using it!), but we’ve been very happy with it for the most part.

Which brings me to this Easter weekend. Because we had so many things going on this weekend, including a big outreach at the local elementary school on Saturday where between one and two thousand people came for free groceries and to win one of 100 bikes in a giveaway, I pitched in on Friday and ordered the Message version of the Bible for use in EasyWorship (a module that was unavailable when we originally purchased EasyWorship with many of the then-available paid Bible translations), because some passages from the Message version were planned for use in the Easter services.

Within an hour of placing the order, I got the confirmation email and a temporary, 10-day license key for the Message version, with the final key to arrive after a manual order review. I forwarded this to Shawn, an awesome friend, fellow local one-man IT guy, and our lead tech team volunteer, and the report came back: it works! But, none of our previously purchased Bible work anymore! Shawn was able to roll back to the previous registration information so we at least had our old Bibles back. By the time all this transpired EasyWorship was closed for the weekend, and a Saturday phone call and email couldn’t rouse them. Shawn did what all good IT guys do in such a situation: he improvised and created a new song and pasted the necessary verses in manually.

Today, Monday, I received the final registration code from EasyWorship, which worked to unlock our new and old purchases, and I also received an apology for them being closed over the weekend and unable to help us in time. Still, the glitch still exists: temporary licenses lock you out of previous orders! If you use EasyWorship, keep this in mind (and order early if you need to, like we should have done). Otherwise, I hope you enjoy using this software as much as I used to and our tech team still does!

In related interesting timing, it appears that EasyWorship is the next class we’re focusing on at the Ministry Technology Institute. Just like my university pursuits, I’m happy for classes where my experience makes things much less difficult. Yes, being challenged is good and I like learning (usually things are only easy because I’ve spent the time and learned a lot already on my own!), but it feels good to get things finished and move on to other things demanding my time!

UPDATE: Within moments of publishing this post, I received a second email from another person at EasyWorship offering to help with our problem. I’m sure that the first reply I received was to my email and the second was from my voicemail (I had hoped one or the other would make it through before weekend services), rather than the second being in response to this post (the response time was too fast for this post to have existed long enough to read and reply!). But EasyWorship is very responsive during the week apparently!

Because I recently received a request for a recommendation of where to purchase Microsoft software, I wrote an email reply with information on available options and contact information for the sales representatives that I work with. That was the catalyst for this post, and I’m going to provide some of the same details below:

Microsoft and Adobe Charity Programs

Microsoft’s charity licensing program is called Microsoft Open License Charity. Their price list is available for download as an Excel spreadsheet (or it used to be; thanks to Jason Powell for the link and an excellent post about this topic that also includes some sample pricing on common items), but you may need either extensive training or experience to decipher a lot of it! But a reseller will be happy to give you a price, which I find is often less than the suggested retail (but the reseller price will usually still have wiggle room for negotiation). Suffice it to say you’re wasting money if you can purchase at charity pricing and aren’t. Percentages vary, but expect more than 50% off and up to 90% off is not uncommon.

Adobe didn’t used to have options for non-profit, religious purchasing discounts, but in the last couple of years that has changed. Their discounts are in general over 50% off the retail price of their software, sometimes a lot more than that. They have a website dedicated to non-profits and also have a non-profit blog, although it’s not very active.

The regular charity pricing offered by at least Microsoft and Adobe, unlike the restrictive TechSoup offerings that don’t usually apply to churches anyway, is good for unlimited licenses! The main limitation is that Microsoft requires at least five licenses to be purchased at once to set up a charity pricing agreement, although these can be low-cost licenses (if not otherwise needed) that will not normally negate most of your savings if you need fewer licenses! Adobe’s current program lets you purchase just one license at a time if desired!

