Popular Post DMcCoy Posted August 22, 2009 Popular Post Posted August 22, 2009 So, it seems Microsoft don't actually test things like *using* a server OS before they release it. The major non MS issue - backup Exec is not compatible, this may be a hotfix for 12.5 or even wait until the next release! The MS things: No WSUS, hooray! Put an entry in the list of available roles for something that doesn't yet exist! No WSUS 3.0 SP2 yet, so no WSUS for 2008 R2. Errors and warnings galore! I've got it down to 1 error and 5 warnings for the boot of a DC now. There is an error for when Windows boots from the Active Directory Web Services (this seems to be new), seems to be a startup order issue (but happened to both DCs). A couple of SSL certificate warnings, one for the previously mentioned ADWS which is not fixable, seeing as all the other services are quite happy with the generated DC certificate. And then there are the annoying things. Why the Shared documents, with all the sample Videos and music crap? This is a SERVER OS! You cannot input a name during sysprep - this is not a bug, but a design decision for 2008 R2. Firewall not opened for KMS server when you use it. Lots of Hyper-V crap bundled by default, although not enabled. nslookup a bit broken until you use or disable ipv6 No Exchange support There are a few nice things: KMS server now counts VMs towards the activation count Can't think of anything else specific right now, it's really *very* similar to 2008. The schema updates for R2 and Windows 7 are quite minor over 2008. 8
Theblacksheep Posted August 22, 2009 Posted August 22, 2009 (edited) There are a few nice things: KMS server now counts VMs towards the activation count Can't think of anything else specific right now, it's really *very* similar to 2008. The schema updates for R2 and Windows 7 are quite minor over 2008. Best nice new thing: DirectAccess! If you use hyper-v: live migration and a clustered file system support (finally). Edited August 22, 2009 by Theblacksheep
DMcCoy Posted August 22, 2009 Author Posted August 22, 2009 (edited) For any heavy IAS users. MD5 has been removed as an authentication method. I know it is not terribly secure, but it is used by my HP Radio Ports so that they can still use 802.1x to login to the network. You can enable it again by adding the following keys (found on MS forums): HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\4 Value name: RolesSupported Value type: REG_DWORD Value data: 0000000a Value name: FriendlyName Value type: REG_SZ Value data: Microsoft: MD5-Challenge Value name: Path Value type: REG_EXPAND_SZ Value data: %SystemRoot%\System32\Raschap.dll Value name: InvokeUsernameDialog Value type: REG_DWORD Value data: 00000001 Value name: InvokePasswordDialog Value type: REG_DWORD Value data: 00000001 On the plus side there is a migration tool to move the settings from 2003 to 2008 for IAS. Edited August 22, 2009 by DMcCoy Add "Microsoft:" to a key to make it tidy in UI
PiqueABoo Posted August 22, 2009 Posted August 22, 2009 backup Exec is not compatible No WSUS, hooray! I'll second that hooray! Reason being I very recently agonised over whether to install 2K8 or just released 2K8 R2 for something. I cautiously settled on 2K8 which is good because the above items are both show stoppers (I couldn't have waited for them to be fixed). Vindicated :: phew ::. nslookup a bit broken until you use or disable ipv6 I've been knocking that out by default on 2K8 (too much ipconfig output to wade through otherwise). No Exchange support Exchange is (or should be) a dedicated app server or two .. or three ... Do you really care? live migration and a clustered file system support (finally). Not having hundreds of virtual servers to throw around I don't care that much about live migration, will be useful very infrequently. CSV is definitely good though.
PEO Posted August 22, 2009 Posted August 22, 2009 not going to bother here just yet, I may look at it next summer, when I re-asses our needs
EduTech Posted August 22, 2009 Posted August 22, 2009 Microsoft Exchange 2007 does not work, but Exchange 2010 will work on Server 2008 R2. Server 2008 R2 was done the way it was as technically it is like another server release not an R2, but if it wasn't done as an R2 people would of had to replace their CAL's so with Microsoft doing it this was it has saved people some money rather then them having to go and buy new CALs aswell. James.
