Simply finding the right objects and then updating their properties or implementing changes can be a cumbersome process. Many Microsoft systems engineers have developed their own shortcuts and conventions over the years for dealing with the administration of complex Active Directory structures. One tool that has been lacking, however, is the ability to write powerful scripts to manage Active Directory.

The good news is that the arrival of Windows Server 2008 R2 with PowerShell 2.0 and the Active Directory Module changes all of that for the better.

Powershell 2.0 and Active Directory Module

Of the many new features in Windows Server 2008 R2, PowerShell 2.0 is one that may finally be coming into its own. One of the key new features in PowerShell 2.0 is the addition of modules. Modules differ from PowerShell 1.0 snap-ins in that they are self-contained and do not require registration or installation. Rather, modules are imported into the shell via the Import-Module command. Modules can also be offloaded when they are no longer needed.

To use the Active Directory Module, there needs to be at least on Windows Server 2008 R2 Domain Controller running Active Directory Web Services (ADWS) in the domain. As an alternative, the Active Directory Management Gateway Service can be installed on Windows Server 2003 SP2 servers and Windows Server 2008 (non-R2) servers with or without SP2 installed.

For the most powerful configuration of PowerShell 2.0 with the Active Directory Module, you will want to be able to do your scripting remotely from your own computer, or other workstation. This does require Windows 7 in order to install the Remote Server Administration Tools (RSAT).

The Active Directory Module provides a powerful way to manage AD structures even across domains. Part of the AD Module is the PSDrive Provider which allows you to map to an Active Directory domain using whatever credentials are required via the New-PSDrive cmdlet. Users are connected to their current domain by default. The mapped rights persist for the entire shell session, even if it requires using different login credentials for several different AD domains.

Active Directory Scripts In PowerShell 2.0

There are many different commands included in the Active Directory Module. One count places the total number of new commands at 82. The most commonly used commands, however, are those that match up with the most common Windows Server Administrator tasks. The naming convention for Active Directory cmdlets dictates that each cmdlet start with “AD” in order to help separate the Active Directory versions from similar PowerShell cmdlets available in the base PowerShell.

Thanks to this naming convention, obtaining a list of all the Active Directory Module cmdlets can be done by running the Help *-AD* command.

The most difficult part of getting up to speed with Active Directory management via PowerShell 2.0 is mastering all of the parameters available for each cmdlet. In an effort to allow virtually any function that can be performed manually to be scripted, Microsoft had to provide a working parameter for pretty much every setting, checkbox, and field that there is in the GUI. That means that some commands have a mind boggling array of available options. Fortunately, only a small subset of any cmdlet’s parameters are mandatory in order to run the desired command.

As with any new programming language, the key is to focus in the beginning on the basics and most frequently used options and build mastery as you go along. While it may seem daunting at first, one will quickly find that using built-in cmdlets specifically designed for their purpose ends up being much easier to both code and manage than mastering all of the work-arounds and band-aids currently required to perform the same tasks.

Common Active Directory Cmdlets for PowerShell

The most common administrative tasks within Active Directory are those that relate to creating, finding, and changing objects and users. Not surprisingly, these cmdlets make a great place to start learning and using PowerShell 2.0 to manage Active Directory.

Commonly used PowerShell AD cmdlets include:

• New-ADUser
• New-ADGroup
• New-ADComputer
• New-ADOrganization
• New-ADServiceAccount
• Unlock-ADAccount
• Enable-ADAccount
• Disable-ADAccount
• Get-ADUser
• Add-ADGroupMember
• Get-ADGroupMember
• Get-ADForest
• Get-ADDomain
• Get-ADDomainController

Of course, the real power from scripting comes not from typing in a bunch of esoteric computer commands instead of clicking mouse buttons, but from the ability to save useful scripts and use them over and over again. To this end, Active Directory cmdlets support piping information into the cmdlets. For example, to create a couple dozen new users, the administrator could take the Excel Spreadsheet supplied from Human Resources, export it as a CSV file and then pipe the resulting data to the New-ADUser command: Import-CSV c:\neweuserdata\april-new-employees.csv | New-ADUser and let the script take care of all the basic data entry.

Using parts of the same file, the admin can go back through and using the appropriate cmdlets add users to their respective groups and domains and even apply additional group policies to the new users.

Of course, easy, but highly repetitive tasks can be automated as well. Imagine picking up the phone with a call from a panicked user who has locked himself out of his account (again). A tiny shortcut launched directly with minimal typing and clicking requiring nothing more than the user’s login name quickly firing off and unlocking or even re-enabling the account, all without ever having to leave the screen you were already working on when the phone rang.

PowerShell Resources

Even though the Active Directory Module is new with PowerShell 2.0 there are already some great references available for Microsoft server administrators. Check out Jonathan Medd’s Active Directory PowerShell Quick Reference Guide for help getting up to speed and remembering lesser used commands. Microsoft has a general PowerShell Quick Reference guide as well. For those of you lamenting the hours spent mastering VBScripting, check out the VBScript to Windows PowerShell Conversion Guide.

Learning new technology and skills is never easy, but the truth — if we are willing to admit it — is that as high-tech computer administrators, we quickly grow bored with doing the same things over and over again. Not only does PowerShell 2.0 and the Active Directory Module provide some new material for the skills menu, it also provides a way to eliminate far more tedious, repetitive tasks than ever before.

Related posts:

• PowerShell 2.0: Server 2008 R2 Top New Management Feature
• Take Command of Server 2008 with Windows PowerShell – Part 1
• Don’t be Afraid of PowerShell

Installing FCI on Server 2008

Although FCI comes with all versions of Server 2008 R2, it is not installed by default in line with Microsoft’s strategy of installing only the necessary services and roles on each server based upon its functionality within the network. FCI is installed as a component of the File Services role, and implemented via the File Server Resource Manager console. Once installed, FCI is at once deceptively easy to use, and at the same time, infinitely complex in its possibilities.

The first step in using File Classification Infrastructure is to define what the tags are. There are no default tags or tagging systems, because FCI is designed to be custom tailored to a particular business environment. One need only think about the difference between what confidential or secret mean to a chain of dry cleaners, versus what they mean to a defense contractor to see why defaults would not be particularly useful in this case.

Tagging files is done by “classifying” them. FCI classification is a two-step process. The first step is to define the classifications. The second step is to apply the classifications to files.

Defining classifications is done within FSRM under Classification Management. Under Classification Management, is Classification Properties, where one creates the classification structure. Here the rules are defined that determine whether or not a file is classified as a particular kind of data. For example, a file might be classified as “confidential” if is stored in the “Confidential” directory of the Legal Department’s file server area. Obviously, more complex criteria are possible. A file might be classified as internal financial data if it is created by a member of the Accounting group, during the first week of the month, and the file name contains the words “monthly report.”

