Nuo Yan : 1. Windows Client

Usability Issue - Windows Security Center

Nuo Yan — Sun, 24 Feb 2008 22:08:00 GMT

My friend went to China for a 3-month vacation last December. Just now she asked me to help turn on her computer and send her a file in her computer. Since the computer hasn't been on for two months, the first notification I got when I logged in was a security notification said Windows Defender needed to be updated.

I clicked the balloon notification, and it guided me to the Windows Security Center. Then I noticed that Spyware and other malware protection is out of date, so I clicked Update Now.

Then a small dialog box pops up, as shown in the figure.

There isn't any problem so far. But if you look at the small dialog box, there are two buttons on it: "Cancel" and "Close".

As a user, I feel confused about the "Close" button. I clearly know by intuition that pressing the "Cancel" button will cancel the update process and return to Windows Security Center. But what does "Close" do? Does it just close the pop up dialog box and continue the updating process? Or does it end the updating process as well?

It's just confusing.

There can be many ways to solve the problem, such as changing "Close" to "Minimize". It may be worth to survey some users about this problem to know if the general users consider this a problem. At least I personally consider it an usability issue.

Usability Issue in Windows Recycle Bin on the Desktop

Nuo Yan — Sat, 29 Dec 2007 04:33:00 GMT

If you put a Recycle Bin on the desktop, you might empty it by right clicking it and click "Empty Recycle Bin" form the menu.

But you may have noticed that there is another option in the menu called "Delete" which is for deleting the Recycle Bin shortcut from the desktop.

I saw many people mistakenly clicking the "Delete" menu item instead of the correct "Empty Recycle Bin" for emptying the trash, so I consider this as a usability issue for this design.

One way to solve this issue is to replace the "Delete" menu item with other names such as "Remove this shortcut." Currently I don't have any better idea.

Windows Vista and 2007 Office System RTM

Nuo Yan — Tue, 07 Nov 2006 13:09:00 GMT

Get ready to them!

2007 Office System is Golden: http://www.microsoft.com/presspass/press/2006/nov06/11-062007OfficeRTMPR.mspx

Windows Vista Express Upgrade: http://www.microsoft.com/windowsvista/getready/expressupgrade.mspx

Access-Based Enumeration is in Windows Vista

Nuo Yan — Tue, 18 Jul 2006 15:07:00 GMT

Windows Vista supports to share a single file to one or more users. This is truely a great news for all Windows users since we don't have to share a whole folder only for a file. But more excited, Access-Based Enumeration is used for sharing single file.

What is Access-Based Enumeration?

Usually when we share something on our computer, we prevent illegal access by providing different users different permissions. When those users connect to the share folder, all of them are still able to see all of the contents listed, no matter they have permissions to read or write or not. If they don't have right permissions for some contents, they are not able to do the expected operation but they are able to see the contents listed.

Access-Based Enumeration controls the listing of the share folder based on access permissions. Users accessing sharing resources will not see those contents which they don't have correct permissions to access. Access-Based Enumeration is first included in Windows Server 2003 Service Pack 1 and provided a tool called abetool.exe.

Where can I find Access-Based Enumeration in Windows Vista?

No. You may not be able to find something like an interface or tool. However, when you use Windows Vista to share a single file, you can experience the concept and advantage of Access-Based Enumeration.

Windows Vista allows a user to share a single file with one or more specified users. If one user named A is sharing a file named FILE to B and sharing another file named FILE1 to C, and C doesn't have permission to see FILE and B doesn't have permission to see FILE1. In this case, when B connects to A's sharing resources, she is only able to see FILE listed but not FILE1; when C connects to A's sharing resources, he is only able to see FILE1 listed but not FILE. If A also shared both files with user D, then D can see two files listed in A's sharing resources.

This feature increases the working efficiency for the information workers and increases the overall security in a sharing environment.

A Quick Note Regarding Safe Mode with Networking

Nuo Yan — Sun, 29 Jan 2006 20:02:00 GMT

Please always remember, there is NO wireless network connection enabled when Windows is running in "Safe Mode with Networking".

Use a wired network if you want to diagnose the Windows in Safe Mode with Networking.

Windows OneCare Beta Preview

Nuo Yan — Fri, 21 Oct 2005 22:44:00 GMT

I wrote a brief introduction of Windows OneCare (except the back-up feature). If you're interested, you could view the article at http://msmvps.com/nuoyan/articles/72070.aspx.

Hope you will like it.

