What does the navigation pane on the left side of the File Explorer window display?

Can Your Business Benefit from Document Management?

A business can benefit from document management if the answer is yes to any of these questions:

Is there confusion over which document is the latest or approved version?

Are excessive duplications eating into available network storage capacity and causing bottlenecks during the electronic discovery process?

Are business decisions made with incomplete or inaccurate information because it takes too long to locate the right content?

Are employees frustrated or spending too much time searching multiple file shares or other storage locations?

Do employees recreate or feel compelled to redo work because it is difficult to find? Are employees even aware of previous work done by colleagues or other business units?

Are delays in information access and efficient content distribution causing bottlenecks and slowing completion of projects?

Monitoring Vista

To monitor Vista, follow these steps:

Open the SCOM console by going to Start | All Programs | System Center Operations Manager 2007 | Operations Console.

The SCOM console will launch and you will be presented with the home screen. Click Computers in the left-hand navigation pane.

The middle pane will give you the Computers pane with a Detail View of the selected computer object directly below the list of managed systems. Click the Vista machine to view various details about the system.

On the right-hand side of the console you will see the Actions pane. From here, you can perform various tasks on the selected system. Click Computer Management to launch the familiar Computer Management MMC console.

Note

The Computer Management console does not support the Event Viewer, Performance Monitor, or Device Manager when connecting to Vista machines.

Click Remote Desktop to connect to the selected computer via the Remote Desktop Protocol (RDP). Clicking Remote Desktop (console) will launch an RDP connection that connects directly to the console.

Tip

If you want to launch RDP connections that connect directly to the console of the machine you are connecting to, use this command: mstsc /v:SERVERNAME /console.

Collection Summary

The collection Summary is accessed from the Collection pane menu. It provides you with a graphical breakdown of Sessions, Bytes, and Packets over Time. You have the ability to zoom in and out of each graph. You also have the ability to navigate a particular time slice from the Summary View (see Figure 5.21).

Filtering

Filtering is the process of eliminating unnecessary sessions from a collection. Netwitness provides you with several ways to accomplish this task. Rules can be created that will filter traffic during a live capture or file import.

Custom Drills can also be created within a collection while in Navigation view from the Report icons. There is also a Custom Drill icon in the Navigation toolbar menu.

Rules

The Rule Configuration window is accessed through the Edit menu. The Rules Configuration window allows you to create Net Rules or App Rules. Rules created here will be available for any collection. The rules can be created for either a Network Capture or File Import.

Let’s create a rule.

From the Netwitness menu bar, select Edit and Rules. In the Rules Configuration window, select Net Rules. Click on the New Rule icon and select For File Import.

In the Add Rule window, provide a name for the new rule. In the Definition window, enter the following:

ip.addr=192.168.8.128 (this is the address of our victim). Select the Packet Data action and Session Options, click OK. The Rule will now be listed in the Rules Configuration window. You can click on the Disable Rule icon to disable the rule until needed. Click OK to close the Rules Configurations window. Just like Wireshark filters, Netwitness also provide the same visual clue as you type in the rule definition, red is bad, green is good (see Figure 5.22).

Drilling

Drilling is the process of focusing the view on a specific subset of the chosen metadata report. You are narrowing down the amount of data displayed and focusing on suspect sessions. There are several ways to drill in Netwitness.

Custom Drill

The Custom Drill icon is located in the Navigation toolbar. Clicking on the icon will open the Custom Drill window. You can define the filter desired and it will be applied only to the current view. The result of the filter is a new Navigation pane displaying only those sessions matching the filter. Filter expressions can be combined.

Let’s create a Custom Drill.

From the Navigation Pane tool bar, select the Custom Drill icon. In the Custom Drill window, define the filter. In the Definition window type the following:

ip.src=192.168.8.128 (our victim). Click OK (see Figure 5.23).

Intellisense

Intellisense helps you create a drill definition by providing possible choices and displaying the Definition window background in green or red, depending on if the Definition is valid.

