Yesterday Microsoft announced that Windows 7 SP1 and Windows Server 2008 R2 SP1 have been released to manufacturing. If you haven’t yet dealt with the service pack, it is now time to inform yourself about it. In this article, I will summarize some basic facts and link to resources where you can get some in-depth information about SP1.

Windows 7 SP1 download

Microsoft partners have already received the SP1. Thus it is quite likely that you can download leaked versions from the Internet. I don’t have to tell you that such unofficial downloads are always risky because they may contain malware. Thus you had better wait until Microsoft offers Windows 7 SP1 for download. The public download will be available on February 22; TechNet and MSDN subscribers will be able to download Windows 7 SP1 on February 16.

Windows 7 SP1 and Windows Server 2008 R2 SP1 new features

I have already summarized what’s new in Windows 7 SP1 and Windows Server 2008 R2 SP1 a few months ago. The official Windows 7 SP1 page has some additional information. For Windows Server 2008 R2 SP1, you should check out the reviewer’s guide (PDF), which is quite comprehensive with 26 pages. The main new features in this service pack are certainly RemoteFx and Dynamic Memory for Hyper-V.

Hyper-V Dynamic Memory resources

Dynamic Memory allows you to increase the memory of Hyper-V VMs dynamically during run time. A good start is to read my introduction to Dynamic Memory and RemoteFX, and this Comparison of Hyper-V Dynamic Memory and VMware Overcommit will clarify the concept. If you would like to learn how you can actually use Dynamic Memory, I recommend this article at VirtualizationAdmin.com.

Checking out Microsoft’s Hyper-V Dynamic Memory Evaluation Guide is certainly also a good way to get started. Microsoft’s latest blog post relates Address Space Layout Randomization (ASLR) to Dynamic Memory, and the Microsoft Infrastructure blog has a link list of articles about Dynamic Memory. Related to this topic is Paul Schnackenburg’s series about Hyper-V performance tuning.

RemoteFX resources

RemoteFX is supposed to improve user experience in RDP sessions. I think the success of VDI (Virtual Desktop Infrastructure) depends a lot on how good this new feature really is. I already linked to my RemoteFX intro above, but it can’t be wrong to link to it again. You might also want to have a look at Microsoft’s explanation. Brian Madden’s in-depth guide to RemoteFX is a must-read for everyone who wants to dig a bit deeper.

Windows 7 SP1 significance

In my opinion, RemoteFx and Dynamic Memory are the only important new features in this service pack. Of course, the main reason why you will want to deploy SP1 is because it contains all of the updates since the release of Windows 7 and Windows Server 2008 R2. Considering that there have been quite a few “monster patch days” lately, the number of hotfixes in this service pack could reach a new record.

If you are a “traditionalist admin” who always waits for the release of the first service pack before you deploy a new Windows version, then you might feel confirmed. However, I think that Windows 7 RTM was one of the most reliable Windows releases. This is probably due to the fact that Windows 7 is essentially a service pack for Windows Vista. Thus Windows 7 SP1 essentially is than Windows Vista SP3.

• What’s new in Windows 7 SP1 and Windows Server 2008 R2 SP1 (1)
• Poll results: Will you wait for SP1 before you deploy Windows 7? (8)
• Seven reasons why you need BitLocker hard drive encryption for your whole organization (16)
• Poll: Will you wait for SP1 before you deploy Windows 7? (4)
• Windows 7 SP1 – Should you wait? (0)

Windows 7 SP1 changes

Third-party federation services enhancements

Windows 7 SP1 offers additional support for communication with third-party federation services. The document does not give more details.

HDMI (High-Definition Multimedia Interface) fix

This is not really a new feature but a bug fix. In some cases HDMI audio devices can be lost after system reboots. Windows 7 SP1 should fix this problem.

Printing mixed-orientation XPS documents fix

Windows 7 RTM appears to have problems with printing XPS documents that have both portrait and landscape orientation. Windows 7 SP1 is supposed to solve this problem.

Windows Servers 2008 R2 SP1 changes

Dynamic Memory

Dynamic Memory allows your virtual Hyper-V machine to allocate additional physical memory during run time. This feature is comparable to dynamic disks. I covered Dynamic Memory in more detail already in a previous post.

RemoteFX

RemoteFX will improve the user experience for graphics-intensive applications for Remote Desktop connections by harnessing virtualized graphics resources. I also described RemoteFX before. The acceptance of this feature will probably determine the future of VDI (Virtual Desktop Infrastructure).

6to4 and ISATAP support for DirectAccess

DirectAccess is a new Windows 7 feature that allows users to establish a VPN connection without manually launching a VPN client. Windows 7 SP1 adds support for 6to4 and ISATAP (Intra-Site Automatic Tunnel Addressing Protocol), both of which are technologies used to transmit IPv6 packets over an IPv4 network.

Managed Service Accounts (MSAs) support for RODCs

Managed Service Accounts (MSAs) are Active Directory accounts for application services that run under the identity of a user account. Windows can change the passwords of MSAs automatically before they expire. In environments with Read-Only Domain Controllers (RODC), MSAs can cause problems. Windows Server 2008 R2 SP1 fixes this problem. (This is how I understood this enhancement. Microsoft’s paper only speaks of “branch office scenarios.”)

Concurrent connections to a domain controller

According to Microsoft’s paper, this Windows Server 2008 R2 SP1 feature “allows for more granular control of the maximum number of possible concurrent connections to a domain controller.” I am not sure what this means, exactly, because this Technet article indicates that this is already possible now. The background of this is that cloud-based services require higher thresholds of authentication traffic to domain controllers because of slow Internet connections. The current default limitations are supposed to prevent denial of service attacks.

Enhancements to failover clustering with storage

Microsoft’s paper only says here that “improvements” have been made regarding storage that is shared between a subset of cluster nodes, but it does not specify what exactly has been improved. Sometimes I wish admins would write those papers and not product managers.

Windows 7 SP1 and Windows Server 2008 R2 SP1 changes

Restore previous folders at logon

The folder options of Windows Explorer offer this “Restore previous folders at logon” setting. In Windows 7 SP1, this feature restores Windows Explorer folders at the same positions before you rebooted. In Windows 7 RTM the folders were restored in a cascaded position.

Additional identities for IKEv2

The IKEv2 authentication protocol is used in IPSec and RRAS. Windows 7 SP1 supports additional identification forms (such as E-mail ID or Certificate Subject). No more details are available yet.

Support for Advanced Vector Extensions (AVX)

Advanced Vector Extensions (AVX) is a future extension for Intel and AMD CPUs that is supposed to improve performance for floating point-intensive applications. I suppose the fact that Windows 7 SP1 supports AVX means that AVX CPUs will soon be available.

You can find the direct download links for the beta of Windows 7 SP1 and Windows Server 2008 R2 SP1 here.

• What you have to know about Windows 7 SP1 and Windows Server 2008 R2 SP1 (0)
• Poll results: Will you wait for SP1 before you deploy Windows 7? (8)
• Seven reasons why you need BitLocker hard drive encryption for your whole organization (16)
• Poll: Will you wait for SP1 before you deploy Windows 7? (4)
• Windows 7 SP1 – Should you wait? (0)

I only added the option that got the majority of the votes after Lukas complained about the incompleteness of this poll. I never imagined that 44% have already deployed Windows 7 by now. Considering that the Windows 7 market share is now about 10% this number can hardly be representative.

Note: There is a poll embedded within this post, please visit the site to participate in this post's poll.

If you add the 26% of those who want to deploy Windows 7 without SP1, then 70% of all 4sysops will be running Windows 7 in their organizations very soon. It’s also somewhat hard to believe that only 8% will skip Windows 7.

