Windows 7 on Remko's Blog

The publisher could not be verified when launching an application with RES Workspace Manager

Fri, 13 Sep 2013 15:35:25 +0000

Today I was troubleshooting a warning message that popped up when launching a network application with RES Workspace Manager:

Usually this is a simple fix: add the servername (file://server) to the Local Intranet zone:

That worked when I launched the application directly. However when launching the application with RES Workspace Manager I would still get the warning. Even stranger: when I clicked Cancel the application would still be launched.

RD Gateway connection fails on Windows 7

Thu, 15 Aug 2013 11:27:15 +0000

I needed to connect remotely via Remote Desktop to a Windows Server 2012 machine.

I received an rdp file that was configured to use an RD Gateway server:

However when trying to connect from my Windows 7 laptop (x64) machine, I got the following error message:

ClickOnce Applications in Enterprise Environments

Mon, 05 Aug 2013 16:51:21 +0000

ClickOnce is a Microsoft technology that enables an end user to install an application from the web without administrative permissions.

That's great isn't it?
While ClickOnce may sound great to developers it's actually a nightmare for Enterprise administrators because they try to prevent users from installing software themselves.

ClickOnce also incorporates an Automatic Updates mechanism which means that users might run different or not tested/approved versions...

Virtual Environments
It get's even worse in virtual environments such as VDI and SBC where machines are often non-persistent. Each time the users starts the application they will see a screen similar to the one below while they actually download and install it over and over again:

If the environment is persistent, it's not guaranteed that the user works on the same machine each day. This means that the application will be installed on every box the user ever logs onto...

How does it work?
In order to understand how we can best treat ClickOnce applications we need to understand how they work since MSDN documentation does not describe this in detail.

My Network Places Internals

Thu, 19 Jul 2012 11:26:12 +0000

I am using a PowerShell script to copy some elements of from the users old profile location to a new location. This includes the Nethood ("My Network Places") folder which contains the Network Places shortcuts.

A user reported that she could not save documents to Network Places anymore and after inspection the Network Places shortcuts were broken.

I started comparing the old Nethood folder to the new and observed the following difference in Explorer:

When copying entries from the Nethood folder with Explorer manually they worked fine, so somehow Explorer gives the Nethood folder special treatment.

Switching to the Services Session

Fri, 24 Feb 2012 14:49:21 +0000

Just read a tweet from @andyjmorgan about Interactive Service Detection. This made me remember that it's possible to switch to the Session 0 with an undocumented api in winsta.dll.

For this API to work you must have the Interactive Services Detection (UI0Detect) service running.

Hibernation fails in Windows 7

Fri, 10 Feb 2012 22:40:46 +0000

A while ago my Windows 7 laptop suddenly refused to go into Hibernation. The strange thing was that the whole process of saving memory to the hibernate file seemed to work correctly. The screen would go black and there was lots of disk activity. Then after the disk activity finished the system would return to the logon screen.

A Google on this issue learned that the most likely cause was a driver preventing the system from going into hibernation. Using the cmdline "powercfg -DEVICEQUERY wake_armed" we can check if there are any devices that can wake the system. Another useful parameter is -ENERGY which generates an html report file.

But in my case this lead to nothing.

Speed up Windows 7 Resume by 20%

Fri, 10 Feb 2012 21:54:37 +0000

UPDATE: See this new article by Helge Klein.

Recently Helge Klein wrote a blog titled How to Speed Up Your Windows 7 Boot Time by 20%. He does this by disabling the graphical animation that Windows 7 displays while booting.

After applying this tweak I noticed that a resume from hibernation (which I do far more often than a full boot) still showed the graphical animation (and wasn’t speed up).

So how to disable the animation while resuming?

System Process PID 4 is listening on port 80

Mon, 02 Jan 2012 10:23:21 +0000

I wanted to save the SHSH signatures from my iPhone before updating to iOS 5.01. I started Tiny Umbrella but it showed an error indicating that there's already a process listening on port 80:

I verified this using netstat (netstat -aon | find /I "LISTENING" | find /I ":80"):

Remote Registry from 32 to 64 bit

Fri, 21 Oct 2011 09:05:11 +0000

Yesterday I needed to set a few registry keys remotely from a 32 bit windows machine to a 64 bit machine.

