Martin Zugec blog : Deployment

SystemSherlock - snapshot using GUI or CMD

martin — Sat, 17 May 2008 21:32:00 GMT

Recently I wrote about SystemSherlock Lite - really nice snapshoting tool that supports command line... I also posted small utility for parsing log files.

After that I started to heavily use SystemSherlock - and I must say that it is really really great utility. Problem is that usually you want to have command line AND GUI interface - and SystemSherlock is cmd only :(

So I decided to create wrapper around it - and for me combination of GUI and SystemSherlock is much better snapshoting tool than RegShot or InstallRite...

SystemSherlock GUI consists of 3 different tabs - one for creating snapshots, second for comparing snapshots and third for displaying log files in friendly structure.

Create snapshot

Below is GUI used for taking snapshots:

It allows you to create snapshot configuration, specify output file and also to include exclusion list if you want to ignore particular entries. This is configured snapshot for detecting HKCU and C:\Temp folder:

I tried to implement quite logical interface, so there are feature like auto-suggest or auto-repair of entries (for example HKLM is automatically translated HKEY_LOCAL_MACHINE)... Another feature is that entry type is automatically detected (you can see it in video - I don't select whether entry is registry or filesystem, it is automatically filled):

Update: Embedded video from Jing doesn't work :( So click on following link instead).

Once you specified what you want to monitor, just click on create button - dump is automatically created. Then do whatever you want - and just click on Create button again. One of SystemSherlock advantages is that it allows you to create as many dumps as you want - you can even compare current dump with one created months ago...

When finished, move to Compare snapshots tab.

Compare snapshots

Below is screenshot of Compare snapshots tab:

It is divided to two parts - on left you can see source dumps and on right target dumps. Source dumps are the ones that were taken first - this is VERY important to understand that source must be always older.

System Sherlock Lite can report unexpected results if you are not aware of this behavior - if you will swap source and target (so target will be older file and source will be newer file), results will be opposite (for example if you deleted folder between snapshots, it will report that this folder was created etc.).

For this reason I implemented some logic to processing. When you select any file on left, ONLY newer files then selected are displayed on right.

Parse logs

When you compare two dumps, differences between these two entries are automatically displayed in GUI.

Current version should be already functional, but I am sure that there will be some issues - after all, this is really first version I just finished. If you encounter any problems or you have some features requests, feel free to post them in comments - if nothing, I will at least respond (but probably also implement such changes).

Advantages compared to RegShot:

Fully supports command line - can be scripted
Imho better GUI
Supports multiple dumps - not only comparison of 2 snapshots (easily review historical changes)
Exclusion list based on RegExes
GUI for reading log files

Download

Make snapshots of filesystem and registry using command line

martin — Wed, 14 May 2008 12:43:00 GMT

Some installers can be very mysterious - this suddenly applies for MSI packages, even using full logging, it is not easy to find out which registry keys or files were modified\deleted\added. If you have application that is using some custom installer, this can be hell...

Colleague of mine came with really nice idea - what about using some tool like InstallRite or RegShot for monitoring all installations and reporting what was changed during that installation? From idea it is usually not far to implementation - you only need some tools to do it...

I used utility called System Sherlock Lite - it is very simple to use command line utility that can take snapshots from filesystem\registry and compare them. Of course it is freeware ;) It also supports exclusion list (using regexes), so you can easily configure it for your needs and ignore entries you are not interested in (usually log files or temporary folders).

So what I did is that I created 2 different scripts - StartMonitor and StopMonitor.

StartMonitor is creating first snapshot.

StopMonitor will create second snapshot, compare it with first snapshot and store differences in installation log file. Then it will delete both snapshots.

This implementation is really easy, but is working really nice. Now I can easily monitor all installation I want automatically without any knowledge about installer being used or installation method. It allows me to easily debug anything from logon\logoff scripts to software installations...

Martin

Applications with hardcoded paths

martin — Thu, 21 Jun 2007 13:22:00 GMT

In my citrix environment, I am trying to install on applications to D:\ drive. Most applications doesnt have problems with this, however some of them requires installation to C:\ drive.

Sometimes you can fix these applications yourself, sometimes you can fix them with vendor or application support, however there are situations where you are not able to do anything about application locations.

In this case I prefer to still install applications to D:\ drive and just create symbolic link to C:\ drive.

I am using Junction from SysInternals for such tasks.

