Windows 2003 on Remko's Blog

ClickOnce Applications in Enterprise Environments

Mon, 05 Aug 2013 16:51:21 +0000

ClickOnce is a Microsoft technology that enables an end user to install an application from the web without administrative permissions.

That's great isn't it?
While ClickOnce may sound great to developers it's actually a nightmare for Enterprise administrators because they try to prevent users from installing software themselves.

ClickOnce also incorporates an Automatic Updates mechanism which means that users might run different or not tested/approved versions...

Virtual Environments
It get's even worse in virtual environments such as VDI and SBC where machines are often non-persistent. Each time the users starts the application they will see a screen similar to the one below while they actually download and install it over and over again:

If the environment is persistent, it's not guaranteed that the user works on the same machine each day. This means that the application will be installed on every box the user ever logs onto...

How does it work?
In order to understand how we can best treat ClickOnce applications we need to understand how they work since MSDN documentation does not describe this in detail.

The case of the COM Port Redirection

Mon, 11 Mar 2013 14:53:44 +0000

One of my colleagues asked me to assist in troubleshooting an application called SmartWare FM running on Citrix XenApp.

This application reads data from an external device called SECUTEST.

The device is connected to a COM port which is redirected to the XenApp session. In contrast to Microsoft Remote Desktop Services COM ports are not automatically redirected in XenApp but need to be mapped via eg a logonscript (NET USE COM1: \\Client\COM1:) or using UEM.

In my case the COM port was mapped with RES Workspace Manager:

Trick to Export Private Key from Certificate Request

Fri, 28 Dec 2012 15:51:13 +0000

I noticed something interesting today: I needed to generate a Code Signing certificate from a Windows 2003 CA Server.

However the default Code Signing Template does not allow us to export the private key. I found a nice trick however that enables us to request a code signing certificate WITH private key.

To do this I first needed to enable the Code Signing template on the CA Server. This can be done using the Certification Authority MMC Snap-in: right click on the Certificate Templates node and select New | Certificate Template to Issue | Code Signing:

Return username instead of computername to Applications

Thu, 06 Dec 2012 10:45:40 +0000

Some applications use the computer's name as a unique identifier, rather than using the user name. In a single-user-per-computer environment, this strategy works well.

However, in a Multi User environment such as Citrix XenApp or Microsoft's Remote Desktop Services (Terminal Server), all connected users report the same computername.

If the application relies on unique computernames to handle tasks such as file and record locking, then the application will fail.

We can however set an Application Compatibility Flag in the registry to return the username instead of the computername.

To demonstrate this behaviour I wrote a small Test Application called TestAppCompatFlags.exe.

Replacing WFP Protected files

Wed, 05 Dec 2012 15:33:45 +0000

On Windows 2000, XP and Server 2003 a mechanism called Windows File Protection (WFP) is used to protect system integrity.

How does WFP Work?
Inside SFCFILES.DLL a list of files is kept that are monitored for changes. When a monitored file gets deleted, modified or overwritten WFP will restore the original from one of the following locations:

Cache Folder (%systemroot%\System32\DllCache)
Network Installation Path
Windows CD (or i386 folder on harddisk)

But what if we need to replace such a file? You could write a batch file that copies the modified file to the cache folder, installation path and destination. And this may work if it's quick enough.

A more reliable method is to use an undocumented export from sfc_os.dll called SfcFileException (only exported by ordinal #5).

Screen flickering with PowerPoint 2010 on Citrix XenApp

Fri, 30 Nov 2012 14:18:22 +0000

Within half an hour of writing the article "Application causes Screen Flickering in Citrix XenApp Session" I got a message that the hotfix in that article also fixes a similar problem in PowerPoint 2010.

Office 2010 uses hardware acceleration for displaying images and when this is enabled (which is the default) you will see constant screen flicker when you try to display a presentation with Images on Citrix XenApp (Server 2003):

Screen Flickering when running WPF Applications on Citrix XenApp

Application causes Screen Flickering in Citrix XenApp Session

Fri, 30 Nov 2012 13:28:54 +0000

Yesterday I was asked to troubleshoot an interesting issue with an application running on Citrix XenApp.

