Outlook connection issues with Exchange 2010 mailboxes because of the RPC encryption requirement

With Exchange 2010 RTM Microsoft enabled the RPC encryption on the server side, so users had to enable that in their Outlook profile as well, what is the case with Outlook 2007 and 2010, but not with Outlook 2003.
So might Microsoft got so many complains from Outlook 2003 users (or administrators) that they decided to make RPC encryption optional on the Exchange Server side again.
How odd is this?!

source: http://support.microsoft.com/kb/2006508

Wildcard vs. CN certificates or how to reduce the pain of management of SSL certificates

If you use reverse proxy, e.g. with Apache or Microsoft ISA Server/TMG 2010 you might already ran into one of those:
- some certificates are public signed, others are from the internal CA
- validity of certificates is from 1 year to 3 years, and nobody knows why not all are good for 3 years
- every certificate has a another validity start date and expiration date
- it is exhausting to renew certificates with Subject Alternative names
- each web site or ssl listerner has its own certificate
- no (semi)-automatic certificate renew process

May you can run this with 5 web sites in this way, but what if you have 20,40,180 and more websites on your reverse proxy.

So what?
- Request next time only 2048bit RSA certificates
- Secure internal-only and external-facing websites with public certificates
- Don't buy certificates on a daily basis, get  as many as you can from one public CA. Makes troubleshooting much easier.
- Request one wildcard certificate, so instead of www.domain.com use *.domain.com
- Wildcard certificates do not work with all services, if so use at least SAN entries
- Buy/request certificates for 3 year instead of 1 year
- Renew certificates in a bulk, e.g. every January and start the renew process early
- create a script with openssl or a certreq.inf file
e.g. a inf file to request a certificate from a internal Windows CA

[NewRequest]
Subject="CN=win4012.crypto-live.org"
Exportable=TRUE
KeyLength=2048
KeySpec=1
KeyUsage=0xf0
MachineKeySet=TRUE
SMIME = FALSE
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
RequestType = CMC


[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1
OID=1.3.6.1.5.5.7.3.2


[RequestAttributes]
CertificateTemplate = CLWebServer ;Omit line if CA is a stand-alone CA
SAN="dns=win4012.crypto-live.org&dns=cl4000.crypto-live.org"



And here we are with the batch file, to complete this post.

echo ================  >> certreq.log
certreq -f -NEW win4012.inf win4012.csr >> certreq.log
CertReq -f -Submit -f -config "win4011.crypto-live.org\AAA Crypto Live 4000" win4012.csr win4012.cer  >> certreq.log
CertReq -accept win4012.cer  >> certreq.log

Forefront Identity Manager 2010 R2 beta available

If you were ever interested what the next version of FIM would be, it is an R2 version.

btw my favorite was FIM V.next ;-)

The GA is planned for first half of 2012. To highlight:

- web based password reset

- Outlook 2010 support

From the beta release notes I couldn`t find to much about the certificate management in FIM 2010 R2. If there is   something new I will post it as soon I have the beta running. Beta is public available, so go and try it by yourself.

http://blogs.technet.com/b/forefront/archive/2011/08/01/key-improvements-in-forefront-identity-manager-r2.aspx


Beta test on Certificate Management:
- same schema extensions as before
- still needs IIS 6 management compatibility
- no news on CA modules
...so nothing new here at all.

Testing IPv6

The other day I configured a IPv6 address as tunnel via Hurricane Eletric http://www.tunnelbroker.net. Everything went smooth with my Apple Airport.

I got all IPs and a screenshot for my Airport from HE. Btw: my current internet provider is Cox. Cox does not offer IPv6 testing for residential services yet.
Afterwards I tested IPv6 connectivity with http://test-ipv6.com/
Other sites where you can see your fresh IPv6 address are:
- http://www.opendns.com/
- http://www.heise.de/netze/tools/ip/

Office365 - Step by step

- Apply online for Office365 Beta for Enterprises at http://g.microsoftonline.com/0BXPS00EN/1130?OfferId=B07A1127-DE83-4a6d-9F85-2C104BDAE8B4&dl=ENTERPRISEPACK&culture=en-us&Country=US, fill in your data and you are ready to go in a few minutes.

