Windows 2008 on Remko's Blog

The publisher could not be verified when launching an application with RES Workspace Manager

Fri, 13 Sep 2013 15:35:25 +0000

Today I was troubleshooting a warning message that popped up when launching a network application with RES Workspace Manager:

Usually this is a simple fix: add the servername (file://server) to the Local Intranet zone:

That worked when I launched the application directly. However when launching the application with RES Workspace Manager I would still get the warning. Even stranger: when I clicked Cancel the application would still be launched.

ClickOnce Applications in Enterprise Environments

Mon, 05 Aug 2013 16:51:21 +0000

ClickOnce is a Microsoft technology that enables an end user to install an application from the web without administrative permissions.

That's great isn't it?
While ClickOnce may sound great to developers it's actually a nightmare for Enterprise administrators because they try to prevent users from installing software themselves.

ClickOnce also incorporates an Automatic Updates mechanism which means that users might run different or not tested/approved versions...

Virtual Environments
It get's even worse in virtual environments such as VDI and SBC where machines are often non-persistent. Each time the users starts the application they will see a screen similar to the one below while they actually download and install it over and over again:

If the environment is persistent, it's not guaranteed that the user works on the same machine each day. This means that the application will be installed on every box the user ever logs onto...

How does it work?
In order to understand how we can best treat ClickOnce applications we need to understand how they work since MSDN documentation does not describe this in detail.

Return username instead of computername to Applications

Thu, 06 Dec 2012 10:45:40 +0000

Some applications use the computer's name as a unique identifier, rather than using the user name. In a single-user-per-computer environment, this strategy works well.

However, in a Multi User environment such as Citrix XenApp or Microsoft's Remote Desktop Services (Terminal Server), all connected users report the same computername.

If the application relies on unique computernames to handle tasks such as file and record locking, then the application will fail.

We can however set an Application Compatibility Flag in the registry to return the username instead of the computername.

To demonstrate this behaviour I wrote a small Test Application called TestAppCompatFlags.exe.

My Network Places Internals

Thu, 19 Jul 2012 11:26:12 +0000

I am using a PowerShell script to copy some elements of from the users old profile location to a new location. This includes the Nethood ("My Network Places") folder which contains the Network Places shortcuts.

A user reported that she could not save documents to Network Places anymore and after inspection the Network Places shortcuts were broken.

I started comparing the old Nethood folder to the new and observed the following difference in Explorer:

When copying entries from the Nethood folder with Explorer manually they worked fine, so somehow Explorer gives the Nethood folder special treatment.

Switching to the Services Session

Fri, 24 Feb 2012 14:49:21 +0000

Just read a tweet from @andyjmorgan about Interactive Service Detection. This made me remember that it's possible to switch to the Session 0 with an undocumented api in winsta.dll.

For this API to work you must have the Interactive Services Detection (UI0Detect) service running.

Remote Registry from 32 to 64 bit

Fri, 21 Oct 2011 09:05:11 +0000

Yesterday I needed to set a few registry keys remotely from a 32 bit windows machine to a 64 bit machine.

I used reg.exe to set the key but even though it returned success the key wasn't altered.

As I suspected the key was written to the Wow6432Node. In the help I couldn't find any switch to force reg.exe to use the 64-bit view.

On a 64 bit machine this is not a problem since both 32- and 64 bit versions of reg.exe exists. The 32 bit version of reg.exe defaults to the 32 bit view and the 64 bit version defaults to the 64 bit view.

But luckily reg.exe has a switch (that is not listed in the help) to force the View:

GetUserObjectInformation fails with Access Denied

Tue, 16 Aug 2011 21:11:01 +0000

Today I was reusing some old (pre vista) code the retrieves the Logon SID that I wrote a few years ago. The Logon SID is a special SID that identifies a logon session that has the form S-1-5-5-X-Y.

You can view your Logon SID with Process Explorer, right click a GUI process, select Properties and goto the Security Tab:

GetTokenInformation with TokenLinkedToken returns error 1312

Thu, 11 Aug 2011 11:30:47 +0000

The GetTokenInformation function can be used with the TokenLinkedToken Information Class on Windows Vista and higher to the linked (Elevated) token.

