Open Active Directory Users and Computers, by following the links in the Administrative Tools Start menu in Windows Server 2003.

The above picture shows an unconfigured Active Directory structure.  Before we go to far into creating our own structure, it is important to understand why Microsoft has created a default structure.  In the old days before Active Directory, NT4 used to make a distinction between groups and users and that was it.  Active Directory changed the landscape by showing Users and Groups in the same place.  Allowing an administrator to keep users and specific security groups together.

The Default Active Directory structure has the following containers;

• Built-in:  Contains Domain-Local security groups, such as Administrators, Users and Guests.
• Computers:  The Default location where computer accounts are created when a machine joins the domain.
• Domain Controllers:  The Default location for servers that are network Domain Controllers.
• ForeignSecurityPrinciples:  A container used for storing Domain Trust account details.
• Users:  Contains the Administrator account as well as Global Security Groups.

Whilst this structure is ok, it has one flaw.  The containers don't allow Group Policy Objects to be applied to them.  If you wanted Group Policy, it would have to be applied to the entire domain, restricting what you could do.

A simple extension to the Active Directory gives us a lot more configuration choices and a better way to manage school users.

Create a Managed Organisation Unit (OU)

Right click on the Domain level branch of the Active Directory structure.  On my domain, I have right clicked on schooltech.local.  Choose New > Organisation Unit.

Enter the name of your OU, I have called my Managed, as I am going to use this to manage the entire structure of my network.  Click OK and you will see the new OU inside of Active Directory Users and Computers.

Computers Area

• Right click on the Managed OU.  Create a New OU called Computers.

We now have a structure that contains an area for our school computers.  We can now begin adding further detail, added more layers as appropriate.

For Example;

• Managed > Computers > Admin
• Managed > Computers > Admin > Finance
• Managed > Computers > Admin > Reception
• Managed > Computers > Library
• Managed > Computers > Room M29
• Managed > Computers > Science Lab 1

You can think of the Computers Organisational Unit as the various locations in your school.  You can make them as complex or as simplistic as you need.

What are the Advantages of Managed > Computers?

There are several advantages of using this approach.  You can use the locations to keep track of computers.  Active Directory Group Policy will also come into its own, allowing you to assign software to the whole site, or individual rooms.  You can also assign printers to areas or rooms using Group Policy.

Hopefully you can see how this approach will apply to your individual school needs, although you might not fully appriciate putting in all this work until you learn a little more about Group Policy.

Users Area

The same approach can be applied to network users in the school.  You can separate Administration staff, teachers, network support and students from each other.

Right click on the Managed OU.  Create a New OU called Users.

We now have a structure that contains an area for our school computers.  We can now begin adding further detail, added more layers as appropriate.

For Example;

• Managed > Users > Students
• Managed > Users > Students > Year 7
• Managed > Users > Students > Year 7 > 7KMB
• Managed > Users > Students > Year 7 > 7PMD
• Managed > Users > Students > Year 7 > 7TMW
• Managed > Users > Students > Year 8
• Managed > Users > Staff
• Managed > Users > Staff > School Admin
• Managed > Users > Staff > Teachers
• Managed > Users > Staff > Teaching Assistants
• Managed > Users > Technicians

In the example above, I have deliberately used areas such as "Year 7" so that you can see the context of how this structure could be used.  However you will find it much easier to use the Intake Years, that way you won't need to spend hours moving files and changing groups of users around.

For example in the current year 2008.  The intake started in September 2007, so all students who started between Sept 2007 and June 2008 will permanatly live in the 2007 OU.  I used to keep a helpful note which I kept updated each year, that would map Year 7 to 2007, Year 8 to 2006 etc.

I have implemented an example structure in my Active Directory forest which best matches my needs.  I have also designed the structure so that it closely matches the folder structure that I have created on the server hard drive.

Using partitions allows for the logical grouping of files and resources, this should also make disaster recovery simpler to implement.  By keeping Operating System files separate from the data side of things, you could take a backup of your Operating System partition on DVD for quick recovery by using something like Ghost to make the DVD.  Restoring System state can then be done from the last tape or online backup.  Taking the approach could reduce the downtime of the server.

If you have followed the guide for installing a new 2003 server, then you will already have left sufficient space on your hard drives to allow for the creation of new partitions.  Once partitions have been assigned, they can’t be changed easily without the use of specialise software, or wiping them out and starting again.

In this article I will be creating 2 new partitions, E: for my User Home directories and G: for my shared applications space, remote installation space and Software deployment.

To access the Disk Management utility in Windows Server 2003; follow the menu route Start > Administrative Tools > Computer Management.  This will load up the Computer Management console. 

Under the storage branch, choose Disk management.  A visual representation of the available disk drives along with allocated and free space is displayed.

In the example above, 20 GB has been allocated to the C: drive.  This is the Operating System drive which is used to store Windows Server 2003 and other Server/service applications.

Create a New Partition

Using the Disk Management utility, right click in the Unallocated disk space, then choose New Partition.  A wizard will be started, click Next at the Welcome page.

Choose the type of partition that you would like to use.  In most cases a Primary partition will be sufficient; however it is not possible to have any more than 4 partitions on a normally formatted hard drive.

On the next page, choose how much space you want to allocate to the new partition.  If you have no other uses for the remaining space on the disk, then allow the Wizard to use all of the available space.  In this example I am going to allocate 20GB (1024 x 20 = 20480Mb).