- Logon to https://login.microsoftonline.com/ with your new admin account

Info: If you have only one admin and you lost the password you can request for password reset at https://portal.microsoftonline.com/Support/NewSignupServiceRequest.aspx


- add your real domain name to Office365. You must have access to the DNS settings of your domain. That is the way how Office365 checks your domain ownership. It can take a while till your new DNS settings are published and replicated to all internet DNS servers. Microsoft says it can take up to 72 hours before the update is propagated properly. In our case it was 24h, others were ready in 15 minutes.

- NEXT: Configure Single Sign-On with AD Federation Services
Note: Run this from your AD FS Server
Go and download the Powershell Online Services to this machine needs internet access.

Microsoft Online Services Sign-In Assistent
http://office.microsoft.com/en-us/word-help/redir/XT102098593.aspx?CTT=5&origin=HA102065466


Microsoft Online Services Module for Windows PowerShell
http://g.microsoftonline.com/0BD00en-US/126
 
After you have installed both packages run "Microsoft Online Services Module for Windows PowerShell" from Start Menu.



Set-ExecutionPolicy RemoteSigned

$cred = Get-Credential

Connect-MsolService -Credential $cred

convert-MSOLDomainToFederated -DomainName crypto-live.org

Set-MsolAdfscontext -Computer win4011


 
- Install and configurea Directory Sync
You cannot create users in O365 for Single Sign-On from the web interface. You need the Dirsync tool to sync your AD users to the O365.
 
Go to your O365 Admin Web


Admin Overview/Users/Active Directory synchronization: Set up

Activate Active Directory synchronization

Dirsync requires:

1) .Net framework 3.5 http://download.microsoft.com/download/2/0/e/20e90413-712f-438c-988e-fdaa79a8ac3d/dotnetfx35.exe
Hint: run dotnetfx35.exe /q for silent installation

2) Powershell (comes with 2008)
servermanagercmd -install Powershell

DO NOT install DirSync on your ADFS server. Since Nov 2011 you have the option to run DirSync on 32 bit or on 64bit OS. 32 bit runs on Windows 2003 and 2008, 64bit on Windows 2008 and 2008 R2.


Now download DirSync 32bit from http://g.microsoftonline.com/0BX10en/216

Or DirSync 64bit from https://bposast.vo.msecnd.net/dirsync/prod64/dirsync.exe


Start dirsync and have a Enterprise admin near you.

Note: If you ave more than 10.000 objects tell this in a ticket to Microsoft to increase the limit of directory imports on their side.


Note: If you have more than 50.000 objects to sync tell this Microsoft as well and install Dirsync with a full SQL server, e.g. SQL Server 2008 R2. Dirsync comes with the express version of SQL 2008 R2 and has a database limit of 10GB.



How to setup dirsync for more than 50.000 users:

- dirsync /fullsql - start powershell (I use always an elevated prompt) - Add-PSSnapin Coexistence-Install - $cred = Get-Credential ; creds of your dirsync service account - Install-OnlineCoexistenceTool –UseSQLServer –SqlServer  sqlservername -SqlServerInstance dirsync -ServiceCredential $cred –Verbose ; make sure you have the SQLServerInstance specified - Run Config Wizard from the start menu, now you need your Enterprise Admin :-)

CryptoLive in the Cloud with Microsoft Office365

Crypto Live is joining the Office365 beta

See what Microsoft Office365 can do for you:
http://www.microsoft.com/en-us/office365

ProRMS Alliance - Rights Management

I am proud to announce a new group for data security methods, the ProRMS Alliance. Right Management overcomes a lot of restrictions and problems we had in the past and today with traditionell data encryption. It adds two more layers, usage and identity. So the data owner has full control even she has sent the document out to someone on the internet.

http://www.prorms-alliance.org/