My Notes to Myself and Others... : windows

BitLocker To Go Reader

Erik Rozman — Fri, 30 Oct 2009 21:23:42 GMT

BitLocker protection on removable drives is known as BitLocker To Go. When a BitLocker-protected
removable drive is unlocked on a computer running Windows 7, the drive is automatically recognized
and the user is either prompted for credentials to unlock the drive or the drive is unlocked automatically
if configured to do so. Computers running Windows XP or Windows Vista do not automatically recognize
that the removable drive is BitLocker-protected. With the BitLocker To Go Reader users can unlock the
BitLocker-protected drives by using a password or a recovery password (also known as a recovery key)
and gain read-only access to their data.

Download it here.

Snipping tool trick

Erik Rozman — Fri, 23 Oct 2009 22:30:18 GMT

I really love the Snipping Tool. It enables me to take screenshots without having
to install third-party software quite efficiently. I did encounter one very annoying
issue though when trying to capture context menus or the Start menu- while launching
the snipping tool these menus disappeared… :(

It seems that there is a solution for this issue. To capture a context menu, open the
Snipping Tool, open the menu you would like to capture and then press Ctrl+PrtScn.

The screen should fade and the familiar interface of the snipping tool should appear.

Note that once a screen is captured this will not work again, you will have to reopen the
snipping tool.

Vista Gets Stuck During File Copy

Erik Rozman — Sat, 24 Jan 2009 11:08:23 GMT

Ok, so this isn’t a new topic. It’s been around for quite a while but I have never
encountered it, so now that I have- it’s time for a post about it.

I have installed a new PC (Windows Vista 64bit) and connected it to my home
network using a wireless NIC (Realtek RTL8168B/8111b). The wireless router I
use is an Edimax BR-6215SRg. The same network has several other PCs connected
to it wirelessly and one PC that is wired.

When copying files to/from the new PC (HTPC) it seemed to simply freeze up. Even
though I could move the mouse pointer I couldn’t really do anything else…Now keep in
mind that this is a new PC (and it’s fully patched:SP1 and everything). Since this
is a new PC I started worrying that I have a hardware issue, yet after some research
on the Internet I found others that had similar problems due to the TCP receive window
auto-tuning issue in the new TCP/IP stack.

The advice was to simply turn off the auto-tuning feature by running the following
command:

netsh interface tcp set global autotuninglevel=disabled

I decided to give it a try, and not surprisingly it worked. Personally, I find it very odd that
due to a networking your whole OS freezes up. When dwelling deeper into the issue
it seems that the new TCP/IP stack tries to manage data flow in a more efficient way by constantly
tuning the receive window set by TCP. This window allows the receiver to define the amount
of data it will receive before the sender has to stop data if it hasn’t received acknowledgments.

In older versions of Windows, the window size was set once (not tuning) which causes data flow
to be less efficient. Once I disabled the feature, I could see that my copying speed has dropped from
4.5 to 3.7. On the other hand it no longer froze my system…

I am not sure who is at blame here, my gateway, the NICs driver or the favorite target of the last few
years:Vista…

Service Pack 2 season

Erik Rozman — Sat, 25 Oct 2008 11:28:58 GMT

Service Pack 2 beta(for TAP clients) has been announced for both Windows Vista and
Windows 2008:

http://blogs.technet.com/windowsserver/archive/2008/10/24/windows-server-2008-service-pack-2-beta.aspx

http://windowsvistablog.com/blogs/windowsvista/archive/2008/10/24/windows-vista-service-pack-2-beta.aspx

Let the Panic begin?! (or maybe not…) [MS08-067]

Erik Rozman — Fri, 24 Oct 2008 09:04:25 GMT

Yesterday, Microsoft has released an out of band patch (in other words, not through
the standard cycle of releases,which means it’s really important and there is no time
to wait for the next cycle) for all Windows version. Such a release, obviously causes
concerns (as does everything that is not routine).

The patch is intended for all Windows versions, and it is supposed to plug a hole in
the Server service (specifically RPC) that might allow an attacker to run arbitrary code
under the system account (it also seems that the vulnerability is wormable).
Enter PANIC!!! (or maybe not)

First reason to lower the panic levels is that when stating that an attacker can do something we have to ask ourselves
whether the attacker is an anonymous attacker or an authenticated one (he difference
is obvious and major). In this case, older Windows version (2000, XP, 2003) are
vulnerable to an anonymous attack (thus the patch is critical).
Windows 2008 and Vista are only affected if the attacker is authenticated.

Second, security is a layered art. The vulnerability can only affect systems that do not
have firewalls that protect them. This statement sounds like a double edged sword:
on one hand you will obviously not have a firewall block the ports on a system that is
acting as a server(simply sharing a folder/printer),on the other hand how many personal computers that do not have
some type of firewall protection do you think are on the Internet today (a lot, but a lot
less since the days of Blaster).

