My Thoughts On IT…

Brian Lewis's Thoughts on all things Information Technology related

220px-Microsoft_HealthVaultIt is always interesting in a large organization, like Microsoft, because there are a lot of really great things the company does that most people don’t know about. For example in my last post I had stumbled across the Elevation of Privilege (EoP) Card Game card game. Well today I stumbled across the Microsoft Health Vault. It is a whole lot more than a little card game. Can you tell that I have been at a conference and have been browsing the web a bit?

So what is the Microsoft HealthVault? It is a platform from Microsoft to store and maintain health and fitness information. It was started back in October 2007. It enables you to store your health information “in the Cloud” and choose which healthcare professionals are allowed to access your information. There are also a large number of applications that integrate into HealthVault that can track your diet or your workouts and much more. There are even hardware devices which will automatically load your data up to your vault. Things like heart monitors etc.

Take a look and see what you think at:
www.healthvault.com

imageEvery once in a while I come across something interesting and useful. Today I discovered something on the Microsoft Website. It is a learning tool for developers to help them understand coding securely. This falls under the Secure Definition Lifecycle (SDL). So if you program or just want to understand what programmers need to watch out for this card game is for you.

Check it out here: http://www.microsoft.com/security/sdl/adopt/eop.aspx

imageThose of you waiting for a Windows Phone to come to a CDMA carrier need to wait just a little longer. The “HTC Arrive” is due to arrive on March 20th 2011. The phone has a 3.6-inch capacitive touch screen with a slide out keyboard. It has a 1 GHz Snapdragon processor and has 16 GB of storage. For more information on this phone please see: http://now.sprint.com/arrive/?id16=arrive

The Xbox Kinect is truly an amazing step forward in commercially available technology. I believe this is just a start of things to come. The device gives computers the ability to see in 3D, the way people see the world. This technology allows a computer to track movements – So, when hooked up to an Xbox it means we can play games and interact with the computer without any controllers.  If you haven’t had the chance to play yet – it is really fun!

Now think about what you could do with this technology. For example if it was hooked up to a robot; it could see distance and movement and map out the 3 dimensions of it’s environment. This could be done in the past but it was extremely expensive. Now it is available at commodity pricing. Because of the low price point the Kinect opens up this technology to everyone. I expect to see the robotics enthusiasts to utilize this. It will be interesting to see what other innovative ideas people come up with.

Enthusiasts have reverse engineered a driver for the Kinect so people could start to play with it. But what would be even better is a fully supported SDK. That is exactly what Microsoft is doing. The Kinect for Windows SDK is being developed and released by the Microsoft Research group. It will be available this spring as a free download, and will give academic researchers and enthusiasts access to key pieces of the Kinect system—such as the audio technology, system application programming interfaces and direct control of the Kinect sensor itself.

For more information check out this site:
http://research.microsoft.com/en-us/news/features/kinectforwindowssdk-022111.aspx

Passwords…

Comments off

Most people would be surprised at how easy it is to guess their passwords. For most people if you know a little about them you can guess their passwords. I had a friend who dared me to "break" into their iPhone. They handed it to me and I thought for a short while and tried entering their birthday "1207" – and I was in. They were shocked and dismayed. Really? I was shocked at how poor a password that was.

You can also reset passwords at many sites if you know some basic information about the person. Real tough questions like "what city were you born in?" If you know two of those "hard questions" you can reset the password. That is how Sara Palin’s yahoo email account was allegedly hacked into. I treat those questions like a password. When asked what city I was born in I enter "xyrtg3ji" or whatever my random password generator creates.

Even if you can’t guess someone’s password it is probably easy to brute force the password. Most people use real words for their passwords which drastically reduces the possible letter combinations. There are hacker dictionaries available on the internet that have the top used passwords in there to guess those first. Back in 1994 I read a book called "Secrets of a Super Hacker" and I was shocked to find my password in the back of the book in a small password dictionary. I thought because I was using an obscure word that would make it a stronger password – wrong it actually makes it weaker because it makes the short list.

Another thing people think will make their password more secure is to add numbers to the end of the word. While it does make it more secure it only adds a few minutes of guessing to a brute force attack.