Report Icon

You can also access a Custom Drill menu from any Report icon in the Navigation view.

Options

The options available under the drop-down arrow depend on the Report type. Some of the choices include; =, =, exists, contains or begins. Once you supply the desired parameter, you can chose to Drill, Copy to Clipboard, Open Report, Close Report, Close other Reports, More Results, and All Results.

Copying to Clipboard allows you to paste the results into a new file. Choosing the Drill option will modify the Navigation view to only display the sessions associated with that chosen parameter.

Report Value

You can also drill down into a collection by clicking on a Report Value within a Report. Next to each Report Value there will be a number enclosed in parenthesis. This number represents the number of sessions associated with that particular Report Value. As an example, the following entry indicates that there are 292 sessions associated with the HTTP service located under the Service Report (see Figure 5.24).

When using this method to drill, you have the ability to generate a new tab containing the associated Report Value data or change the existing tab. To generate a new tab, press the CTRL key while selecting a Report Value.

Session List

Clicking on a Session List number next to a Report Value will open the Session View Pane and display all the sessions associated with that Report Value.

Breadcrumbs

As you drill down into a collection, Netwitness displays the path you have taken in the path window located beneath the main menu bar. Netwitness refers to this window as breadcrumbs. A user can simply click on any element in the path to jump back up to that level. This also applies when you create new tabs when drilling.

Searching

Netwitness allows you to perform searches for keywords and regular expressions. You can create a new keyword or expression search or you can choose one of the precompiled expressions. Netwitness provides a simple search in addition to an advanced search.

Accessing the Search Function

The search function window becomes active once you have opened the Navigation pane of a collection. Using this search window conducts a simple search without being able to edit the preferences (see Figure 5.25).

You can also access the search function by right clicking anywhere in the Navigation Pane and the Session View Pane. The Content View Pane provides a Find feature.

Simple Search Window

See Figure 5.26.

Advanced Search Window

See Figure 5.27.

Search Preferences

Search preferences dictate where and how Netwitness will search for the designated keyword or regular expression. The default setting is to just search content. You must check the regular expression box, if necessary. Otherwise, the search engine treats the search string as a keyword.

Simple Search

A simple search is conducted by entering in the keyword or expression, selecting your desired options and clicking the Search button. Netwitness will conduct the search and the results will be displayed in a Session View Pane. The matching keyword will be displayed as bold text.

Netwitness will not save a simple search term or expression for future use. You must use the advanced search if you want to save the term or expression. Netwitness keeps track of the last several searches run. This allows you limited access to previous terms. The search term history will only be available for that particular collection.

Advanced Search

The advanced search window is accessed by clicking on the small icon in the top left corner of the search window (see Figure 5.28).

The advanced search window allows you to create and save for later use custom search expressions and keywords. You can also access the precompiled search terms for use (see Figure 5.29).

Advanced Search

An advanced search is conducted by selecting a precompiled expression or creating a new one, selecting your desired options, and clicking the Search & Export button or Search button.

Netwitness will conduct the search and the results will be displayed in a Session View Pane. The matching keyword will be displayed as bold text.

The advanced search window also provides an ASCII to Unicode convertor.

Exporting Sessions

Exporting can be accomplished either from the Session View Pane or the Content View Pane.

Exporting from the Session View Pane exports all the sessions associated with a particular drill. Exporting from the Session View Pane provides allows you to export to a new pcap file or new collection.

Exporting from the Content View Pane exports only the packets associated with the currently selected session. In the Content View Pane, you can either export the currently loaded session to a new pcap file or open the session as a pcap file in your default pcap application.

From the Session View Pane, select either the Export to a File icon or Export to Collection icon from the menu bar. Provide a name for the file or collection and select OK (see Figure 5.30).

You can also Export Sessions by right clicking anywhere in the Session View Pane. Select either Export Sessions to a File or Export Sessions to New Collection, provide a name for the file or collection and select OK.