DMcCoy Posted August 22, 2009 Author Posted August 22, 2009 Exchange is (or should be) a dedicated app server or two .. or three ... Do you really care? Only in that I am stuck on 2003 as I had no 64 bit VM support. I have been waiting to change to 2007 for years, but I don't want to implement a 2008 server only to change it to 2008 R2 in a short time. I will skip 2007 and wait for 2010. Anything else that isn't R2 compatible yet (SIMS, Learning Gateway etc) will get moved to new 2003 x64 installs. x64 because it removes some emulation on the Nehalems to speed things up. And about the Clustered FS, it really NTFS with knobs on not a true clustered FS, which put me off Hyper-V again.
Crispin Posted August 22, 2009 Posted August 22, 2009 No WSUS, hooray! Put an entry in the list of available roles for something that doesn't yet exist! No WSUS 3.0 SP2 yet, so no WSUS for 2008 R2. I'm assuming this means R2 won't be fully compatible with SCCM 2007 R2? That's gonna be a spanner in the works.
PiqueABoo Posted August 22, 2009 Posted August 22, 2009 I will skip 2007 and wait for 2010 RC released last week.. shouldn't be a long wait... and shouldn't be like 2007 RTM i.e. a bit feature deficient.
Theblacksheep Posted August 22, 2009 Posted August 22, 2009 I'm assuming this means R2 won't be fully compatible with SCCM 2007 R2? That's gonna be a spanner in the works. Sp2 out soon
DrCheese Posted August 22, 2009 Posted August 22, 2009 The major non MS issue - backup Exec is not compatible, this may be a hotfix for 12.5 or even wait until the next release! Not fussed about the main server software for now, as the server I have it on has no need to be upgraded to R2 (although I'd like to) Does the agent work at least?
DMcCoy Posted August 22, 2009 Author Posted August 22, 2009 Not fussed about the main server software for now, as the server I have it on has no need to be upgraded to R2 (although I'd like to) Does the agent work at least? Media Server = No chance Agent = Somewhat broken, although there may be a way around VSS issues 1
tmcd35 Posted August 23, 2009 Posted August 23, 2009 Best nice new thing: DirectAccess! nslookup a bit broken until you use or disable ipv6 Heres a question, how many of us have LEA assigned/controlled IP addresses and firewall setups? I can foresee a problem with both DirectAccess and IPv6 here. DirectAccess is a VPN. A very, very clever VPN with a lot of the setup hidden away from the end user, but still a VPN non the less. This is going to require the correct ports opened on the myriad of firewalls between my network and the Internet. Could be a bit of a fight here. Like whys, if IP's are currently issued in blocks by County who are using IP4 where do we stand with IP6? I guess the answer is to wait for them to get on board with IP6 and roll it out to us in the trenches. I haven't really looked in to this yet, but doe IP6 have any private ranges like IP4 (192.168.x.x, 172.16.x.x, 10.x.x.x - for instance)? I know it shouldn't need it private ranges as there should be enough IP's available for every known device to have a few unique addresses.
SYNACK Posted August 23, 2009 Posted August 23, 2009 Heres a question, how many of us have LEA assigned/controlled IP addresses and firewall setups? I can foresee a problem with both DirectAccess and IPv6 here. DirectAccess is a VPN. A very, very clever VPN with a lot of the setup hidden away from the end user, but still a VPN non the less. This is going to require the correct ports opened on the myriad of firewalls between my network and the Internet. Could be a bit of a fight here. Like whys, if IP's are currently issued in blocks by County who are using IP4 where do we stand with IP6? I guess the answer is to wait for them to get on board with IP6 and roll it out to us in the trenches. No fight nessisary, if IP6 is not avalible then it will just use SSL (https) which is allowed practiclly everywhere and should even be realitivly easy for stone age LEA firewalls to publish a couple of servers from your internal site. The DirectAccess Connection Process It will also attempt to pipe Teredo encapsulated IP6 traffic to a more up to date host if it is not directly IP6 enabled. I know that the providers here are a long way off IP6 as I was hasseling them about it about a year ago when I first heard about the new feature. I haven't really looked in to this yet, but doe IP6 have any private ranges like IP4 (192.168.x.x, 172.16.x.x, 10.x.x.x - for instance)? I know it shouldn't need it private ranges as there should be enough IP's available for every known device to have a few unique addresses. By the looks of it there are several layers of IP address space that the computer participates in, one of these is the site local address which is simmilar to the private ip range. They also have global ips and the system will use the lowest level ip to attempt connection first. For example if you are in the internal network and it can connect using the site local address it will use that but otherwise it will use a higher level address to access resources outside the local network. https://wiki.tools.ietf.org/id/draft-durand-ngtrans-dns-issues-00.txt
GrumbleDook Posted August 23, 2009 Posted August 23, 2009 Heres a question, how many of us have LEA assigned/controlled IP addresses and firewall setups? I can foresee a problem with both DirectAccess and IPv6 here. DirectAccess is a VPN. A very, very clever VPN with a lot of the setup hidden away from the end user, but still a VPN non the less. This is going to require the correct ports opened on the myriad of firewalls between my network and the Internet. Could be a bit of a fight here. Like whys, if IP's are currently issued in blocks by County who are using IP4 where do we stand with IP6? I guess the answer is to wait for them to get on board with IP6 and roll it out to us in the trenches. I haven't really looked in to this yet, but doe IP6 have any private ranges like IP4 (192.168.x.x, 172.16.x.x, 10.x.x.x - for instance)? I know it shouldn't need it private ranges as there should be enough IP's available for every known device to have a few unique addresses. Yes, this is one of the things I spotted from Friday's session at Reading, which I will have to take back to the RBC to discuss ... and I am sure it is something that will be discussed nationally too, so your RBC might already be looking into it (you could ask them!), but I will let you know when I hear something.
