PEP CP303SECSP1S Version 2 , May 3/2006 IMPORTANT NOTE: --------------------------- This is version 2 of CP303SECSP1S. The reason for re-spinning this PEP is: - to fix Q01348874 - Low Disk Space on C:\ After CP303SECSP1S install - to fix Q01344486 - Cannot access CDROM after installing CP303SECSP1S 201i Since both problems only affect 201i platform, therefore there is no need for reinstalling this PEP on either 703t or 1002rp. But if you have not installed PEP CP303SECSP1S on your 703t or 1002rp, please install this version. DOs and DON'Ts regarding disk space saving: DO: - Delete any hotfix uninstall folders, e.g. C:\Windows\$NtUninstallKB837272$ - Delete the content but keep the folder of C:\WINDOWS\SoftwareDistribution\Download DON'T: - Don't move system pagefile to another partition. - Don't delete C:\WINDOWS\$hf_mig$ - Don't delete C:\WINDOWS\ServicePackFiles - Don't delete C:\WINDOWS\i386 - Don't compress the whole C drive - Don't compress the C:\Windows\system32 This package contains: 1. PEP Number: CP303SECSP1S --------------------------- 2. Problem Description: ----------------------- This package installs Service Pack 1 for Windows Server 2003 on a CallPilot 3.03 server. The PEP does not install any additional hotfixes or perform any other security hardening beyond what is included within SP1. This PEP is a prerequisite for CP303SEC003S and for all future CallPilot 3.03 Security PEPs. After SP1 has been installed and the system has rebooted, the most recent CallPilot 3.03 Security PEP should be installed (currently this is CP303SEC003S). The PEP is very large (362 MB) due to the size of Microsoft's SP1 update. Due to limited disk space on CallPilot servers, PEP CP303SECSP1S has been designed to install SP1 in a way that minimizes the disk space cost. In addition, due to security-related changes that Microsoft made with SP1, the PEP needs to change some DCOM security settings so that CallPilot features still work properly. SP1 must only be installed via this PEP on CallPilot 3.03 servers. Do not install Microsoft's SP1 package directly. Do not use Windows Update to install SP1. Installation can take up to 95 minutes depending on your platform and method of installation you have chosen. Less time is needed if anti-virus software is temporarily disabled during installation. Less time is needed if one of the following methods is chosen (ranking from the fastest to slowest): - unzip this PEP from CD (recommended, and at least 415M free disk space on D: is needed) - copy and unzip this PEP locally (at least 750M free disk space on D: is needed) - unzip this PEP from shared network drive (at least 415M free disk space on D: is need. Depending on the network traffic and speed of connection, it could be very slow.) This PEP may be installed remotely using pcAnywhere or Remote Desktop, however, due to the size of the PEP, downloading it over a dial-up modem is not recommended. This PEP may be reinstalled if necessary at a later time. 3. List of CRs that are fixed by this PEP: ------------------------------------------- A couple of CallPilot CRs are fixed by this PEP, as well as various Operating System security issues are fixed by Microsoft's changes. - Q01348874 - Low Disk Space on C:\ After CP303SECSP1S install - Q01344486 - Cannot access CDROM after installing CP303SECSP1S 201i 4. Pre-installation notes: -------------------------- a) Make sure you are installing this PEP on a CallPilot 3.03 server. b) Make sure the CallPilot server is fully booted before beginning PEP installation. Stop any other applications running on the local console, including all support tools and the CallPilot PEP Maintenance Utility (DMI Viewer). c) Disable any anti-virus software active on the server prior to installing this PEP. (This makes the PEP install faster.) As a precaution, it's recommended the CLAN cable be disconnected prior to disabling the anti-virus software. d) Remove any unneeded large files on the desktop and empty the recycle bin. e) Ensure there is a recent good full system backup available prior to installing this PEP. If the system has RAID disks, an alternative is to do a RAID split. 