Try all these steps with one of your previously captured files from Chapter 2 and see what you can, or can’t find. You can also Google for “sample packet captures” and use those to become more familiar with these two tools.

Catalogs

The archetypal example of a catalog e-commerce site is Amazon.com (Figures 8.1 and 8.2). With likely millions of products across dozens of categories, the primary challenges for a site such as this, in addition to conversion, are to get shoppers to their desired product or to help them find a product they wish to purchase and then to facilitate that process. In addition, there are secondary goals such as increasing cart size through cross-selling or recommendations. With such a diverse product offering, locating a product becomes a significant source of cognitive demand, which can, unfortunately, lead to dissatisfaction and abandonment. Accordingly, navigation and search functions receive intense attention (Figure 8.3). Design and use of navigation in all its forms, from tabs to dropdowns with various expansion or bread-crumbing strategies (both vertical and lateral), are frequently studied both with and without eye tracking.

Search and results filtration strategies are another common target of study. Typical questions that are asked in navigation studies pertain to the logic and “intuitiveness” or naturalness of the categories with respect to moving from the broad to the specific or from category to rational subcategory. For example, in Figure 8.4 we have the top-level categorization for cameras at B&H PhotoVideo, a major retailer of photographic and video equipment. On this page, they present only the broadest categories of “digital” and “film” cameras. Clicking through either brings up a page format with detailed categorizations such as “point and shoot” or “35 mm” and “medium format” in the expanded left navigation pane and product listings in the center of the page. On Adorama’s (a competitor to B&H) top-level camera page, not only are digital cameras shown, but there are also multiple film camera types such as dSLR, 35 mm rangefinder, and medium format displayed (Figure 8.5). Selecting any of these leads to another page that includes further options to click through to see the cameras and various accessory types. It is only after this additional step that the user is presented with a camera listing and left navigation filtration options that appear one stage earlier at B&H. In these two different approaches, we see evidence suggestive not only of how each vendor approaches conceptual and practical categorization but also the prominence of cross-selling opportunities such as for accessories.

So for browsing and search filtration, evaluating the efficiency of those filters, especially the appropriateness and number of the filtration parameters, are components of many navigation and selection studies. For example, how useful is the inclusion of a color parameter in top-level search for point and shoot digital cameras, and how hierarchical or flat should the arrangement of search and filtration parameters be? Eye tracking can help answer these questions.

Commodities

In contrast to multicategory catalog sites, commodities e-commerce sites generally offer a more limited range of product categories but with greater depth. For example, Petco.com (Figure 8.6) and Petsmart.com (Figure 8.7) deal with a vast array of products, but they are all specifically for pet care. While these sites employ many of the functions of a catalog site, they also need to address the specific needs of new-to-market visitors (e.g., those considering becoming pet owners) and in-market shoppers. In-market shoppers, those who already have intent to purchase, will further be sensitive to site differentiators between vendors as well as product options and resources that are designed to move them along the purchase funnel to conversion. For example, the availability of testimonials (Romano Bergstrom, 2013), enhanced product information displays (such as 3-D virtual views), and targeted offers can be used to increase engagement and dwell time on the product page as well as provide a more complete context for product usage and its benefits. In studies undertaken by such e-commerce sites like Peapod.com and Safeway.com, shopping lists; the presentation of product information and imagery; recommendations, such as “you may also like” shown in Figure 8.8, or “other people who bought this”; and enrichment resources such as recipes are often investigated as to visibility, efficacy, and acceptability.

Public Folders through OWA

This is the great deal-breaker for many companies. Despite being a good idea, public folders never really managed to do what they promised, and Microsoft is trying to get rid of them in the next couple of versions of Exchange. However, this is no excuse for taking it out of OWA in RTM! Whether they ran out of time to implement it, or they meant to take it out but bowed to public pressure, it's back into OWA and that's a welcome step.

