BackupExec 11d - GRT Backup for Exchange 2003

BackupExec 11d has a new feature called GRT - Granular Restore Technology - which allows you to restore emails at the brick level with Information Store backup only!

This is very exciting for most of us who know how painful is doing brick level backup, especially the time it takes.

Now Veritas with its BackupExec product has a great solution for us. This blog will show you a very quick way to make this happen. Of course you can do more tweaking:

1st step - very obvious, install your BackupExec Server

2nd step - once you have finished installing the BackupExec server - install the remote agent to your exchange server

3rd step - Create a backup selection list and choose the Information Store you'd like to backup




4rd step - Create backup-to-disk folder, this to store the backup files



5th step - Create a backup job with the selection list created on the 3rd step, use the backup-to-disk folder as the device and make sure on the Microsoft Exchange settings, tick the checkbox 'Enable the restore of individual mail messages and folders from Information Store backups'





6th step - create an Active Directory account for doing the backup. Make sure this account is mailbox enabled (send a test email to this account to trigger the mailbox creation after the AD account has been created). Run the BackupExec services using this account and use this account for the logon account that runs the backup and restore. Finally, assign this account as a local administrator of the exchange server and delegate this account as an Exchange administrator

Good luck! and I'll be posting again with Exchange 2007 backup

Passed ONT (642-845) Today - CCNP -

Yes!! Finally, the final fourth exam, Optimizing Converged Cisco Networks (ONT), was done today with the score 955/1000.

This marks special moment in my career as a Certified Cisco Network Professionals (CCNP). I learnt a lot of new stuff when studied for this certification. It is the best certification so far :)

Next one is probably CCDP

Cisco ISCW Exam Passed!

I have passed the 3rd Cisco exam toward the CCNP.

It is the ISCW, and my score is 966/1000!!
This is the best exam so far of getting the current knowledge; it includes:

• site-to-site VPN
• ADSL configuration with PPPoE and PPPoA
• SDM

1 more 2 go :)

The Best PST Password Recovery Utility

I've been trying to recover a PST file for the last 4 weeks!

Yes, I know there are a lot of utilities out there that promise you to recover the password of your PST file.

I tell you something, none of them is able to recover a password of a PST file that has a size of 4.0 GB - yes it is four GIG! All of them saying the file is corrupted! but it is not.

Only one utility can open the file and recover the password: PstPassword
This is the best utility for this matter, it is free and it works!

The website has a lot of other utilities, check it out.

Cisco BCMSN Exam Passed!

I have passed the 2nd Cisco exam toward the CCNP.
It is the BCMSN, and my score is 978/1000!!

2 more 2 go :)

Checkpoint and Cisco site-to-site VPN

This guide shows you how to create site-to-site VPN tunnel between checkpoint firewall and cisco router. Let's begin:

Checkpoint
IP address: 1.1.1.2
Network behind: 172.20.200.0/24

Create a network object that is the network that will be sitting behind the new Cisco router



Set the NAT – for Internet routing



Create a network object that is the network that will be sitting behind Checkpoint firewall:




Set the NAT – for Internet routing



Create a new interoperable device on CheckPoint for Cisco router



On Topology option, add external Interface



Note picture above is wrong (should be 1.1.1.1) – sorry$
Mark it as an external interface



Create an internal Interface:



Mark it as an Internal interface which leads to the network behind Cisco router



On the VPN domain option, choose manually defined: and assign the network that is behind Cisco router



On the VPN Manager, create a new community or join the new interoperable device to the existing community (either meshed or star)
Create a new one:



On the participating gateway, put the Cisco router and Checkpoint firewall



On the VPN properties, make sure the phase 1 and phase 2 is having the same setup in both Cisco (later) and Checkpoint
In this example we are using 3des-md5 for phase 1 and aes-128-md5 for phase 2



On the Advanced Properties, make sure the phase 1 and phase 2 is having the same setup in both Cisco (later) and Checkpoint
In this example we are using group 2 for phase 1 diffie-hellman group
Disable NAT inside VPN community – so that site-to-site VPN is not Natted



On Shared Secret page, put the share secret on to be used with Cisco router:



Create a rule in Checkpoint firewall to encrypt the traffic between network behind each firewall:



Push the policy to the CheckPoint firewall!

