Microsoft started pushing harder on resolving ongoing security problems following a January 2002 email that Gates sent employees encouraging them to focus more on privacy and reliability. But a year later, customers and analysts have given Microsoft mixed marks on its security push, known as Trustworthy Computing. At the conference this week, MVPs discussed the SQL Server Slammer worm that slowed Internet traffic the last week of January, as well as the overall problem of applying security patches. One of the primary concerns: Customers used software that, unbeknownst to them, ran a runtime version of SQL Server that could not easily be patched -- if at all. David Shaw, chief technologist for Simsbury, Connecticut-based Genesis ii Associates is a Windows Server MVP. His consultancy serves midsized businesses with 50,000 to 100,000 users. Some of his customers struggled to purge their systems of the Slammer worm. "It's very clearly difficult to manage patches," Shaw said. "Patch management is not an insignificant programming exercise. But that's no excuse not to get it right." Still, Shaw had many good things to say about Microsoft's security push, particularly the way Windows Server 2003 ships "locked down" to prevent accidental security breaches. Such an approach could temporarily break some customer software or cause other problems, but Shaw sees the approach as "the right direction for the company". "They're making the right decisions in the right way," he emphasised. "They have sacrificed the usability of their products for the sake of security, and that's something that has never really been done before at Microsoft. The mantra here has always been usability first." Shaw, who used to work on security issues in the military, gave Microsoft "a pretty solid 'B' in (security) improvements over the last year, understanding that I would give absolutely no one an 'A' over the last year. I'm a pretty harsh critic for obvious reasons. My background sort of drives me that way." Martin Tuip, Exchange Server MVP and technical consultant for Getronics in the Netherlands, shared many of Shaw's views. Tuip typically works with global companies with anywhere from 25,000 to 140,000 users. Microsoft has "made a significant push forward" in terms of security, he said. "But they're not there yet." At the same time, he said that many security problems "are just caused by human use. If you don't click on an attachment you're not supposed to open, you don't spread a virus. How do you protect against a user who bypasses all the security you just installed?" Response to big releases
One of the most important roles MVPs play is prepping customers for the release of major, new Microsoft products. "MVPs in an enterprise account bring knowledge to those businesses that help them with their technology," Microsoft's Moore said. MVP feedback also helps the software titan gauge how quickly enterprise customers will adopt new releases. "Boy, are we getting feedback," Moore said. "We're always hearing feedback about existing products and how we can migrate those to newer versions." Microsoft is closely listening to MVPs like Shaw and Tuip who specialise in products for which the company will release new software this year. Microsoft is set to release Windows Server 2003 in April, with Exchange Server 2003, code-named Titanium, launching as soon as midyear. Both products are important anchors to the company's .Net Web services strategy. Exchange could be an important revenue-generator for Microsoft, considering the large number of customers still running Exchange Server 5.5. Exchange Server 2000 is the more current version. Tuip said there "are still a large number of folks still on Exchange 5.5. In those communities, they're really getting excited about Titanium." But many of those customers face a potentially difficult transition. "If you're running 5.5, you're going to have to implement Active Directory (to make the move)," he said. "That's something you're going to have to think about." Microsoft introduced Active Directory -- software for managing network resources, computers and users -- with Windows 2000. But many businesses took a long time testing the software, which slowed adoption of Windows 2000 Server. "A significant number of our customers are interested in going directly to Titanium and (Windows) 2003 and Active Directory," Shaw said. As far as Windows Server 2003 is concerned, companies' delaying their Windows Server 2000 migrations means many businesses won't need to move to the newer version. But Microsoft is banking on Windows NT 4 Server customers quickly making the move to Windows Server 2003. Microsoft estimates about 15 percent of Windows Server users are on NT 4. "We're not really sure what the numbers are on NT 4 out there right now," Shaw said. "One of the significant drivers for upgrades we're hearing is the aging of Exchange 5.5 and the NT 4 security model. We're hearing more customers indicating that they're going to move to the new platform and Active Directory than we did with Windows 2000."
See the Windows News Section for the latest news, reviews and briefing papers on everything from Windows NT and 95 to service pack releases for XP.
Let the editors know what you think in the Mailroom.