You'll notice public folders are published via the /owa virtual directory rather than the old /public directory, so you don't need to modify your Exchange publishing rules in ISA Server. The redirection to the public folder store is cleverly written into the /owa directory rather than using a separate one.

S/MIME

Another feature present in previous versions but not in 2007 RTM was the ability to sign and encrypt messages in OWA. Not a major deal for most companies, but a deal-breaker for others, S/MIME is back into OWA. It also includes an update to the cryptology API and “Suite B,” an NSA-compliant suite of cryptology algorithms that über-techy security people might get excited about.

Monthly Calendar View

This speaks for itself. What would we do without our monthly calendar view?!

OWA Customization

Exchange 2007 RTM allowed the standard customization of OWA themes, allowing you to brand your own OWA to match your company's look. This is limited to modifying or replacing graphics files and cascading style sheets to modify the appearance, but the bones or OWA are still the same.

With SP1, the Front End Team within the Exchange Product group are giving us another two themes—Xbox and Zune—in a typically modest Microsoft way, so if you're so inclined you can make OWA look a little bit like your games console.

However, there are more interesting changes with SP1 in the form of proper customization of OWA. If you look in the ClientAccess\Owa\forms folder, you'll notice a new folder called “Customization.” In this folder are a couple of template files you can use to build your own customizations. Possible customizations are:

Custom OWA forms Just as in Outlook, you can customize forms and publish them to Outlook clients or public folders. OWA allows you to produce custom Web forms that are then stored in the ClientAccess\Owa\forms\Customization folder in the Exchange installation folder. Custom forms can be linked to content classes so they open automatically depending on the action taken. These forms must be registered in a Forms Registry (registry.xml) file, which is picked up automatically by Exchange 2007 SP1 (as long as it's within the \forms folder).

Application integration via navigation pane links The navigation pane is the one normally at the bottom-left that has the links to the OWA functions—Mail, Calendar, Contacts, etc. Additional links can be added in the UIExtensions.xml file to point to external URLs or other applications. Settings consist of a large icon, small icon, text, and external URL.

New drop-down menu customization It is now possible to customize the “New” launch button in OWA to add custom links to external applications or custom forms. Using the UIExtensions.xml file in the Customizations folder, you can register these within the New drop-down. These extensions consist of an icon, text, and the relevant custom class. The custom form you create for that custom class will open automatically when you select this menu link.

Icon mappings Also within the UIExtensions.xml file, you can map your own small icon to custom content classes. With this, you can use an icon of your choice for the custom content you use in OWA, rather than the standard envelope, calendar, contact, etc. icons.

Right-Click Move/Copy

You can now move/copy items in OWA using the right-click menu. Previously, although you could drag and drop items from folder to folder, there was no option to move or copy by right-clicking.

Figure 1.1 shows the difference in RTM and SP1.

Server-Side Rules

Rules are now accessible through the Rules section of the OWA settings page. Server-side rules can be modified via OWA; client-only rules are present as well (in gray) and can be deleted but not modified (Figure 1.2).

Bulk Mailbox Creation

It's not inconceivable that an administrator might want to mail-enable more than one mailbox at a time, yet trying to do this in EMC in Exchange 2007 RTM will frustrate you to no end. Using the console to create a mailbox, you are able to select a single mailbox as in Figure 1.3.

Again, it is possible through the shell, but this requires code that is not simple to write, and most Exchange admins are not great at command-line tasks. For example, to create mailboxes for all users within the “New Users” OU, you can use a command such as:

get-user –organizationalUnit “new users” | where-

object{$_.RecipientType –eq “User”} | Enable-Mailbox –Database

“EXCH07TEST\First Storage Group\Mailbox Database” | get-mailbox |

select name,windowsemailaddress,database

The output will be something like Figure 1.4.

However, SP1 enables you to do this, and create users and mailboxes at the same time, using the console. In SP1, you can select a list as shown in Figure 1.5.