FCI supports classifications based upon date and time, numbers, multiple choice lists, ordered lists, strings, multiple strings, or Boolean criteria. There is no need to stick with generalized classifications like Confidential, Secret, or Internal Use Only, although these can be set as high-level classifications. The real power of FCI comes from more granular classifications, such as classifying all Excel spreadsheets, stored in the project folder “New Products”, created between January and March of 2009, that contain the words “projected internal costs”, as Internal Prototyping Projections.

Using FCI To Improve Security and Better Manage Data

Defining the classifications doesn’t actually do anything. No files are tagged just by defining the components of a classification. In order to do anything with these classifications, the real files must be tagged. Doing so requires creating Classification Rules.

To create a classification rule, one first defines a name and a scope for the rule in the Rule Settings tab. The name is what the tag attached to the file will be called. The scope defines which files to evaluate to determine if they are assigned that classification. The actual rules for classifying files are done in the Classification Tab. Classifying can be done by simply evaluating whether or not a file is within a certain folder (Remember the tag follows the file as it is moved and copied.). It can also be done by checking for certain words or phrases within the documents themselves. Powerful classification can be done using the PowerShell classifier. This limits your ability to evaluate files only by your ability to write a PowerShell script to do what you want.

An analogy can help make the process a little clearer.

Classifications Properties are the things that matter for determining speed limits. For example, how close is the road to a school, is the road an Interstate, is the road two-lanes, three-lanes, four-lanes, etc. Notice that these are just the properties that CAN be evaluated; there is no structure here for how a road is assigned a particular speed limit, only what properties will need to be examined in order to assign a speed.

Classification Rules are like the actual criteria that determines which speed limit a road gets. For example, roads within 100 feet of a school should be classified as 20 MPH roads. At this point, all you have is rules in the city planner’s office. In order to actually implement the speed limits, the possible criteria need to be evaluated against the rules.

At this point, you can actually apply the rules to the roads. Doing so requires choosing which roads to evaluate against which criteria (scope). Based on that evaluation, you can actually “tag” the roads by putting up speed limit signs that say 20 MPH (name).

Finally, the files are classified. However, nothing has actually been done based on those classifications.

To actually DO SOMETHING with all these tagged files, the administrator has several choices. First, both file management and reporting based on the classification tabs are available in FSRM. These tools can be used to move, copy, rename, or delete files, as well as setting more traditional file properties. Just as important, reports can be generated to alert administrators or managers that files tagged as Sensitive or Confidential are residing in insecure locations. Using just these two tools can resolve a lot of headaches, as well as create better processes. No doubt the first time that guy in accounting gets asked why he is saving proprietary budget documents to a public share, he won’t even know he was doing that. (“We’ve always saved them to the G Drive.”)

However, even more powerful management can be achieved using PowerShell. Once classified, the FCI system can be used inside PowerShell scripts in order to perform complex tasks or create additional reporting or alert levels.

Creating an entire file classification system from scratch is a daunting prospect. However, building some basic rules to generate reports is a good starting place. From there, needs and concerns will arise that can be easily solved by using the FCI system. Eventually, a file classification as robust and as well-defined as your Active Directory structure will emerge. After all, you didn’t start out the first day of the Active Directory implementation by creating all the objects you have today.

Related posts:

• File Classification Infrastructure in Server 2008 R2 SP2
• Active Directory Rights Management Services: Data Access Controls
• Server 2008: Installing Distributed File System (DFS)

Ironically, these data breaches were seldom the fault of corporate IT professionals who were properly performing their duties of keeping the company file servers up and running, and secure behind firewalls and security protocols. However, when a problem with computers or data arises, everyone turns to IT for answers. Fortunately, Microsoft Windows Server 2008 R2 comes with a free data management tool that can help IT be more proactive in managing data.

File Classification Infrastructure (FCI) in Server 2008 R2

File Classification Infrastructure, or FCI, was released with Server 2008 R2. Although FCI comes bundled for free with all editions of Server 2008 R2, it is not enabled by default. FCI is primarily a function of file servers.

To install FCI, the administrator must first install the File Server Resource Manager (FSRM) role service to the File Services role. All FCI functions, reporting, and configuration are handled from inside of the FSRM console.

Understanding FCI

Understanding the potential power of FCI is done best through example. Consider the following scenario.

Our intrepid hero this episode is a Microsoft Certified Systems Engineer (MCSE) named Clyde. Clyde works for a company that processes third-party transactions of all types (including financial transactions for some clients) for both businesses and customers.

As is the case at most well run corporate IT departments, the server and network infrastructure is housed in secure data centers behind an assortment of firewalls, security protocols, and monitoring systems. Getting at the company’s data by coming in the front door (or the backdoor, sidedoor, or windows) is difficult at best, and impossible for all but the most skilled intruders.

However, the company continues to have embarrassing incidents where confidential, proprietary, or personal information has been unintentionally disclosed in a variety of ways. None of these breaches has been the result of a hacker penetrating the company’s security, but rather mishaps ranging from sensitive data being left on a public share, to files with confidential information being passed on to clients, customers, or in one very embarrassing incident, directly to the media. In each case, internal investigations revealed that all IT systems functioned correctly.

How did sensitive information end up being exposed to the public?

The answer lies at the heart of what FCI can do for making data management easier, less expensive, and more secure.

What is the Point of FCI?

From our example above, we know that Clyde is a competent systems administrator. Like most admins, he has several responsibilities. He manages all of these different functions by utilizing power tools and utilities that allow him to automate as much as possible, and to monitor everything else.

Unfortunately, one critical tool is missing from his arsenal. While Clyde knows that financial reports are confidential, he has no way of knowing which files ARE financial reports, or which ones contain financial data.

Clyde has done what most IT administrators have done. He created specific places for the Accounting Department to store financial reports and other sensitive financial information. Access is locked down and restricted to certain members of the accounting team via several mechanisms including setting carefully configured permissions on servers, desktops, and laptops. Procedures are in place to require notification of any member of the accounting team leaving the company, and access is frequently audited. Security is monitored by both the security team and the administrators both manually and via detection systems. Accessing the financial data stored in these locations is virtually impossible for all but the most capable hackers.

Unfortunately, for Clyde, the Executive Vice President of Operations, who is preparing for a very important presentation to the Board of Directors on Friday, requested a few years worth of financial data. For a presentation like this one, the high-level numbers presented to the public, and even most people within the company, are not sufficient. This presentation requires details like exactly how much revenue comes from each client, and how much profit that generates, and so on.

The accounting team provided the VP with the data he needed. The executive is no dummy; he knows that this information is very sensitive and that its disclosure could hurt the company’s relationships with very important clients. Therefore, he keeps the data safe by storing it in secure locations he has access to on the network and on the encrypted hard drive of his laptop. Every system has worked perfectly and only authorized personnel have accessed the data.

Four months later, with the Board of Directors presentation long since left in the rear view mirror, a new crisis has erupted. The VP is travelling abroad and an issue is blowing up back at home. If the right people don’t get what they need fast, heads are going to roll. A fully authorized user, acting in a proper manner, accesses the backups of the server location where the necessary information is properly stored. He quickly copies all the files from April, encrypts them, and sends them on to the right people. Since almost all of the information required is confidential or sensitive in some manner, even if the file was in a directory called Confidential, there is no reason to single out a particular file.

