General on Remko's Blog

Blog improvements

Tue, 07 Feb 2017 15:56:21 +0000

When I started this blog in 2007 (wow that’s almost 10 years ago) I went for a cheap web hoster with a reasonable performance to host it.

In the beginning performance was acceptable but over the years it has degraded and of course user experience standards have changed.

I decided it was time to do something about it so I’ve moved the blog from a shared platform to my own server.

This server is running on optimized flash storage where most writes are DeDuplicated and never actually hits the flash disks:

Shodan, search engine for IoT or hackers delight?

Sat, 14 May 2016 15:36:22 +0000

Today I stumbled upon Shodan, a search engine for devices and services.

I decided to search for Citrix and this was the first page of results:

It's interesting to see that we get details such as the name of published applications. But it's possible to get even more details:

Debugging Tools for Windows Direct Download

Thu, 13 Jun 2013 15:57:38 +0000

Since some time Microsoft no longer offers the Debugging Tools for Windows as a standalone download.

You need to download the SDK installer and download from there.

This sort of annoys me since I sometimes need to install WinDBG quickly for some troubleshooting.

HDMI Output in Black & White

Wed, 05 Jun 2013 21:50:37 +0000

I connected my Dell laptop to my TV via HDMI and the picture on the TV was in Gray scale instead of Color.

I had connected my laptop before and it worked fine so I knew that my TV and the HDMI cable were working correctly. I had recently updated the drivers for my NVIDIA graphics card so I went into the NVIDA Control Panel.

MSCOMM32.OCX returns error 80040112

Wed, 13 Mar 2013 15:58:39 +0000

Yesterday I wrote about troubleshooting an application that used Com Port redirection in Citrix.

During the troubleshoot I noticed that the application used an ActiveX component, MSCOMM32.OCX, for serial communication.

I wanted to quickly test if the component was correctly registered so I searched the registry from HKEY_CLASSES_ROOT for mscomm32.ocx.

Wordpress and the Cookie Monster

Thu, 03 Jan 2013 15:19:19 +0000

As you are probably aware the EU has made legislation regarding the use of cookies on websites. This new legislation is active since May 2012.

The Dutch government has also issued legislation in the Telecommunications LAW which states that you must ask the user for permissions before server out cooking. Unless these cookies are necessary for the correct technical working of the website or service. This leaves some grey areas but for instance using Google Analytics is a clear case of a situation where opt-in is required.

Although I am not using Google Analytics I wanted to check what cookies my own blog was serving out and if it was necessary to ask for an opt-in.

Modify VB Executable to force Taskbar Button

Sat, 04 Aug 2012 11:07:18 +0000

I had to troubleshoot an application that was published with Citrix XenApp. The problem with this application was that it didn't have an button/icon in the taskbar and the window would sometimes disappear.

I noticed that this (cr)application was written in Visual Basic, so I decided to run it through a decompilation tool.

The decompiler was able to list the forms used in the Application:

Could not load file or assembly 'System.Configuration'

Wed, 18 Jul 2012 13:43:06 +0000

Today I was asked to troubleshoot an executable that didn't work correctly on Windows XP Embedded.

On startup it displayed the following message:

text Download

Unhandled Exception: System.IO.FileNotFoundException: Could not load file or ass
embly 'System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b0
3f5f7f11d50a3a' or one of its dependencies. The system cannot find the path spec
ified.
File name: 'System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyTok
en=b03f5f7f11d50a3a' ---> System.IO.DirectoryNotFoundException: The system canno
t find the path specified. (Exception from HRESULT: 0x80070003)

I verified that System.Configuration.dll was present (in C:\Windows\Microsoft.NET\Framework\v2.0.50727).

Excel 2010 multi-threaded calculation

Fri, 08 Jun 2012 13:21:19 +0000

I was just browsing through the Options tab in Excel 2010 when I noticed the following setting:

This feature was introduced in Excel 2007.
In the default settings, multi-threaded calculation is Enabled with "Use all processors on this computer".

On a physical desktop this would be the preferred setting since it will make formula calculation as fast as possible.

Reset Root Password on Linux Virtual Appliance

Tue, 27 Mar 2012 10:52:19 +0000

I needed to login as root on a Linux based virtual appliance to do some troubleshooting. In my case the appliance was running Suse Linux Enterprise.

I booted the VA using the Ubuntu Live CD and opened a Terminal. Then I used the cfdisk tool (sudo cfdisk /dev/sda) to view the partitions:

Imprivata fails to logon with special characters in the password

Wed, 14 Mar 2012 15:19:08 +0000

Interesting case today: customer uses Imprivate for two factor logon in combination with Citrix XenApp.

