Author Archive

« Previous Entries
Next Entries »
19 02 2007

How to relocate your Groove 2007 files to another disk

Posted by Kevin Reeuwijk in Groove

If you are like me and you like to use a smaller, dedicated partition for Windows and the remaining space as a separate data partition, you’ll have a problem with the way Microsoft Office Groove 2007 stores it files. In the previous version (Groove 3.1), you could specify the data directory for Groove’s user and system files during installation. I always changed the location to a different location, because I didn’t want all my workspaces to be stored somewhere under C:\Program Files, so I would set it to something like D:\GrooveData. If I needed to reinstall my laptop later (something that happened a lot during the Vista beta timeframe), I could just format C: and still have my workspaces.

However in Microsoft Office Groove 2007, the location of the files has changed to the local (non-roaming) part of your user profile. Now I already don’t like large profiles, so adding another few gigabytes of Groove 2007 data doesn’t sound appealing to me… So since day 1 of installing Groove 2007 I have been looking for a good way to relocate back to something like D:\GrooveData. Here’s how you can do it:

Important note: you will need Windows Vista for this, because full support for symbolic links exists only in Windows Vista.

The Groove 2007 files are located at this location in your user profile in Vista: C:\Users\<username>\Appdata\Local\Microsoft\Office\Groove
You will need to redirect this folder to another location using a symbolic link. Windows Vista supports creating symbolic links from the commandline, using the mklink command. First however, you will need to move your Groove files to the new location; follow this procedure to do that:

  1. Shutdown Groove! I can’t stress this point enough: don’t try the move the files while Groove is still running because it will corrupt the files and you will lose access to your workspaces. It happened to me and it’s quite frustrating. Exit the Groove application and open Task Manager. GROOVE.EXE should not be in the list; if it still is then kill it by clicking ‘End Process’. If you see GrooveMonitor.exe in the list, end that process as well.
  2. Create a new folder on the disk you want the files to move to. I created a folder called GrooveData on my D: drive
  3. Open Windows Explorer and navigate to C:\Users\<username>\Appdata\Local\Microsoft\Office\Groove
  4. Select the ‘System’ and ‘User’ folder and move them to the directory on the other disk that you created in step 2.
  5. After the files have moved, delete the C:\Users\<username>\Appdata\Local\Microsoft\Office\Groove folder.

Now, open a commandprompt and enter the command:

Mklink /D C:\Users\<username>\Appdata\Local\Microsoft\Office\Groove D:\GrooveData

Replace <username> with your own username and replace D:\GrooveData with the location you use in step 2. Now in Windows Explorer, you should see a Groove folder again under C:\Users\<username>\Appdata\Local\Microsoft\Office. This time however, the folder has a shortcut icon on it, to show it is a redirected folder. The resulting folder should look like the screenshot. You should also see the Groove files again that you moved to the location from step 2.

There’s one caveat: Windows will not apply the parent NTFS permissions to the files and folders that are behind the symbolic link; those files and folders will inherit the permissions from their own parent, which is D:\ in my case. So make sure you explicitly give yourself (or the local ‘Users’ group) full control on D:\GrooveData folder, otherwise Windows User Account Control might prevent you from modifying the contents and Groove 2007 will have a problem with the files.

Now you can start up Groove 2007 again, and it will happily use the files from the redirected location!

Comments 35 Comments »

09 02 2007

Security loophole found in Groove 2007 Files Tool

Posted by Kevin Reeuwijk in Groove

I’m working on this cool new offering for my company and of course we use Microsoft Office Groove 2007 to quickly and easily share documents, presentations and such, without having to use an intermediary website like SharePoint or an internal fileshare over a VPN. I was invited to this particular Groove workspace as a ‘participant’ (my security role for this workspace) and for the place where you can put your files that basically comes down to permissions you see in the screenshot.

At first, those permissions seemed to work fine, because I couldn’t delete a document that was put there by someone else. In this case however, I was asked to update this particular document and I chose to save the updated document under a different name in the workspace. Now I had 2 documents in the same folder, 1 old en 1 new. There was also an “OLD” folder in the workspace, so I decided I would move the old document to the OLD folder and this is where I hit the security restrictions, and after some fiddling, the loophole:

Because you don’t have the “Delete files/subfolders” permission as a ‘Participant’ in Groove, you can’t delete someone else’s files. This prevented me from moving the old document (which was owned by someone else) to the OLD folder. However I could copy the document to the OLD folder since the security permissions do allow that, so now I only needed to delete the old document in the root folder.

I tried to open the document, make a change to it and save it back again to Groove, but even though the “Modified By” value was updated (to myself) I didn’t became the owner of the document and still couldn’t delete it – Groove’s security model scores again.