There are two vendors that I’ve used for charity pricing, and I use them for just about everything else as well: Zones and Dell:

Zones

I’ve been using Zones as a supplier for somewhere in the neighborhood of 3-4 years. They have had competitive pricing in most cases and I’ve worked with a single, excellent sales representative, Lisa Shook (formerly Brubaker), for that entire time. The Zones HQ where Lisa works is located in Washington state, but most shipments (to us) ship out of warehouses in Illinois or northern Indiana and even with standard ground shipping arrive here in Indianapolis the next day or, in rare cases, in two days. There may be warehouses closer to you, so it’s worth asking if you’re buying hardware. Keep in mind that software from Microsoft and Adobe, when they’ll allow you to order discs rather than downloading it (and my understanding is that Microsoft recently started requiring you to download disc images for their software), must be shipped directly from Microsoft or Adobe themselvles, although the discs usually arrive within a few days in my experience. Contact me if you are interested in Lisa’s contact information, I won’t post it here so she can spend more time helping me and less time dealing with spam :-)

Update 2010-07-06: Lisa moved on to larger accounts and didn’t hold onto ours any longer, as of close to two years ago. However, her neighbor Eric Inabnit (who she recruited to Zones) took over our account and has been just as excellent! I still highly recommend him. I recommend shooting him an email if you need charity pricing or good non-profit pricing in general on Adobe, Microsoft or hardware (they can resell Dell too). Tell him I sent you! You can also call him at (800) 258-0882 x 3361, or directly at (253) 205-3361. Make sure you talk to him first before another rep gets you set up so he can help you.

Dell

Although I’ve ordered some Dell stuff in the past, I hadn’t really used their business sales division where they resell just about anything (with some limitations) in addition to giving (good!) discounts on their own hardware. I haven’t verify that they carry Adobe charity licensing, but I know they carry Microsoft’s and they seem to be undercutting just about everyone else right now on price, including Zones. They appear to be making little to no money on the licensing side of things to earn your business in other areas, and I’m OK with that. I haven’t made the decision to switch to them for all licensing yet because managing licenses is easier if done through one vendor, and right now that’s Zones for us, but I’m contemplating the situation. Our sales rep at the moment is Lindsey Keen, and again, if you want contact info let me know. Dell ships primarily with DHL, and while systems generally ship out of their Texas HQ (and the most recent one took only one week), I’ve received shipments of non-Dell-branded items from the Kentucky/Tennessee/Ohio areas recently that took only 1-3 days to arrive via ground shipping.

Also, Dell will often have huge discounts they can give you at the end of their fiscal quarters if you talk to their reps, in addition to the deals they usually offer on their website. January was the end of their last quarter, so start tracking from there and see what you can get if you can wait long enough!

Update 2010-07-06: Our Dell rep, Lindsey Keen, left Dell and was replaced by a new rep who has been around for over a year and a half now, Shelton Cammon. He’s great to work with, has a good team, and is often the lowest on Microsoft charity pricing due to Dell’s policies of low- to no-margin software sales. If you do a lot of ordering, ask him to set up a Premier account so you can login and see your approximate pricing with discounts from a website, including ordering (and you can finalize order’s Shelton has quoted you over the phone via Premier as well).

Consistent Computer Bargains

A company I’ve never dealt with simply because I didn’t know about them when I first started with charity pricing is Consistent Computer Bargains. They offer charity pricing programs for both Microsoft and Adobe, and they also have many other products. They are Christian-owned and cater specifically to non-profits and churches. I have heard many good things about them, so although I can’t personally recommend them I would certainly add them to your list of places to investigate.

Purchasing and Credit

Zones and Dell both offer lines of credit, or you can purchase with a credit card. Talk to the reps to get started opening a line of credit, but basically Zones will do Net 30 terms, and Dell will do a form of Net 30 with their Dell Business Credit line for purchases under $500. If your purchase is over $500, Dell will usually do their 60-days-same-as-cash loan. If you pay it off in full within the 60 days, there’s no charge. But let it go one day longer, and you’ve got a multi-year loan with prepayment penalties on your hands! Dell offers several leasing options as well, and Zones offers leasing through their partners. (UPDATE 2010-07-06: After writing this post, I did find out that Dell will also do standard Net 30 credit terms, which is much easier to deal with than the Dell Financial Services loans, which often have brief due dates and high finance charges if not paid off in the free period.)

When you order Microsoft Charity software, most of it requires a volume license key to be entered at install time. Once you have your emailed agreement information from your purchase, you’ll want to head over to the Microsoft eOpen Licensing (now the Volume License Service Center, or VLSC, as eOpen was replaced in 2009) website, log in with (or create) a Microsoft Passport account, and add your agreement information to the system. You can then download licensed software images to burn to disc from this site, and you can view the license keys for the products you have purchased. Adobe volume licensing software will come as an email with a username and password and a link to the site where you an log in and get your license key(s).