Choose a drive letter to assign to the new partition.  I have already planned on using the letter E: for this new drive, but you could choose something that makes the most sense to you.  For example U: for the Network Users Space.

Choose the formatting options for the new partition, and then click next.

At the end of the Wizard, confirm your choices by clicking the Finish button.  The Wizard will now create and format the new partition.  Depending on the speed of the disk drive during the formatting, the new disk will be available to use when complete.

Create any additional partitions, by repeating the same process as you have just read.  For my system I have used the remaining space to create Partition G:

Once the formatting has been completed, the drives will appear in Disk Management and will be available to use.

Resources Required:

• A Windows 2003 Server (see Installing a Windows Server 2003 Domain)
• Windows Server 2003 Installation CD

DHCP = Dynamic Host Configuration Protocol, and can be used for much more than simply assigning and managing your network IP addresses.  It can be used for providing network information to your workstations, such as Domain Name Servers, Domain Name, Time Servers, Logon Servers and much more.

Ranges of IP addresses are defined as a Scope.  DHCP servers can have Global options that apply to every IP address managed by the DHCP server, or can be applied to the individual Scope.  Configuration that is applied to the individual scope overrides the information provided by the Server.

Installing DHCP on your Windows Server 2003

Log onto the Server as an Administrator User.  Then start the Add and Remove Programs Control panel applet.

Choose the option on the left hand side, called Add/Remove Windows Components.  After a short delay, a new dialog box will be displayed.

Browse down and find the Networking Services option.  Select it, then click the Details button.

Place a Tick in against Dynamic Host Configuration Protocol (DHCP), and then click OK.  Click Next to begin the installation.  At the end of the installation, press Finish to continue.

NOTE: Windows may require the Server Installation CD-ROM to complete the installation of the DHCP Service.
Close the Add and Remove Control Panel.

Configuring DHCP

You are now going to use the DHCP administration Applet to configure and enable DHCP for your network Server.  Click Start > Administrative Tools, then Choose DHCP.

You are now going to add a new DHCP Scope, by Right Clicking on the named server, then choosing New Scope.  A wizard will begin.  Click Next at the welcome page.

Type a name and description for the new Scope.  This name could be for a VLAN or just simply the name of the school.  Then click Next.

At the next page, enter the IP address information.  The Addresses that you enter should not include the server IP address or the Gateway/Router IP Address.  Doing so will cause unexpected problems at a later date.  The Start and End Addresses should be on the same subnet as your Domain Controller/File Server.

Once you have entered your required IP information, click Next to continue.

At this point you can now add any exclusions.  For example you have an RM SmartCache or Espresso box on your network that is difficult to reconfigure.  Using the exclusions you can ensure that the IP addresses of those machines are never handed out to other machines.

Each IP address that is handed out by the DHCP server will have a lease.  Choose an appropriate time for the lease to be valid.  When a lease expires, the IP address will be available for other computers.  Although the original computer will normally request the same IP address that it had before.

If you know the remaining configuration details for the scope, choose Yes and enter these details on the preceding pages.

Enter a Router/Gateway address, and then click Next.

Enter details about the internet domain name (the schools Active Directory name) and the local DNS Servers.  The local DNS Server will usually be the Active Directory Domain Controller.  Click Next.

Enter a WINS Server if you have set this up.  WINS is an older Windows version of DNS.  This is no longer required for operating a Windows Network.  You can leave this empty.

Finally choose to Activate the Scope at the end of the Wizard.

Once the scope has been created you will, need to authorise the DHCP Server so that it can start to assign network IP addresses to your workstations.  This process can take a few minutes to complete.

NOTE: There most only be one DHCP server on your network.  Multiple DHCP servers will result in conflicts occurring that could prevent machines connecting to the right server to logon.

Your DHCP server is now active and will be assigning IP addresses to new workstations.

You can see which IP addresses have been allocated by using the DHCP applet and browsing to the Address Leases branch of the relevant scope. 

Before we start on the installation, there are some things that we need to do first.  It is the all important planning stage which will help considerably with the installation of the new server.

Hardware Required:

• Server Class hardware such as Dell Power-Edge servers or HP Servers (although you could use a standard desktop computer with a big hard drive – not recommended)
• Network Switch and Cat5 Network Cables
• Internet Connection

Software Required:

• Windows Server 2003 R2 Standard Edition
• Drivers for Server Hardware (Network, Video, SCSI, Raid and Chipset)
• Client Access License for workstations

Other Information:

• Layout of how files will be stored on the Server hard disk
• Network IP Address information (Gateway, Subnet, IP for new server)
• New Domain Name (i.e. schooltech.local)
• Short NetBIOS Domain Name (i.e. SCHOOLTECH)
• Password for your Administrator Account

Whilst the above list is not comprehensive, it gives us a fairly good platform to enable us to build our new server.  One of the mistakes that many schools often make is to use the Internet Domain name that is used for the schools website and email.  Whilst it is not a generally a problem to use the schools Internet Domain name, it is often easier to have a shortened name for your internal network.  For example if your school internet domain name was southpark-community.authority.sch.uk, then you could use southpark.local for your internal network name.  You can always add the full domain name to the Active Directory for use with Exchange Mail servers at a later date.