This is useful when User Account Control is enabled and you want to launch an elevated process e.g. from a service.

Programmatically Check if User Account Control is Enabled

Thu, 11 Aug 2011 11:27:13 +0000

Snippet below can be used to programmatically determine if User Account Control is enabled:

objectpascal Download

uses
 JwaWinbase, JwaWinNt;

function IsUACEnabled: Boolean;
var
 hToken: THandle;
 tet: TOKEN_ELEVATION_TYPE;
 dwSize: DWORD;
begin
 Win32Check(OpenProcessToken(GetCurrentProcess, TOKEN_QUERY, hToken));
 // TokenElevationType class only available on Vista+
 Win32Check(GetTokenInformation(hToken, TokenElevationType, @tet, SizeOf(tet), dwSize));

 Result := tet <> TokenElevationTypeDefault;
end;

1 Comments

GetTokenInformation with TokenLinkedToken returns error 1312 Aug 11, 2011
[...] specified logon session does not exist. It may already have been terminated.”So you should check if User Account Control is enabled in such cases (or make this error non critical).share: Bookmark on Delicious Digg this post [...]

SSL Certificates in termsrv.dll

Mon, 02 May 2011 14:54:39 +0000

I was digging around in termsrv.dll yesterday when I noticed that there are some (well 372 to be exact) SSL certificates inside the Terminal Server binary (termsrv.dll):

Two of them seem to actually contain the private keys as well, but I am not 100% sure it may be just a certificate in another format.

SasLibEx Screencast

Wed, 19 Jan 2011 22:36:44 +0000

I just recorded a SasLibEx Screencast, it shows some of the very powerfull features of SasLibEx.

The following features are shown:

Simulate Ctrl Alt Del (Secure Attention Sequence)
Cancel Ctrl Alt Del
Lock Workstation
Unlock Workstation (without credentials)
Disable Ctrl Alt Del
Enable Ctrl Alt Del again
Cancel pending UAC request
Is Desktop Locked

SasLibEx Feature Demo #1

1 Comments

Tweets die vermelden SasLibEx Screencast | Remko Weijnen's Blog (Remko's Blog) -- Topsy.com Jan 20, 2011
[...] Dit blogartikel was vermeld op Twitter door Remko Weijnen, Remko Weijnen. Remko Weijnen heeft gezegd: First #SasLibEx ScreenCast! showing simulate ctrl alt del, unlock workstation without credentials, disable cad and more http://bit.ly/fFM8wB [...]

Paging file and Memory Dump

Fri, 07 Jan 2011 13:45:55 +0000

I often hear that people configure the Paging File (on Citrix or Terminal Servers) on a seperate volume but, the reasons is either performance or the chance that the Paging File might corrupt the volume.

However if at some point you would like to create a Memory Dump you must have a paging file on the boot volume.

Default User Profile: Remko’s solution

Tue, 04 Jan 2011 15:46:18 +0000

If you are implementing a Citrix, Terminal Server or even just a plain Client-Server environment you will need to create a Default User Profile at some point.

The Default User Profile can be thought of as the initial registry settings that are used when a new profile is created.

Many people think that the Default User Profile is available in regedit via HKEY_USERS.Default but this is NOT the Default User Profile.

Modify Internet Explorer 8 MUI Pack to install a single language

Mon, 03 Jan 2011 12:10:22 +0000

Today I wanted to install the Dutch Language pack for Internet Explorer 8, the Dutch language comes as part of the Windows Internet Explorer 8 MUI Pack (in my case the version for Windows Server 2003 SP2).

If you install the MUI Pack you will always end up with all 35 (!) languages installed. This behaviour is the same as the language pack for Internet Explorer 7 that I wrote about earlier (see Modifying Microsoft Updates and/or hotfixes)

The solution is really the same as for the IE7 language pack: you modify the inf file (in my case update_srv03.inf) but if you run update.exe it will refuse to use your modified inf file:

So we need to patch update.exe to accept your modified version!