Cisco
IP address: 1.1.1.1
Network behind: 172.20.199.0/24

Create the isamkmp policy:
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2

Create the crypto key:
crypto isakmp key address 1.1.1.2 no-xauth

where shared-key is the shared key you setup in Checkpoint and 1.1.1.2 is the checkpoint IP address

Create transform set:
crypto ipsec transform-set cm-transformset-1 esp-aes esp-md5-hmac

Create the crypto-map:
crypto map cm-cryptomap 1 ipsec-isakmp
description VPN tunnel to Checkpoint
set peer 1.1.1.2
set security-association lifetime seconds 28800
set transform-set cm-transformset-1
match address 111

Create the outbound access list inside VPN (allow Cisco network to Checkpoint network):
access-list 111 permit ip 172.20.199.0 0.0.0.255 172.20.200.0 0.0.7.255

Create the inbound access list for external interface:
access-list 101 permit icmp any any
access-list 101 permit ip 1.1.1.2 0.0.0.0 any
access-list 101 permit ip 172.20.200.0 0.0.0.255 any
access-list 101 deny ip any any log

Assign crypto-map to the external interface:
interface Serial0/0
bandwidth 2048
ip address 1.1.1.1 255.255.255.0
ip access-group 101 in
no ip proxy-arp
ip nat outside
ip route-cache flow
no cdp enable
crypto map cm-cryptomap

Configure internal interface:
interface FastEthernet0/0
description Cisco LAN
ip address 172.20.199.254 255.255.255.0
no ip proxy-arp
ip nat inside
ip route-cache flow
speed 100
full-duplex
ntp broadcast
no cdp enable

Create the NAT rule:
ip nat inside source route-map nonat interface Serial0/0 overload
route-map nonat permit 10
match ip address 150

Create access list for NAT:
Do-not NAT traffic between sites
NAT everything else
access-list 150 deny ip 172.20.199.0 0.0.0.255 172.20.200.0 0.0.0.255
access-list 150 permit ip 172.20.199.0 0.0.0.255 any

Encode movies to Zune player

Since I've got my Zune player from Microsoft, I could not sync some movies to it. Those movies are Microsoft Webcast files, weird huh? Yes! On Demand Webcast is using .wmv file format and Zune player supports .wmv format, but it's just does not work.

The only way to do it is to convert the webcast file to Zune 'compatible' format. There are many products available on the market to do this, but they are not free.

Alternatively, you can use the Windows Media Encoder 9 to help you to encode the .wmv file to be Zune 'compatible' format.

I've created a video how to do it, and posted it on Youtube - have fun :)

Citrix Conference 2007

Today is the Citrix day.
Darling Harbour was the place for Citrix Conference 2007!

Citrix has got a great range of solutions for Enterprise:

• Presentation Server
• Desktop Server
• Access Gateway
• WANScaler
• NetScaler

I've been using Citrix Access Gateway with Advanced Access Control - this product is awesome! with two form of authentication and end-point analysis makes this product as secure as it can be.

WANScaler rocks as well!! It optimizes traffic between main office and branch offices by caching and compressing the data and use token to simplify the traffic.

There is a new coming appliance product which is based on Citrix and Microsoft technology, not available yet now. They are saying this product can be used as a Domain Controller at branch office as well as the WANScaler!