The short NetBIOS name although very much a legacy from the old Windows NT domain days, is still required.  There is a restriction of the number of letters that can be used.  Where possible try to match the NetBIOS name with the internal domain name.  So in the example I have used earlier, you could choose SOUTHPARK as the NetBIOS name.

Another common mistake that people make when installing a new Server is to use the entire disk as one big drive.  If you have only one partition on your server, then you will find it a lot harder to implement Disk Quotas.  Also securing files will also be harder.  You will also not be able to take advantage of Workstation Deployment technologies for building workstations.   I would recommend that a minimum of 3 partitions are used on the Server.

If you don’t have any other type of Network in the school, it would make a whole lot of sense to work out what you are going to do with your IP addresses.  More small schools will usually have an IP subnet that allows for 253 possible computers on the network.  You could divide the network up into chunks to help make the management of IP addresses simplier to manage at a later date.  For example;

• 192.168.0.1 to 192.168.0.10 – Servers
• 192.168.0.11 to 192.168.0.29 – Network Printers
• 192.168.0.30 to 192.168.0.49 – Machines that need Manual IP Addresses
• 192.168.0.50 to 192.168.0.200 – Normal Network Workstations (DHCP – covered later)
• 192.168.0.201 to 192.168.0.253 – Reserved for future use
• 192.168.0.254 – Internet Gateway/Router

Practice Run

Before you start building your new network using real hardware, I would recommend that you first practice building your new network in a test environment.  You can use the Microsoft Virtual PC 2007 to emulate a Server.  You can install the Server environment as many times as you like, so that you build up your confidence.

You can download the Microsoft Virtual PC for Free from the www.microsoft.com/downloads centre.

Off We Go

For the purposes of this Guide, I will be using Virtual PC software and ISO CD images for setting up my Windows Server 2003 Network environment.

I have used my Network Planning sheet to record all of the information that I am going to use for setting up my new Server.  This form is located in the File section of this site.

Set your Server to boot from the CD-ROM drive, this will start the Windows Server 2003 installation routine.  In most cases Windows Server 2003 is able to detect quite a bit of the hardware that might be in your computer.  However if your Server has specialist RAID or other hardware, you might need to use the Press F6 to add additional hardware when prompted on the blue setup screens.  You will need to have drivers available on Floppy disk if this is the case.

When the above screen is displayed, press ENTER to continue the setup of Windows Server 2003.  The next screen will display the license agreement; you can press F8 if you agree to the license.

If the computer has not been used before, the setup will prompt which hard disk to install Windows Server 2003 on.  If there are no hard disks found, then you will require a driver for your hardware.

At this stage, do not allow the setup to use up all of the disk space.  Instead use the C option to create a new partition that is somewhere between 20 and 30Gb in size.  This will be plenty of space for the installation of the server.  If you have a large RAID array, then 20-30% of the available space might be more suitable to use.

For this demonstration system I am going to use 20GB for my first partition (C:).  Press Enter to set up Windows on the new partition.

As the partition is new, it will require formatting.  It is generally a good idea to format the partition using NTFS.  Avoid using the Quick partition, as this will only create headers on the disk and not check the surface condition of the disk – which could result in data loss.

For speed, I have used the Quick format.  When you press Enter, Set up will format the drive and then begin the next phase of the installation.

Some setup files are copied to the Server hard drive, once the copying is complete the server will reboot automatically.  Leave the CD-ROM in the drive, Windows will need that later on.

Windows will begin the next phase of the installation; this will have a graphical front end, similar to Windows XP setup.

When ready, the Windows Server 2003 setup will prompt for information to continue the setup.  You will need to setup your Regional Location and Keyboard layouts.  The default will be a US layout,  I don’t know why it should be any different from a UK layout, after all the S and Z keys are in the same place on a qwerty keyboard, and not swapped around because of American spellings.

There are 4 locations where you need to set United Kingdom, or to your own country.  I would also make sure that you remove the United States where ever you see it.  Sometimes you will need to click apply before you can remove the entry.

Enter your Windows Server 2003 product key.  Without a product key you will be unable to install Server 2003.

Select the licensing model that you wish to use.  Most schools will use the Per Device/Per User model, as each computer that connects to the server will have many users.  Read the various documents on the Microsoft Website about licensing before you commit to your choice of licensing.

Give your new server a name.  I have chosen SERVER-01, this allows an easy numbering scheme that also allows for additional servers at a later date.  Type in a password that is going to be used for your Administrator account.  You need to choose a password that has at least one Capital letter, lowercase letters, a number of a special character.

Set the Time zone to your location.  Windows will then go on to setup the Networking.

If you already know the network settings, then use the Custom Settings.  If you want to just get on and install Windows, then choose Typical.  You can set things like the IP address at a later time.

I have chosen to Custom setup the network.  This allows me to specify an IP address, or to load additional protocols for the network.

I have setup the TCP/IP stack with basic information.  Notice that I have chosen to use a DNS server that is already on my network for the time being.  Change this to be the DNS server of your Internet Service Provider.

Later on we shall be setting up DNS on the server itself and updating the TCP/IP settings to reflect that.  Using the ISP DNS server will allow Windows Update to update the server before we start configuring it.

You can leave the Workgroup as the default setting.  We shall be creating the domain environment later on.

At the end of the Installation, Setup will restart the computer.

