Lukas Beeler's IT Blog

I’ve had my share of experiences with ZyXEL equipment, like the ZyWALL vs. Exchange post i did a few years ago.

But today i experienced the most grave issue with their equipment that critically impacted a customers business.

The customer has two sites – an HQ with an SBS 2008 and a branch office with two Lenovo SFF machines running Windows Vista Business. Both sites are using 20/2 VDSL lines from Swisscom, with ZyXEL P-2802HWL routers.

There is an IPsec VPN configured between these two sites. This has been working fine since January.

Now, about a month ago a telecom service company installed VoIP telephones in the branch office, and enabled QoS on both ZyXEL routers.

Since then, Outlook was unable to synchronize correctly with the SBS server. Unfortunately, the customers personnel isn’t that technically savy, so they weren’t able to tell that they had a problem – because smaller e-mails were able to successfully synchronize, but larger ones failed. This led to very inconsistent states of the OST files, with some mails there and some mails not there.

When i arrived at the branch office i didn’t have a single clue what the issue was or may be. At first i suspected an Outlook problem, so i deleted the OST file. But from there on, nothing happened – Outlook wasn’t able to download anything.

Next, i tried to copy a 50kbyte Excel file from a share to the local computer. This worked. So i tried a 2 megabyte Word file. This failed about halfway through, with Explorer just hanging there and doing nothing. From that point on, i suspected a network issue, but the fact that copying a 50kbyte file worked and a 2 megabyte file didn’t was very odd.

Using Outlook with Outlook Anywhere also worked (when the VPN tunnel was downed).

Whenever i’m confronted with strange network problems, i suspect MTU issues (which was my first “real” network problem i solved back on my first ADSL line – took me weeks for a simple fix). ping -l 5000 CUSTSBS01 worked. ping -l 15000 CUSTSBS01 worked, too. So thought it wasn’t an MTU issue.

Disabling QoS on the ZyXEL router fixed the issue, but made the phones unusuable while Outlook was filling it’s OST files.

So i ran through the usual check points – tcp checksum offloading, chimney, receive window autotuning, reboots, etc. Nothing helped. At the end i was just changing network settings at will. But nothing helped.

Out of any reasonable ideas, i changed the MTU to 1300. That fixed it – with QoS enabled and the NIC MTU of the two machines, everything was working as it should. File transfers worked, Outlook worked, Phones worked.

Don’t buy ZyXEL.

The Microsoft Performance team published a new great article about the Vista eventviewer and saved logs.

With Windows Server 2008 at the door, this is interesting. I would also strongly suggest to read all other articles in the Askperf blog – while updates are rather sparse, the content is extremely interesting and well written.

Windows Vista has been available for consumers since more than half a year – longer for companies and IT professionals.

Are you using Vista on your Desktop yet? No matter what you think of Windows Vista, you should already be using it right now. If you don’t think you’ll ever migrate to Windows Vista, you should start evaluating your alternatives now – and not when mainstream support for Windows XP ends in a few years.

Windows Vista is the next stop in the Microsoft desktop operating system part. I’ll agree that Vista still has some smaller quirks to be sorted out, but the main problem are 3rd party apps made by lazy idiots based upon technology from before 2000. If you’re working in IT, you should start getting used to Windows Vista now, even if you read and heard bad things.

Vista offers many great improvements – none of them are revolutionary, but they definitely make Windows a better platform. These are not the features advertised on TV, or debated in forums – but instead the deployment process which was just awkward under Windows XP and it’s predecessors, and many management improvements.

UAC helps to make privilege separation more comfortable. However, there is no native way to start a command elevated from the commandline. I’ve often found myself to be typing “notepad hosts”, and then getting an error message that i lack the permissions for doing so.

Of course i can launch a cmd window with administrative capabilites (a neat trick for this is to put that at position one in the quicklaunch bar, and then launch it by pressing WIN + 1), but i’ve gotten using to the whole WIN + R, cmd, Enter deal (mostly because it also works on customer’s computers).

There’s a nice Script for elevating a command directly from the commandline. I really, really do wonder why there’s no such command in Vista by default. I’ll make that this is in our standard Image.

Windows Vista brings Shadow Copies to the end users. While this feature was already implemented in Windows XP with System Restore points, only Windows Server 2003 allowed users to access specific versions of files as a sort of online backup (for non-disaster purposes).

With Windows Vista, this feature is now available for the users of the Business, Enterprise and Ultimate versions (the Home and Home Premium use it in the same way as Windows XP did). However, this brings light to new privacy concerns. Files that you deleted and removed from the recycle bin are probably still there. This is actually a good thing as it has saved me more than one restore from backup.