Environment
This customer is running Citrix XenApp 5 on Windows Server 2003 (x86). On the Client Side the Online Plugin version 12.3 is used.

The Problem
When this particular application was active the screen was flickering and black blocks appeared at seemingly random places. Further more it was not possible to resize the window:

My experience is that display issues are often related to either HDX Flash Redirection (offloading flash to the client) or the Multi Monitor hook.

My Network Places Internals

Thu, 19 Jul 2012 11:26:12 +0000

I am using a PowerShell script to copy some elements of from the users old profile location to a new location. This includes the Nethood ("My Network Places") folder which contains the Network Places shortcuts.

A user reported that she could not save documents to Network Places anymore and after inspection the Network Places shortcuts were broken.

I started comparing the old Nethood folder to the new and observed the following difference in Explorer:

When copying entries from the Nethood folder with Explorer manually they worked fine, so somehow Explorer gives the Nethood folder special treatment.

Edit Document requires a Windows SharePoint Services-compatible application

Fri, 09 Mar 2012 14:23:11 +0000

Today I was troubleshooting a message that appeared when a user tries to edit a document from SharePoint on a Citrix XenApp server.

The user browsed to a word document on Sharepoint and selected “Edit in Microsoft Office Word” from the Combobox:

This would present the following error message to the user:

Session freeze when starting Excel

Mon, 20 Feb 2012 15:42:25 +0000

Environment
Windows 2003 Enterprise (32 bit), Citrix XenApp 5, RES Workspace Manager 2011, McAfee VirusScan Enterprise 8.7.0i.

Problem
When a opening an Excel workbook from Sharepoint the whole session freezes.

I asked the user to open an Excel workbook from Sharepoint and I noticed the following popup:

So my first thought was that the user somehow clicked this message to the background and IE was waiting for a response.

Harmony Client crashes upon exit

Tue, 31 Jan 2012 16:37:08 +0000

Today I was troubleshooting the application "Harmony Client" which crashed upon exiting:

The application had been thinapped and the error only appeared when starting the thinapped version.

Bypassing RES/Appsense Application Security

Fri, 27 Jan 2012 16:15:38 +0000

The video below shows a Proof of Concept of bypassing Application Security in RES Workspace Manager .

Please note that at this time the code is not publicly available so please don’t ask for it.

EDIT 2: I added a video that I received from someone who tried my Excel Sheet with AppSense Application Manager.

EDIT: I wanted to clarify a couple of things regarding this post.

First of all I would like to explain why I wrote this code and why I choose to test it with RES WM.

I had the idea about this approach a long time ago but I never got around to actually do it. The main reason was that I needed to convert Delphi code to VBA and especially converting some Windows headers was a lot of work. Then suddenly I noticed that someone had already converted the headers, so I all I had to do was rewrite the code that used it to VBA.

The choice for RES was made because of two reasons:

If you want to beat something, you want to beat the best and I most certainly consider RES WM to be one of the top products.
At the time I wrote the POC code I had access to an enviroment with RES in it.

I would like to emphasize that RES contacted me very quickly after publishing this blog. I've had contact with RES and they showed a very constructive approach with their primary goal being a fix or guidance for their customers. Hats of to RES taking a constructive approach and I will be working together with RES on this issue.

Finally I would like to state that I didn’t expect this post to draw this much attention, if I did I would have probably taken another approach.

The case of the Slow Xerox Universal Print Driver

Wed, 04 Jan 2012 22:54:29 +0000

Earlier this week I was asked to investigate a problem with the Xerox Universal Printer Driver. Users complained that printing to a Xerox printer was much slower than printing to an HP printer.

I received a reference document from a user, a rather complex Excel sheet. When selecting multiple tabs it took almost a minute to generate a print preview in Excel 2007 running on Windows 2003 with XenApp 5.

I was aware of a bug in the Xerox Universal Driver where almost 9.000 files were copied into the user's profile directory (I wrote about that in an earlier post). But this seemed to be another problem.

NTVDM encountered a hard error

Wed, 14 Dec 2011 21:41:22 +0000

Today I troubleshooted an old DOS application that needed to run on a 32 bit Citrix XenApp Server. The last time I saw an actual DOS application in a production environment must be years ago.