Perhaps I chased away all XP supporters with my rants? If so, I am really sorry. I love it when readers oppose my opinions in comments. It would be a pity if all conservative admins are now only reading InfoWorld. Are any XP advocates reading this? Please do me favor and speak out now. It would really be great if a few are still left on this blog.

• What you have to know about Windows 7 SP1 and Windows Server 2008 R2 SP1 (0)
• What’s new in Windows 7 SP1 and Windows Server 2008 R2 SP1 (1)
• Seven reasons why you need BitLocker hard drive encryption for your whole organization (16)
• Poll: Will you wait for SP1 before you deploy Windows 7? (4)
• Windows 7 SP1 – Should you wait? (0)

1. Confidential data

It is true that the most common use of BitLocker is to protect the data on stolen laptops. Since you are probably an IT pro, you know that anybody can access the data on an unencrypted disk without requiring any passwords by booting up from a second drive. Thus, hard disk encryption is the only way to protect the data on a stolen laptop. However, who says that the disks in your PCs or servers can’t be stolen? Did you ever wonder what a disgruntled employee could do with the easy-to-remove hot-plug hard disks in your servers? If you use RAID, you might not even notice the theft for a while. I suppose, your organization protects all your valuable printed documents in a safe. Do you have the same security precautions for your valuable digital data?

2. System data

Okay, you say you don’t have any confidential data in your organization. Let’s forget for a moment that this is probably only an excuse. But what about the security relevant data that is stored on every system disk? Password hashes for example. Once an attacker has physical access to one of your company’s system disks, this opens a variety of ways to attack your whole network. Brute force attacks to crack cached passwords is only one option. If the stolen computer is a domain member, a hacker can use its trust relationship to access other machines in your organization. However, if the disk is encrypted, the bad guy has little chance to compromise your network.

3. Disk crashes

You think all your disks are physically well protected? Read on. What are you doing with a crashed disk that you just bought a year ago? Right, you send it to the manufacturer so they can verify that the disk is really broken and that the terms of the guarantee are met. Who knows, perhaps it’s only a malfunction of the electronics and they can even repair the hard drive. Now, do you really want to send an unencrypted disk with security relevant data to people you don’t really know? The same applies if you have a support contract with your PC vendor that damaged PCs will be repaired or replaced with new ones. And you don’t really trust the nice guy from UPS who picks up the broken PCs. Do you?

4. Disk disposal

For every hard drive comes the time when the last journey to the scrap yard becomes inevitable. I know, you are a conscientious admin and erase every disk thoroughly with a special hard drive eraser tool. Don’t blush now. You didn’t do that in the past? I know, disposing of a couple hundred PCs is work enough and erasing just one big hard disk can take days. However, if all the disks in your organization are BitLocker encrypted, you can be a conscientious admin without erasing hard disks for weeks before you dispose of them.

5. Why not a third party drive encryption software?

I hope, I have already convinced you by now that hard disk encryption is a must. BitLocker is certainly not the only encryption solution out there. A popular contender is TrueCrypt. I outlined already a few days ago why I am not really a friend of TrueCrypt drive encryption. Other encryption solutions exist, such as from PGP. However, I wouldn’t use third-party software for this purpose because system drive encryption always requires tight integration with Windows. I could also tell you some stories about former versions of PGP drive encryption. With any Windows update you are in danger that your encryption software breaks and that your PCs become unusable. The problems I had with TrueCrypt demonstrate how difficult it is to integrate drive encryption into Windows. Moreover, if you have more than 50 machines in your network, BitLocker is the best choice because of its good integration in Active Directory.

6. Why not Encrypting File System (EFS)?

Okay, no third party encryption software. But what about the Encrypting File System (EFS)? It is perfectly integrated into Windows and like BitLocker it can be managed centrally. The advantage of EFS is that you don’t need Windows 7 Enterprise or Ultimate and you can deploy Windows Professional instead. However, the problem with EFS is that you can’t encrypt the whole system drive. Therefore, EFS doesn’t help with the concerns I outlined above. EFS is useful if you want to encrypt a couple of private files. But it is no option for encrypting a whole disk drive.

7. Sleep well

Okay, I admit it. I made this one up because I needed a seventh reason. All such blog posts about Windows 7 need seven reasons these days. But then, a good sleep is so important. No more nightmares of your CEO’s computer with all the confidential data falling into the hands of a competitor. Isn’t that reason enough to deploy BitLocker?

• Microsoft Desktop Optimization Pack (MDOP): BitLocker Administration and Monitoring (MBAM) (0)
• Active Directory and BitLocker – Part 7: Tips and troubleshooting (0)
• Active Directory and BitLocker – Part 6: View recovery information (3)
• Active Directory and BitLocker – Part 5: BitLocker to Go (4)
• Active Directory and BitLocker – Part 4: Encrypting hard disks (2)

The fact that Windows 7 sells like hot cakes is certainly mostly because many skipped Vista and are now forced to update their IT environment. Many also didn’t replace their hardware for a while because of the bad economic situation. Since the prospects are looking better now, a lot of organizations will start investing again in new PCs and will take the chance to also upgrade to the latest Windows version. The media hype about Windows 7 is probably also a reason why Windows is again everybody’s darling.

I guess, quite a few organizations have been waiting for an announcement of a release date of Service Pack 1. Since it is now out that there won’t be such an announcement any time soon, many of you will now have to decide whether to break Windows admin’s first law, that is to deploy a new Windows version only after the first service pack. You would have at least the excuse that Windows 7 is just another name for Windows Vista SP2, or SP3 if you will. So what will you do?

Note: There is a poll embedded within this post, please visit the site to participate in this post's poll.

• What you have to know about Windows 7 SP1 and Windows Server 2008 R2 SP1 (0)
• What’s new in Windows 7 SP1 and Windows Server 2008 R2 SP1 (1)
• Poll results: Will you wait for SP1 before you deploy Windows 7? (8)
• Seven reasons why you need BitLocker hard drive encryption for your whole organization (16)
• Windows 7 SP1 – Should you wait? (0)

So what is this talk all about? I attended a Microsoft online meeting for a discussion on SP1 for Windows 7 and Server 2008 R2, which was a little more revealing. It is interesting to note that no NDA (Non-disclosure Agreement) was required as is usually the case when MVPs are invited to such meetings. Obviously, Microsoft wanted IT pros to spread the message. So what was the message? About half of the meeting was used for repeating the central part of this “announcement”: Don’t wait for SP1! Deploy Windows 7 now!

You know there is an unwritten law to never deploy a new Windows version until the first service pack is available. Microsoft is doing everything to make you break this law. One meeting participant asked if there will be a public beta of SP1. Answer: “We don’t know yet.” Huh? No beta? That would indeed be a “new feature”. (Note: He did not ask “when” but “if,” and the speaker repeatedly also talked of “if.”)

So what can you read between the lines? Microsoft doesn’t want to reveal anything about this service pack. We don’t know about the new features, we don’t know the release date, we don’t know if there will be a public beta, and if someone in this meeting would have asked if it will be called ”service pack,” then the Microsoft spokesman probably would also have evaded this question. The message of this announcement was that Microsoft doesn’t want to announce anything at this point. And if you don’t know anything about it, you might as well proceed as if there never will be a service pack. Perhaps the only reason why Microsoft brought this topic up was because of the related announcement about desktop virtualization.

Of course, it is not very likely that there will be many new features in Windows 7 SP1. However, I doubt that the new RDP client will be the only one. Considering that the Internet Explorer 9 preview became available almost at the same time as this “announcement,” it encourages the speculation that it will be a part of SP1. Microsoft is fighting hard against market losses in the browser market and the ballot screen in Europe will cost even more market share. Thus the new IE9 with the important marketing message “faster than Firefox” and with HTML 5 support has to gain market share as fast as possible. Okay, this is all mere speculation. But this is what bloggers have to resort to if no real information is made available.

