Anything about IT

Issues with installing Windows Updates? Then have a look at the following Microsoft Support Articles:

KB971058 How do I reset Windows Update components?

KB947821 Description of the System Update Readiness Tool for Windows Vista, for Windows Server 2008, for Windows 7, and for Windows Server 2008 R2

Managing ActiveX Components within an enterprise sometimes can be a pain. Users with standard user privileges by default can’t install ActiveX components, hence whenever a larger group of users require an ActiveX component you usually end up creating a software package and distribute it via Software Distribution or you provide them with temporary Administrative rights. But if the clients are running Windows Vista or Windows 7 there is another solution available I noticed many people aren’t aware of, hence that’s why I am writing this article.

The Solution is the Windows ActiveX Installer Service. Using the Windows ActiveX Installer Service allows Enterprise Administrators to manage the deployment of ActiveX controls through Group Policy Settings. On Windows Vista the ActiveX Installer Service is not installed by default but can be added as a feature. On Windows 7 the Service is installed by default.

Configuring the ActiveX Installer Service through Group Policy can be done in two ways. Either by specifying the ActiveX Control installation URL or by configuring trusted sites. I am going to use the first option to demonstrate the configuration and behavior of the ActiveX Installer Service.

Most of you will be familiar with the Microsoft Connect, MSDN Subscriber Download or TechNet subscriber download Site that uses the File Transfer Manager for downloading content. When trying to download content from one of the above mentioned web sites for the first time with a standard user you will be prompted with a message as shown in the picture below.

But as soon as you allow the Add-on to be installed, you will be prompted to provide a user name and password of a user that has administrative privileges to allow the installation to continue. 

This is what would happen in an enterprise environment where users access a website that requires the installation of an ActiveX control. So let’s create a Group Policy that allows the installation of the Microsoft File Transfer Manager through the ActiveX Installer Service.

First we need to know the URL that points to the ActiveX Control installation file, which is usually a CAB file but can be an OCX or DLL file as well. To find out the URL of the Microsoft File Transfer Manager I open the web site’s source and search for the word “CODEBASE”.

Now that I know the location that points to the CAB file, I open the Group Policy Management Console and create a new GPO called GPO_ActiveX_Management. Within the new created GPO I navigate to the ActiveX Installer Service which is located under Computer Configuration, Policies, Administrative Templates, Windows Components.

I then enable the "Approved Installation Sites for ActiveX Controls” setting and add the Site name https://transfers.ds.microsoft.com/FTM/TransferSource/grTransferCtrl.cab and set the Installation control value to 2,1,1,0.

To ensure that the GPO settings is applied to my client I run GPUPDATE at the command prompt. Now when i launch the website again that tries to install the Microsoft File Transfer Manager there is no User Account Control prompt anymore, this because i have now configured this site as an approved site to install an ActiveX control.

When opening the Services list within the Microsoft Management Console, I can see that the Service has been started and looking at the Windows Application log I can see that the URL was identified as a secure location.

So after a few seconds, the Microsoft File Transfer Manager is successfully installed without having to provide administrative privileges.

If you’re interested in using the ActiveX Installer Service in your environment I recommend that you also read the below referenced articles.

Additional Resources
The ActiveX Installer Service in Windows Vista
Microsoft TechNet – ActiveX Installer Service
NirSoft – ActiveXHelper

Be aware of the upcoming End of Support for Windows Vista (RTM) and Windows XP SP2. More details here. Also read End of support for Windows 2000 and Extended Support phase transition for Windows Server 2003 here

Is your application vista compatible ? The Windows Vista Application Compatibility List for IT professionals might give you the answer. The list contains all applications that have the status “Certified for Windows Vista” or “Works with Windows Vista”.

This list might be helpful as well in planning for Windows7, since “most” applications that work for Windows Vista are supposed to work on Windows7 as well.

Mark Minasi has put together a nice overview on Windows7. “the next Windows: Lucky7?”

The Windows Vista footprint is quite large, so my current thoughts are “how to reduce the Windows Vista footprint ?”. I hope to come up with a complete overview at some stage, for now i have found the following interesting references:

Uninstalling Drivers and Devices in Windows Vista a Microsoft white paper primarily intended for driver developers, but why not use the same methods described in there and reduce the driver store size ?

Reduce size of installed Vistasome tips how to remove a couple of unnecessary things like wallpapers etc.

The reason for looking into this is not that there is an issue with already installed clients, since usually there is enough disk space available, the objective is to get the customized windows vista images smaller or let’s say as small as possible.

According to a blog post on the Windows Blog from Mike Nash, Windows Vista SP2 will be made available on TechNet Thursday December 4th.

Windows Server 2008 Service Pack 2 (SP2) and Windows Vista Service Pack 2 (SP2) Customer Preview Program (CPP

The current plan is to ship Vista SP2 in the first half of 2009.

….. in fact it’s already available on MSDN now: https://msdn.microsoft.com/en-us/subscriptions/securedownloads/default.aspx

I wrote about BITSADMIN earlier, use the below command line to directly download Vista SP1. Note that you have to create the c;\download folder yourself or define an other path.