Users reported that logons failed after they had changed their password. After contacting the users we learned that this only happened with special characters in the password like ! and +.

To do the actual logon to Citrix Imprivata uses an executable which is actually an AutoIT script compiled to an executable.

After authentication the executable get's the password from the Imprivata Appliance.

I decompiled the executable to source and read the line that passes the password to XenApp:

Run multiple instances of Lync 2010–POC

Tue, 06 Mar 2012 19:27:23 +0000

This video shows that's it's possible to run multiple instances of the Lync 2010 client.

I am running natively, so I am not using ThinApp or App-V.

I will follow this up later with a how-to blog.

Running Multiple Instances of Lync 2010

1 Comments

FaeLLe Oct 9, 2012
So how did you manage it mate?

Shutdown option on the logonscreen with Imprivata Onesign

Tue, 21 Feb 2012 16:12:12 +0000

I logged remotely to a server with RDP and I noticed that I had options to restart or shutdown that server. This means we can shutdown or restart a server without physical access and without authentication:

The XLSploit explained

Sun, 12 Feb 2012 23:36:34 +0000

Recently I published a Proof of Concept that showed it was possible to launch unauthorized processes with both AppSense Application Manager and RES Workspace Manager.

Although I didn’t test Microsoft Applocker I have no doubt at all that we couldn’t bypass it.

I have named my Proof of Concept the XLSploit because I am using Excel as a trampoline. I choose Excel because this is generally a trusted process and VBA offers access to the Windows API that is needed.

After publishing the XLSploit I have talked to both RES and AppSense and not that they both have a response to my Proof of Concept, I consider it safe to tell a little more about how it works.

If you are merely interested in stopping the XLSploit, please scroll down to the end of the article.

The case of the Slow Xerox Universal Print Driver

Wed, 04 Jan 2012 22:54:29 +0000

Earlier this week I was asked to investigate a problem with the Xerox Universal Printer Driver. Users complained that printing to a Xerox printer was much slower than printing to an HP printer.

I received a reference document from a user, a rather complex Excel sheet. When selecting multiple tabs it took almost a minute to generate a print preview in Excel 2007 running on Windows 2003 with XenApp 5.

I was aware of a bug in the Xerox Universal Driver where almost 9.000 files were copied into the user's profile directory (I wrote about that in an earlier post). But this seemed to be another problem.

System Process PID 4 is listening on port 80

Mon, 02 Jan 2012 10:23:21 +0000

I wanted to save the SHSH signatures from my iPhone before updating to iOS 5.01. I started Tiny Umbrella but it showed an error indicating that there's already a process listening on port 80:

I verified this using netstat (netstat -aon | find /I "LISTENING" | find /I ":80"):

McAfee Anti Virus Unlock User Interface Password

Fri, 09 Dec 2011 15:50:12 +0000

I needed to change a few settings on a McAfee VirusScan Enterprise 8.7.Oi client. However there was a password protection in place that locks the user interface and nobody around that could tell me the password. So what to do?

Right, we check out where this password is stored and how we can get rid of it!

I openend vsplugin.dll in Ida Pro and searched for related strings such as password, lock etc.

Dutch Citrix User Group Launched

Thu, 01 Dec 2011 09:51:29 +0000

A while ago I was invited for a presentation at the UK Citrix User Group. I went there together with my colleague Ingmar Verheij and we had a great day there.

I was impressed with what I say there, a community that was very much alive and with good discussions. It was clear that the UK Citrix User Group was doing very well, thumbs up for their Steering Group!

So Ingmar and I wondered why there was no active Dutch Citrix User Group in The Netherlands. There had been an initiative in the past, the DUCUG so we decided to see if we could revive it.

Determining if Battery Backed Write Cache is installed

Tue, 15 Nov 2011 16:27:42 +0000

I wanted to know if a certain server had a Battery Backed Write Cache module (BBWC) on it's array controller.

I suspected it did not, but I had to be sure. Since this server was running production I couldn't open (Visual Inspection) or reboot it.

The server didn't have Insight Agents installed so I couldn't query it via iLO or the Insight Agents webpage either.

I knew that when you do a full install of the array controller bundled software it comes with a commandline tool, hpacucli.exe.

Installing Dell Wireless 5530 HSPA Mini PC #2

Sun, 13 Nov 2011 20:20:51 +0000

In a Comment on my Article "Installing Dell Wireless 5530 HSPA Mini PCI", Florian asked how to Install Dell's R298998 driver on non authorized system and card combinations.

I decided to have a look and downloaded this driver. The structure isn't much different from the R251153 driver I described in my earlier post.