A few don’t rules about passwords:

  • Don’t use numbers, birthdays. (i.e. "12345" or "10031988")
  • Don’t use your kids or pets names (i.e. "Samuel" or "spot")
  • Don’t use obvious words or combinations (i.e. "password" or "password123")
  • Don’t use names or dictionary words (i.e. "John" or "automobile" or "fish")
  • Don’t use the same password on multiple systems
  • Don’t choose short passwords. At a minimum have 8 characters – more is better.

Here are two ideas on how to create more secure passwords:

  1. Take a full sentence and take the first letter or two from each word. (i.e. The sentence "I want to eat at Taco Bell today" yields "IwteaTBt")
  2. Use a random password generator to create the password and a password wallet so you can remember them.

Security and usability are almost always at odds with each other. Today there are way to many passwords we need to remember. It is rare that a person can remember beyond 7 passwords and many of us can’t even do that. What I use is a password manager to keep track of my passwords. I have this sync between my computers and my smartphone. That way I always have what I need.

Here are a few Free password managers

KeePass

http://keepass.info/

Free. KeePass, the free, open source, light-weight and easy-to-use password manager.

PasswordSafe

http://passwordsafe.sourceforge.net/

Free. Password Safe is free and allows you to safely and easily create a secured and encrypted user name/password list. With PasswordSafe all you have to do is create and remember a single "Master Password" of your choice in order to unlock and access your entire user name/password list

Efficient Password Manager

http://www.efficientpasswordmanager.com/

Free. Still be worrying about so many passwords to remember? Now we have Efficient Password Manager, a completely free but powerful and unique password management software program.

There are a lot of good for cost password managers available. They offer things that the free ones don’t like online backup so you never loose your passwords. Automatic Synchronization so your passwords are always up to date. One of the easiest to use is Password Genie. My late Father’s favorite was RoboForm.

The password managers that I really like are the wallets. They not only encrypt and store your passwords but they also store your credit card numbers, bank account info, frequent flyer numbers, and anything else you want to keep secure. I also like the ones that offer synchronization so that my latest passwords are always on all my PCs and smartphone. I need them to offer a password generator because I too fail at creating difficult passwords. Lastly I like it when they have a web browser plugin that enters the passwords for me with the touch of a button. I have used all 3 of the managers below and they are all good.

Here are my three favorite:

SPB Wallet

http://spb.com/products/wallet/

SPB Wallet supports Windows, Mac, iPhone, iPad, Windows Mobile, Symbian. With more mobile devices to come…

Code Wallet Pro

http://www.developerone.com/codewalletpro/windowspc.htm

CodeWallet Pro 6 Desktop/PC Companion Edition securely organizes all of your business and personal information. The PC Edition is the perfect companion to the mobile version of CodeWallet. Manage passwords, banking information, credit card details, PIN codes, travel plans, insurance policies, registration codes, gift lists, you name it,

eWallet

http://www.iliumsoft.com/site/ew/ew_ssh.php#hpc

Do you have too much info to remember? Do you wish you could take all your passwords, credit cards, account information and logins with you – so they’re handy when you want them? But keep them safe – so you don’t have to worry about intruders finding them? You need eWallet.

Passwords…

Comments off

Most people would be surprised at how easy it is to guess their passwords. For most people if you know a little about them you can guess their passwords. I had a friend who dared me to "break" into their iPhone. They handed it to me and I thought for a short while and tried entering their birthday "1207" – and I was in. They were shocked and dismayed. Really? I was shocked at how poor a password that was.

You can also reset passwords at many sites if you know some basic information about the person. Real tough questions like "what city were you born in?" If you know two of those "hard questions" you can reset the password. That is how Sara Palin’s yahoo email account was allegedly hacked into. I treat those questions like a password. When asked what city I was born in I enter "xyrtg3ji" or whatever my random password generator creates.