Log onto the server using your Administrator username with the password you set earlier.

If you have used the R2 version of Windows Server 2003, then insert CD 2 into the drive and click OK.

Assuming that Windows Server 2003 has recognised your network card, it is advisable to Update the server as soon as possible, this will provide the server with all of the latest hotfixes and security patches.

If your ISP does not provide a direct route to the internet, then you can configure the Internet Explorer Proxy settings by using the Control Panel Applet for Internet Explorer.  Configure the Internet Proxy in the same way as you would for a Windows XP machine.

Internet Explorer on Server 2003 is automatically protected by Enhanced Security configuration.  I shall cover switching off the Enhanced Security later on.

Install the Windows Update control to allow Windows Update to update the computer successfully.  Install all of the available Windows updates.  Then configure the Automatic Windows update according to your preferences.  I would normally set the automatic updates to Download Only and install the updates at a time of my choosing.

After the Windows Updates have been installed.  Allow the server to reboot, to complete the installation of the updates.

Before configuring the server any further, you will need to resolve driver issues.  Right click on My Computer in the Start Menu and choose the Manage option.

This will display the Computer Management Console.  Expand Device manager to see a list of hardware that has not been recognised by Windows Server 2003.  Install the relevant hardware by using the Driver disk that came with your Server Hardware.  If you are testing on a Virtual PC, use the Virtual PC additions software to install the missing hardware.

Configuring the Active Directory Domain

Before we start setting up the new Active Directory Domain, we need to make a correction to the Network Card TCP/IP settings.

Click on the Start Menu and Choose Control Panel, Expand the Network Connections and right click on your network card.  Choose Properties from the pop-up list.

Set the Preferred DNS Server to the same IP address as the Server has.  Close the Network Card Properties.

Close the Manage Your Server screen.  We are going to setup the new domain and the relevant roles manually.

Type DCPROMO into the Run command dialog box, which you can find by using Start > Run.

The Active Directory Installation Wizard will now begin.  Click Next at the first and Second pages of the Wizard.  Ensure that the option for “Domain Controller for a new Domain” is selected, then click Next.  The choose Domain in a New Forest, then click Next.

Type in the full DNS for your new Domain.  Remember that it is recommend not to use your schools internet domain name.  Choose something that is shorter.  I have chosen Schooltech.local.  Click Next to move onto the next page.

The DCpromo tool will automatically search the network for a NetBIOS name, if one does not already exist, then it will automatically select a NetBIOS name based upon your full DNS name for your network.  Click Next to move onto the next Page.

Select folders for the Database and Log folders.  Leave these set as the default, as there is not going to be any performance gained by putting them on another disk.  Click Next to move on.

Select a SYSVOL folder, again leave this as the default, then click Next to move on.

DCPromo will detect that it has not been able to register the new DNS name against any DNS servers.  Choose the option to Install and Configure the DNS server on the new server.  This will save you a lot of hassle having to configure things manually.  Click Next to move on.

On the permissions page, leave the default and click Next.

At the Active Directory Restore Password, enter a password that might be used, in the event that a low level restoration of the server is required.  It is recommended that the password is recorded and put into the school safe in the event of an emergency.  NOTE:  it is possible to reset the Restore mode password once Active Directory has been installed.   There is more information on the Microsoft website about doing this.
Click Next at the Summary button, to begin the creation of Active Directory.

The server will take upto 10 minutes to build and configure a new Active Directory database and configure the server to run as a Domain Controller.  During this time, Windows may require the Windows Server 2003 CD-ROM to complete the installation of relevant services.

When the installation is complete, click the Finish button and choose to restart the server.

When the Server has rebooted, you will notice that a new Log on to option is listed on the log on to Windows dialog box.

Final Setup and Configuration

Now that the server has been setup, there are a few configuration changes that we need to make to the server.  By default the Manage Your Server screen will appear each time you logon to the server.  You can switch this off, by ticking a box at the bottom of the page.

From the Start Menu, choose Administrative Tools, then DNS

DNS is the most important part of your new Windows Server 2003, without it you will not be able to use tools like Group Policy correctly.  You will also experience problems with workstations connecting and logging into the Domain.

In order for other workstations to be able to resolve names on the Internet, we need to tell the Local Server DNS about other DNS servers that are located on the Internet.  By default Server 2003 will already know about the main Internet Root DNS servers.  These servers maintain records about every internet domain name.  However access to these servers may be slow, as the whole world might rely on these servers.  Configuring to use your ISP DNS servers may offer enhanced name resolution, or may be the only method to resolve external internet addresses.

Right click on the Server listed underneath the DNS branch, choose properties, then click the forwarders tab.

Enter the DNS server IP address of your ISP and click OK to save.

You can test that DNS is correctly resolving internet domains by using NSLOOKUP at the Command Prompt.

You have now successfully configured your new Windows Server 2003 machine with an Active Directory domain.  You can now start to add additional services to the Server such as DHCP to allocate IP Addresses to workstations.  You can create folders and share them with other computers on the network.  You can also create new user accounts and groups.  