The other question is, whether it is really worth waiting for SP1. If you are a regular reader of this blog, you already know my answer. Of course not! If you still run XP in your network, Windows 7 will boost productivity and security in your organization. Windows XP is now third-world technology, and the longer you stick with this hopelessly outdated piece of software the longer your organization will have a significant competitive disadvantage and the more likely it is that your network will become a training center for wannabe hackers.

If you were wise enough to deploy Vista, the pressure is significantly lower. But Windows 7 basically is a huge service pack for Vista. That is, Windows 7 doesn’t come with architectural changes and benefits from Vista’s maturing process. It is stable and the Windows ecosystem finally has adapted to Vista’s new core technologies which means that compatibility issues with Windows 7 are rare. Thus, an upgrade from Vista to Windows 7 is comparable to the deployment of a service pack. And how long do you usually wait to deploy a new service pack?

• What you have to know about Windows 7 SP1 and Windows Server 2008 R2 SP1 (0)
• What’s new in Windows 7 SP1 and Windows Server 2008 R2 SP1 (1)
• Poll results: Will you wait for SP1 before you deploy Windows 7? (8)
• Seven reasons why you need BitLocker hard drive encryption for your whole organization (16)
• Poll: Will you wait for SP1 before you deploy Windows 7? (4)

Single PC migrations

Upgrading from Windows XP to Windows 7

Upgrading from Windows XP to Windows 7 is a rather long-winded process. As you might know, you can’t just pop in the Windows 7 DVD and upgrade an existing XP installation. In my view, in most cases it is better to start with a clean installation anyway. This video tutorial explains in detail how to perform the upgrade. You should print the printed version of the tutorial before you start the upgrade process because your PC will restart during the upgrade. Don’t forget to copy your data files to an external drive before you begin.

Upgrading from Windows Vista to Windows 7

While the upgrade from XP to Windows 7 requires five steps, the upgrade from Vista can be completed in only two steps. This gives you an idea why skipping a Windows version—even for single-PC upgrades—usually doesn’t save money. Of course, this is just one of many reasons.

Network migrations

Tools to plan and deploy Windows 7 or Windows Server 2008 R2

If you are more the visual and auditory type, you might be interested in this video interview. It also gives you the chance to get acquainted with a couple of Microsoft employees who are responsible for Windows deployment. In this interview, these employees discuss the Microsoft Deployment Toolkit 2010 (MDT), Assessment and Planning Toolkit 4.0 (MAP), and the Infrastructure Planning and Design guides (IPD).

Windows XP to Windows 7 migration interviews

This is a series of interviews covering the topics “Collect, Analyze, and Test,” “Remediate Applications – Fix,” “Remediate Applications – Virtualize,” and “Deploy Operating System.” These interviews give you a first look at what awaits you if you have to migrate your Windows XP network to Windows 7.

Windows 7 desktop deployment overview

These nine pages give you an overview of the new deployment features in Windows 7. I recommend this overview only for admins who are already familiar with Vista deployment.

Deploying Windows 7 series by Mitch Tulloch

Before you read Microsoft’s documentation, I recommend studying Mitch Tulloch’s Windows 7 deployment series in 16 parts. This guide is clearer and more practical than Microsoft’s guides and covers everything that is important for small and mid-sized organizations.

Windows 7: Deployment – TechNet documentation

The TechNet documentation is the place to go when you want the details. For my taste, TechNet documentation is sometimes a bit too theoretical, an opinion that also applies to this guide. However, if you work in a large organization you often have no other choice than to study the theory first before you can actually start playing with the tools.

Deploying Windows 7 essential guidance from the Windows 7 Resource Kit and TechNet Magazine

Without a doubt, this guide is the most comprehensive one. At 332 pages it more like an ebook. You will be hard pressed to find a Windows 7 deployment question that is not answered in this PDF file.

Windows Desktop Solution Accelerators – Windows 7

This page offers links to Microsoft’s solution accelerators covering topics for every stage of the Windows 7 migration: Planning, delivery, and management. However, not all the topics are related to OS deployment. Most of the content is of interest to large enterprises.

Do you know of other good Windows 7 deployment guides?

• What you have to know about Windows 7 SP1 and Windows Server 2008 R2 SP1 (0)
• What’s new in Windows 7 SP1 and Windows Server 2008 R2 SP1 (1)
• Poll results: Will you wait for SP1 before you deploy Windows 7? (8)
• Seven reasons why you need BitLocker hard drive encryption for your whole organization (16)
• Poll: Will you wait for SP1 before you deploy Windows 7? (4)

Once you have planned your Windows 7 deployment and prepared your Windows 7 master images with their answer files, you are ready to deliver the images to your PCs. This article gives an overview of Microsoft’s free Windows 7 installation tools.

Windows Deployment Services (WDS)

WDS is one of the major enhancements in Windows Server 2008 and is also available for Windows Server 2003 SP2. This tool enables small and mid-sized organizations to deploy Windows. Its main limitations compared to more sophisticated commercial deployment tools are that you can only install Windows remotely within a subnet (see discussion below) and that it lacks scheduling features, and supervision capabilities. I reviewed the Windows Server 2008 WDS a while back. The Windows Server 2008 R2 version comes with the following improvements: dynamic driver provisioning, Virtual Hard Disk (VHD) deployment, additional multicast functionality, PXE provider for Transport Server, and additional EFI functionality.

Learn more | Download

Microsoft Deployment Toolkit (MDT)

The MDT is a shell that can be used to tame Microsoft’s deployment tool zoo. You can integrate the WAIK tools, USMT (see below), Application Compatibility Toolkit (ACT), Microsoft Assessment and Planning (MAP) Toolkit, and volume licensing tools. It is essentially a central GUI that gives you an overview of the whole deployment process. The toolkit offers two types of installations: Lite Touch Installation (LTI), where you can deploy Windows without a systems management tool, and Zero Touch Installation (ZTI), where you would integrate MDT with Microsoft’s Configuration Manager.

Learn more | Download

User State Migration Tool (USMT)

You might have heard that it is not possible to upgrade Windows XP to Windows 7. You can, however, use USMT to transfer user files and settings to the Windows 7 installation. If you are lucky and you deployed Vista, you can upgrade directly to Windows 7, but you can also use USMT. USMT 3.0.1 was available as a separate download. The latest version is USMT 4.0 which is now part of the Windows AIK. You can find all the tools that belong to USMT in C:\Program Files\Windows AIK\Tools\USMT\. The documentation is in C:\Program Files\Windows AIK\Docs\CHMs. Transferring user settings with USMT is not trivial. In most cases a clean install is probably the best solution. If you work with roaming user profiles, then transferring user files shouldn’t be big problem anyway.

Learn more | Download WAIK

Windows Easy Transfer

Windows Easy Transfer basically does the same as USMT—that is, it allows you to transfer files and settings from one PC to another. However, whereas USMT is for large deployments, Windows Easy Transfer is for migrating computers one at a time.

Learn more | Download

Key Management Service (KMS)

If you are migrating your PCs from Windows XP to Windows 7, you will have to deal with the new activation “feature” that was introduced with Windows Vista. Entering the product key is not enough any more; every single PC now must be activated. Microsoft offers two free tools for corporate environments that help you manage Windows 7 activation: Key Management Service (KMS) and Volume Activation Management Tool (VAMT).

KMS is a central service that can activate all Vista, Windows 7, Server 2008, and Server 2008 R2 machines in your network. KMS is part of the operating system since Windows 2008. You can get help about the tool with the slmgr command. If you installed KMS 1.1 on Windows Server 2003, then you have update to KMS 1.2. The update for Windows Sever 2008 can be found here: x64, x86. Windows Server 2008 R2 comes already with KMS 1.2.