When starting the application, the WOW subsystem (NTVDM) crashed with the message: "NTVM encountered a hard error.":

After spending some time troubleshooting I remembered a similar issue from a few years ago where a DOS application worked fine from the Console but refused to work from an RDP or ICA session.

Remote Registry from 32 to 64 bit

Fri, 21 Oct 2011 09:05:11 +0000

Yesterday I needed to set a few registry keys remotely from a 32 bit windows machine to a 64 bit machine.

I used reg.exe to set the key but even though it returned success the key wasn't altered.

As I suspected the key was written to the Wow6432Node. In the help I couldn't find any switch to force reg.exe to use the 64-bit view.

On a 64 bit machine this is not a problem since both 32- and 64 bit versions of reg.exe exists. The 32 bit version of reg.exe defaults to the 32 bit view and the 64 bit version defaults to the 64 bit view.

But luckily reg.exe has a switch (that is not listed in the help) to force the View:

Windows 2003 Server Standard memory patch

Sun, 27 Mar 2011 21:42:17 +0000

So a few days ago I got new memory for a development box - an upgrade from 4 to 6 GiB (later on even 8 GiB). Much appreciated as you can imagine. After dismissing the BIOS warning about changed amount of memory (oh really? :mrgreen:), I booted into Ubuntu and happily looked at the memory stats. After that I booted into Windows (a Windows 2003 Server Standard, but I’ll just use Windows from here on) and was disappointed to see only 4 GiB available. This is apparently a limitation specific to the Standard edition.

After some pouting, I decided to take action. Of course one of my first thoughts was to ask Remko, because he had done similar things for some other Windows versions. He pointed me to MmInitSystem, which was not an immediate hit, though. I loaded my kernel .exe into a disassembler to look at the details, but MmInitSystem was a lengthy and rather boring function. However, the advice was good and got me a good bit closer, especially when Remko also mentioned the use of ExVerifySuite in the logic that would set the limits. So I brought up the references to ExVerifySuite and - surprise surprise - only seven other functions used it and out of these only one was not recognized by name from the exports and debug symbols. And since the inspection of that function (at 0x00615FB0 in my kernel) proved that it was being called from MmInitSystem, this was an immediate hit.

Windows 2003 align OS disk

Mon, 14 Mar 2011 15:11:48 +0000

If you read one of VMWare's Best Practices Guides (in my case this one) then you may have read that it's important to align guest partitions.

We can do this (for Windows OS) using the DiskPart tool that comes with the OS since Windows 2003 SP1 (there is a hotfix for earlier versions).

On Windows 2008, and higher, all partitions are automatically aligned to a 1 MB boundary.

But how to do this for the OS disk on Server 2003?

My first thought was to open a command prompt during setup, right before creating the partitions and then use diskpart.

However the OS partition is created during the Text portion of the install process and even though we can get a cmd prompt using SHIFT-F10 we get the recovery console (which has a builtin diskpart but cannot align).

So I used a Windows PE bootdisk. Any version with Diskpart should do but I used a bootdisk from Symantec Backup Exec System Recovery that I've customized to my own needs.

If you boot the original Symantec disk you can open a command prompt by accessing a hidden feature: move the mouse above the "S" from Symantec until you get a Hand icon and press the left mouse button:

Autologon user on Windows XP/2003 using AutoReconnect pipe - part 3 (implementation details)

Thu, 03 Mar 2011 13:00:46 +0000

In the previous parts (part 1 part 2) i’ve described the theoretical part and implementation problems. So, now we can write the code:

In case we login the user, we just call LsaLogonUser to get the token:

Autologon user on Windows XP/2003 using AutoReconnect pipe - part 2 (problems and workarounds)

Wed, 02 Mar 2011 00:10:02 +0000

In part 1 I’ve described the theoretical parts needed for a custom autologon application implementation.

But there are some practical problems which I will describe here.

I use the LsaLogonUser function to log in the user. However, if I do not pass not null for the LocalGroups parameter, msgina.dll fails to process the logon.

Why? Because it looks for the SE_GROUP_LOGON_ID SID and treat it as logon SID. So we have to add the logon SID manually:

Autologon user on Windows XP/2003 using AutoReconnect pipe - part 1 (theory)

Mon, 28 Feb 2011 10:46:29 +0000

Windows XP introduced the ability to use Fast User Switching (FUS from here on), which is implemented using Terminal Services.