Miscellaneous

Keep in mind that if you can’t get something through Zones, Dell, or another reseller, or you can’t get a non-profit discount, try talking to the company directly about a non-profit discount. I would say the majority of software vendors I’ve talked to, and many hardware vendors, are willing to offer at least a 10% discount for non-profits, although I’ve seen it go up to 15%, 20%, or higher. But you usually won’t get this without asking! I don’t have a list of all the software I’ve gotten non-profit discounts on, but I do recall HelpSpot and WebDrive, and SftpDrive offered a very good discount as well. Also check out Remote Desktop Manager, which has a non-profit discount (50% off a site license when I asked, which made it $100 for the pricing at the time!), as it’s my current favorite administrative tool for connecting to remote desktop and LogMeIn sessions remotely (it supports other remote connection types as well) using saved information and tabbed connections (there is a free, useful version as well).

Make sure that you know what Software Assurance (Microsoft) and upgrade insurance (Adobe) is and whether you want it or not. I usually recommend it on server products, like Windows Server, Small Business Server, Exchange Server, etc. but on desktop products (Windows XP/Visa, Office) it’s a bit of a tougher decision, although I do recommend it for Adobe products. The idea is you pay more up front and then a recurring fee (every two years in the case of the Microsoft and Adobe programs, I believe), and you can upgrade to future versions of the software you’ve purchased without having to pay full price when a new version is released. The sales reps should be able to give you the details and pricing.

Other well-known vendors are CDW and TechDepot. I don’t have experience with them, but they’re certainly options if you want to investigate further and compare prices and service.

Updated Info on Mac Office 2008 pricing; also Home Use Program

UPDATED May 23: Thanks to Jason Powell for pointing out something I have not yet run into: Mac Office 2008 is not available at Microsoft charity pricing from Apple. In fact, Apple and others are selling Mac Office 2008 at prices above $200 per license, while the charity vendors I’ve listed in this post (and others) are carrying it for under $60 (no typo!). Check out Jason Powell’s post on the topic for more details. Thanks Jason! (Update 2010-07-06: I’m not sure of all the details, but you can also use Mac Office with a volume licensed version of Office for Windows, as long as the version is ‘the same or lower’ though I’m not sure of the specifics. Do some research, but keep in mind you can “trade” OSes in some cases if you have licenses from one you want to use on another!)

Also, I didn’t mention it here at all, but I’ll throw in that if you buy Software Assurance for your Microsoft products, some of them come with home use rights (the Home Use Program, or HUP) that let your users get separate licenses to the same software you bought for use at home, generally for very low cost. This is something you can activate through your eOpen licensing management portal (when it’s actually working). Microsoft Office has been the most well-known software available through this program, but Jason also posted that Office for Mac is also a part of the Home Use Program now! I’m just starting to dig into the HUP program myself but it’s certainly a good deal! And one good reason to pay for Software Assurance, although I’ve certainly heard arguments in both directions.

Mumbo-Jumbo

Disclaimer: The licensing programs described here are based on my understanding of the programs through my own use and purchasing, reading agreements, and discussions with resellers familiar with the options. However, it’s all just my (non-legal) opinion and you should independently verify all terms and legalities as they apply to your situation. Be careful as Microsoft licensing guidelines can be and have been interpreted differently even by different Microsoft representatives themselves! If you can decipher the straight legalese in their licensing on your own, you’re a better man than me. And if you’re a woman and can decipher it, well you’re already a better woman than me, so no contest :-)

So far this morning, I’ve tried hibernating three or four times, and as promised, TrueCrypt does not block me from hibernating any more. However, my experience resuming from hibernation has been, well…non-existent! After appearing to hibernate normally, when I try to resume I am prompted for my decryption boot password and then Windows boots normally. From scratch. No traces of hibernation present.

My only thought as to why this is happening is perhaps it’s because I decided to use Whole Drive encryption this time, as opposed to System Partition encryption. I didn’t realize when I started the encryption process that the version history was so specific, but it does say that one of the new features is, “Support for hibernation on computers where the system partition is encrypted (previous versions of TrueCrypt prevented the system from hibernating when the system partition was encrypted).” It specifically mentions encryption of the system partition!