I used reg.exe to set the key but even though it returned success the key wasn't altered.

As I suspected the key was written to the Wow6432Node. In the help I couldn't find any switch to force reg.exe to use the 64-bit view.

On a 64 bit machine this is not a problem since both 32- and 64 bit versions of reg.exe exists. The 32 bit version of reg.exe defaults to the 32 bit view and the 64 bit version defaults to the 64 bit view.

But luckily reg.exe has a switch (that is not listed in the help) to force the View:

Prevent additional IP addresses from being registered in DNS

Tue, 18 Oct 2011 15:01:33 +0000

In Windows 7 and 2008 R2 all IP Addresses are by default registered in DNS.

If you don’t want certain IP addresses to appear in DNS you can alter this behavior with Netsh using the skipassource flag.

Use the following syntax to add an additional IP Address with skipassource flag:

GetUserObjectInformation fails with Access Denied

Tue, 16 Aug 2011 21:11:01 +0000

Today I was reusing some old (pre vista) code the retrieves the Logon SID that I wrote a few years ago. The Logon SID is a special SID that identifies a logon session that has the form S-1-5-5-X-Y.

You can view your Logon SID with Process Explorer, right click a GUI process, select Properties and goto the Security Tab:

GetTokenInformation with TokenLinkedToken returns error 1312

Thu, 11 Aug 2011 11:30:47 +0000

The GetTokenInformation function can be used with the TokenLinkedToken Information Class on Windows Vista and higher to the linked (Elevated) token.

This is useful when User Account Control is enabled and you want to launch an elevated process e.g. from a service.

Programmatically Check if User Account Control is Enabled

Thu, 11 Aug 2011 11:27:13 +0000

Snippet below can be used to programmatically determine if User Account Control is enabled:

objectpascal Download

uses
 JwaWinbase, JwaWinNt;

function IsUACEnabled: Boolean;
var
 hToken: THandle;
 tet: TOKEN_ELEVATION_TYPE;
 dwSize: DWORD;
begin
 Win32Check(OpenProcessToken(GetCurrentProcess, TOKEN_QUERY, hToken));
 // TokenElevationType class only available on Vista+
 Win32Check(GetTokenInformation(hToken, TokenElevationType, @tet, SizeOf(tet), dwSize));

 Result := tet <> TokenElevationTypeDefault;
end;

1 Comments

GetTokenInformation with TokenLinkedToken returns error 1312 Aug 11, 2011
[...] specified logon session does not exist. It may already have been terminated.”So you should check if User Account Control is enabled in such cases (or make this error non critical).share: Bookmark on Delicious Digg this post [...]

Switch SATA Operation Mode

Sat, 18 Jun 2011 21:38:19 +0000

Modern systems usually offer different SATA Operation Modes such as ATA, AHCI or IRRT.

The AHCI mode offers extra features such as hot swapping and native command queuing.

Many vendors set the SATA Operation Mode to ATA by default because it’s the most compatible mode but there are a few reasons why you might want to change it:

AHCI has a higher performance than ATA.
AHCI is a requirement for the TRIM command.
AHCI is required for self encrypting hard drives

Please note that the IRRT (integrated raid) mode is supposed to support all functionality of AHCI but in my experience it doesn't.

So the question is: how do we switch the SATA Operation Mode from ATA or IRRT to AHCI?

Programmatically determine if we run server core

Tue, 17 May 2011 21:32:22 +0000

If you want to check if you are running on a Server Core edition of Windows you can use the GetProductInfo API.

