Vista on Remko's Blog

The publisher could not be verified when launching an application with RES Workspace Manager

Fri, 13 Sep 2013 15:35:25 +0000

Today I was troubleshooting a warning message that popped up when launching a network application with RES Workspace Manager:

Usually this is a simple fix: add the servername (file://server) to the Local Intranet zone:

That worked when I launched the application directly. However when launching the application with RES Workspace Manager I would still get the warning. Even stranger: when I clicked Cancel the application would still be launched.

My Network Places Internals

Thu, 19 Jul 2012 11:26:12 +0000

I am using a PowerShell script to copy some elements of from the users old profile location to a new location. This includes the Nethood ("My Network Places") folder which contains the Network Places shortcuts.

A user reported that she could not save documents to Network Places anymore and after inspection the Network Places shortcuts were broken.

I started comparing the old Nethood folder to the new and observed the following difference in Explorer:

When copying entries from the Nethood folder with Explorer manually they worked fine, so somehow Explorer gives the Nethood folder special treatment.

Switching to the Services Session

Fri, 24 Feb 2012 14:49:21 +0000

Just read a tweet from @andyjmorgan about Interactive Service Detection. This made me remember that it's possible to switch to the Session 0 with an undocumented api in winsta.dll.

For this API to work you must have the Interactive Services Detection (UI0Detect) service running.

Remote Registry from 32 to 64 bit

Fri, 21 Oct 2011 09:05:11 +0000

Yesterday I needed to set a few registry keys remotely from a 32 bit windows machine to a 64 bit machine.

I used reg.exe to set the key but even though it returned success the key wasn't altered.

As I suspected the key was written to the Wow6432Node. In the help I couldn't find any switch to force reg.exe to use the 64-bit view.

On a 64 bit machine this is not a problem since both 32- and 64 bit versions of reg.exe exists. The 32 bit version of reg.exe defaults to the 32 bit view and the 64 bit version defaults to the 64 bit view.

But luckily reg.exe has a switch (that is not listed in the help) to force the View:

GetUserObjectInformation fails with Access Denied

Tue, 16 Aug 2011 21:11:01 +0000

Today I was reusing some old (pre vista) code the retrieves the Logon SID that I wrote a few years ago. The Logon SID is a special SID that identifies a logon session that has the form S-1-5-5-X-Y.

You can view your Logon SID with Process Explorer, right click a GUI process, select Properties and goto the Security Tab:

GetTokenInformation with TokenLinkedToken returns error 1312

Thu, 11 Aug 2011 11:30:47 +0000

The GetTokenInformation function can be used with the TokenLinkedToken Information Class on Windows Vista and higher to the linked (Elevated) token.

This is useful when User Account Control is enabled and you want to launch an elevated process e.g. from a service.

Programmatically Check if User Account Control is Enabled

Thu, 11 Aug 2011 11:27:13 +0000

Snippet below can be used to programmatically determine if User Account Control is enabled:

objectpascal Download

uses
 JwaWinbase, JwaWinNt;

function IsUACEnabled: Boolean;
var
 hToken: THandle;
 tet: TOKEN_ELEVATION_TYPE;
 dwSize: DWORD;
begin
 Win32Check(OpenProcessToken(GetCurrentProcess, TOKEN_QUERY, hToken));
 // TokenElevationType class only available on Vista+
 Win32Check(GetTokenInformation(hToken, TokenElevationType, @tet, SizeOf(tet), dwSize));

 Result := tet <> TokenElevationTypeDefault;
end;

1 Comments

GetTokenInformation with TokenLinkedToken returns error 1312 Aug 11, 2011
[...] specified logon session does not exist. It may already have been terminated.”So you should check if User Account Control is enabled in such cases (or make this error non critical).share: Bookmark on Delicious Digg this post [...]

SasLibEx Screencast

Wed, 19 Jan 2011 22:36:44 +0000

I just recorded a SasLibEx Screencast, it shows some of the very powerfull features of SasLibEx.