Even if you can’t guess someone’s password it is probably easy to brute force the password. Most people use real words for their passwords which drastically reduces the possible letter combinations. There are hacker dictionaries available on the internet that have the top used passwords in there to guess those first. Back in 1994 I read a book called "Secrets of a Super Hacker" and I was shocked to find my password in the back of the book in a small password dictionary. I thought because I was using an obscure word that would make it a stronger password – wrong it actually makes it weaker because it makes the short list.

Another thing people think will make their password more secure is to add numbers to the end of the word. While it does make it more secure it only adds a few minutes of guessing to a brute force attack.

A few don’t rules about passwords:

  • Don’t use numbers, birthdays. (i.e. "12345" or "10031988")
  • Don’t use your kids or pets names (i.e. "Samuel" or "spot")
  • Don’t use obvious words or combinations (i.e. "password" or "password123")
  • Don’t use names or dictionary words (i.e. "John" or "automobile" or "fish")
  • Don’t use the same password on multiple systems
  • Don’t choose short passwords. At a minimum have 8 characters – more is better.

Here are two ideas on how to create more secure passwords:

  1. Take a full sentence and take the first letter or two from each word. (i.e. The sentence "I want to eat at Taco Bell today" yields "IwteaTBt")
  2. Use a random password generator to create the password and a password wallet so you can remember them.

Security and usability are almost always at odds with each other. Today there are way to many passwords we need to remember. It is rare that a person can remember beyond 7 passwords and many of us can’t even do that. What I use is a password manager to keep track of my passwords. I have this sync between my computers and my smartphone. That way I always have what I need.

Here are a few Free password managers

KeePass

http://keepass.info/

Free. KeePass, the free, open source, light-weight and easy-to-use password manager.

PasswordSafe

http://passwordsafe.sourceforge.net/

Free. Password Safe is free and allows you to safely and easily create a secured and encrypted user name/password list. With PasswordSafe all you have to do is create and remember a single "Master Password" of your choice in order to unlock and access your entire user name/password list

Efficient Password Manager

http://www.efficientpasswordmanager.com/

Free. Still be worrying about so many passwords to remember? Now we have Efficient Password Manager, a completely free but powerful and unique password management software program.

There are a lot of good for cost password managers available. They offer things that the free ones don’t like online backup so you never loose your passwords. Automatic Synchronization so your passwords are always up to date. One of the easiest to use is Password Genie. My late Father’s favorite was RoboForm.

The password managers that I really like are the wallets. They not only encrypt and store your passwords but they also store your credit card numbers, bank account info, frequent flyer numbers, and anything else you want to keep secure. I also like the ones that offer synchronization so that my latest passwords are always on all my PCs and smartphone. I need them to offer a password generator because I too fail at creating difficult passwords. Lastly I like it when they have a web browser plugin that enters the passwords for me with the touch of a button. I have used all 3 of the managers below and they are all good.

Here are my three favorite:

SPB Wallet

http://spb.com/products/wallet/

SPB Wallet supports Windows, Mac, iPhone, iPad, Windows Mobile, Symbian. With more mobile devices to come…

Code Wallet Pro

http://www.developerone.com/codewalletpro/windowspc.htm

CodeWallet Pro 6 Desktop/PC Companion Edition securely organizes all of your business and personal information. The PC Edition is the perfect companion to the mobile version of CodeWallet. Manage passwords, banking information, credit card details, PIN codes, travel plans, insurance policies, registration codes, gift lists, you name it,

eWallet

http://www.iliumsoft.com/site/ew/ew_ssh.php#hpc

Do you have too much info to remember? Do you wish you could take all your passwords, credit cards, account information and logins with you – so they’re handy when you want them? But keep them safe – so you don’t have to worry about intruders finding them? You need eWallet.

VDI Licensing 101

Comments off

Understanding Microsoft Licensing can be, and often is, more difficult than understanding the technology. In this post we will look at what is required to license Windows in a VDI scenario.

The concept of VDI is to store and run desktop workloads including a Windows client operating system, applications, and data in a server-based virtual machine in a data center; and allow a user to interact with the desktop presented onto a user device via a Remote Desktop Protocol such as Microsoft’s RDP or Citrix’s ICA.