Desktop Icons, hide, show, prevent rename or delete

Sun, 19 Dec 2010 15:14:04 +0000

I was cleaning up some old data on my Hard Drive when I found a program I wrote about a year ago.

At that time I was doing a project where I was deploying a Windows 2008 based Citrix Environment.

I wanted to get rid of the new Personal Folders or User’s files icon on the Desktop and replace it with the familiar My Documents icon.

These settings are stored in the Registry under HKEY_CLASSES_ROOT\CLSID{folder’s GUID}\ShellFolder.

Default Explorer View

Sun, 19 Dec 2010 14:40:40 +0000

As you probably know there are several different Folder Views in Windows Explorer:

The Explorer keeps tracks of the last used View per Folder in the registry in the key HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags. This KB article sort of desribes this functionality.

Scripted creation of Server Manager Answer Files

Thu, 25 Nov 2010 16:14:42 +0000

A while ago I created a script that I can run as embedded script in Altiris that creates a Server Manager Answer File (for Server 2008).

I could have simply done an echo >answer.xml but I wanted a well formed XML that could be read and displayed in an XML editor or Internet Explorer when needed.

I use the Microsoft.XMLDom object in the script the create the XML and I think the code is easy to understand so I will just show it here:

The case of the failing Deployment Server Install

Tue, 26 Oct 2010 16:47:15 +0000

I was trying to install HP Insight Control server deployment (previously called HP Rapid Deployment Pack) on Sql Server 2008 Express. I will just call it Deployment Server or DS from here.

I first installed SQL 2008 Express with Advanced Services and configured it to listen op Port 1433 as required by DS.

The installation of the first part (Deployment Server version 6.9.4) indicated a successfull install but the prereqisuites check of the Hotfix version 2.0 installer failed on the last step:

This was strange because I didn’t yet startup the console, so I decided to start it and close it as this would perhaps allow me to continue.

The next screen was a clear indication something went wrong:

I presumed that the ODBC connection was missing so I went to Adminstrative Tools | Data Sources (ODBC). But the ODBC connection was present. I then fired up SQL Server Management Studio which showed me the eXpress database was missing.

Change Driveletter Commandline Tool

Wed, 20 Oct 2010 14:04:35 +0000

Some time ago (2008 actually) I wrote a tool that can assign driveletters given a volumename. I use it myself after SysPrep operations to assign the desired drive letters. For instance after cloning a Virtual Machine from a template.

I noticed that I updated this tool sometime after the original post but never uploaded it here. The most important changes are:

Active Directory Properties Commandline Tool

Sun, 12 Sep 2010 21:56:01 +0000

I have written a small commandline tool that shows the Active Directory Property Sheet for a given account.

The Property sheet is what you get when you doubleclick an object in Active Directory & Computers. Basically this tool is meant to make it easy to quickly view or change properties without needing to start a GUI tool and looking up the account in the AD Tree.

Did you make a SasLibEx enquiry? And... news!

Mon, 22 Feb 2010 14:07:28 +0000

My hoster has had some problems with the simulatesas.com domain that I use for SasLibEx enquiries. If you have sent mail to that has not been answered I kindly request you to send it again.

I would also like to briefly tell you about an upcoming new release of SasLib, version 2.0. There is so much I would like to tell you about it but I will limit it to a few highlights here and save the rest for the upcoming website on SimulateSAS.com.

Getting Back the Classic Event Viewer in Vista and Windows 7

Thu, 26 Nov 2009 13:15:55 +0000

I never liked the new eventviewer that was introduced with Windows Vista. If you want to have the old eventviewer back (you can use the old and new one together) you need to follow the following steps:

Open a command prompt as Adminstrator.
Type Regsvr32 els.dll (if you get error code 0x80070005 then you didn't run as Administrator).
Start mmc.exe and goto File | Add/Remove Snapin.
From the available Snapins choose "Classic Event Viewer".
Right-Click Classic Event Viewer under Console Root and select New Window from Here.
Choose Customize from the View menu.
Deselect the Action Pane and Click OK
Now save the file with a name of your choice eg EventVwrC.msc.