When installing it on a non authorized card/laptop combination the error is similar:

When the error message appeared I looked into the temp folder and I noticed that just like before 2 folders were created (with a GUID as name). One of these folders contained the file driver_auth.exe which, as I already knew, performs the actual validation.

RNS510 firmware has new startup logo’s

Fri, 02 Sep 2011 19:32:48 +0000

I didn't notice it before but the new RNS 510 firmware (3810/3814/3816/3818) has a new startup logo for the Volkswagen firmwares:

Changing the RNS 510 startup logo

Wed, 31 Aug 2011 17:20:18 +0000

I wrote earlier about the startup logo's on the Volkswagen RNS 510 navigation.

Today I can finally tell you that I succeeded!
I changed the startup logo to the logo from the MFD2 DVD as you can seen on this picture:

RNS 315: Enable the hidden bluetooth carkit

Fri, 26 Aug 2011 14:37:13 +0000

The Volkswagen RNS 315 Navigation has a builtin Bluetooth carkit which is disabled by default. I am not sure why, I presume this is done because VW also sells carkits that integrate into the MFD.

The builtin carkit can be enabled using VCDS like this:

RNS 315 Enable Developer Mode

Fri, 26 Aug 2011 14:24:19 +0000

I recently had some time to play with VCDS and a friend's RNS 315 navigation. By default there is no test mode or hidden menu with extra features like on some other Volkswagen systems.

Using VCDS we can however (temporarily) enable the Developer mode.

W3 Total Cache influences WP-PostViews counter

Tue, 28 Jun 2011 21:14:10 +0000

I have used the WP-Postviews Wordpress plugin for a while to keep track of the number of times my blog posts are being read.

But after installing the W3 Total Cache plugin I noticed that the read counters weren’t properly updated anymore. I figured this was a consequence of using a cache.

Renaming and hiding object in PowerPoint

Fri, 20 May 2011 11:26:59 +0000

I was working on a PowerPoint presentation that included screenshots that were using the Appear animation. I use it to only show a particular screenshot when I am actually talking about it.

However when editing the slide, the screenshots hide the slide text which makes it difficult to edit it.

And in the Animation Pane the pictures are shown as Picture1, Picture2 etc.

So I wanted two things;

Rename the object to a more meaningfull name in the Animation Pane
Hide the screenshots when I want to edit the text in the slide.

VW RNS 510 Navigation Startup Pictures

Wed, 04 May 2011 21:06:43 +0000

A while ago I started exploring the firmware of an RNS510 Navigation unit. The RNS510 is an OEM navigation system, manufactured by Continental Automotive and is used in several models of Volkswagen, Seat and Skoda Cars

When the units is booting it shows a startup logo and I wanted to replace this logo with my own picture.

HP Smart Array controller previous lockup code 0xAB

Thu, 28 Apr 2011 11:47:51 +0000

I ran into an error when I was upgrading hardware on an HP BL460c G6 Blade.

After placing 2 new (larger) hard drives the Array Configuration would hang after saving the configuration (It just kept blinking "Saving Configuration." forever.

dUP2 Patcher update

Sun, 27 Mar 2011 21:31:24 +0000

A missing feature in the dUP2 Patch Generator has always been to correct the PE Checksum.

After all if you write a clever search&replace patch but have to include the PE Checksum it doesn't make any sense.

But then I saw there's a beta version of dUP2 that supports ome new features one of them being a fix checksum option!

AES-NI Benchmarks

Fri, 11 Mar 2011 11:35:20 +0000

As you may know, recent Intel processors have an extension to the x86 instruction set called Advanced Encryption Standard Instruction Set (AES-NI).

AES-NI is basically hardware support for AES based encryption and because I had a chance to run some benchmarks on differing systems I was curious what the impact of AES-NI would be.

I used TrueCrypt for running the benchmarks because this is a real life application and it had support for AES-NI.

I first ran the benchmark on a laptop with an Intel Core2 DUO (P9700 2,80 GHz):

The next system was an Intel Core i7 Q740 (Quad Core with Hyperthreading, so 8 in total) machine.

Office Communicator 2007 R2 crashes after sign on

Thu, 10 Mar 2011 15:45:45 +0000

After I uninstalled Office 2010 64 bit and installed Office 2010 32 bit I had a problem with Office Communicator 2007 R2.

