Windows Vista / Windows 2003 and WebDAV over HTTP (not S)

There's a good article about the problem to do a WebDAV connection without SSL on Vista / Win2003:

SharePint, WebDAV, and http (not https)

Here's the abstract:

1. Fire up regedit.exe (if UAC is enabled you'll have to approve it of course)
2. Navigate to the key HKEY_LOCAL_MACHINE\
   SYSTEM\CurrentControlSet\Services\WebClient\Parameters
3. Change the setting BasicAuthLevel from its current value (default 1) to 2 (0 means disabled, 1 is https only, 2 is both http and https)
4. Enter the following commands:
   1. net stop webclient
   2. net start webclient
   3. net use x: "http://yoursharepointprovider.tld/somesharename" /user:"whateverdomain\yourusername" /persistent:yes
   4. Enter your password when prompted

Update:

For Windows 2003 server the DWORD value you must add to the registry under the Parameters key above is UseBasicAuth and set its value to 1 and you'll also want to update the AcceptOfficeAndTahoeServers key from 0 to 1.  You cannot just net stop/start webclient; instead you must net stop mrxdav then net start webclient.  I found this out from KB841215.

A bit Off Topic: Virtual Tape Driver

Last week I was searching for a solution how to do "Cloud Backup" in a datacenter. This is not directly related to WebDAV, but what other reliable file protocol would anyone use when storing file based data on a remote storage solution - especially if the storage solution is something "in the cloud" like Amazon S3 or similar.

Well, the first question was about how to do a good Windows 2003 / Windows 2008 backup - eventually with Microsoft Data Protection Manager (Microsoft DPM) - when there is no tape infrastructure. All the Microsoft tools want to have some kind of tape. But tapes in datacenter clouds... not good.

Here's what I have found last week, I am now running a test pilot but it looks like a perfect solution: Virtual Tape Driver.

Firestreamer Virtual Tape Driver for Microsoft Data Protection Manager / Microsoft Backup

It supports not only all kind of physical media but also network shares, NAS and.... WebDAV.

Maybe some of you may have the same situation and this information could help.

EFS in Teams on Network Shares

Hi,

today I have found a great article about productive usage of EFS in teams. I mean everyone who have ever tried to use EFS in a multi-user environment may have seen the same unbelievable shortcomings: SMB EFS works with server based profiles with a bunch of issues as a result of this concept. And even with WebDAV there is still a major issue: multi-user server shares with EFS will not work because you can't inherit the EFS "ACL" and a new file will only be decryptable by the file owner. No comment.

Well, here's the link:
http://geisbauer.blogspot.com/2008/06/sharepoint-dateien-verschlsseln-teil-1.html
http://geisbauer.blogspot.com/2008/06/sharepoint-dateien-verschlsseln-teil-2.html

But sorry... it's in German. Maybe some of you folks can read it?

Joelle

WebDAV Redirector Registry Settings

In Windows Vista and Windows Server 2008 there is an updated WebDAV redirector which has several settings available through registry.

Rober McMurray has documented all currently available settings in his blog, it's a great resource and I have to copy it especially for my own memory.

The base registry hive is:
HKLM\SYSTEM\CurrentControlSet\Services\WebClient\Parameters

The know settings are:

Value & Description	Type	Values	Default
AcceptOfficeAndTahoeServers Specifies whether the WebClient service can connect to web sites that are running SharePoint or Office Web Server.	DWORD	0 = False 1 = True	1
BasicAuthLevel Specifies whether the WebClient service can use basic authentication to talk to a server. Note: Using basic authentication can cause serious security issues as the username/password are transmitted in clear text, therefore the use of basic authentication over WebDAV is disabled by default unless the connection is using SSL. That being said, this registry key can override the default basic authentication behavior, but it is still strongly discouraged.	DWORD	0 = Basic authentication is disabled 1 = Basic authentication is enabled for SSL web sites only 2 = Basic authentication is enabled for SSL and non-SSL web sites	1
FileAttributesLimitInBytes Specifies the maximum size that is allowed by the WebClient service for all properties on a specific collection.	DWORD	Size of attributes in bytes	1,000,000 decimal (1 MB)
FileSizeLimitInBytes Specifies the maximum size in bytes that the WebClient service allows for file transfers.	DWORD	File size in bytes	50,000,000 decimal (50 MB)
InternetServerTimeoutInSec Specifies the connection timeout for the WebClient service uses when communicating with non-local WebDAV servers.	DWORD	Time in seconds	30 decimal
LocalServerTimeoutInSec Specifies the connection timeout for the WebClient service uses when communicating with a local WebDAV server.	DWORD	Time in seconds	15 decimal
SendReceiveTimeoutInSec Specifies the timeout in seconds that WebDAV the WebClient service uses after issuing a request, such as “GET /file.ext” or “PUT /file.ext”.	DWORD	Time in seconds	60 decimal
ServerNotFoundCacheLifeTimeInSec Specifies the period of time that a server is cached as non-WebDAV by the WebClient service. Note: The WebClient service maintains a list of non-WebDAV servers that have been contacted. If the server is found in this list, a fail is returned immediately without attempting to contact the server.	DWORD	Time in seconds	60 decimal
SupportLocking Specifies whether the WebClient service supports locking.	DWORD	0 = False 1 = True	1

Note: After changing any of these settings you will need to restart the WebClient service.

Source: Robert McMurray's Blog

Great Microsoft EFS articles and tools

Microsoft EFS (Encrypted File System) can be used in combination with SMB and WebDAV. With SMB on network shares it makes not much sense (see my other notes) because of the strange implementation of using server side profiles and keys. But on local disks or with WebDAV on network filestores it's a great security enhancement out-of-the-box.

But there are a lot of issues and caveats you have to know when you want to deploy EFS in an enterprise infrastructure. Today I found the "ParanoidMike" blog which is a great resource for some of EFS related question:

EFS Certificate Updater
EFS and SYSKEY backgrounder
Why EFS makes no sense on servers

Source: ParanoidMike

Mounting WebDAV Servers (RFC 4709)

Found this RFC today. Well, it's an October 2006 document, I am sorry if this is old news for you :-).

RFC 4709

It's Julian Rescke (greenbytes) again and he does a good job in not only describing an WebDAV announcement technology already used by SAP and others but also included some Windows client script to make the transparent mounting work in any native Windows environment.

Worth looking into because if you plan an infrastructure where WebDAV is used instead of file servers it is a real need to think about a link notation which does not result in the well known "browser view" of WebDAV shares but instead opens an explorer view of the data. Julian's document describes such a way.

On the other hand at least in Windows Vista it is possible to use a file share URL to connect to WebDAV:

\\server.domain@SSL\DavWWWRoot

I will try to collect some more pros and cons about the different ways to mount a WebDAV share - happy about your comments.

Windows Server 2008, the storage story

On the Windows Server Division Weblog, Claude Lorenson is writing about "the future of SMB". He delivers some very interesting details about Windows Server 2008 (Longhorn) and the new features of SMB 2.0. It's obvious that Microsoft invests in SMB, especially to make it usable for the loosely coupled branch offfice scenarios:

SMB 2.0 greatly improves the scalability of SMB 1.0; there is now more open files on a server supported as well as a higher number of shares supported. The protocols have been enhanced to reduce the “chattiness” that makes file sharing on a WAN sometimes painful. With SMB 2.0, customer data has shown the ability to download a 300MB file 35 times faster than with SMB 1.0 using a 100 Mbps link (from 24 minutes to 41 seconds). SMB2.0 will also support transactions, symbolic links and client side encryption. All these features are fully functional when Vista clients are used in combination with Windows Server 2008.

But there is also an important side note which may change a lot when planning next generation storage infrastructures:

The following sentence: "SMB2.0 will also support transactions, symbolic links and client side encryption" is not correct. Transaction support and client side encryption will not be available in Windows Server 2008 and therefore are not in the beta 3 release either.]

Wow... still no SMB encryption. I remember Microsoft is promising this feature since the late 90's. It looks like WebDAV will continue to be the only native file access protocol in Windows Clients which support communication encryption.

See the full story here:
Windows Server 2008, the storage story