Some notes from the session about upgrading to Presentation Server 4.5:

1. Parallel Migration


• Build Presentation Server 4.5 Data Store
• Build License Server 4.5 (member server 4.5 does not work with earlier version of license server)
• Build new zone data collector
• Create a Web Interface Site 4.5 (using access management console -> create site)
• Add Server Farms
• Migrate Servers (install PS4.5 to the existing member server - note: maske sure the one that has data store installed is the last one to be migrated
  


2. In-place Upgrade (insert the CD to the existing server and install)


• First to upgrade -> License Server
• Upgrade Farm Metric Server
• Upgrade Consoles
• Upgrade Web Interface 4.5
• Upgrade Zone data collector
• Upgrade Member Server

Some pictures:

APAC SharePoint Conference 2007 - 1st Day

Today, I attended the 1st day of APAC SharePoint Conference 2007 in Hilton, Sydney.

Very exciting !! met a lot of MVPs and SharePoint guru from Microsoft and the Partners. I was attending cool stuff sessions about InfoPath 2007, Groove 2007, Security and Disaster Recovery.

If you don't know what Groove is, check this and this out. It is basically the collaboration tool you can use to share files securely, collaborate with other people around the world without having to worry about the underlying infrastructure such as the firewall.

Met with Joel Oleson - check his blog here. One of the most active SharePoint blogger dude :)

Some pictures:

Microsoft Zune

Ahh... finally, after 3 months - the most existing gadget has arrived safely to Sydney, Australia :)

It is the reward for winning the Microsoft ASAP Pro Infrastructure Architect design contest on February 2007.

The Zune looks great - and it's got the most existing Digital FM Radio! However, it is very hard to find any accessories on the market, since it is not officially released in Australia yet by Microsoft.

Some pictures:

MSDTC

Step-by-step to make the MS DTC working between IIS and SQL servers if there is a firewall between them:

· Enable the Network DTC Access on both IIS and SQL
http://support.microsoft.com/?kbid=555017 (Step 1)

· Specify the static port numbers for MSDTC on both IIS and SQL
http://support.microsoft.com/?id=250367

· Add extra registry entries for the RPC (if the entry is there, modify it; otherwise add a new entry)
http://support.microsoft.com/?id=250367

· Open the static port numbers for MSDTC specified above (e.g. TCP 5000 – 5030) and port TCP 135 both ways between IIS and SQL servers on the firewall
· Open the port number that is used by MS SQL inbound to SQL server (e.g. TCP 1433)

· Configure the MSDTC Security setting
http://blogs.msdn.com/florinlazar/archive/2004/06/18/159127.aspx

Note: No Authentication Required radio box is selected because IIS and SQL are not running on Windows Domain Authentication

· Make sure IIS and SQL can resolve their name using NetBIOS (use hosts file) or DNS
http://support.microsoft.com/?kbid=555017 (Step 4)

· Disable RPC Security for MSDTC Service on SQL server
http://support.microsoft.com/?kbid=555017 (Step 5)

· Test the DTC communication with DTCPing tool
http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q306843

Change DST 2007 for Redhat Linux

In March 2006 the BC goverment decided to follow the US and change the daylight savings time starts and ends. So PD will start on March 11 2007.

To update your Redhat Linux DST, do the following

Check your local time zone
less /etc/sysconfig/clock

once you have found your zone, download the zonefile (e.g. mine is America/Detroit)
wget http://andrew.triumf.ca/northamerica.rules.txt

Check the old zone file
zdump -v /usr/share/zoneinfo/America/Detroit grep 2007

Compile the rules with zic
zic northamerica.rules.txt

Link the localtime file
ln -sf /usr/share/zonefile/America/Detroit /etc/localtime

Check the new localtime
zdump -v /etc/localtime grep 2007

You should see like this:
/etc/localtime Sun Mar 11 06:59:59 2007 UTC = Sun Mar 11 01:59:59 2007 EST isdst=0 gmtoff=-18000
/etc/localtime Sun Mar 11 07:00:00 2007 UTC = Sun Mar 11 03:00:00 2007 EDT isdst=1 gmtoff=-14400
/etc/localtime Sun Nov 4 05:59:59 2007 UTC = Sun Nov 4 01:59:59 2007 EDT isdst=1 gmtoff=-14400
/etc/localtime Sun Nov 4 06:00:00 2007 UTC = Sun Nov 4 01:00:00 2007 EST isdst=0 gmtoff=-18000