GetProductInfo takes 4 input parameters that can be obtained using GetVersionEx and the OSVERSIONINFOEX structure:

objectpascal Download

var
 osvi: OSVERSIONINFOEX;
begin
 ZeroMemory(@osvi, SizeOf(osvi));
 osvi.dwOSVersionInfoSize := SizeOf(osvi);
 Win32Check(GetVersionEx(osvi));

No we call GetProductInfo:

objectpascal Download

var
 dwProdType: DWORD;
begin
 Win32Check(GetProductInfo(osvi.dwMajorVersion, osvi.dwMinorVersion,
 osvi.wServicePackMajor, osvi.wServicePackMinor, dwProdType));

SasLibEx Screencast

Wed, 19 Jan 2011 22:36:44 +0000

I just recorded a SasLibEx Screencast, it shows some of the very powerfull features of SasLibEx.

The following features are shown:

Simulate Ctrl Alt Del (Secure Attention Sequence)
Cancel Ctrl Alt Del
Lock Workstation
Unlock Workstation (without credentials)
Disable Ctrl Alt Del
Enable Ctrl Alt Del again
Cancel pending UAC request
Is Desktop Locked

SasLibEx Feature Demo #1

1 Comments

Tweets die vermelden SasLibEx Screencast | Remko Weijnen's Blog (Remko's Blog) -- Topsy.com Jan 20, 2011
[...] Dit blogartikel was vermeld op Twitter door Remko Weijnen, Remko Weijnen. Remko Weijnen heeft gezegd: First #SasLibEx ScreenCast! showing simulate ctrl alt del, unlock workstation without credentials, disable cad and more http://bit.ly/fFM8wB [...]

Paging file and Memory Dump

Fri, 07 Jan 2011 13:45:55 +0000

I often hear that people configure the Paging File (on Citrix or Terminal Servers) on a seperate volume but, the reasons is either performance or the chance that the Paging File might corrupt the volume.

However if at some point you would like to create a Memory Dump you must have a paging file on the boot volume.

Default User Profile: Remko’s solution

Tue, 04 Jan 2011 15:46:18 +0000

If you are implementing a Citrix, Terminal Server or even just a plain Client-Server environment you will need to create a Default User Profile at some point.

The Default User Profile can be thought of as the initial registry settings that are used when a new profile is created.

Many people think that the Default User Profile is available in regedit via HKEY_USERS.Default but this is NOT the Default User Profile.

Modify Internet Explorer 8 MUI Pack to install a single language

Mon, 03 Jan 2011 12:10:22 +0000

Today I wanted to install the Dutch Language pack for Internet Explorer 8, the Dutch language comes as part of the Windows Internet Explorer 8 MUI Pack (in my case the version for Windows Server 2003 SP2).

If you install the MUI Pack you will always end up with all 35 (!) languages installed. This behaviour is the same as the language pack for Internet Explorer 7 that I wrote about earlier (see Modifying Microsoft Updates and/or hotfixes)

The solution is really the same as for the IE7 language pack: you modify the inf file (in my case update_srv03.inf) but if you run update.exe it will refuse to use your modified inf file:

So we need to patch update.exe to accept your modified version!

Cannot Access Files, But Need the Origin?

Mon, 03 Jan 2011 09:52:20 +0000

Have you developed an application that accesses files and may stop because a file cannot be accessed but you need to?

Since Windows Vista it is possible to find out the name of the application which holds open a file.

Desktop Icons, hide, show, prevent rename or delete

Sun, 19 Dec 2010 15:14:04 +0000

I was cleaning up some old data on my Hard Drive when I found a program I wrote about a year ago.

At that time I was doing a project where I was deploying a Windows 2008 based Citrix Environment.

I wanted to get rid of the new Personal Folders or User’s files icon on the Desktop and replace it with the familiar My Documents icon.

These settings are stored in the Registry under HKEY_CLASSES_ROOT\CLSID{folder’s GUID}\ShellFolder.

Default Explorer View

Sun, 19 Dec 2010 14:40:40 +0000

As you probably know there are several different Folder Views in Windows Explorer:

The Explorer keeps tracks of the last used View per Folder in the registry in the key HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags. This KB article sort of desribes this functionality.