BITSADMIN /TRANSFER VSP1 http://download.microsoft.com/download/3/a/9/3a9b72c2-527d-4694-8a49-84c056d4c34d/Windows6.0-KB936330-X86-wave0.exe C:\DOWNLOAD\Windows6.0-KB936330-X86-wave0.exe

Until last week we have just seen rumours around the Service Pack 2 for Windows Vista. The only visible thing from Microsoft was a placeholder KB number on their Support page.

On October 24, Microsoft has droppped some more information on their Windows Vista blog about the Service Pack 2 for Windows Vista.

While most people again seem to get excited about Microsoft’s next operating system and waste their time with rumours and guessing when it will be released, let me continue with promoting not to skip Vista

An interesting article about “Five Reasons Why Skipping Windows Vista Could Backfire” was posted yesterday on www.cio.com

I found the arguments good enough to mention this article here.

To be honest i haven’t gone into the details of the Windows Integrity Levels myself but wanted to mention the chml.exe tool that can be downloaded from Mark Minasi’s web site.

More details about the Windows Vista Integrity Mechanism can be found here:

Instead of manually searching the web, i have created some Google Alerts. This is very useful as it does simply send me an e-mail every day with the found results.

Of course like many others i’m also interested about what is going on around Windows 7, but to be honest, i really am not interested on how “Paint” will look.

What annoys me most is all the rumors going around about the possible release date for Windows 7, first we heard 2010, then some argue 2009, but today i even see messages speaking about Summer 2009 and of course Microsoft is not commenting on any of those messages.

But they should, because it’s about money and time being invested. In an earlier post i had argued not to wait and move to Vista, but if i would put myself into the seat of A CIO i would get concerned on what decision is to be made.

Again, i would wish to see some clear statements from Microsoft, especially what customers can do that have adopted Vista or plan to do in the very near future. Will there be an easy upgrade path , just like adding a service pack ? In the past an in-place upgrade was rather a no-go when doing serious IT management, i have seen very few companies doing in-place upgrades on clients as it is rather messy, however considering the new modular way the OS has been build we might want to re-evaluate such an approach if that would be provided to get a Vista client up to the next level. Well let’s see Microsoft plans to tell us more in November at the PDC. Just hope they are aware of the following, in many companies IT spending budgets are being planned in these days, not in december !

All those being pessimistic about Windows Vista, book some time and carefully read this:

http://www.tweakguides.com/VA_1.html

In 2006 Microsoft acquired the company DesktopStandard known for its extending Group Policy products GPVault and PolicyMaker.

While GPVault has become part of Microsofts MDOP suite that is available only for Enterprise customers that have a Software Assurance contract, the Policy Maker features have been available to everyone.

The PolicyMaker GPO extensions are now called GP Preferences.

GPO Preferences can be managed directly from a Windows 2008 system that has the latest GPMC installed or through a Windows Vista client with RSAT installed.

With GP Preferences you can now manage Windows 2008 server, Windows Vista, Server 2003 SP1 and Windows XP SP2.

What can I do with these GP Preferences ? Well, GPO preferences go beyond what we used to do with Group Policy settings today, furthermore while GPO policies are being enforced, with GP Preferences a user might still have the possibility to change things.

With GP Preferences, you can now customize all those things that you would typically do through a logon script, software packaging or by putting the settings into an image.

The big advantage is that now you can do this all from the same management console where you manage your Group Policy settings.

To give you an idea of what GP Preferences can do:

• Configure Power Settings
• Drive Mappings
• Map local / network printer
• Create / Change Folders, Files and Registry settings
• Configure Applications through extensions.

Furthermore , and I found this an extremely useful feature, you can target the GP preferences. As an example, you can first define power settings or power schemes and then add a query so that the GP preference is only being applied if the query matches that device or user, let’s say, only apply the power settings if the system is a notebook.

Give it a try, if you already have a test environment available all you need to do is the following:

Install a Windows 2008 server or RSAT on Windows Vista SP1

Open the Group Policy Management Console and create a new GPO Object.

Within the GPO object create a new Preference, for example an environment variable that is set at system level

Link the Group Policy object you just created to the OU where you have your test machine computer objects stored

On the client machine run gpupdate /force to pull down the new GPO settings.

If you are using a Windows XP client, you will first need to install the client side extensions that can be downloaded from Microsoft.

Resources:

A Guide to Group Policy Preferences for Users of PolicyMaker Standard Edition

Group Policy Preferences Overview

Group Policies on TechNet

Group Policy Preference Client Side Extensions for Windows XP (KB943729)

Microsoft has published a Windows Vista Performance and Tuning Guide focusing on the following:

• Making configuration changes that help a computer feel more responsive when you use it.
• Using hardware to boost the actual physical speed of a computer.
• Making configuration changes that help a computer to start faster.
• Making the computer more reliable may help increase performance.
• Monitoring performance occasionally so that you can stop problems before they get too big.