The day is saved, but the right people to be getting all of the other April files are the wrong people to be looking at one particular spreadsheet from April. The spreadsheet used for the Board presentation that the VP kept just in case a board member came back later with questions about the data. The VP didn’t forget about it; he kept it a few weeks just in case someone came back with questions about the data, and then deleted the file.

How FCI Helps Manage Data Better, Reduces Costs, and Improves Security

The problem in this scenario would eventually be called “employee error” if investigated fully. However, that is a disingenuous conclusion since no one actually acted improperly.

The VP stored a confidential file in a secure manner. The employee retrieving the data was authorized to do so and can’t realistically be expected to examine every file to see what is in it. In fact, that could be a bigger security risk.

The real issue is that there is no practical way for data to be marked as sensitive (or important, or from a certain project, or …) in such a way that the tag follows the data through its lifespan. Even if the original file had been tagged somehow, the new one created by the VP would not have the same tag.

This is where the new File Classification Infrastructure comes in.

With FCI, data can be tagged in exactly this manner. The original spreadsheet from accounting could have been tagged not just as confidential, but as internal financial data, as well, based on where the file was stored originally. Even the new file created by the VP would be tagged in this manner, not because of where the VP saves the file, but rather based upon being part of a particular project. The off-site backup of the project data would retain the file’s tags because tags are retained within the NTFS properties of the file no matter where it is moved in the enterprise. Finally, even if the data were to somehow lose its tagged status, it could be re-tagged properly based upon its content.

These tags can be used by Clyde to monitor for sensitive files in the wrong places, if the file were copied to the web server, for example. The tags can also be used to manipulate how the file is treated. Files tagged like this one, might never be backed up as part of the regular backups. The tags could even be used to prevent the file from being displayed or included in the subsequent copy because the data tagged like this file are considered expired after a certain amount of time.

For the first time, the right tool is available to Clyde without implementing yet another big infrastructure project, without buying even more tools and utilities, and best of all, without implementing another round of company-wide security procedures. All he has to do is set it up.

Related posts:

• Using File Classification Infrastructure to Improve Security, Save Money, and Manage Data
• Server 2008: Windows System Image Manager and WDS
• Server 2008: Configuring Distributed File Systems (DFS)

PowerShell 1.0 gave systems administrators around the world a new administration tool when it was introduced with Windows Server 2003.

For years, Microsoft has worked to develop a graphical user interface, or GUI, that would make system administration and user administration easier and more user friendly.

In many ways, the company succeeded admirably.

Most admins know at least one or two people who have managed to create a user in a very small Windows Server environment through User Manager and think that they should become a Windows Administrator because they already understand “how to do it.”

However, for administrators in environments where users exceed the number of people it takes to field a couple softball teams, things  are more complicated. In fact, one of the difficulties of properly administering a networked operating system and its servers is keeping all the “little things” consistent across the enterprise. Forgetting a check-box here, and a radio button there, can add up to a security nightmare waiting to happen, or perhaps, a very angry Vice President unable to remotely connect at a critical time.

The solution to some of these problems has been scripting. By writing scripts, Windows system engineers could ensure that repetitive tasks happened correctly and with far less effort than doing them manually. Everything from creating new user accounts, to installing software and upgrades, to basic login scripts has been coded somewhere along the way by a savvy systems admin looking to avoid headaches and spend a little less time on repetitive tasks.

Eventually, new Windows Server features and enhancements began to outstrip the capabilities of the DOS-based scripting that server administrators had been cobbling together. Fortunately, new tools and utilities were also developed that helped reduce some of the reliance on login scripts. For example, User and Group profiles have long since made mapping drive letters via login script obsolete. However, administrators still needed a more powerful scripting environment.

PowerShell 2.0 Upgrades Features and Capabilities

PowerShell has been slightly underrated within the administrator community. One reason is that in order for PowerShell to really perform throughout the enterprise, it needs to be usable on the servers and all the desktops.

Fortunately, Windows 7 comes ready to execute PowerShell scripts. Windows 7 SP1 is set to ship in the near future, which sounds the bell for many long-time IT professionals who live by the rule to always wait for SP1 before upgrading, and Server 2008 R2 comes with PowerShell 2.0 installed by default. As Windows 7 is installed in the enterprise, PowerShell 2.0 will grow even more useful.

Another reason PowerShell has not gotten its fair share of affection from systems administrators is that there were a few nagging things about how PowerShell worked conspiring to make it seem less powerful than it actually was. However, Microsoft has addressed many of these issues and thrown in a few new features as well.

Let’s take a look at some of these new features now.

Remoting

Nothing has been a bigger thorn in the side of PowerShell than Remoting. Remoting is the ability to run commands via PowerShell on remote computers. Technically, some remoting was possible in PowerShell one, but it was limited to the Get-WMIObject cmdlet within Windows Management Instrumentation (WMI). Even worse, WMI required RPC connections which meant having to go to the networking guys to get ports opened and firewall exceptions allowed. Not fun.

PowerShell 2.0 allows administrators to run commands on remote computers using the WS-Man (WS-Management) protocols which establish secure connections to remote computers using ports 80 and 443 by default. In many environments these ports will already be open, and in those that they are not, they’ll be a much easier sell to the networking team.

There is one little catch to remoting in PowerShell 2.0. In order to use remoting, it must be enabled on both machines. However, this only needs to be done once. Once enabled, remoting can be used on multiple machines at the same time allowing the administrator to execute the same commands on several computers at once. The applications for this ability are limited only by the admin’s ability (and the availability of the right cmdlet).

New cmdlets

Speaking of cmdlets, PowerShell 2.0 comes with over 100 built-in cmdlets. While this covers a lot of ground, there is no doubt that Microsoft Server administrators will quickly find functions and tasks that require other commands. Fortunately, Microsoft has implemented a way to handle this eventuality as well.

Modules are also new to PowerShell 2.0 and allow script developers to organize code into self-contained reusable units. This functionality has already been used to create a PowerShell 2.0 Active Directory Module which brings more possibilities to managing Active Directory via PowerShell.

Run Background Jobs in PowerShell

Another big addition to the PowerShell feature set is the ability to run background jobs. This means that those PowerShell scripts that take a long time to run can continue to perform in the background while the command prompt returns control immediately to the console.

An admin performing numerous tasks late at night can get them all running right away instead of having to wait until 2:00 AM to run that last command. This is especially useful while remoting multiple machines, especially when those machines are separated by various network connection speeds.

System Events Integration

PowerShell 2.0 now offers the ability to monitor and act on system events which can allow for more proactive scripting.

PowerShell ISE GUI

The most curious edition to PowerShell 2.0 is the PowerShell GUI, which, on the surface, appears to defeat the whole point of PowerShell. However, the GUI is really more of a basic script editor complete with color coded syntax, partial execution, stepping, and graphic debugging. The GUI also includes context sensitive help which can save admins from scanning through the verbose output of some help commands.