ASAP Pro - Infrastructure Architect

I've been watching the ASAP Pro webcasts for the last couple of weeks - it is about Infrastructure Architect by Ramnish Singh - he is holding MCA (Microsoft Certified Architect). At the end of the program, they have a case study and the winner of the best architecture design will be getting the latest Microsoft Zune Player!

Here is the case study
Here is my solution (will be published later)

Guess what? I am one of the winners of the best architect design for the case study :)

Nice Partition Utility

Ever wonder how to partition your HDD or re-size with zero cost? :)
Try this:

Gnome Partition Editor

It is a LIVE CD which you can boot and manage your partition. It supports NTFS!

Restart Server Remotely

Do you want to give permission to other people to restart your server remotely? All they can do is to restart the server - nothing else. Here is how you do it:

• Create a local user in the server
• Create a local group in the server, and assign the new user to this group
• Add the user to the built-in Remote Desktop Users group
• Assign the new group to the local policy to be able to login through Terminal Service and Shutdown the server
• Create a reboot VBScript - call it r.vbs

Option Explicit
Dim Reboot
Dim Cancel
Dim objShellSet

objShell = WScript.CreateObject("Wscript.Shell")
Reboot = msgBox("You are about to reboot the server now. Click YES to confirm or NO to cancel", 4, "Confirm Reboot Server")

If Reboot = 6 Then
objShell.Run "cmd /c C:\windows\system32\shutdown -r -f -t 30", 0, True

Cancel = msgBox("To cancel the reboot, Click YES now", 4, "Cancel Reboot")

If Cancel = 6 Then
objShell.Run "cmd /c C:\windows\system32\shutdown -a", 0, True
End If
End If

• Create a wrapper batch file - call it a.cmd

@echo off
cscript r.vbs

• Assign the new user environment properties to run the a.cmd when they login through terminal service

Run As - explorer.exe - Admin priv

Sometime you need to login to your local machine as a normal user - to maintain least privileges. However, some of your tasks needing you to have higher level of privileges - e.g. open a folder that has NTFS permission for admin group only.

The best way is to run explorer.exe as admin user. But, Windows XP does not support running an explorer.exe as different context. It will spawn a new explorer.exe process under the parent explorer.exe process which has a normal user context.

Here is the trick:

Open the registry (regedit)
Navigate to the following path:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\

Right click the "shell" folder and choose New -> Key
Name it: OpenAsAdminUser

Click the "OpenAsAdminUser" folder and find the (Default) string value
Double Click on that string value, put the value data:
Open An Explorer Window as Admin User

Right Click the "OpenAsAdminUser" folder and choose New -> Key
Give it the name: command

Click the "command" folder and find the (Default) string value
Double click on that string value, put the value data:
runas.exe /user:DOMAIN\ADMIN "explorer.exe /SEPARATE,%L"

Now open your explorer, navigate to any folder you want to open as admin user, right click, you will have the new menu called: Open An Explorer Window as Admin User. Choose that and enter your admin password. Bingo!!

Exchange 2003 - Message stuck in the categorizer

If you have a big distribution list or email enabled security group within Active Directory which has a particular member that forwards an email externally, you might not be able successfully send an email to that group.

