Can a 32-bit server handle 64-bit drivers

Short answer, yes. The server uses it’s own 32-bit driver as a interpreter between the spooler and the printer but it can serve clients with the drivers they need. The server really doesn’t care if the drivers it serves to clients are 32 or 64 bit. It can store all of them on the filesystem.

How do I install the drivers?

I’ve been using Windows 7 RSAT(Remote Server Administration tools) to add the drivers to our print server. The important step is to upgrade your current 32-bit drivers. If the driver versions of the 32 and 64 bit differ the server wont recognize them as the same driver. So if you’re using old drivers on your server I’m sorry to say you’ll have to start by upgrading the 32-bit ones first. I suggest you download both the 32-bit and the 64-bit version of the driver when you’re out driver hunting. First upgrade the 32-bit drivers you want to add 64-bit drivers for. I did this directly on the print server and I removed any old versions of the driver. Next add the 64-bit driver. Adding drivers from RSAT is really simple so I won’t go trough it in any detail. Just open Print Manager

Right click drivers and select add driver, add your 64-bit driver. As you can see in the image booth Toshiba drivers have the same version number, the difference is only the Environment.

Group policy edits for Windows 7

Next we’re going to create a group policy to allow restricted users to install their drivers, and we don’t want UAC to disturb or scare them. Side note: if you’re thinking of disabling UAC take a look at a previous article here http://www.nixadmins.net/2009/12/04/why-uac-is-the-best-thing-that-ever-happened-to-windows/ .

Open your Group policy management console and create a new / or add these settings to an old policy. You’ll find the setting under Computer Configuration \ Policies \ Administrative templates \ Printers \ Point and Print Restrictions.

Set the policy to Enabled and set the Security prompts Do not show warning or elevation prompt.

Push the group policy setting to your clients, point to your printer and you’ll be able to install it as a normal user.

Using any operating system with administrative privileges is a bad idea. It doesn’t matter if your running OS X, Windows, Linux or something else. If you’re running your day to day tasks as an administrator(root) you’re not thinking straight. You should be using as little privileges as possible to get the job done, and here UAC does a beautiful job stepping in as a bridge into administrator land.

I run my Windows 7 as a ordinary user and have two separate administrator account for any admin work I need done. I haven’t had any problems running as a user since I started using Windows 7(never really used Vista that much). I can work efficiently as a user and elevate my privileges at any time if I need to.

UAC isn’t really there for the ordinary user it’s there to protect you as an administrator so you won’t make mistakes you might regret later. It makes you think about what you are doing, even if you are running as an administrator, touch something that’s crucial for the OS it will hit you with an prompt to remind you that this could have consequences. Find it annoying? Don’t. Use it, bend it to your will.

Using UAC to elevate privileges.

A typical situation is you start an installer and it asks you for the name and password for an administrative account. This worked long before Vista or Windows 7. But the great part with Windows 7 is that you can ask for elevated privileges REALLY easily.

Let’s take Active directory Users and Computers as an example. You can run it and browse your organizational units and you can se users without administrative privileges. If you need to open an account or reset a password you will have to elevate your privileges OR you can delegate the tasks to your restricted user or maybe even a co-worker who normally doesn’t work in IT(by creating custom MMC:s).

Anyway to elevate just hit the Windows Logo button, type Active Directory move to Active directory users and computers AND hit SHIFT+CTRL+ENTER. Instead of the program starting with your user privileges Windows tries to elevate and sees that your access token doesn’t have the required rights for this. So it shows you the prompt. Easy as 1,2,3.

This is something most corporate administrators are used to BUT I would like to see home users adapt to this workflow as well. In the example I used the builtin Windows search, but you can start up any program like this. Now that you have read how easy this is, PLEASE create an administrative user to use and remove administrative privileges from your normal account. I promise it will feel natural in a few days and you’ll be a lot safer using your computer.

Configure Active Directory account

First we need to make sure the user will be able to connect to the SSTP VPN gateway. I have a test user called Sally Sales, and yes she works in the Sales department. So I use ADUC (Active Directory Users and Computers) to modify her account. She needs to have permissions to use Dial In even if she really isn’t dialing in.

So select the users properties and on the Dial In tab change Network Access Permission from Control access trough NPS Network Policy to Allow Access. We can’t use NPS Network policies since we don’t have an Network Access Protection server, for the moment anyway. Once your done just click ok. Sally Sales is now minutes away from connecting with VPN.