For more articles about configuring your new Windows Server 2003 Server and Adding additional functionality see http://www.schooltechnician.co.uk/knowledge_base/windows_server/index.html

The WIM format offers has a lot more going for it than any of its rivals.  Ghost for example is basically disk imaging, which copies all of the individual bits from the hard drive.  To use Ghost you will require a license for each of the computers that you are imaging.  WIM doesn't require a license for each computer, several different computer images can be contained in the same file, saving space.  Image deployment is generally quicker as files are handed off to the host operating system that will then use drive caching techniques to boost the performance of the drive.

The key component of the WIM format file is an application called IMAGEX.  This command line application is very powerful, and not only captures images, but can deploy and mount the images as well.  ImageX is part of the WAIK (Windows Automated Installation Kit) and can be downloaded free of charge from the Microsoft Website.  I would recommend downloading and using the Business Desktop Deployment tool from Microsoft, as that will download all of the required files for you.

Because the WIM format supports Single Instance Storage without any complicated command lines or options to type, you can start using it right out of the box.  The most complicated part is creating the initial capture and deployment disks.

As a quick example, I made 2 images on the same bit of hardware, one for Curriculum use and one for Administration use.  The respective images sizes were 1.5Gb and 3GB.  I would normally send of a Ghost image to the OEM who would deploy that onto the machines that were sold.  My colleagues would then get a disk for each of the builds, just in case they needed to reload the machine at any point.  By combining the images, I ended up with a saving of over 1GB which doesn't seem like a lot, but actually saves a lot of back office time, as there is now only one DVD to build and send out.

How to Do It

To make use of the Single Instance storage feature of WIM, you need to append the new computer image onto an existing image that you had already taken.

First Image 

In my Admin/Curriculum example.  I built the Admin machine first, installed all the relevant software and set it up as required.  I then sysprep'd the machine and booted from a WinPE disk that had ImageX on.

The First Image was created the image using the command

imagex.exe /capture C: E:v490.wim "Admin_WSS" /check /compress maximum

This essentially captured the C: drive and all of the related files to a new WIM image on my external USB hard disk (E:).  I choose to use Maximum compression.  This took a bit longer to take the image, but I would consider this beneficial for images that are going to be deployed via CD/DVD

Second Image

I then built the Curriculum machine – wiping out the Admin hard disk in the process.  I installed all of the relevant software and created some basic users.  I then sysprep'd the machine and again booted from the WinPE disk that I used earlier.

I then used this command to capture the second copy of the image.

imagex.exe /append C: E:v490.wim "Curriculum" /check

The imageX application will automatically use the same compression that was used when the WIM was originally created.  It is not possible to use a different compression when appending an image to an existing image. The image process didn't take all that long to complete.  Mainly because the amount of data on the hard disk was much less than the Admin image.

The Results

Once the second image was complete, the WIM file had grown from 3,043,035Mb to 3,301,404Mb, so an additional 250Mb was added to the image.  This space saving could mean that instead of 2 DVD's for each reference computer, only one DVD is now required.

Applying the Image

Getting the image back onto the computer is reasonabliy simple.  Use the Apply command in ImageX to apply the image that you want.  I would recommend formatting the target computer before applying the image, otherwise ImageX will rename existing folders which might cause some confusion.

Command to apply the first image

imagex.exe /apply E:v490.wim 1 c: /verify

or if you have named the image, you can also use the image name

imagex.exe /apply E:v490.wim "Admin_WSS" C: /verify

To apply the second image, use the command;

imagex.exe /apply E:v490.wim 2 C: /verify 

Exchange 2003 to Exchange 2007 Migration Test Environment

Purpose of the Test Environment was to practice setting up
an Exchange 2007 mail server on a member server of a Windows 2003 domain.  Moving a mail box from the 2003 to 2007
Exchange server and checking that mail flow was still possible.

Test Environment:

• Intel Core 2 2.40Ghz – 2GB Ram – 32Bit

• Microsoft Virtual PC 2007

• Windows Server 2003 SP2 (mail2003) VPC with
  256Mb Ram

• Windows Server 2003 SP2 (mail2007) VPC with
  512Mb Ram

• Internet mail connectivity via port forwarder on
  Internet Router

The first Server (mail2003) was setup with Windows Server
2003 Standard that had SP2 already integrated into the CD.  Once commissioned the server had all Windows
Updates installed along with the required Virtual PC Additions.

In preparation for Exchange 2003, Internet Information
Services with SMTP and NNTP were installed. 
A new Active Directory was also created.

Exchange 2003 was then installed onto mail2003, following a
reboot SP2 was then installed.

Exchange 2003 was then tested to ensure correct
functionality, by sending messages to internal domain users and to the
internet.

Test1 – Upgrading to Exchange 2007 – Direct Upgrade

The conceived easiest way to upgrade would be to install
Exchange 2007 onto the existing Exchange Server.  If successful, then the entire platform could
be upgraded easily.

The Setup Application identified that several
pre-installation requisites were missing. 
The Microsoft .net framework version 2 and Microsoft Power shell were then
downloaded and installed.

The Setup Application allowed proceeding to the readiness
checks.  All checks failed.

1. Exchange is not in Native Mode
2. Exchange is already installed
3. Computer requires software patch
   http://go.microsoft.com/fwlink/?linkid=74469
4. Active Directory is in Mixed Mode

This test proves that there is no direct upgrade route to
Exchange 2007.

Test 2 – Additional Exchange Server

The second Virtual PC was setup with the exact same
configuration as mail2003.  With the exception
of having the .net 2 framework and power shell installed.