So the process is:

a.) Install application to D:\Apps\AppX

b.) Configure security on D:\Apps\AppX

c.) Create symlink from D:\Apps\AppX to C:\XApp

What are you doing when you encounter such application?

What is Microsoft missing at deployment field?

martin — Mon, 28 May 2007 20:50:00 GMT

As you maybe know, I am no longer deployment specialist - now I am specializing on SBC (Server Based Computing), however I hope so there are still few comments and I left and sounds reasonal :)

Linux environment got big advantage with rpm packages - installation is easy. However Microsoft got same technology - Windows Installer aka MSI. Why it is not broadly accepted?

Because there is nothing like Windows Installer Express - studio to create MSI packages easily and for free. And I dont see any reason why not to have tool like this :(

Second tool that was missing was Windows PE available publicly for free - finally they achieved this with Windows PE 2.0, hoooooraaaaaay :)

Last thing I am really missing (and again, I dont see any reason, specially with Microsoft focusing on WIM today) is per-demand PXE boot.

What do I mean? Standard deployment scenario is to have some techies running around with cds and installing OS using images. More advanced scenario (including RIS or WDS) is to use PXE - principle is the same, you have techies running around, this time without CDs, they boot target computer, select boot from network and select image to install.

Looks logical, right?

But we are talking about unattended installation and running around doesnt fit to this image.

Per-demand PXE is little different - EVERY PC boots automatically to network. It finds PXE server and doesnt have any image assigned, so it automatically continue with booting regular windows. However when you want to install something - you just assing correct image on PXE server, link it with you computer MAC address and reboot target server. After reboot it links with PXE server, detect one assigned image, boots it and install automatically.

That means that to reinstall computer, you just need to reboot it or wol it (wake on lan it).

Easy and powerfull. I had solution like this implemented using ftfpd32.

One common question about AutoLogon

martin — Tue, 11 Apr 2006 08:43:00 GMT

This is question I got quite often - when I enable autologon (for example for deployment purposes), even when I logoff and I want to change user, it will automatically logon back!

Answer is quite simple - if you check http://support.microsoft.com/?kbid=315231, you can find setting called ForceAutoLogon.

Many people dont understand this setting correctly - this wont just autologon you, it will FORCE autologon. Which is really usefull for kiosk mode computers etc, when you have remote administration capabilities, however you can run into problems (I even know few guys that reinstalled computer to get rid of it).

Get rid of old .ini files - redirect them to registry!

martin — Wed, 01 Mar 2006 09:22:00 GMT

If you remember, loooong time ago (Windows 3.x) we used .ini files for setting almost everything.

These files were often placed in %WinDir% (which is quite disaster when you try to implement LUA). What can you do about it (instead of logging, creating security templates and so on)?

There is functionality built-in Windows called Initialization file mapping, that allow you to "upgrade" your registry-unaware software -> this software will now be able to use registry :)

How to do it? It is quite simple - the best documentation I found is here:

http://www.oreilly.com/catalog/manwinreg/chapter/ch08.html#32309

LUA post no. 2 - using different user account for application

martin — Wed, 09 Nov 2005 15:53:00 GMT

Well, sometimes you encounter application, that just WONT run under user... Many people are trying to solve this by running that particular application under different account... They use RunAs+Sanur or AutoIt RunAsSet command...

However there is also one tool available from Microsoft - it is called EPAL -

http://www.microsoft.com/downloads/details.aspx?FamilyID=cf3cc921-9b8e-4266-a905-2e2a20217ce0&DisplayLang=en

I think it can be sometimes really usefull, however I dont understand WHY there isnt anyone (even from Microsoft) that know something about this utility :(

It is based on Active Directory - first you must register your application to AD using

epal.exe /r /c:OU=<application>,OU=EPAL,OU=MyBusiness <application.exe>

After successful registration, new OU is created in AD... There is user, under which account the application will launch (I usually create ElevatedApps group, that is in local administrators) and group with users, that are allowed to run this application using EPAL.

If you want to run this application elevated, you must perform following tasks:

1.) Add user to group <application> Application Users

2.) Add <application> user account to local administrators (in my case add this account to ElevatedApps group)

3.) Create new shortcut with EPAL /c:OU=<application>,OU=EPAL,OU=MyBusiness <application.exe>

And thats it! When you click on shortcut, the application will automatically launch under elevated user account

Interview with Johan Arwidmark about deployment

martin — Wed, 12 Oct 2005 14:08:00 GMT

Here we go! This is second interview, now with Johan Arwidmark and we talked about deployment... As you can see, Johan have same opinion as me about availability of WinPE ;)

1.) What tools are you missing most in deployment today?