But in some cases (i.e. when FUS is not enabled, or when you connect to the console in Windows 2003 server), the Winlogon process in an RDP session needs to transfer credentials to Session 0.

Although not documented in MSDN, the process of transferring credentials is described by Keith Brown in the June 2005 issue of MSDN magazine: Customizing GINA, Part 2.

WlxQueryConsoleSwitchCredentials and WlxGetConsoleSwitchCredentials are used in the transfer with the semi-documented WLX_SAS_TYPE_AUTHENTICATED SAS code constant.

Internally, winlogon.exe uses a Named Pipe, \.\Pipe\TerminalServer\AutoReconnect, to implement both of these functions.

The pipe format is described in this structure:

Script to install SNMP

Fri, 04 Feb 2011 11:22:26 +0000

In my project the monitoring group required that SNMP was installed and configured on all servers.

I wrote scripts for Windows 2003 and Windows 2008 that I deploy from my Altiris Server.

This is the script for Windows 2003:

batch Download

@echo off
rem Install SNMP

rem Create Sysoc Answer File
echo [NetOptionalComponents] >InstallSNMP.txt
echo SNMP = 1 >>InstallSNMP.txt
echo. >>InstallSNMP.txt
echo [SNMP] >>InstallSNMP.txt
echo Accept_CommunityName = MYCOMMUNITY:Read_Only >>InstallSNMP.txt
echo Any_Host = No >>InstallSNMP.txt
echo Community_Name = "MYCOMMUNITY" >>InstallSNMP.txt
echo Contact_Name = "MYCONTANT" >>InstallSNMP.txt
echo Limit_Host = MYIP >>InstallSNMP.txt
echo Location = "MYLOCATION" >>InstallSNMP.txt
echo Send_Authentication = Yes >>InstallSNMP.txt
echo Service = Applications, Internet, End-to-End, Physical, Datalink >>InstallSNMP.txt
echo Traps = THETRAPIP >>InstallSNMP.txt

Sysocmgr.exe /i:\windows\inf\sysoc.inf /u:\Windows\Temp\InstallSNMP.txt /r

Querying a user token under 64 bit version of 2003/XP

Sat, 29 Jan 2011 22:17:52 +0000

If you want to obtain a user’s token in a Terminal Server or Citrix session (eg to launch a process in a session) you can call the WTSQueryUserToken function.

On the x64 versions of Windows XP and Server 2003 this function fails however and returns ERROR_INSUFFICIENT_BUFFER ("The data area passed to a system call is too small.") when called from a 32 bit process.

Internally WTSQueryUserToken calls the undocumented function WinstationQueryInformationW with the WinStationUserToken class (14) and passing a WINSTATIONUSERTOKEN struct, filled with caller ProcessId and ThreadId.

But on x64 Windows the size of this structure is 24 bytes, while on 32 bit Windows the size of the structure is 12 bytes!

PowerShell Script to raise Citrix Video Memory

Fri, 28 Jan 2011 15:23:08 +0000

On a Citrix XenApp 5 environment a user reported that he was unable to start a Full Screen session on a Dual Monitor Configuration.

He received this error message:

Enumerating Session Processes with NtQuerySystemInformation

Thu, 20 Jan 2011 15:34:23 +0000

As you may know, you can enumerate processes of a specific Terminal Server or Citrix session using the NtQuerySystemInformation function.

On x86 system the code below works fine:

objectpascal Download

var
 Status : NTSTATUS;
 RetLength : DWORD;
 SessionInfo : SYSTEM_SESSION_PROCESS_INFORMATION;
 CurrentProcess : PSystemProcesses;
begin

 SessionInfo.SessionId := SessionId;
 SessionInfo.Buffer := nil;
 SessionInfo.SizeOfBuf := 0;