Configure Vista SSTP VPN client

Next we need to take care of Sally’s laptop. Normally she could fix this herself since the vpngw.nixadmins.net is already on a public network. But in our test lab we are using the HOST file to point her the right way.

Open the command prompt on your Vista workstation using Administrative privileges. In the prompt enter

notepad.exe C:\Windows\System32\Drivers\etc\hosts

Because we don’t have a DNS on our “public” network we have to use the host file. So at the end of the file add a line 10.0.0.1 vpngw.nixadmins.net (in my case, yours might differ).

Save the file.

Create the new VPN Network connection

Now we need ( using Sally’s credentials ) to create the new network connection.  So right click on the network icon in the system tray and select Connect to a network.

Select Setup a connection or network. Select Connect to a workplace.

Click next and select Use my Internet connection (VPN).  Because this is a virtual machine with a local only network the system asks us if we want to set up a Internet connection. We already have one so we choose I’ll set up an Internet connection later.

Next are the settings for the VPN gateway. So the internet address should be your public name of the server, in my case vpngw.nixadmins.net and let’s give Destination name an clear name saying Corporate VPN connection.

We aren’t using a smartcard and for now we don’t want to share this connection either. So just click next. I also won’t type the username and password here. I’ll rather provide them at login. That’s it. The connection is now ready to use.

But at the moment it will use PPTP and we want to use SSTP. So let’s continue. Go to your network connections and select properties on the Corporate VPN Connection. Select the tab Networking and change the Type of VPN to Secure Socket Tunneling Protocoll (SSTP).

Testing the SSTP VPN connection

Now we can test our new SSTP connection. So in the system tray right click on your network icon and select connect to a network. Select the Corporate VPN Connection and supply your user credentials. ssales in my case.

Then just click connect and wait a moment for the tunnel to connect.

That’s it. Your client is now connected to your corporate headquarters.  As I have shown you in these two short articles. Supplying your users with a secure offsite connection to the corporate network isn’t a great deal of work. Anyway, these are just the basics. So I encourage you to study more about securing Windows Server and take a look at Microsoft’s documentation on the Routing and Remote Access documentation. This is a server connected on the public Internet so caution is always a good thing.

Some extra reading can be found here

• Windows Server 2003 Routing and Remote Access
• New in Windows Server 2008 Routing and Remote Access
• Securing Windows Server 2008
• Routing and remote access blog on how SSTP based VPN works

That’s it for this time. Hope to see you soon when we take a look at Windows Server 2008’s capabilities in providing Network Access Protection (NAP). But that’s a story for another day.

Feel free to comment and provide me with feedback if you find this two part guide useful.

“ASDM is unable to continue loading. Click OK to exit from ASDM.
Unconnected sockets not implemented.”

ADSM was however launching on my Windows 7 64-bit laptop so I started looking for any other difference than the OS. ADSM is a Java application so starting there was only reasonable. I ran Java JRE 1.6 update 13 in the Vista machine and 1.6 update 7 in the Windows 7 laptop.

Downgrading the Java JRE to 1.6 update 7 solved the issue and ADSM is now launching without any problems. So if you’re having trouble getting the Cisco ADSM to launch, check and possibly downgrade your Java Runtime Environment.

This is not the way a site should look from one of the largest laptop manufacturers. And believe me this is not the first time. It probably won’t be the last either.

So I get annoyed but think what the heck, I’ll find the drivers to the Ericsson module somewhere else. Well dream on. I can’t find any drivers for this god forsaken thing.

Access connections tell me nicely that the system contains incompatible drivers and I need to get the latest drivers and install them on my system. WELL I WOULD GOD DAMMIT! If I could get them somewhere.

So now I think I can get something from Thinkvantage System Update, but no. There are no updates available for this machine.

If you are reading this and you are considering a Lenovo ThinkPad X200, think twice. I can’t say the laptop itself, it’s a nice piece of machinery but Lenovo has THE worst website I ever had to use. Of the 50+ times I’ve had to visit them the error rate has been well over 60% and that’s just not acceptable these days.

I even remember when I was trying to decide on my next laptop and doing research I couldn’t get specifications on the X200 from their site(to make it even more ridiculous it doesn’t work today either). I guess that should have sounded a few warning bells.

I used to be mad at HP:s download site because the download speed was really low but at least their site works.  If you’ve read this then I thank you and you are really welcome to comment to ease my pain. And if you have found a solution for the Ericsson module then PLEASE let me know.

http://technet.microsoft.com/en-us/windows/cc952917.aspx?ITPID=fr2189s

I actually got a few aha’s and a few doh’s from watching that video.