After entering my password and clicking sign in it crashed every time:

In the EventLog an Application Error was recorded with some additional error info:

Event Type: Error Event Source: Application Error Event Category: (100) Event ID: 1000 Date: 10-3-2011 Time: 15:20:52 User: N/A Computer: remkolaptop Description: Faulting application name: communicator.exe, version: 3.5.6907.221, time stamp: 0x4cddcd9f Faulting module name: KERNELBASE.dll, version: 6.1.7601.17514, time stamp: 0x4ce7bafa Exception code: 0xc06d007e Fault offset: 0x0000b727 Faulting process id: 0xf94 Faulting application start time: 0x01cbdf2e592fc53c Faulting application path: C:\Program Files (x86)\Microsoft Office Communicator\communicator.exe Faulting module path: C:\Windows\syswow64\KERNELBASE.dll Report Id: 9a4e3adf-4b21-11e0-8f0f-c0cb38a92f9b For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The exception code is 0xc06d007e which is defined in WINERROR.h as ERROR_MOD_NOT_FOUND, the error description is: "The specified module could not be found".

Office 2010 cannot remove registry key

Thu, 10 Mar 2011 14:12:22 +0000

I have worked with Office 2010 x64 for a while now but because of compatibility issues I wanted to remove it and install the x86 version instead.

After uninstall Office left a key in the registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common\SmartTag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}

I couldn't remove it so I figured there was a specific process that had opened this key but couldn't find anything (using Process Explorer).

Then I checked the permissions on the Office key but it was set to Full Control for Administrators.

The case of the intermittent hangs

Mon, 14 Feb 2011 13:20:40 +0000

Yesterday I had some intermittent hangs on the family pc, and old Medion MD-8800 PC.

Since there was no crash and thus no crash dump, there was nothing to debug.

I suspected a hardware issue and opened the pc and I noticed that there was an enormous amount of heat.

Move WSUS content folder

Wed, 02 Feb 2011 11:15:55 +0000

I needed to relocate the WSUS content folder because it was placed on the C Drive (even though there was a 2nd 150 GB Data Partition) to prevent WSUS from filling up the OS Drive.

Unfortunately there doesn't seem to be a GUI option to do that, all Google searches lead to a GUI option for Small Business Server.

Using Synctoy in Data Migrations

Mon, 31 Jan 2011 11:39:03 +0000

In every project I do I will have to migrate data at some point. This usually involves three types of data:

Home Directory Data
Workgroup Data (eg office documents)
Application Data (not database but flat file data belonging to applications such as templates and documents).

Home Directory Data is usually a flat copy although I tend to filter out the garbage (temp files and such).

Workgroup data usually needs to be cleaned up so it involves some kind of data mapping (folder x goes to place y).

Application Data is usually a flat copy from old to new location but often there are things like ini files that are adjusted and we don’t want to overwrite that.

Saving Password in Office Communicator

Thu, 27 Jan 2011 15:50:27 +0000

If you want to be able save the password in Office Communicator you must create the key HKLM\Software\Microsoft\Communicator or on x64 OS HKLM\Software\Wow6432Node\Policies\Microsoft\Communicator and set the DWORD value SavePassword to 1.

Now you will have the Save my password checkbox (which will save the encrpted password to HKCU\Software\Microsoft\Communicator\AccountPassword

The case of the UPS discovery not working

Mon, 24 Jan 2011 15:22:03 +0000

I am doing a project involving a Citrix Xenapp environment running on VMWare vSphere.

The physical machines are powered by two Eaton Uninterruptable Power Supplies that both a network card.

I received some documentation that describes how to implement automatic shutdown in a VMWare vSphere environment.

This documentation describes that a vSphere Management Assistant (vMA) must be deployed in which we need to install some software from Eaton.

I followed the documentation that even described the needed iptables rules needed for their software.

In the last step a discovery is done and the UPS is supposed to be found. And you have probably guessed by now: it didn’t!

At first I figured that maybe the iptables configuration was still too tight so I stopped the iptables service but that didn’t help.

The case of the Annotations Toolbar

Mon, 17 Jan 2011 22:24:22 +0000

I got some interesting questions from a user today regarding TIFF images on a Windows 2003 based Citrix environment.

This user has an application that works with scanned documents and for each document exists both a pdf and a tiff version in the application.

By default the TIF (and TIFF) file extensions are linked to the Windows Picture and Fax Viewer in Windows 2003.

The user told me that some time ago she had an extra toolbar where she could perform some extra operations such as making a selection on TIFF images.

At some point in time this mysterious Toolbar disappeared and she was never able to get it back. She reported this to the helpdesk and the system administrator but they were unable to resolve this.

I hadn’t hear of this toolbar before but a Google Search led me to this page which explains the toolbar in question which is called the Annotation Toolbar.

Self Signing Word Macro’s

Wed, 12 Jan 2011 15:45:51 +0000

Today I noticed that a recently added Application to the Citrix Test environment added a Macro to the Office Startup directory.