Add NICs to Existing Virtual PC

Nuo Yan — Wed, 12 Oct 2005 05:44:00 GMT

Virtual PC is a fantastic tool to help us build test or experimental environment of Windows Server System.

Suppose now we are building a test environment for Windows Server 2003 and its updates. The purpose is to simulate the company's real network environment and test the Service Pack and other updates.

We setup the workstations, member servers and domain controllers on Virtual PC successfully. The next step is to make the scenario as same as the real life environment. We begin to build the Network Address Translation (NAT) server. At this time, we need 2 NICs on the virtual machine. However, by default after installation, there is only one in this virtual Windows Server 2003 and there is only one real NIC in the host computer.

How can we do that? How can we add another NIC to the Windows Server 2003 virtual machine so that we could simulate the real life NAT environment?

Actually we could finish this work within a minute. First, shut down the virtual machine we need to add NICs to. Then start Virtual PC 2004, click the virtual machine we need to add NICs to. Click “Action”, then click “Settings...”. On the new dialog box, click “Networking”. In the right pane, click the dropbox on the right of “Number of network adapters” and choose the total number of NICs we want in this system. Note, here is to choose the total number of NICs we want in this particular virtual machine, but not to choose the number of NICs we want to add to this particular virtual machine. Then we will need to set the scope of the added NIC(s). “Local only” means the particular virtual NIC could only have network connection with virtual machines on the same host computer. We could see another option is the name of the host NIC (we assumed only one NIC in the host computer), this option means the particular virtual NIC could have network connections with virtual machines on the same host computer, the host computer, and computers connectted to the host computer through the host's NIC. If we're configuring the first virtual NIC on a virtual machine, we also can see another option called “NAT”. It's almost the same meaning as the real life NAT concept. After configuring the virtual NICs, click “OK” to close the dialog box.

We've done. Turn on the particular virtual machine we've just configured, we will see another LAN interface is right there. Then we could do the simulation of the real life environment, for instance, the NAT environment, and continue testing the Service Pack and updates in the simulated environment.

To learn more about Virtual PC 2004, please visit:

http://www.microsoft.com/virtualpc

Where to Find IP Security Monitor in Windows Server 2003 and Windows XP?

Nuo Yan — Sat, 08 Oct 2005 17:07:00 GMT

Microsoft has changed the way IPSec Monitor runs in Windows Server 2003. Dislike it's in Windows 2000, we can't start IPSec Monitor by clicking “start”- “Run” then enter “ipsecmon”.

In Windows Server 2003, IPSec Monitor becomes a MMC-based tool. We can start it from MMC:

Click “start”- “Run”
Enter “MMC”
Click “File” - “Add/Remove Snap-in...”
Click “Add”, and double-click “IP Security Monitor”
Click “Close” and click “OK”.

We're all set. Now we can use the powerful tool to check whether our IPSec configurations functions well or not.

In Windows XP, IP Security Monitor starts the same way as it is in Windows Server 2003. In fact, Windows XP is the first operating system that Microsoft changes the IP Security Monitor after Windows 2000.

Enabling IP Routing for Windows XP

Nuo Yan — Wed, 05 Oct 2005 16:08:00 GMT

We got a few computers (less than 10) in 2 subnets. We have one Windows XP computer with 2 LAN adapters. We want to use this computer as a very simple router in the middle of the two subnets.

In NT 4 we can simply open the properties of TCP/IP and check “Enable IP Routing”. However, in Windows XP we don't have this checkbox in TCP/IP properties. To make the same effect, we need to change something in the registry.

Click “Start”, click “run” and enter “regedit”.

Locate “HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters”, we can find a value called “IPEnableRouter”. Let's double click it and set the value to “1”. We are all set then.

This is not good for large enterprises. But for some specific very small businesses enabling Windows XP as the simple router will save the cost, as we don't need to buy a new copy of Windows Server 2003 only for the Routing feature.

Good Network Connections Diagnostics Tool - Windows XP, Windows Server 2003

Nuo Yan — Tue, 04 Oct 2005 05:23:00 GMT

You got a new computer or server, and you spent a long time configured all network settings. Now you want to make sure the software, hardware and network connections are functioning normally.

A buit-in tool in Windows XP and Windows Server 2003 can help you.

Click “Start”, click “run” and enter “cmd” to open the Command Console.

Enter “netsh diag gui”, the Network Diagnostics tool starts (see the figure below).

Click on “Scan your system”, the tool will scan the software, hardware and network connections settings. (see the figure below)

When the scaning process completes, it will generate a report to show you whether your system has passed or failed the scan (see the figure below). You can also expand the nodes to see the details.