When you track the message using Exchange Message Tracking Center, you'll find out that the message is in the status: Message Submitted to Categorizer

This is because the automatic forward email is not enabled by default in Exchange 2003. To enable this:

• Go to Exchange System Manager
• Expand Global Settings
• Click Internet Message Formats
• Right click Default
• Click Advanced tab
• Choose Allow automatic forward

If this one does not work, try to do high level diagnostic with categorizer - modify the registry:

HLM\System\CurrentControlSet\Services\MSExchangeTransport\Diagnostics\

Change 2 Categorizer from 0 to 7

and check your application event log

Configure Cisco DSL Routers

I have just finished configuring my Cisco 1720 router with ADSL wic module installed. I'll show you step by step how to do that:

connect your router with the console cable
say 'no' for initial configuration

configure terminal mode
# conf term

change the enable secret password
# enable secret

change the hostname
# hostname adslrouter

assign IP address to the ethernet adapter (private IP address), use NAT
# int fastethernet 0
# ip address 192.168.0.254 255.255.255.0
# ip nat inside
# no shut
# exit

configure ATM interface
# int atm0
# no ip address
# no atm ilmi-keepalive
# dsl operating-mode auto
# no shut
# exit

configure ATM sub-interface
# int atm0.1 point-to-point

! find the PVC from your ISP
# pvc 8/35
# encapsulation aal5mux ppp dialer
# dialer pool-member 1
# exit
# exit

configure dialer interface
# int dialer 1

! if you get IP address from your ISP's DHCP, otherwise assign static address
# ip address negotiated

! access list for inbound traffic
# ip access-group 110 in

# ip nat outside
# encapsulation ppp
# dialer pool 1

! ppp authentication usernamen and password from your ISP
# ppp authentication chap callin
# ppp chap hostname <username@domain.com>
# ppp chap password
# exit

! NAT for internal clients
# ip nat inside source route-map NAT interface Dialer1 overload

! Port fowarding to internal Firewall
# ip nat inside source static tcp 192.168.0.10 22 interface Dialer1 22

# ip classless

! static route to dialer interface
# ip route 0.0.0.0 0.0.0.0 Dialer1

! access list for inbound connection to Dialer 1
# access-list 110 remark Inboud traffic to internal firewall
# access-list 110 remark Allow access to HTTPS from everywhere
# access-list 110 permit tcp any any eq 443
# access-list 110 remark Allow access to SSH only from X
# access-list 110 permit tcp host a.b.c.d any eq 22

! DNS is UDP that is not connection oriented, thus this is needed
# access-list 110 remark Allow DNS inbound
# access-list 110 permit ip host a.b.c.d any

! If you have SMTP server
# access-list 110 permit tcp any any eq smtp

! allow all established connection
# access-list 110 permit tcp any any established
# access-list 110 permit icmp any any

! deny all
# access-list 110 deny ip any any

! access list for route-map, being used by the ip nat
# access-list 150 remark NAT Traffic from Inside
# access-list 150 permit ip 192.168.0.0 0.0.0.255 any

# dialer-list 1 protocol ip permit

# route-map NAT permit 10
# match ip address 150

save it
# wr mem

Cisco BSCI Exam Passed!

Yes, today, I've passed the 642-801 BSCI Cisco exam with the score 868!!
BSCI is all about:

• Routing protocols - RIP, IGRP, OSPF, EIGRP, ISIS, BGP
• eBGP and iBGP
• Redistribution of various routing protocols
• Routes filter, distribute-list, route policy
• and of course all the CCNA topics

There were 2 simulation questions that took quite a while for me to answer :)
This is the first exam out of four exams need to be done to get CCNP.

Get the users' memberOf from Active Directory

Sometime you need to do an audit of your Enterprise users and make sure they are a member of the proper security group and distribution list within your Active Directory.