When a user launches Word he will get a popup because the Template (.dot file) was not signed:

It would have been a lot easier if Application Vendors sign their stuff because in that case I could have just added the certificate using Group Policy (yesterday’s post describes how to do this).

Application Vendors usually tell you that you should lower the Macro security in Office (or Word in this case) to Low to get rid of this message. But I think there’s a better solution: we will sign the .dot file ourselves!

New Categories

Sun, 09 Jan 2011 21:03:24 +0000

I added some new Categories to the Blog, something I should have done a long time ago.

I also tried to add missing Categories to existing posts but I didn’t check all posts ever written so feel free to add a comment to this post if you miss a category or that a certain post is properly categorized.

Fixing Applications: The Next Step

Fri, 07 Jan 2011 14:39:55 +0000

Lately I wrote a few articles about fixing bad applications using Compatibility Shims. If you didn’t read them yet, here are the links:

I also described that you can install an Application Compatibility Database using the sdbinst command.

At first I just took a script task in my Altiris Server to deploy the database using sdbinst -q <dbname> but later on I got a better idea.

Paging file and Memory Dump

Fri, 07 Jan 2011 13:45:55 +0000

I often hear that people configure the Paging File (on Citrix or Terminal Servers) on a seperate volume but, the reasons is either performance or the chance that the Paging File might corrupt the volume.

However if at some point you would like to create a Memory Dump you must have a paging file on the boot volume.

Modify Internet Explorer 8 MUI Pack to install a single language

Mon, 03 Jan 2011 12:10:22 +0000

Today I wanted to install the Dutch Language pack for Internet Explorer 8, the Dutch language comes as part of the Windows Internet Explorer 8 MUI Pack (in my case the version for Windows Server 2003 SP2).

If you install the MUI Pack you will always end up with all 35 (!) languages installed. This behaviour is the same as the language pack for Internet Explorer 7 that I wrote about earlier (see Modifying Microsoft Updates and/or hotfixes)

The solution is really the same as for the IE7 language pack: you modify the inf file (in my case update_srv03.inf) but if you run update.exe it will refuse to use your modified inf file:

So we need to patch update.exe to accept your modified version!

Wordpress monthly archives broken

Sat, 01 Jan 2011 19:44:20 +0000

I noticed that the monthly archives on my blog were not working. I first thought it was a problem with the .htaccess file but it was correct.

I also tried resetting the permalinks option in Wordpress to default an back but that did help as well.

My favorite KB Article

Wed, 15 Dec 2010 14:07:53 +0000

The previous post reminded me of my all time favourite knowledge base article from Compaq titled: "Where do I find the "Any" key on my keyboard?"

It's still in archive.org: http://web.archive.org/web/20070627063024/http://www29.compaq.com/falco/detail.asp?FAQnum=FAQ2859

Script to register ASP.NET in IIS

Fri, 26 Nov 2010 12:37:01 +0000

I did an unattended install of the Citrix WebInterface on a testmachine and it failed with error 258.

The logfile clearly indicates the reason:

[ ERROR ] com.citrix.wi.install.SetupErrorReporter: Error 258 occurred: ASP.NET 2.0 must be registered and enabled in Microsoft Internet Information Services before the Web Interface can be installed.

We can register ASP.NET in IIS with the Aspnet_regiis.exe tool that comes with the .NET framework.

The commandline would be:

Unattended Visual J# Install returns error 4122

Fri, 26 Nov 2010 11:53:30 +0000

This means you are installing the wrong edition, eg x86 version on an x64 OS.

All available version are listed on the MSDN Visual J# Redistributable Packages page.

Disabling Java Autoupdate

Wed, 24 Nov 2010 16:07:28 +0000

I did an unattended install of Java Jre1.6_0.22 using an mst file that puts all (auto)update properties to off.

However it seems that Java simply ignores this, so usually a script runs after the install to the delete some registry keys and perform some extra configuration.

silly issue with DHCP reservation on Netgear WNDR3700 router

Thu, 23 Sep 2010 16:32:44 +0000

I recently bought a new router, a Netgear WNDR3700 and I noticed a silly bug. When you make a DHCP reservation in the webinterface it will present a list of existing clients which makes it easy to add them to the reservation list.

This seems to work fine at first but when I checked my IP with IPConfig I noticed that I received a different address. I checked the router’s log and saw this:

[DHCP IP: 192.168.2.29] to MAC address 00:21:5c:9a:a0:99, Thursday, September 23,2010 14:03:59

I noticed that the MAC address was lowercase here and not uppercase as in the webinterface. I changed the case in the webinterface and then it worked fine!