The Server was joined as a member server to the existing
domain with the Exchange 2003 environment installed.

• The Active Directory Domain was upgraded to
  Native 2003 mode

• Exchange 2003 was upgraded to Native Mode.

Exchange 2007 setup was run. 
Typical installation was chosen as the installation method.  At the readiness checks, installation failed
because SMTP and NNTP were installed as part of the IIS configuration.  The installation also failed to connect to
the domain controller and required that the server is logged in as a Domain
Administrator user.

With these problems corrected.  The Exchange setup passed the readiness
checks with warnings.

• Active Directory schema will be updated

• 32bit version of Exchange is not supported

The time taken to install Exchange took just under 22
minutes.

Moving a Mail Box

Usually mail boxes are moved using the Exchange Tasks
context menu of Active Directory Users and Computers.  The Domain Controller was used to attempt to
move the mail box from the Exchange 2003 to Exchange 2007 server.

The wizard failed to move the Mail box, suggesting that the
tool is upgraded to a compatible version. 
Not having the Exchange 2007 tools on the Domain controller would make
it difficult to manage the Exchange Mail boxes.

It is possible to move mail boxes using the Exchange 2007
MMC.  There are also numerous power shell
scripts that will move mail boxes based on group memberships.

Mail boxes can be moved both too and from an Exchange 2003
storage server.

Accessing the Mail Box

Accessing the Exchange Mail box using Outlook Web Access has
changed significantly.  The new method of
accessing the web based access is via a secured "HTTPS" web address.  The address has also changed.  From http://mail.domain.com/exchange/  to HTTPS://mail.domain.com/owa

A dummy certificate is installed, Internet Explorer 7
complains about the certificate, but does allow access to the site.  This would suggest that schools will need to
purchase a Domain certificate if they wish to allow external access to the
exchange server.

Moving mailboxes might suggest that Outlook may need to be
updated to use the correct Mail Server.

Sending Mail

Sending internal mail from the Exchange 2007 to Exchange
2003 and vice versa worked as expected. 
However the Exchange 2007 server was unable to send email to the
internet.  Inbound internet mail was
correctly routed to the incoming mail box.

To resolve the problem of sending mail from an Exchange 2007
mail box, a new Outbound SMTP connector must be created.

Menu Route, Organisation Configuration > Hub Transport
> Send Connectors > New.  Type Internet
and SMTP with domain name MX resolution was used for testing.

Smarthost addresses can be added to the same connector.

Once the SMTP connector was created, messages could be sent
to and from the Exchange 2007 machine (Note: inbound email was still being
received by the exchange 2003 server)

Uninstalling Exchange 2007

Uninstalling Exchange 2007 from the test environment proved
more difficult that is should have been. 
I could not uninstall Exchange because I had done something with the
Public Folders and didn't have enough knowledge of exchange to undo the bits
that I had changed.  I ended up
reinstalling Windows wiping out Exchange 2007 in the process.

However, what I tried was as follows.  First move any Mail boxes back to the
Exchange 2003 server, otherwise these could get deleted.  If you have moved or created Public
Mailboxes, these need to be removed first, using the Public Folder Management
Tool.  The shutdown all of the Exchange
Services, then remove any add-on Features such as Microsoft Forefront Security
Centre.  Use the Add/Remove Programs
control panel and choose to Remove Exchange. 
Un-tick all of the installed options then click Next.  Exchange should uninstall correctly.  The Setup application will alert you about
any problems that may prevent the un-installation.

Message Filtering

Message filtering is performed by the Edge Server which can
only be installed on a dedicated machine. 
It is not possible to install the Exchange Mail box role alongside the
Edge Server on the same machine.  One
possible work around would be to use Server Virtualisation so that an
additional physical machine is not required.

I am not sure how Edge message filtering would work for
internal mail, which would be the whole point of needing mail filtering on a
school network.

Other Info

The Exchange 2007 management tools make extensive use of the new MMC 3.0 management console.  The MMC appears slow to load and populate, however there is a vast range of Tasks that are made easier by using the MMC.  It is also possible to script many tasks by using the Microsoft PowerShell.  Using Powershell will make it easier to migrate all of your Exchange 2003 mail boxes to a new Exchange 2007 server. 

When I first started to manage a School network, everything was already in place, there were servers, network cables and computers.  The computer rooms pretty much ran themselves mainly due to good design on the network software and management tools.

Over the following years I learnt quite a bit about what I wanted from a networked system.  I was then given the opportunity to design and implement a new networked system that would initially run along side the existing network, then eventually replace the old network.

Of course having a limited budget ensured that I made the best use of the resources that I had at my disposal.  There was all sorts of things that I needed to take into account.  New hardware, new network infrastructure, new software licenses and of course integrating the older software so that it would run correctly with minimal downtime to the school.

To try and make things a little simpler, I am going to break this guide down into chunks, so that you can think about some of the steps that are involved.  The key aspect is that you end up with a reliable network system that means the demands of the curriculum.

Defining the needs of the School.

Your use of ICT in school will ultimately steer any decisions that you take, so it is important to take stock of everything that you currently have and use.  You will need to engage your staff to find out how they might like to use a new ICT system.  Talk to your colleagues so that you can understand where weaknesses might exist.  Not everyone is keen to use ICT in the classroom, and not everyone can use ICT for everyday tasks.  I still use a pen and paper, instead of typing directly into a word processor.