It should look like this:

Removing the Uninstall or change a program button from the Explorer Command Bar

Wed, 25 Nov 2009 10:52:13 +0000

Windows Vista introduced the Command Bar in Explorer which is sometimes also referred to as the Folder Band or the Task Band. The Command Bar is of course also present in Windows 7 and Server 2008 (R2).

This Command Bar shows possible tasks or actions depending on the active folder. I wanted to remove the “Uninstall or change a program” (in Dutch this is called “Een programma verwijderen of wijzigen”) button from the Computer view:

Save Explorer settings without Logging off

Mon, 16 Nov 2009 16:42:12 +0000

This is more a note to self because I always forget. Explorer holds all it’s settings in memory so if you change a settings through the GUI (like in Folder Options) you cannot use a tool like Process Monitor to see what the corresponding registry entry is.

Adding a Printer Connection with an alternative driver

Mon, 16 Nov 2009 10:59:13 +0000

I needed to add a printer connection to a Citrix server but the problem was that this printer had a buggy driver. I wanted to use an alternative driver such as the Citrx Universal Printer driver but on Terminal Server you might want to use the Terminal Services Easy Print driver.

So I decided to make something that could be used in both situations, the result is a small commandline tool called AddPrinter2 (sorry I am not good in finding original names).

It takes 2 parameters: the printername as unc path and the driver name. An example would be:

AddPrinter2 “\server\printer” “Citrix Universal Printer”.

Slow Installation because of Certificate Checks

Fri, 06 Nov 2009 21:29:15 +0000

A few days ago I noticed that an unattended installation of Citrix XenApp 5 was installing very slowly. When I looked at the various jobs and their installation time in the (Altiris) Deployment Server I saw that it was the Citrix Access Management Console that took almost 45 minutes to install:

It was clear that this wasn’t normal since the install job is taking installing OS components like IIS and all subcomponents, activating Application Server and reboot in around 9 minutes. The installation of Citrix XenApp itsself takes only 14 minutes.

I searched with Google and one of the first links was this knowledge base article from Citrix: Slow Access Management Console Installation on XenApp 5.0. The article clearly describes that the delay is occurred by failing checks for Publisher’s and Server Certificate Revocation (because there’s no Internet Connection) and suggests to turn these checks off. Indeed my servers do not have a direct internet connection so the cause and solution were clear.

And actually I had seen similar issues before in other (non Citrix) installations, some examples are Exchange 2007 (here and here) and SQL Server 2008 (the SQL Installer actually checks if there’s an internet connection in the prerequisites check).

The suggested, manual way, of turning of these checks is to clear the following checkboxes in Internet Explorer’s advanced settings Dialog:

But since I had to do this on many servers I decided it would be better to do it with a little VBS script.

Windows Installer proxy information not correctly registered

Thu, 05 Nov 2009 22:11:06 +0000

I was deploying an unattended installation of Citrix XenApp 5.0 with Altiris Deployment Server. The installation consists of several prerequisites, the installation of XenApp and finally the Citrix Management Consoles.

The installation is performed with a special account and not the Local System account because the install packages are located on the network.

When testing the deployment on a Windows Server 2008 I noticed that sometimes MSI based installations would fail with error code 1603 or 1601.

SasLibEx updates

Tue, 07 Apr 2009 08:40:36 +0000

I have found and tested some new functionalities which I will add to SasLibEx:

Unlocking workstation without entering password
Cancel UAC (User Account Control) request
fully disable Ctrl-Alt-Del
Cancel Ctrl-Alt-Del
Switch between secure desktop (where the UAC prompt is) and the normal desktop.

Some people asked if SasLibEx works on x64 or Windows 7, the answer is yes. I tested on build 7000 of Windows 7 beta and also on Server 2008 x64.