Here is the code in VBScript and talking to AD with LDAP:

On Error Resume Next
Dim OutPutFileDim FileSystem
Set FileSystem = WScript.CreateObject("Scripting.FileSystemObject")
Set OutPutFile = FileSystem.CreateTextFile("users.txt", True)

'-- Number value of the error return by ADSI if the '-- memberOf attribute cannot be found.
'==================================================
Const E_ADS_PROPERTY_NOT_FOUND = &h8000500D

'-- Bind to the Users container'==============================
Set objOU = GetObject("LDAP://OU=Users,dc=domain,dc=com")

'-- Initialize the array for user accounts.
'==========================================
ObjOU.Filter= Array("user")

'-- Control Loop
'===============
For Each objUser in objOU
OutPutFile.WriteLine objUser.cn & " is a member of: "

'-- Use the GetEX method to intialize the array for group
'-- membership. Get method cannot be used as it does not
'-- multivalued attributes (user can be member of many groups.)
'============================================================== arrMemberOf = objUser.GetEx("memberOf")

'-- If the error is not raised from ADSI, then list the
'-- groups that are entries within the arrMemberOf array.
'-- If error is raised, display notification on screen.
'========================================================
If Err.Number <> E_ADS_PROPERTY_NOT_FOUND Then
For Each Group in arrMemberOf
OutPutFile.WriteLine vbTab & Group
Next
Else
Err.Clear
End If
Next

'Clean up
OutPutFile.CloseSet
FileSystem = Nothing

Mindsharp Sharepoint 2007

I was attending the Mindsharp SharePoint 2007 Administrators course last week in Sydney. It was really a very good course for SharePoint 2007, a lot of new stuff with SharePoint 2007 - great design, deployment architecture, DR strategy and flexibility.

The instructor name is Milan Gross. He was showing mostly everything with SharePoint 2007.

I am doing the planning and design with SharePoint 2007 right now. I'll post the basic step-by-step installation from the scratch shortly

Melbourne Trip

Yes, I am flying to Melbourne Office. Nice!!

I am doing Domain Controller hardware refresh and Proxy server replacement.

Create SSL Certificate

If you want to get a FREE SSL certificate, you can get it from CAcert. All you need to do is to have your CSR ready.

As per my previous blog about creating CSR, all you need to do with openssl (Linux or cygwin) is:

%> openssl req -new -nodes -keyout private.key -out public.csr

Submit the public.csr to the CAcert, it will give you the public key of your SSL certificate (save it as public.cer)

Now you need to convert both your public and private key to PKCS12 format:

%> openssl pkcs12 -export -out cacert.p12 -in public.cer -inkey private.key

You then will have cacert.p12 which you could import to IIS

Fix MBR with Linux boot loader

If for some reasons your MBR is corrupted, you won't be able to boot back to your OS.
Boot from the Linux installation CD and type:

%> linux rescue

It starts mounting your linux installation partition to the /mnt/sysimage. Then type:

%> chroot /mnt/sysimage

Now you are in the shell within the parent directory. It depends on your boot loader, if it is GRUB, then do:

%> grub-install /dev/sda

For SCSI disk or

%> grub-install /dev/hda

for IDE disk

If you have LILO, then do:

%> /sbin/lilo

Unload application disabled /greyed out in IIS

In IIS6 application unloading / recycling is handled differently. You may notice that the "Unload" button is greyed out or disabled in the Application Settings area. This is because the application is in native IIS 6 mode using application pools. Synonymous to unloading the application in IIS 5 is the concept of recycling the application pool in IIS6, see the Application Pools folder in IIS manager (inetmgr). The only time the Unload button will work is if the IIS web service is running in IIS 5.0 isolation mode and the Application Protection is set to either Medium or High.

Microsoft Ready Summit 2006

Yes, Microsoft Ready Summit 2006 today @ Darling Harbour - Sydney.

The keynote was great, Microsoft Australia Managing Director, Steve V, was talking the evo products.

Cool thing about EVO:

Vista Bitlocker
Vista built-in shadow copy
Vista Search Engine - able to save the search result as a dynamic content folder
Vista Deployment Service

Groove Server

Group policy for blocking device installation - get rid of USB drives
Windows Firewall group policy enhancement - 3 profiles: Domain, Private and public

Exchange 2007 Managed folders - automatic archive emails
Exchange 2007 Unified Messaging - voice mail inbox capability

Network Access Protection - quarantine network for un-healthy machine, incorporate IPSec and Health Certificate

Sharepoint 2007 Rocks!!!

www.microsoft.com.au/readysummit

Microsoft Partner Roadshow 2006

I am attending the Microsoft Partner Roadshow '06 today at Darling Harbour - Sydney.