With Windows 7 coming to many businesses in the near future and the upcoming release of Windows Server 2008 R2 SP1, PowerShell 2.0 will be already waiting to go for enterprise-wide control and administration. The time is now for Microsoft systems engineers and administrators to learn how to take advantage of PowerShell 2.0.

PowerShell 2.0 Demonstration

Take a look at the video below to see a short demo of PowerShell 2.0.

Related posts:

• Active Directory PowerShell Scripts Management Tool For Admins
• Don’t be Afraid of PowerShell
• Take Command of Server 2008 with Windows PowerShell – Part 1

As always, Windows Server 2008 R2 SP1 will include a rollup of patches and fixes developed since the original release shipped. Microsoft has also started banging the drum about two new features that are slated to be a part of the first Service Pack for Server 2008 and Windows 7.

New Features in Server 2008 R2 SP1 Update

The two new features mentioned in various statements and internal Microsoft blogs, such as Windows Server Division WebLog (no word on the appropriateness of the capitalized “L” in weblog) are Dynamic Memory and RemoteFX, both of which are functions for Microsoft virtualization.

Dynamic Memory in Server 2008 R2 SP1

Dynamic Memory is a new feature to Hyper-V which allows administrators to allocate all the memory available on a physical host and then have it dynamically distributed among the virtual machines that run on that host. They say that the best laid plans of mice and men often go awry. Plans for projecting how much memory a given VM may not have been the inspiration for that saying, but they certainly fit. Dynamic memory is a way to try and nudge the plans of Windows Server systems engineers back on track.

Dynamic Memory is similar to the Memory Overcommit feature in VMware that allows for greater VM density on a given set of hardware, but with a different twist. Memory Overcommit works by essentially over-promising how much RAM each VM can have. The theory is that most machines do not use their full allotment of RAM all of the time. Thus, when one virtual machine goes over its “real” memory limit, the virtual manager lets it use some of the memory that a different VM is not currently utilizing. As long as all VMs aren’t trying to use all of their allocation at the same time, there is no problem.

Microsoft has long claimed that Memory Overcommit is a dangerous solution and advocated against using it. While Dynamic Memory is very similar, the twist is that instead of fooling a VM into thinking it has more RAM than it really does, the Hyper-V manager monitors the percentage of memory being used on all the VMs and then changes the maximum amount of RAM the OS has to work with based on those percentages. The net effect is the same; more VMs can be installed on the same hardware.

The whole point of virtualization is to be able to create numerous virtual servers on a single set of hardware, or host, without having to have big reserves of hardware resources, “just in case.” By virtually allocating all hardware resources to virtual machines, IT professionals are able to maximize how costly hardware is used.

But, what happens when a formerly sleepy virtual machine suddenly becomes mission critical?

For example, consider a hypothetical cable TV channel that is typically lost somewhere “in the middle” of the channel numbers. Let’s assume that like many of its competitors this particular channel has some reality TV show starring a not-so-famous famous person when news breaks that the channel’s reality TV star backed over the Pope with his car.

The virtual machine that houses the application used to route incoming phone calls, that annoying, “Press 1 for this. Press 2 for that,” system doesn’t usually require much in the way of resources. On this day, however, it’s running full-speed when some “helpful” person reconfigures the phone lines to allow a lot more incoming call lines.

Now the VM is swamped and bogging down. If it were a submarine, the captain would be ordering Engineering to go to 105% on the reactor, but since it’s a virtual machine, it is paging everyone in IT with monitoring errors.

For even the most foolhardy server administrators, manually reallocating memory among virtual machines isn’t the kind of thing you want to do during business hours while systems are live and users are counting on those critical business systems. Without Dynamic Memory, our heroes are in a jam, having to rush through an emergency change control ticket and notifying users that some of their server-based software is about to reboot.

However, with Dynamic memory, memory is reallocated on the fly without any service interruptions, leaving our poor sys admin to deal with the sudden flood of incoming email and website traffic, instead.

RemoteFX for Windows Server 2008 R2 SP1

The other major update coming in Service Pack 1 is called RemoteFX. RemoteFX is an improvement that should help iron out some of the unpleasantness of using Microsoft Remote Desktop Services on thin clients. Essentially what RemoteFX does is handle all the heavy lifting for graphics. Rendering is done server-side and then displayed on clients without using their resources. This means that intensive effects like Microsoft Aero should start being a lot more usable on thin clients configured without a lot of hardware power.

This technology comes from Calista Technologies which Microsoft bought two years ago. Microsoft has integrated it into the session virtualization environment (Terminal Services to those of you who don’t update your lingo with every press release). Using a standard RDP connection, resource hogging multimedia presentations, full-motion video, and Silverlight animations can all be viewed seamlessly even on clients that don’t have powerful enough hardware to handle them on their own.

RemoteFX has also been licensed out to Citrix for its XenDesktop VDI, so those enterprises running these systems will be able to take advantage of this new capability as well. Citrix has been promoting HDX as a similar feature, but both companies have said that the technologies are complimentary and not competitive. Time will tell how (or if) the two will integrate.

While Microsoft hasn’t provided any details yet, they have also said that Windows 7 will get an updated RDP client as part of the Windows 7 SP1, which would allow those systems to use the feature as well. While traditional workstations wouldn’t require the feature for standard use, something like high-resolution 3-D rendering could potentially benefit from RemoteFX.

These new features show Microsoft’s willingness to roll out new technologies without a full product release or add-on pack like in the past. However, neither technology is a game changer, and just as important to those enterprises with tight change control and testing procedures, neither function makes core changes to the OS and can be disabled at install.

In the end, SP1 is what it should be, a boring accumulation of patches and a handful of improvements without any major surprises.

Related posts:

• Hyper-V and VMware — Part 2: Features
• Windows 7 Features That Require Server 2008 R2
• Windows Server 2008 R2 Green Features

For decades, corporations have been building data centers and server rooms complete with raised floors and their own separate air conditioning systems to deal with the large amounts of heat generated by powerful servers, storage systems, and other components. These rooms were driven by necessity because overheating can cause the most stable of systems to fail. And, as processors became faster, and hard drives spun even more quickly, the amount of heat they generated grew by leaps and bounds.

Along the way, something else began to emerge, data centers with their own separate power supplies and generators. At first, these innovations were driven by the need for 24/7 server usage and a business necessity to achieve as near-zero downtime as possible. But, as data centers and server rooms grew, there emerged another necessity, the ability to get enough power to these massive computer centers without having to completely re-engineer the whole building’s power distribution system.

Wasted Power = Wasted Money

On the smallest of scales, the new power management capabilities built into Server 2008 R2 offer only small energy savings at best. A single server running the fastest processors, hard drives, and components won’t draw much more power than that old space heater the receptionist on the third floor keeps under the desk. However, like many things, when one stops to add all of the little differences up, the result ends up being a very big difference.