Volume Activation Management Tool (VAMT)

If you prefer to activate each machine separately using so-called MAKs, VAMT helps you centrally manage Windows 7 activation. VAMT 1.2 is now part of the Windows AIK. VAMT 1.1 is available as a separate download and VAMT 2.0 is still in beta. I will probably blog about VAMT 2.0 soon.

Just in case you are not yet familiar with Vista/Windows 7 activation, see my previous articles on this topic: How to activate Vista: MAK (Multiple Activation Key) essentials

How to activate Vista: KMS (Key Management Service) essentials

MAK vs. KMS: advantages and disadvantages of activating Vista using MAKs

Windows 7 Security Compliance Management Toolkit

Once you have deployed Windows 7, you might want to tighten the security settings in your network. The Windows 7 Security Compliance Management Toolkit could be of help here. It enables you to plan, deploy, and monitor the security baselines of computers running Windows 7 and BitLocker. The security baselines are predefined settings that offer more security than the default Windows 7 settings. The toolkit comes with an Excel sheet that gives you an overview of the settings and documentation that explains how to deploy these settings network-wide. The GPOAccelerator allows you to create the corresponding Group Policy Objects (GPOs) and the DCM Configuration Packs help you monitor the security baselines with Microsoft Configuration Manager. Note that the Security Compliance Management Toolkit Series also support other operating system versions, Office 2007, and Internet Explorer 8.

Learn more | Download

Did I forget any free Microsoft deployment tool? Please let me know!

• Raffle: SmartDeploy Enterprise – Easy OS deployment – Part 2 (1)
• Raffle: SmartDeploy Enterprise – Easy OS deployment – Part 1 (0)
• Windows deployment preflight checks – Part 2: The script (0)
• Windows deployment preflight checks – Part 1: Introduction (2)
• MDT Workbench and Windows deployment (0)

In my last article I introduced those free Microsoft’s deployment tools that help you plan Windows 7 deployment. Today, I will give you an overview of the tools that you can use to prepare the image of your Windows 7 master installation. The most important tool collection certainly is the Windows Automated Installation Kit. This kit is usually abbreviated as WAIK, but in Microsoft’s documentation it is called Windows AIK. The first four tools described in this article are most essential. The WAIK contains a few additional useful command line tools, such as BCDboot (set up a system partition) and DrvLoad (adds out-of-box drivers to a booted Windows PE image), but I don’t discuss them here. I will discuss the WAIK’s installation tools in part 3.

Windows System Image Manager (WSIM)

WSIM is a GUI tool that allows you to create answer files for unattended Windows setups. Installing Windows unattended means that typical setup configurations—such as applications, additional device drivers or updates that have to be added during the installation, Windows settings, and system partition settings—are stored in an answer file and loaded from there during the installation process. This allows you to fully automate Windows 7 deployment.

Learn more | Download WAIK

ImageX

ImageX is an important command line tool for creating, modifying, and deploying Windows images (.wim files). Windows deployment without it is hardly imaginable. If you are a Vista geek, you already know this tool inside out. I blogged about the new features in Windows 7 and the tool’s new command line options a while back. If you prefer using GUIs, you should also check out GImageX.

Learn more | Download WAIK

Deployment Image Servicing and Management (DISM)

As a Vista expert, you might not yet be familiar with DISM. This tool replaced three other tools in the WAIK: Package Manager, PEimg, and Intlcfg. You can use DISM to add OS updates and drivers and to change language-related settings in .wim files. It is also for creating and modifying Windows PE images. I blogged about DISM in more detail before: Introduction to DISM, Managing .wim files with DISM

Learn more | Download WAIK

Sysprep

Sysprep will also be well-known to anyone familiar with Windows cloning. It is used to remove unique elements of a Windows installation such as the computer name and the Security Identifier (SID). You have to run this tool before you create a master image that you want to deploy client computers. Since Windows Vista Sysprep is already included in every installation and can be found under C:\Windows\System32\sysprep\.

Learn more | No download required

Windows Preinstallation Environment (Windows PE)

If you used third-party cloning tools to deploy Windows XP, you probably had to work with DOS to create and deploy Windows images. When Microsoft finally embraced OS imaging they introduced Windows PE (Preinstallation Environment) for this purpose. It is a limited Windows OS that also comes into play when you boot up from a Windows setup DVD.

Learn more | Download WAIK

In Part 3 of this series, I will show you those free Microsoft tools that allow you to deliver the Windows 7 master image to your PCs.

• Raffle: SmartDeploy Enterprise – Easy OS deployment – Part 2 (1)
• Raffle: SmartDeploy Enterprise – Easy OS deployment – Part 1 (0)
• Windows deployment preflight checks – Part 2: The script (0)
• Windows deployment preflight checks – Part 1: Introduction (2)
• MDT Workbench and Windows deployment (0)

Microsoft has created a remarkable collection of free deployment tools for Windows 7. If the last OS you deployed was Windows XP, which was released nine years ago, then you might be interested in knowing about the available technology that helps you get rid of this hopelessly outdated operating system. In this post I will give you a short description of all Windows deployment tools that help you plan installations and evaluate hardware and software compatibility. In the next post I will discuss tools to prepare the Windows 7 master image. In the final post of this series I will introduce Microsoft’s free utilities to deliver the OS image—that is, install Windows 7 on your network.

Windows Optimized Desktop Solution Accelerator

This is not really a deployment tool in the literal sense. I included this solution accelerator because the Windows Optimized Desktop Scenario Selection Tool helps you get an overview of your PC environment, which can be useful during the planning phase. This Excel application asks you a couple of questions about your IT environment and then tells you which of these five user scenarios applies to your organization: Office Worker, Mobile Worker, Task Worker, Contract/Offshore Worker, and workers who need to Access from Home. Once you know which scenario fits best, you can use the Windows Optimized Desktop Scenarios Assessment Guide, which is included in the solution accelerator, to learn more about the Microsoft products and technologies that can come into play in your environment. Learn more | Download

Microsoft Assessment and Planning (MAP) Toolkit 4.0

MAP basically is a hardware inventory tool that helps you assess whether or not the computers in your network are ready for Windows 7 and Windows Server 2008 R2. The free utility also collects some software-related information such as Microsoft Office installations and SQL Server components. Most important with regard to Windows 7 deployment is that MAP reports the availability of device drivers for your hardware. MAP requires no agent installation because it uses Windows Management Instrumentation (WMI), the Remote Registry Service, Active Directory Domain Services, and the Computer Browser service to access inventory data remotely.

Learn more | Download

Screenshot from Matt Hester’s WebLog

Application Compatibility Toolkit (ACT)

ACT is to software compatibility what MAP is to hardware compatibility evaluation. This tool allows you to analyze the applications in your network to determine whether they are compatible with Windows 7 and you can also use to the tool to fix compatibility issues. ACT also enables you to analyze website compatibility with the latest Internet Explorer version. ACT requires an SQL Server installation, which indicates that the tool addresses the needs of large enterprises. Note that at the time of this writing the “learn more” link below points to the documentation of ACT 5.0, which was developed for Windows Vista. I suppose Microsoft will update this TechNet article soon to reflect the latest version for Windows 7, version 5.5. The download page also contains a link with the ACT 5.5 documentation. You might also be interested in these video tutorials about ACT 5.5. Or, jump right into the TechNET magazine article’s technical details.

Learn more | Download

Windows 7 Upgrade Advisor

ACT and MAP are enterprise tools. If you have to manage only a small network, the Windows 7 Upgrade Advisor is probably the better choice. It lacks the central inventory capabilities of the other two compatibility evaluation tools. Therefore, you have to install all your applications on your test machine if you want to evaluate their Windows 7 compatibility. If you have PCs with different hardware, you have no other choice than to run the Windows 7 Upgrade Advisor on each of those computers.

Learn more| Download

In my next post I will discuss Microsoft’s free Windows 7 image preparation tools.