Please note, the server your computer program has connected to may have security concerns to disable “ping“s. You may get a failed message because of the server's configuration. Just don't worry about that. I recommend you to expand the nodes to check all details, especially for failed ones.

Windows XP Shared Computer ToolKit

Nuo Yan — Mon, 19 Sep 2005 17:42:00 GMT

Today, Microsoft Released the Windows XP Shared Computer ToolKit version 1.0. It's a very powerful tool for administrators of public computers. It combined almost all the tasks that administrators need to do with shared computers to eight simple steps. The figure below shows the interface.

To configure a secure shared computer, we need to configure selected or all (recommended) steps from the 1st to the 8th. Click “Step 1” we will see the details of this step. It's a cool instruction to teach us how to adjust the partitions for public computers. In “Step 2” we can do a couple of security settings, such as “Remove Shut Down and Turn Off Computer logo options”. “Test your Password”in “Step 2”can be used to test the complexity of the Password of the current logged-on user account. In my case, my Password is really strong so I passed the test (See the figure below).

“Step 3” enables us to create a public user account, to prevent using an account with administrator permissions. “Step 4”is a shortcut to log off the current user account, and it includes the instructions to let us log in to the new public user account we've just created using “Step 3” and modify the profile of this user account to make it really “public”.

“Step 5“ is really powerful. It's a tool for restricting and locking user profiles. For example, we can restrict the user from saving internet histories to the account profile with this tool. The figure below shows this powerful tool.

“Step 6“ is a shortcut to log off the computer, so that we can log on as the new user account to test it funcionalities. For example, testing its restrictions and security, etc.

“Step 7“, Windows Disk Protection. It's for scheduling the installation of Windows Updates and it can be used to clear or retain user changes to Windows partition (usually C:\). I want to explain some of these options here:

Clear changes with each restart

Each time the computer is restarted, all user changes to the Windows partition are cleared.

Save changes with next restart

If we want to save user changes to Windows partition for one time, we should select this option. It will save user changes with next restart, then, the option will be automatically changed to “Clear changes with each restart”.

Retain changes for one restart

If we want to install and run a new program, this is the right option to select. It will retain user changes to Windows partition for one restart (i.e. installed a new program and restarted the computer). The option will be automatically changed to “Clear changes with each restart”when we restart the computer for the second time.

Retain changes indefinately

If we select this option, it will allow users to save changes to Windows partition until we change to another option.

“Step 8“, the last step, is to get more resources about configuring public computers. We can also view help of Windows XP Shared Computer ToolKit here.

Well, this is the brand new Windows XP Shared Computer ToolKit version 1.0. Genuine Windows XP Users can download this program for free at www.microsoft.com/sharedaccess. Try it, and enjoy it!

PageDefrag - Defragment Page Files and Registry Hives

Nuo Yan — Sun, 18 Sep 2005 22:42:00 GMT

Windows NT Defragment Tool doesn't defragment pages files and the registry hives. However, in some situations, we need to do this. For example, when we installed a new version of Windows Operating System with the upgrade install option.

PageDefrag can help us with defragmenting page files and registry hives.

Click “Defragment at next boot” radio box, and click “OK”, it will run defragment at the next time we start the computer. We can also set it to defragment at every boot, though I don't recommend to do so.

PageDefrag can be downloaded on sysinternals.com.

Funny Windows XP Pro Installation Experience

Nuo Yan — Sat, 17 Sep 2005 21:56:00 GMT

I bought a new Dell Dimension 9100 computer last week with Windows XP Home. As an IT person, Windows XP Home edition is obviously not powerful enough for me. Luckily, I have an MSDN Universal subscription, so I planned to install Windows XP Professional for the new box.

The first work to do was to create unattended installation. Why unattended? Because my new box comes without a floppy disk, but it comes with SATA hard drives. You know, I cannot press [F6] during text step mode without a floppy.

I originally tried to create the unattended answer file and the custom setup CD by myself. That is, to download the SATA controller driver, then to create a new folder in the setup CD named $OEM$ (in the same folder as i386 in). And then I created a sub-folder named Drivers in $OEM$ and created a sub-folder named 01 in Drivers. Then I put the driver files in the folder named 01. Well, this is not what I want to say. Actually I don't need to do this because another MVP gave me a link to a Microsoft KB article. There I can download the standard SCSI controller driver (which can be used for my SATA drive controller).

http://support.microsoft.com/kb/318812

I thought I was all set at this time, so I started the installation:

C:\> M:

(M:\xpcd is the folder my setup files in.)