Recently, Google applied to U.S. regulators to become a national utility for the purposes of electricity generation and distribution, and more importantly, participation in the wholesale power markets.

Conspiracy theories aside, the move was largely driven by necessity because Google’s enormous datacenters require so much electricity that simply relying on the local utilities is becoming impractical.

While most companies may not have such dramatic power needs, server rooms and the numerous computers within them have become a major budget item, due not to typical maintenance and administration needs, but because of how much electricity they take to run. With the cost of electricity continuing to rise, and IT Departments looking to save money in their budgets, the power consumed by servers can no longer be ignored.

The typical server without power management features continues to draw between 50% and 70% of its maximum power usage even when completely idle. In other words, a server doing nothing uses at least half as much power as one running flat out. That means that every print server, domain controller, file server, Exchange server, etc., is sucking up plenty of power every minute of every day.

In terms of dollars, if servers were employees and electricity were their pay, it would be like paying every employee their full salary for the 40 hours per week they work, and then paying them half that rate for the remaining 128 hours. In other words, the amount of money spent to power servers when they are doing nothing exceeds the amount of money spent powering them while they are performing mission critical functions.

Server 2008 Advanced Power Management

It’s no surprise then that customers both big and small are looking for ways to lower the power usage of their servers, not just to be good corporate citizens, but in order to save on the bottom line.

Server 2008 R2 comes with support for all of the latest energy saving standards, including updated support for Advanced Configuration and Power Interface (ACPI) in the form of a new processor power management (PPM) engine. When a server’s load is low, the processor is slowed down to consume less power.

Entire cores can be shutdown, a process called core parking. Likewise, hard drives can be spun-down to a low power state, and even the storage devices within SANs can be power managed.

To help businesses tell which products are capable of supporting these full power-management features, Microsoft has introduced the Enhanced Power Management Additional Qualifier (AQ) logo program. To use the logo, vendor’s hardware must support commands from the OS that reduce power during low utilization.

These are impressive technological improvements that demonstrate the commitment of the entire industry to reducing power consumption. However, to achieve significant power savings, it isn’t enough to just throttle back the processor when it isn’t busy.

Big power savings come from rethinking the entire IT datacenter architecture.

Rethinking Datacenters With “Green” In Mind

One of the first questions asked by non-IT executives when informed about the issue of server power consumption is why there are servers doing nothing in the first place. It is a fair question.

The days of slower WAN connections, and the increasing need for zero downtime led to a proliferation of “just in case” servers, or in more technically friendly-speak, over provisioning. Keeping server loads low ensured snappy response time. Having “extra” servers on hand in the form of fail-over systems, whether automated or manual, meant less down time. Running servers at 100% or even close to 100% was considered a sure-fire recipe for failure.

However, each of these goals also ensured that most servers were never fully utilized, creating an environment where servers were purchased, provisioned, and maintained based on how well 50% of the specs would meet the businesses current needs. (The issue of over-budgeting and “buying ahead” still exists, but is more of a corporate culture issue than a technology specific challenge.)

Fortunately, Microsoft’s continuing emphasis on developing better management and fault-tolerance within the Windows Server OS, also provides big opportunities for power reductions.

Server virtualization technology allows for more roles to be consolidated on a single server. Instead of one print server, one domain controller, one Exchange server, one SQL server, and so on, for each location, virtually all of those roles can be handled by a single server, without the fear of one service taking down all of the others should something go wrong, or increasing security complexity.

Server level hardware problems that cause a complete server failure become less common every year it seems. Even so, total fault tolerance in the form a fully redundant fail-over solution still only requires two servers instead of several.

Beyond Server Power Management

Enterprise level management tools included with Server 2008 or available separately can be used to see which servers are using the most, or the least power, and provide a starting point for where to being consolidation or virtualization. As an added bonus, these same management features also improve monitoring, reporting, and alerting, providing not just potential power savings, but increased uptime and easier management as well.

While most IT Departments are currently focused on the power consumption of their servers and data centers, awareness is arising as well about the power wasted by workstations which often operate at full power even less often than servers do.

Management tools within Server 2008 and Windows 7 allow for IT to begin managing this cost as well. Group policies, for example, can be set to move workstations into standby mode or to power off completely after their backup or other “off-hours” tasks have been completed.

The opportunities for power-savings are enormous. Savvy IT Departments should consider having data center electricity moved into their own budget lines allowing them to both “get credit” for significant expense savings, as well as giving them the justification to migrate to important new technologies like Server 2008 R2 and Windows 7 in the form of large operating expense reductions.

Related posts:

• Windows 7 Features That Require Server 2008 R2
• Windows Server 2008 R2 SP1 New Features: Dynamic Memory and RemoteFX
• 7 Server Management Improvements in Server 2008 R2

However, Windows Server 2008 R2 provides many new features and upgrades, including several that go hand in hand with new features found in Windows 7.

That means there are more new reasons to upgrade both the desktop operating system and the server operating system at many companies.

If that doesn’t sound like major undertaking, I don’t know what is.

What is an R2 Release Anyway?

Many businesses have been plugging along comfortably with older combinations of Windows XP and either Server 2003 or Windows Server 2000, and installing only those service packs and features designed to keep those systems running securely and stably.

Therefore, the question that has to be asked is what is an R2 release and exactly what does the R2 version of Sever 2008 have to offer?

Over the past several years, Microsoft has received a lot of feedback from users in the business community who wanted a more predictable release cycle for critical business platforms such as Microsoft’s server operating systems. For businesses that had driven the planning uncertainty out of other areas of operations, the seemingly random release schedule of Server upgrades and service pack releases prevented IT from adequately planning everything from hardware acquisition, to lease schedules, to software budgeting.

In addition, companies wanted to keep the critical security and performance updates to the operating systems separate from updates that added new features. Companies where extensive testing and planning make virtually any downtime unacceptable, didn’t like that in order to keep their systems secure and optimized they had to introduce new, untested, features and services into their environment, or deal with kludgey, file deleting, registry editing, hacks to remove those features from otherwise necessary Service Pack updates.

On the other hand, in the technology industry, five years is a lifetime and Microsoft worried that products would quickly become out of date, with its offerings lacking the latest features and innovations if new feature sets were released only twice a decade. If there was one thing Microsoft did not need, it was to bolster the view of the company as a slow moving dinosaur out of touch with the fast moving pace of business.

The compromise the company struck was that the company would focus on releasing new versions of core business software products approximately every five years. Like with Windows Server 2003 and then Windows Server 2008. Service packs would continue to be released whenever necessary in order to update critical security, stability, and performance issues.

However, Service Packs would not contain new features within them. Instead, Microsoft would update feature sets with an R2 release every 2 to 3 years.

This way, businesses that wanted to keep up to date with the latest security, stability, and performance enhancements, but did not want to introduce new features (and their potential stability and security problems) into the production environment could install Service Packs. And, those companies looking to incorporate the latest technologies and feature set could take advantage of the R2 releases.