Third reason to lower the panic levels is the fact that you are reading this. If your level
of awareness is high enough to pursue information on the subject it means that you
are security conscious and that you are protecting your computers and will apply
the patch. Security conscience has significantly grown which means that systems may
be hit, yet the damage (effect) will be significantly lower.

If you managed to bear with me, it’s time to go and patch:
http://www.microsoft.com/technet/security/bulletin/ms08-067.mspx

http://www.kb.cert.org/vuls/id/827267

Windows Vista SP1 available (since Tuesday)

Erik Rozman — Fri, 21 Mar 2008 08:24:25 GMT

Yes I know,a bit late and no I don't want to get a haircut(you know who you are).

So after these cryptic messages do I have something new to tell you about this release?
Not really,except that finally all those holding out until SP1 can finally install Vista and
that SP1 comes packed with a few new cool features (e.g. the ability to apply Bitlocker
encryption to all volumes including flash based ones...).

In addition to that you may also want take a look at the list of incompatible drivers that
may block the SP from being installed:
http://support.microsoft.com/?kbid=948343

So if you have the time and you finally want to become SP1ed take the plunge!!

Windows Command Line

Erik Rozman — Fri, 14 Mar 2008 11:13:19 GMT

The Windows command line interface is a powerful tool. Most people might shrug away
from it since they feel that it is not flexible enough...to those people I dedicate this post.

Microsoft has a released a command line reference that can be found here.

Administrative Mode Terminal issues...

Erik Rozman — Fri, 15 Feb 2008 08:34:11 GMT

This was an annoying one. In Windows 2003 you have the Administrative Mode terminal that
allows you to have two standard connection and one "console" connection using RDP (a total of
three (3) concurrent connections).
Well, that is true if the server has not decided to misbehave.

In my case it did. After having two connections to the server (in any combination,console and standard)
the server would not allow a third. Not only would it not allow a third connection but the client also
provided the oddest error message:

Once one of the two connected would disconnect all of sudden the server was found again...

So,at this stage I ruled out any concurrent violations,since if it would be a concurrence limitation
I would have expected the following error message:

At first, I thought that this might be a networking/security issue of limited RDP connections to this specific
server (no more then 2)...

After some continued digging,researching and registry comparing(with a well behaved server) I noticed a difference
between the two:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\MaxInstanceCount was set
to "2" instead of "ffffffff"

Once I changed the key I had no problem to connect...and thus the mystery of only two administrative connections
(instead of three) was solved...

[Now comes the question of how or why was this value changed. The server was a clean installation with SP2 on it.]

Windows Automated Installation Kit 1.1

Erik Rozman — Fri, 08 Feb 2008 16:38:19 GMT

With support for Vista's SP1 and Windows 2008.

New features in the Windows AIK

Supports Windows Vista Service Pack 1 and Windows Server 2008
Supports for Windows Server 2008 ServerManagerCmd.exe. Documents how to build answer files for the Server Manager CLI used to install and to remove Windows Server 2008 roles, role services, and features.
Support for Windows Server 2008 ICT (Initial Configuration Tasks). Documents schema definitions how to add tasks, links, and branding material to the out-of-box experience.
Supports Windows Setup cross-platform deployment. You can install 64-bit version of Windows from a 32-bit preinstallation environment WinPE.
Contains Windows PE 2.1.
- Boot from Hard Disk. Support for booting directly from the hard disk, not into RAM Disk.
- Oscdimg tool. Updated features including support for larger images.
- Writable RAM drive. When booting from read-only media, Windows PE automatically creates a writable RAM disk (drive X) and allocates 32 megabytes (MB) of the RAM disk for general-purpose storage. You can customize the size up to 512 MB using PEImg /scratchspace.
Contains several new tools (%programFiles%\Windows AIK\Tools\<platform>)
- Driver Package Installer (DPInst). Add non-boot critical drivers during Windows Setup using the Driver Package Installer (DPInst)
- Boot critical driver projection tool (PostReflect.exe).
- Windows Vista SP1 Files Removal Tool (VSP1Cln.exe). Remove archived Vista RTM files and reclaim disk space after Windows Vista SP1 is applied.
- Windows Deployment Services Multicast (WDSmcast.exe). WDSmcast.exe is used by computers to join multicast transmissions offered by a Windows Server 2008 based WDS (Windows Deployment Server). More about this in an upcoming blogpost...
Contains Windows Vista Deployment Error Diagnostic Guide. Describes how to diagnose error logs related to deploying Windows Vista, specifically how to interpret errors related to Windows Setup (Setup.exe) and Package Manager (Pkgmgr.exe).

Download it here.

Vista SP1 deployment rants...