Multicast, offline image editing (when using SMS OSD), good driver injection tools, support for multiple partition handling (when using SMS OSD) and Windows PE free for all Windows Users…

2.) What are your favourite upcoming deployment technologies? SMS v4, Monad, WIM or something absolutely else?

This would be all technologies using the new WIM format (WDS, SMS v4 and Ximage)

3.) What do you think is the biggest problem with deployment today? I mean like non-msi installers, profile migrations etc...

Windows PE is not available for all Windows customers

4.) What are your favourite tools for deployment? I mean everything including 3rd party tools/support tools (IDE...) etc.

SMS 2003 OSD (with ZTI from BDD 2.5) for clients and ADS 1.1 for servers

JIT Setup - really nice feature and most people dont know about it!

martin — Thu, 06 Oct 2005 19:54:00 GMT

Well, when I talked with Noise in discussion under one of my previous posts, I decided I will write something about this feature. It is called Active Setup.

When new user logged on first time, their profile is created from Default user and ntuser.dat from default user... However there are some things that you cant find in default user - for example icons for Outlook Express. Most administrators dont want to have these icons - mostly because they are using more robust email client like outlook.

Most of these administrators just left them where they are. However how are these icons created?

When you look to HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components, you will see a pack of GUIDs -

every GUID here means what to do when new profile is created. The most important value is StubPath - it is path to command to execute. When this is not available, it will just ignore it.

Lets try small experiment - first locate key {6BF52A52-394A-11d3-B153-00C04F79FAA6} - it is key responsible for creating WMP icon. When you change the name of StubPath (for example DisableStubPath), the icons wont create. Neat, right? :)

Now you know how to disable certain components - however there is of course another use for them - you can create new!

For example you have application, that is using per-user settings. You want to specify default settings and you cant use HKLM\All users.

If you dont know how to create GUID, you can use my script:

strGuid = Left(CreateObject("Scriptlet.TypeLib").Guid, 38)
strInterpreter = Wscript.FullName
strInterpreter = InStr(strInterpreter,"cscript")
If strInterpreter = 0 Then
InputBox "Generated GUID:", "GUID Generator", strGuid
Else
Wscript.Echo strGUID
End If

create new key containing GUID.
create file test.cmd with content “mkdir c:\test“ in c:\temp
create value StubPath with path to your script, that will create this settings. In our example it will be “C:\Temp\test.cmd“
create value ComponentID with any name you prefer. For example “Test active setup“
Last needed value is IsInstalled. It should be REG_DWORD with value 1.

Now try to log as new user... Is it working? :)

Deployment presentation no.3: User profiles

martin — Mon, 03 Oct 2005 20:56:00 GMT

Hey guys!

As maybe some of you know, I am working on series of (free) presentations about (free) deployment tools & techniques.

First two part were successful - right now I am preparing third part, which will be about user accounts and application installation.

Why am I telling you about this? Because I would like to ask you to help... Bring some new ideas, you experiences etc.

So I will share with you informations I want to provide there.

User accounts - I want to talk about different aspects of user profiles.

Local user profiles, roaming profiles, redirecting directories... I want to describe the difference between w2k “Wipe&Load” method of roaming profiles and wxp “Merge” method...

Next I would like to talk about how profiles are working - detecting SID, ProfileImagePath, mapping ntuser.dat to HKU\SID and HKU\SID to HKCU etc...

Also quite important will be section about Default user/All users... Informations like that you can use domain Default user (just create Default user in NetLogon) etc.. Here I have one question - have anyone tried to redirect All users directory to network? I think it should be possible, however never tried it.

Also important part about modifying profiles - how to load HKCU for different user, how to modify Just-in-time setup (like when Outlook Express icons are automatically generated), methods for modifying Default user...

So right now I am waiting for your comments :) What do you miss in this list, what are your experiences, tips&tricks etc...

Hope so you wont let me down :D I am always interesting in finding new informations/ideas...

BartPE + USMT

martin — Thu, 22 Sep 2005 19:13:00 GMT

I wanted to move to next step - I finally decided to leave MSDOS to stay in grave and use BartPE... Everything is working fine - however I encountered one (logical) problem...