VDI Licensing
There is some confusion here because the old Microsoft Windows VDI licensing model called VECD. Please ignore any VECD material as it has been replaced by VDA (Virtual Desktop Access) as of July 1st 2010.

If I want to access a virtual machine running a Windows client I have two choices. If the machine I am running is Windows then I either need that machine covered under software assurance or I need to buy a VDA license. For all other devices I need a VDA license. Windows VDA is a device-based subscription license and will be available at $100/device/year.

So it doesn’t matter if you use Hyper-v or VMWare ESX or something else. To run Windows clients in a VDI scenario you need to either:

  • License the Windows desktop used to access the VM under SA. about $40 a year
  • License the device with a VDA license for about $100 a year

Hope that helps. Let me know if you have questions.

I received two questions today about Windows 7 and the subscriber downloads in TechNet and I thought it might be useful for others. I do have to agree with the customer that TechNet Subscriber downloads are much better than acquiring you test software from a torrent. Not that any of you would know anything about that… TechNet Subscriber downloads are also more convenient and safer!

Does Windows 7 have anything like Windows XP volume licensing?
Windows 7 does not have a volume licensing version like Win XP. There is no version of Windows 7 that doesn’t require activation. The closest thing to how it was in XP is the MAK key. (Multiple Activation Key) The same MAK key can be used in several installations on different PCs. Those PCs will need to individually connect to Microsoft and activate. Once they are activated they will not need to communicate with Microsoft again. A MAK key has a preset number of allowed activations, so once the limit has been reached the MAK key no longer activates.

image

What are the N, K, and KN versions of Windows 7?
The N, K, and KN versions of Windows 7 are versions that have had components of the OS removed for legal reasons. You generally don’t want those versions. Here are the details of what is different:

  • Windows 7 N: Windows 7 N is meant for European market, and includes the same functionality as Windows 7, except that it does not include Windows Media Player and related technologies such as Windows Movie Maker.
  • Windows 7 K: Windows 7 K is meant for Korean market, and includes the same functionality as ordinary Windows 7, except that it includes links to a Media Player Center Web site and a Messenger Center Web site.
  • Windows 7 KN: Windows 7 KN is meant for Korean market, and includes the same functionality as Windows 7 K, except that it does not include Windows Media Player and related technologies such as Windows Movie Maker, links to download Windows Live Messenger, or links to a Media Player Center Web Site and a Messenger Center Web site.

I hope this helps clears up some of the questions you may have had.

clip_image002How will your IT organization consider using “the cloud”?  Is there even an option for you; and if so, what does it look like?

Next month we start our new series of events focusing on how IT is being transformed into a dynamic, service-based resource for your business.  To do this you need to not just think about things like Virtualization, but to consider taking advantage of cloud-like solutions; whether in your own datacenter or hosted elsewhere.   And I know you’ll agree: Choosing the right solution for the right scenario becomes very important.

Here is the schedule.  The events run from 8:00am to 12:30pm, though we may let you out early for good behavior.  Click on any of these to get a summary of the three parts of our morning.

TechNet Events Presents: Transforming IT – Virtualization to the Cloud

Wednesday, March 23, 2011

Milwaukee, WI

Tuesday, March 29, 2011

Madison, WI

Thursday, April 14, 2011

Indianapolis, IN

Thursday, April 21, 2011

Chicago, IL

Tuesday, May 10, 2011

Downers Grove, IL

For other events around the country, check out and continue to watch the TechNet Events site.

See you there!

Service Pack 1 for Windows 7 and Server 2008 R2 is scheduled to release February 22nd 2011. This service pack is a rollup of patches and adds two new features. Here are the two new features:

  • RemoteFx is technology that enables administrators to provide a very rich end user desktop virtualization experience including delivery of full-motion video, Silverlight and 3D applications independent of any graphics stack via server-hosted virtual and session based desktops.
  • Dynamic Memory allows Hyper-V administrators to pool available memory on a physical host and dynamically distribute it to any virtual machine running on that host. This allows virtual workloads to dynamically change their memory allocation without service interruption.

http://www.pcmag.com/article2/0%2c2817%2c2379933%2c00.asp