I started the decryption process (estimated to complete in 6 hours, much slower than encryption) this morning and when complete, I will attempt re-encrypting just the system partition and see if that fixes the issue. I’ll update this post with information as I discover it!

UPDATE Saturday, March 15th, early morning: Yesterday, I re-encrypted just the system partition with TrueCrypt, but the same problem still occurs. I did discover (thanks to referrer logs) that someone had a similar problem and posted a thread to the official TrueCrypt Forums, linking to this post. Apparently, while the problem does not appear to be widespread, it does seem to still happen for others. I did not get a chance to try any of the suggested workarounds, but I did post an update to that thread with a few more details of my experience in case it helps resolve the issue. About a day after I posted my details, the developers posted a fix in the form of 5.1a Beta, which they requested be tested to see if the problem is fixed. I have installed the beta, but it requires a reboot before taking effect. Update coming later.

UPDATE later Saturday: The beta of 5.1a fixed the problem, and hibernation works now. Happy ending! Apparently there is still a problem with a couple of versions of Vista that are fixed but won’t be released in a beta, per Vertex on the forums:

This is a known issue in Beta 1 that affects users running Windows
Vista Ultimate and Enterprise. According to the developers, it was
discovered and fixed shortly after Beta 1 was released. Beta 2 is
currently unlikely to be released so if you use one of those systems,
you will need to wait for TrueCrypt 5.1a final/stable.

The main reason was the lack of hibernation support. I tried using standby, which seemed to work sometimes. I would verify that standby mode had been entered, and put the latpop in my bag. Less than 12 hours later, more often than not, the battery was dead and the laptop was off. Even within shorter time periods, I would sometimes take the laptop out of my bag and it would be running! This is dangerous, as carrying around a laptop when it’s off can be done much less gently than should be done when it’s on. And running in my bag prevents good heat dissipation, so it would be practically burning hot in this case (pun intended :-)

So, now hibernation works again. Which has worked well for me 99% of the time since I purchased the laptop. And it’s not encrypted, but it wasn’t in the past either. If they can make whole-disk encryption work with hibernation, and I’m not enthusiastic about the chances of this given the security implications that I think I understand but probably need to read more carefully, I’ll give it another try.

Note: I’m running Windows XP Pro on my laptop. At some point I may try Vista Ultimate, and may perhaps test Vista’s Bitlocker. I’ve heard it’s more complicated. I don’t know if it allows for hibernation or not. There’s an excellent overview of the two together at 4sysops, a blog I highly recommend overall.

UPDATE on March 15th: The problem with hibernation support has been fixed in TrueCrypt’s beta and soon the final release of version 5.1a. I am back to running an encrypted system for now!

In the Windows and Linux versions a special bootloader is available that lets you encrypt your entire system drive. It doesn’t look like that option is available in the OS X version.

What? Whole-drive encryption of the system drive is now available in Windows and/or Linux? (Clarification: Only Windows is supported right now.) This I’ve gotta see. I’ve looked at some laptop disk encryption tools in the past, and they’re nice but generally not cheap (whether software or specialized hardware). But open source is better than cheap, and TrueCrypt is already considered to be high quality. It’s written well (important where security software is concerned) and is in active development. The new version also promises significant speed increases.

I’ve installed the new version on my laptop. Do I dare try out the encryption feature? I do have most (not all) of my data backed up, the important stuff at least. Maybe I’ll investigate this through the weekend, make a decision, and possibly try it out. Possibly. Fire is fun to play with and very powerful, but you have to know what you’re doing!

UPDATED after a night’s sleep: Yes, I dared. Before going to bed I started the process to encrypt the entire system partition on my laptop. I don’t know precisely how long it took; it was projecting 2-3 hours left when I went to bed (shortly after starting it) and was done when I got up. The process is slick, I’ll give them credit for that. They require that you burn a recovery disc (and verify it) before you can continue, just in case, and they also verify that the bootloader works before allowing the encryption process to begin. I haven’t used the system enough to know whether there is a significant speed penalty when the partition is encrypted. It seems a touch sluggish but still responsive, but within the normal operating parameters depending on the day! The biggest downside: hibernation is no longer supported. Standby is an option, but the system will not hibernate (if you try, TrueCrypt stops you and provides a helpful message about why it won’t work). I generally hibernate all the time when not using my laptop. I’ll try using Standby for a while and see how happy I am with it. Not sure if it’s a deal-breaker yet.