Thus, Server 2008 R2 offers much more than just a Service Pack, but not quite as much a new full-scale release.

So, what exactly is in the latest release of Windows Server 2008 R2?

Server 2008 R2 Upgrade Costs

Many of the features and functionalities in Server 2008 were introduced in the original, or “R1″ release of Server 2008. However, for environments currently running Windows Server 2003, these features should also figure heavily in any decision whether to upgrade to Server 2008 R2 or not.

Obviously, migrating from Server 2003 to Server 2008 R2 is not a free update, unless the company is enrolled in certain licensing subscriptions.

For IT groups already running the original Server 2008 system, the question gets a little murkier. For businesses with Software Assurance, the question is merely one of value versus the time and effort to upgrade the server operating system.

For those without Software Assurance, or other business licensing that includes free upgrades, Windows Server 2008 R2 is not a free upgrade. In other words, for those running Server 2008 already, the evaluation involves not only the time and effort, but additional cost as well.

New Features in Server 2008 R2

As before, there are several Editions of Windows Server 2008 R2 available depending upon the needs of an organization. Some features are optional on certain editions or only available on specific editions. Thus, a straight list of all new features is a relatively complicated undertaking.

However, there are certain features that are the “deal-makers” in Server 2008 R2.

  •   Hyper-V and Virtualization

The centerpiece of Server 2008 was the addition of virtualization as a built-in function of the operating system. As is often the case, the company’s first effort was successful and usable if not as scalable or feature filled as competing offerings. However, for companies looking to start down the path toward virtualization or to roll out the new technology on a limited basis, Microsoft’s Hyper-V offered a great entry point without any additional cost.

One area that has received substantial attention for the R2 release of Windows Server is virtualization and Hyper-V.

Features like Live Migration, Hot Add/Remove Virtual Machine Storage, integration with desktop virtualization (VDI), and also presentation or application virtualization (formerly provided in some fashion by Terminal Services) have all been added.

In addition, services like clustering and failover have been improved and expanded. Also, included is the long awaited ability to boot from storage networks.

  •   64-bit Architecture and More

Of course, the R2 release contains upgraded support for more powerful hardware. Server 2008 R2 becomes the first version to be released only in 64-bit architecture, marking the official end of 32-bit computing for Server products.

R2 supports up to 256 logical processor cores and up to 64 logical cores for each host. New power management features allow processor cores to be parked when load is low and then automatically re-enabled when demand increases. In a large data center, the amount of savings just from lowered cooling requirements alone could make an upgrade to R2 worth it.

Other new features receiving a lot of attention are improvements in Remote Administration, as well as secure connections for remote employees without the need for third-party VPN software, updates to Active Directory management, including a recycle bin for AD objects, streamlined performance, improved storage management, and an update to PowerShell.

Add to all of this the fact that many of the high-end features of Windows 7 will only work with Server 2008 R2, or will work much better with it, and it starts to add up to a must upgrade scenario.

The only real question in these trying economic times is when and where the will and funds will meet the need for a much improved server operating system environment.

Related posts:

• Overview of Server 2008 R2 — The Half Version Upgrade
• Windows 7 Features That Require Server 2008 R2
• Windows Server 2008 R2 SP1 New Features: Dynamic Memory and RemoteFX

Most reviewers claim to see not only improvements in speed and functionality, but better usability as well.

Some reviewers are going so far as to proclaim that Windows 7 is as user friendly as the latest Mac OS Snow Leopard.

Even more important for business users and Information Technology Professionals is the list of impressive new features that come with Windows 7. Many of these new Windows 7 technologies allow for IT Departments to better manage, support, and configure Windows 7 machines throughout the enterprise.

It is not surprising then that these Windows 7 features are at the top of the list of reasons IT groups are ready to initiate the massive undertaking of upgrading desktop computers throughout the company.

Server 2008 R2 Required for Windows 7 Functions

But, did you know that some of the best new Windows 7 features only work with Windows Server 2008? In fact, some features actually require the latest Windows Server release, Server 2008 R2.

And, a handful of functions not only require Windows Server 2008 R2, but they require that all domain controllers be Windows Server 2008!

This isn’t a trivial point when evaluating upgrading to Windows 7 in a large environment. Let’s take a look at some of the features of Windows 7 that require Server 2008 R2.

  •   DirectAccess

DirectAccess is one of the much-anticipated features in Windows 7. For the home user, DriectAccess provides little benefit, but in the business environment, it will be invaluable.

Whether they were employees traveling on business trying to connect from hotel rooms or other locations, or whether they were employees working from home, or IT administrators trying to remotely diagnose or fix a systems issue at 3:00 A.M. — the value of remote connectivity could not be denied.

Unfortunately, until the release of Windows 7, businesses had only a few unappetizing choices for providing remote access to workers.

They could open up a giant security hole by allowing full connectivity over unencrypted connections (like the hotel wireless network) and just hope that no one intercepted sensitive data, or worse piggybacked on the connection into the servers themselves. Obviously, this option was not popular.

They could create a DMZ area of sorts allowing connectivity only to specific resources that were sealed off from the “real” corporate network. However, this inevitably meant that whatever access the employee needed was behind the firewall and not available, and it did nothing to solve the problem of unencrypted data transfers.

Finally, companies could install a Virtual Private Network or VPN which would encrypt communications between the remote user and the company network as well as provide a means to authenticate remote users before they connected to the network.

Unfortunately, this required a whole other layer of client software, server setup, firewall configuration, and cost to make it work. Too often, the overall expense and effort of installation, support, and use of the VPN was such a burden that companies strictly limited who was permitted to use the service. Even for those with VPN installed, it was a clunky solution.

With Windows 7, Microsoft implemented DirectAccess. While DirectAccess offers many of the features found in VPN, it is not the same thing.

DirectAccess offers secure connections, like VPN, using IPSec in order to encrypt data passing between the client and network as it travels through the Internet. However, unlike VPN, DirectAccess provides an extra layer of “bi-directional” communications in which the remote computer can be connected and managed, without the user logging in. This is accomplished by authenticating the machine before the user ever attempts to connect.

This provides two huge benefits. First, because the machine must authenticate to the network first, a stolen username and password are worthless without an authorized computer. Thus, not only must a password be compromised, but a machine must be taken as well, which offers a much more obvious flag of a possible security breach.

Secondly, with the machine connected and authenticated over an Internet connection, the system can be remotely administered including installing patches, running scripts, or setting policies or profiles. With DirectAccess, users no longer have to worry that when the connect in a mad rush to download a critical presentation that their connection will be slowed to a crawl while a login script runs and updates are installed. Instead, these things can happen while the employee is asleep or watching T.V. in their hotel room.

DirectAccess is a native part of Windows 7 and integrates seamlessly with Windows Server 2008 R2 eliminating the need for managing an extra layer of security or tying Active Directory entries to VPN users.

Instead, all of the same profiles, policies, and object security features run with full affect ensuring that no one gets access to something they aren’t supposed to, while everyone gets access to everything they do need, all without any frantic 6:30 P.M. phone calls on Friday afternoon.