The following features are shown:

Simulate Ctrl Alt Del (Secure Attention Sequence)
Cancel Ctrl Alt Del
Lock Workstation
Unlock Workstation (without credentials)
Disable Ctrl Alt Del
Enable Ctrl Alt Del again
Cancel pending UAC request
Is Desktop Locked

SasLibEx Feature Demo #1

1 Comments

Tweets die vermelden SasLibEx Screencast | Remko Weijnen's Blog (Remko's Blog) -- Topsy.com Jan 20, 2011
[...] Dit blogartikel was vermeld op Twitter door Remko Weijnen, Remko Weijnen. Remko Weijnen heeft gezegd: First #SasLibEx ScreenCast! showing simulate ctrl alt del, unlock workstation without credentials, disable cad and more http://bit.ly/fFM8wB [...]

Cannot Access Files, But Need the Origin?

Mon, 03 Jan 2011 09:52:20 +0000

Have you developed an application that accesses files and may stop because a file cannot be accessed but you need to?

Since Windows Vista it is possible to find out the name of the application which holds open a file.

Desktop Icons, hide, show, prevent rename or delete

Sun, 19 Dec 2010 15:14:04 +0000

I was cleaning up some old data on my Hard Drive when I found a program I wrote about a year ago.

At that time I was doing a project where I was deploying a Windows 2008 based Citrix Environment.

I wanted to get rid of the new Personal Folders or User’s files icon on the Desktop and replace it with the familiar My Documents icon.

These settings are stored in the Registry under HKEY_CLASSES_ROOT\CLSID{folder’s GUID}\ShellFolder.

Active Directory Properties Commandline Tool

Sun, 12 Sep 2010 21:56:01 +0000

I have written a small commandline tool that shows the Active Directory Property Sheet for a given account.

The Property sheet is what you get when you doubleclick an object in Active Directory & Computers. Basically this tool is meant to make it easy to quickly view or change properties without needing to start a GUI tool and looking up the account in the AD Tree.

Having fun with Windows Licensing

Tue, 15 Jun 2010 15:09:14 +0000

If you look into the registry in the key HKLM\System\CurrentControlSet\ProductOptions you will find several licensing related Values.

The ProductType and ProductSuite keys contain the OS Suite and Edition, but the ProductPolicy key is much more interesting. So let’s have a closer look at it, open RegEdit and DoubleClick the key, you will something like the screenshot below, a Binary Value:

As you can see the license names are there as a Unicode string and later on I will show you how we can read the values. But because I didn’t want to extract all the names manually I decided to see if I could reverse the used structure because it didn’t look very complicated. Using a Hex Editor I could determine the important part of the structure.

Did you make a SasLibEx enquiry? And... news!

Mon, 22 Feb 2010 14:07:28 +0000

My hoster has had some problems with the simulatesas.com domain that I use for SasLibEx enquiries. If you have sent mail to that has not been answered I kindly request you to send it again.

I would also like to briefly tell you about an upcoming new release of SasLib, version 2.0. There is so much I would like to tell you about it but I will limit it to a few highlights here and save the rest for the upcoming website on SimulateSAS.com.

Getting Back the Classic Event Viewer in Vista and Windows 7

Thu, 26 Nov 2009 13:15:55 +0000

I never liked the new eventviewer that was introduced with Windows Vista. If you want to have the old eventviewer back (you can use the old and new one together) you need to follow the following steps:

Open a command prompt as Adminstrator.
Type Regsvr32 els.dll (if you get error code 0x80070005 then you didn't run as Administrator).
Start mmc.exe and goto File | Add/Remove Snapin.
From the available Snapins choose "Classic Event Viewer".
Right-Click Classic Event Viewer under Console Root and select New Window from Here.
Choose Customize from the View menu.
Deselect the Action Pane and Click OK
Now save the file with a name of your choice eg EventVwrC.msc.