• Raffle: SmartDeploy Enterprise – Easy OS deployment – Part 2 (1)
• Raffle: SmartDeploy Enterprise – Easy OS deployment – Part 1 (0)
• Windows deployment preflight checks – Part 2: The script (0)
• Windows deployment preflight checks – Part 1: Introduction (2)
• MDT Workbench and Windows deployment (0)

Okay, you obviously ignored my warning. So let me first raise your adrenalin level a little before we tear each of Kingsley-Hughes’ points into pieces.

I have already outlined that skipping an operating system version is a mistake in most cases. I know that a large number of admins are “skippers”. And it’s no wonder. Admins tend to be overworked, and operating system upgrades usually just mean more stress for a certain time period. That’s why they easily fall for such false arguments as those presented in this ZDNet article. The fact that the majority of the readers voted for this article proves it. Telling your boss that you don’t like to upgrade to a new operating system because you don’t want to work more for a certain time period is probably not the smartest thing to do. But repeating “arguments” published in a well-known magazine that even your boss finds appealing might foster your career and your leisure time as well.

Okay, if you are a skipper, you are now well prepared for what comes next.

Stick with what you know

This is my favorite. “Stick with what you know” translates into “Don’t even try to learn something new.” “Learning curves” are dangerous paths which we should “bypass altogether.” How can a writer ever publish something like this? This is very close to “Never read again” or at least “Never read Kingsley-Hughes again.” I refuse to discuss this any further!

Certainty

Adrian Kingsley-Hughes is afraid of the “unknown.” Well yes, computers are mysterious beings and their future behavior is often unknown to us, particularly if compatibility issues arise after an operating system upgrade. Of course, moving into uncharted territory always causes uncertainty and you have to weigh the gains against the risks. But Kingsley-Hughes believes that “the best research and testing” can “never truly eliminate” the “unknown.” Thus, he tells us weighing the risks is pointless because it is doomed to fail anyway. It follows that if you want certainty, you had better never upgrade. But rest assured that another thing is very certain then. Sooner or later your company will also be unknown because it will cease to exist.

Cost

Let me cite the first sentence of this claim:

While many people like to cling on to the belief that upgrading operating systems will save them money, in the real world this is rarely the case.

Please read this sentence again. Now tell me what is wrong with it? How often has your company upgraded operating systems, and why? If you are Kingsley-Hughes fan you probably would say “But only because the Microsoft-Intel cartel forced us.” Is that so? Did they also force you to replace all the typewriters with word processing systems in your company? Yes, this also cost a lot of money. The point here is that “avoiding costs” is not the same as “saving money.” The word that differentiates these two sentences is called “investment.” If Google had invested more in their IT infrastructure and replaced all their XP machines with Vista earlier, they would have never been hacked by Chinese hackers. Google’s reputation has been tarnished, and many companies will now hesitate to invest in Google’s cloud infrastructure. Believe me, sticking with XP didn’t really save Google any money.

XP is still supported by Microsoft

Last time I checked, Microsoft still supported XP. Yes. So what? By the way, Windows 2000 is supported until July 2010. Perhaps this is a good reason to downgrade your XP machines to Windows 2000 until then? We don’t know whether Kingsley-Hughes would recommend this. However, we do know that “support” and “support” are two completely different things for Microsoft. “Extended” support until April 2014 doesn’t mean that they will offer more support for XP. It means all you get are security updates. They won’t even fix bugs any more. Hence, if a yet unknown XP bug crashes one of your central apps in 2013, it is unknown but highly uncertain if your company will survive.

Upgrade components to stay secure!

This one surprised me. It appears upgrading third-party components does not lead into the unknown. Perhaps the “certainty argument” only applies to Microsoft software. I don’t know. I have to cite the Google hack incident again to demonstrate how wrong this argument is. Security updates for applications and the operating system are necessary, yes, but by no means are they sufficient to “stay secure.” We are living in a fast-moving world. The number of hackers and crackers out there is increasing every day. To stick with a hopelessly outdated operating system is not only insecure it is also grossly negligent. Besides, if you constantly upgrade your whole IT infrastructure except your operating system, you will run into compatibility issues and be plunged into the “unknown” faster than you can deploy patches.

Do you really need to upgrade?

Kingsley-Hughes suggests that you think about it. Thinking is always good, even if you are exposed to the danger of having to learn more about the unknown. Unfortunately, the result of Kingsley-Hughes’ thinking is also unknown. No, seriously. Don’t even start to think “how those new features will translate into value for the money.” This bad habit has become quite popular lately. The point is that it is absolutely impossible to relate such a complex piece of infrastructure as Windows to the earnings of a company. There is no formula that translates features directly into the value of money. This is why the skippers have such an easy win. If you can’t calculate the exact value of improved security or central management, then there probably is none, they argue. But this is just nonsense. It is a matter of fact that worldwide productivity skyrocketed because of the introduction of IT, and in fact, the accelerating advancements in hardware and software technology still increase productivity year after year at a never seen accelerated pace. Of course, the Windows ecosystem is a major component in this process. Falling technologically behind competitors has never been riskier than in these days. So after evaluating Windows 7 in detail, I can tell you the outcome of my thinking: Yes, you do really need to upgrade.

• What you have to know about Windows 7 SP1 and Windows Server 2008 R2 SP1 (0)
• What’s new in Windows 7 SP1 and Windows Server 2008 R2 SP1 (1)
• Poll results: Will you wait for SP1 before you deploy Windows 7? (8)
• Seven reasons why you need BitLocker hard drive encryption for your whole organization (16)
• Poll: Will you wait for SP1 before you deploy Windows 7? (4)

With this Platform, users won’t allegedly be bothering you any more with trivial issues so you can focus on the more interesting stuff, and CIOs can save costs by reducing help desk staff. It all sounds too good to be true. Unfortunately, these implicit promises in Microsoft’s paper are a bit exaggerated, at least in my experiences with the Windows 7 Troubleshooting Platform.

Troubleshooting security

In my last post, I mentioned two examples where Windows was indeed able to solve two common user problems. However, the Troubleshooting Platform also has some severe limitations. One problem is related to security. Quite a few of the built-in Troubleshooting Packs require admin rights. In such cases the Troubleshooting Wizard will prompt the user for an account with administrator privileges. This is even the case in the simple example of the muted speakers I gave in my last article. Would you really give an end user admin privileges just to unmute speakers?

Troubleshooting the Troubleshooting Platform

I suppose, these problems could be solved with more sophisticated Troubleshooting Packs. Many typical user problems can be fixed with standard users rights. However, this is not my main complaint. I have serious doubts that script-based troubleshooting works for the majority of computer problems. Computers have become far too complex to be mastered with some simple scripts. When I played with the Troubleshooting Platform I immediately encountered simple problems that couldn’t be solved. For example, the Printer Troubleshooting Pack didn’t recognize that my printer simply wasn’t connected. The Networking pack was confused by the fact that I had a third-party VPN solution running, which made it think I have a networking problem.

Since I use Windows 7, the Action Center discovered four different issues. Two of them were not problems at all, and the other two couldn’t be solved by the Troubleshooting Platform. You might argue that this new feature doesn’t have to solve all problems and that it would be already helpful if it can solve a few issues. However, I think, this argument is only valid if the Troubleshooting Platform could solve a significant number of problems.

As long as only a few simple Troubleshooting Packs exist, it is not worth wasting your time with a wizard if you know in advance that the wizard won’t be helpful in 99.99% of all cases, anyway. As things stand now, the Troubleshooting Platform might even increase costs if end users start messing with their systems without being able to solve the problem in most cases.

Troubleshooting approaches

I think, the approach of the FixWin tool, I discussed a few days ago, is much more promising. Instead of letting a script spot computer problems, human intelligence is used to identify a very specific problem and then the script takes over to only change the configuration.