5 Comments

Simulate ctrl-alt-del in Windows Vista | RemkoWeijnen.nl May 18, 2009
[...] SasLibEx updates | RemkoWeijnen.nl April 7th, 2009 at 8:41 2 [...]

TSAdminEx Features Part 3

Wed, 25 Feb 2009 13:08:31 +0000

Beta Release

Part 1

Part 2

This is part 3 of the TSAdminEx Features series. Today I will discuss the Process View. As usual we will start by comparing TSAdmin to TSAdminEx again. So let's look at TSAdmin Process View:

And the one from TSAdminEx:

TSAdminEx Features Part 2

Tue, 24 Feb 2009 10:17:07 +0000

Part1

Now that a TSAdminEx beta is ready I will be showing you some features. In this part I will show the Sessions View.

Let’s start again with a compare of TSAdmin and TSAdminEx:

As you can see TSAdminEx shows more details, it shows the following extra columns:

TSAdminEx Features Part 1

Mon, 23 Feb 2009 16:18:28 +0000

Part 2

Now that a TSAdminEx beta is ready I will be showing you some features. In this part 1 I will be comparing the Users view to TSAdmin.

Let’s start TSAdmin, this tool is present by default on Windows 2003. If you use Windows XP or Windows Vista you can get it by installing the Administration Pack. Please note that TSAdmin does not work on Vista RTM due to a bug that was corrected in Vista SP1 (TSAdminEx works fine on both RTM as well as SP1)

Now let’s open TSAdminEx and start comparing…

TSAdminEx Beta release

Fri, 20 Feb 2009 17:59:06 +0000

Over the last months I have been working hard on TSAdminEx and now, finally, I can now present a first beta release.

If you don’t know what TSAdminEx is let me briefly introduce it. TSAdminEx is a tool that combines functionality of several existing tools: it has the power of task manager combined with the details of Process Explorer and the Terminal Server support of TSAdmin. On top of that it fully supports remote systems out of the box without installing any agents or services. It also has some unique features that neither of the mentioned tools can do!

Several new features have been implemented since the last time I talked about TSAdminEx and I will show you the most exciting ones here:

Patch Windows 2008 Terminal Server to allow more than 2 concurrent sessions

Tue, 21 Oct 2008 13:56:23 +0000

Well it took some time but I patched Terminal Server for Windows 2008 to allow unlimited sessions in Remote Administration mode.

This patch is for 32 bit English version. In order to install it you need to perform the steps below. Before you start please check if using this patch is allowed according to your country’s law and your license agreement.

Registry editing has been disabled by your administrator (not anymore!)

Tue, 12 Aug 2008 23:09:32 +0000

Most administrator will want to prevent normal users from opening Regedit and a command prompt. Usually this is done by activating the “Prevent access to registry editing tools” and “Prevent access to the command prompt” policy settings. They are located under User Configuration | Administrative Templates | System:

Activating the policies will set the matching keys in the registry:

If we try to open regedit we are denied access:

So how does this work?

Using Windows Server 2008 as a SUPER workstation OS

Sun, 06 Apr 2008 23:35:48 +0000

Vijayshinva Karnure wrote a very cool article about running Server 2008 as a desktop os or rather as a Windows Vista replacement. It seems that besides additional features like Hyper-V, Server 2008 runs approx. 20% faster than Vista.

If only upgrading Vista to Server 2008 would be possible… (has anyone ever tried)?

How to deactivate Internet Explorer Enhanced Security Configuration in Windows Server 2008?

Fri, 04 Apr 2008 15:44:33 +0000

Open Server Manager and in the Security Information tab click Configure IE ESC. An improvement in Server 2008 is that you can disable it for Administators but enable it for Normal Users, this is nice for Terminal Server and Citrix environments.

How to install Powershell in Server 2008?

Fri, 04 Apr 2008 15:40:02 +0000

Even though Powershell is included with Windows Server 2008 it’s not installed by default. You can do this in Server Manager by going to Features and then Click Add Features in the Tasks bar on the right. Select Windows Powershell in the list and there you go!