The poor man's e-mail archiving solution

Fri, 18 Sep 2009 12:11:36 +0000

My work e-mailbox is hosted on an Exchange server and is very limited in size (only 100 MB) so I use a PST file to archive mail when it’s full. This has of course several disadvantages such as possible corruption on the PST and some limitations. I open my mailbox from severals places: Outlook on my laptop, Outlook Web Access remote (no PST available in OWA), Outlook from my Virtual Desktop (no PST since it’s located on my laptop) and so on.

Then I got the idea to create a seperate GMail account and use that for archiving. I added the new account as IMAP mailbox in Outlook and create some folders & subfolders in it:

Modifying Microsoft Updates and/or hotfixes 2

Tue, 21 Jul 2009 22:54:54 +0000

In a previous post I wrote about patching update.exe to allow installing updates with modified .inf files.

A commenter asked how to do this for another build of update.exe, specifically version 6.3.4.1 as is distributed with Windows 2003 SP2 (now what would he want to do with it?).

This is actually a very easy task with the knowledge of the previous post, so let me explain it here step by step.

First we open the target file in Ida and wait for the Autoanalysis to finish. Then go to the Functions window and look for the function IsInfFileTrusted:

Patch Vista's Kernel to Address more than 4 GB of Memory

Tue, 23 Jun 2009 16:33:03 +0000

As you may know the 32 bit, also called x86, editions of Windows Vista cannot address more than 4 GB of memory. You may think this 4 GB is a limit of the processor but this isn’t true; using Physical Address Extension (PAE) it’s possible to address more memory

Enterprise Server versions of Windows (2003 and 2008) can already address more than 4 GB of memory so why can we not do that with Vista? The answer is: Microsoft doesn’t want that! It is all just a licensing matter, we can see this in the registry. Take RegEdit and goto HKLM\CurrentControlSet\Control\ProductOptions and doubleclick the Value ProductPolicy, scroll down a little until you see the value “Kernel-PhysicalMemoryAllowedx86”, next to it is the value 01 00 which corresponds to 4096 (1000 is the Hex of 4096):

We can also see where this (and other licensing values) come from: if we look in %systemroot%\system32\licensing\ppdlic al license values are in XML files. The memory value is in Kernel-ppdlic.xrm-ms:

Dell Systems Build and Update Utility DVD

Mon, 15 Jun 2009 16:58:17 +0000

I was installing Dell Deployment Solution (the Dell branded version of Altiris) and at end of the installation you can choose to add drivers for scripted installed. If you do it asks for the Dell Systems Build and Update Utility DVD in order to install drivers for scripted install:

I searched on the Dell site for this DVD but the only version I could find was a version of 20-11-2008 (5.5.1 AA00) with the filename OM_5.5.1_SUU_A00.ISO and it is not accepted by the installer:

What a helpfull message ;-)

Modifying Microsoft Updates and/or hotfixes

Tue, 12 May 2009 13:53:34 +0000

As you might know Microsoft distributes updates and hotfixes with in installer, update.exe. When you run update.exe it looks into the supplied .inf files to see what it has to install. It’s not possible to make changes to the inf files however because that will invalidate it’s signature (and update.exe checks the signature that is stored in an accompanying .cat file).

In my case I wanted to deploy the MUI pack for Internet Explorer 7 to be able to support multiple languages. By default this pack installs 35 (!) languages and I wanted to install only Dutch language on top of existing English.

Unable to get System PTE individual lock consumer information error when using !sysptes 4 in WinDbg

Thu, 16 Apr 2009 16:07:07 +0000

A few days ago I was troubleshooting some strange problems on a Citrix Server. After some investigation (I will write about that later) it was clear to me that there was a shortage of System Page Table Entries (PTE’s). Using perfmon you can see how many free System PTE’s are available:

Any value below 5000 is not good, values below 2000 are critical. In my case it wasn’t possible to view processes with Task Manager anymore.

Next I used WinDbg and attached to the Kernel (you can do that with File | Kernel Debug | Local | OK) and issued the !vm command:

WinDbg shows us a warning that a lot of PTE allocations have failed, we can also see that there’s enough Paged Pool and Non Paged Pool available.

So how do we find the guilty driver (usually it’s a driver)?

Sending Ctrl-Alt-Del / Simulate SAS in Windows Vista

Mon, 30 Mar 2009 21:51:48 +0000

Existing code to simulate the Secure Attention Sequence (SAS),which most people refer to as control alt delete or ctrl-alt-del, no longer works in Windows Vista. It seems that Microsoft offers a library that exports a function called SimulateSAS(). It is not public and one is supposed to request it by sending a mail to saslib@microsoft.com. Mails to this address remain unanswered though.