Import/Export PST Files

RTM didn't include a utility to export and import mailbox data using Personal Folder (PST) files. There is an Export-Mailbox shell command, but it merely exports/imports in the same process and only between mailboxes in the same organization. We guess the main use for this command in RTM was to merge mailboxes, as otherwise it is almost identical to the Move-Mailbox command.

With Exchange 2007, the Exchange Product group decided to bring the ExMerge functionality within the same codebase as Exchange, as opposed to the separate utility it has always been. (ExMerge was actually produced by Microsoft Support way back in the days of Exchange 5.5 and taken on by the Product Team because it was such a useful tool.) With SP1, we still don't have the full functionality of ExMerge, but at least we can now import and export from/to PST files using the enhanced Export-Mailbox and new Import-Mailbox cmdlets.

To export and then import a mailbox using these cmdlets, you would use commands such as:

Export-Mailbox –Identity Fergus –PSTFolderPath “c:\MyMailbox.pst”

Import-Mailbox –Identity Fergus –PSTFolderPath “c:\MyMailbox.pst”

Easy! You can also specify filters based on date/time, subject and recipient keywords, etc. For more information, type Get-Help Export-Mailbox –Full in the EMS.

Public Folder Management

Public Folder Permissions Configuring PF permissions through Outlook has not changed and is usually the best way to set individual user/group permissions. We say that because despite the new Public Folder admin GUI, the only way to change permissions through the Exchange admin tools is using the command line. Great if you want to script a lot of things, but poor if you want to add a single permission for users.

To add public folder permissions for clients using the EMS, use the Add-PublicFolder' ClientPermissions cmdlet, or the AddUsersToFPRecursive.ps1 management script.

Public Folder Administrator Permissions A new administrator role in SP1 called “Public Folder Administrator” gives the user rights to control specifically public folders. This gives slightly more granular delegation of administrative rights within the organization.

Mail-enabled public folders included when reviewing address lists, e-mail address policies, and group memberships When previewing the recipients who are members of an address list, e-mail address policy, dynamic distribution group, and distribution group, you can now see the mail-enabled public folders that are included in the membership criteria.

Public Folder Management Console This is covered under Toolbox in the next section.

POP3/IMAP4 Management

POP3 and IMAP4 configuration options are now a part of the console. The new configuration pages are similar to those in Exchange Server 2003 and allow you to modify security settings, ports, and other standard POP3/IMAP4 settings without getting dirty and frustrated in the management shell.

More GUI Options

A few additional tabs here and there in the EMC help us GUI-junkies who were still in cots when VMS and early Unix were being developed…

Global Transport Settings There are many places in Exchange 2007 where you can configure options such as message size limits. Even with the GUI-rich Exchange 2003, we often experienced bounced messages because one of these options had been missed—usually the global settings. In Exchange 2007, these settings weren't obvious because of the lack of GUI accessibility—it's not easy to seek out all the available options via the shell.

Thankfully, SP1 provides access to the global transport settings via the GUI, accessible through Organization Configuration > Hub Transport > Global Settings (shown in Figure 1.6). The Transport Settings page accesses the options through the Get-TransportConfig and Set-TransportConfig cmdlets, which also includes Transport Dumpster and DSN message configuration.

Log Settings Message Tracking, Connectivity and Protocol logging options have been added to the console. These are under the Properties of a server in the Server Configuration or Hub Transport windows (Figure 1.7).

Message Size Limits on AD Site Links and Routing Group Connectors

Setting a maximum size for messages sent internally is useful when WAN links are not good enough to realistically support a lot of email flow. SP1 allows you to set message size limits on both AD IP Site Links, which are used for Exchange 2007 mail flow, and Routing Group Connectors, which are used for communication with Exchange 2000/2003 servers.

To set the maximum message size on a Site Link to 10MB, use the shell command:

Set-AdSiteLink -Identity [SITELINKNAME] -MaxMessageSize 10MB

MaxMessageSize corresponds to the new delivContLength AD attribute, which can be viewed using ADSIEdit.