BSOD with STOP 0x0000008E when installing Window 7 Checked Build

Mon, 06 Dec 2010 23:13:01 +0000

I was trying to install a checked build of Windows 7 under VMWare Workstation but after the first reboot during the install (the completing installation step) the system came up with a BSOD.

It can be fixed by adding a line to the VMX configuration file:

Change Driveletter Commandline Tool

Wed, 20 Oct 2010 14:04:35 +0000

Some time ago (2008 actually) I wrote a tool that can assign driveletters given a volumename. I use it myself after SysPrep operations to assign the desired drive letters. For instance after cloning a Virtual Machine from a template.

I noticed that I updated this tool sometime after the original post but never uploaded it here. The most important changes are:

Active Directory Properties Commandline Tool

Sun, 12 Sep 2010 21:56:01 +0000

I have written a small commandline tool that shows the Active Directory Property Sheet for a given account.

The Property sheet is what you get when you doubleclick an object in Active Directory & Computers. Basically this tool is meant to make it easy to quickly view or change properties without needing to start a GUI tool and looking up the account in the AD Tree.

Having fun with Windows Licensing

Tue, 15 Jun 2010 15:09:14 +0000

If you look into the registry in the key HKLM\System\CurrentControlSet\ProductOptions you will find several licensing related Values.

The ProductType and ProductSuite keys contain the OS Suite and Edition, but the ProductPolicy key is much more interesting. So let’s have a closer look at it, open RegEdit and DoubleClick the key, you will something like the screenshot below, a Binary Value:

As you can see the license names are there as a Unicode string and later on I will show you how we can read the values. But because I didn’t want to extract all the names manually I decided to see if I could reverse the used structure because it didn’t look very complicated. Using a Hex Editor I could determine the important part of the structure.

Did you make a SasLibEx enquiry? And... news!

Mon, 22 Feb 2010 14:07:28 +0000

My hoster has had some problems with the simulatesas.com domain that I use for SasLibEx enquiries. If you have sent mail to that has not been answered I kindly request you to send it again.

I would also like to briefly tell you about an upcoming new release of SasLib, version 2.0. There is so much I would like to tell you about it but I will limit it to a few highlights here and save the rest for the upcoming website on SimulateSAS.com.

Getting Back the Classic Event Viewer in Vista and Windows 7

Thu, 26 Nov 2009 13:15:55 +0000

I never liked the new eventviewer that was introduced with Windows Vista. If you want to have the old eventviewer back (you can use the old and new one together) you need to follow the following steps:

Open a command prompt as Adminstrator.
Type Regsvr32 els.dll (if you get error code 0x80070005 then you didn't run as Administrator).
Start mmc.exe and goto File | Add/Remove Snapin.
From the available Snapins choose "Classic Event Viewer".
Right-Click Classic Event Viewer under Console Root and select New Window from Here.
Choose Customize from the View menu.
Deselect the Action Pane and Click OK
Now save the file with a name of your choice eg EventVwrC.msc.

It should look like this:

Removing the Uninstall or change a program button from the Explorer Command Bar

Wed, 25 Nov 2009 10:52:13 +0000

Windows Vista introduced the Command Bar in Explorer which is sometimes also referred to as the Folder Band or the Task Band. The Command Bar is of course also present in Windows 7 and Server 2008 (R2).

This Command Bar shows possible tasks or actions depending on the active folder. I wanted to remove the “Uninstall or change a program” (in Dutch this is called “Een programma verwijderen of wijzigen”) button from the Computer view:

VMWare Workstation and Virtual PC XP Mode: unrecoverable error

Fri, 18 Sep 2009 11:33:46 +0000

I just installed my laptop with Windows 7 (x64) and I was curious how the new Windows XP mode worked (more on that topic later). After installing it I could no longer start any Virtual Machines in VMWare Workstation. The VM fired up but immediately halted with the following error: “VMware Workstation unrecoverable error: (vcpu-0)” “VCPU 0 RunVM failed: -2”.