Erik Rozman — Fri, 08 Feb 2008 08:54:11 GMT

So since SP1 is finally final, I started playing around with it. One of the most important
features for me was the ability to deploy it. So,wanting to hear it from the horses mouth,
I downloaded the Windows Vista SP1 Guides for IT Professionals.

After going over it I found a few points that surprised me:

No option to slipstream. Integrating the SP into the OS is not possible although
a version that will have SP1 integrated will be made available (?!?).
The SP can not be applied to an offline copy of Windows. This is kind of obvious
if you read the previous point but still,considering that many people use images (WIM)
to deploy desktops having to install it online and then recapturing the image seems
to be somewhat questionable in the light of the automation features (such as offline
driver integration) that WIM images provide...
Still in the image department, if you create an image (or apply the SP to an existing image,
which is more or less the same) you have to run the Boot critical driver tool (PostReflect.exe).
To be honest, I don't (yet) understand the exact reason as for why you have to run this tool
except the reason provided in the document:

"This is necessary because SP1 contains boot-critical drivers for the hardware abstraction layer (HAL) and matching changes to the kernel. If the updated versions of boot-critical drivers for the HAL and the kernel are not correctly installed on the computer that you are deploying SP1 to, the operating system will not boot on that computer or on any computer that has a different CPU or hardware configuration."

Now that is even more surprising since Vista is considered as an OS that is hardware independent...

On the brighter side of things, an additional tool that can be found either in the new version of the AIK or
%windir%\system32 called Vsp1cln.exe will allow you to clean up all the files that SP1 backs up during the
installation (approximately 800MB).

This tool can be used either online or offline but once it is used you can no longer uninstall SP1 (which is also
kind of obvious, so make your choice wisely).

Mandatory Integrity Control (What,how and why do we care?)

Erik Rozman — Sat, 19 Jan 2008 15:10:03 GMT

The theory

Mandatory Integrity Control (MIC) is an additional layer of security built into Vista and
Windows 2008. This particular layer helps Windows protect itself from harmful intentional and unintentional
changes to important objects. Among the objects protected we can find files, directories, registry
key, printers, and actually any object that has a security descriptor.

The beauty of MIC is that it has been there in the background all along protecting you, yet you never knew
it existed. You might have actually encountered it by trying to change a file that is protected by it, and even
though you had the permission you couldn't...

The MIC layer is a barrier placed before your permissions are checked. Essentially this new road block checks
your privilege level against the object that you are trying to change. If your privilege level is equal or higher you are
allowed to make the change. On the other hand if your privilege is lower you cannot change the object even
though you may have the permission to.

Vista defines four integrity levels in order of precedence from low to high (the Untrusted and Trusted Installer are out
of scope here):

Low - Used by Internet Explorer 7 to enforce Protected Mode:
Medium - Used for standard users (assumed if no other level is set):
High - Used for administrative actions (CMD with Run as administrator):
System - Used by the system

Note that what happens is that each privilege level is represented by a different group SID.

Privilege levels are inherited, meaning that the privilege level of the creator is inherited by the object
that is created. If a user opens Notepad the users privilege level is attached to the process and the
file created by the process and so on...

A quick example

Ok, lets try something practical.
In the following example I will create a new file using an elevated CMD.exe ,view the integrity level by using ICACLS and then
I will try to delete the same file using a standard CMD.EXE...lets see what happens:

Note that CMD was started as an administrator and the file has been created with a privilege level of high (last line
of ICACLS output. The users privilege level is also high (see the WOAMI output and he belong to the Administrators
group).

Note that the second instance of CMD is not run as and administrator. The file is still there, still with a high level of privilege,
the user has permissions (ICACLS and WHOAMI output) yet he can not delete the file.
The reason is that the current privilege of the user is medium (note the output of WHOAMI).

Now to top it off-something odd(or actually normal,depends on how you look at it...). If you attempt to delete the file
from an Explorer window you will receive the following message:

Once acknowledged (by pressing Continue) the file will be deleted-what happened here?

Well by choosing to continue you elevated the Explorer processes level to High- thus you can delete the file...

Conclusion

Based on the above example you can see that MIC is an additional layer of security implanted into Vista. Vista
assigns the level of integrity a specific object belongs too, it's not configurable and the only way that a user
can elevate his own level of integrity is by interacting with the system an explicitly acknowledging an action(such as
the deletion of the file in our example). A very important point to understand about MIC is that it protects files
from being tampered with,not their privacy. In other words only ACLS will protect the file from being read.

Now I really love to contradict myself (at least I do it in different paragraphs...),there is a way to manipulate
files and even protect it's contents by using MIC but it's not a way I would recommend. On the other hand it's
still good to know and as Mark Minasi mentions what happens if a malware actually creates a file with the privilege
level of System -no one will be able to delete it?!?