If you delete your browsing history, the files will remain available in their shadow copy form. Of course it is possible to delete all shadow copies, but programs that support secure delete do generally not support scrubbing the respective shadow copies too.

Few end users know about the support, as it is not available in the Home and Home Premium features – Apple brings this technology to the masses, advertising it as a Time Machine. However, many Laptops are sold with Vista Business on them, and many Small Businesses that purchase Hardware from Lenovo or HP might end up with a Vista Business Machine.

End users should learn about shadow copies and that it might affect their privacy – you can no longer be sure that a file you scrubbed and deleted is actually completely gone.

I’ve encountered an interesting problem, where i wasn’t really able to track down the source (but found a solution nonetheless.

It was a new Vista Business machine, running Office 2007, freshly set up by me about a week ago. The problem was that Adobe Flash didn’t work. Or, didn’t work completely. Sites like youtube.com didn’t work, but the flash install site showed the animated bar.

When looking at the add ons settings in IE7, you could see that it was successfully installed. I ran the Flash uninstall Tool, which didn’t work quite right – i had to launch it with administrative privileges manually in order for it to succeed. After that, i revisited the flash install site, the plugin was installed again, and everything worked fine.

And here comes the really interesting thing – the person that was using this machine swore that he never saw the ActiveX installation dialog. I looked at the installed software, and Adobe Reader 8 was part of it. Maybe Adobe Reader installed a slightly broken version of the flash plugin? I didn’t bother to investigate this more closely since the problem was already solved, but this might cause some more trouble down the road.

Yes.

Vista isn’t the greatest thing since sliced bread. Vista isn’t revolutionary. Vista isn’t Wow. But it is a lot better than Windows XP. It’s evolutionary, not revolutionary.

I’ve been using Windows Vista for over half a year. There are several very cool improvements in Windows Vista, which you might not have heard of. I don’t really care about Aero, but i do care about all the other, important enhancements in Windows Vista.

• Virtual file store
  
  Windows Vista allows broken or legacy programs to run without admin privileges, by creating a virtual store for programs that try to write to %ProgramFiles% or %SystemRoot%. This is much more important than one might think, because many SMB businesses run all their users with admin rights, because they don’t have and can’t afford a dedicated IT staff which would make sure that all programs have compatible permissions for a limited user.
• Better integrated firewall
  
  The integrated firewall from SP2 was okay. It worked, but it wasn’t very flexible. GPO managment was so-so. With Windows Vista, this has changed. You can create custom rules, distribute them through GPO. The firewall also takes advantage of Windows Vista’s network location awareness, allowing you to make rules depending on the location of the machine – domain network, home network or public network. It also has integrated support for RPC, allowing you to allow and disallow seperate RPC calls – e.G. allowing file share access, but not access to remote registry, services, etc.
• Working internationalization
  If you have ever worked with Windows XP MUI, you will know that it was an incomplete piece of shit. IE7 still isn’t available for XP MUI, and there were severe problems with Outlook Express (unable to open attachments directly). With Windows Vista, there are no more native language versions, everything is MUI now. This is a good thing, because MUI is a first class citizen now. Even the file system has symlinks (called Junctions) to the internationalized name. This means less hassle with Vendor preloads (I’m thinking of you, Lenovo).
• Better offline files support
  Offline files finally work 100%. While XP was almost there, Vista now has fully working Offline Files without unnecessary problems. Laptop users, rejoice!
• User Account Control
  Every power user complains about it. I don’t understand why, honestly. But i’m used to sudo, so i might be biased. I even configured UAC through group policy to always ask for a user name – this imitates sudo well, and makes the user even more aware that there is an important decision to be made.
• Deployment Toolkit
  Well, i hated RIS. It always reminded me at the good old times, when we still used DOS. With Windows Vista, Microsoft made Imaging with ImageX the new default for network deployment, allowing more flexibility. Windows PE is now available for normal people like me. This is a good thing.
• More group policies
  Managment for 802.1x on WLAN, but also on wired networks has been extended. There are many, many new GPO settings, allowing easier customization of your deployed machines. Also, the new centralized GPO store will solve some problems in the near future.
• Many updates to admin tools
  Like the new eventvwr, there are very many improvements to the Vista administration utilities. It’s now also possible to make partitions smaller in Vista, eliminating the need for 3rd Party Partitioning Software.

For home users on the other hand, i don’t see much reasons for vista adoption. Of course, when buying a new PC you should buy Vista. But if you’re not interested in the OS itself.