  •   BranchCache

While network connectivity has become widespread and WAN connections have dropped in price and increased in speed in larger cities, there are still tons of places where connectivity is expensive and slow. For companies with nationwide operations there are unpleasant choices to be made. Spend huge amounts of money on faster connections, or force employees in branch offices to suffer through slow authentication and slower data access.

With BranchCache you can have files stored on-site, either on a server, Windows 2008 Server, of course, or if there is no onsite server, files can be cached on the hard drives of other workstations. This way, if one person pulls down a file at 8:30 am and another person needs the same file at 9:15 am, the second user doesn’t need to download it across the WAN.

  •   BitLocker-to-Go

Windows 7 extends the drive encryption to USB keys and other removable drives. While BitLocker works without Server 2008, if you want to FORCE it to be used on USB key drives, you’ll need the Group Policy updates in Server 2008 R2. (Technically, you can’t force the drive to be encrypted, but you can disallow access to a non-encrypted drive.) Most importantly, the recovery password can be stored in Active Directory.

  •   RemoteApp

If you want to use Presentation Virtualization (making the application appear as if it installed locally) you’ll need Server 2008 (R1 or R2) and Windows 7. While you can technically get away with using Vista, advanced visuals like Aero won’t behave and will eliminate that “local install” feel.

  •   Sever 2008 Without Windows 7 and Vice Versa

In the real world, no upgrade to either the desktop OS nor the server OS will happen overnight. The question then becomes whether or not to upgrade to Windows Server 2008 R2 first or upgrade to Windows 7 first, or go the hybrid route and upgrade some of the server OS while also upgrading some of the desktop OS.

While at first glance, this sounds like the less desirable option, the reality is that this paradigm may actually serve many companies very well. The hybrid upgrade approach allows IT to upgrade by site or location, generally starting with the office with the highest concentration of the right IT personnel. By the time the IT guys are all running Windows 7 and at least a handful of the servers in the datacenter are running Windows Server 2008 R2, much of the infrastructure will not only be in place, but been tested as IT goes about its daily duties.

Working the bugs from a major upgrade out is a lot easier and less politically volatile when the ones dealing with the issues are both the people most capable of figuring out what the problem is, and the ones least likely to complain about the way things are being handled.

In the end, much of the handwringing going on about whether to put the chicken or the egg first may be moot. The only question is, which is the chicken, Windows Server 2008 or Windows 7?

Related posts:

• Windows Server 2008 R2 SP1 New Features: Dynamic Memory and RemoteFX
• Active Directory Rights Management Services: Features & Operational Considerations
• Windows Server 2008 R2 Green Features

Back then, I got an unsolicited phone call from a major computer company that was adding a new arm to its consulting division. They found my resume on the Internet, doubled my salary, sent me on consulting gigs across the country, and bought my first house with the discounted stock I bought out of every paycheck.

By the time I left the computer industry (before it became the “technology” industry) there wasn’t a job I couldn’t get an interview for just because I had an MCSE.

(By the way, if you’re wondering, I’m not old. I graduated from college in 1995. I got my certs pretty much right away.)

The Value of MCSE Certifications Today

Of course, things are not the same today as they were then. That is the function of time, to change what was into what is. Nevertheless, the MCSE certification continues to be both a badge of honor among IT professionals, and a powerful card to play when seeking a new job or a promotion.

However, the MCSE gravy train may finally be coming to an end.

When Microsoft first announced its new certification paradigm, there was much hand wringing and more than a few pronouncements that the IT world was doomed. It turns out that those sentiments were premature. The MCSE on Windows Server 2003 stepped in unnoticed as the “next” MCSE certification and IT professionals have been content to pursue, hold, and display the MCSE ever since.

So, what has changed?

Impact of Windows 7

Microsoft released Windows Server 2008 with exactly five years spacing between the last major server OS release (at least based on version number). True to form, corporate IT managers and directors remembered the advice they got somewhere along their career path: “When it comes to Microsoft always wait for SP1.”

That coupled with the diminished economy, budget cuts, and the fact that plenty of companies hated Windows Vista, all add up to Windows Server 2003 remaining the “standard” Microsoft server platform in most enterprises. But, with the release of Windows 7, change is on the horizon.

It has been a decade or more since most corporations last upgraded their operating system. There is no rush to upgrade now, but everyone knows that while Windows XP has become a solid, reliable, work horse, the future is Windows 7.

While there will be no stampede to upgrade to Windows 7 right away (after all, many companies will be waiting for SP1) the fact that an OS upgrade is coming raises some issues.

Perhaps the first question on the minds of IT executives is the order of the upgrades. With most enterprises still running Windows XP and Windows Server 2003, there are two major upgrades in the works. Upgrading to Windows Server 2008 first allows a company to take advantage of the newer, better, faster, easier to use tools to create and distribute an OS upgrade across a large environment.

Windows Server 2008 was released into a world where Microsoft was fully aware that the main upgrade in the enterprise would be from XP to Windows 7, there promises to be less integration issues between Windows 7 and Server 2008; in contrast to Microsoft’s focus the past few years on Server 2003 being used to upgrade XP to Vista.

Even more importantly, Windows Server 2008 not only already has SP1, it also already has R2, which means that more of those real world glitches that are so stubborn to find have been stomped out. Windows 7, in contrast, still hasn’t has a way to go.

MCSE 2008: How I learned to stop worrying and love the MCITP

The new world order that is emerging will soon be looking for system administrators, architects, consultants, engineers, and other IT pros that are certified in Windows Server 2008. They’ll be surprised to find that their former go-to certification, the MCSE is no longer around.

Those keeping an eye on the job boards, especially the more mainstream ones, can expect to see more than a couple postings looking for MCSE 2008 certifications while the world at large slowly comes to terms with Microsoft’s bizarre decision to sacrifice the virtually household name of MCSE for a confusing collection of who-outranks-who certifications.

MCITP is the new MCSE

Microsoft’s PR machine is big, if not effective, and eventually the world will come to at least a basic understanding of the new certification paradigm.

Until then, companies big and small will be looking to map what they already know on top of the new system. When they do, they’ll notice that MCTS can be had with just one exam for one product. That makes it the MCP, or the certification that people use because they can’t get an MCSE, or haven’t gotten there yet.

Then, they will take a look at the MCITP, with it multiple exam requirements across different technologies and products and they will decide that the MCITP is the new MCSE. In other words, shortly after the job postings for MCSE 2008 start appearing, postings for MCITP 2008 will appear without regard to “in what”.

Some hiring managers will overshoot and find themselves woefully lacking in applicants for a position that requires a MCM Server 2008 or a MCA Server Administrator. Then again, perhaps they’ll be flooded with applications that state this, since there is no such thing, perhaps I would be a good match.

How-To Upgrade Your MCSE to MCITP

Microsoft is all too aware that while there are over 155,000 MCSE Server 2003 certifications, there are fewer than 10,000 MCITP Server Administrators. It doesn’t look good when there are not enough people who are “qualified” to handle your products.