Preventing Domain Group Policies from Applying

Wed, 25 Feb 2009 13:31:11 +0000

I was just researching a little on how Group Policies are applied in Windows Vista. The client processing is actually done by the Group Policy Client Service. So can a user prevent Domain Policies from being applied by stopping this service?

If you go to the service properties you can see that even a local administrator cannot stop or disable the service:

The description says: “The service is responsible for applying settings configured by administrators for the computer and users through the Group Policy component. If the service is stopped or disabled, the settings will not be applied and applications and components will not be manageable through Group Policy. Any components or applications that depend on the Group Policy component might not be functional if the service is stopped or disabled.”

That sounds good! Let’s try it…

Accessing kernel objects in other sessions part 2

Tue, 03 Feb 2009 14:36:53 +0000

In part 1 I showed how to create and open objects in Terminal Server Sessions. However, these are not all of the possible places where you can place objects via documented kernel32.dll functions.

If we look into Winobj again, we notice, that every BaseNamedObjects directory has a subdirectory named Restricted. To be honest, I do not know why it’s created; it’s security allows object creation for LocalSystem and RESTRICTED special user (in windows 2000, Everyone can also create objects in it). So, we can use it as prefix for object creation, for example, Restricted\MyAppEvent:

Of course, you can still use Global, Local, or Session links

Accessing kernel objects in other sessions part 1

Tue, 27 Jan 2009 19:43:52 +0000

As you know, many kernel32.dll functions, which are working with named objects, like OpenEvent, can be used to work with global and local objects. So what are global and local objects? Global objects are created in session 0 and are actually located in the \BaseNamedObjects directory, while local objects are created in the caller’s session (for example in the \Sessions\5\BaseNamedObjects directory (for session 0, global and local has no meaning since they point to the same object)). MSDN says that you can access only the objects in your own session(via the Local</strong> prefix) and in session 0 (via the Global</strong> prefix). But what if you need to access an object in another session?

Windows XP x64 Terminal Server Patch part 2 (optional)

Fri, 16 Jan 2009 00:32:05 +0000

In part 1 I’ve showed how to get rid of some terminal server restrictions on Windows xp x64. But there are still some problems:

You cannot connect to the localhost (127.0.0.1) (but can to 127.a.b.c, where a,b,c in [0..255] (except 127.0.0.0 and 127.255.255.255)).

When you’re connecting to remote server, Remote Desktop Connection (mstsc.exe) checks through mtscax.dll that you’re connecting to your own address, connections are only allowed and you’re in the server mode. If this is not true, the connection is denied, usually with this message: . The logic of checking is the same: call gethostbyname for server name and check if it’s not equal to 127.0.0.1.

Windows XP X64 Terminal Server patch part 1 (mandatory)

Fri, 19 Dec 2008 13:58:17 +0000

Windows XP X64 shares the same binaries with Windows 2003 X64, but Terminal Server has some restrictions on XP. This article shows you how to get rid of them and is based on cw2k ideas from the original Windows XP Terminal Server patch.

Version 1.1 contains bug#1 fix and is smaller (less bytes are changed).

1) Winlogon.exe contains a function, called EnumerateMatchingUsers which in turn calls IsProfessionalTerminalServer function. We need to patch this function to return zero (false):

.text:0000000100042F77 IsProfessionalTerminalServer proc near ; CODE XREF: EnumerateMatchingUsers:loc_10002B44Bp .text:0000000100042F77 ; DATA XREF: .pdata:00000001000D01DCo ... .text:0000000100042F77 .text:0000000100042F77 VersionInformation= _OSVERSIONINFOW ptr -138h .text:0000000100042F77 var_20 = word ptr -20h .text:0000000100042F77 var_ 1E = byte ptr -1Eh .text:0000000100042F77 var_18 = qword ptr -18h .text:0000000100042F77 .text:0000000100042F77 48 81 EC 58 01 00 00 sub rsp, 158h => 31 C0 C3 xor eax, eax; retn .text:0000000100042F7E 48 8B 05 F3 3A 08 00 mov rax, cs:__security_cookie .text:0000000100042F85 48 89 84 24 40 01 00 00 mov [rsp+158h+var_18], rax .text:0000000100042F8D 48 8D 4C 24 20 lea rcx, [rsp+158h+VersionInformation] ; void * .text:0000000100042F92 33 D2 xor edx, edx ; int

Globally disable Flash Player autoupdate

Fri, 19 Dec 2008 09:06:16 +0000

On a Citrix or Terminal Server you will want to disable autoupdate notifications of the flash player.