As a precaution, the boot loader offers the option to, with the correct password, decrypt the entire disk without needing to boot into Windows, if Windows gets corrupted. There are several other handy “rescue” methods in the boot loader (on the hard drive and on the bootable rescue disc). I am extremely impressed with the quality of the thought and effort put into this whole-disk encryption feature, and although I haven’t tried the Vista Bitlocker method, TrueCrypt certainly sounds a bit easier (but it doesn’t integrate with the TPM chip, if one exists). There are options in the setup to set up encryption to work with multi-boot systems, but it warns that this requires advanced knowledge to set up. And, of course, you need a dual-boot system, which I don’t have at the moment.

UPDATE: The new version 5.1 has hibernation support, and version 5.1a Beta actually makes it work on my laptop. I’m back encrypted!

Anyway, normally I would try Lavasoft’s Ad-Aware and Spybot Search & Destroy next. I’ve had mixed results with both of these in the past; they’re generally very good products but I had heard several things a while ago (not even sure where) about Sunbelt Software’s CounterSpy software. They have both Enterprise and Home editions; both have trials but to test it out, I chose the Home edition for this one computer. I installed the download, ran a full scan, and it found five items that Windows Defender missed! Zap. Problem gone. I’m impressed. The Enterprise functionality they advertise, which supposedly has a nice administrative dashboard to monitor all this stuff centrally (if it works half as well as the Symantec console and is even one-fifth easier to use it should be sweet). Price looks to be around the same as our Symantec deployment (not that we can get rid of antivirus, it’s just comparable), which is more than the freebies but if we do try it on the whole network and it finds a lot, it’s probably worth it. I’m putting it on my to-do list.

This should be an interesting test considering that another major commercial antispyware vendor I’ve heard of, Webroot, seems to have Jason Powell steamed due to their poor communication! I’ve never used Webroot, but if Sunbelt can do the communication thing and get the job done, I’ll at least consider it.

Anyone else use CounterSpy and have comments to share?

While I was at it, I threw in the VersaMail 3.5 EAS Meeting Invitation Update for good measure, just in case I needed it (and it was free!). I got all the updates available, basically; I must be used to Windows Updates where you should install it all, just in case it closes a huge gaping security hole or fixes something you don’t care enough about to research every time :-)

Everything went much more smoothly than expected! I installed VersaMail 3.5, installed and applied the updates, and did a sync. After the first sync, I was able to modify my account preferences to specify that I wanted to be notified “As items arrive,” which enables Direct Push.

So far, so good. Except that several minutes later, I hear my “New Mail Alert” sound and the message I get says, “EAS Account: Please press the Sync button.” Well, that’s fun. I go from email every 30 minutes to an annoying notice to manually “automatically” sync every five minutes! What is this? A Microsoft-like “improvement” from Palm?! Oh no! Things like “I wonder what would happen if I threw this phone through the window” started to go through my mind, but instead of following through with that I reverted to my backup plan:

Must…use…Google. Which I did, and I found this thread on the Palm forums that sounded like a broken record of my problem (not helpful) until I got to the last reply in the thread (which was helpful!). It had links to a blog entry from You Had Me At EHLO about Direct Push and Heartbeats, where, right there under list item 3 under the heading “Deployment Considerations for Direct Push” (I know, so easy to find in such a “short” entry :-) it talks about firewall connection timeouts with a link to an MSKB article (the same one the forum post linked to): 905013, Enterprise firewall configuration for Exchange ActiveSync Direct Push Technology. It’s reasonably short and sweet, and they’re kind enough to include step-by-step instructions for making the needed configuration change to our ISA 2004 firewall. Seriously, the instructions are so good and easy, I won’t even repeat them here. Click, click, click, type numbers, click, click, Apply, done. Or something like that.

I initiated a manual sync again to establish the connection with the new timeout values, and waited. Fifteen minutes later, no sign of the EAS Account error message! And now I get new emails popping up on my Treo usually before they show up in Outlook, whether connected via Cached Exchange Mode or not! Time will tell how good of a thing this actually is, but the concept is excellent!