1.  Undertake a Survey/Audit of your existing ICT equipment and where it is used throughout the school.

2.  Address the staff asking for suggestions of how ICT might make a difference to the quality of teaching in the school (remember that no Idea is too big at this stage)

3.  Visit other schools in your area.  This will give you an understanding of the systems and suppliers that they use.

4.  Get in contact with other ICT co-ordinators.  This might be your neighbouring Primary School, or perhaps Secondary School or College.

5.  Contact your LEA for advice and support.  After all they will have specialists that can help.

Now that you have gathered some basic information about what the school already has, and perhaps what other schools are already using, you can now start build your plan.

What do you need.

Every Networked System will need something.  Listed below are the essential areas that you need to spend some time getting familiar with.

1.  Space – You will need space for a file server and monitor, not to mention secure storage space for a laptop trolley (if you get one) or ICT Suite.  You may even need space for Networked printers or photocopiers around the school.

2.  Electrical power points – May seem silly putting Electrical sockets in your list, but each computer requires at least two 13 amp wall sockets.  Most schools have baned the use of multi-gang extension leads.  It is also important that any power circuits that you have are able to cope with the load of X number of machines all starting up at the same time.

3.  Network Infrastructure – This is the bit that joins everything together.  Most school networks will have evolved, usually by schools daisy-chaining network hubs and switches, gradually extending the network over time.  In practice this is a bad idea, as problems can be introduced which are not always easy to find.  Where possible get new suites re-cabled to a single location where better quality network equipment can be located.  A Comm's cabinet will also require electric.

4.  Wireless – Do you need a Wireless connection for your laptops.  Wireless networks are more than capable of suppling a home Internet connection, but school networks are a lot more demanding.  Some manufactures suggest that for every 10 laptops there is 1 wireless access point.  You will also need to do a survey (see the Networking Section of this site).

5. Building layout and construction – When planning a major project, try to take into account the layout of your building.  How thick are the walls?  Would the room be large enough to comfortably teach in?  Is the room used for other purposes? What are the lighting conditions of the room?  Is there lots of Sunshine?  Might you need to get Air-Conditioning fitted.  In the case of Server Cupboards, is the room well ventilated and has enough electrical sockets.

If there is anything that you are unsure about - seek advice, your local electrician may be able to offer suitable advice about most things.  Usually your LEA will have a call-off contract for suppling data cabling and electrical works – again always good to seek support and advice.

Now that you have planned where everything is going to go and how it might be serviced by electric and data points, you can now think what you need.

Desktops

Desktop computers are a great investment.  They are relatively cheap to buy and will come with everything that you need.  Desktop computers come in a range of sizes and can go under the desk or behind an LCD monitor.  There are also integrated models that have the Computer and Screen built into one unit.  If you are just after a standard workstation that doesn't need to be a power horse then something like an RM One or Viglen Omnino make perfect classroom computers.

Desktop computers generally have faster processors, larger hard disks and more memory making them ideal for Video Editing as well as the usual Word processing and Internet surfing.

Laptops

Laptops/Notebooks are great for space saving, particularly if you don't have room in your school to make a purpose built ICT suite.  They can do everything that a Desktop computer can, however there are some things you should consider.  Laptop computers have a finite battery life, this means that you might be able to get up to 3 hours of usage before the batteries would need a recharge.  Recharging the batteries would take a long time.  You might be luck to get a morning and afternoon computer session.

Over time, the laptop batteries will begin to fail, holding less and less charge than they did before.  Ideally you should budget to replace the batteries at least once a year – or make sure your supplier has a battery replacement policy.

Laptops are generally are designed with medium range processors and smaller hard disks so that they can make power savings.  However they can still be used for intensive video editing as well as Word processing and Internet Surfing.

Software 

Schools generally have a lot of software that they will want to use on the computers.  It is essential that schools are aware of the license conditions that exist on the software that they use.  Most computers will come with a Windows License; this might be Windows XP or Windows Vista.  If you intend to connect the computers up to a Windows Server you will also require a Client Access License for each computer.  If you want to use Microsoft Office on all of your computers you will also need the correct licenses for each version of Microsoft Office that you intend to use.

Many schools make the mistake of referring to their Microsoft software as having a Site License.  Let's make it clear that there is no such thing as a Microsoft Site License.  There are of course subscription based annual licenses from Microsoft that can cover all of the computers in the school, but you will need to budget for this type of license.
Much of the older CD-ROM titles may not be compatible with Windows XP or Windows Vista.  Be prepared to bin these old titles.  It may not be worth the time or effort in trying to get this software to work.

Most educational Software is designed for Standalone use and may not work well in a networked environment.  You need to sacrifice some of the benefits of a managed network for some of the features in the software.

Windows XP or Windows Vista?  Many new computers these days will now arrive with a Windows Vista license.  The chances are that the version of Windows Vista will be a Home version, such as Home Basic Edition or Home Premium Edition.  These versions of Windows Vista are NOT able to be managed by centralised file server.  To get the full benefits of a centrally managed network system you will need to purchase an additional upgrade license for Windows Vista Business Edition.

For the time being Windows XP Professional might be the most sensible choice for most Schools, until Windows XP is no longer available.