This can be done by creating a file mm.cfg in the folder where the flash ActiveX control is installed (normally C:\Windows\System32\Macromed\Flash).

Place the following line in this file (with a text editor like Notepad):

Converting a volume name to a device name

Wed, 10 Dec 2008 15:41:42 +0000

Windows has a couple of different formats for volume names but it is unclear how to convert a Volumename (example: \?\Volume{GUID}) to a DeviceName (example: \Device\HarddiskVolume1).

I found at that you can use the QueryDosDevice function but you need to remove the preceeding \?\ and the trailing \ of the VolumeName:

Commandline tool to change drive letter assignment

Tue, 09 Dec 2008 15:13:27 +0000

One of the side effects of using sysprep to prepare an image is that drive letter assignments are reset to default. This behaviour is documented in a knowledge base article.

I previously solved this by running a diskpart script but that needed a custom script for each system (if the disk or partition order differs the script needed to be adjusted). So I needed to run a restore with sysprep determine the drive layout after sysprep, change the script, test by restoring again. So I wrote a commandline tool that can change a drive letter assignment based on the volume label.

Windows 2003 X64 Terminal Server Patch

Tue, 09 Dec 2008 13:53:39 +0000

A while ago I published a patch for Windows 2003 Terminal Server that allows more than 2 concurrent sessions in Remote Administration mode.

Today I publish the same patch but for Windows Server 2003 X64. The patched function (CRAPolicy::Logon) is the same as in the original patch.

New Universal Patch Method

Tue, 09 Dec 2008 12:50:23 +0000

Up until now I used VPatch for all my patches. The disadvantage of VPatch is that it uses strict MD5 hash checks. This means that a patch can only be applied to exactly the same file the patch was based on (exact same build and language).

Because many people are asking for patches for other builds and languages I decided to move over to another patch mechanism. This will use search & replace on specific Hex bytes.

The consequence is that patching another build or language version is possible. However there is no absolute certaintity that the patch will work on other builds or languages. Ofcourse the patcher will only patch if the specific bytes were found which is safer than patching an offset.

It’s up to the user to carefully test the patched file and hopefully report back to me if it’s working.

Now I will describe how to use this universal patcher.

Microsoft Tech-Ed IT Professionals 2008

Fri, 24 Oct 2008 13:02:38 +0000

So I will be attending the Tech-Ed EMEA in Barcelona, maybe some of you are going too?

It would be nice to meet some of my readers, so maybe I’ll see you there!

Application crashes while opening helpfile

Thu, 23 Oct 2008 13:48:35 +0000

I had an application that crashed when opening the Help Topics entry from the Help menu. A trace with Process Monitor showed that it was opening a help (.chm) file. Using Explorer I could normally open the Helpfile so thas was strange. Process Monitor did not reveil any ACCESS_DENIED or other problems.

I did notice that ieframe.dll was being accessed several times and some further debugging revealed that a dll in the application directory was loaded (psapi.dll). This is strange because psapi.dll resided in the windows\system32 folder normally. Also the copy in the application directory was an old version (4.0.1371.1).

Registry editing has been disabled by your administrator (not anymore!)

Tue, 12 Aug 2008 23:09:32 +0000

Most administrator will want to prevent normal users from opening Regedit and a command prompt. Usually this is done by activating the “Prevent access to registry editing tools” and “Prevent access to the command prompt” policy settings. They are located under User Configuration | Administrative Templates | System:

Activating the policies will set the matching keys in the registry:

If we try to open regedit we are denied access:

So how does this work?

Resuming Microsoft's (Akami) Download Manager

Sun, 22 Jun 2008 08:51:09 +0000

If you ever download software from Microsoft's Volume Licensing Site you have probably seen that it uses the Akamai download manager. Sometimes your downloads get interrupted but how to restart the downloadmanager? There's no entry in the startmenu and not even an icon on the desktop.

Citrix Solutions Conference 2007

Thu, 08 Nov 2007 15:01:24 +0000

Yesterday I attended the Citrix Solutions Conference in Antwerp. Brad Pedersen (Chief Architect and Senior Fellow at Citrix Systems) held an interesting speech about The End User Experience. I liked especially liked the part about the history of Citrix and the early versions of their products like Wincredible and Winframe. Since Brad wrote the original code for Citrix and thus Terminal Server (the stuff that is in winsta.dll now) I hoped he could share some info with me on the undiscovered parts of winsta.dll. Unfortunately Brad could not do this because of a non disclosure agreement with Microsoft. He did tell me that Citrix is pushing Microsoft to make more Terminal Server API’s public. I presume that’s why Vista and Windows 2008 offer some new API’s which I wrote about earlier.