However, I think the Troubleshooting Platform could be useful in some cases. In very limited areas (for example, a third-party application) where typical misconfigurations frequently appear, a Troubleshooting Pack could be a good solution. We will see if ISVs will embrace this new Windows 7 feature and deliver their applications with their own Troubleshooting Packs.

Self-troubleshooting computers

It is not Microsoft’s first attempt to introduce AI-based helpers in their products. Do you remember the funny Office assistants that were dropped in Office 2007 because they were good only for distracting users from their work? I think, it is much too early to introduce problem-solving software in such complex environments.

According to Ray Kurzweil, it will take  another 20 years or so until a common PC is as intelligent as a human being. And this is the minimum of what it takes to be capable of “trial and error computer troubleshooting.” It is common knowledge that even some humans have problems mastering their computers after years of training. So how could software that is far less complex than a grasshopper brain be any better?

• What you have to know about Windows 7 SP1 and Windows Server 2008 R2 SP1 (0)
• What’s new in Windows 7 SP1 and Windows Server 2008 R2 SP1 (1)
• Poll results: Will you wait for SP1 before you deploy Windows 7? (8)
• Seven reasons why you need BitLocker hard drive encryption for your whole organization (16)
• Poll: Will you wait for SP1 before you deploy Windows 7? (4)

For many information workers and IT professionals, solving computer problems feels like nothing more than trial and error. It can be frustrating for users to try to solve their problems, but it can be expensive for corporations to maintain a fully staffed support center. To compound the problem, many support calls involve routine, recurring issues.

Windows® 7 takes steps to address both of these problems with the Windows Troubleshooting Platform, which allows users to solve many common problems on their own and improves Help desk efficiency by allowing IT administrators to extend the platform to solve routine issues that are specific to their environment.

So the main purpose of the Windows 7 Troubleshooting Platform is to make life easier for admins because it enables end users to solve common problems by themselves. The paper even implies that the support staff can be reduced thanks to this new feature. I will say a word or two about this claim in my next post.

But let’s first see how Windows 7 troubleshoots computer problems. The Troubleshooting Platform consists of three components: Windows Troubleshooting Packs, Troubleshooting Engine, and Troubleshooting Wizard.

Troubleshooting Packs

A Troubleshooting Pack is a combination of XML data and Powershell 2.0 scripts that contain the information to solve a specific problem. Windows 7 comes with 22 built-in packs, including (for example) packs for printer or networking issues. New packs can be added through Windows Online Troubleshooting Service (WOTS), and third parties can add their own Troubleshooting Packs for their applications.

The Troubleshooting Engine is just the interpreter for the Troubleshooting Packs, and the Troubleshooting Wizard is the interface that interacts with the user during the troubleshooting process.

Users can launch Troubleshooting Packs from four locations: Control Panel (type “troubleshooting”), Control Panel (System and Security|Action Center), Action Center in the notification area, and links in Windows Help.

You can easily see how the Windows 7 Troubleshooting Platform works by just muting the speakers of your computer and then launching the Audio Playback pack. Windows will correctly detect the problem and unmute the speakers.

Not all problems however can be solved so easily. If Troubleshooting can’t correct the issue, it will offer hints for what you can do next. For example, I launched the Aero pack in virtual machine under VMware Workstation 6.5, and Troubleshooting correctly suggested the use of graphics card that supports Aero.

What admins have to know

If the user can’t solve the problem, an admin can access the Troubleshooting history to see what has been already tried, which may save time in some cases. You’ll find the link to this history in the left-hand navigation pane in the Troubleshooting applet in Control Panel.

Admins may restrict users in launching only their own Troubleshooting packs by signing them with a digital certificate. Troubleshooting Packs are .digicab files that can be distributed just like any other application—that is, you can deploy them through Group Policy and also launch them in unattended mode. The Within Windows blog has a crash course on authoring Windows 7 Troubleshooting Packs, and Microsoft offers more detailed documentation.

The Troubleshooting Platform is enabled by default. If you don’t want your users to mess at all with troubleshooting, you can disable this feature through Group Policy (Computer Configuration – Administrative Templates – System – Troubleshooting and Diagnostics – Scripted Diagnostics). You can also configure through Group Policy if users can download new Troubleshooting Packs via WOTS and whether users can launch only signed Troubleshooting Packs.

In my next post, I will share my opinion about the Troubleshooting Platform.

• What you have to know about Windows 7 SP1 and Windows Server 2008 R2 SP1 (0)
• What’s new in Windows 7 SP1 and Windows Server 2008 R2 SP1 (1)
• Poll results: Will you wait for SP1 before you deploy Windows 7? (8)
• Seven reasons why you need BitLocker hard drive encryption for your whole organization (16)
• Poll: Will you wait for SP1 before you deploy Windows 7? (4)

I wasn’t able to figure out who first used the term GodMode. It is interesting to note that most articles I found try to make it appear as if they discovered this super secret Windows 7 feature. Some attribute it to C’net author Ina Fried, probably because she received more than 2700 diggs for her short article. I think this is also a good example of how silly some of these new social media sites are. Most of the articles that make it to the Digg front page are of comparable profundity. (I suppose this remark means that I will get zero diggs for my own article.)

Now Ina Fried posted a follow up article with “exclusive” information from Microsoft about the GodMode incident. You won’t believe it, there are even more undocumented GodMode folders. Let’s see how many diggs this exclusive article gets. I bothered to try them all. The funny thing is that this exclusive information is rather useless because I will tell you now a real exclusive secret. There are many more GodModes which were not mentioned in this exclusive article. If you right click on one of the icons in the original GodMode folder, and then on “create shortcut”, you will find a shortcut on your desktop which will open one of these subGodMode folders. Shall we call them AngelModes?

Some of these could be helpful, if you have to change the corresponding Windows functions frequently. The majority of these folders is quite unspectacular though. I leave it up to you to decide how god-like they are. To play God yourself, you have to create a folder and name it according to this scheme: GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}. Depending on your religious denomination, you can replace “GodMode” with any term that creates enough awe.

• Why only (I)T will matter (8)
• Poll results: IT employment (2)
• Five tips to persuade management about a new investment in IT (1)
• Poll results – Are IT certifications overvalued? (11)
• What you have to know about Windows 7 SP1 and Windows Server 2008 R2 SP1 (0)

It is possible to offline domain join a computer in an unattended installation. For this, you have to perform the two steps I outlined in my last post, i.e., create the computer accounts in your domain and the blob that contain the meta data. Then, you can add the following section to the unattend.xml:

Unattend.xml

<Component>

<Component name=Microsoft-Windows-UnattendedJoin>

<Identification>

<Provisioning>

<AccountData>Base64Encoded Blob</AccountData>

</Provisioning>

</Identification>

</Component>

“Base64Encoded Blob” has to be replaced with the contents of the blob.txt. Please check out the screenshot below to get an idea what such a blob looks like.

Possible uses of offline domain join

My first thought when I’ve read about the offline domain feature was that this would be a great enhancement for those organizations that buy their PCs with pre-installed Windows 7. You could just send an OS image that has already been domain joined to the PC vendor. Once the new PCs connect to the corporate network, they would be ready for use without the need to join the computer to the corporate Active Directory domain.

However, since you need a different blob for every machine, the OS image alone won’t do it. You have to create the blob files first, and then, the PC vendor has to make sure that each PC receives its own blob. The problem is that the blob has to be included in the unattend.xml. Thus, the procedure is a bit more complicated than automatically assigning computer names to multiple machines because you can’t just number the PCs consecutively or use their MAC addresses as names.

Instead of this, you need a central store for all blob files and to make sure that each PC receives the correct unanttend.xml during deployment. Therefore, your PC vendor has to be prepared for this kind of procedure—which is very unlikely at the moment.