Where possible when buying new software for your network, try to make sure that the software has been designed for network deployment.  This type of software can be installed across the network from a centralised location, often unattended and pushed from the servers Active Directory.

Training

With any networked system you will need to make sure that there is training support available.  Otherwise you will be left with a network that you haven't a clue how to manage effectively.  It is your responsibility to find and organise training for yourself.  Even if you just got a pile of books and practice for the skills that you need to acquire. 

After Thoughts

It is going to be impossible to plan for everything, but after reading this article, hopefully you will have some understanding as to the things that you need to consider.  There are plenty of sources of information that will make planning and deploying a networked system much easy. 

If your local LEA can support you then make the best use of there support.  It may appear to cost more on paper when you buy in additional support for the running of your network, but think about all the time that you will save from having to learn advanced skills to manage a networked environment.

I use virtual machine images all of the time, for my application development work, or even connecting into my works network via a VPN.  Without the use of Virtual Machines, my computer would be full of junk that would just clog up the computer.  They are really helpful when you don't have resources for setting up multiple machines for specific tasks.

All of these Virtual machines take up disk space one way or another.  VMWare (www.vmware.com) has the ability to split virtual hard disks into 2GB chunks, this helps with keeping file fragmentation down.  Where as Virtual Machine (www.microsoft.com/virtualpc) uses a single huge file to store is data on.  Regular use of Virtual Machine will eventually mean that your disks become fragmented, slowing down the performance of your PC and Virtual Machines.

Defragmenting the Virtual Hard disk images will take ages to complete, as they are so large.  You will also need a stack of disk space to store the images on.  I mainly store my images on separate hard disks from the host operating system.  I have some VM's running on a USB2 disks and the main images that I use all of the time run from an External E-SATA drive – ensuring top performance without impacting on the host OS.

Microsoft Virtual Machine has a Disk Compactor tool built in, this is supposed to release all of the unused sections of space in the Virtual HD file.  To be fair it does a reasonable job, and the image size is reduced.  But this is a process that you have to undertake yourself.  It is a time consuming process to compact the images and defragment them.  The same is true with VMWare.

The answer to managing the size of your Virtual Machine Images is to use an application from www.visioncore.com. vOptimizer will process any of the VM Images that you have and does its best to remove all of the redundant data from the image.  This includes removing temporary files and OS features such as the games in Windows XP.  There are 21 optimisation features that are user selectable.

The good news is that VisionCore have a freeware version of the application http://www.vizioncore.com/voptimizer/voptimizer_freeware.html perfect for managing your VM images.  There are comercial licences should you have requirements to optimise images stored on remote drives.

Testing vOptimizer, gave really good results, one 12GB Windows Server 2003 images was reduced down to just under 9GB.  The same was true of a Windows XP image.  This 3 GB space saving should really make a difference when backing up the images and also with the everyday use of the Virtual Machine.

The ban news with vOptimizer is that it will only work on Windows based Hosts with Windows Operating Systems of Windows 2000 and above installed.

Working in an environment where data of this nature is very sensitive, there is a pressing need to ensure that data is sent in a secure way.  After all the last thing that we would want to see is our school names splashed across the national news papers headlines.

There is plenty that you can do to ensure that your data is secure, if you send the data on CD/DVD or if you send via file upload.  The answer of course is simple – Zip it up and use Encryption with a secure passkey.

Capita only support compressed data that is in either self extracting EXE, ZIP or RAR format.  To compress to this format you will need a commercial tool such as WinZip (www.winzip.com) or WinRAR (www.rarlabs.com).  Both of these commercial companies offer a free trial version of the software.  It is important to remember that this is only a trial version, you will be required to purchase a licence if you continue to use the software.

Both WinZip and WinRAR offer great support for file compression with Encryption.  They are easy to use and also integrate into the Windows Shell, meaning that you can Right click on a file and send to an archive.  It is worth remembering that both of these utilities will default to just compressing the files – this will not be enough to secure your data.  Always choose the option to add to an Archive, this will allow you to select additional options such as encryption.

The other key aspect of keeping your data secure is to use a strong encryption key.  You could use a Random number generator inside of an Excel Spreadsheet, or you could use a web-based service such as http://www.goodpassword.com/ to generate a password.  Always use Copy and Paste when recording and entering this password, otherwise the recipiant will not be able to unscramble your file.

Now that you have an encryption key, the next phase is to ensure that the recipent has the key.  If you have a support call with Capita or your support helpdesk, then add the Encryption key to the logged call, the support staff should know what to do with it, if they have requested data.  If you can't send the data or Encryption key electronically, then ensure that you send the data and Encryption key separately.  Always leave a 2 day gap in posting to ensure that there is no chance that the 2 will be delivered at the same time.

The data is useless to the support staff without the encryption key, like wise the encryption key is meaningless without the data.

As licensing WinZip or WinRAR may be an issue for some schools, the next best thing would be to use free archiving software such as 7-Zip (www.7-zip.org) or IZArc (www.IZArc.org) both of these free tools offer encryption or password protection.  The real bonus is that schools don't have to pay for a bit of software that they might only use once or twice.

At a recent Capita Technical Seminar, the chief technical guru explained that Capita will accept any compressed archive as long as they can extract it – or rather it contains a method to self-extract. Therefore Capita will accept a self extracting archive created by the popular 7-zip archiving application.