DMcCoy Posted August 23, 2009 Author Posted August 23, 2009 (edited) I have been trying to get Softlink Alice working on 2008R2, just to see if I can. Apart from having to manually register the isapi extension and enable 32 bit app pool (Installer from 2003 for IIS5!) for the web inquiry, it all seems to work, even when run on the server rather than just as a file share! I'm not sure if that says more about Alice seemingly to be fully 32 bit rather than 2008 being compatible with older applications. Edited August 23, 2009 by DMcCoy
Gatt Posted August 23, 2009 Posted August 23, 2009 I came a cropper with 2 apps WSUS and OCS 2007 R2 Both have had to be re-installed on non-R2 Servers... Will prob shift WSUS back to its proper server if SP2 works!
DMcCoy Posted August 24, 2009 Author Posted August 24, 2009 Argh! BIG incompatibility. Smoothwall doesn't work with R2! At least NTLM doesn't.
john Posted August 24, 2009 Posted August 24, 2009 Argh! BIG incompatibility. Smoothwall doesn't work with R2! At least NTLM doesn't. Mine working fine :S I've pointed this thread to the good Sir Tom and I am sure he will be on to it like a bolt of lightening!
DMcCoy Posted August 24, 2009 Author Posted August 24, 2009 NTLM ident works, NTLM auth does not. I can see the ldap requests, but the user is never logged in.
Theblacksheep Posted August 24, 2009 Posted August 24, 2009 NTLM ident works, NTLM auth does not. I can see the ldap requests, but the user is never logged in. Havent they changed NTLM for more security? I read about the the other night, but the referencing docs arent up on technet at the mo.
rob_f Posted August 24, 2009 Posted August 24, 2009 FYI, we're looking into this now for you Smoothie folks. Rob. 3
ZeroHour Posted August 24, 2009 Posted August 24, 2009 I'm assuming this means R2 won't be fully compatible with SCCM 2007 R2? That's gonna be a spanner in the works. There is a beta out that allows SCCM 2007 to deploy r2/windows 7 but MS are saying if you install it you WONT be able to upgrade to release and will need to wipe but who knows if its actually blocked as an install.
john Posted August 24, 2009 Posted August 24, 2009 NTLM ident works, NTLM auth does not. I can see the ldap requests, but the user is never logged in. You need to do my S7000 fix on your R2 DCs, I will dig it out in a minute that will cure it I suspect, they have bought NTLM stuff right up to the latest top security and a LOT of kit isn't up to date with it as they are still using NT4 style NTLM which quite rightly in some cases is a bit sloppy as its very insecure now a days (so MS tell us) but should have been brought up to date. I don't know if this is what the Smoothy is struggling on, but I am sure Rob, Tom and crew will soon have it bossed
Theblacksheep Posted August 24, 2009 Posted August 24, 2009 (edited) 128bit NTLM encryption: Changes in NTLM Authentication 2008-2008R2 changes: What's New: Changes in Functionality from Windows Server 2008 to Windows Server 2008 R2 Edited August 24, 2009 by Theblacksheep
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now