However, I suppose there will be third-party solutions soon to solve this problem. Of course, you could also script a solution for yourself to offline domain join newly-installed machines before you send them to your branch offices.

Smaller organizations certainly can do this manually. The advantage of offline domain join is that no admin has to be locally present when the new machine is deployed; respectively no netdom script with a clear text password is required.

Another way to make use of the offline domain join feature is to deploy virtual machines automatically. As I mentioned in my last post, you can domain join a VM that is offline by just mounting its virtual disk. This allows you to deploy a large number of VMs using scripts without the requirement of rebooting the VMs during the deployment process.

Critique

As useful as this new offline domain feature is, I would have preferred a solution without the need of a special blob for each PC. I don’t see a reason why this shouldn’t be technically feasible. The computer name could be added during the unattended installation. Moreover, the computer account could be created in Active Directory once the computer boots up the first time. This would make the provisioning step obsolete.

I suppose such a solution would make some major changes necessary in the way new machines are added to Active Directory. Considering that the new imaging technology that was introduced with Vista is pre-destined to allow organization to buy computers with pre-installed Windows and applications, it would have been worth the effort. However, I guess, Microsoft is not in the mood anymore for major technical changes after the Vista-bashing media campaigns.

More information about the offline domain join feature can be found at Microsoft’s Technet site.

• Raffle: Blackbird Auditor for Active Directory – Real-time Active Directory auditing (0)
• FREE: ManageEngine Free Active Directory Tools (0)
• Microsoft Exam 70-640 – Operations Masters – Sample question (3)
• Microsoft Exam 70-640 – The Global Catalog – Sample question (0)
• Microsoft Exam 70-640 – The Global Catalog (3)

Requirements

Djoin comes with every Windows 7 and Windows Server 2008 R2 installation. You don’t have to raise the functional level of the Active Directory domain to Windows Server R2, and you don’t need an R2 domain controller since djoin also works with earlier domain controller versions. Because Djoin requires administrator privileges, you have to use the tool on an elevated command prompt. Of course, you also need an account that has sufficient rights to create domain computer accounts.

Two steps

There are basically two steps necessary to offline domain join a computer. First, you have to create the computer account in Active Directory. This process is called “provisioning.” The easiest way to do that is on an R2 domain controller. Djoin will create a base 64-encoded metadata blob as text file. This blob then has to be used to offline domain join the Windows 7 machine.

Provisioning

The command to provision the computer account on an R2 domain controller looks like this:

djoin /provision /domain <domain to be joined> /machine <name of the computer to be joined> /savefile blob.txt

If you don’t have a Windows Server 2008 R2 domain controller, you can run djoin.exe with the /downlevel parameter on a Windows 7 machine that is already a domain member.

Offline domain join

Then you have to copy bob.txt to the computer that has to be joined to the domain and launch this command:

djoin /requestODJ /loadfile blob.txt /windowspath %SystemRoot% /localos

The localos parameter is necessary to run djoin on the computer that is supposed to join the computer. You can also run djoin from a second machine making sure the windowspath parameter points to the system root folder of the destination computer. This is useful if you want to domain join a virtual machine (VM) that is offline. Once the VM boots up, it is already a domain member without requiring a reboot.

There are some additional features which I didn’t discuss in this article. Below is a complete list of all djoin parameters. In my next article, I will discuss how offline domain join in unattended installations works and in what ways this new feature could be used.

Usage: djoin.exe [/OPTIONS]

/PROVISION  – Provision a computer account in the domain /DOMAIN <Name> – <Name> of the domain to join /MACHINE <Name> – <Name> of the computer joining the domain /MACHINEOU <OU> – Optional <OU> where the account is created /DCNAME <DC> – Optional <DC> to target for account creation /REUSE – Reuse any existing account (password will be reset) /SAVEFILE <FilePath> – Save provisioning data to a file at <FilePath /NOSEARCH – Skip account conflict detection, requires DCNAME (faster /DOWNLEVEL – Support using a Windows Server 2008 DC or earlier /PRINTBLOB – Return base64 encoded metadata blob for an answer file /DEFPWD – Use default machine account password (not recommended)

/REQUESTODJ  – Request offline domain join at next boot /LOADFILE <FilePath> – <FilePath> specified previously via /SAVEFILE /WINDOWSPATH <Path> – <Path> to the Windows directory in an offline /LOCALOS – Allows /WINDOWSPATH to specify the locally running OS. This command must be run as a local Administrator. This option requires a reboot for changes to be applied.

• What you have to know about Windows 7 SP1 and Windows Server 2008 R2 SP1 (0)
• What’s new in Windows 7 SP1 and Windows Server 2008 R2 SP1 (1)
• Poll results: Will you wait for SP1 before you deploy Windows 7? (8)
• Seven reasons why you need BitLocker hard drive encryption for your whole organization (16)
• Poll: Will you wait for SP1 before you deploy Windows 7? (4)

I thought this would be an opportune time to document some of the problems I’ve encountered so far in the build of our Windows 7 Standard Operating Environment (SOE). Given that we are moving from a Windows XP/Novell Netware environment, there are a whole raft of changes happening as well as having to deal with problems which were lurking behind the scenes, and that’s what I’ll talk about today.

One of our critical line-of-business applications is an authoritative administration/HR system, with a locally-installed GUI application which talks back to a SQL database. The database is hosted on SQL Server 2005 SP3 x64 which sits on a Windows Server 2003 SP2 x64 system. We started noticing that on the Windows 7 machines, the local GUI took forever to talk back to the SQL database. There were no error messages (irritatingly) but performance was so slow as to be unusable.

Of course, the first assumption is that there’s an incompatibility with the application. It’s not an unreasonable assumption given that any IT pro looking at Windows 7 has been conditioned to expect appcompat problems, particularly with Line of Business (LOB) applications. But on further investigation, performing a simple ODBC connectivity test produced the same performance results – in other words, taking the LOB application out of the equation, the problem was still present.

Next step – three cheers for Wireshark. A packet trace on the Windows 7 machine displayed Kerberos traffic between the client, server and domain controller, with an error from the DC that it was unable to verify the ticket request – KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN. The client and server then renegotiated using NTLM and the connection was made. This was why there were no error messages, but did it explain the slow-down?

The error was due to an incorrect Service Principal Name (SPN) for the SQL server. This can happen when SQL Server is installed and the account used to start the SQL services is either a local or domain user rather than the Local System account. Standard user accounts don’t have the access rights in AD to update SPN records, whereas the Local System account uses the computer account of the server, which does have sufficient rights. Why didn’t this problem emerge before? Even though our XP workstations are connected to both AD and eDirectory, the “functionality” of the Novell Client means that when they talk out across the network, the workstations don’t identify themselves using standard the AD domain\username syntax. As a result Kerberos authentication isn’t attempted.

To update and verify the SPN in AD I used two tools – QUERYSPN.VBS and SETSPN. I ran these from the DC, but you can run them from any domain-joined workstation with an account with sufficient rights to modify AD. To check what information AD returns when queries are made, type in:

cscript queryspn.vbs mssqlsvc*

This queries AD for all instances of SQL server. If the SQL services on the problematic server are being started with a local/domain user account, the query should return something like:

CN=Username,CN=Users,DC=domain.com

Class: user

User Logon: Username

MSSQLSvc/servername.domain.com:1433

If this is not returned (as it wasn’t in my case), use SETSPN to create the service name:

SETSPN –S MSSQLSvc/servername.domain.com:1433 username

Using –S instead of –A will check for duplicate entries before adding the SPN. Also, this assumes that the SQL server is using the default port of 1433. If not, use whichever port is appropriate. Run QUERYSPN.VBS again and the correct result should be returned. Allow AD replication to take place and then restart SQL services.