They were talking about Vista, Office 07 and Exchange 2007 and the benefit of Microsoft Partner.

Links:

http://www.microsoft.com.au/partner/evo

Windows Scripting Links

link will be posted here:

Script Center:
http://www.microsoft.com/technet/scriptcenter/default.mspx

Using WMI:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/using_wmi.asp

WMI Reference:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/wmi_reference.asp

WMI Explorer:
http://www.ks-soft.net/hostmon.eng/downpage.htm

Sharepoint Links

Interesting links will be posted here:

http://www.spsfaq.com/

ESX Admin

Nice post for ESX Admin

http://www.rtfm.copperstream.co.uk/docs/vmwdocs/admin1/

http://www.rtfm.copperstream.co.uk/docs/vmwdocs/admin2/

MCSE Messaging+

Today is the final day for Microsoft certification for me.
I've passed 70-285 and get my MCSE Messaging+ certification.

Getting the .spc and .pvk files for Code Signed certificate

Getting code signed
Something that has bothered me for a while is the hassle in putting together all the pieces to sign my download files. I finally got around to looking it all up, and it isn't easy as you have to piece all the things together. I hope that this will give you an insight into how it can really work, since I managed to actually achieve what I wanted and sign my code. This article is a list of the steps I had to take, and you will probably need to review the commands yourself if you have problems.

The process
Get a certificate from http://www.ascertia.com/onlineCA/Issuer/CerIssue.aspx who will do a free code signing certificate. Obviously any alternative is good, but this will prove the concept for you, and you can go buy another from them or elsewhere later. The email address is included in the certificate, so use a sensible one you are happy for the world to see. Accept the installation of the certificate into the browser as it won't be emailed even though they say it will. Make sure you chose exportable.

Then get the Microsoft code signing stuff (codesigningx86.exe) from the MSDN web site (google will find its current location).

Use the certmgr to view your certificate and export it. Export it as a certificate (.cer file), and with the key (.pvk) file.

Use cert2spc to convert the cer file into an spc file. That's the first half of the process done. Now you need a key file compatible with the signcode application.

From http://support.globalsign.net/en/objectsign/transform.cfm:

How to transform your certificate to a pvk + spc combination.

Export your certificate to a pfx file (be sure to check "Include all certificates in the certification path if possible"). (The latter will help ensure it is accepted by more systems.

Install openssl. You can find compiled binaries on www.openssl.org (but get the Windows build from http://www.shininglightpro.com/ http://www.shininglightpro.com/download/Win32OpenSSL-v0.9.7d.exe)

Extract your private key from the pfx file.

->openssl pkcs12 -in -nocerts -nodes -out

The pfx password will be asked.

Download the pvk transform utility. This file can be found at http://support.globalsign.net/en/objectsign/PVK.zip.

-> pvk -in -topvk -out

Extract your certificates from the pfx file.

openssl pkcs12 -in -nokeys -out

The pfx password will be asked.

Transform your pem file to a spc file

->openssl crl2pkcs7 -nocrl -certfile -outform DER -out

ESX Server Guest OS NIC 10MB Only

If your guest OS on ESX Server is only using 10 MB NIC, install the VMWare tools and change the network driver to vmxnet from your ESX Management console

MCSE - Finally

I have passed my last elective exam: 70-284 with score 820.
This is it. I am officially a Microsoft Certifiied System Engineer!! what a relief!! After 7 exams.

I might do the 70-285 to get the MCSE+messaging and Citrix or SQL2005 after that :)

(or Checkpoint or CCNP or Ethical hacker)?