 Status := NtQuerySystemInformation(SystemSessionProcessesInformation, @SessionInfo, SizeOf(SessionInfo), @RetLength);
 while (Status = STATUS_INFO_LENGTH_MISMATCH) do
 begin
 SessionInfo.SizeOfBuf := RetLength;
 SessionInfo.Buffer := GetMemory(RetLength);
 try
 Status := NtQuerySystemInformation(SystemSessionProcessesInformation, @SessionInfo, SizeOf(SessionInfo), @RetLength);
 if NT_SUCCESS(Status) then
 begin
 CurrentProcess := SessionInfo.Buffer;
 while True do
 begin
 // Your code here

 if (CurrentProcess^.NextEntryDelta = 0) then
 Break;

 Cardinal(CurrentProcess) := Cardinal(CurrentProcess) + CurrentProcess^.NextEntryDelta;
 end;

 Exit;
 end;
 finally
 FreeMemory(SessionInfo.Buffer);
 end;
 end;

 SetLastError(RtlNtStatusToDosError(Status));
 RaiseLastOSError;
end;

While this works fine on Windows XP and 2003 x86, it fails to work correctly on the x64 versions of Windows XP and 2003 (or maybe even higher).

The problem is that RetLength is always SizeOf(SYSTEM_SESSION_PROCESS_INFORMATION) and thus we are in an endless loop!

The case of the Annotations Toolbar

Mon, 17 Jan 2011 22:24:22 +0000

I got some interesting questions from a user today regarding TIFF images on a Windows 2003 based Citrix environment.

This user has an application that works with scanned documents and for each document exists both a pdf and a tiff version in the application.

By default the TIF (and TIFF) file extensions are linked to the Windows Picture and Fax Viewer in Windows 2003.

The user told me that some time ago she had an extra toolbar where she could perform some extra operations such as making a selection on TIFF images.

At some point in time this mysterious Toolbar disappeared and she was never able to get it back. She reported this to the helpdesk and the system administrator but they were unable to resolve this.

I hadn’t hear of this toolbar before but a Google Search led me to this page which explains the toolbar in question which is called the Annotation Toolbar.

Paging file and Memory Dump

Fri, 07 Jan 2011 13:45:55 +0000

I often hear that people configure the Paging File (on Citrix or Terminal Servers) on a seperate volume but, the reasons is either performance or the chance that the Paging File might corrupt the volume.

However if at some point you would like to create a Memory Dump you must have a paging file on the boot volume.

Default User Profile: Remko’s solution

Tue, 04 Jan 2011 15:46:18 +0000

If you are implementing a Citrix, Terminal Server or even just a plain Client-Server environment you will need to create a Default User Profile at some point.

The Default User Profile can be thought of as the initial registry settings that are used when a new profile is created.

Many people think that the Default User Profile is available in regedit via HKEY_USERS.Default but this is NOT the Default User Profile.

Terminal Server Remote Keyboard Layout

Mon, 27 Dec 2010 16:38:55 +0000

Today I shadowed a user’s session in Citrix and when I wanted to type something I noticed that the keyboard layout was incorrect.

This is and old “friend” that I always tend to forget about. So hopefully this post will help me to remember it :D.

You can prevent this by adding a value “IgnoreRemoteKeyboardLayout” to the registry key HKLM\System\CurrentControlSet\Keyboard Layout:

text Download

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v IgnoreRemoteKeyboardLayout /t REG_DWORD /d 0x00000001 /f

This option has been present since Windows 2000 but was broken in Windows 2003. For Windows 2003 there are two related hotfixes, see kb 842136 and kb 917910.

Default Explorer View

Sun, 19 Dec 2010 14:40:40 +0000

As you probably know there are several different Folder Views in Windows Explorer:

The Explorer keeps tracks of the last used View per Folder in the registry in the key HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags. This KB article sort of desribes this functionality.

Programmatically Changing the Driver Signing options

Thu, 11 Nov 2010 09:57:17 +0000

Today I was tested my unattended Citrix installation (XenApp 5 on Windows 2003) and I noticed that the install was taking longer than expected.

This was because of a popup:

I am not sure if this popup is shown because I ran MsiExec with /Qb- (I usually do that when testing) but if the Popup is not shown it means that at least the installation of this driver (probably Citrix Universal Print driver) fails.

So this means I needed to script turning off Driver Signature Warnings. A quick search led me to kb article kb298503 which is titled “Driver signing registry values cannot be modified directly in Windows”. As you may guess that title drew my attention.