You cant use USMT to migrate user profiles to network when you boot using PE :( I am still trying to find a workaround, however it looks like really big problem.

Have anyone any advices?

Windows Installer a.k.a. Advanced Setup Manager

martin — Mon, 19 Sep 2005 03:28:00 GMT

One of the most common problems with unattended installations are typos (as I wrote before)... How to solve them?

You can use dictionary for your favourite text editor (Crimson Editor or dictionary for Word). This is one solution.

Remember Setup Manager, that is used to automatically generate .sif file? It is included in deploy.cab and have name SetupMgr.exe. It is working fine, however it contains only necessary values :( Nothing advanced...

For a long time I was looking for similar tool, however with support for more advanced features. And then I found project Winstaller on MSFN. And I decided to create .xml files for every possible section in .sif file with descriptions etc.

Right now I am working on this project with Jonathan Gordon - the problem is it is really big time-eater to generate files for all settings in .sif files in one person :(

So this way I would like to ask for a help - please, if you could give us a hand, let me know. I dont want to let this project die, it looks really promising. Only thing you need to do is to rewrite some text from ref.chm to xml file (I will provide howto if you are interested).

Most common problems during deployment

martin — Sat, 17 Sep 2005 20:23:00 GMT

I spoke about this few days ago, these are most common problems during deployment projects:

including toooo much settings in .sif files - many people are trying to include everything they can in their answer files - but when you encounter problems, you will find out it is really hard to find out where is the problem.
not enought time spend on planning phase - this is often problem. I personally dont like planning (plus documentation etc.), however it is VERY important.
static informations - I spoke about it in Batch abstraction - use variables everywhere you can! One of the worst work ever is trying to find what was running on burned server - I encounter this quite often, when I am called to solve problems :(
deployment is not divided to sections - I prefer to create different sections during unattended. What I mean? I always create sections that are shared for all computers - for example installation of AV and removing temporary files. Technology part is run before any installation, ending part is run after any installation. This is quite usefull when you want to change
using workaround to solve some problems. This is VERY common problem - for example if server is not available, many administrators will include timeout (sleep command) instead of trying to solve the problem by another method (for example loop witch checking if server is available). This is really often problem - you create workaround, everything is working fine, however when you try to install 5 computers, one of them fails :( So DONT USE WORKAROUNDS! Spend some time and try to locate the problem and solve it using adequate solution.
Too complicated solutions. Sometimes when I see what are people able to implement, I think I will bang my head against the wall. Easy solutions often means reliable solutions. I like to use something similar to black-boxes - solutions, that are independent on company, domain etc and are dependent only on .ini files...
Too simple solutions. What I mean is not related to deployment, it si more related to scripting. Why the hell are people using variables like a, b or st? I like variables where you can say exactly what they will hold. That is way my variables are quite longer than usual - however if I try to change behavior later, it is really easy for me (for example if I want to see variables that contains paths, I only need to list all Path.* variables).
OS modifications. Why are people always trying to remove/disable something that is necessary or recommended to stay on computer? Typical is removing IE - you CANNOT remove IE. IE is (simply said) just practical usage of OS components. It is NOT something that is dig into OS, it is something that is using many natives functions... When you remove something from core OS, you can expect various problems later. If you want to remove something like this, you must know what you are doing and how it will affect OS. For example I like to disable LastAccessStamp on FS - however I know what it will affect (like Outlook or Add/Remove Programs), so when someone wants to use diary in outlook, the installation will automatically enable LAS and reinicialize Office.
Fight for your rights :) What I mean is similar as workarounds section - if something is not working, dont just disable, find the reason. Typical example of this is WakeOnLan - many companies automatically disable WOL, because their computers woke automatically. Instead of trying to find solution (disable RWUPING and RWUARP), they just disable this great functionality.
mistypes in .sif - of course really common problem :) I saw a Word dictionary for .sif files somewhere around internet and I think it is really useful.

These are problems I got in mind right now. What are your experiences?

SAM (Software Asset Management) - what about paid solutions?

martin — Fri, 16 Sep 2005 22:00:00 GMT

Not a long time ago I encountered nice page from Microsoft, where you can search for SAM tool of your preference...

Check it out! I recommended it already to few people that were searching for software asset tools...

http://www.microsoft.com/resources/sam/aspx/findtool.aspx

Free Asset Management

martin — Fri, 16 Sep 2005 21:35:00 GMT

Yesteday I had presentation about deployment - it was first part of series, where I want to cover every deployment topic. I was talking about theory of deployment and then I spoke about planning.... Part of the planning phase is inventorize you software and hardware environment - and I was REALLY surprised that there were only few guys that are using asset management software.