M:\>cd xpcd

M:\ xpcd> cd i386

M:\ xpcd \ i386> winnt32.exe /unattend:unattend.txt

(I've copied the unattend.txt file to i386 folder.)

Everything went well for the text mode setup, then, I got into the graphical based setup.

The processing bar stopped at the 34-minutes-left status. I waited there for a long time (approx. half an hour), it then popped up a new window mentioned the IEEE 1394 Controller didn't pass the Windows Logo Testing. Normally I should either click OK here to install the driver or click NO here not to install the driver. However, I couldn't do either one. The mouse and keyboard stopped responds at this time. I tried to re-boot with different keyboards and mouses, but I got same result. I guess if I use PS2 keyboard or mouse there wouldn't be this problem because I think the driver for the USB controller was temporarily unloaded at that time. However I don't have a PS2 interface on my box.

Then, the only idea I had was to add a line to the unattend.txt file to ignore or allow all unsigned drivers. I searched the KB with my laptop and found this article:

http://support.microsoft.com/default.aspx?scid=kb;en-us;293765

But, it was late. I created a new unattend.txt with ignoring all unsigned drivers, and then started a new setup. I finished the setup successfully.

The significance of this post is to remind people to mention what to do with the unsigned drivers during setup in the unattend.txt answer file. Note if your UnattendMode is set to fullunattended, you don't have to do anything specially with unsigned drivers.

Converting Numeric Error Messages to Text Messages in Windows XP and Windows Server 2003

Nuo Yan — Fri, 02 Sep 2005 04:02:00 GMT

Have you ever met a problem displaying an error message like “Error 066“? You will want to know what these numeric error messages mean under Windows XP and Windows Server 2003. Be sure, you can know that.

Simple click “start - run”, and enter “cmd” to open Command Console. Run the following command:

C:\> net helpmsg ERROR_NUMBER

For example, enter “net helpmsg 066”, it will display “The network resource type is not correct.”

Set Administrator Password on Windows XP Home Edition

Nuo Yan — Sat, 27 Aug 2005 17:19:00 GMT

Don't like Windows XP Professional Edition, the Home Edition doesn't support log on normally with the administrator user account. You cannot find “Local Users and Groups” console in “Computer Management Console” either.

If you want to change the “administrator” account's password, you need to log on to safe mode with a user account with administrative permissions. Click “Start - Settings - Control Panel - User Accounts”, click on “Administrator” then click “Create a password” and follow the screen instructions to complete the process.

Some Windows tips

Nuo Yan — Wed, 03 Aug 2005 11:45:00 GMT

SC.exe in Windows 2000

I have an old blog article regarding the use of SC.exe in Windows Server 2003 and Windows XP. SC.exe is a powerful commend line tool to control Windows services. It can delete a service without mannully modifying the registry. However, a number of people also tried to use SC.exe in Windows 2000, but they failed. Because SC.exe is not included in any of the Windows 2000 editions.

For Windows 2000, SC.exe is a resource kit tool. If you have a printed copy of the Windows 2000 Server Resource Kit books, you will have SC.exe in the book CD. Otherwise, you can download it from the web for free: http://www.dynawell.com/reskit/microsoft/win2000/sc.zip. (NOTE AND CLARIFICATION: I have searched the official microsoft.com web but cannot find the location to download this tool for free, then I searched the internet and I found dynawell.com. It seems to be a Microsoft MVP's web site and provides this tool for free download. If this tool is not allowed for free download from the internet, please use the contact feature of this blog to let me know as soon as possible, and I will delete this link.)

Windows XP Product Activation with Unattended Installation

You may aware with installing Windows XP with unatteded option. We could create a text script file named Unattended.txt to automate the installation process because we could specify installation settings in the Unattended.txt file. Once the installation needs a respond, it will search the text file to look for settings instead of asking human respond. The unattended installation option is a ideal way to deploy large amount of systems automatically, we could also use it with Remote Installation Services to deploy systems automatically and remotely.

But now, I will not discuss how to make an unattended installation. I will let you know how to automatically activate Windows XP if you want to install Windows XP with unattended option.

Open your existing completed Unattended.txt file, you will see many sections include an [Unattended] section and a [UserData] section. If you want to activate your Windows XP automatically with the installation, add AutoActive = Yes to the [Unattended] section, and remember to add legal Product Key information to the [UserData] section. Use ProductID = CD-KEY.

Remember to also spcify Internet connection settings in the unattended.txt file to make sure when the Windows XP Setup completes the basic installation, the system can connect to internet to perform product activation.