Mark has created a tool called CHML.EXE that is a bit more versatile then ICACLS and it allows you to set privilege
levels.
For additional information on CHML look at:
http://www.minasi.com/vista/chml.htm

The Compare campaign

Erik Rozman — Sat, 19 Jan 2008 09:19:19 GMT

Microsoft has built an area in it's Windows Server website called Compare. Basically this area
will provide content that compares Windows Server to other environments. There several
interesting screencasts and Webcasts there,take a look:

http://www.microsoft.com/windowsserver/compare/windows-server-comparison-screencasts-and-webcasts.mspx

http://www.microsoft.com/windowsserver/compare/default.mspx

Timing operations

Erik Rozman — Sat, 19 Jan 2008 09:10:27 GMT

If you need to know the time that elapsed between two operations you can use the
the following tool from Microsoft(windows 2000 resource kit):

http://www.microsoft.com/downloads/details.aspx?familyid=913795CD-7026-4143-AE85-1F5E096F9BE0&displaylang=en

-----------------------------------
TIMETHIS : Command Timing Utility
-----------------------------------

Usage : TIMETHIS "command"

TimeThis executes the command specified by its arguments, then reports its
run time in HH:MM:SS.TTT format. Quotes around the command are required only
when the command involves redirection via <, >, >>, or |, etc. Quotes ensure
that the redirection is applied to the command being timed, rather than the
TimeThis command itself.

An Interview with Mark Russinovich (Channel 9)

Erik Rozman — Fri, 21 Dec 2007 09:29:07 GMT

I heard Mark Russinovich speak at Tech-Ed Europe in Barcelona (2003) and I found
it to be a great experience, now that he is a part of Microsoft what he has to say
has additional weight since he is a part of the team that works on the Windows kernel
and additional goodies...

I highly recommend taking the 40 minutes and watching the interview with Mark at:

http://channel9.msdn.com/showpost.aspx?postid=365911

System information at the command line

Erik Rozman — Thu, 20 Dec 2007 23:36:26 GMT

Ever wanted to get information about your system at the command line?
You could try using the 'systeminfo' command that provides a lot of technical information
about the local system, or remote systems.

Among the information provided you can find:

Hardware information
OS information
Hotfix information

Changing your logon screen (Windows Vista)

Erik Rozman — Fri, 30 Nov 2007 09:21:39 GMT

Since I can remember myself I love customizing stuff. I love changing thins so
they reflect some individuality. Logon screen and desktops are obviously my
favorites when it comes to computers.

I never had the time to check how the logon screen in Vista can be changed but
by chance I bumped into this neat(free) tool(Logon Studio) from Stardock that
allows you to change the logon screen with your own pictures.

So the next question is where do you get those cool pictures from...well, I get them
from two websites that have very high quality(almost any resolution) pictures:
http://www.gamewallpapers.com
http://www.cgwallpapers.com

The websites are not free yet IMHO the price is worth it.

Outlook Sidebar Gadgets for Outlook

Erik Rozman — Fri, 30 Nov 2007 09:08:01 GMT

When the Vista sidebar was released, I was a bit skeptical. It reminded me of
the old Office toolbar(ok,but not a big hit-at least not with me). Lately I have started
to view it in a different light-you can actually have quite a useful gadget attached to it,you
can build a gadget that will provide directory information for your companies employee
or direct access to your IT staff.

In addition to that two new gadgets were published on the Outlook teams blog: appointments
and tasks. Take a look at the post.

Remote Server Administration Tools (RSAT) Beta is now available

Erik Rozman — Fri, 30 Nov 2007 08:29:46 GMT

Basically provides you with remote management tools for Windows 2008.

http://connect.microsoft.com/windows/Downloads/DownloadDetails.aspx?DownloadID=9561

Also,check out the post on the Windows Server Division Blog.

Converting EVT files to EVTX

Erik Rozman — Sat, 13 Oct 2007 09:22:10 GMT

I stumbled upon a good post on the Ask the Performance Team blog that explains how
to convert EVT files(old event log files) to EVTX (the format used in Vista).

The post provides several methods to undertake the task.

Technorati Tags: Microsoft, Windows 2008, Vista

Pre-SP1 Vista Patches

Erik Rozman — Thu, 04 Oct 2007 18:14:22 GMT

KB941229 (x86) (x64): This update addresses issues with Media Center for Microsoft Vista.

KB941651 (x86) (x64): This is a reliability update. Install this update to improve the reliability
of Windows Media Player 11 for Windows Vista in certain scenarios.

KB941600 (x86) (x64): This update resolves some reliability issues in the USB core components
on the Windows Vista operating system.

KB941649 (x86) (x64): This update resolves some compatibility and reliability issues in Windows
Vista. By applying this update, you can achieve better reliability and hardware compatibility in various scenarios.

Technorati Tags: Microsoft, Windows, Vista