It should look like this:

Removing the Uninstall or change a program button from the Explorer Command Bar

Wed, 25 Nov 2009 10:52:13 +0000

Windows Vista introduced the Command Bar in Explorer which is sometimes also referred to as the Folder Band or the Task Band. The Command Bar is of course also present in Windows 7 and Server 2008 (R2).

This Command Bar shows possible tasks or actions depending on the active folder. I wanted to remove the “Uninstall or change a program” (in Dutch this is called “Een programma verwijderen of wijzigen”) button from the Computer view:

Save Explorer settings without Logging off

Mon, 16 Nov 2009 16:42:12 +0000

This is more a note to self because I always forget. Explorer holds all it’s settings in memory so if you change a settings through the GUI (like in Folder Options) you cannot use a tool like Process Monitor to see what the corresponding registry entry is.

Adding a Printer Connection with an alternative driver

Mon, 16 Nov 2009 10:59:13 +0000

I needed to add a printer connection to a Citrix server but the problem was that this printer had a buggy driver. I wanted to use an alternative driver such as the Citrx Universal Printer driver but on Terminal Server you might want to use the Terminal Services Easy Print driver.

So I decided to make something that could be used in both situations, the result is a small commandline tool called AddPrinter2 (sorry I am not good in finding original names).

It takes 2 parameters: the printername as unc path and the driver name. An example would be:

AddPrinter2 “\server\printer” “Citrix Universal Printer”.

Patch Vista's Kernel to Address more than 4 GB of Memory

Tue, 23 Jun 2009 16:33:03 +0000

As you may know the 32 bit, also called x86, editions of Windows Vista cannot address more than 4 GB of memory. You may think this 4 GB is a limit of the processor but this isn’t true; using Physical Address Extension (PAE) it’s possible to address more memory

Enterprise Server versions of Windows (2003 and 2008) can already address more than 4 GB of memory so why can we not do that with Vista? The answer is: Microsoft doesn’t want that! It is all just a licensing matter, we can see this in the registry. Take RegEdit and goto HKLM\CurrentControlSet\Control\ProductOptions and doubleclick the Value ProductPolicy, scroll down a little until you see the value “Kernel-PhysicalMemoryAllowedx86”, next to it is the value 01 00 which corresponds to 4096 (1000 is the Hex of 4096):

We can also see where this (and other licensing values) come from: if we look in %systemroot%\system32\licensing\ppdlic al license values are in XML files. The memory value is in Kernel-ppdlic.xrm-ms:

SasLibEx updates

Tue, 07 Apr 2009 08:40:36 +0000

I have found and tested some new functionalities which I will add to SasLibEx:

Unlocking workstation without entering password
Cancel UAC (User Account Control) request
fully disable Ctrl-Alt-Del
Cancel Ctrl-Alt-Del
Switch between secure desktop (where the UAC prompt is) and the normal desktop.

Some people asked if SasLibEx works on x64 or Windows 7, the answer is yes. I tested on build 7000 of Windows 7 beta and also on Server 2008 x64.

5 Comments

Simulate ctrl-alt-del in Windows Vista | RemkoWeijnen.nl May 18, 2009
[...] SasLibEx updates | RemkoWeijnen.nl April 7th, 2009 at 8:41 2 [...]

Sending Ctrl-Alt-Del / Simulate SAS in Windows Vista

Mon, 30 Mar 2009 21:51:48 +0000

Existing code to simulate the Secure Attention Sequence (SAS),which most people refer to as control alt delete or ctrl-alt-del, no longer works in Windows Vista. It seems that Microsoft offers a library that exports a function called SimulateSAS(). It is not public and one is supposed to request it by sending a mail to saslib@microsoft.com. Mails to this address remain unanswered though.