WHY?

Dont tell me it is because money - if you want free solution, you can try http://ocsinventory.sourceforge.net (my favourite is v3.0, NG is tooo complicated and needs too many components) or http://www.ilient.com (didnt try this SysAid, however looks useful).

When I saw that these people didnt have any experience with asset management, I decided to show them how to configure OCS... Installation of asset “server” took me about 5 minutes (and dont forget that I was talking about every step)...

It is quite simple - download package, unpack it somewhere, create share with access rights, then you just need to create ODBC connection to included access DB (doesnt require MS Access) and add one line to logon script...

Troubleshooting WSUS - Client

martin — Fri, 16 Sep 2005 15:07:00 GMT

This is question I see almost every day - client problems with WSUS...

Most of the solutions are quite simple -

do you have generated corresponding groups in WSUS server?
are you sure your registry settings are correct? This is often cause of troubles
do you have http:// prefix in your WUServer and WUStatusServer?
did you check WindowsUpdate.log in windir? WindowsUpdate.log is related to WSUS, Windows Update.log is related to automatic updates...
did you run http://download.microsoft.com/download/9/7/6/976d1084-d2fd-45a1-8c27-a467c768d8ef/WSUS%20Client%20Diagnostic%20Tool.EXE? This is Client Diagnosti tool, it is working quite well and can really help you.

Batch abstractions 2

martin — Thu, 15 Sep 2005 11:14:00 GMT

Ok, I found some time, so lets go!

Set Ini.Include.Servers=Server

Set Ini.Include.Paths=Paths

Set Path.Server.Ini=\\%UserDNSDomain%\Netlogon\IniFiles

For /f “usebackq delims== tokens=1-2” %%i IN (`Set Ini.Include`) Do (

For /f “usebackq delims== EOL=[ tokens=1-2” %%a IN (`Type %Path.Server.Ini%\%%j.ini`) Do (Set %%a=%%b)

)

So what does it do? For example first (Ini.Include.Server) will search for Server.ini file in your Netlogon folder (\\SoulinCorp.com\Netlogon\IniFiles\Server.ini in my case).

Content of Server.ini looks like this:

[Deployment]
Server.Main=Soulin-dc
Server.Backup=Soulin-2
Server.OSSource=Soulin-dc

[Exchange]
Server.Exchange=Soulin-Ex

This script will automatically create variables Server.Main, Server.Backup, Server.OSSource and Server.Exchange. So if you (for example) change the exchange server to Soulin-Ex2, you will only need to change it in this one file and all your exchange scripts will work fine!

Batch abstractions...

martin — Thu, 15 Sep 2005 09:27:00 GMT

I really HATE static scripts - and most of administrators use them. Static script means that paths, server names etc. are hardcoded to these scripts.

I am using quite simple method to workaround.

First method is using variable for current directory. This is extremely usefull for network scripts. The implementation is quite simple, you just need to include this two lines in your script and it will create variable Path.CurrentDirectory.

Set Path.CurrentDirectory=%~dp0

Set Path.CurrentDirectory=%Path.CurrentDirectory:~0,-1%

As you can see, its really easy.

I will talk about second method tomorrow - it is really useful for centralizing .ini files in your environment.

EDIT: Repaired typo... Thx BG for comment.

Now lets say something about SDS

martin — Thu, 15 Sep 2005 05:55:00 GMT

SDS is the most important project for me right now... SDS is free management software ala SMS/Altiris/Unicenter...

It all began when I began preparations for my next presentation - it will be about deployment, however using free tools. What I want to achieve is to show people that deployment is not just for big companies. This presentation have goal to create professional deployment solution including asset management etc. without paying a cent.

Which is not problem - only problem I encountered is there is no free management solution. So I decided I will create one only for this presentation.

It is working quite fine, so I decided I will continue my work on this project. Core is based on batches (surprise) with using advanced technologies like batch services or named parameters, GUI is programmed in VB.NET.

If you want some informations, see my old blog (http://martinzugec.blogdrive.com) or MSFN thread (http://www.msfn.org/board/index.php?showtopic=55843&pid=389688&st=0&#entry389688#entry389688)

I will post some informations + screenshots soon.