Fortunately, for holders of MCSE in Windows Server 2003, there is a very attractive upgrade path to the MCITP certification.

For Server 2003 MCSEs, just one Microsoft certification upgrade exam is required to get three 2008 MCTS certifications — Active Directory, Network Infrastructure, and Applications Infrastructure Configuration.

If you are wondering how to list that kind of certification on your resume and business card — MCTS(3), perhaps? — then you have an idea of why the new certification paradigm is not as user friendly as its predecessor.

Professionals who take advantage of this route can spend the next four or five years as MCSE 2003, MCTS 2008 certified while both the number of companies using Windows Server 2008 and the number of professionals with 2008 certifications slowly starts to build.

For older MCSEs, upgrading to MCITP isn’t as easy. The upgrade exams for Windows Server 2000 MCSEs have already been retired. For MCSE NT4 (like yours truly) the upgrade path involves taking almost all the same exams as someone without a certification. However, many individual exams count toward some of the MCITP requirements, particularly those from the “Choose One” areas.

There will be considerable value in being both a MCSE 2003 and MCITP for the next several years. For that reason, professionals capable of completing the MCSE 2003 certification quickly, would be best off getting their MCSE 2003 and then upgrading it instead of going straight for the MCITP.

Related posts:

• MCSE vs MCITP: Is the MCSE Still Worth It?
• Why Getting Your MCSE Now Is Still A Good Idea
• Dust Off Your MCSE: The New MCTS & MCITP Certifications Are The Future

An MCSE meant that, not only had you demonstrated an understanding of systems administration and the skills necessary to run a Windows-based enterprise, but also that you were willing to take the extra necessary steps to achieve a long-term IT based goal.

Those two attributes were the best available indicator of someone having what it takes to be a quality sys admin.

Then, Microsoft inexplicably pulled the plug on its highly successful technology certification. In a misguided effort to make Microsoft certification “more relevant” to specific job functions, the company made wholesale changes to the entire certification program instead of tweaking the areas that needed improvement.

In doing so, the company left behind a fog of confusion for both IT professionals, who wondered what certification track to pursue, and for managers who wondered what certification actually matched up with the available position.

There Goes the Last MCSE

The Tom Petty song, Last DJ laments the growing influence of corporations in radio. An enterprise that was once the bastion of people who loved music had grown into one focused only on dollars and cents. It is not unlike what has happened to Microsoft certification.

The MCSE program was both a demonstration of technical abilities, and a badge of honor among Microsoft IT personnel. Senior systems administrators with years of experience and skills that no one would ever question still put forth the effort to get their MCSE designation, even if they did not intend to look for a new position.

The MCSE became what it was, not because of Microsoft, but because the IT community itself took up the MCSE as something to be obtained and respected. When the company took it away, something was lost, and Microsoft Certification became something the company did, not something that we did.

While it is true that the letters MCSE on your business card did not mean you were qualified for a particular job, what it did mean was that you had the skills, knowledge, commitment, and ability to do ANY job given the right resources and training. An MCSE said that you were the kind of computer professional who could learn new, complex, interrelated technologies and then apply them in a given environment.

Not everyone can do that, no matter how much training they get. That is what made it so valuable, not that it mimicked the job functions of a specific position.

Is MCSE Still the Golden Ticket?

While Microsoft officially killed the MCSE with its certification overhaul, the real world has been slow to follow along. Although Windows Server 2008 is the current version, Windows Server 2003 still dominates the corporate landscape making a Server 2003 MCSE the highest certification level necessary in most enterprises.

Indeed, a quick glance at Microsoft’s own job search shows many high-level positions, including Architect and Senior Consultant still requiring a MCSE 2003, or getting an MCSE 2003 within six months.

Even though “2003″ makes the certification sound dated to untrained ears, most technology professionals still regard the 2003 MCSE as the current certification. Forums and web sites around the Internet still advise those looking to upgrade their certifications or positions, or those looking to get into the field to focus on getting the MCSE on 2003.

Everybody Panic … Or, Not

But all of that may finally be changing.

With the imminent release of Windows 7, the new features in Windows Server 2008 become even more alluring. Unlike Vista, which was largely skipped by the enterprise, and Server 2008, which has not become a “necessary” upgrade for businesses still working through budget cuts yet, Windows 7 starts the clock ticking at most companies.

While no one will be looking to rush into a system-wide upgrade right away, the over/under on the number of years left with the XP and Server 2003 pairing as the dominant corporate standard has been set at something less than four or five.

In other words, the MCSE on 2003 won’t be the “current” certification for very much longer.

Microsoft has put too much effort into its new certification model to turn back now. However, if it becomes clear that the revamped model is not producing the desired effect, certain changes could be made.

The most likely being a consolidation of the bewildering array of titles.

In the meantime, Microsoft has provided 2003 Server MCSEs with a two exam upgrade path. The good news is that these upgrade paths provide for a quick road to what appears to be the MCSE heir-apparent, the MCITP, with an interim stop at the MCTS certification.

For MCSE on Server 2003, just one Microsoft certification upgrade exam is required to get three 2008 MCTS certifications: Active Directory, Network Infrastructure, Applications Infrastructure Configuration. If you are wondering how to list that kind of certification on your resume and business card (MCTS x 3, perhaps?) then you have an idea of why the new certification paradigm is not as user friendly as its predecessor.

Is the MCSE Still Worth It?

All of which leads us to the big question: Is the MCSE still worth getting?

The answer is yes.

Windows Server 2003 will continue to be the dominant installed Microsoft server product for at least a few more years, and won’t become a rarity for the better part of a decade. Even with a high-level Windows Server 2008 certification, IT professionals who can demonstrate skill in BOTH 2008 and 2003 platforms will be most highly prized.

Indeed, the most sought after system administrator consulting skill of the next decade will be migrating Server 2003 to Server 2008.

In addition, while the newer MCITP tracks pigeonhole computer pros into specific product tracks, the 2003 MCSE still carries the can-do-anything label that managers find so desirable. There will be a new president before professionals drop MCSE 2003 from their business cards and resumes (and that’s true regardless of whether the current guy gets re-elected).

In fact, the value of 2003 MCSEs will only grow for next several years with those 9 characters being proof that not only are you highly skilled and certified, but that you have plenty of experience too!

So get cracking, get your MCSE on Windows Server 2003. Then, when 2013 rolls around and the usual business card exchange takes place around the conference room table, and among the 7 IT pros with MCITP 2008 you will be the only one with MCITP 2008 and MCSE 2003 on your card.

Oh, and when the Executive Vice President of Whatever (who doesn’t know as much as he thinks about IT) looks down impressed and says, “You’re a MCITP AND an MCSE? Wow,” don’t forget to thank me.

Related posts:

• MCSE vs MCITP: Is the MCSE Still Worth It?
• Dust Off Your MCSE: The New MCTS & MCITP Certifications Are The Future
• What’s The Next Step for MCSEs?