I then ran another packet trace with Wireshark and the Kerberos issue was resolved, but the speed problem was still present (depressingly). Then, when remotely connected from home I noticed that the Windows server which hosts the SQL server was quite sluggish compared to the other systems I was connected to. This triggered a memory of something which cropped up when Windows Vista first came onto the scene, whereby Server 2003-based systems were very slow to respond to networking requests from operating systems later than Windows XP, and this was also a problem in Server 2003 SP2.

Turned out to be a simple registry fix on the server:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableTCPA=1

Change this to EnableTCPA=0, reboot the server and all the performance issues were resolved. Phew!

So the moral of this particular tale is that if you’re planning a Windows 7 deployment, then depending on your environment there may be hidden problems which Windows 7 will uncover, but for which the operating system itself isn’t necessarily the cause. As our deployment progresses I’ll keep bringing you our discoveries.

Until next time…

• What you have to know about Windows 7 SP1 and Windows Server 2008 R2 SP1 (0)
• What’s new in Windows 7 SP1 and Windows Server 2008 R2 SP1 (1)
• Poll results: Will you wait for SP1 before you deploy Windows 7? (8)
• Seven reasons why you need BitLocker hard drive encryption for your whole organization (16)
• Poll: Will you wait for SP1 before you deploy Windows 7? (4)

To demonstrate how easy it is, I have created an OpenSearch connector for 4sysops. After you have downloaded the OSDX file (right click to save the file), you have to double click it. Windows will ask you if you want to add this search connector. Of course ! Windows Explorer will then display a new shortcut named “4sysops”in the Favorites section in the navigation pane. To search 4sysops, you can now use the Windows Explorer if you click on this icon.

The search results page looks better than in Vista. The search term is highlighted in the title and the excerpt. On the right hand pane, you can see the author’s name, the publication date, and the tags. Double clicking on a search result will open the corresponding page in your default web browser.

Just in case you want to delete the 4sysops search connector (which I don’t believe you will), you’ll find all installed connectors in the user profile (c:\users\[user name]\searches). The shortcut in the Windows Explorer Favorites has to be removed as well.

Creating a search connector is fairly simply. The OSDX file for 4sysops looks like this:

<?xml version=”1.0″ encoding=”UTF-8″?> <OpenSearchDescription xmlns=”http://a9.com/-/spec/opensearch/1.1/”> <ShortName>4sysops</ShortName> <Description>4sysops – For Windows Administrators</Description> <Language></Language> <Url type=”application/rss+xml” template=”http://4sysops.com/index.php?feed=rss2&amp;s={searchTerms}”/> </OpenSearchDescription>

I think, the XML file is mostly self-explanatory. The interesting parameter is the template variable. OpenSearch uses RSS or Atom XML for providing search results. In WordPress (the blog engine on which 4sysops runs), a query URL that produces RSS as output looks like this: http://4sysops.com/ ?feed=rss2&s=applocker. In this example, I searched for “applocker”. Notice that you have to replace “&” with “&amp;” in the OSDX file.

As you can see, it is quite simple to create your own search connectors for Windows 7. Of course, things will get more complicated if your CMS or repository does not support RSS or Atom-based search results. Also note that my example is very simple. More information about Windows 7 Federated Search can be found here.

• What you have to know about Windows 7 SP1 and Windows Server 2008 R2 SP1 (0)
• What’s new in Windows 7 SP1 and Windows Server 2008 R2 SP1 (1)
• Poll results: Will you wait for SP1 before you deploy Windows 7? (8)
• Seven reasons why you need BitLocker hard drive encryption for your whole organization (16)
• Poll: Will you wait for SP1 before you deploy Windows 7? (4)

So you either have to buy an external DVD drive or you make your USB stick bootable and copy the ISO image on it. As nobody wants to spend 60 bucks on buying an external DVD drive just for installing their shiny new OS most prefer the second option. Manually making the USB stick bootable is a pain though. Fortunately there are some applications available which exactly do that for you.

If you just want to install Windows 7 Microsoft offers the tool Windows 7 USB/DVD Download Tool (WUDT). In four steps it creates a bootable USB stick. All you need is an ISO image of Windows 7 and a USB stick bigger than 4 GB. At the moment you can’t download the tool directly from Microsoft, because it may violate the GPL. However, you can download it from various other sites, e.g. here. Despite its name you can also use it to install Windows Server 2008 and Vista.

If you sometimes want to try different OSes there is an application which usage is as easily as the WUDT but not limited to Windows 7. It’s called UNetbootin. For some Open Source OSes you don’t even need to download the according ISO file manually, it’s automatically done by the tool. You can see a partial list of supported OSes on the screenshot below, a full list is available here. Not only common Linux Distributions are supported, you can also find different Unix and Dos distributions.

• What you have to know about Windows 7 SP1 and Windows Server 2008 R2 SP1 (0)
• What’s new in Windows 7 SP1 and Windows Server 2008 R2 SP1 (1)
• Poll results: Will you wait for SP1 before you deploy Windows 7? (8)
• Seven reasons why you need BitLocker hard drive encryption for your whole organization (16)
• Poll: Will you wait for SP1 before you deploy Windows 7? (4)

1 Drag and drop to the command prompt

Daniel Petri discovered that drag and drop to the command prompt is back in Windows 7. This allows you to copy a file’s path to the command prompt.

2 Pin files to a taskbar button

Paul Thurrott mentioned this tip. To associate a file with a certain application, you can drag and drop its icon to the corresponding taskbar button. You can then open this file from the app’s Jumplist.

3 Dual Boot with Bitlocker

Keith Comb explained how you can encrypt your system drive with Bitlocker and still boot from a VHD. This is useful for dual boot environments

4 Revive the Quick Launch bar

I already mentioned this tip in a post about the Windows 7 taskbar. In my view, taskbar pinning is not really a good replacement for the Quick Launch bar. However, both ways for quickly launching applications complete one another.

5 Revive the Windows 3.1 File Manager

Mitch Tulloch talked about this tip in an interview at the Microsoft Press blog. You probably know that the new Aero Snap feature allows you to resize an application window to half screen by dragging it to the left or right side of the desktop. There are certainly many situations where this feature could be useful, but the one I like most is that it allows me to open two Explorer windows side-by-side this way. Mitch Tulloch refers to the Windows 3.1 File Manager, but this style of copying files reminds me of the good old Norton Commander under DOS.

6 Start Windows Explorer from My Computer

I found this tip in a list of 70 Windows 7 tricks (many of them already work for Vista). The Explorer in Windows 7 opens by default from the Libraries folder. If you want to start the Explorer with the My Computer page, you have to replace the shortcut target with %SystemRoot%\explorer.exe /root,::{20D04FE0-3AEA-1069-A2D8-08002B30309D}. Note that you can also open any other folder by just adding the corresponding path as a parameter to the launch command. For example, if you want Windows Explorer to start in C:\Program Files, the target for the Windows Explorer icon would look like this: %SystemRoot%\explorer.exe “C:\Program Files”

7 Make use of hotkeys

Windows has countless keyboard shortcuts and Windows 7 received a few more. It makes sense to skim over the list of Windows 7 hotkeys at least once. Perhaps you will find a key combination that improves your productivity. My favorite new Windows 7 hotkey is “Windows logo key +Down arrow”. It minimizes the active window.

Of course, there are myriads of other useful Windows 7 tips out there. I am curious to know which ones are your favorite tips.

• What you have to know about Windows 7 SP1 and Windows Server 2008 R2 SP1 (0)
• What’s new in Windows 7 SP1 and Windows Server 2008 R2 SP1 (1)
• Poll results: Will you wait for SP1 before you deploy Windows 7? (8)
• Seven reasons why you need BitLocker hard drive encryption for your whole organization (16)
• Poll: Will you wait for SP1 before you deploy Windows 7? (4)