5. Installing the PEP: ---------------------- a) Begin installation by executing CP303SECSP1S.exe to extract the files to the D:\TEMP\CP303SECSP1S folder. b) Navigate to the D:\TEMP\CP303SECSP1S folder and run "RUNME.BAT" to launch the installer. Note that RUNME.BAT MUST be executed from this exact folder or the PEP install will fail. c) Click on OK to start the installation of the PEP. From this point the time required will be about 70 minutes, plus the time to reboot into service. Note: This PEP automatically installs Windows Server 2003 Service Pack 1. Do not close any windows or click on any buttons while the PEP is being installed or the PEP will not install successfully. Do not accidently Cancel the install. d) When the PEP installation is complete, a window will be displayed with the title "CallPilot OS Security PEP Installation Completed". Click on the OK button to reboot the server. AFTER REBOOT, YOU NEED TO LOGIN TO THE SERVER FOR THE DCOM PERMISSION CHANGE TO TAKE EFFECT. Note: Do not reboot the system until the PEP installation is finished, otherwise the PEP may not be properly registered on the server. e) After this PEP has been successfully installed and system has rebooted, it might take up to 10 minutes for Windows to come up and CallPilot to accept calls. Please be patient. Note: On the initial system reboot after this PEP has been successfully installed, occasionally, you might see a black screen that lasts 2 to 5 minutes before the Windows splash screen shows up. Do not worry. Windows is completing its installation and initialization. f) If anti-virus software was disabled, check to ensure it is now enabled. Note that it must be properly configured to scan "incoming" files only. See the bulletin "CallPilot Support for Anti-Virus Applications". g) After this PEP has been successfully installed and CallPilot runs & accepts calls, make sure you remove the CP303SECSP1S.exe (if you copied it locally) and the CP303SECSP1S folder from the D:\temp, empty the recycle bin afterwards because they consume a lot of disk space which might lead to future problems. 6. Installation Problem Resolution ---------------------------------- If the PEP install fails with a message indicating insufficient free disk space, you will have to try to free up some space and retry it. Here are some suggestions for freeing up disk space: - Do not bother deleting small files - Check whether Anti-Virus software has been installed on the C drive. If so, uninstall that software and reinstall in on the D drive according to the bulletin "CallPilot Support for Anti-Virus Applications". - Note that files on the desktop of any userid take up space on the C drive. (Look under C:\Documents And Settings\\Desktop, C:\Documents And Settings\\Local Settings\Temp, C:\Documents And Settings\\Local Settings\Temporary Internet Files, C:\Windows\Temp ) - Remove unneeded files and folders from under C:\TEMP and D:\TEMP. Do not remove the C:\TEMP or D:\TEMP folders themselves. If an error occurs while removing a particular file, ignore the error but try to remove as many other files and folders as you can from the temp folders. (Sometimes Windows programs hold a file open, preventing it from being deleted.) - Check for any unauthorized application software installed on the C drive. - Delete any hotfix uninstall folders, e.g. C:\Windows\$NtUninstallKB837272$ - A technique for locating large files is to use Explorer to Search for all files on the C drive. This lists all the files in the search results window. Then click on the "Size" heading to sort the files by file size. Look for files greater than 20 MB in size. If any of these files are unneeded, CAREFULLY delete them. Do not delete needed Operating System files. Do not delete any files that you are not absolutely sure about. 7. Installation Log ------------------- File "secpep.log" in the root folder of the system drive will contain a log of the actions performed during PEP installation. In addition, a note will be added to the file "os_ver.txt", also in the root folder of the system drive. 8. PEP Uninstall ---------------- This PEP cannot be uninstalled. Once applied, if removed from DMIViewer, only the reference to PEP CP303SECSP1S will actually be removed. 9. PEP ReInstallation --------------------- If required, this PEP may be installed again without any problem. This will reapply Windows Server 2003 Service Pack 1 and other configuration changes. If the PEP is not already in the PEP Utility (DMI Viewer), the PEP entry will be added when the PEP is reinstalled. If the PEP is already listed in the CallPilot PEP Utility (DMIViewer), it will not be added again to this utility. A popup window saying "Setup concludes that no actions needs to be taken" will be displayed. This just means that the PEP is already present in the list of installed PEPs so it will not be added again to this list. Click OK to dismiss the popup and complete the PEP install.