Preventing Domain Group Policies from Applying

Wed, 25 Feb 2009 13:31:11 +0000

I was just researching a little on how Group Policies are applied in Windows Vista. The client processing is actually done by the Group Policy Client Service. So can a user prevent Domain Policies from being applied by stopping this service?

If you go to the service properties you can see that even a local administrator cannot stop or disable the service:

The description says: “The service is responsible for applying settings configured by administrators for the computer and users through the Group Policy component. If the service is stopped or disabled, the settings will not be applied and applications and components will not be manageable through Group Policy. Any components or applications that depend on the Group Policy component might not be functional if the service is stopped or disabled.”

That sounds good! Let’s try it…

TSAdminEx Features Part 3

Wed, 25 Feb 2009 13:08:31 +0000

Beta Release

Part 1

Part 2

This is part 3 of the TSAdminEx Features series. Today I will discuss the Process View. As usual we will start by comparing TSAdmin to TSAdminEx again. So let's look at TSAdmin Process View:

And the one from TSAdminEx:

TSAdminEx Features Part 2

Tue, 24 Feb 2009 10:17:07 +0000

Part1

Now that a TSAdminEx beta is ready I will be showing you some features. In this part I will show the Sessions View.

Let’s start again with a compare of TSAdmin and TSAdminEx:

As you can see TSAdminEx shows more details, it shows the following extra columns:

TSAdminEx Features Part 1

Mon, 23 Feb 2009 16:18:28 +0000

Part 2

Now that a TSAdminEx beta is ready I will be showing you some features. In this part 1 I will be comparing the Users view to TSAdmin.

Let’s start TSAdmin, this tool is present by default on Windows 2003. If you use Windows XP or Windows Vista you can get it by installing the Administration Pack. Please note that TSAdmin does not work on Vista RTM due to a bug that was corrected in Vista SP1 (TSAdminEx works fine on both RTM as well as SP1)

Now let’s open TSAdminEx and start comparing…

TSAdminEx Beta release

Fri, 20 Feb 2009 17:59:06 +0000

Over the last months I have been working hard on TSAdminEx and now, finally, I can now present a first beta release.

If you don’t know what TSAdminEx is let me briefly introduce it. TSAdminEx is a tool that combines functionality of several existing tools: it has the power of task manager combined with the details of Process Explorer and the Terminal Server support of TSAdmin. On top of that it fully supports remote systems out of the box without installing any agents or services. It also has some unique features that neither of the mentioned tools can do!

Several new features have been implemented since the last time I talked about TSAdminEx and I will show you the most exciting ones here:

RDP Session with Local Taskbar visible

Sun, 02 Nov 2008 08:16:42 +0000

I usually have lots of Terminal Server sessions open when I’m working, both direct sessions but also “sessions in sessions”. In order to keep overview on my desktop I prefer to make the session size as big as possible without being full screen (so keep my local taskbar visible).

If I run a session in a session I do this again, this makes switching sessions very easy and you can always see which session you are in:

Registry editing has been disabled by your administrator (not anymore!)

Tue, 12 Aug 2008 23:09:32 +0000

Most administrator will want to prevent normal users from opening Regedit and a command prompt. Usually this is done by activating the “Prevent access to registry editing tools” and “Prevent access to the command prompt” policy settings. They are located under User Configuration | Administrative Templates | System:

Activating the policies will set the matching keys in the registry:

If we try to open regedit we are denied access:

So how does this work?

Multiple Concurrent Terminal Server Sessions On Vista SP1

Sat, 14 Jun 2008 23:35:44 +0000

There are several patched terminal server dll’s floating around in the net to allow multiple concurrent Terminal Server session on Windows Vista with Service Pack 1. But they all have the same limitations:

It’s not possible to start a session to Localhost, this is because the Terminal Server client does a check to see if you are running Personal Terminal Server (Vista/XP) and denies Localhost or 127.0.0.1 if true (127.0.0.2 works though).