Next however I tried something devious (and it worked): I created a file with the same name as the document that I wanted to delete from Groove and dragged that file to the workspace. Groove asked me if I wanted to overwrite the file and needless to say I happily clicked ‘yes’ and presto! I was now the owner of the file and I could delete the file!

It seems that Groove sees an overwrite action only as a ‘Modify files’ action and not as a ‘Delete files/subfolders’ action. I will report this to Microsoft so they can fix this; in the mean time you can remove the ‘Modify files’ right from the participant role if you’re afraid that some of your Workspace members want to take advantage of this loophole.

Comments 7 Comments »

21 01 2007

It’s official: I’m Vista Certified

Posted by Kevin Reeuwijk in General

I just received this e-mail:

Congratulations on becoming a Microsoft Certified Technology Specialist: Microsoft Windows Vista: Configuration!
Your next step as a MCP is to confirm your address at the MCP Member site in order to receive your Welcome Kit. The kit contains your certificate.
[…]
By earning a Microsoft Certified Technology Specialist(MCTS) Certification, you have made a valuable investment in your future.
We hope you enjoy the benefits of membership in the Microsoft Certified Professional community, and we look forward to helping you succeed as a Microsoft Certified Professional.
[…]

Thank you,

The Microsoft Certified Business Solutions Professional Team

I wonder what the certificate looks like, if it’s as cool looking as the new Windows Vista retail boxes I’ll definitely give it a nice place to shine :-)

Comments 1 Comment »

05 01 2007

The Legend of Exchange: Twilight Mail Migration

Posted by Kevin Reeuwijk in General

Having spend a whole night up to do my first inter-org Exchange 2003 to Exchange 2007 mailbox migration and publishing the new OWA, SMTP and POP3 endpoints, I feel obligated to share this epic story with our readers. After much exploring, digging through the (now deemed priceless) Exchange 2007 TAP e-mail archives and fighting great battles with the PowerShell bosses, I must say I feel a Wii bit proud of my accomplishments… and a little too hooked on Zelda I suppose.

Although I can’t clearly recall exactly what all happened that night, I now I started somewhere around 22:30 and finished around 06:30 in the morning. Now don’t think I had many mailboxes to move; nope, when I finally got the move-mailbox command going, all 12 of my mailboxes moved without a hitch. Oh and before any of you think that any of this is Microsoft’s fault, it’s not. Every problem I came across was either due to my own faults or it was standard (read: more secure) behavior and just needed the correct PowerShell command to change it to my own (read: less secure) requirements. Finding those correct PowerShell commands took most of the time though, so here is my main message to you: make sure you get plenty of hands-on experience with the Exchange 2007 Management Shell ’cause you are going to need it!

So I had already installed Exchange 2007 on 2 servers:
- One internal server with the Mailbox, Hub Transport, Client Access and Unified Messaging roles on it
- One internet-facing server with the Edge Transport role on it

The Exchange 2007 organization is installed into its own forest, because I wanted to be able to build everything from scratch next to my live (Exchange 2003) environment and move the whole thing over when all was working well, keeping downtime to a minimum. Boy, my VMware Server had a tough time in those weeks I built the new environment, having to support up to 12 virtual machines at peak moments…

Now to keep user problems as low as possible, I chose to use the latest ADMT with the Password Export Service to copy over the user accounts including their passwords. Next I setup the EdgeSync subscription in Exchange to connect my Edge server to my main internal Exchange server. This is a pretty straightforward process and is well described on the Exchange Management Console. You basically go to your Edge server, start the Exchange Management Shell and enter the command:

New-EdgeSubscription -file:”c:\NewSubscriptionExport.xml”

This creates a xml file which you now have to manually move to your internal Exchange server and import it using either the Management Shell or the Management Console, I chose the Management Console. It then creates the EdgeSync subscription and connectors. With this your Exchange environment can now basically route mail to the internet and accept mail from the internet for the e-mail domains that the Exchange Organisation knows about. And here comes your next task: your internal e-mail domain is probably not the e-mail domain you use for internet mail, so you need to add another “Accepted Domain” to your Exchange config. This is pretty easy to do with the Exchange Management Console, but to push this change directly to the Edge server, you must go open up the Exchange Management Shell on the internal Exchange server and enter the command:

Start-EdgeSynchronization

After this command completes you can check if the Edge server received the changes correctly by entering to following EMS command (on the Edge server):

Get-AcceptedDomain

Now that that was done, I wanted to move over my mailboxes and knowing this would be an inter-organization mailbox move I looked for the Mail Migration Wizard in the start menu…..it’s not there. So I searched the Exchange Management Console for move-mailbox kind of options, but the only one you will find only supports intra-org mailbox moves… Oh boy. So I went back to my trusty TAP mail archive and searched for inter-org and found one Exchange TAP tip (no 167) mail about inter-org mailbox migration (but a good one!). The article was quite lengthy and ultimately resulted in the following Exchange Management Shell commands:

$s = get-credential

$t = get-credential

Get-mailbox -DomainController ‘forestAdc1.extest.com’ -Credential $s -database ‘SourceServer1\SourceDB1′ | move-mailbox -TargetDatabase ‘TargetServer1\TargetDB1′ -SourceForestGlobalCatalog ‘forestA.extest.com’ -GlobalCatalog ‘forestB.extest.com’ -DomainController ‘forestBdc1.extest.com’ -NTAccountOU ‘OU=UsersOU, DC=forestB, DC=extest, DC=com’ -SourceForestCredential $s -TargetForestCredential $t

The get-credential commands bring up a user control that allows you to enter the credentials needed for the source forest (stored in $s) and the target forest (stored in $t). These objects are then re-used in the following larger-than-life command that should enumerate all the source mailboxes in the source database on the source server and move them over to the target database on the Exchange 2007 server. Needless to say this requires some practice to do well… One more problem was that I wanted to migrate everything but the mailbox of the Administrator account, so… how do you specify that? Well, you have to insert a ‘where’ statement in between the get-mailbox and move-mailbox commands. The resulting command is:

Get-mailbox -DomainController ‘forestAdc1.extest.com’ -Credential $s -database ‘SourceServer1\SourceDB1′ | where {$_.Alias -ne “Administrator”} | move-mailbox -TargetDatabase ‘TargetServer1\TargetDB1′ -SourceForestGlobalCatalog ‘forestA.extest.com’ -GlobalCatalog ‘forestB.extest.com’ -DomainController ‘forestBdc1.extest.com’ -NTAccountOU ‘OU=UsersOU, DC=forestB, DC=extest, DC=com’ -SourceForestCredential $s -TargetForestCredential $t

However, every time I tried to migrate the mailbox I got a “The object could not be found” error message. After much searching, I found that I had not migrated the sIDHistory from the user accounts in the ADMT migration… whoops. Fortunately this was easily fixed by deleting the users in the new forest and migrating the users once more with ADMT, this time enabling the sIDHistory option. I then also found that you can skip some options of the move-mailbox command because they are often not required for the command to work. I got the mailbox migration running with the following command:

Get-mailbox -DomainController ‘forestAdc1.extest.com’ -Credential $s -database ‘SourceServer1\SourceDB1′ | where {$_.Alias -ne “Administrator”} | move-mailbox -TargetDatabase ‘TargetServer1\TargetDB1′ -SourceForestCredential $s -TargetForestCredential $t

During the migration, the PowerShell tries to graphically represent the migration progress, using old Norton Commander-like progress bars. It’s quite nostalgic really…

After the mail migration, I needed to enable POP3 and allow external users to send outbound SMTP mail via the Edge Transport server. How that story went, I’ll save for another part…

 

Comments 19 Comments »

17 11 2006

Media Center in Vista RTM rocks!

Posted by Kevin Reeuwijk in Vista

I’ve just upgraded my Windows Media Center 2005 to Vista Ultimate and I can’t stop smiling, this thing rocks! Forget your previous (notoriously flaky) experiences in the beta’s, it just really flies now… Here’s just a few things that I really like about this new version of Media Center:

  • x64-bit support: If you install Vista x64, you get Media Center x64! Especially for watching HD content, this should allow you to get the most out of your x64-capable processor
  • Instant media sharing with other Windows Vista machines: If your laptop also runs Vista (which it should), you can easily browse from Windows Media Player or Windows Media Center to your shared media library on your Vista Media Center box and effortlessly play that remote content over the network
  • Media playback priority: In Vista, multimedia content is *finally* treated as a first class citizen; Vista will do everything in its power to ensure a smooth and glitch-free playback of audio and video. Having a background task, virus scanner or p2p software download running will not prevent you from smoothly playing a high-def video or audio file. If your system can play the file when it’s otherwise idle, it can now also play it under load
  • New Media Center color scheme: the darker shades of blue give a more professional and polished feel to the interface
  • Super fluent transitions: moving through the Media Center interface and switching from Live TV to say Pictures & Videos is just flawless and glitch-free. I was amazed at the overall improved comfort level due to these optimizations
  • Mini-guide: If you hit up or down on the remote while watching Live or Recorded TV, you’ll get a nifty mini-guide in the lower left quarter of the screen. It shows summarized info about the current program on the current channel and you can view program/channel info of the other channels by using the navigation buttons. You can now check the Guide while still viewing the current channel!
  • Instant teletext info when the sound is muted: Yes you read that right; if you mute the sound, Media Center will instantly activate teletext at the subtitle page. This allows you to still follow what’s being said on the show. For some channels, this teletext page contains now & up next channel info instead of subtitles.

So start upgrading, you know you want to.

Kevin

Comments 1 Comment »

« Previous Entries
Next Entries »