Using Windows Server 2008 as a SUPER workstation OS

Sun, 06 Apr 2008 23:35:48 +0000

Vijayshinva Karnure wrote a very cool article about running Server 2008 as a desktop os or rather as a Windows Vista replacement. It seems that besides additional features like Hyper-V, Server 2008 runs approx. 20% faster than Vista.

If only upgrading Vista to Server 2008 would be possible… (has anyone ever tried)?

Microsoft Remote Server Administration Tools released

Wed, 26 Mar 2008 20:59:20 +0000

Microsoft has releaseed the Remote Server Administration Tools (RSAT) for Vista SP1. RSAT enables IT administrators to remotely manage roles and features in Windows Server 2008 from a computer running Windows Vista with SP1. It includes support for remote management of computers running either a Server Core installation or the full installation option of Windows Server 2008. It provides similar functionality to Windows Server 2003 Administration Tools Pack.

Vista SP1 changes to Terminal Server API

Sun, 02 Mar 2008 15:31:55 +0000

In a previous article I wrote about changes in utildll in vista that breaked compatibality for Terminal Server. Even though release notes for Service Pack 1 don’t indicate changes or fixes in this area my testing shows that Microsoft has taken over the Windows 2008 implementation of utildll to Vista.

TSAdminEx Progress

Sun, 27 Jan 2008 23:04:07 +0000

I just wanted to show some of the progress that I made in development of TSAdminEx. I thought the best way would be to show some screenshots. Which reminds me I installed a nice Javascript to enlarge the thumbnails, click to see it…

Using WTSWaitSystemEvent

Fri, 25 Jan 2008 18:02:13 +0000

If you develop an application for Terminal Server you might want to react on session events. This means that your application is notified when a user logs on, logs off or becomes idle. This can be done with the WTSWaitSystemEvent function. Implementing it is rather simple and could look something like this:

Why TSAdmin crashes on Windows Vista

Wed, 19 Dec 2007 21:38:39 +0000

Have you ever tried running the Terminal Server Administration tool (aka TSAdmin) on Windows Vista? You would need it to remotely administer windows 2000/2003 Terminal Servers. If you try to run it you will get an Access Violation but why? I found the answer to this question today because I was testing my TSAdmin replacement on different Windows versions. Just like TSAdmin I use an (undocumented) function from Utildll.dll called ElapsedTimeString. It’s a very simple function that returns a formatted elapsed time string (as seen in the Idle time column from TSAdmin).

Multiple Terminal Sessions in Windows Vista

Wed, 21 Nov 2007 18:09:47 +0000

There were 2 ways (known to me) of extending Windows XP to offer mulitple concurrent Terminal Sessions. One with the RC1 version of XP SP2 and one that patches Winlogon and Termsrv.dll. The latter offers not only multiple sessions but also multiple sessions under the same account and sessions to the local machine.

New Terminal Server API's in Vista SP1

Tue, 30 Oct 2007 22:19:25 +0000

The upcoming Vista SP1 promises 3 new Terminal Server API functions:

WTSConnectSession : Connects a Terminal Services session to an existing session on the local computer.
WTSStartRemoteControlSession: Starts the remote control of another Terminal Services session.
WTSStopRemoteControlSession : Stops a remote control session.

If you look in the Windows 2008 beta you can see that the functions are already implemented (in WtsApi32.dll):

Atheros AR5007EG - Bad WLAN performance

Tue, 16 Oct 2007 17:55:54 +0000

A friend bought a new Toshiba Satellite L40 laptop which came with Windows Vista preinstalled. The wireless connection (via the built in Atheros AR5007EG card) was very unstable and sometimes unable to connect to the access point. When connected internet speed was very slow, sometimes unable to open pages at all. First we tried replacing the preinstalled Toshiba drivers with the latest from the Toshiba site and later on the most recent from Atheros (which can be found here). Both drivers didn’t improve the speed.
Solution: