Remko's Blog

Quip hangs with waiting cursor

Mon, 27 Feb 2023 10:00:00 +0000

It's been a little while since I had a "nice" application problem to blog about. It's weird but I actually enjoy looking into those issues, well probably means I'm weird which is probably right.

I use a Virtual Desktop as my primary work desktop since my day 1 at work (and all the day 1's after).

Get registry key name from a handle

Tue, 18 Oct 2022 10:00:00 +0000

Sometimes it can be useful to determine what registry key belongs to a registry key handle. And exampling is when hooking RegQueryValue so you can determine the registry key that a value belongs to instead of having to track the registry key when it's opened.

Downloading a Video from the Web without Browser Extension

Mon, 17 Oct 2022 00:00:00 +0000

Sometimes I want to download a video from a website for offline usage, for example when I want to watch it whilst travelling.

Most video websites don't want you do download videos as they of course want to show their ads and receive the clicks. I am not discussing the legal side here, up to you to check if it's legally allowed to download the video you're interested.

Get Rid of the Office 2019 Licensing Nag Screen

Tue, 11 Oct 2022 10:00:00 +0000

In my lab I have deployed Office 2019 to an Windows 2019 VM to do some testing with Citrix Virtual Apps and Desktops.

The proper way to do this is to customize the Office installation using the Office Deployment Tool (ODT). The page even lists an example containing a value to accept the EULA.

The AWS Access Key Id you provided does not exist in our records using AWS PowerShell Cmdlets

Fri, 17 Jun 2022 10:00:00 +0000

After changing AWS accounts I resetup my API key so I could use the AWS PowerShell CmdLets.

However even though I was sure I configured everything correctly I couldn't call any EC2 cmdlet. More about that further below but let's refresh how to setup an API key for PowerShell:

Ubuntu crash when pasting files from VMware

Wed, 15 Jun 2022 10:00:00 +0000

It's been a while since I last wrote a post but it does feel good so I'm expecting to pick up blogging in a more regular cadence soon!

This one is a quicky though, as I had an annoying issue with Ubuntu 22.04 VM's running on VMware workstation.

No internet access from Edge and other Microsoft apps

Wed, 16 Oct 2019 15:30:57 +0000

I had a strange issue today: I couldn't open any webpage in the Edge browser on my Windows 10 machine:

Edge browser: "Can't reach this page"

The network icon was showing that there was Internet access and a quick check on the command prompt showed that the connection (including name resolution appeared to work fine):

ping www.google.com

Pinging www.google.com [172.217.168.196] with 32 bytes of data:
Reply from 172.217.168.196: bytes=32 time=15ms TTL=55
Reply from 172.217.168.196: bytes=32 time=14ms TTL=55

Ping statistics for 172.217.168.196:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 14ms, Maximum = 15ms, Average = 14ms" class=“wp-image-4338”/>

ping to www.google.com

Other browsers such as Firefox (my default browser) and Chrome also worked fine but some other Microsoft applications also didn't work such as the Microsoft Store:

DesktopAppConverter : error 'E_MANIFEST_USE_DEFAULT_VALUE_FAILED

Thu, 22 Mar 2018 11:54:54 +0000

I had a strange error today using the Desktop App Converter with the parameters given from the Store for Business.

The conversion would fail with the following error:

I’m not sure why this fails as the PackageName is provided by the store and should be valid. An answer on stackoverflow suggested to use a different value for the PackageName parameter and then edit the manifest.

I don’t like this method as manual modifications of the manifest often leads to errors when submitting the application to the store.

So let’s have a look and see why we’re getting this error.

I searched for E_MANIFEST_USE_DEFAULT_VALUE_FAILED in the DesktopAppConverter folder and found 1 occurence in ManifestOps.ps1.

From a look at the code it wasn’t immediately clear where the validation failed so I decided to debug it.

signtool sign returns error 0x800700C1

Fri, 19 Jan 2018 17:54:49 +0000

I was trying to sign an .appx package that I created with the Desktop App Converter. However signtool returned the following error: Sign returned error: 0x800700C1 For more information, please see http://aka.ms/badexeformat

Sadly signtool doesn’t return more detailed information, even when passing the debug switch:

So what’s going on?

Case of the Crashing Task Scheduler

Thu, 18 Jan 2018 14:56:23 +0000

Recently I installed a new Windows 10 machine (version 1709 aka Fall Creators Update).

After a while I noticed a problem with the Task Scheduler: when I wanted to open the “Schedule Tasks” option from settings I received the following error message:

The Task Scheduler MMC snapin was empty:

How to use a comma in the Publisher field when using the Desktop App Converter

Tue, 16 Jan 2018 14:55:51 +0000

When using the Desktop App Converter there’s no need to sign the resulting .appx packages with your own code signing certificate when you submit them to the Store.

However if you want to test the package on a different machine or distribute it to test users you may want to sign the .appx with a certificate.

One option is to use the -sign parameter, in this case the Desktop App Converter generates a code signing certificate and signs the package with it. Although easy to use, it’s not very convenient if you want to distribute the .appx as you need to add the certificate to the Trusted People certificates store (for each user). See Run the Packaged App in the documentation.

If you want to sign the .appx package with a trusted certificate (e.g. issued by a trusted certificate authority such as DigiCert) you need to make sure that you pass the subject (the CN) from your code signing certificate to the Desktop App Converter (using the -Publisher parameter).

How to remove Windows.old folder

Tue, 16 Jan 2018 13:00:14 +0000

Just a very quick note here (mostly a note to self) but I had a couple of folder from previous Windows 10 installations named Windows.old Windows.old(1), Windows.old(2) etc.

These folders should be removed when you use Disk Cleanup and select the “Remove previous Windows Installation(s)” option.

Sign APPX packages with PowerShell

Wed, 20 Dec 2017 15:00:33 +0000

I have been working with Microsoft’s Desktop App Converter a lot recently. Even though there’s an option to autosign the resulting package with the -Sign switch I prefer to sign APPX packages myself using signtool.

The reason is that I can send UWP packages to testers for sideloading without requiring them to import the auto generated certificate (which is different on each (re)build).

However I always forget the exact path to signtool.exe (this comes with the Windows SDK).

The Windows 10 SDK is installed by default in C:\Program Files (x86)\Windows Kits\10.

Signtool.exe will be in the folder<sdkpath>\bin\<version>\<platform>\signtool.exe.

As there are multiple version of Windows 10 there are multiple version of the SDK and you can install those concurrently.

But then I found the PowerShell cmdlet Resolve-Path which “Resolves the wildcard characters in a path, and displays the path contents”.

This does exactly what I need:

Wow, Resolve-Path is a perfect example of the many hidden gems in PowerShell!

So I decided to wrap signtool.exe in a PowerShell cmdlet as PowerShell also makes it easy to locate the correct code signing certificate from the certificate store.

RAD Studio Tokyo 10.2(.2) Data Collection

Mon, 18 Dec 2017 12:10:51 +0000

Just a very quick note: I was just installing RAD Studio 10.2.2 when I noticed the installer has an Options button:

So I clicked it to see what options are available and noticed that the "Embarcadero Customer Experience Program" is opted-in by default:

Change NetScaler Password Hash from SHA1 to SHA512

Wed, 13 Dec 2017 13:53:08 +0000

This morning I wanted to install the NetScaler patch for the TLS padding vulnerability and of course I made a backup before deploying it.

Note: If you haven’t installed this patch yet I would recommended to do so: see CTX230238 and check out the ROBOT attack -Return Of Bleichenbacher’s Oracle Threat page to check which other products you may have that are vulnerable.

Upon checking the backups (I always download the backup and verify that the archive is intact) I noticed that one of my NetScaler’s uses SHA1 for the password hash whilst the other one uses SHA512:

I thought that this was a little strange as both NetScaler's are running the exact same build. However one of them (the one that uses SHA512) was reinstalled recently whilst the one using SHA1 has been upgraded.

Get Windows 10 Version Number with PowerShell

Tue, 04 Apr 2017 16:54:02 +0000

As you may heard, the API’s returning the Operating System version have changed, started with Windows 8.1 and Server 2012 R2.

The reason for this change is Application Compatibility but let’s take a little closer look into this why.

As an application developer there may be a need to check the version of the OS you’re running on. A typical example is when you are using an API that only works on a specific Windows version (and up). Or the other round, you’re not supporting an older version of Windows (say Windows XP as an example).

A common error in such version checks is to check for a specific Windows version but forget to take new (not yet released) versions into account.

Where does the Citrix Linux VDA store settings?

Thu, 23 Mar 2017 17:02:44 +0000

I recently (well today really) started playing with the Citrix Linux VDA. I took Ubuntu to test because I happen to like Ubuntu.

I didn’t get it to work correctly right away though and during troubleshooting I wanted to know where the VDA is storing it’s settings.

I found the following file /etc/xdl/ctx-vda.confwith the following contents:

On forbes.com, Cookies and Ads

Tue, 14 Mar 2017 16:34:52 +0000

Even though I try not to visit the forbes.com site anymore due to their heavy usages of ads, anti adblocker and overwhelming number of cookies they’re trying to push, sometimes however I accidentally follow a tweet that leads to forbes.com and just notice it to late.

Besides wasting your bandwidth, mobile data and especially time there have been a few occasions were the forbes.com page was actually serving malware from their adfeeds.

It annoys me bigtime so let’s “fix” this:

First thing that happens upon visiting the forbes site is that you get a blurred background with a random ad or quote of the day and you need to press Continue to article:

If you open the Developer console in Chrome (Application tab) you can see that Forbes uses a cookie that expires in 24 hours. This cookie make sure that you don’t see the “welcome” ad for 24 hours:

Modifying a .NET Application

Tue, 14 Mar 2017 15:31:03 +0000

I will explain why in a seperate post, but on my MacBook Pro I wanted to use the Intel Thunderbolt driver under BootCamp instead of the ones supplied by Apple.

The Thunderbolt control program however refused with the following error message:

It’s really beyond me why Intel would deliberately block their Thunderbolt software on Apple hardware (under Windows). Believing this was just a simple hardcoded hardware check rather than any hardware issue that would prevent the drivers to work I proceeded into finding where the check takes place.

Convert Executable to PowerShell

Mon, 13 Mar 2017 17:25:56 +0000

Recently I stumbled upon an executable that appeared to be a PowerShell script converted into an executable.

I was curious to the actual script so I decided to have a look and see how I could convert the executable back into PowerShell.

Having seen similar techniques to turn vb scripts and java jar’s into executables I first looked if this particular executable was simply carrying the payload in the resource section.

I opened the executable with Resource Hacker and saw 2 resources (note that I am using a simple HelloWorld executable here in the screenshots). The first resource, named 1, is clearly a Unicode string with the title:

Resource Hacker - HelloWorld.exe

Split a string by dollar sign ($) in PowerShell

Mon, 13 Mar 2017 15:28:13 +0000

Just a very quick post (more like a note to self) but I wanted to split a string with the $ sign in PowerShell:

powershell Download

'one$two$three$four$five' -split '$'

Took me a little while to realize that this doesn’t work as the split operator in Windows PowerShell uses a regular expression in the delimiter, rather than a simple character.

Google Earth fix for XenApp, RDSH & Horizon

Mon, 20 Feb 2017 20:26:51 +0000

Both Google Earth and Google Earth Enterprise do not work correctly for multiple users on shared Hosted Shared Desktops (I still prefer to call it Server Based Computing but that’s likely because I’m an oldtimer).

Problem summary
So let’s look at the actual issue: the first user on a server is able to launch Google Earth but for any subsequent users on the same server Google Earth fails silently.

Problem details
Google Earth uses various synchronization objects such as Events and Mutexes but registers those in the \Global namespace instead of the \Local namespace.

Show Client IP Address when using NetScaler as a Reverse Proxy

Fri, 10 Feb 2017 14:10:45 +0000

Recently I switched over my blog from a hoster to a self hosted VM. In my setup I am using Citrix NetScaler as a reverse proxy.

Simular to when you’re using a 3rd party reverse proxy such as CloudFlare you will see the IP address from the reverse proxy instead of the actual Client IP Address on your webserver.

This means that your logging will all show the same, internal, IP address and that IP Based Access Rules will not work.

Fortunately this is easy to solve by having NetScaler add the Client IP Address in the headers and rewriting the address on your webserver.

Blog improvements

Tue, 07 Feb 2017 15:56:21 +0000

When I started this blog in 2007 (wow that’s almost 10 years ago) I went for a cheap web hoster with a reasonable performance to host it.

In the beginning performance was acceptable but over the years it has degraded and of course user experience standards have changed.

I decided it was time to do something about it so I’ve moved the blog from a shared platform to my own server.

This server is running on optimized flash storage where most writes are DeDuplicated and never actually hits the flash disks:

Citrix Receiver Unknown client error 1110

Tue, 07 Feb 2017 15:08:27 +0000

Citrix Receiver and StoreFront error messages are sometimes confusing or lacking details so I decided to make little blog notes about common issues when I see them. So without further ado here’s #1:

In Citrix Receiver I tried to logon remotely via NetScaler Gateway and got the following error message: “Cannot get your apps from the store”

Citrix Receiver

Enable Developer mode on VW Discover Pro with VCDS

Tue, 17 May 2016 22:46:21 +0000

If you try to enable "Developer mode" on the VW Discover Pro navigation with VCDS you will get the following error: "Request out of range:"

This happens because VCDS uses a type 0x02 (Programming) session but this adaptation needs type 0x4F (Developer) session.

Shodan, search engine for IoT or hackers delight?

Sat, 14 May 2016 15:36:22 +0000

Today I stumbled upon Shodan, a search engine for devices and services.

I decided to search for Citrix and this was the first page of results:

It's interesting to see that we get details such as the name of published applications. But it's possible to get even more details:

Invalid file handle when trying to delete a file

Mon, 09 May 2016 12:30:02 +0000

When I was trying to delete a folder from my local harddrive (cygwin64 in my case) I got the following error message: "Invalid file handle.":

I then attempted to delete the folder from the command prompt which failed as well with an "Access is denied" error:

Citrix PVS RAM cache size Performance Counters

Wed, 30 Mar 2016 14:58:54 +0000

There has long been a debate about how to accurately view the size of your Citrix Provisioning Services ram cache size. SO much so that even Citrix clarified on how to view this detail using yet another tool

The thing is, this is all fine and well, but it’s a bit of a pig to actually get this data when you need it, or in an automated way. Wouldn’t it be better if we could have something easier?

Lately, Andrew Morgan and I decided to sit down and create an easy to use, Windows performance counter for the key metrics in a PVS cache and provide them to the community for use.

These counters turned out to be fascinating, as they really show how the cache works.

Our latest counters (which can be downloaded below) provide the following counters for easy access:

PVS Ram cache size (MB)
PVS metadata size (MB)
PVS Write Cache VHD disk size (MB)
PVS Ram Cache Percent used.

As there is no accurate way to detect how much ram is assigned to cache via Citrix Provisioning services, this value must be provided or this performance counter is missing.

Upload ovf/ova to vCloud Director with PowerShell

Wed, 14 Oct 2015 10:08:49 +0000

Recently support for NPAPI has been removed from Google Chrome. While understandable from a security point of view it does mean that some plugins no longer work.

A good example is VMware's Client Integration Plugin where we've lost the ability to upload an ovf template. While VMware has published a fix for vCenter (see this kb), it has not been fixed for vCloud Director:

Deploy VCSA 6 to vCloud Director or vCloud Air

Mon, 05 Oct 2015 20:11:47 +0000

In versions prior to 6.0 VMware supplied the VCSA (vCenter Server Appliance) as an OVF template that could be imported directly.

Starting with version 6.0 the installation process has changed and now consist of an .iso file containing a custom, HTML based, installer. Vladan Seget has a nice blog post where he describes the installation.

This installation process is annoying, it needs a separate client (Windows) machine to run the installer on, requires the Client Integration Plugin (which doesn't appear to run well on chrome now that support for npapi/dpapi has been removed):

But even worse is that we cannot import VCSA 6.0 in vCloud Director. Even converting the OVF inside the iso file doesn't help because vCloud directory lacks support for Deployment Options.

Update AMD Display Driver under BootCamp

Mon, 21 Sep 2015 22:57:15 +0000

I’m using Windows 10 with BootCamp on my MacBook Pro (Retina, 15-inch, Mid 2015). Overall I’m pretty happy with the hardware but Apple seems to limit functionality when running under Windows.

A good example is the trackpad which simply doesn’t operate as smoothly as under Mac OSX. This isn’t because Windows is a less good Operating System, it’s simply Apple supplying drivers and support software this is less good.

For the trackpad I found a good solution with Trackpad++ which enables 2, 3- and 4-finger gestures and improves scrolling.

The AMD Display Drivers as supplied with BootCamp are instable leading to “Display driver stopped responding” messages.

Synchronizing Citrix ShareFile with PowerShell

Wed, 28 Jan 2015 11:39:17 +0000

The Citrix ShareFile Sync application is quite limited in functionality, one of those limitations is that you can only synchronize to a single (one) local folder.

As Helge Klein wrote in his excellent article "Configuring Citrix ShareFile Sync from PowerShell" this is simply a GUI restriction and not a restriction in the actual ShareFile sync engine.

Helge describes that you can easily do this in PowerShell with the following example:

Add-SyncJob example powershell Download

Add-SyncJob -ApplicationId 1 -ApplicationName "PowerShell" -Account helgeklein.sharefile.com
-RemoteFolderName "foc86c19-d904-434a-9d67-xxxxxxxxxxxx" -LocalFolderPath "D:\Daten\Sync to ShareFile"
-AuthType 4 -UserName xxxxxx@helgeklein.com -SyncDirection 2 -Password "MY SHAREFILE PASSWORD"

While the command was accepted, nothing was synchronized.

Twitter Analytics and AdBlock Plus

Thu, 28 Aug 2014 13:35:47 +0000

Twitter has opened access to Analytics for all users. However when you use an Ad Blocker, like Adblock Plus, you'll get the following error:

For Adblock Plus you can fix this by adding a filter: go to Filter Preferences and on the "Custom filters" tab add a new filter within a filter group (or create a filter group for this rule).

Use this as a filter rule:

@@||ads.twitter.com/stylesheets/ads-allow.css

And don't forget to Enable the rule!

EDIT: Twitter user @Ertraeglichkeit mentioned a different method:

Handling ini files in PowerShell

Tue, 29 Jul 2014 15:03:08 +0000

This morning Aaron Parker was wondering if Hash Tables could be used to work with ini files:

I thought it was a great idea because in Hash Tables you can use the . operator to get or set a Hash Table entry. But I wondered what to do with sections in ini files. Then I got the idea to use nested Hash Tables for that.

The result is two functions, one to read an ini file into a nested Hash Table and one function to write it back to an ini file.

Sorting a hashtable by byte value in PowerShell

Tue, 22 Jul 2014 12:03:28 +0000

In a PowerShell script I needed to sort a hash table by byte value (not alphabetically, lowercase parameters will be listed after uppercase ones). An example for this requirement is the Amazon Product Advertising API.

Consider the following hashtable as an example:

Example Hash Table powershell Download

$params = @{}
$params.Add("AssociateTag", "dummy")
$params.Add("AWSAccessKeyId", "AKIAIOSFODNN7EXAMPLE")
$params.Add("IdType", "0679722769")
$params.Add("Operation", "ItemLookup")

If we use the Sort-Object to order the list (note that we need to use the GetEnumerator method):

Sort Hash Table powershell Download

$params.GetEnumerator() | Sort-Object Name

We will get the following result:

Sort Results powershell Download

Name Value
---- -----
AssociateTag dummy
AWSAccessKeyId AKIAIOSFODNN7EXAMPLE
IdType 0679722769
Operation ItemLookup

If you use the -CaseSensitive switch the resulting order will remain the same.

Get Actual CPU Clock Speed with PowerShell

Fri, 18 Jul 2014 16:29:24 +0000

To get the best performance out of Virtual Desktops it is essential that the power configuration in the system BIOS and the HyperVisor are configured for maximum performance.

Many people have blogged about the importance of these settings like, Andrew Wood, Helge Klein and Didier Van Hoye. So I will not go into details again.

But how do you check from a Virtual Machine if you are actually running at full clock speed or not?

I have written a PowerShell script to do just that (requires at least PowerShell v3).

Here are some screenshots:

Running with "High Performance profile":

Running with "Balanced" power profile:

Set alert parameters with Visual Studio Authoring Extensions

Fri, 18 Jul 2014 16:08:33 +0000

In a SCOM Management Pack Custom Properties can be used for Alert Description and Notification as described in this blog by Kevin Holman.

In my case I wanted to add the Display Name and the Performance Counter Value in a Performance Threshold Monitor. In XML it would look this this:

xml Download

 <alertsettings alertmessage="Memory.Usage.AlertMessage">
 <alertonstate>Error</alertonstate>
 <autoresolve>true</autoresolve>
 <alertpriority>Normal</alertpriority>
 <alertseverity>MatchMonitorHealth</alertseverity>
 <alertparameters>
 <alertparameter1>$Target/Host/Property[Type="System!System.Entity"]/DisplayName$</alertparameter1>
 <alertparameter2>$Data/Context/Value$</alertparameter2>
 </alertparameters>
 </alertsettings>

But how to add these parameters when using the System Center 2012 Visual Studio Authoring Extensions?

Cannot connect to iTunes Store after enabling https scanning in Sophos UTM

Wed, 16 Jul 2014 18:33:25 +0000

I am currently implementing Sophos UTM and I quite like this solution. It is free up for home usage and can easily be installed on a hypervisor.

I wanted to scan encrypted traffic (ssl) as well so I activated the "Decrypt and scan" option:

When testing this on one of my iPad's I noticed that the App Store didn't work properly anymore.

When I tried to update applications I got the following error: "Cannot connect to iTunes Store". Additionally when I searched for Apps the search would return no results.

non-existent schema type 'Snmp!System.SnmpVarBindsSchema' error in SCOM

Sun, 13 Jul 2014 23:50:59 +0000

Today I encounterd what seems to be a bug in the System Center 2012 Visual Studio Authoring Extensions. I wanted to define a Performance Collection Rule that reads out the percentage of free memory from an SNMP device.

Since the device returns only the percentage of used memory I needed to use the ComputedPerfProvider provider to substract the used memory percentage from 100.

I could of course report used memory instead of free memory but I wanted the resulst to appear in the default SCOM Performance View, which only lists Free Memory:

Where to find System.NetworkManagement.Monitoring.mp?

Sun, 13 Jul 2014 13:22:13 +0000

I am currently working on a Management Pack for SCOM and I have studies a few examples on adding processor and memory counters.

These examples all reference a Management Pack named "System.NetworkManagement.Monitoring.mp" but this Management Pack is not bundled with the System Center 2012 Visual Studio Authoring Extensions.

Error MSB4018 when building a Management Pack with Visual Studio Authoring Extensions

Tue, 08 Jul 2014 14:38:56 +0000

I am currently working on a Management Pack for System Center Operations Manager (aka SCOM). I am using the System Center 2012 Visual Studio Authoring Extensions and during build of my project I suddenly got the following error: “MSB4018: The “MergeFragments” task failed unexpectedly”:

I searched on this error message but wasn’t able to find anything helpful. In order to get more detailed output from MSBuild I changed the MSBuild project build output verbosity. To do this go to the Tools menu in Visual Studio and select Options. Navigate to the “Build and Run” node under “Projects and Solutions” and set both options to “Diagnostic”:

Fri, 09 May 2014 00:14:31 +0000

Aaron Parker was talking about the uninstall guid in his session “Hands off my Golden Image Redux” at Citrix Synergy.

I remembered that I had written a small PowerShell script to read out the uninstall GUID from an MSI file. This way you do not need to actually install the software to determine the uninstall GUID.

Dumping passwords in a VMware .vmem file

Mon, 25 Nov 2013 08:54:34 +0000

Benjamin Delpy the author of the well known mimikatz toolkit has released a very cool extension to WinDbg today.

In summary the extension can extract Windows passwords from memory dumps, hibernation files and Virtual Machine .vmem files (paging, snapshots).

Especially the ability to extract passwords from .vmem files was very interesting. So I decided to to test this out, so let's see how it works!

My presentation at E2EVC in Rome

Tue, 29 Oct 2013 21:44:43 +0000

I will be presenting a session at E2EVC in Rome next weekend.

Recently I published an article on my blog that shows how to run an executable of choice when the Citrix Receiver exits.

Error 1603 when installing Microsoft App-V 5.0 SP1 client

Wed, 23 Oct 2013 12:48:54 +0000

I wanted to do an unattended install of the Microsoft App-V 5.0 SP1 client.

I wanted to install using the MSI's instead of using the exe installer so I unpacked the MSI's from the installer as documented here.

The install failed however with MSI error 1603. I activated logging but that was not very helpful since it only logged "MainEngineThread is returning 1603".

Convert Citrix License Server VPX to OVF

Fri, 27 Sep 2013 16:41:54 +0000

I wanted to run a virtual Citrix License server in my LAB.

Unfortunately Citrix only provides the VPX License Server in XenServer format (.xva). If you want to run the VPX on VMware ESX or Microsoft Hyper-V you need to convert it first.

The option to convert a Xen Virtual Appliance to OVF format was removed in XenConvert 2.4.1. So for a conversion you need version 2.3.1.

Here are the direct download links:

However when I tried to convert the downloaded VPX (Citrix_License_Server_VPX_v11.10.0_Build_12002.xva) I got the error "Failed to decode tar header record":

Run a Process when Citrix Receiver Exits

Tue, 24 Sep 2013 16:11:59 +0000

A while ago I was doing some research for Magic Filter when I stumbled upon something interesting within Receiver.

Inside wfica32.exe is a function called _Eng_RunExecutableOnExit. That name caught my interest, I’ve made it a little more readable with Ida Pro:

The publisher could not be verified when launching an application with RES Workspace Manager

Fri, 13 Sep 2013 15:35:25 +0000

Today I was troubleshooting a warning message that popped up when launching a network application with RES Workspace Manager:

Usually this is a simple fix: add the servername (file://server) to the Local Intranet zone:

That worked when I launched the application directly. However when launching the application with RES Workspace Manager I would still get the warning. Even stranger: when I clicked Cancel the application would still be launched.

RD Gateway connection fails on Windows 7

Thu, 15 Aug 2013 11:27:15 +0000

I needed to connect remotely via Remote Desktop to a Windows Server 2012 machine.

I received an rdp file that was configured to use an RD Gateway server:

However when trying to connect from my Windows 7 laptop (x64) machine, I got the following error message:

Magic Filter Preview

Sat, 10 Aug 2013 16:34:26 +0000

In Enterprise environments users are often working on a remote (virtual) desktop such as when using SBC or VDI.

They typically get a full screen session, perhaps on a thin client, and have not idea that they are using a remote desktop.

The Problem
However when they press Ctrl-Alt-Delete they get either the local Security Attention Screen / Task Manager or nothing at all if it has been blocked.

Clever users know they can use alternative key combinations such as Shift-F2 for Citrix or Ctrl-Alt-End for RDS.

But that's not the seamless experience we want to give our users, is it?

PNAgent Icon Data Algorithm

Thu, 08 Aug 2013 17:34:05 +0000

Some time ago I wrote about the PNAgent data that is stored in the registry in XML format.

After that post Andrew Morgan asked me if I could extract the PNAgent icons from the XML data.

That got me interested so let’s look at this data!

If you look at XML from PNAgent the icondata as in the AppData.Details.Icon node you’ll see something like this:

Seems like the icon data is stored/encrypted in a proprietary format.

ClickOnce Applications in Enterprise Environments

Mon, 05 Aug 2013 16:51:21 +0000

ClickOnce is a Microsoft technology that enables an end user to install an application from the web without administrative permissions.

That's great isn't it?
While ClickOnce may sound great to developers it's actually a nightmare for Enterprise administrators because they try to prevent users from installing software themselves.

ClickOnce also incorporates an Automatic Updates mechanism which means that users might run different or not tested/approved versions...

Virtual Environments
It get's even worse in virtual environments such as VDI and SBC where machines are often non-persistent. Each time the users starts the application they will see a screen similar to the one below while they actually download and install it over and over again:

If the environment is persistent, it's not guaranteed that the user works on the same machine each day. This means that the application will be installed on every box the user ever logs onto...

How does it work?
In order to understand how we can best treat ClickOnce applications we need to understand how they work since MSDN documentation does not describe this in detail.

Debugging Tools for Windows Direct Download

Thu, 13 Jun 2013 15:57:38 +0000

Since some time Microsoft no longer offers the Debugging Tools for Windows as a standalone download.

You need to download the SDK installer and download from there.

This sort of annoys me since I sometimes need to install WinDBG quickly for some troubleshooting.

HDMI Output in Black & White

Wed, 05 Jun 2013 21:50:37 +0000

I connected my Dell laptop to my TV via HDMI and the picture on the TV was in Gray scale instead of Color.

I had connected my laptop before and it worked fine so I knew that my TV and the HDMI cable were working correctly. I had recently updated the drivers for my NVIDIA graphics card so I went into the NVIDA Control Panel.

Redirect Registry by Modifying .NET Executable

Thu, 30 May 2013 16:18:23 +0000

Yesterday I was troubleshooting an application that was migrated to Citrix XenApp.

The application is able to use a high precision scale which is attached to the client pc's com port. This com port is redirected to XenApp.

While testing users reported several issues, let's have a look at them.

Error configuring COM Port
Within the application the comport to which the scale is connected must be configured:

After pressing "Registreer" to register the new com port the following error message was shown

Application Compatibility Fixing to the Extreme?

Thu, 23 May 2013 16:48:36 +0000

Today's blog is about an application that was migrated to Citrix XenApp. During testing the users reported that several application menu's were missing.

An example is the settings menu where the System tab is missing:

Fat Client:	XenApp:

I suspected a permissions issue so I added the account to the Local Administrator group to verify that. And indeed the System tab was visible.

Process Monitor
I removed the account from the Administrators group and fired up Process Monitor. I set a filter on the process name (ra60.exe) and on Result (ACCESS DENIED):

Programmatically set Excel LinkedCell property with VBA

Wed, 22 May 2013 11:36:48 +0000

Yesterday I was working with an Excel document that contained Combobox form controls.

I wanted to count the number of cells containing a particular value using the COUNTIF formula. However the count returned 0 because the LinkedCell property of the Combobox was not set to the Cell that contained the Combobox.

To set the LinkedCell Ctrl-Click the Combobox to select it, right-click and select Format Control. Then set the correct Cell in the Cell link field:

My sheet contained about 150 Comboboxes, so obviously I was going to do this using a script. I couldn't find anything useful with Google so I wrote my own Macro.

Timestamp column in iOS SQLite database

Sun, 14 Apr 2013 15:59:45 +0000

I was researching a database from an iOS app called <appname>.sqlite. From the filename it was obvious that we were dealing with an SQLite database.

I opened the database with SQLite Database Browser and the table I looked at has datetime values which are expressed in the TIMESTAMP data format in SQLite:

SQLite documentation indicates that the TIMESTAMP format is based on unix time: the number of seconds elapsed since 01-01-1970 in UTC time.

Activate XDS with VCDS on Passat B7

Sun, 14 Apr 2013 14:47:02 +0000

XDS is an electronic differential lock, which was developed for the Golf GTI. But later on it was introduced as an option for other cars.

XDS is an advanced electronic differential lock, linked to the ESP system.

In moments of fast cornering XDS gives out exactly the right amount of power, providing pressure on the inside wheel to prevent wheel spinning. The result is better traction and a reduction of any tendency to under steer.

Golf mk6
On the Golf mk 6 it's possible to activate XDS with VCDS by going to control module 03, ABS Brakes, then 10, Adaptation.

Channel 36 controls XDS which can be set to:

0 - default
1 - weak
2 - strong

Skoda Octavia II
It's also possible on other cars, for instance the Skoda Octavia II where it can be coded in module 03, ABS Brakes, 07 Long Coding, Byte 17, Bit 3.

Passat B7
I wanted to know how to activate this on a Passat B7, but searching with google returned nothing.

Decrypting Dell vWorkspace .pit files

Mon, 08 Apr 2013 11:53:32 +0000

The Dell vWorkspace (previously Quest vWorkspace) Client can save a connection to a .pit file which is very similar to an .rdp file with one big difference: it is encrypted!

I am not sure why Dell/Quest have chosen to encrypt their files but a while ago I needed to know what was in a particular pit file so I could troubleshoot an issue.

I first created a test .pit file with the client (pntsc.exe version 7.6.305.791).

RC4 Encryption in PowerShell

Fri, 05 Apr 2013 16:27:32 +0000

For an upcoming blog post I needed to decrypt some data using the rc4 algorithm. I wanted to do this with PowerShell but sadly PowerShell and the .NET framework have no functions for it.

So I needed to implement it (download at the bottom of the post):

Convert Bin to Hex and Hex to Bin in PowerShell

Fri, 05 Apr 2013 11:17:24 +0000

For an upcoming Blog post I needed to convert a Byte Array to a Hex string in PowerShell and vice versa.

PowerShell doesn't come with HexToBin or BinToHex functions so here's my attempt at it:

Scriptable Citrix Password Encoder

Tue, 19 Mar 2013 16:27:49 +0000

A while ago I published a tool to Encode and Decode Citrix passwords. Today I am publishing a small update to this tool that makes it scriptable by adding a COM interface.

If you start the tool without parameters you will get the GUI, just like before:

To use the COM interface you first need to register the executable with the /regserver switch:

After the registration you can call it using any language that supports COM. To get you started I wrote a few examples

Java has discovered application components that could indicate a security concern

Tue, 19 Mar 2013 13:13:04 +0000

When starting a particular web based application Java popped up the following dialog:

The dialog asks us if we want to Block potentially unsafe components so to continue we should click no. However users tend to not really read such messages and click Yes which leads to this error:

MSCOMM32.OCX returns error 80040112

Wed, 13 Mar 2013 15:58:39 +0000

Yesterday I wrote about troubleshooting an application that used Com Port redirection in Citrix.

During the troubleshoot I noticed that the application used an ActiveX component, MSCOMM32.OCX, for serial communication.

I wanted to quickly test if the component was correctly registered so I searched the registry from HKEY_CLASSES_ROOT for mscomm32.ocx.

Returning a string from unmanaged dll to .net

Wed, 13 Mar 2013 10:01:31 +0000

I write most of my code in unmanaged languages such as Delphi and C/C++. Sometimes customers ask me to interface my code to their .net code in which case I create a dll for them.

A recurring thing is that I need to return string to .net.

There are many ways to do this of course but in all cases we need to manage memory: who will allocate the memory for the string and who is responsible for freeing it?

The case of the COM Port Redirection

Mon, 11 Mar 2013 14:53:44 +0000

One of my colleagues asked me to assist in troubleshooting an application called SmartWare FM running on Citrix XenApp.

This application reads data from an external device called SECUTEST.

The device is connected to a COM port which is redirected to the XenApp session. In contrast to Microsoft Remote Desktop Services COM ports are not automatically redirected in XenApp but need to be mapped via eg a logonscript (NET USE COM1: \\Client\COM1:) or using UEM.

In my case the COM port was mapped with RES Workspace Manager:

Cannot create shell notification icon error during unattended install

Tue, 19 Feb 2013 15:52:33 +0000

I was troubleshooting an unattended installation of a particular application. The install seemed to hang right away so I figured it was presenting some kind of message (error?).

Using a Window Spy tool I made the setup process visible and saw the following message:

The unattended install was supplied by the vendor and apparently they use InstallAware.

The setup tries to create a Tray Icon, probably a setup progress indicator, but this fails because there is no shell running (the installation is pushed from a deployment server).

The case of the missing audio

Fri, 25 Jan 2013 16:07:06 +0000

Yesterday I was asked to investigate a problem with a presentation pc. Even though the volume was set maximal there was not audio output.

The machine was used to connect to a Citrix XenApp desktop and RES Workspace Extender was used to integrate local applications in the XenApp desktop.

The local sound volume control was published as a subscribed application so I launched that and verified that the volume was set to Maximum:

I decided to launch the local explorer shell and noticed that there were two volume control icons in the Traybar:

Return username instead of computername in a ThinApp

Tue, 15 Jan 2013 11:50:07 +0000

One of the lesser known features of VMware ThinApp is that you can supply a Virtual Computer name.

This is documented as follows in the package.ini reference guide:

VirtualComputerName Parameter
The VirtualComputerName parameter determines whether to rename the computer name, to avoid naming conflicts between the capture process and the deployment process.

Cannot redeclare class Snoopy

Mon, 14 Jan 2013 19:31:34 +0000

After installing a new Plugin in WordPress called Native Apps Builder I got the following error when I tried to go to the Plugin's settings:

Fatal error: Cannot redeclare class Snoopy in www/blog/wp-content/plugins/native-apps-builder/appsbuilderapi.php on line 34

This error is caused because a class named "Snoopy" is being declared twice. I figured that two plugins were incompatible with each other so I first needed to know which ones.

Wordpress and the Cookie Monster

Thu, 03 Jan 2013 15:19:19 +0000

As you are probably aware the EU has made legislation regarding the use of cookies on websites. This new legislation is active since May 2012.

The Dutch government has also issued legislation in the Telecommunications LAW which states that you must ask the user for permissions before server out cooking. Unless these cookies are necessary for the correct technical working of the website or service. This leaves some grey areas but for instance using Google Analytics is a clear case of a situation where opt-in is required.

Although I am not using Google Analytics I wanted to check what cookies my own blog was serving out and if it was necessary to ask for an opt-in.

Change Tab Order in an Executable

Wed, 02 Jan 2013 15:03:14 +0000

An application called Cardiology PACS was recently packaged for a Citrix XenApp environment. The functional tester reported a strange problem at the logon screen: after entering the username it was not possible to go to the password field with the TAB key.

This was a strange observation since I cannot imagine XenApp interfering with tab stops. So what was going on?

In the old situation the user was starting the application on his local pc. The application remembered the last username and pre-filled this, therefore the cursor was already in the Password field. The user simply entered his password and hit the Enter key:

On XenApp the Username field is not pre-filled because the last username is kept globally per machine. Therefore the user has to enter both the username and the password:

I tested the Tab key behavior in both situations and as I expected it didn’t work in both situations. This happens because the Tab Order has been messed up by the programmer (if you press Tab 9 times you do end up in the Username field).

Because this is something that would annoy me if I were the user I decided to fix it.

Trick to Export Private Key from Certificate Request

Fri, 28 Dec 2012 15:51:13 +0000

I noticed something interesting today: I needed to generate a Code Signing certificate from a Windows 2003 CA Server.

However the default Code Signing Template does not allow us to export the private key. I found a nice trick however that enables us to request a code signing certificate WITH private key.

To do this I first needed to enable the Code Signing template on the CA Server. This can be done using the Certification Authority MMC Snap-in: right click on the Certificate Templates node and select New | Certificate Template to Issue | Code Signing:

Change OPS picture with VCDS

Tue, 18 Dec 2012 12:31:56 +0000

This time a car topic: using VCDS you can change the picture that it's shown on the navigation headunit to match your car.

In my case it's a VW Passat Variant B7/3AA and it can be coded with VCDS:

Open Module 76 - Park Assist:

Office 2010 very slow when ThinApped

Tue, 11 Dec 2012 09:00:11 +0000

This blog is about an issue with VMware ThinApp and Office 2010 I discovered a while ago.

Environment
Customer is using Office 2003 natively on a Citrix XenApp 5 environment. Some users had a business need for Office 2010, therefore a ThinApp with Office 2010 was created (this customer uses ThinApp for App-Virt).

To make the picture complete: Thinapp version is 4.7.2-771812 and Office version is 2010 SP1 (14.0.6024.1000) .

Symptoms
Users complained that Office 2010 was very slow. Most noticeable was Outlook 2010 which was completely unusable.

Outlook startup time was minutes rather than seconds and while starting it seemed to delay on loading profile.

When Outlook was finally started, switching between folders and layouts felt really sluggish.

For example when switching from Calendar to Inbox took a few seconds, after which it would take almost 20 seconds for the e-mails to show. Switching between e-mail would take 2-3 seconds to display the contents in the reading pane.

License Check fails on Citrix XenApp

Fri, 07 Dec 2012 16:30:07 +0000

Today I was asked to assist in getting an Excel Add-In to work on Citrix XenApp.

The application was packaged into a Thinapp by one of our package engineers.

However when testing the Add-In on Citrix XenApp the following message appeared:

Apparently this application does a license check that fails when run from another server (how bad).

Disclaimer
Before we go on: I would like to make clear that my goal is not to be able to use an application without license. I am just trying to make it work within the customer’s environment.

Parse RES Building Blocks with PowerShell

Fri, 07 Dec 2012 13:29:20 +0000

Background
Customer uses Citrix XenApp 5 with ThinApp, RES Workspace Manager and RES Workspace Extender.

An application integration strategy is defined, the picture below displays the strategy and preferred order:

Question
Customer wanted to know the type (1..7) for all applications currently defined in RES Workspace Manager.

I decided to export all the Applications from RES WM as Building Blocks. This results in a folder with XML files. I decided to parse the XML files with a PowerShell script.

Application Hangs when Scanning in Citrix XenApp

Thu, 06 Dec 2012 16:10:50 +0000

Another interesting issue today with an application that runs on Citrix XenApp.

Environment
Customer has a Citrix XenApp 5 environment running on Windows Server 2003. Clients are all Windows XP and run the Citrix Online Plugin 12.3 full screen.

RES Workspace Extender is used to integrate locally installed application into the XenApp Session. Users have no access to the local desktop.

Symptoms
This particular application scans invoices using a USB scanner attached to the client and runs them trough a workflow.
Whenever the Start scan button was pressed the application froze.

Return username instead of computername to Applications

Thu, 06 Dec 2012 10:45:40 +0000

Some applications use the computer's name as a unique identifier, rather than using the user name. In a single-user-per-computer environment, this strategy works well.

However, in a Multi User environment such as Citrix XenApp or Microsoft's Remote Desktop Services (Terminal Server), all connected users report the same computername.

If the application relies on unique computernames to handle tasks such as file and record locking, then the application will fail.

We can however set an Application Compatibility Flag in the registry to return the username instead of the computername.

To demonstrate this behaviour I wrote a small Test Application called TestAppCompatFlags.exe.

Replacing WFP Protected files

Wed, 05 Dec 2012 15:33:45 +0000

On Windows 2000, XP and Server 2003 a mechanism called Windows File Protection (WFP) is used to protect system integrity.

How does WFP Work?
Inside SFCFILES.DLL a list of files is kept that are monitored for changes. When a monitored file gets deleted, modified or overwritten WFP will restore the original from one of the following locations:

Cache Folder (%systemroot%\System32\DllCache)
Network Installation Path
Windows CD (or i386 folder on harddisk)

But what if we need to replace such a file? You could write a batch file that copies the modified file to the cache folder, installation path and destination. And this may work if it's quick enough.

A more reliable method is to use an undocumented export from sfc_os.dll called SfcFileException (only exported by ordinal #5).

File not found error when scanning using Twain Redirection in Citrix XenApp

Tue, 04 Dec 2012 15:07:10 +0000

Scanners attached to client machines can be used from within a Citrix XenApp session via a mechanism called Twain Redirection.

For this mechanism to work correctly the file twain_32.dll must be present in the Windows directory.

On Windows 2008 this dll should be copied from winsxs (side by side) to the windows directory as described in CTX123981.

On Windows 2003 the dll is already in the correct directory, however applications that are not Terminal Server Aware cannot find this dll because the Windows directory is redirected to the user profile. Citrix recommends copying twain_32.dll to each user’s profile directory but this will take up unnecessary space.

So what alternatives do we have?

Screen flickering with PowerPoint 2010 on Citrix XenApp

Fri, 30 Nov 2012 14:18:22 +0000

Within half an hour of writing the article "Application causes Screen Flickering in Citrix XenApp Session" I got a message that the hotfix in that article also fixes a similar problem in PowerPoint 2010.

Office 2010 uses hardware acceleration for displaying images and when this is enabled (which is the default) you will see constant screen flicker when you try to display a presentation with Images on Citrix XenApp (Server 2003):

Screen Flickering when running WPF Applications on Citrix XenApp

Application causes Screen Flickering in Citrix XenApp Session

Fri, 30 Nov 2012 13:28:54 +0000

Yesterday I was asked to troubleshoot an interesting issue with an application running on Citrix XenApp.

Environment
This customer is running Citrix XenApp 5 on Windows Server 2003 (x86). On the Client Side the Online Plugin version 12.3 is used.

The Problem
When this particular application was active the screen was flickering and black blocks appeared at seemingly random places. Further more it was not possible to resize the window:

My experience is that display issues are often related to either HDX Flash Redirection (offloading flash to the client) or the Multi Monitor hook.

Get Process Id of a running Service

Wed, 28 Nov 2012 12:20:40 +0000

Sometimes you need to know the Process Id (PID) of a running service. Since Windows 2003 you can use the tasklist.exe tool with the /SVC switch. But how to do this programmatically?

The QueryServiceStatusEx API returns a SERVICE_STATUS_PROCESS structure that contains the PID.

Query Administrator Account Name with PowerShell

Thu, 25 Oct 2012 15:22:47 +0000

A customer had partially implemented a (written) policy in the past where the the Local Administrator account was renamed according to a special convention.

This policy stated that the Administrator account needed to be renamed to admin with the computername as a prefix.

However they didn’t know exactly on which machines this policy had been applied to in the past. I was asked to write a script that would check a list of machine names, query the Administrator account name and write this in a new list.

The Administrator account has a Well Known SID of S-1-5-21-xxxxxxx-500 where xxxxxxx is the SID of the computer.

Convert an IP Address to an Integer in C# in host byte ordering

Sat, 13 Oct 2012 15:18:26 +0000

Yesterday I wrote about converting an IP Address to an Integer in C#. But both methods I presented return the IP Address in network byte order.

However in some cases, especially when calling WinApi functions, you will need to convert the Integer to host byte order which is little-endian on Intel processors.

warning CS0618: 'System.Net.IPAddress.Address' is obsolete

Fri, 12 Oct 2012 13:43:21 +0000

For a call to a WinApi function I needed to convert an IP Address to an Integer in C#.

This can be done using the System.Net.IPAddress class:

text Download

using System.Net;

IPAddress ipa = IPAddress.Parse("10.4.2.91");
uint ip = (uint)ipa.Address;

Although this works, the compiler issues a warning:

Citrix License Server Crash

Thu, 23 Aug 2012 15:29:40 +0000

After updating a Citrix License server from 11.6.1 to 11.10 the Citrix Licensing Service crashed immediately after startup.

In the Event Log the following error was shown:

I suspected that there was a corrupt licensing file in the MyFiles folder (Default C:\Program Files\Citrix\Licensing\MyFiles).

Calling a function inside another assembly in .NET

Wed, 22 Aug 2012 09:42:06 +0000

I wanted to call a hash function from a .net executable from my code. My first step was to inspect the executable with Reflector.

The Hash function was in a namespace called Core:

text Download

namespace TheExe.Core
{
 internal static class AssemblyInfo
 internal static class StringExtensionMethods
}

internal static class StringExtensionMethods
{
 // Methods
 public static string Hash(this string original, string password);
 // More methods...
}

Notice that the Core namespace is marked as internal so it was not meant to be callable outside of the executable. It's still possible to call it using Reflection:

Error 1787 when logging in with domain account

Tue, 21 Aug 2012 11:43:35 +0000

After joining a new Windows 2008 R2 Server to the domain I could not login to the domain.

I would get the following error message:

Additionally the following error was logged in the Eventlog:

Modify VB Executable to force Taskbar Button

Sat, 04 Aug 2012 11:07:18 +0000

I had to troubleshoot an application that was published with Citrix XenApp. The problem with this application was that it didn't have an button/icon in the taskbar and the window would sometimes disappear.

I noticed that this (cr)application was written in Visual Basic, so I decided to run it through a decompilation tool.

The decompiler was able to list the forms used in the Application:

My Network Places Internals

Thu, 19 Jul 2012 11:26:12 +0000

I am using a PowerShell script to copy some elements of from the users old profile location to a new location. This includes the Nethood ("My Network Places") folder which contains the Network Places shortcuts.

A user reported that she could not save documents to Network Places anymore and after inspection the Network Places shortcuts were broken.

I started comparing the old Nethood folder to the new and observed the following difference in Explorer:

When copying entries from the Nethood folder with Explorer manually they worked fine, so somehow Explorer gives the Nethood folder special treatment.

Could not load file or assembly 'System.Configuration'

Wed, 18 Jul 2012 13:43:06 +0000

Today I was asked to troubleshoot an executable that didn't work correctly on Windows XP Embedded.

On startup it displayed the following message:

text Download

Unhandled Exception: System.IO.FileNotFoundException: Could not load file or ass
embly 'System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b0
3f5f7f11d50a3a' or one of its dependencies. The system cannot find the path spec
ified.
File name: 'System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyTok
en=b03f5f7f11d50a3a' ---> System.IO.DirectoryNotFoundException: The system canno
t find the path specified. (Exception from HRESULT: 0x80070003)

I verified that System.Configuration.dll was present (in C:\Windows\Microsoft.NET\Framework\v2.0.50727).

Excel 2010 multi-threaded calculation

Fri, 08 Jun 2012 13:21:19 +0000

I was just browsing through the Options tab in Excel 2010 when I noticed the following setting:

This feature was introduced in Excel 2007.
In the default settings, multi-threaded calculation is Enabled with "Use all processors on this computer".

On a physical desktop this would be the preferred setting since it will make formula calculation as fast as possible.

Decoding Citrix IMA Datastore Password

Tue, 29 May 2012 21:46:30 +0000

This morning Arjan Beijer sent me an interesting link to a youtube video about obtaining the Citrix IMA Datastore password using Windbg.

The video shows a method, discovered by Denis Gundarev to obtain the IMA Datastore password. Basically he uses DSMaint.exe and set’s a breakpoint on the call to CryptUnprotectData and then reads the password from memory.

I tried to call the CryptUnprotectData API with the data read from the registry directly but this failed with error NTE_BAD_KEY_STATE, this is defined in winerror.h and it means “Key not valid for use in specified state”.

DefaultPassword Dumper

Mon, 21 May 2012 22:39:05 +0000

Just a small post today: a small commandline utility that reads the “DefaultPassword” LSA secret.

This secret is stored in the registry under the SECURITY Hive:

Citrix Launcher Progress Update 1

Thu, 17 May 2012 23:19:12 +0000

After figuring out how to encode and decode the Citrix passwords my next step for the upcoming Citrix Launcher is experiment with config.xml and authenticating to the Citrix Web Interface.

I imported the NFuse.dtd from the Citrix Web Interface into Delphi with the XML Data Binding Wizard. The results in an NFuse Unit so I can easily create the XML data.

To create an authentication packet I use the following code:

Encoding and Decoding Citrix Passwords

Sun, 13 May 2012 21:55:02 +0000

I am working on a launcher tool for Citrix XenApp that can not only connect to a published application or published desktop but can also leverage Citrix Workspace Control to reconnect to disconnected and/or active sessions.

There doesn't seem to be any sdk that exposed the data we need so I am trying to reproduce what the Citrix online plugi-in does.

I used a HTTP monitoring tool to capture the traffic between the Online plug-in and the Web Interface. First the online plug-in will retrieve the config.xml from the server specified via the Change Server option:

Setup was unable to verify drive C while installing Windows NT4 Terminal server on VMWare

Thu, 10 May 2012 13:56:29 +0000

For a research project I tried to install Windows NT 4 Terminal Server on VMWare Workstation (version 8).

The setup would always fail however with the following error:

Obviously the installation doesn't really fail because of too little memory and neither is the installation disc (an iso file) corrupt, it's a bug.

Bit Shifting in PowerShell

Thu, 10 May 2012 12:14:36 +0000

I needed to dome some Bit Shifting in PowerShell but unfortunately PowerShell lacks operator for Bit Shifting. I searched the .NET Framework for anything that allows for bit shifting but was unable to find anything suitable.

I didn't want to revert to C# so I implemented shift left and shift right functions in PowerShell.

The code isn't really pretty and could probably be improved (comments/improvements are welcome!) but here goes (please note that I implemented for bit shifting a byte):

Cookie Error on Citrix XenApp

Thu, 29 Mar 2012 10:02:10 +0000

A user reported that the following error while visiting a website on a Citrix XenApp server:

I tried adding the site to the Trusted Sites List and adding the url to the Per Site Privacy list:

But this didn't work, but I noticed that the site was "flickering" a lot so I suspected that HDX Flash Acceleration was the problem.

Reset Root Password on Linux Virtual Appliance

Tue, 27 Mar 2012 10:52:19 +0000

I needed to login as root on a Linux based virtual appliance to do some troubleshooting. In my case the appliance was running Suse Linux Enterprise.

I booted the VA using the Ubuntu Live CD and opened a Terminal. Then I used the cfdisk tool (sudo cfdisk /dev/sda) to view the partitions:

Create Active Directory Group with PowerShell

Thu, 15 Mar 2012 15:51:23 +0000

If you want to Create an Active Directory group with PowerShell there are a few things you need to be aware of:

First of all there is no direct way to create new objects in Active Directory. You always need to bind to the Domain or an Organizational Unit and call the Create method.

Example:

powershell Download

# Bind to OU
$ou = [ADSI]"LDAP://OU=OU=Groups,DC=Contoso,DC=COM"

# Create the Group
$group = $ou.Children.Add("CN=TestGroup", "Group")
$group.CommitChanges()

However the group is not yet complete:

AuthorizationManager check failed when starting PowerShell

Thu, 15 Mar 2012 14:03:18 +0000

When Launching a PowerShell script I noticed the following error: "AuthorizationManager check failed."

This happens because either the Current User or the All Users PowerShell profile is empty.

Imprivata fails to logon with special characters in the password

Wed, 14 Mar 2012 15:19:08 +0000

Interesting case today: customer uses Imprivate for two factor logon in combination with Citrix XenApp.

Users reported that logons failed after they had changed their password. After contacting the users we learned that this only happened with special characters in the password like ! and +.

To do the actual logon to Citrix Imprivata uses an executable which is actually an AutoIT script compiled to an executable.

After authentication the executable get's the password from the Imprivata Appliance.

I decompiled the executable to source and read the line that passes the password to XenApp:

Track who created the TreatAs registry key

Tue, 13 Mar 2012 13:41:56 +0000

Last week I wrote about an error message the users received when opening documents from SharePoint.

The article showed how to fix the problem but it didn't feel good that I didn't know where this "TreatAs" value was coming from.

I figured that I could read the timestamp key from the registry to see at what/date time the value was created. This value can be read using the RegQueryInfoKey API but there are various tools that can read it.

Lync Client Password Recovery

Mon, 12 Mar 2012 23:25:51 +0000

I wrote a small tool that dumps all stored password for the Microsoft Lync Client that I'd like to share here.

It's a commandline tool that takes no arguments:

Have fun with it!

Edit Document requires a Windows SharePoint Services-compatible application

Fri, 09 Mar 2012 14:23:11 +0000

Today I was troubleshooting a message that appeared when a user tries to edit a document from SharePoint on a Citrix XenApp server.

The user browsed to a word document on Sharepoint and selected “Edit in Microsoft Office Word” from the Combobox:

This would present the following error message to the user:

Running multiple instances of Lync (howto)

Wed, 07 Mar 2012 22:55:37 +0000

Yesterday I showed a video demonstrating it's possible to run multiple instances of the Microsoft Lync 2010 client simultaneously.

A little warning before we go on: the Lync Client was not designed to run with multiple instances. Or better said: it was designed specifically to prevent this, let's see how it does this:

On startup Lync calls an internal function called COcAppNoUI::InitializeMainInstance. In this function it creates a Mutex named "Office Communicator_" in the Global namespace. It also creates an Event in the Global namespace called "COMMUNICATOR-".

When a second instance of Lync is launched it checks if the Global Mutex exists and if it does it fires the Global Event. The Main instance has a thread that waits for this event using the WaitForMultipleObjects API.

Run multiple instances of Lync 2010–POC

Tue, 06 Mar 2012 19:27:23 +0000

This video shows that's it's possible to run multiple instances of the Lync 2010 client.

I am running natively, so I am not using ThinApp or App-V.

I will follow this up later with a how-to blog.

Running Multiple Instances of Lync 2010

1 Comments

FaeLLe Oct 9, 2012
So how did you manage it mate?

PowerShell script to read Agent Guid from Automation Manager

Tue, 06 Mar 2012 16:00:06 +0000

From a script I needed to schedule a project in RES Automation Manager 2011 for a particular server.

This can be done with the WMC.exe commandline tool as documented in the Admin Guide. However we must specify the agent's GUID instead of it's name. We can of course use the AM console to get the agent's GUID but it's more flexible to script this.

Unfortunately there's no API we can call so I am directly quering the AM database using a PowerShell script.

The script read the database server and database name from the registry so it assumes you have the AM console installed.

PowerShell RegEx Fun

Tue, 06 Mar 2012 11:19:53 +0000

I am writing a script that is going to automate a number of manual steps involved in creating a new image with Citrix PVS.

First step is to copy the most recent base image which is kept in a folder structure. The folder name is always YYYY-MM-DD (description):

I needed to determine the most recent folder and didn't want to rely on creation date. Instead I walk the directory tree and filter the date out of the filename with a regular expression:

Windows 8 comes with free hardware/software inventory tool

Thu, 01 Mar 2012 11:26:44 +0000

Yesterday I wrote about the Windows 8 CP WebSetup installer and told you that the Application Compatibility check creates a few XML files in the folder %AppData%\Local\Microsoft\WebSetup\Panther.

So what can we do with them?

The XML files are created by a separate exe in the WebsetupExpanded folder called WicaInventory.exe with the arguments: /apps /fast /ext "exe,sys" /output <XML file> /log <LOG file>

In my case the commandline was:

batch Download

WicaInventory.exe /apps /fast /ext "exe,sys" /output "C:\Users\rweijnen\AppData\Local\Microsof\WebSetup\Panther\WICA_Programs_REMKOLAPTOP.xml" /log "C:\Users\rweijnen\AppData\Local\Microsoft\WebSetup\Panther" "c:\Users\rweijnen\AppData\Local\Temp\1fd52b5b-2609-4156-ac02-49dca27a0a8d\WebSetupExpanded"

Let's see what's in WICA_Programs_REMKOLAPTOP.xml.

Undocumented commandline switches for Windows 8 CP

Wed, 29 Feb 2012 23:29:18 +0000

The Windows 8 Consumer Preview is downloaded as a Web Installer called Windows8-ConsumerPreview-setup.exe.

On my system the Web Installer crashed while checking Application Compatibility:

I clicked the Debug option and launched the Visual Studio debugger:

Convert MCli output into PowerShell Objects

Wed, 29 Feb 2012 21:35:49 +0000

I was experimenting today with the PowerShell cmdlets for Citrix Provisioning Server. I was surprised to learn that the output of these cmdlets are not PowerShell types such as collections and objects with methods and properties but just plain text output.

A google search for a method to quickly convert the garbage output to objects led me to this blog post by Frank Peter. He describes a clever use of the switch statement with regular expressions with the Get-DiskInfo cmdlet.

Using Frank's code as a basis I wrote a generic function that converts Mcli output to an array of objects.

Switching to the Services Session

Fri, 24 Feb 2012 14:49:21 +0000

Just read a tweet from @andyjmorgan about Interactive Service Detection. This made me remember that it's possible to switch to the Session 0 with an undocumented api in winsta.dll.

For this API to work you must have the Interactive Services Detection (UI0Detect) service running.

Where to download TraceView

Wed, 22 Feb 2012 13:57:29 +0000

Various Citrix knowledge base articles refer to a tool called TraceView.exe to view the output of diagnostic traces.

CTX106233 describes where to download traceview but this article is outdated because it describes an older version of the DDK (the Windows Driver Development).

The current DDK version (7.1.0) can be downloaded here and has the filename "GRMWDK_EN_7600_1.ISO".

Shutdown option on the logonscreen with Imprivata Onesign

Tue, 21 Feb 2012 16:12:12 +0000

I logged remotely to a server with RDP and I noticed that I had options to restart or shutdown that server. This means we can shutdown or restart a server without physical access and without authentication:

Session freeze when starting Excel

Mon, 20 Feb 2012 15:42:25 +0000

Environment
Windows 2003 Enterprise (32 bit), Citrix XenApp 5, RES Workspace Manager 2011, McAfee VirusScan Enterprise 8.7.0i.

Problem
When a opening an Excel workbook from Sharepoint the whole session freezes.

I asked the user to open an Excel workbook from Sharepoint and I noticed the following popup:

So my first thought was that the user somehow clicked this message to the background and IE was waiting for a response.

Change CD/DVD drive letter with RES Automation Manager

Fri, 17 Feb 2012 15:04:34 +0000

I needed to change the drive letter assigned to the cd/dvd station from an Automation Manager project.

Although most systems only have one cd/dvd drive, some machines might be equipped with multiple drives.

A couple of years ago I wrote a tool called ChDrvLetter that can assign a specific drive letter to a partition given it's volumename. In that tool I also included an option for CD/DVD drives.

Using the CDROM [Letters] parameter you can assign specific letters to the CD/DVD drives.

Script to Get Computer OU

Tue, 14 Feb 2012 11:12:30 +0000

Just some quick code to get the OU Name of the computer we run the script on.

VBS:

vbnet Download

Function GetComputerOU
	Dim objSysInfo: Set objSysInfo = CreateObject("ADSystemInfo")
	Dim objComputer: Set objComputer = GetObject("LDAP://" & objSysInfo.ComputerName)
	Dim objOU : Set objOU = GetObject(objComputer.Parent)
	GetComputerOU = objOU.OU
End Function

Wscript.Echo GetComputerOU

PowerShell:

powershell Download

function GetComputerOU
{
	$SysInfo = New-Object -ComObject "ADSystemInfo"
	$Computer = [ADSI]("LDAP://{0}" -f $SysInfo.GetType().InvokeMember("ComputerName", [System.Reflection.BindingFlags]::GetProperty, $null, $SysInfo, $null))
	return ([ADSI]$Computer.Parent).OU
}

GetComputerOU

Scripting Citrix Online Plugin Settings

Mon, 13 Feb 2012 13:55:45 +0000

The Citrix Online Plugin has a number of settings that can be changed. This includes things as Window Size and Color Depth:

In my case I wanted to preset the Window size to Full Screen so using Process Monitor I checked where the Online Plugin writes this setting. I Used a Filter that includes only the Online Plugin (PNAMain.exe) and the RegSetValue Operation:

The XLSploit explained

Sun, 12 Feb 2012 23:36:34 +0000

Recently I published a Proof of Concept that showed it was possible to launch unauthorized processes with both AppSense Application Manager and RES Workspace Manager.

Although I didn’t test Microsoft Applocker I have no doubt at all that we couldn’t bypass it.

I have named my Proof of Concept the XLSploit because I am using Excel as a trampoline. I choose Excel because this is generally a trusted process and VBA offers access to the Windows API that is needed.

After publishing the XLSploit I have talked to both RES and AppSense and not that they both have a response to my Proof of Concept, I consider it safe to tell a little more about how it works.

If you are merely interested in stopping the XLSploit, please scroll down to the end of the article.

Hibernation fails in Windows 7

Fri, 10 Feb 2012 22:40:46 +0000

A while ago my Windows 7 laptop suddenly refused to go into Hibernation. The strange thing was that the whole process of saving memory to the hibernate file seemed to work correctly. The screen would go black and there was lots of disk activity. Then after the disk activity finished the system would return to the logon screen.

A Google on this issue learned that the most likely cause was a driver preventing the system from going into hibernation. Using the cmdline "powercfg -DEVICEQUERY wake_armed" we can check if there are any devices that can wake the system. Another useful parameter is -ENERGY which generates an html report file.

But in my case this lead to nothing.

Speed up Windows 7 Resume by 20%

Fri, 10 Feb 2012 21:54:37 +0000

UPDATE: See this new article by Helge Klein.

Recently Helge Klein wrote a blog titled How to Speed Up Your Windows 7 Boot Time by 20%. He does this by disabling the graphical animation that Windows 7 displays while booting.

After applying this tweak I noticed that a resume from hibernation (which I do far more often than a full boot) still showed the graphical animation (and wasn’t speed up).

So how to disable the animation while resuming?

Harmony Client crashes upon exit

Tue, 31 Jan 2012 16:37:08 +0000

Today I was troubleshooting the application "Harmony Client" which crashed upon exiting:

The application had been thinapped and the error only appeared when starting the thinapped version.

Bypassing RES/Appsense Application Security

Fri, 27 Jan 2012 16:15:38 +0000

The video below shows a Proof of Concept of bypassing Application Security in RES Workspace Manager .

Please note that at this time the code is not publicly available so please don’t ask for it.

EDIT 2: I added a video that I received from someone who tried my Excel Sheet with AppSense Application Manager.

EDIT: I wanted to clarify a couple of things regarding this post.

First of all I would like to explain why I wrote this code and why I choose to test it with RES WM.

I had the idea about this approach a long time ago but I never got around to actually do it. The main reason was that I needed to convert Delphi code to VBA and especially converting some Windows headers was a lot of work. Then suddenly I noticed that someone had already converted the headers, so I all I had to do was rewrite the code that used it to VBA.

The choice for RES was made because of two reasons:

If you want to beat something, you want to beat the best and I most certainly consider RES WM to be one of the top products.
At the time I wrote the POC code I had access to an enviroment with RES in it.

I would like to emphasize that RES contacted me very quickly after publishing this blog. I've had contact with RES and they showed a very constructive approach with their primary goal being a fix or guidance for their customers. Hats of to RES taking a constructive approach and I will be working together with RES on this issue.

Finally I would like to state that I didn’t expect this post to draw this much attention, if I did I would have probably taken another approach.

From Jailbreak to Jailbreak part 2

Sat, 21 Jan 2012 14:02:15 +0000

In this post, which is a followup on my From JailBreak to Jailbreak post, I will describe the same procedure for A5 devices (iPhone 4S and iPad 2).

A lot of the stuff is really the same so I will not describe that again, this includes the actual update to iOs 5.01, xBackup, SHSH signatures and backup using iTunes.

Currently the Jailbreak for A5 devices with iOS 5 is only for iOS 5.01. Since Apple is expected to release iOS 5.1 very soon it’s highly recommended to update to iOS 5.01 NOW. Especially because it’s not yet possible to downgrade to iOS 5.01 using Tiny Umbrella.

Get the location of an advertised shortcut

Wed, 18 Jan 2012 13:28:36 +0000

Installers can create so called Advertised Shortcuts in the Start Menu. I wanted to check the Target Path of such an shortcut but Explorer doesn’t show it:

Take ownership of a registry key in PowerShell

Mon, 16 Jan 2012 16:39:36 +0000

After reading Andy Morgan’s (excellent) blog post about Removing Screen Resolution and Personalize shell extensions from a users desktop session I couldn’t help it.

I had to write a PowerShell script to take ownership of the mentioned registry keys. So here goes:

The case of the Slow Xerox Universal Print Driver

Wed, 04 Jan 2012 22:54:29 +0000

Earlier this week I was asked to investigate a problem with the Xerox Universal Printer Driver. Users complained that printing to a Xerox printer was much slower than printing to an HP printer.

I received a reference document from a user, a rather complex Excel sheet. When selecting multiple tabs it took almost a minute to generate a print preview in Excel 2007 running on Windows 2003 with XenApp 5.

I was aware of a bug in the Xerox Universal Driver where almost 9.000 files were copied into the user's profile directory (I wrote about that in an earlier post). But this seemed to be another problem.

From Jailbreak to Jailbreak

Wed, 04 Jan 2012 22:02:04 +0000

A few days ago I decided to update my iPhone which was still running iOS 4.3.1 to iOS 5.0.1. I delayed this update for a while because I had Jailbreaked my iPhone. Unfortunately an update is much more work when you have Jailbreaked because you also have to restore Cydia settings such as the repositories and Cydia installed Apps.

This blog post is not a guide on how to Jailbreak but more a collections of tips to go from a Jailbreak iOS 4.x to iOS 5.01.

If you notice any extra steps while doing your update please send them to me so I can add them to this post.

Error 372 in Thinapped Visual Basic Application

Tue, 03 Jan 2012 22:34:29 +0000

Today I was troubleshooting a Thinapped Visual Basic Application. The application halts with a Run-time error '372' when trying to run a report:

Microsoft KB article kb942870 hints to an ActiveX component that is registered into HKCU instead of HKLM.

A trace with the ThinApp Log Monitor reveals that the application is looking for an ActiveX component under HKCU:

System Process PID 4 is listening on port 80

Mon, 02 Jan 2012 10:23:21 +0000

I wanted to save the SHSH signatures from my iPhone before updating to iOS 5.01. I started Tiny Umbrella but it showed an error indicating that there's already a process listening on port 80:

I verified this using netstat (netstat -aon | find /I "LISTENING" | find /I ":80"):

NTVDM encountered a hard error

Wed, 14 Dec 2011 21:41:22 +0000

Today I troubleshooted an old DOS application that needed to run on a 32 bit Citrix XenApp Server. The last time I saw an actual DOS application in a production environment must be years ago.

When starting the application, the WOW subsystem (NTVDM) crashed with the message: "NTVM encountered a hard error.":

After spending some time troubleshooting I remembered a similar issue from a few years ago where a DOS application worked fine from the Console but refused to work from an RDP or ICA session.

Automatic Coming Home on Passat B7

Tue, 13 Dec 2011 20:01:50 +0000

I am not sure why Volkswagen has altered the behavior of the Coming Home function but on recent B6 and all B7 Passats it works differently.

Previously the Coming Home function was activated automatically either when taking out the ignition key or when leaving the car (depending on coding).

In newer B6 and all B7 models you need pull the high beam stalk towards you before leaving the car which is annoying and looks very silly.

So how can we restore the old behavior?

Citrix online plug-in received a corrupt ICA File

Tue, 13 Dec 2011 10:58:24 +0000

I was testing a Script I wrote to launch a Citrix XenApp session using the Ica Client Object. Typical code to do this may look like this:

vbnet Download

Const cHttpBrowser = "someurl.local"
Const cColorDepth = 4

' Create the ICA Client Object
Dim objIca : Set objIca = CreateObject("Citrix.IcaClient.2")

' Set Credentials
objIca.Username = "JohnDoe"
objIca.SetProp "ClearPassword", "Secret01"
objIca.Domain = "CONTOSO"

' Connection Settings
objIca.BrowserProtocol = "HTTPonTCP"
objIca.TransportReconnectEnabled = True
objIca.HttpBrowserAddress = cHttpBrowser

' Session Settings
objIca.Address = "MyApp"
objIca.Application = "MyApp"
objIca.DesiredColor = cColorDepth
objIca.ScreenPercent = 0 ' Full Screen
objIca.DesiredHRes = 0
objIca.DesiredVRes = 0
objIca.Launch = True

' Connect
objIca.Connect

On my testmachine it ran nicely but on a customer machine the script failed with the error 2312 "The Citrix online plug-in received a corrupt ICA File. The ICA File has no [ApplicationServer] section":

McAfee Anti Virus Unlock User Interface Password

Fri, 09 Dec 2011 15:50:12 +0000

I needed to change a few settings on a McAfee VirusScan Enterprise 8.7.Oi client. However there was a password protection in place that locks the user interface and nobody around that could tell me the password. So what to do?

Right, we check out where this password is stored and how we can get rid of it!

I openend vsplugin.dll in Ida Pro and searched for related strings such as password, lock etc.

Remember Driver Seat Heater Level

Sun, 04 Dec 2011 12:39:26 +0000

On a friend's car, a Passat B7 (3AA) the seat heaters didn't work. So I connected to the car with VCDS to see if we could troubleshoot this.

I opened Control Module 9, Central Electronics:

Then went to 7 Long Coding, and it turned out that the Seat Heating was not properly coded.

Read Maximum Password Age with PowerShell

Fri, 02 Dec 2011 13:47:44 +0000

I needed to read out the Maximum Password age with a PowerShell script in a Windows 2003 domain.

Reading out the maxPwdAge attribute is a trivial task in PowerShell (I am re-using the function AdsLargeIntegerToInt64):

text Download

$domain = New-Object System.DirectoryServices.DirectoryEntry

# Read maxPwdAge attribute and convert to Int64
$maxPwdAge = AdsLargeIntegerToIn64 $Domain.maxPwdAge.Value

In my case this returns the value -78624000000000 but how do we interpret this?

Embedding images in HTML

Fri, 02 Dec 2011 13:09:43 +0000

I was creating a small dialog in an .hta file and to make a little prettier for the user I included a company logo:

But I wanted to deploy the .hta as a single file.

Convert IADsLargeInteger to Int64 in PowerShell

Thu, 01 Dec 2011 16:03:46 +0000

Some Active Directory attributes return an 8 byte integer in the form of an IADsLargeInteger interface. An example is the pwdLastSet attribute from a user object.

Because the IADsLargeInteger object doesn’t provide type information PowerShell cannot read the HighPart and LowPart properties.

So I wrote the function below to get the Int64 value of an IADsLargeInteger:

Dutch Citrix User Group Launched

Thu, 01 Dec 2011 09:51:29 +0000

A while ago I was invited for a presentation at the UK Citrix User Group. I went there together with my colleague Ingmar Verheij and we had a great day there.

I was impressed with what I say there, a community that was very much alive and with good discussions. It was clear that the UK Citrix User Group was doing very well, thumbs up for their Steering Group!

So Ingmar and I wondered why there was no active Dutch Citrix User Group in The Netherlands. There had been an initiative in the past, the DUCUG so we decided to see if we could revive it.

Determining if Battery Backed Write Cache is installed

Tue, 15 Nov 2011 16:27:42 +0000

I wanted to know if a certain server had a Battery Backed Write Cache module (BBWC) on it's array controller.

I suspected it did not, but I had to be sure. Since this server was running production I couldn't open (Visual Inspection) or reboot it.

The server didn't have Insight Agents installed so I couldn't query it via iLO or the Insight Agents webpage either.

I knew that when you do a full install of the array controller bundled software it comes with a commandline tool, hpacucli.exe.

Installing Dell Wireless 5530 HSPA Mini PC #2

Sun, 13 Nov 2011 20:20:51 +0000

In a Comment on my Article "Installing Dell Wireless 5530 HSPA Mini PCI", Florian asked how to Install Dell's R298998 driver on non authorized system and card combinations.

I decided to have a look and downloaded this driver. The structure isn't much different from the R251153 driver I described in my earlier post.

When installing it on a non authorized card/laptop combination the error is similar:

When the error message appeared I looked into the temp folder and I noticed that just like before 2 folders were created (with a GUID as name). One of these folders contained the file driver_auth.exe which, as I already knew, performs the actual validation.

Set homefolder permissions with PowerShell

Tue, 08 Nov 2011 21:05:19 +0000

Today one of my collegues asked me to write a script that performs two actions for all users of a certain Organizational Unit:

Ensure that each user has modify permissions on their homefolder
Make each user visible in the Exchange Address List.

Sounds like a PowerShell job right?

I reused my function to set NTFS Permissions by SID:

Construct AQS date range with PowerShell

Fri, 04 Nov 2011 16:05:25 +0000

For a script I needed to create an AQS (Advanced Query Syntax) Query that contained a date range.

An example of such is a range is: date:11/05/04..11/10/04

However we need to account for regional settings where for example the data seperator and the order of day and month may be different.

In my example I wanted to match any data that is 30 days or older so let's do this in PowerShell:

Remote Registry from 32 to 64 bit

Fri, 21 Oct 2011 09:05:11 +0000

Yesterday I needed to set a few registry keys remotely from a 32 bit windows machine to a 64 bit machine.

I used reg.exe to set the key but even though it returned success the key wasn't altered.

As I suspected the key was written to the Wow6432Node. In the help I couldn't find any switch to force reg.exe to use the 64-bit view.

On a 64 bit machine this is not a problem since both 32- and 64 bit versions of reg.exe exists. The 32 bit version of reg.exe defaults to the 32 bit view and the 64 bit version defaults to the 64 bit view.

But luckily reg.exe has a switch (that is not listed in the help) to force the View:

Prevent additional IP addresses from being registered in DNS

Tue, 18 Oct 2011 15:01:33 +0000

In Windows 7 and 2008 R2 all IP Addresses are by default registered in DNS.

If you don’t want certain IP addresses to appear in DNS you can alter this behavior with Netsh using the skipassource flag.

Use the following syntax to add an additional IP Address with skipassource flag:

Analysing binaries with Binwalk

Wed, 12 Oct 2011 16:24:50 +0000

I came across an interesting tool today called Binwalk.
Binwalk is a firmware analysis tool that scans a given binary file for embedded files and executable code.

Binwalk requires a Linux machine, I used the Backtrack VM I used from my article about WEP keys.

Note there is no binary distribution of Binwalk so you will need to compile it but this is a breeze.

Exchange Move Mailbox Experiences Part 5

Tue, 04 Oct 2011 15:21:42 +0000

Another interesting Move Mailbox error and in this case I am really unsure how this would be possible!

Let's look at the Move Mailbox log:

powershell Download

1-10-2011 11:49:18 [The Exchange Server] A corrupted item was encountered during the move operation. The item wasn't copied to the destination mailbox.
<baditem id="0000000088B41EB2A774E14BA3B29759527EBBD007007A08E4E185746A45BF5C6EF2A17E8D5500000590285800007A08E4E185746A45BF5C6EF2A17E8D550000059028720000" flags="0x00000000" errorcode="0x80004005" errortype="MapiExceptionMaxSubmissionExceeded">
 <folder id="0000000088B41EB2A774E14BA3B29759527EBBD001007A08E4E185746A45BF5C6EF2A17E8D550000059028580000">Top of Information Store</folder>
 <sender>John Doe</sender>
 <recipient></recipient>
 <subject>archive.pst</subject>
 <messageclass>IPM.Document.PSTFile</messageclass>
 <size>38621879</size>
 <datesent>01/19/2006 14:30:57</datesent>
 <datereceived>01/19/2006 14:30:19</datereceived>
 <errormessage>Message (size 36.83 MB (38,621,879 bytes)) exceeds the maximum allowed size for submission to the target mailbox. You can increase this limit by using the Set-Mailbox cmdlet in the Exchange Management Shell.
Error details: MapiExceptionMaxSubmissionExceeded: IExchangeFastTransferEx.TransferBuffer failed (hr=0x80004005, ec=1242)

This error occurs because of a size constraint just like the one in the previous part.

But the strange part is that it seems to be a PST file (type IPM.Document.PSTFile) located in the Root folder of the Exchange mailbox (which is not possible AFAIK).

Exchange Move Mailbox Experiences Part 4

Tue, 04 Oct 2011 13:43:23 +0000

The previous part (part 3) addressed Mailbox Size but did you know that even Message Size (or rather Item size) can prevent a successful move as well?

Here's an example move mailbox log:

powershell Download

2-10-2011 3:18:58 [The Exchange Server] A corrupted item was encountered during the move operation. The item wasn't copied to the destination mailbox.
<baditem id="00000000469F68BB3AD7E745B2B8A041FC1B688C07007A08E4E185746A45BF5C6EF2A17E8D55000001537A9D00007A08E4E185746A45BF5C6EF2A17E8D55000001540FF30000" flags="0x00000000" errortype="MapiExceptionMaxSubmissionExceeded" errorcode="0x80004005">
 <folder id="00000000469F68BB3AD7E745B2B8A041FC1B688C01007A08E4E185746A45BF5C6EF2A17E8D55000001537A9D0000">verzonden nov 2004-aug 2005</folder>
 <sender>Jane Doe
 <recipient></recipient>
 <subject>Foto's afscheid John Doe 10 februari jl.</subject>
 <messageclass>IPM.Note</messageclass>
 <size>76121694</size>
 <datesent>02/15/2005 15:28:06</datesent>
 <datereceived>02/15/2005 15:28:06</datereceived>
 <errormessage>Message (size 72.6 MB (76,121,694 bytes)) exceeds the maximum allowed size for submission to the target mailbox. You can increase this limit by using the Set-Mailbox cmdlet in the Exchange Management Shell.
Error details: MapiExceptionMaxSubmissionExceeded: IExchangeFastTransferEx.TransferBuffer failed (hr=0x80004005, ec=1242)
Diagnostic context:

As you can see in the log this mailbox there is one item with a size of 72 MegaBytes.

Exchange Move Mailbox Experiences Part 3

Wed, 28 Sep 2011 11:08:21 +0000

In Part 2 I showed some details about Mailbox Rule corruptions that can disturb Mailbox Moves.

For this part the topic is Mailbox size, which can be an important factor in deciding which mailboxes you want to move first.

In my case the mailbox size was important because we agreed to move smaller mailboxes during the day but larger mailboxes only outside working hours.

For Exchange 2010 mailboxes it's very easy to obtain the size using PowerShell.

Example:

powershell Download

Get-Mailbox "rweijnen" | Get-MailboxStatistics | select DisplayName, ItemCount, TotalItemSize

 <td valign="top" width="70" align="right">ItemCount</td>

 <td valign="top" width="230" align="right">TotalItemSize</td>
</tr>

<tr>
 <td valign="top" width="130">Remko Weijnen</td>

 <td valign="top" width="70" align="right">313</td>

 <td valign="top" width="230" align="right">34.87 MB (36,564,183 bytes</td>
</tr>

DisplayName

But how can we get the Mailbox Size for Exchange 2003 mailboxes?

Inline arrays in PowerShell

Wed, 28 Sep 2011 10:34:18 +0000

Sometimes I want to process a list of “things” easily in PowerShell where the list is not in an external file but in the script itself.

Ideally this list would not be separated by e.g. a comma so it can be easily copy/pasted from external data sources.

Something like this:

powershell Download

$List = @("
John Doe
Jane Doe
James Bond
And so the list goes on
")

RNS 510 Startup Logo–My thoughts

Tue, 27 Sep 2011 22:13:44 +0000

If you have read my earlier blogs about the RNS 510 then you may know I have been working on creating custom startup logo’s for some time.

For some time now I know how the images are encoded and decoded between Windows bitmap and the native RNS 510 image format.

Recently I identified the checksums in the image data, and the differing parameters for the Seat, Skoda and VW versions of the RNS 510 firmware.

Exchange Move Mailbox Experiences Part 2

Tue, 27 Sep 2011 15:07:15 +0000

In part 1 we saw that a corrupted rule made the Mailbox Move fail.

I wanted to know if I had really a corrupted mailbox or maybe even corruption in the store or another problem.

So in this part I will describe how to break down the Mailbox Move Log.

First go to the Failed Move Request and select Properties:

Exchange Move Mailbox Experiences Part 1

Wed, 21 Sep 2011 16:38:23 +0000

I am currently working on a migration project from Exchange 2003 to Exchange 2010.

Most Exchange migration projects use Mailbox Moves to move the mailbox data to the new Exchange environment.

But there are some things I observed during Mailbox Moves (from Exchange 2003 to 2010) that are worth mentioning.

RNS 510 Editor

Tue, 20 Sep 2011 01:42:18 +0000

Work is in progress.

2 Comments

RNS 510 Startup Logo–My thoughts Sep 27, 2011
[...] Startup PicturesChanging the RNS 510 startup logoRNS510 firmware has new startup logo’sRNS 510 Editorshare: Bookmark on Delicious Digg this post Recommend on Facebook share via Reddit Share with [...]

Oracle Client install fails with NullPointerException

Tue, 06 Sep 2011 15:51:45 +0000

Today I was asked to assist in troubleshooting an Oracle Client (10g) installation. The installation halted very quickly with a java.lang.NullPointerException:

RNS510 firmware has new startup logo’s

Fri, 02 Sep 2011 19:32:48 +0000

I didn't notice it before but the new RNS 510 firmware (3810/3814/3816/3818) has a new startup logo for the Volkswagen firmwares:

Settings NTFS Permissions by SID in PowerShell

Fri, 02 Sep 2011 17:21:42 +0000

I am currently creating a PowerShell script that creates a user with all needed Active Directory attributes, Exchange mailbox, (TS) Home- and Profile directories and so on.

In such a script you can easily get failures because of Active Directory replication.

Check if a useraccount exists with PowerShell

Fri, 02 Sep 2011 11:51:37 +0000

Function below can be used to check if a given Username exists in Active Directory:

powershell Download

function UserExists([string]$Username)
{
	$strFilter = "(&(objectCategory=person)(sAMAccountName=$Username))"

	$objDomain = New-Object System.DirectoryServices.DirectoryEntry

	$objSearcher = New-Object System.DirectoryServices.DirectorySearcher
	$objSearcher.SearchRoot = $objDomain
	$objSearcher.PageSize = 1000
	$objSearcher.Filter = $strFilter
	$objSearcher.SearchScope = "Subtree"

	$colResults = $objSearcher.FindAll()
	return [bool]($colResults -ne $null)
}

Changing the RNS 510 startup logo

Wed, 31 Aug 2011 17:20:18 +0000

I wrote earlier about the startup logo's on the Volkswagen RNS 510 navigation.

Today I can finally tell you that I succeeded!
I changed the startup logo to the logo from the MFD2 DVD as you can seen on this picture:

RNS 315: Enable the hidden bluetooth carkit

Fri, 26 Aug 2011 14:37:13 +0000

The Volkswagen RNS 315 Navigation has a builtin Bluetooth carkit which is disabled by default. I am not sure why, I presume this is done because VW also sells carkits that integrate into the MFD.

The builtin carkit can be enabled using VCDS like this:

RNS 315 Enable Developer Mode

Fri, 26 Aug 2011 14:24:19 +0000

I recently had some time to play with VCDS and a friend's RNS 315 navigation. By default there is no test mode or hidden menu with extra features like on some other Volkswagen systems.

Using VCDS we can however (temporarily) enable the Developer mode.

Cannot achieve Exchange Server authentication

Wed, 17 Aug 2011 16:49:53 +0000

I was testing outgoing mail flow in my new Exchange 2010 setup, which should go from the CAS Servers to the Edge server in the DMZ.

After configuring the Edge subscription I noticed that outgoing mails got stuck in the queue with the following error:

"451 4.4.0 Primary target IP address responded with: "451 5.7.3 Cannot achieve Exchange Server authentication." Attempted failover to alternate host, but that did not succeed. Either there are no alternate hosts, or delivery failed to all alternate hosts."

I verified that name resolution back and forth was ok and that I could communicate on port 25, 50389 and 50636.

GetUserObjectInformation fails with Access Denied

Tue, 16 Aug 2011 21:11:01 +0000

Today I was reusing some old (pre vista) code the retrieves the Logon SID that I wrote a few years ago. The Logon SID is a special SID that identifies a logon session that has the form S-1-5-5-X-Y.

You can view your Logon SID with Process Explorer, right click a GUI process, select Properties and goto the Security Tab:

Get smallest Exchange Database in PowerShell

Tue, 16 Aug 2011 14:16:33 +0000

I needed to adapt some scripts that create a user with mailbox for Exchange 2010. The existing scripts had a hardcoded database for new mailboxes.

I wanted the mailbox to be created in the smallest database, but how do we determine this?

Set Exchange Product Key with PowerShell

Mon, 15 Aug 2011 09:17:14 +0000

By default Exchange 2007 and 2010 are installed in Trial mode so before going into production you need to enter the Product Key.

The Exchange Management Console will warn you if one or more servers are still in trial mode:

GetTokenInformation with TokenLinkedToken returns error 1312

Thu, 11 Aug 2011 11:30:47 +0000

The GetTokenInformation function can be used with the TokenLinkedToken Information Class on Windows Vista and higher to the linked (Elevated) token.

This is useful when User Account Control is enabled and you want to launch an elevated process e.g. from a service.

Programmatically Check if User Account Control is Enabled

Thu, 11 Aug 2011 11:27:13 +0000

Snippet below can be used to programmatically determine if User Account Control is enabled:

objectpascal Download

uses
 JwaWinbase, JwaWinNt;

function IsUACEnabled: Boolean;
var
 hToken: THandle;
 tet: TOKEN_ELEVATION_TYPE;
 dwSize: DWORD;
begin
 Win32Check(OpenProcessToken(GetCurrentProcess, TOKEN_QUERY, hToken));
 // TokenElevationType class only available on Vista+
 Win32Check(GetTokenInformation(hToken, TokenElevationType, @tet, SizeOf(tet), dwSize));

 Result := tet <> TokenElevationTypeDefault;
end;

1 Comments

GetTokenInformation with TokenLinkedToken returns error 1312 Aug 11, 2011
[...] specified logon session does not exist. It may already have been terminated.”So you should check if User Account Control is enabled in such cases (or make this error non critical).share: Bookmark on Delicious Digg this post [...]

PowerShell script to set Exchange Static RPC Ports

Wed, 10 Aug 2011 16:49:01 +0000

I am currently working on an Exchange migration from 2003 to 2010. For the implementation of a load balancing solution for the CAS/HUB servers I needed to set Static RPC Ports for the RPC Client Access Service and the Exchange Address Book Service.

The procedure of changing these ports is described on the Technet Wiki: Configure Static RPC Ports on an Exchange 2010 Client Access Server

Since I am lazy I decided to do this with a PowerShell script that would automatically do this for all CAS/HUB servers in my 2010 environment.

Exchange 2010 Install-ADTopologyService 0x800706D

Tue, 05 Jul 2011 09:43:04 +0000

I got the following error while installing Exchange 2010: “There are no more endpoints available from the endpoint mapper. (Exception from HRESULT: 0x800706D9)”

I looked up HRESULT 0x800706D9 which is defined in winerror.h as EPT_S_NOT_REGISTERED with the same error text.

Virtualized Mac OS X Freezes

Fri, 01 Jul 2011 15:12:39 +0000

I am running a virtualized Mac OS X machine in my VMWare Workstation but I noticed that after a period of inactivity the virtual machine would sometimes freeze.

Because this only happens after inactivity I assumed it had something to do with Power Saving so I changed the Energy Saver settings and that fixed it!

W3 Total Cache influences WP-PostViews counter

Tue, 28 Jun 2011 21:14:10 +0000

I have used the WP-Postviews Wordpress plugin for a while to keep track of the number of times my blog posts are being read.

But after installing the W3 Total Cache plugin I noticed that the read counters weren’t properly updated anymore. I figured this was a consequence of using a cache.

AD Internals: Display RID Allocation Pools

Mon, 27 Jun 2011 15:37:04 +0000

In my previous post I wrote about a problem I had with duplicate RID Allocation pools.

But how do we get more insight into these RID Allocation pools?

The DCDIAG tool can display this information per domain controleler using the following syntax

batch Download

dcdiag /s:server /v /test:ridmanager

Example output:

But where in Active Directory is this information stored and can we display it for all Domain Controllers at once for larger environments?

The case of the duplicate SID’s

Mon, 27 Jun 2011 10:04:01 +0000

I encountered another interesting error during Exchange 2010 installation today. During the Organization Preparation I got the following error:

The setup.log doesn’t give us much more detailed info:

text Download

[06-22-2011 11:16:29.0614] [2] [ERROR] Active Directory operation failed on dc001.zorg.local. This error is not retriable. Additional information: The requested object has a non-unique identifier and cannot be retrieved.
Active directory response: 0000219D: SvcErr: DSID-031A0FC0, problem 5003 (WILL_NOT_PERFORM), data 0

[06-22-2011 11:16:29.0630] [2] [ERROR] The server cannot handle directory requests.
[06-22-2011 11:16:29.0630] [2] Ending processing initialize-ExchangeUniversalGroups
[06-22-2011 11:16:29.0630] [1] The following 1 error(s) occurred during task execution:
[06-22-2011 11:16:29.0630] [1] 0. ErrorRecord: Active Directory operation failed on dc001.zorg.local. This error is not retriable. Additional information: The requested object has a non-unique identifier and cannot be retrieved.
Active directory response: 0000219D: SvcErr: DSID-031A0FC0, problem 5003 (WILL_NOT_PERFORM), data 0

[06-22-2011 11:16:29.0630] [1] 0. ErrorRecord: Microsoft.Exchange.Data.Directory.ADOperationException: Active Directory operation failed on dc001.zorg.local. This error is not retriable. Additional information: The requested object has a non-unique identifier and cannot be retrieved.
Active directory response: 0000219D: SvcErr: DSID-031A0FC0, problem 5003 (WILL_NOT_PERFORM), data 0

I remembered from a Tweet by Helge Klein recently that the Active Directory schema has no mechanism for enforcing uniqueness of an attribute.

Exchange 2010 well-known object entry install error

Fri, 24 Jun 2011 12:52:30 +0000

Today I was testing the installation of Exchange 2010 in a VMWare sandbox environment. We created the sandbox to test migration from a 2003 AD and Exchange environment to 2008 R2 with Exchange 2010.

We used a P2V to get real copies of the Active Directory and the AD upgrade to 2008 R2 was already tested.

But during the Exchange installation in the sandbox I got the following error:

Reading the otherWellKnownObjects attribute with PowerShell

Fri, 24 Jun 2011 11:19:25 +0000

I wanted to read the otherWellKnownObjects attribute from an Active Directory object.

In my case this was the Microsoft Exchange container in the Configuration partition:

The otherWellKnownObjects attribute is of type ADSTYPE_DN_WITH_BINARY which unfortunately cannot be viewed or edited with ADSI Edit:

Delphi TSaveDialog doesn’t work on Windows PE

Tue, 21 Jun 2011 15:03:07 +0000

In my SATA Controller Identification tool I was using the TSaveDialog (Delphi 2010) but I got a report that under Windows PE the dialog is never shown.

There’s no exception and I didn’t really bother to check why it fails. Instead I decided to replace it with the GetSaveFileName API which does work under Windows PE.

Switch SATA Operation Mode

Sat, 18 Jun 2011 21:38:19 +0000

Modern systems usually offer different SATA Operation Modes such as ATA, AHCI or IRRT.

The AHCI mode offers extra features such as hot swapping and native command queuing.

Many vendors set the SATA Operation Mode to ATA by default because it’s the most compatible mode but there are a few reasons why you might want to change it:

AHCI has a higher performance than ATA.
AHCI is a requirement for the TRIM command.
AHCI is required for self encrypting hard drives

Please note that the IRRT (integrated raid) mode is supposed to support all functionality of AHCI but in my experience it doesn't.

So the question is: how do we switch the SATA Operation Mode from ATA or IRRT to AHCI?

Crack WEP Encryption

Tue, 14 Jun 2011 11:55:39 +0000

I think everybody knows that using WEP to encrypt your WiFi network is not very safe. To demonstrate this I will show you how easy it is to crack the WEP encryption in this post.

Note that I am using my own Access Point here so I am not actually cracking someone else’s WEP Key.

Requirements:

back|track Linux distribution
USB WiFi card (most internal WiFi cards will not work)

In this post I am using the 32 bit back|track 5 VMWare image which you can use with VMWare Workstation or VMWare player.

After starting the back track Virtual Machine you can login with username root and password toor

Installing Dell Wireless 5530 HSPA Mini PCI

Fri, 27 May 2011 17:40:14 +0000

EDIT: See my followup article to learn how to reverse driver_auth.exe, decrypt and encrypt dell_wwan_sysID.dat.

I bought a Dell Wireless 5530 HSPA Mini PCI card for my Dell Precision M4500 laptop.

This is a small expansion card that works together with the built in SIM card slot that is present in most Dell (Business) laptops.

This SIM card slot is usually located near the battery compartment:

The card was installed in a few minutes since the antenna cables were present already and on my laptop I only needed to remove the backcover with just one screw.

Then I wanted to install the required software but this card is not officially supported in the M4500 (I bought this card because it was much cheaper on ebay).

So I took the driver from the M4400/Latitude E range, labeled R251153 but I got this error message when installing:

Determining stack size

Fri, 27 May 2011 15:10:00 +0000

I just read an answer on StackOverflow with this code:

objectpascal Download

var
 eu:DWORD;
begin
 asm
 mov eax,[fs:$4]
 mov ebx,[fs:$8]
 sub eax,ebx
 mov eu,eax
 end;

 ShowMessage(IntToStr(eu));
end;

Unfortunately it lacked explanation, so what does this code do?

RNS 510 Checksum Calculator

Fri, 20 May 2011 16:42:27 +0000

About a year ago I wrote a checksum calculator for the Volkswagen RNS 510 navigation unit.

The checksum is a variant on Crc16 and is present either at the end of certain files (eg #CRC16:db1d) or as a special file with the name CRC.16.

Renaming and hiding object in PowerPoint

Fri, 20 May 2011 11:26:59 +0000

I was working on a PowerPoint presentation that included screenshots that were using the Appear animation. I use it to only show a particular screenshot when I am actually talking about it.

However when editing the slide, the screenshots hide the slide text which makes it difficult to edit it.

And in the Animation Pane the pictures are shown as Picture1, Picture2 etc.

So I wanted two things;

Rename the object to a more meaningfull name in the Animation Pane
Hide the screenshots when I want to edit the text in the slide.

Using i-Clickr when you have no WiFi Connection

Fri, 20 May 2011 11:22:25 +0000

I started using the i-Clickr PowerPoint Remote iPhone App for my presentations recently. I like this app as it shows me the current (or next slide), annations and previous/next buttons:

How Outlook and Exchange handle Timezones

Wed, 18 May 2011 19:53:27 +0000

Again an old war story, this time about timezone handling in Outlook/Exchange.

I am not sure which year it was but I had just started to work for a new company and inherited an Exchange 5.5 Server.

The mail had been migrated from an earlier version and calendar data was migrated from Schedule+.

On the first change to Daylight Savings (DTS) all recurring appointments where shown one hour later (or earlier can't remember) in Outlook. A manual change was not an option: there were over 2000 mailboxes each with a lot of appointments.

We first tried a workaround by disabling DTS on the the workstations and then manually change the time when changing from and to DTS.

But this influenced the timestamps on externals mails and of course appointments with external parties.

After a lot of (and I really mean a lot) of researching I found that Outlook stores all times in an appointment as relative (UTC) time.

Upon display it uses an undocumented TimeZone descriptor field to convert to Local Time.

Stuff from an ancient past

Wed, 18 May 2011 10:08:35 +0000

I just found a very old backup file containing old source code for a few tools I wrote ages ago.

This was in 1997 on my first job for a company called PTT Telecom (the Dutch Telecoms) and I wrote some tools to make life easier.

They were all written in Turbo Pascal and supported Long Filenames when running under Windows '95 (there was a trick to do that under DOS).

The first tool was called Retreive Tool, it parsed a backup file from a private branch exchange (PBX) and could make reports about Licensing, the hardware in the PBX, Extension numbers and their hardware positions and so on.

Programmatically determine if we run server core

Tue, 17 May 2011 21:32:22 +0000

If you want to check if you are running on a Server Core edition of Windows you can use the GetProductInfo API.

GetProductInfo takes 4 input parameters that can be obtained using GetVersionEx and the OSVERSIONINFOEX structure:

objectpascal Download

var
 osvi: OSVERSIONINFOEX;
begin
 ZeroMemory(@osvi, SizeOf(osvi));
 osvi.dwOSVersionInfoSize := SizeOf(osvi);
 Win32Check(GetVersionEx(osvi));

No we call GetProductInfo:

objectpascal Download

var
 dwProdType: DWORD;
begin
 Win32Check(GetProductInfo(osvi.dwMajorVersion, osvi.dwMinorVersion,
 osvi.wServicePackMajor, osvi.wServicePackMinor, dwProdType));

VW RNS 510 Navigation Startup Pictures

Wed, 04 May 2011 21:06:43 +0000

A while ago I started exploring the firmware of an RNS510 Navigation unit. The RNS510 is an OEM navigation system, manufactured by Continental Automotive and is used in several models of Volkswagen, Seat and Skoda Cars

When the units is booting it shows a startup logo and I wanted to replace this logo with my own picture.

Deleting scheduled Altiris tasks from SQL

Tue, 03 May 2011 10:27:30 +0000

I needed to delete around 50 scheduled tasks from several machines in Altiris because something went wrong in on of the first jobs.

It would have better if the jobs were configured to fail on error and not continue but they weren't.

Deleting the jobs from the Altiris console is very, very, slow. First the console asks for confirmation (after showing the hourglass for a long time):

Then the actual delete can take a few minutes and then the next server and so on.

I decided to delete the tasks directly from SQL.

I know this is not preferred but I think in the end it's safe enough because I found a stored procedure called del_event_schedule which looks like this:

sql Download

ALTER procedure [dbo].[del_event_schedule]
 @schedule_id int
as
 begin transaction

 delete from event_schedule where schedule_id = @schedule_id

 if (@@error != 0)
 rollback transaction
 else
 commit transaction

So al it does is a (transacted) delete from the table.

SSL Certificates in termsrv.dll

Mon, 02 May 2011 14:54:39 +0000

I was digging around in termsrv.dll yesterday when I noticed that there are some (well 372 to be exact) SSL certificates inside the Terminal Server binary (termsrv.dll):

Two of them seem to actually contain the private keys as well, but I am not 100% sure it may be just a certificate in another format.

Extremely slow Virtual Machines on HP Smart Array P410

Mon, 02 May 2011 14:15:50 +0000

I was deploying virtualized Citrix XenApp Servers on HP BL460c G6 servers and somehow the storage (direct attached) responded very slowly.

I had expected reduced performance (see my earlier post) since I didn't have the Battery Backed Write Cache module installed.
I did order them but had to start deployment before they arrived.

I did not however expect such an extreme bad performance. Deployment took ages or sometimes failed completely and when logging in to a VM it responded very sluggish.

Disk Latency

I looked in the vSphere console what the Disk Latency was. Latency under 10ms is usually considered good while a latency between 10 and 20ms is a potential performance problem.

I was shocked to notice that the Disk Latency was much higher with peaks toward 2.000 ms (2 seconds!):

Apply IP Configuration from a Database

Fri, 29 Apr 2011 10:27:27 +0000

I am currently deploying 64 Citrix XenApp servers with Altiris. The deployment consists of an OS Image, OS Configuration and finally Citrix XenApp and Applications.

In the OS Configuration part the IP configuration needs to be applied and I decided to do this with a database.

The database consists of 2 tables; one table with the per host settings and one table with the global settings (such as DNS).

In the Altiris job both tables are read from an embedded VBScript and assigned to the NIC.

Database configuration

I created a database (SQL Server) called IPManagement with 2 tables:

HP Smart Array controller previous lockup code 0xAB

Thu, 28 Apr 2011 11:47:51 +0000

I ran into an error when I was upgrading hardware on an HP BL460c G6 Blade.

After placing 2 new (larger) hard drives the Array Configuration would hang after saving the configuration (It just kept blinking "Saving Configuration." forever.

Post Ratings Rant

Wed, 13 Apr 2011 22:32:30 +0000

On my blog I offer visitors the options to rate the articles I write using either thumbs up/down or a 1-10 star rating.

I am interested in what content my readers like so these ratings (and of course comments you leave) indicate what kind of articles you like and which you don't.

However some people feel the need to abuse this, take a look at this:

Wordpress redirects to wp-admin/install.php

Wed, 13 Apr 2011 22:14:36 +0000

My blog has been down for a short period, if you tried to open Wordpress would redirect to wp-admin.install.php and you would see this message:

Windows 2003 Server Standard memory patch

Sun, 27 Mar 2011 21:42:17 +0000

So a few days ago I got new memory for a development box - an upgrade from 4 to 6 GiB (later on even 8 GiB). Much appreciated as you can imagine. After dismissing the BIOS warning about changed amount of memory (oh really? :mrgreen:), I booted into Ubuntu and happily looked at the memory stats. After that I booted into Windows (a Windows 2003 Server Standard, but I’ll just use Windows from here on) and was disappointed to see only 4 GiB available. This is apparently a limitation specific to the Standard edition.

After some pouting, I decided to take action. Of course one of my first thoughts was to ask Remko, because he had done similar things for some other Windows versions. He pointed me to MmInitSystem, which was not an immediate hit, though. I loaded my kernel .exe into a disassembler to look at the details, but MmInitSystem was a lengthy and rather boring function. However, the advice was good and got me a good bit closer, especially when Remko also mentioned the use of ExVerifySuite in the logic that would set the limits. So I brought up the references to ExVerifySuite and - surprise surprise - only seven other functions used it and out of these only one was not recognized by name from the exports and debug symbols. And since the inspection of that function (at 0x00615FB0 in my kernel) proved that it was being called from MmInitSystem, this was an immediate hit.

dUP2 Patcher update

Sun, 27 Mar 2011 21:31:24 +0000

A missing feature in the dUP2 Patch Generator has always been to correct the PE Checksum.

After all if you write a clever search&replace patch but have to include the PE Checksum it doesn't make any sense.

But then I saw there's a beta version of dUP2 that supports ome new features one of them being a fix checksum option!

Tips for using SysPrep with Altiris

Tue, 22 Mar 2011 12:29:32 +0000

Altiris has built in support for Sysprep when creating or distributing images.

The documentation doesn't mention some things that are worth knowing so I will try to address them in this post.

Sysprep support can be added to Altiris during the install where it will ask you for the Sysprep install files (deploy.cab) per selected OS.

If you didn't add Sysprep during install you can copy deploy.cab to one of subfolders in the Sysprep folder. Eg for 32 bit Windows 2003 deploy.cab goes to Sysprep\DotNet\x86:

As I wrote earlier in this post it's very important to use the correct Sysprep version as each OS has it's own version.

Add VMXNET3 driver to Windows PE PXE Image

Fri, 18 Mar 2011 14:20:08 +0000

After compiling the VMWare VMXNET3 Driver for Linux I needed a driver for the Windows PE Image as well.

Compared to what I needed to do for Linux this was a breeze!

First we need the VMWare tools again so I grabbed windows.iso from /vmimages/tools-isomages.

The driver files are in a cab file, VMXNET3.cab, extract this cab file somewhere and open the Altiris PXE Configuration tool.

Select the Windows PE Entry and click Edit:

Then click Edit Boot Image:

Compiling Drivers for Altiris Linux PXE Image Part 2

Thu, 17 Mar 2011 15:39:12 +0000

In the previous part we have already setup the Ubuntu Virtual Machine and we did a build of the kernel image.

So now we can finally compile the driver, in my case I needed a driver for VMWare’s VMXNET3 Network Card.

VMXNET3 is VMWare’s paravirtualized network driver and offers better performance with less host processing power compared to the default e1000 driver.

First we need the source for the driver, we can obtain this from the VMWare Tools either from a running Linux VM or like I did by transferring the file linux.iso from /vmimages/tools-isomages from the vSphere server.

In the iso file is a single file, VMWARETO.TGZ and after unpacking we get a folder called vmware-tools-distrib.

In vmware-tools-distrib/lib/modules/source we find the vmxnet3.tar file that contains our sources. Copy the tar to the Virtual Machine and unpack it, then start a Terminal and cd to the directory where you unpacked the tar.

The first time I attempted a compile I received an error indicating that the file autoconf.h could not be found. After I found this bug report I was able to fix this by creating a link:

bash Download

sudo ln -s /usr/src/linux-headers-2.6.35-22-generic/include/generated/autoconf.h /usr/src/linux-headers-2.6.35-22-generic/include/linux/autoconf.h

We can compile the driver with the make command, referencing the kernel image we created earlier:

Compiling Drivers for Altiris Linux PXE Image Part 1

Thu, 17 Mar 2011 13:07:22 +0000

First we need to setup a Linux Virtual Machine with a distro of choice (I recommend a 32 bit version). I will be using Ubuntu here and the first step is to download the iso.

At the time of writing Ubuntu 10.10 was the Latest version so I used that one.

Create a new Virtual Machine and use the iso as install media, I am using VMWare Workstation and it recognises Ubuntu and performs an “easy install”:

The install is unattended (when VMWare Tools are installed you need to perform a login) and took only 6 minutes on my laptop!

Now we need to install gcc (the compiler), open the Ubuntu Software Center:

STOP: 0x0000005D when booting Windows PE

Tue, 15 Mar 2011 12:47:13 +0000

I was booting a new VMWare Virtual Machine with Windows PE through Altiris for initial deployment but Windows PE halted with a BSOD:

Windows 2003 align OS disk

Mon, 14 Mar 2011 15:11:48 +0000

If you read one of VMWare's Best Practices Guides (in my case this one) then you may have read that it's important to align guest partitions.

We can do this (for Windows OS) using the DiskPart tool that comes with the OS since Windows 2003 SP1 (there is a hotfix for earlier versions).

On Windows 2008, and higher, all partitions are automatically aligned to a 1 MB boundary.

But how to do this for the OS disk on Server 2003?

My first thought was to open a command prompt during setup, right before creating the partitions and then use diskpart.

However the OS partition is created during the Text portion of the install process and even though we can get a cmd prompt using SHIFT-F10 we get the recovery console (which has a builtin diskpart but cannot align).

So I used a Windows PE bootdisk. Any version with Diskpart should do but I used a bootdisk from Symantec Backup Exec System Recovery that I've customized to my own needs.

If you boot the original Symantec disk you can open a command prompt by accessing a hidden feature: move the mouse above the "S" from Symantec until you get a Hand icon and press the left mouse button:

Booting a Virtual Machine from USB Drive

Mon, 14 Mar 2011 12:59:53 +0000

I wanted to boot a Virtual Machine from an USB Stick but even though you can Connect USB devices to VMWare you cannot boot from it.

It can be done however using a boot manager that is able to perform a boot from USB media. I used Plop Boot Manager.

Download one of the stable releases (I used 5.0.11-2) and extract plpbt.img from the archive and mount this (don’t forget to select the Connect at power on option) and when booting press Esc for the Boot Menu.

This would be a good time to Connect the USB device to the Virtual Machine, right click the USB device in the bottom bar:

And select the Connect option:

Click OK on the warning message:

AES-NI Benchmarks

Fri, 11 Mar 2011 11:35:20 +0000

As you may know, recent Intel processors have an extension to the x86 instruction set called Advanced Encryption Standard Instruction Set (AES-NI).

AES-NI is basically hardware support for AES based encryption and because I had a chance to run some benchmarks on differing systems I was curious what the impact of AES-NI would be.

I used TrueCrypt for running the benchmarks because this is a real life application and it had support for AES-NI.

I first ran the benchmark on a laptop with an Intel Core2 DUO (P9700 2,80 GHz):

The next system was an Intel Core i7 Q740 (Quad Core with Hyperthreading, so 8 in total) machine.

Office Communicator 2007 R2 crashes after sign on

Thu, 10 Mar 2011 15:45:45 +0000

After I uninstalled Office 2010 64 bit and installed Office 2010 32 bit I had a problem with Office Communicator 2007 R2.

After entering my password and clicking sign in it crashed every time:

In the EventLog an Application Error was recorded with some additional error info:

Event Type: Error Event Source: Application Error Event Category: (100) Event ID: 1000 Date: 10-3-2011 Time: 15:20:52 User: N/A Computer: remkolaptop Description: Faulting application name: communicator.exe, version: 3.5.6907.221, time stamp: 0x4cddcd9f Faulting module name: KERNELBASE.dll, version: 6.1.7601.17514, time stamp: 0x4ce7bafa Exception code: 0xc06d007e Fault offset: 0x0000b727 Faulting process id: 0xf94 Faulting application start time: 0x01cbdf2e592fc53c Faulting application path: C:\Program Files (x86)\Microsoft Office Communicator\communicator.exe Faulting module path: C:\Windows\syswow64\KERNELBASE.dll Report Id: 9a4e3adf-4b21-11e0-8f0f-c0cb38a92f9b For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The exception code is 0xc06d007e which is defined in WINERROR.h as ERROR_MOD_NOT_FOUND, the error description is: "The specified module could not be found".

Office 2010 cannot remove registry key

Thu, 10 Mar 2011 14:12:22 +0000

I have worked with Office 2010 x64 for a while now but because of compatibility issues I wanted to remove it and install the x86 version instead.

After uninstall Office left a key in the registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common\SmartTag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}

I couldn't remove it so I figured there was a specific process that had opened this key but couldn't find anything (using Process Explorer).

Then I checked the permissions on the Office key but it was set to Full Control for Administrators.

Autologon user on Windows XP/2003 using AutoReconnect pipe - part 3 (implementation details)

Thu, 03 Mar 2011 13:00:46 +0000

In the previous parts (part 1 part 2) i’ve described the theoretical part and implementation problems. So, now we can write the code:

In case we login the user, we just call LsaLogonUser to get the token:

Autologon user on Windows XP/2003 using AutoReconnect pipe - part 2 (problems and workarounds)

Wed, 02 Mar 2011 00:10:02 +0000

In part 1 I’ve described the theoretical parts needed for a custom autologon application implementation.

But there are some practical problems which I will describe here.

I use the LsaLogonUser function to log in the user. However, if I do not pass not null for the LocalGroups parameter, msgina.dll fails to process the logon.

Why? Because it looks for the SE_GROUP_LOGON_ID SID and treat it as logon SID. So we have to add the logon SID manually:

Autologon user on Windows XP/2003 using AutoReconnect pipe - part 1 (theory)

Mon, 28 Feb 2011 10:46:29 +0000

Windows XP introduced the ability to use Fast User Switching (FUS from here on), which is implemented using Terminal Services.

But in some cases (i.e. when FUS is not enabled, or when you connect to the console in Windows 2003 server), the Winlogon process in an RDP session needs to transfer credentials to Session 0.

Although not documented in MSDN, the process of transferring credentials is described by Keith Brown in the June 2005 issue of MSDN magazine: Customizing GINA, Part 2.

WlxQueryConsoleSwitchCredentials and WlxGetConsoleSwitchCredentials are used in the transfer with the semi-documented WLX_SAS_TYPE_AUTHENTICATED SAS code constant.

Internally, winlogon.exe uses a Named Pipe, \.\Pipe\TerminalServer\AutoReconnect, to implement both of these functions.

The pipe format is described in this structure:

The case of the intermittent hangs

Mon, 14 Feb 2011 13:20:40 +0000

Yesterday I had some intermittent hangs on the family pc, and old Medion MD-8800 PC.

Since there was no crash and thus no crash dump, there was nothing to debug.

I suspected a hardware issue and opened the pc and I noticed that there was an enormous amount of heat.

Windows XP Cmd Prompt Patch

Tue, 08 Feb 2011 22:28:31 +0000

A few days ago I needed to test a few things on a Windows XP Workstation running under a regular user account.

I wanted to verify if some files and registry keys existed but Group Policies were in place that denied me access to the command prompt and regedit.

While this may be a good thought to secure the pc it is not very convenient if you need to verify some settings.

For that purpose I created patched versions of the Windows Server 2003 command prompt and regedit utilities.

They are patched to ignore the Group Policy settings and I usually place them in some share, secured by NTFS permissions.

You can read about it in my post: Registry editing has been disabled by your administrator (not anymore!).

However due to kernel differences you cannot use the Windows 2003 cmd.exe on Windows XP (you can do it the other way round btw). So I decided to create a patched version of the XP version as well.

I thought it might be interesting to show you how it’s done so here we go:

The Case of the Citrix Ready Printer Driver

Tue, 08 Feb 2011 21:47:44 +0000

I had a very interesting issue today on a new Citrix XenApp 5 farm. We went into production yesterday and we noticed a number of issues:

Printing in general was slow, especially when a user connects to a printer for the first time.
User Profiles were rapidly growing in size (from the expected 1-2 MB to over 40 MB).
Logons took much longer then in the testing period (and since we use a Full Screen Desktop the user doesn't see any progress).
Performance monitoring showed CPU spikes in Word, Excel and IE processes.

I took a look at the profiles first and noticed that the size growth was due to a Xerox subfolder in %APPDATA%:

Script to install SNMP

Fri, 04 Feb 2011 11:22:26 +0000

In my project the monitoring group required that SNMP was installed and configured on all servers.

I wrote scripts for Windows 2003 and Windows 2008 that I deploy from my Altiris Server.

This is the script for Windows 2003:

batch Download

@echo off
rem Install SNMP

rem Create Sysoc Answer File
echo [NetOptionalComponents] >InstallSNMP.txt
echo SNMP = 1 >>InstallSNMP.txt
echo. >>InstallSNMP.txt
echo [SNMP] >>InstallSNMP.txt
echo Accept_CommunityName = MYCOMMUNITY:Read_Only >>InstallSNMP.txt
echo Any_Host = No >>InstallSNMP.txt
echo Community_Name = "MYCOMMUNITY" >>InstallSNMP.txt
echo Contact_Name = "MYCONTANT" >>InstallSNMP.txt
echo Limit_Host = MYIP >>InstallSNMP.txt
echo Location = "MYLOCATION" >>InstallSNMP.txt
echo Send_Authentication = Yes >>InstallSNMP.txt
echo Service = Applications, Internet, End-to-End, Physical, Datalink >>InstallSNMP.txt
echo Traps = THETRAPIP >>InstallSNMP.txt

Sysocmgr.exe /i:\windows\inf\sysoc.inf /u:\Windows\Temp\InstallSNMP.txt /r

Restart Altiris Client Agent Service Tool

Fri, 04 Feb 2011 10:57:48 +0000

After a restart of the Altiris Services or the Altiris Server some machines refuse to reconnect.

They are shown in the Computers Tree with the Inactive state icon:

Move WSUS content folder

Wed, 02 Feb 2011 11:15:55 +0000

I needed to relocate the WSUS content folder because it was placed on the C Drive (even though there was a 2nd 150 GB Data Partition) to prevent WSUS from filling up the OS Drive.

Unfortunately there doesn't seem to be a GUI option to do that, all Google searches lead to a GUI option for Small Business Server.

Get last char of the computername in PowerShell

Tue, 01 Feb 2011 10:02:20 +0000

For my Reboot Script I needed to get the last character of the computername and convert it to an integer.

We can do it like this in PowerShell:

powershell Download

$i = [int]"$((gc env:computername)[-1])"

PowerShell Script to add reboot scheduled task for Citrix

Mon, 31 Jan 2011 22:53:47 +0000

I wanted to create a Scheduled Task on my Citrix Servers to have the reboot every other night.

The idea is that half of the servers will reboot in a night and the other half the following night.

The TSSHUTDN tool is handy since it can issue a warning to logged on users, log them out after a certain period and finally issue the reboot.

Since I needed to add a scheduled task to many servers I wanted to do this with a script.

WMI Exposes the Win32_ScheduledJob Class and it’s Create Method.

Using Synctoy in Data Migrations

Mon, 31 Jan 2011 11:39:03 +0000

In every project I do I will have to migrate data at some point. This usually involves three types of data:

Home Directory Data
Workgroup Data (eg office documents)
Application Data (not database but flat file data belonging to applications such as templates and documents).

Home Directory Data is usually a flat copy although I tend to filter out the garbage (temp files and such).

Workgroup data usually needs to be cleaned up so it involves some kind of data mapping (folder x goes to place y).

Application Data is usually a flat copy from old to new location but often there are things like ini files that are adjusted and we don’t want to overwrite that.

Using Fast User Switching on domain XP computers

Sun, 30 Jan 2011 20:42:20 +0000

As you may know, Fast User Switching (FUS) is not available (disabled) on Windows XP computers joined to a domain, Microsoft confirms this in kb280758.

However, Microsoft doesn’t tell us there’s an undocumented registry value that allows us to have FUS when joined to a domain!

To enable FUS you need to set the DWORD registry value HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ForceFriendlyUI.

It can also be set by Group Policy at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.

When the value is set to 1, and LogonType key is also set to 1, it allows you to use a Friendly UI on a computer joined in a domain:

Querying a user token under 64 bit version of 2003/XP

Sat, 29 Jan 2011 22:17:52 +0000

If you want to obtain a user’s token in a Terminal Server or Citrix session (eg to launch a process in a session) you can call the WTSQueryUserToken function.

On the x64 versions of Windows XP and Server 2003 this function fails however and returns ERROR_INSUFFICIENT_BUFFER ("The data area passed to a system call is too small.") when called from a 32 bit process.

Internally WTSQueryUserToken calls the undocumented function WinstationQueryInformationW with the WinStationUserToken class (14) and passing a WINSTATIONUSERTOKEN struct, filled with caller ProcessId and ThreadId.

But on x64 Windows the size of this structure is 24 bytes, while on 32 bit Windows the size of the structure is 12 bytes!

Making String.IndexOf case insensitive

Sat, 29 Jan 2011 10:41:24 +0000

I don't do much programming in .NET based languages but I have to for some things like the Windows Live Writer plugin I am creating.

I didn't expect this but the String.IndexOf Method is by default case sensitive.

But we can make it case insensitive if we use one of the overloads: IndexOf(String, StringComparison).

PowerShell Script to raise Citrix Video Memory

Fri, 28 Jan 2011 15:23:08 +0000

On a Citrix XenApp 5 environment a user reported that he was unable to start a Full Screen session on a Dual Monitor Configuration.

He received this error message:

Saving Password in Office Communicator

Thu, 27 Jan 2011 15:50:27 +0000

If you want to be able save the password in Office Communicator you must create the key HKLM\Software\Microsoft\Communicator or on x64 OS HKLM\Software\Wow6432Node\Policies\Microsoft\Communicator and set the DWORD value SavePassword to 1.

Now you will have the Save my password checkbox (which will save the encrpted password to HKCU\Software\Microsoft\Communicator\AccountPassword

Enabling Privileges for WMI in PowerShell

Thu, 27 Jan 2011 11:05:30 +0000

A few days ago I wrote about a PowerShell Script to Install Printer Drivers.

I noticed there was a problem with this script: some drivers fail to load with error 1797 which means ERROR_UNKNOWN_PRINTER_DRIVER.

I reread the AddPrinterConnection documentation on MSDN but it didn’t mention anything about additional required permissions or anything.

Script to install all print drivers on Citrix or Terminal Server

Tue, 25 Jan 2011 15:24:14 +0000

I wrote a PowerShell script to install all printer drivers on a Citrix or Terminal Server.

Actually the script isn’t specific to Citrix or Terminal Server but on such environments we need to preload all drivers because users do not have the permissions to do that.

I have chosen for PowerShell because you can do it in a one-liner which makes it easy to run this script from my Altiris server on all Citrix Servers.

The idea is that we enumerate all the shared printers on a Printer Server and make a connection to each printer. This will make sure that the driver is installed if it wasn’t already present.

The script could even be scheduled to enforce that newly added printer drivers are added to each Citrix Server.

Adding a hidden Exchange mailbox to Outlook

Tue, 25 Jan 2011 13:11:42 +0000

In Exchange it’s possible to hide a Mailbox from the (Global) Address List. You can do that in the Exchange System Manager:

But after you have hidden a Mailbox you cannot create an Outlook profile for it (or add it as an extra mailbox).

When you click Check Name in the wizard you’ll get an error:

The common workaround is to remove the “Hide from Exchange address lists” setting, create the profile (or add the Mailbox) and afterwards set it again.

Once the profile is created it all keeps working.

There is an easier solution though!

Determine the System Page Size

Mon, 24 Jan 2011 15:46:58 +0000

Just a quick note: if you want to determine the page size of the OS (Windows) you can use the GetSystemInfo function.

Example:

objectpascal Download

var
 SystemInfo: SYSTEM_INFO;
 PageSize: DWORD;
begin
 GetSystemInfo(SystemInfo);
 PageSize := SystemInfo.dwPageSize;

Note that MSDN recommends to use the GetNativeSystemInfo function when running in a 32 bit app on an x64 OS (and you can use the IsWow64Process function to determine that).

The case of the UPS discovery not working

Mon, 24 Jan 2011 15:22:03 +0000

I am doing a project involving a Citrix Xenapp environment running on VMWare vSphere.

The physical machines are powered by two Eaton Uninterruptable Power Supplies that both a network card.

I received some documentation that describes how to implement automatic shutdown in a VMWare vSphere environment.

This documentation describes that a vSphere Management Assistant (vMA) must be deployed in which we need to install some software from Eaton.

I followed the documentation that even described the needed iptables rules needed for their software.

In the last step a discovery is done and the UPS is supposed to be found. And you have probably guessed by now: it didn’t!

At first I figured that maybe the iptables configuration was still too tight so I stopped the iptables service but that didn’t help.

Enumerating Session Processes with NtQuerySystemInformation

Thu, 20 Jan 2011 15:34:23 +0000

As you may know, you can enumerate processes of a specific Terminal Server or Citrix session using the NtQuerySystemInformation function.

On x86 system the code below works fine:

objectpascal Download

var
 Status : NTSTATUS;
 RetLength : DWORD;
 SessionInfo : SYSTEM_SESSION_PROCESS_INFORMATION;
 CurrentProcess : PSystemProcesses;
begin

 SessionInfo.SessionId := SessionId;
 SessionInfo.Buffer := nil;
 SessionInfo.SizeOfBuf := 0;

 Status := NtQuerySystemInformation(SystemSessionProcessesInformation, @SessionInfo, SizeOf(SessionInfo), @RetLength);
 while (Status = STATUS_INFO_LENGTH_MISMATCH) do
 begin
 SessionInfo.SizeOfBuf := RetLength;
 SessionInfo.Buffer := GetMemory(RetLength);
 try
 Status := NtQuerySystemInformation(SystemSessionProcessesInformation, @SessionInfo, SizeOf(SessionInfo), @RetLength);
 if NT_SUCCESS(Status) then
 begin
 CurrentProcess := SessionInfo.Buffer;
 while True do
 begin
 // Your code here

 if (CurrentProcess^.NextEntryDelta = 0) then
 Break;

 Cardinal(CurrentProcess) := Cardinal(CurrentProcess) + CurrentProcess^.NextEntryDelta;
 end;

 Exit;
 end;
 finally
 FreeMemory(SessionInfo.Buffer);
 end;
 end;

 SetLastError(RtlNtStatusToDosError(Status));
 RaiseLastOSError;
end;

While this works fine on Windows XP and 2003 x86, it fails to work correctly on the x64 versions of Windows XP and 2003 (or maybe even higher).

The problem is that RetLength is always SizeOf(SYSTEM_SESSION_PROCESS_INFORMATION) and thus we are in an endless loop!

SasLibEx Screencast

Wed, 19 Jan 2011 22:36:44 +0000

I just recorded a SasLibEx Screencast, it shows some of the very powerfull features of SasLibEx.

The following features are shown:

Simulate Ctrl Alt Del (Secure Attention Sequence)
Cancel Ctrl Alt Del
Lock Workstation
Unlock Workstation (without credentials)
Disable Ctrl Alt Del
Enable Ctrl Alt Del again
Cancel pending UAC request
Is Desktop Locked

SasLibEx Feature Demo #1

1 Comments

Tweets die vermelden SasLibEx Screencast | Remko Weijnen's Blog (Remko's Blog) -- Topsy.com Jan 20, 2011
[...] Dit blogartikel was vermeld op Twitter door Remko Weijnen, Remko Weijnen. Remko Weijnen heeft gezegd: First #SasLibEx ScreenCast! showing simulate ctrl alt del, unlock workstation without credentials, disable cad and more http://bit.ly/fFM8wB [...]

Recursive Groups #2

Tue, 18 Jan 2011 19:51:15 +0000

In my previous post I explained how to get the recursive group membership with a very simple Powershell Script.

Commenter Michel thought that the script only tested one level deep but it doesn’t.

But let’s prove that!

Create 3 Global Groups in your Active Directory and name them Level1, 2 and 3:

Make Level3 a Member of Level 2 and make Level a member of Level 1 and finally add an account to the Level 3 group:

Kofax VRS Unattended Install

Tue, 18 Jan 2011 14:53:39 +0000

Recently I needed to create an Unattended Install for an application that uses a piece of software (for scanning) called Kofax VRS.

This Kofax software comes with an .msi file but there was no documentation on the install options.

In fact it didn’t seem like the Vendor anticipated on an Unatttended Install.

I browsed in the msi file using Microsoft’s Orca tool and tried some of the properties I found in the public properties table.

Recursive group Membership in Powershell

Tue, 18 Jan 2011 12:54:17 +0000

In this post I will show an easy way to get the recursive group membership for the current user.

I use this in a logon script to handle certain tasks based on group membership.

Most scripts I see for this task do a manual recursive enumeration but in a large environment this could be very slow.

A better way would be to use the tokenGroups attribute of the Active Directory user object.

The tokenGroups attribute is an array of SIDs computed by Active Directory and is used to verify user access.

We need to translate these SIDs to their sAMAccountNames to get the actual group names.

In unmanaged code this could be accomplished by calling the DsCrackNames API or the IADsNameTranslate interface.

The case of the Annotations Toolbar

Mon, 17 Jan 2011 22:24:22 +0000

I got some interesting questions from a user today regarding TIFF images on a Windows 2003 based Citrix environment.

This user has an application that works with scanned documents and for each document exists both a pdf and a tiff version in the application.

By default the TIF (and TIFF) file extensions are linked to the Windows Picture and Fax Viewer in Windows 2003.

The user told me that some time ago she had an extra toolbar where she could perform some extra operations such as making a selection on TIFF images.

At some point in time this mysterious Toolbar disappeared and she was never able to get it back. She reported this to the helpdesk and the system administrator but they were unable to resolve this.

I hadn’t hear of this toolbar before but a Google Search led me to this page which explains the toolbar in question which is called the Annotation Toolbar.

Another packaging challenge

Mon, 17 Jan 2011 09:15:37 +0000

Another post on something that happened last week, this time it’s about a Java based Application again.

This particular application wanted to download three DLL’s from the Webserver to the Java bin directory.

This presents us with several issues on a multi user server such as a Citrix of Terminal Server:

The user does not have write permissions in this directory
If we we give the user write permissions here what happens when the DLL's are in use by another user?

I assumed that if I preinstalled the DLL's the application wouldn't try to overwrite them but that didn't work.

Then I monitored with Process Monitor if the Application wrote some kind of check file but at first I didn’t find anything.

So I decided to use the CorrectFilePaths shim to redirect the DLL’s to the user’s homedirectory (see Using the CorrectFilePaths shim to redirect an ini file to a writable location for an explanation).

Troubleshoot CorrectFilePath shim

Sun, 16 Jan 2011 20:42:03 +0000

A few days ago I was packaging an application that was writing an INI file in the application directory.

If you have read my earlier article, Using the CorrectFilePaths shim to redirect an ini file to a writable location, then you will probably think: create a nice shim and redirect that ini file!

But this application had a few challenges, the first being that it writes %COMPUTERNAME%.INI. The application’s developer probably assumed that a user is bound to one pc and that no other user’s use that pc.

To solve it we we need to catch all possible computer names (it would be nice if the CorrectFilePaths shims was able to accept wildcards and environment variables).

But it doesn’t so it means we have to add a parameter for each possible computer name. In my case that was doable because I have only 8 Citrix servers.

So I created a Fix using the Application Compatibility Manager as described in my previous post.

However it didn’t work, so I started to trace what happens.

Convert Drive Bitmask to Drive Letter

Fri, 14 Jan 2011 11:06:03 +0000

I was writing a test program that will perform some actions when a USB Memory Stick is inserted.

When this happens Windows send a Broadcast a WM_DEVICECHANGE message.

The wParam member of this Message contains a (pointer to) a DEV_BROADCAST_HDR structure.

if the dbch_devicetype member of this structure is of type DBT_DEVTYP_VOLUME then we can cast the structure to DEV_BROADCAST_VOLUME.

Self Signing Word Macro’s

Wed, 12 Jan 2011 15:45:51 +0000

Today I noticed that a recently added Application to the Citrix Test environment added a Macro to the Office Startup directory.

When a user launches Word he will get a popup because the Template (.dot file) was not signed:

It would have been a lot easier if Application Vendors sign their stuff because in that case I could have just added the certificate using Group Policy (yesterday’s post describes how to do this).

Application Vendors usually tell you that you should lower the Macro security in Office (or Word in this case) to Low to get rid of this message. But I think there’s a better solution: we will sign the .dot file ourselves!

Java Webapplication, certificates and Citrix

Tue, 11 Jan 2011 15:23:47 +0000

Yesterday I created an Unattended Installation of a webapplication. Of course it was “just a web link” and the application vendor usually says: you don’t need to install it just go the URL and that’s it.

The reality is usually that you go to the URL and need to install several (ActiveX) components and maybe other dependencies such as Java.

While a user may have the permissions for this on his own pc, on a Citrix or Terminal Server environment this is highly unlikely.

So we need to package and pre-install this for the users.

Nothing special so far but this particular application had some special things that were interesting enough to blog about.

So let’s start with what happened, I visited the URL of an application called Centric Key 2 Financien.

First I got a few popups with Certificates that needed to be accepted:

The application’s instructions say that the user must accept this and set the “Always trust content from this publisher” checkbox.

New Categories

Sun, 09 Jan 2011 21:03:24 +0000

I added some new Categories to the Blog, something I should have done a long time ago.

I also tried to add missing Categories to existing posts but I didn’t check all posts ever written so feel free to add a comment to this post if you miss a category or that a certain post is properly categorized.

Fixing Applications: The Next Step

Fri, 07 Jan 2011 14:39:55 +0000

Lately I wrote a few articles about fixing bad applications using Compatibility Shims. If you didn’t read them yet, here are the links:

I also described that you can install an Application Compatibility Database using the sdbinst command.

At first I just took a script task in my Altiris Server to deploy the database using sdbinst -q <dbname> but later on I got a better idea.

Paging file and Memory Dump

Fri, 07 Jan 2011 13:45:55 +0000

I often hear that people configure the Paging File (on Citrix or Terminal Servers) on a seperate volume but, the reasons is either performance or the chance that the Paging File might corrupt the volume.

However if at some point you would like to create a Memory Dump you must have a paging file on the boot volume.

Another Oracle Error

Fri, 07 Jan 2011 13:26:20 +0000

My collegue that is working with me on the current project was packaging another application that uses Oracle.

The interesting thing about it is that he ran into the same error I did: the Oracle client tries to create (and access) an Object in the Global namespace.

Redirect Global Object to Local Objects (aka fix that bad app!)

Thu, 06 Jan 2011 14:34:11 +0000

Today I was working on Unattended Installation of an Application called SmartDocuments.

The application seemed to behave nicely on a Multi User (Citrix/Terminal Server) environment: it writes user configuration to the user part of the registry and writes configuration files in a user accessible path.

When testing with a normal user account I ran into a problem though, I got an Oracle ORA-01019 error message:

The English message is ORA01019: unable to allocate memory in the user side.

Default User Profile: Remko’s solution

Tue, 04 Jan 2011 15:46:18 +0000

If you are implementing a Citrix, Terminal Server or even just a plain Client-Server environment you will need to create a Default User Profile at some point.

The Default User Profile can be thought of as the initial registry settings that are used when a new profile is created.

Many people think that the Default User Profile is available in regedit via HKEY_USERS.Default but this is NOT the Default User Profile.

Modify Internet Explorer 8 MUI Pack to install a single language

Mon, 03 Jan 2011 12:10:22 +0000

Today I wanted to install the Dutch Language pack for Internet Explorer 8, the Dutch language comes as part of the Windows Internet Explorer 8 MUI Pack (in my case the version for Windows Server 2003 SP2).

If you install the MUI Pack you will always end up with all 35 (!) languages installed. This behaviour is the same as the language pack for Internet Explorer 7 that I wrote about earlier (see Modifying Microsoft Updates and/or hotfixes)

The solution is really the same as for the IE7 language pack: you modify the inf file (in my case update_srv03.inf) but if you run update.exe it will refuse to use your modified inf file:

So we need to patch update.exe to accept your modified version!

Cannot Access Files, But Need the Origin?

Mon, 03 Jan 2011 09:52:20 +0000

Have you developed an application that accesses files and may stop because a file cannot be accessed but you need to?

Since Windows Vista it is possible to find out the name of the application which holds open a file.

Wordpress monthly archives broken

Sat, 01 Jan 2011 19:44:20 +0000

I noticed that the monthly archives on my blog were not working. I first thought it was a problem with the .htaccess file but it was correct.

I also tried resetting the permalinks option in Wordpress to default an back but that did help as well.

Unattended Installation of IBM WebSphere MQ

Wed, 29 Dec 2010 16:50:14 +0000

Today I needed to create a silent install for IBM WebSphere MQ, in my case version 6.0.2.10.

I started by reading IBM’s documentation: WebSphere MQ Unattendend (silent) Installation which desribes that we can create a response file using the SAVEINI parameter.

So I recorded a response file and tested the install using the USEINI parameter as indicated by the documentation.

However the installation failed producing only this error message:

Using the CorrectFilePaths Shim with Visual Basic Applications

Tue, 28 Dec 2010 16:14:44 +0000

Earlier today I wrote about Using the CorrectFilePaths shim to redirect an ini file to a writable location and believe it or not the next application I was working with today needed a nice shim as well.

This one was a little more complicated and that’s why I am writing a second post about it.

I am not sure if this is actuall documented somewhere but a Shim is not applied to Applications or DLL’s that reside in the system directory.

The application in question here is a Visual Basic 6 application which uses the VB6 runtime, msvbvm60.dll which resides usually in %systemroot%\system32.

We need to do two things if we want to apply the shim to msvbvm60.dll:

Using the CorrectFilePaths shim to redirect an ini file to a writable location

Tue, 28 Dec 2010 13:52:01 +0000

Today I needed to package an application called PlesirReality and I noticed that it wrote an ini file into the program directory (in my case D:\Apps\PlesirReality).

I looked into this ini file (areastate.ini) and it writes user settings in there, like the last position of the window etc.

We can see this easily with Process Monitor:

This presents us with several problems:

The first problem is that the user does not have write permission in this directory so upon application exit we get an ugly error message:

We could “fix” this by giving the user write permissions to this directory or even to this specific file but here comes the seconds problem:

On a multi user environment like Citrix or Terminal Server/Remote Desktop Services it means that when one user exists he will he save his settings for all users.

And then we have a third problem:

When a users starts the application on another server he will not get the expected settings because each server will have it’s own copy of this ini file.

Unattended Installation of the Oracle Client

Mon, 27 Dec 2010 17:20:48 +0000

Last week I needed to an unattended installation of the Oracle Client, in my case version 10.2.0.1.0.

Oracle has a record switch that allows you to record an installation and generate a response file using: setup -record -destinationFile response_file_name. This is documented here.

When you are finished you can use this response file to perform the unattended install, eg setup -silent -responseFile response_file_name.

There is a problem though, the installer (setup.exe) launches a java based installer and immediately returns.

This was a problem for me since I cannot deploy a dependant application if the Oracle install hasn’t finished yet.

I did some googling and found a lot of questions about this subject and saw a common resolution where a script is watching a certain file that is creating when the installation has finished in a loop.

I figured there should be a better wait so I to a closer look at the installer with Ida Pro. I noticed that setup.exe launches another exe. called oui.exe (Oracle Universal Installer) which in turn launches Java.

Terminal Server Remote Keyboard Layout

Mon, 27 Dec 2010 16:38:55 +0000

Today I shadowed a user’s session in Citrix and when I wanted to type something I noticed that the keyboard layout was incorrect.

This is and old “friend” that I always tend to forget about. So hopefully this post will help me to remember it :D.

You can prevent this by adding a value “IgnoreRemoteKeyboardLayout” to the registry key HKLM\System\CurrentControlSet\Keyboard Layout:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v IgnoreRemoteKeyboardLayout /t REG_DWORD /d 0x00000001 /f

This option has been present since Windows 2000 but was broken in Windows 2003. For Windows 2003 there are two related hotfixes, see kb 842136 and kb 917910.

Unattended Installation of IBM System i Access for Windows

Fri, 24 Dec 2010 15:52:04 +0000

Today I needed to script the installation of IBM System i Access for Windows (formerly called IBM Client Access).

With older versions of this client (up to 5.4) you could use the -r (record) installer switch to record the install in a setup.iss file but version 6.1 uses an MSI based installer.

IBM offers the client in a 2 DVD download but you probably only need the first dvd (dvd 1 has both the x86 and x64 installers, dvd 2 has the ia64 installer) which is a whopping 3,5 GB download.

Inside the download (a zip) is an iso file of which you will only need the files in the root and the Image32 or Image64a folder.

Inside the image folder are subfolders names MRI29xx where xx is a language identifier:

The following Identifiers are used:

Master Return codes in Altiris

Fri, 24 Dec 2010 15:48:17 +0000

Altiris offers a Master Return code, a very usefull feature that is not used often I think. In this article I will explain why I find them usefull and we will implement a Master Return code for Installations that require a reboot.

A Master Return code can be consired as a Global Action handler, whenever a job returns a specific error/return/result code this Global handler will be called (unless you override it in the job with another action).

A perfect usage for a Global Action handler is installing MSI files that need I reboot. If you do nothing the system will be rebooted after the successfull installation and your job will return as failed with error 3010.

Microsoft documents that 3010 means ERROR_SUCCESS_REBOOT_REQUIRED: A restart is required to complete the install. This message is indicative of a success.

To prevent the reboot we can pass REBOOT=ReallySurpress to the MSI but we still need to indicate to Altirs that 3010 actually means Success and that we need to reboot.

Citrix Online Plugin could not launch the requested published application

Wed, 22 Dec 2010 14:10:31 +0000

After doing an unattended installation of the Citrix Online Plugin it was not possible to launch a Published Application.

It would just give the error mesage: "citrix online plugin could not launch the requested published application".

Even though the installation finished without errors and the logfiles indicated no failure at all I was able to fix it by using 2 steps described in CTX123761.

Packaging an ActiveX Component: Easy?

Mon, 20 Dec 2010 20:19:18 +0000

Today I needed to package an applications that I was told was very simple. If I hear something like that my first thought is always “hmmm”.

So I prepared a machine to build the package and followed the instructions which were to go to a specific URL and download the package (probably an ActiveX control from there).

I opened the URL and immediately got an error message:

The error message 0x80004005 is not very helpfull since it stands for E_FAIL (winerror.h).

Desktop Icons, hide, show, prevent rename or delete

Sun, 19 Dec 2010 15:14:04 +0000

I was cleaning up some old data on my Hard Drive when I found a program I wrote about a year ago.

At that time I was doing a project where I was deploying a Windows 2008 based Citrix Environment.

I wanted to get rid of the new Personal Folders or User’s files icon on the Desktop and replace it with the familiar My Documents icon.

These settings are stored in the Registry under HKEY_CLASSES_ROOT\CLSID{folder’s GUID}\ShellFolder.

Default Explorer View

Sun, 19 Dec 2010 14:40:40 +0000

As you probably know there are several different Folder Views in Windows Explorer:

The Explorer keeps tracks of the last used View per Folder in the registry in the key HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags. This KB article sort of desribes this functionality.

Packaging an application – Auto Accept the EULA

Fri, 17 Dec 2010 17:10:03 +0000

Yesterday I was packaging an application called Kluwer Juridische Bibliotheek. When the user first starts this application a screen with the License Conditions pops up and it must be accepted:

I always try to remove such things as I don’t think it’s necessary for every user to accept it.

International Karate+

Wed, 15 Dec 2010 22:35:13 +0000

A few weeks ago I turned on my old Commodore Amiga A1200 which had been stored for 15 years or so.

The idea was that my kids can use it as a game computer but tonight I couldn't resist and I played some of the old games.

My favorite KB Article

Wed, 15 Dec 2010 14:07:53 +0000

The previous post reminded me of my all time favourite knowledge base article from Compaq titled: "Where do I find the "Any" key on my keyboard?"

It's still in archive.org: http://web.archive.org/web/20070627063024/http://www29.compaq.com/falco/detail.asp?FAQnum=FAQ2859

Copying files larger than 2GB in an RDP Session

Wed, 15 Dec 2010 14:00:50 +0000

Just had a good laugh while reading Microsoft KB article 2258090:

When you try to copy a file that is larger than 2 GB over a Remote Desktop Services or a Terminal Services session through Clipboard Redirection (copy and paste) by using the RDP client 6.0 or a later version, the file is not copied. And, you do not receive an error message.

Packaging an Application that uses the BDE

Tue, 14 Dec 2010 21:12:58 +0000

Today I needed to package an application that uses the Borland Database Engine (BDE).

The BDE is a database engine/connectivity component commonly used in Delphi and C++ Builder applications. It has been deprecated since 2000 when it was replaced by dbExpress.

But it’s still widely used so you may still find applications that require the BDE.

In my environment I already have a package for the BDE itsself. But the application I needed to package today, needs to have an Alias addded.

This is usually done manually by going into the BDEADMIN control panel applet or by copying the file where BDE saves the aliases (IDAPI32.CFG).

Here is a screenshot of the Alias my application needs (it uses an Interbase database):

I didn’t like the copy approach and didn’t even consider the manual option so I wrote 2 little tools.

Writing Environment Variables to the Registry from a Script

Mon, 13 Dec 2010 20:52:59 +0000

I usually change the text below the “This Computer” icon to reflect the current username and servername:

This is an ancient trick, just set the the LocalizedString Value of the following key:

batch Download

HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}

to “%USERNAME% on %COMPUTERNAME%”.

It get’s a little more complicated if you want to set this from a script, because the environment variables are replaced with the actual value BEFORE they are entered in the Registry.

Where is LSA_OBJECT_ATTRIBUTES defined?

Sun, 12 Dec 2010 23:06:20 +0000

If you read MSDN documentation for LSA_OBJECT_ATTRIBUTES you will think it's defined in LsaLookup.h:

And that it's supported since Windows 2000 but I couldn't find it in this header file.

Instead I found it in NTSecAPI.h, so I decided to check the different SDK versions and starting from SDK v7 LsaLookup.h exists but in earlier SDK's (v5.0, v6.0a and v6.1) there is no LsaLookup.h.

SQL Query to get the Full Path of an Altiris Job #3

Sun, 12 Dec 2010 19:50:32 +0000

Last time I showed a User Defined Function to the Full Path of an Altiris Job given it’s id (event_id). Note that Altiris calls a Job an Event so the terms Event and Jobs are interchangeable here.

To complete it we first need to prepend the server and share name to the path.

I looked into the Altiris database tables to find the best place to get the servername and it seems that the hostname column of the mmsettings table is a good way.

In my database there was only one row in the table but I restrict the results by adding top 1:

sql Download

SELECT TOP 1 hostname FROM mmsettings

Then I looked into the available tokens for one that returns a job id but we can only return a job name or a computer id. Since a job name is not unique I decided to use the computername and find the active job for this computer.

When a Job is scheduled an entry is added to the event_schedule table. If you look into this table you will notice a column status_code which is NULL initially and when the job start it will get a value of -1 which indicates the job is active.

When the job has finished the status will always be 0 or higher.

SQL Query to get the Full Path of an Altiris Job #2

Thu, 09 Dec 2010 10:00:43 +0000

Earlier I described a SQL Query to get the Full Path of an Altiris Job, today I will describe how we can make a User Defined Function (UDF) in SQL so we can call it easier.

I am using an UDF because it allows us to specify parameters, in this case a single parameter (the EventId (or job id).

This is the SQL that creates the UDF:

sql Download

CREATE FUNCTION GetFullPath
 ( @EventId int)
RETURNS nvarchar(4000)
AS
BEGIN
	DECLARE @str nvarchar(4000);
	WITH t1 (folder_id, name, parent_id, level)
	AS
	(
	-- Anchor member definition
		SELECT folder_id, name, parent_id, 0 AS Level
		FROM event_folder
		WHERE folder_id in (
			SELECT folder_id FROM event WHERE event_id = @EventId)
		UNION ALL

	-- Recursive member definition
		SELECT t2.folder_id,t2.name, t2.parent_id, Level+1
		FROM event_folder AS t2, t1
		WHERE t2.folder_id = t1.parent_id
	)

	-- Statement that executes the CTE
	-- STUFF and FOR XML are used to Concatenate the Values and seperate them by \ character

	SELECT @str = STUFF((SELECT '\' + name from t1 order by level desc FOR XML PATH('')),1,1,'')
	RETURN @str
END
GO

Cross-Site Scripting Vulnerability in Citrix Web Interface

Thu, 09 Dec 2010 09:40:59 +0000

from CTX127541:

A cross-site scripting vulnerability has been identified in specific versions of Citrix Web Interface.

This vulnerability could potentially be used to execute malicious client-side script in the same context as legitimate content from the web server; if this vulnerability is used to execute script in the browser of an authenticated user then the script may be able to gain access to the authenticated user’s session or other potentially sensitive information.

SQL Query to get the Full Path of an Altiris Job

Tue, 07 Dec 2010 22:22:56 +0000

I wanted to query the full path name of an Altiris Job, this sounds easier that it is though.

Consider the following hierarchy:

Now I want to assemble the full Path, in this case: RPA\Getronics\PKG_p007.Citrix_Components.

BSOD with STOP 0x0000008E when installing Window 7 Checked Build

Mon, 06 Dec 2010 23:13:01 +0000

I was trying to install a checked build of Windows 7 under VMWare Workstation but after the first reboot during the install (the completing installation step) the system came up with a BSOD.

It can be fixed by adding a line to the VMX configuration file:

Citrix Web Interface starts very slowly

Fri, 26 Nov 2010 15:07:45 +0000

I remembered from a previous project that when the Citrix Web Interface this is caused by a setting called generatePublisherEvidence in the Aspnet.config file.

This behaviour has been documented by Citrix in CTX117273.

If you read it carefully you will see the note that you need to fix it in 2 places for an x64 system.

Script to register ASP.NET in IIS

Fri, 26 Nov 2010 12:37:01 +0000

I did an unattended install of the Citrix WebInterface on a testmachine and it failed with error 258.

The logfile clearly indicates the reason:

[ ERROR ] com.citrix.wi.install.SetupErrorReporter: Error 258 occurred: ASP.NET 2.0 must be registered and enabled in Microsoft Internet Information Services before the Web Interface can be installed.

We can register ASP.NET in IIS with the Aspnet_regiis.exe tool that comes with the .NET framework.

The commandline would be:

Unattended Visual J# Install returns error 4122

Fri, 26 Nov 2010 11:53:30 +0000

This means you are installing the wrong edition, eg x86 version on an x64 OS.

All available version are listed on the MSDN Visual J# Redistributable Packages page.

Scripted creation of Server Manager Answer Files

Thu, 25 Nov 2010 16:14:42 +0000

A while ago I created a script that I can run as embedded script in Altiris that creates a Server Manager Answer File (for Server 2008).

I could have simply done an echo >answer.xml but I wanted a well formed XML that could be read and displayed in an XML editor or Internet Explorer when needed.

I use the Microsoft.XMLDom object in the script the create the XML and I think the code is easy to understand so I will just show it here:

Disabling Java Autoupdate

Wed, 24 Nov 2010 16:07:28 +0000

I did an unattended install of Java Jre1.6_0.22 using an mst file that puts all (auto)update properties to off.

However it seems that Java simply ignores this, so usually a script runs after the install to the delete some registry keys and perform some extra configuration.

Altiris AxSched ignores the DSN parameter

Tue, 23 Nov 2010 22:48:47 +0000

I was playing around with the AxSched tool that comes with Altiris, in my case the version that comes with v6.9 build 453.

I could not make it connect to the Deployment Server from my test machine, it seemed like the /dsn parameter I used was totally ignored.

Why is my scheduled job not executed in Altiris?

Tue, 23 Nov 2010 20:34:15 +0000

Earlier today I wrote about my Altiris Job Builder tool but when I tested the actual produced build job I noticed something weird: the job was scheduled but not executed.

I then tried to manually push a job to this server and that one executed fine.

When I clicked the Job I could see that it was scheduled:

But when I clicked the Server it wasn’t there:

Altiris Job Builder

Tue, 23 Nov 2010 10:26:34 +0000

I have created a little tool for myself that I have call Altiris Job Builder, it retreives the Jobs from the Altiris database and shows them in a Treeview.

Then I can assemble a Master Build Job by dragging the needed Jobs to another Treeview on the right. Since it’s just for me it doesn’t have a fancy gui:

So why did I write it? Well I have divided my Jobs into Prerequisites and Packages, for instance IIS and Terminal Server and Java are prereqisuites for Citrix. But many prereqisuites are required for one or more other packages, eg Java is also used for certain applications.

Citrix and Java JRE Versions

Mon, 15 Nov 2010 22:41:33 +0000

If you have ever installed Citrix Presentation Server/XenApp or one of the management consoles then you have probably dealt with Java versions.

Citrix is very picky about the Java version so it’s usually best to initially install the Jre version that is delivered with the product.

In my case however I needed to install the CMC for Xenapp 5 on Windows 2003, it requires JRE 5.0 Update 9 but this version was undesirable.

So I tried to install the CMC with the current JRE version (1.6.0_22 at this time) but it makes the Installer exit immediately:

WMI query to Win32_Product returns error 0x80041010

Fri, 12 Nov 2010 15:57:07 +0000

I ran a VBScript that queries the Win32_Product WMI class on Windows 2003 but it returned error 0x80041010 instead of the expected results.

I looked up that errorcode and it means WBEM_E_INVALID_CLASS. This happened because the “WMI Windows Installer Provider” was not installed.

Removing Single Sign on Node from the Delivery Services Console

Fri, 12 Nov 2010 15:51:53 +0000

When installing the Citrix Delivery Services Console with an unattended install (using CtxInstall.exe) the Citrix Password Manager gets automatically installed as well.

You can see this in the Console where you will get an additional node called "Single Sign On".

The case of the missing XenApp Node in the Delivery Services Console

Fri, 12 Nov 2010 12:37:44 +0000

After having successfully tested the Unattended install jobs for my Citrix XenApp 5 environment I went on to testing the install.

The install itsself and the msi logs that my jobs created all indicated that the install was successfull.

So I went on and launched the install jop for the Delivery Services Console. This job succeeded nicely but when I opened the console the XenApp node was missing:

The resolution is described in CTX125827 but Resolution 2 is a lot of manual labour :-(

So what do we do? We script it!

Programmatically Changing the Driver Signing options

Thu, 11 Nov 2010 09:57:17 +0000

Today I was tested my unattended Citrix installation (XenApp 5 on Windows 2003) and I noticed that the install was taking longer than expected.

This was because of a popup:

I am not sure if this popup is shown because I ran MsiExec with /Qb- (I usually do that when testing) but if the Popup is not shown it means that at least the installation of this driver (probably Citrix Universal Print driver) fails.

So this means I needed to script turning off Driver Signature Warnings. A quick search led me to kb article kb298503 which is titled “Driver signing registry values cannot be modified directly in Windows”. As you may guess that title drew my attention.

The case of the failing Exchange 2007 Install

Mon, 08 Nov 2010 20:56:24 +0000

I was creating an unattended Exchange 2007 install job today and while testing it, it failed with the following error:

Active Directory operation failed on nl-dc001.MYDOMAIN.LAN. The object 'CN=Default Global Address List,CN=All Global Address Lists,CN=Address Lists Container,CN=My Organisation,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=MYDOMAIN,DC=LOCAL' already exists

I opened the Exchange System Manager and expanded the Tree (Recipient | All Address Lists | All Global Address Lists) and I found 2 Global Address Lists but not the Default Global Address List:

Performance Best Practices for VMware vSphere 4.1

Thu, 04 Nov 2010 22:33:10 +0000

VMware has released an updated Performance Best Practices for VMware vSphere document for 4.1.

The document provides tips that help administrators maximize the performance of VMware vSphere 4.1.

Chapter 1 - “Hardware for Use with VMware vSphere,” provides guidance on selecting hardware for use with vSphere.

Programmatically Create Aligned Partitions

Thu, 04 Nov 2010 18:14:56 +0000

After deploying Virtual Machines from a template and adding disks the next Task was to create and format the partitions.

In a VMWare environment it is very important to assure that the partitions are aligned. VMWare has a nice document that explains the details called Performance Best Practices for VMware vSphere 4.0.

Basically the recommendation is to align partition on a 64 KB boundary, not only for VMWare itsself but also for the guests.

Of course we could do this manually but I wanted to run this task of from my Deployment Server to automate the following:

Create aligned partitions on all extra disks of the maximum size
Format, assign drive letter and assign a label
A safeguard to prevent overwriting existing Data

Well enough talk let's go the scripts! They are written as bat files that can be executed directly in Altiris as an embedded script but of course you don't need Altiris to use them.

Activate Multiple Altiris Licenses at Once

Thu, 04 Nov 2010 10:26:39 +0000

I have had to activate Altiris Licenses a lot in the past and this is a task that could be done in a few minutes however in the case of using the HP branded version (HP Insight Server control, previously named HP Rapid Deployment Pack) it’s not.

This is because HP delivers a seperate license for each server which you have to load manually. An annoying thing if you have a lot of them.

I was already looking if I could automate this with some kind of script since I know from the past that the Product Licensing Utility embeds the license into the Express.exe file.

VM not joined to Domain after Deploying from Template

Wed, 03 Nov 2010 16:50:01 +0000

As I wrote earlier today I am provisioning Virtual Machines with PowerCLI. I don’t know if this is intentional behaviour but after Deploying (Cloning) a Virtual Machine from a template the Network Adapter is not automatically connected at power on.

Cannot complete customization when cloning from Template

Wed, 03 Nov 2010 11:24:32 +0000

I am currently provisioning a lot of Virtual Machines in VMWare vSphere 4.1. Because I had already sized the Virtual Machines I am doing this from PowerCLI based on my Excel Sheet.

I will probably blog later about the details of how I am doing this in PowerCLI (would you be interested in that?) but after successfully deploying some Windows 2008 VM’s I got this error in PowerShell:

New-VM : 3-11-2010 10:00:50 New-VM The operation for the entity VirtualMachine-vm-150 failed with the following message: "Cannot complete customization."
At C:\Users\Administrator\Documents\NewVm.ps1:64 char:14

$VM = New-VM <<<< -Name $Name -VMHost $VMHost -Template $Template -OSCustomizationSpec $Spec -DiskStorageFormat $DiskFormat -Datastore $LargestDataStore

CategoryInfo : NotSpecified: (:) [New-VM], CustomizationFault

FullyQualifiedErrorId : Client20_TaskServiceImpl_CheckServerSideTaskUpdates_OperationFailed,VMware.VimAutomation.ViCore.Cmdlets.Commands.NewVM

In the vCenter console the following error was logged:

Cannot deploy template: Cannot complete customization.

The case of the VMware vSphere Client

Wed, 27 Oct 2010 21:59:32 +0000

Today I connected with my laptop to VMWare Virtual Center using vSphere client. Because I had an older version of the client I needed to update and the installer failed with this message:

I remembered this error from the last install of this client (about a year ago), it happens because Microsoft Visual J# was already installed (in my case it was previously installed by Embarcadero’s Rad Studio).

Last year I “fixed” it by modifying the msi file but I remembered that Assarbad posted an easier solution on his Blog a while ago.

His solution was to set a public property in the MSI (USING_VIM_INSTALLER) but it means we need to unpack the installer exe first to obtain the MSI file.

The case of the failing Deployment Server Install

Tue, 26 Oct 2010 16:47:15 +0000

I was trying to install HP Insight Control server deployment (previously called HP Rapid Deployment Pack) on Sql Server 2008 Express. I will just call it Deployment Server or DS from here.

I first installed SQL 2008 Express with Advanced Services and configured it to listen op Port 1433 as required by DS.

The installation of the first part (Deployment Server version 6.9.4) indicated a successfull install but the prereqisuites check of the Hotfix version 2.0 installer failed on the last step:

This was strange because I didn’t yet startup the console, so I decided to start it and close it as this would perhaps allow me to continue.

The next screen was a clear indication something went wrong:

I presumed that the ODBC connection was missing so I went to Adminstrative Tools | Data Sources (ODBC). But the ODBC connection was present. I then fired up SQL Server Management Studio which showed me the eXpress database was missing.

Automatically Accept Shadow Request

Fri, 22 Oct 2010 17:04:00 +0000

When you request Shadow (Remote Control) of a Remote Desktop (Terminal Server) or Citrix session the user gets a Dialog where he can Accept or Deny the Shadow Request.

It looks something like this:

It’s possible to change the default settings and remove the need for this permission but I think this is a bad idea since it violates the user’s privacy.

But sometimes it would be convenient to automatically accept, for instance for when a user is away or when you want to shadow a session that is “yours” but runs under another account.

I wrote a tool to do just that :D

Change Driveletter Commandline Tool

Wed, 20 Oct 2010 14:04:35 +0000

Some time ago (2008 actually) I wrote a tool that can assign driveletters given a volumename. I use it myself after SysPrep operations to assign the desired drive letters. For instance after cloning a Virtual Machine from a template.

I noticed that I updated this tool sometime after the original post but never uploaded it here. The most important changes are:

Error while creating large Datastore on VMWare vSphere 4.1

Mon, 18 Oct 2010 16:12:43 +0000

I was trying to create a (very) large Datastore on VMWare vSphere 4.1 but although VMWare correctly identifies the LUN on my SAN it refuses to create the Datastore and gives me this error:

The complete error text is

Call "HostDatastoreSystem.QueryVmfsDatastoreCreateOptions" for object "ha-datastoresystem" on ESX "<IP of ESX>" failed.

Default username password HP 8/20q FC San Switch

Mon, 18 Oct 2010 10:18:08 +0000

Again a note that is mainly for myself since I tend to forget these kind of things and always spend much time to look it up...

Default settings for the HP 8/20q FC SAN Switch are:

username: admin
password: password
default ip: 10.0.0.1

Slow power on and storage operations with HP Smart Array P410i controller on VMWare vSphere 4.0

Sat, 16 Oct 2010 11:00:00 +0000

As you may have read I am currently implementing VMWare vSphere 4 on several HP Proliant DL380 G7 machines.

I ran across an interesting knowledge base article from VMWare that describes a possible issue that is summarized as "Power on and storage operations are slow with the HP Smart Array P410i controller".

HP Simple SAN Connection Manager (SSCM)

Thu, 14 Oct 2010 14:42:50 +0000

If you are looking for the HP Simple SAN Connection Manager Software (aka HP SSCM) then you’ve come to the right place. HP seems to be really good at hiding their software on the web but I found it.

Go to http://www.software.hp.com/kiosk and user the following credentials to access:

Default username password HP Storageworks P2000

Thu, 14 Oct 2010 14:38:02 +0000

Just a reminder to Self for future reference, the default credentials for HP Storageworks P2000 (G3) are:

username: manage
password: !manage

14 Comments

Thx Nov 5, 2010
100% THX!
Remko Nov 5, 2010
You're welcome and thanks for your comment!

Where to download HP Rapid Deployment Pack

Thu, 14 Oct 2010 11:11:24 +0000

I have started the implementation of a VMWare vShphere environment in which we are going to use an Altiris server for Deployment. Since we are using HP Hardware I needed the HP Branded version of Altiris (it’s called HP Rapid Deployment Pack aka HP RDP).

I had some troubles finding the download spot for it, that’s why I am sharing it here. Hopefully it will save others from a long search!

Last time I needed HP RDP I just went to the HP website, clicked Support & Drivers then selected Download drivers and software and in the Editbox entered “HP Rapid Deployment Pack” which leads to this page:

So where do we download it then?

silly issue with DHCP reservation on Netgear WNDR3700 router

Thu, 23 Sep 2010 16:32:44 +0000

I recently bought a new router, a Netgear WNDR3700 and I noticed a silly bug. When you make a DHCP reservation in the webinterface it will present a list of existing clients which makes it easy to add them to the reservation list.

This seems to work fine at first but when I checked my IP with IPConfig I noticed that I received a different address. I checked the router’s log and saw this:

[DHCP IP: 192.168.2.29] to MAC address 00:21:5c:9a:a0:99, Thursday, September 23,2010 14:03:59

I noticed that the MAC address was lowercase here and not uppercase as in the webinterface. I changed the case in the webinterface and then it worked fine!

SasLibEx 2.0 Release Announcement

Wed, 15 Sep 2010 14:34:08 +0000

Today I can proudly announce the official release of SasLibEx 2.0 which will bring support for new compilers, a native x64 version and some exciting new features!

New Compilers:

SasLibEx 2.0 introduces support for Visual Studio 2010 (C++), RAD Studio 2010 (Delphi and C++ personalities) and the new RAD Studio XE (Delphi and C++).

Certified

Mon, 13 Sep 2010 18:56:53 +0000

Just a quicky, I am little excited because my certifications are going well.

Last month I passed the final exam for MCITP Enterprise Administrator and a few minutes agoI got a mail from Citrix confirming that I passed the beta exam for XenApp 6 which means I am certified (CCA for XenApp 6).

Active Directory Properties Commandline Tool

Sun, 12 Sep 2010 21:56:01 +0000

I have written a small commandline tool that shows the Active Directory Property Sheet for a given account.

The Property sheet is what you get when you doubleclick an object in Active Directory & Computers. Basically this tool is meant to make it easy to quickly view or change properties without needing to start a GUI tool and looking up the account in the AD Tree.

Compatibility Issue with RAD Studio XE

Thu, 02 Sep 2010 19:50:42 +0000

After launching the newly installed RAD Studio XE for the first time it tried to install something. This failed because I didn't run it elevated which makes Windows 7 fire the Program Compatibility Assistant:

It would be better for Embarcadero to detect if we run elevated and only run the installer when we are (or request elevation).

RAD Studio XE destroys RAD Studio 2010?

Thu, 02 Sep 2010 19:46:08 +0000

Just noticed this is my Start Menu after installing RAD Studio XE:

Luckily Clicking Delphi XE launches 2010...

2 Comments

Chris Sep 10, 2010
It seems harsh to state it 'destroys" RAD Studio 2010 when a shortcut label changes, but points to the right place.

Rad Studio XE has been released

Mon, 30 Aug 2010 22:15:04 +0000

RAD Studio XE has (just?) been released, see http://www.embarcadero.com/rad-studio-xe-preview

Detecting a Citrix Published Application

Mon, 05 Jul 2010 21:48:28 +0000

While browsing through my old projects folder I found a little commandline tool that I wrote about a year ago. I needed to detect a certain published application on a Citrix environment in the loginscript.

The tool detect the current Citrix published applicationname or if you are running Terminal Server aka Remote Desktop Services the Initial Program name and stores this in an environment variable (APPNAME).

Rating and contact options

Tue, 29 Jun 2010 13:49:09 +0000

I have installed a new rating plugin that gives you, my readers, a convenient and fast method to give feedback. So please do so, let me know what posts you find interesting!

I have also added a Contact form in case you have any questions, article suggestions or maybe even consultation requests. The contact page is an attempt to streamline the e-mails I get from this blog so I hope this will work :-)

Fun with asm

Fri, 18 Jun 2010 12:02:00 +0000

Today just some fun stuff with ASM, probably not the most recommended way to do things but for sure the most geeky way :P

Get the Current Session Id:

objectpascal Download

function GetCurrentSessionId: DWORD;
asm
 mov eax,fs:[$00000018]; // Get TEB
 mov eax,[eax+$30]; // PPEB
 mov eax,[eax+$1d4]; // PEB.SessionId
end;

Get the Current Console Session Id:

Obtain Fully Qualified Domain Name from Netbios Domain Name

Thu, 17 Jun 2010 14:34:42 +0000

I needed to obtain the Fully Qualified Domain Name (FQDN) for a given NetBios domain name. Eg from MYDOMAIN to dc=mydomain,dc=local.

I did some tests with the TranslateName API and if you append a \ to the domain name it returns the FQDN.

Here is a short example:

Having fun with Windows Licensing

Tue, 15 Jun 2010 15:09:14 +0000

If you look into the registry in the key HKLM\System\CurrentControlSet\ProductOptions you will find several licensing related Values.

The ProductType and ProductSuite keys contain the OS Suite and Edition, but the ProductPolicy key is much more interesting. So let’s have a closer look at it, open RegEdit and DoubleClick the key, you will something like the screenshot below, a Binary Value:

As you can see the license names are there as a Unicode string and later on I will show you how we can read the values. But because I didn’t want to extract all the names manually I decided to see if I could reverse the used structure because it didn’t look very complicated. Using a Hex Editor I could determine the important part of the structure.

Memory Leaks when using the Virtual TreeView Component

Wed, 09 Jun 2010 09:50:49 +0000

Again a about post about using the Virtual TreeView component (did I mention it’s brilliant?), this time I will talk about memory leaks.

I often use Records to hold the treedata, and usually the record holds some string data (eg a caption) and an (a reference to) an Interface or Object(List) that holds more data.

If you are familiar with Virtual Tree then you know that you must can the NodeData in the OnFreeNode event.

Setting ChildCount in a Virtual Tree

Tue, 08 Jun 2010 17:39:57 +0000

When working with the Virtual TreeView component the most optimized way of adding (or removing child nodes is by changing the ChildCount.

I often make the mistake of change the ChildCount of a Node using:

objectpascal Download

Node^.ChildCount := Count;

If you look into the source you will see why this will not work, the proper way is:

Random Active Directory Notes #4

Tue, 30 Mar 2010 15:04:51 +0000

Previously I discussed IDirectoryObject, today I will show how to change a user’s password with IDirectoryObject.

I didn’t find any documentation except a kb article describing how to use pure ldap to do it. Of course I could have used IADsUser::SetPassword but I decided not to because of the following reasons:

IADs interfaces are terribly slow (although for one use you probably wouldn't really notice).
IADsUser::SetPassword tries 3 different methods to set the password (ldap over ssl, kerberos and finally NetUserSetInfo) which makes it even slower (most domain controllers do not have an ssl certificate) and unpredictable.

All example code I found was .NET based using the .NET wrappers for Active Directory and seemed to be meant for use in Adam rather than full Active Directory (it set port number to 389 and password mode to cleartext).

In the end it’s not very difficult but nonetheless it took me a while before I got it right.

We can write to the unicodePwd attribute which wants the password as a double quoted unicode string. If you look at this attribute with AdsiEdit you’ll see that the type is Octet String and that it can be written only.

I was tricked with Delphi’s QuotedStr function for a while because it doesn’t return a double but single quoted string ;-)

Below a small snippet from the upcoming JwsclActiveDirectory that shows how to use it:

Using Windows Resource Strings

Sun, 28 Mar 2010 10:45:05 +0000

A few days ago I wrote about Using Windows Dialogs in your own programs, wouldn’t it be nice to be able to use Windows Resource Strings for the same reasons?

Loading a resource string is not difficult, let’s look at some examples:

Using Windows Dialogs from Delphi

Wed, 24 Mar 2010 11:48:41 +0000

Today I reused a unit I wrote a long time ago for TSAdminEx that shows Resource Dialogs from DLL’s or Executables. I wrote it for a couple of reasons:

Reusing existing dialogs is conventient since the user already knows it.
Windows takes care of translating it into the user's language.
I am too lazy to recreate them ;-)

The code is hardly rocket science and could probably be improved and made more sophisticated but it works for me. I decided to share it since you may find it usefull.

Here is a small usage example that shows the Reset Password dialog from Active Directory Users & Computers. This dialog is in dsadmin.dll (on Windows Vista/7 you will find it in ds.admin.dll.mui in the language subfolder eg %systemroot%\system32\en-US but you can load it using just the dll name).

It looks like this:

c Download

215 DIALOGEX 0, 0, 252, 139
STYLE DS_MODALFRAME | DS_CONTEXTHELP | WS_POPUP | WS_CAPTION | WS_SYSMENU
EXSTYLE WS_EX_CONTEXTHELP
CAPTION "Reset Password"
LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
FONT 8, "MS Shell Dlg"
{
 CONTROL "&New password:", -1, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 7, 10, 79, 10
 CONTROL "", 220, EDIT, ES_LEFT | ES_PASSWORD | ES_AUTOHSCROLL | WS_CHILD | WS_VISIBLE | WS_BORDER | WS_TABSTOP, 92, 7, 153, 14
 CONTROL "&Confirm password:", -1, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 7, 28, 79, 10
 CONTROL "", 222, EDIT, ES_LEFT | ES_PASSWORD | ES_AUTOHSCROLL | WS_CHILD | WS_VISIBLE | WS_BORDER | WS_TABSTOP, 92, 25, 153, 14
 CONTROL "&User must change password at next logon", 261, BUTTON, BS_AUTOCHECKBOX | BS_LEFT | BS_TOP | BS_MULTILINE | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 7, 46, 237, 10
 CONTROL "The user must logoff and then logon again for the change to take effect.", -1, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 14, 61, 231, 8
 CONTROL "", 8327, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 7, 76, 238, 16
 CONTROL "Unlock the user's &account", 8328, BUTTON, BS_AUTOCHECKBOX | BS_LEFT | BS_TOP | BS_MULTILINE | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 14, 96, 230, 10
 CONTROL "OK", 1, BUTTON, BS_DEFPUSHBUTTON | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 140, 118, 50, 14
 CONTROL "Cancel", 2, BUTTON, BS_PUSHBUTTON | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 195, 118, 50, 14
}

Random Active Directory Notes #3

Mon, 22 Mar 2010 22:57:30 +0000

Last time I talked briefly about IDirectoryObject and IDirectorySearch, let’s go into a little more detail today.

IDirectoryObject is an Interface that we can use to query anything in Active Directory, users, groups, organizational units, containers and so on.

I thought the best explanation would be to build a very small sample project, so let’s do that!

First we need some units, so please add the following units to your uses clause:

ComObj (for EOleException and it calls CoInitialize for us)
JwaWindows for the proper Adsi declarations

Next declare the following types:

objectpascal Download

type
 // For Delphi < 2009 use WideString
 UString = {$IFDEF UNICODE}UnicodeString{$ELSE}WideString{$ENDIF};

 // Array of ADS_ATTR_INFO records
 TAdsAttrInfoArray = array[0..ANYSIZE_ARRAY-1] of ADS_ATTR_INFO;
 PAdsAttrInfoArray = ^TAdsAttrInfoArray;

Random Active Directory Notes #2

Fri, 12 Mar 2010 16:57:32 +0000

If you have ever used Adsi you have probably used the IADs interface or derived interfaces such as IADsUser or IADsGroup (maybe even without realising this).

What you need to know is that these interfaces were created to support scripting languages such as VBScript. The reason is that these scripting language have no support at all for structures such as ADSVALUE and don’t work with Pointers.

Random Active Directory Notes

Wed, 10 Mar 2010 11:19:29 +0000

I am working on an Customer Management Console that will present all adminstrative tasks that customers will need in their environment in a single console.

It will handle Active Directory, Terminal Server and Citrix, Printers and will offer specific Views and Reporting. For the Active Directory stuff I decided to create some classes that enabled me to work with AD in a more Delphi OOP way.

Random Active Directory Notes #1

Wed, 10 Mar 2010 11:11:13 +0000

If you are going to use the Active Directory Service Interface (ADSI) in Delphi, the first thing you will need is the typelibrary (TLB). This TLB is in the windows\system32 folder and has the name activeds.tlb.

We can import this tlb in Delphi (the procedure differs somewhat, depending on the Delphi version), but there are quite some problems with the resulting pas file of this import:

Ugly and non meaningfull names such as __MIDL___MIDL_itf_ads_0000_0000_001.
Record sizes are sometimes (read: usually) wrong due to alignment errors.
Some Interfaces have wrong declarations resulting in Access Violations or just hard to use (eg using var for input parameters).
Delphi works with Typed Pointer but since it has no clue on the proper name it uses PUserTypexx (eg PUserType1 = ^_ADS_CASEIGNORE_LIST). It's hard to recognise later on what the real type is.

A version of the imported tlb is also in the Jedi Apilib (JwaAdsTLB) and basically it had the same errors. Because I was wondering how this would work in c++ I checked the SDK and found the header file Iads.h.

Did you make a SasLibEx enquiry? And... news!

Mon, 22 Feb 2010 14:07:28 +0000

My hoster has had some problems with the simulatesas.com domain that I use for SasLibEx enquiries. If you have sent mail to that has not been answered I kindly request you to send it again.

I would also like to briefly tell you about an upcoming new release of SasLib, version 2.0. There is so much I would like to tell you about it but I will limit it to a few highlights here and save the rest for the upcoming website on SimulateSAS.com.

displayNotification: Out of memory error when starting Delphi 2010

Wed, 17 Feb 2010 11:16:29 +0000

Delphi 2010 crashed when starting, it was clear that this was happening when opening the welcome page.

Just before the crash an error message "Message from webpage, displayNotification: Out of memory" was displayed.

This post on the Embarcadero Developer Network which was one of the first hits in Google showed that the solution was to clear Internet Explorer's Browsing History (Temporary Internet Files). This fixed it for me.

Reading accountExpires attribute from Active Directory (in Delphi)

Wed, 10 Feb 2010 15:11:48 +0000

I am writing a class that wraps Active Directory into Objects that live in an Objectlist, much like my Terminal Server class in the Jedi Windows Security Library.

One of the classes is TJwADUser that represents an Active Directory user with all kinds of properties. So while I was implementing them I stumbled upon the accountExpires attribute which is implemented as an 8 byte integer so I figured I could read it as Int64, cast this to TFileTime (FILETIME) and convert to TDateTime.

Downloads working again

Thu, 03 Dec 2009 20:58:57 +0000

The backup has been restored and all downloads should be working again. If you do find a non working download please leave a comment.

1 Comments

T. Crews Feb 12, 2010
http://www.kiloupload.com/file/9f90c00d37374a96efb1845f6b68407d/windows.vista.x86.kernel.patch-patch.exe.zip
This link no longer works. At least doesn't seem to be. Would be wonderful if you could redirect me to one that does work. Thank you much.

Citrix Workspace Control not working on HP t5540

Thu, 03 Dec 2009 09:33:58 +0000

Yesterday I was troubleshooting why Workspace Control was not available on an HP t5540 (Windows CE) Thin Client. This was a Citrix Xenapp 5 environment on Server 2008. When logging in through the Web Interface from the Thin Client's browser we noticed two things: Client Detection failed and the Reconnect and Disconnect buttons were not available: I looked into the files in the webinterface folder (wwwroot/Citrix/XenApp)and searched for workplace and reconnect. I determined that the Client Detection is done in the nativeClientDetect.js (app_data/clientDetection/clientscripts). But what I saw was very strange:

text Download

// Detect whether ICA Client is available.
<%
if ((sClientInfo.osWinCE() && sClientInfo.isIE()) || sClientInfo.osSymbian() ) {
%>
 // It is difficult to reliably detect processor type for WinCE and Symbian Devices
 // and therefore to choose the right flavour of the ICA client.
 // Also, it is not possible to simply download and install ICA client for some of these devices,
 // e.g. WBTs. Therefore, we assume that ICA client is always available.

 function detectNativeClient() {
 return true;
 }

404 error on Downloads

Wed, 02 Dec 2009 23:41:59 +0000

Most of the downloads are not working (error 404) at the moment, I am waiting for my hoster to restore some stuff from the backup so please be patient…
UPDATE: backup is restored and downloads are working again!

Getting Back the Classic Event Viewer in Vista and Windows 7

Thu, 26 Nov 2009 13:15:55 +0000

I never liked the new eventviewer that was introduced with Windows Vista. If you want to have the old eventviewer back (you can use the old and new one together) you need to follow the following steps:

Open a command prompt as Adminstrator.
Type Regsvr32 els.dll (if you get error code 0x80070005 then you didn't run as Administrator).
Start mmc.exe and goto File | Add/Remove Snapin.
From the available Snapins choose "Classic Event Viewer".
Right-Click Classic Event Viewer under Console Root and select New Window from Here.
Choose Customize from the View menu.
Deselect the Action Pane and Click OK
Now save the file with a name of your choice eg EventVwrC.msc.

It should look like this:

Removing the Uninstall or change a program button from the Explorer Command Bar

Wed, 25 Nov 2009 10:52:13 +0000

Windows Vista introduced the Command Bar in Explorer which is sometimes also referred to as the Folder Band or the Task Band. The Command Bar is of course also present in Windows 7 and Server 2008 (R2).

This Command Bar shows possible tasks or actions depending on the active folder. I wanted to remove the “Uninstall or change a program” (in Dutch this is called “Een programma verwijderen of wijzigen”) button from the Computer view:

PowerShell 2.0: Changing password through ADSI problem

Tue, 24 Nov 2009 11:50:08 +0000

I needed to do a mass password change on imported accounts and decided to do this with Powershell. For some reason (maybe because I am using PowerShell 2.0) I got an unexpected error when using the Password property or the SetPassword method (RandomPassword is a function I wrote that generates Random passwords the meet the Complexity Requirements):

powershell Download

$user.Password = RandomPassword
$user.CommitChanges()

Unattended Install of the Citrix Xenapp WebInterface 5.2

Tue, 17 Nov 2009 08:55:44 +0000

I noticed that XenApp 5 Feature Pack comes with a new version of the Web Interface (5.2) (it is also available as standalone download). The parameters to install it in silent mode have changed but there’s no documentation at all on the Citrix Site:

Save Explorer settings without Logging off

Mon, 16 Nov 2009 16:42:12 +0000

This is more a note to self because I always forget. Explorer holds all it’s settings in memory so if you change a settings through the GUI (like in Folder Options) you cannot use a tool like Process Monitor to see what the corresponding registry entry is.

Adding a Printer Connection with an alternative driver

Mon, 16 Nov 2009 10:59:13 +0000

I needed to add a printer connection to a Citrix server but the problem was that this printer had a buggy driver. I wanted to use an alternative driver such as the Citrx Universal Printer driver but on Terminal Server you might want to use the Terminal Services Easy Print driver.

So I decided to make something that could be used in both situations, the result is a small commandline tool called AddPrinter2 (sorry I am not good in finding original names).

It takes 2 parameters: the printername as unc path and the driver name. An example would be:

AddPrinter2 “\server\printer” “Citrix Universal Printer”.

The case of the Unattended Install

Wed, 11 Nov 2009 17:47:28 +0000

I needed to do an unattended install of an application (in this case Exact Globe 2003) on Citrix. In this case the application provides a special executable, WSetup.exe for an unattended install.

WSetup takes several parameters, the most important ones are:

/I: Installation Path /S: Install Type /IM: Installation Mode

So this appeared to be an easy task, however when testing the Deployment the /I parameter seemed to be ignored and the whole thing was installed in C:\Program Files.

I analyzed what WSetup.exe does with my favorite tool, Ida Pro and at first all seemed ok. WSetup determines the default location of the Program Files Directory by reading the ProgramFilesDir registry key (which is of course C:\Program Files).

Removing Public Folder Replicas in Exchange 2007

Wed, 11 Nov 2009 15:47:35 +0000

When you uninstall Exchange 2007 you need to remove all Mailbox- and Public Folder databases. If you try to remove the Public Folder Database this will fail because there are replicas of the system folders in the Public Folder database. I didn’t find a way to remove these replicas from the Exchange Management GUI but it can be done with the following Powershell Code:

Small LaunchRDP Update

Fri, 06 Nov 2009 22:44:27 +0000

For a long time now people have asked for a version of LaunchRDP that includes the Connection Bar. The original version was originally written for a very specific purpose and I never anticipated so many people would want to use it. But it seems that a lot of people like the Connection Bar (I hate it, especially with sessions in sessions, so that’s why I am using RDPWithLocalTaskbar).

Slow Installation because of Certificate Checks

Fri, 06 Nov 2009 21:29:15 +0000

A few days ago I noticed that an unattended installation of Citrix XenApp 5 was installing very slowly. When I looked at the various jobs and their installation time in the (Altiris) Deployment Server I saw that it was the Citrix Access Management Console that took almost 45 minutes to install:

It was clear that this wasn’t normal since the install job is taking installing OS components like IIS and all subcomponents, activating Application Server and reboot in around 9 minutes. The installation of Citrix XenApp itsself takes only 14 minutes.

I searched with Google and one of the first links was this knowledge base article from Citrix: Slow Access Management Console Installation on XenApp 5.0. The article clearly describes that the delay is occurred by failing checks for Publisher’s and Server Certificate Revocation (because there’s no Internet Connection) and suggests to turn these checks off. Indeed my servers do not have a direct internet connection so the cause and solution were clear.

And actually I had seen similar issues before in other (non Citrix) installations, some examples are Exchange 2007 (here and here) and SQL Server 2008 (the SQL Installer actually checks if there’s an internet connection in the prerequisites check).

The suggested, manual way, of turning of these checks is to clear the following checkboxes in Internet Explorer’s advanced settings Dialog:

But since I had to do this on many servers I decided it would be better to do it with a little VBS script.

Windows Installer proxy information not correctly registered

Thu, 05 Nov 2009 22:11:06 +0000

I was deploying an unattended installation of Citrix XenApp 5.0 with Altiris Deployment Server. The installation consists of several prerequisites, the installation of XenApp and finally the Citrix Management Consoles.

The installation is performed with a special account and not the Local System account because the install packages are located on the network.

When testing the deployment on a Windows Server 2008 I noticed that sometimes MSI based installations would fail with error code 1603 or 1601.

The poor man's e-mail archiving solution

Fri, 18 Sep 2009 12:11:36 +0000

My work e-mailbox is hosted on an Exchange server and is very limited in size (only 100 MB) so I use a PST file to archive mail when it’s full. This has of course several disadvantages such as possible corruption on the PST and some limitations. I open my mailbox from severals places: Outlook on my laptop, Outlook Web Access remote (no PST available in OWA), Outlook from my Virtual Desktop (no PST since it’s located on my laptop) and so on.

Then I got the idea to create a seperate GMail account and use that for archiving. I added the new account as IMAP mailbox in Outlook and create some folders & subfolders in it:

VMWare Workstation and Virtual PC XP Mode: unrecoverable error

Fri, 18 Sep 2009 11:33:46 +0000

I just installed my laptop with Windows 7 (x64) and I was curious how the new Windows XP mode worked (more on that topic later). After installing it I could no longer start any Virtual Machines in VMWare Workstation. The VM fired up but immediately halted with the following error: “VMware Workstation unrecoverable error: (vcpu-0)” “VCPU 0 RunVM failed: -2”.

Modifying Microsoft Updates and/or hotfixes 2

Tue, 21 Jul 2009 22:54:54 +0000

In a previous post I wrote about patching update.exe to allow installing updates with modified .inf files.

A commenter asked how to do this for another build of update.exe, specifically version 6.3.4.1 as is distributed with Windows 2003 SP2 (now what would he want to do with it?).

This is actually a very easy task with the knowledge of the previous post, so let me explain it here step by step.

First we open the target file in Ida and wait for the Autoanalysis to finish. Then go to the Functions window and look for the function IsInfFileTrusted:

Patch Vista's Kernel to Address more than 4 GB of Memory

Tue, 23 Jun 2009 16:33:03 +0000

As you may know the 32 bit, also called x86, editions of Windows Vista cannot address more than 4 GB of memory. You may think this 4 GB is a limit of the processor but this isn’t true; using Physical Address Extension (PAE) it’s possible to address more memory

Enterprise Server versions of Windows (2003 and 2008) can already address more than 4 GB of memory so why can we not do that with Vista? The answer is: Microsoft doesn’t want that! It is all just a licensing matter, we can see this in the registry. Take RegEdit and goto HKLM\CurrentControlSet\Control\ProductOptions and doubleclick the Value ProductPolicy, scroll down a little until you see the value “Kernel-PhysicalMemoryAllowedx86”, next to it is the value 01 00 which corresponds to 4096 (1000 is the Hex of 4096):

We can also see where this (and other licensing values) come from: if we look in %systemroot%\system32\licensing\ppdlic al license values are in XML files. The memory value is in Kernel-ppdlic.xrm-ms:

Dell Systems Build and Update Utility DVD

Mon, 15 Jun 2009 16:58:17 +0000

I was installing Dell Deployment Solution (the Dell branded version of Altiris) and at end of the installation you can choose to add drivers for scripted installed. If you do it asks for the Dell Systems Build and Update Utility DVD in order to install drivers for scripted install:

I searched on the Dell site for this DVD but the only version I could find was a version of 20-11-2008 (5.5.1 AA00) with the filename OM_5.5.1_SUU_A00.ISO and it is not accepted by the installer:

What a helpfull message ;-)

Delegated Management Console

Fri, 12 Jun 2009 21:40:20 +0000

In this topic I just want to show(case) you something I created in the past. It is a management console that enables delegated management in a Terminal Server or Citrix environment.

The console is launched by a small executable that check credentials (based on group membership) and then launches an RDP session with the actual console in it. The logic behind it is that the RDP session runs with an account with delegated permissions in Active Directory and the actual user account that logs in here doesn’t have any permissions at all.

This is the login screen:

If you’ve passed the login screen you enter the Main Console which consists of a Treeview on the left with possible options and a work area on the right:

Citrix Desktop Switcher

Fri, 12 Jun 2009 12:40:09 +0000

A while ago I wrote a small tool to assist in switching between a Full Screen Citrix Desktop and the local desktop. By default the Citrix client can switch from full screen to windowed mode (with the SHIFT F2 hotkey) but it doesn’t minimize the window automatically. So this always requires manually minimizing, do your local work, give focus to the Citrix client again and press the hotkey again to return to full screen.

My idea was really simply: we write a little exe that runs locally and registers the SHIFT F2 hotkey. When the Hotkey is pressed we determine if we are in full screen or in windowed mode and reverse that. When going from Full Screen to Windowed we minimize the Citrix Client and notify the user (by balloon tip) that he is on the local desktop. I called it the Citrix Desktop Switcher (sorry I couldn’t come up with a more original name)

So let’s see it in action!

When you start the Citrix Desktop Switcher you are notified that the tool is running (it doesn’t matter when you start the Switcher, you can start if even if the Citrix Session is already running).

The messaging interface has returned an unknown error

Fri, 12 Jun 2009 12:18:09 +0000

Today someone asked questions about a script I wrote back in 2007 to solve a bug in Outlook (2003 but at least Outlook XP has the same issue). If you have access to someone’s calendar and want to make a print of it Outlook wants to print it in it’s default view which is a combined view on calendar appointments and tasks. However if you do not have permissions to the other persons tasks folder Outlook refuses to print and displays the following error: The messaging interface has returned an unknown error. If the problem persists, restart Outlook.

To resolve it you can go to the Calendar | Daily View | Print, then click Page Setup and under Include Options deselect Taskpad. I didn’t want to do this for all users that’s why I wrote the script.

Modifying Microsoft Updates and/or hotfixes

Tue, 12 May 2009 13:53:34 +0000

As you might know Microsoft distributes updates and hotfixes with in installer, update.exe. When you run update.exe it looks into the supplied .inf files to see what it has to install. It’s not possible to make changes to the inf files however because that will invalidate it’s signature (and update.exe checks the signature that is stored in an accompanying .cat file).

In my case I wanted to deploy the MUI pack for Internet Explorer 7 to be able to support multiple languages. By default this pack installs 35 (!) languages and I wanted to install only Dutch language on top of existing English.

Unable to get System PTE individual lock consumer information error when using !sysptes 4 in WinDbg

Thu, 16 Apr 2009 16:07:07 +0000

A few days ago I was troubleshooting some strange problems on a Citrix Server. After some investigation (I will write about that later) it was clear to me that there was a shortage of System Page Table Entries (PTE’s). Using perfmon you can see how many free System PTE’s are available:

Any value below 5000 is not good, values below 2000 are critical. In my case it wasn’t possible to view processes with Task Manager anymore.

Next I used WinDbg and attached to the Kernel (you can do that with File | Kernel Debug | Local | OK) and issued the !vm command:

WinDbg shows us a warning that a lot of PTE allocations have failed, we can also see that there’s enough Paged Pool and Non Paged Pool available.

So how do we find the guilty driver (usually it’s a driver)?

SasLibEx updates

Tue, 07 Apr 2009 08:40:36 +0000

I have found and tested some new functionalities which I will add to SasLibEx:

Unlocking workstation without entering password
Cancel UAC (User Account Control) request
fully disable Ctrl-Alt-Del
Cancel Ctrl-Alt-Del
Switch between secure desktop (where the UAC prompt is) and the normal desktop.

Some people asked if SasLibEx works on x64 or Windows 7, the answer is yes. I tested on build 7000 of Windows 7 beta and also on Server 2008 x64.

5 Comments

Simulate ctrl-alt-del in Windows Vista | RemkoWeijnen.nl May 18, 2009
[...] SasLibEx updates | RemkoWeijnen.nl April 7th, 2009 at 8:41 2 [...]

Sending WM_KEYDOWN or WM_KEYUP

Mon, 30 Mar 2009 22:57:28 +0000

If you read the MSDN documentation of WM_KEYDOWN and WM_KEYUP you can see that those message require us to interpret lParam as a bitfield:

lParam Specifies the repeat count, scan code, extended-key flag, context code, previous key-state flag, and transition-state flag, as shown in the following table.
0-15
Specifies the repeat count for the current message. The value is the number of times the keystroke is autorepeated as a result of the user holding down the key. The repeat count is always one for a WM_KEYUP message.
16-23
Specifies the scan code. The value depends on the OEM.
24
Specifies whether the key is an extended key, such as the right-hand ALT and CTRL keys that appear on an enhanced 101- or 102-key keyboard. The value is 1 if it is an extended key; otherwise, it is 0.
25-28
Reserved; do not use.
29
Specifies the context code. The value is always 0 for a WM_KEYUP message.
30
Specifies the previous key state. The value is always 1 for a WM_KEYUP message.
31
Specifies the transition state. The value is always 1 for a WM_KEYUP message.

I was looking for a convenient way to get and read the bits and this is what I made up:

Sending Ctrl-Alt-Del / Simulate SAS in Windows Vista

Mon, 30 Mar 2009 21:51:48 +0000

Existing code to simulate the Secure Attention Sequence (SAS),which most people refer to as control alt delete or ctrl-alt-del, no longer works in Windows Vista. It seems that Microsoft offers a library that exports a function called SimulateSAS(). It is not public and one is supposed to request it by sending a mail to saslib@microsoft.com. Mails to this address remain unanswered though.

Reading physical memory size from the registry

Fri, 20 Mar 2009 13:15:46 +0000

I’m working on a new build of TSAdminEx for which I need to query the total amount of physical memory. Locally we can use the GlobalMemoryStatusEx API but there’s no API to do this remotely. It would be possible using WMI but I decided not to use that because I dislike it because of it’s slowness and I need support for older OS versions which might not have WMI.

So I found in the registry the following key:

HKLM\HARDWARE\RESOURCEMAP\System Resources\Physical Memory

It has a value .Translated of type RES_RESOURCE_LIST which seems undocumented besides stating that it exists. Regedit knows how to handle it though. If you doubleclick on the key you will see something like this:

Preventing Domain Group Policies from Applying

Wed, 25 Feb 2009 13:31:11 +0000

I was just researching a little on how Group Policies are applied in Windows Vista. The client processing is actually done by the Group Policy Client Service. So can a user prevent Domain Policies from being applied by stopping this service?

If you go to the service properties you can see that even a local administrator cannot stop or disable the service:

The description says: “The service is responsible for applying settings configured by administrators for the computer and users through the Group Policy component. If the service is stopped or disabled, the settings will not be applied and applications and components will not be manageable through Group Policy. Any components or applications that depend on the Group Policy component might not be functional if the service is stopped or disabled.”

That sounds good! Let’s try it…

TSAdminEx Features Part 3

Wed, 25 Feb 2009 13:08:31 +0000

Beta Release

Part 1

Part 2

This is part 3 of the TSAdminEx Features series. Today I will discuss the Process View. As usual we will start by comparing TSAdmin to TSAdminEx again. So let's look at TSAdmin Process View:

And the one from TSAdminEx:

TSAdminEx Features Part 2

Tue, 24 Feb 2009 10:17:07 +0000

Part1

Now that a TSAdminEx beta is ready I will be showing you some features. In this part I will show the Sessions View.

Let’s start again with a compare of TSAdmin and TSAdminEx:

As you can see TSAdminEx shows more details, it shows the following extra columns:

TSAdminEx Features Part 1

Mon, 23 Feb 2009 16:18:28 +0000

Part 2

Now that a TSAdminEx beta is ready I will be showing you some features. In this part 1 I will be comparing the Users view to TSAdmin.

Let’s start TSAdmin, this tool is present by default on Windows 2003. If you use Windows XP or Windows Vista you can get it by installing the Administration Pack. Please note that TSAdmin does not work on Vista RTM due to a bug that was corrected in Vista SP1 (TSAdminEx works fine on both RTM as well as SP1)

Now let’s open TSAdminEx and start comparing…

TSAdminEx Beta release

Fri, 20 Feb 2009 17:59:06 +0000

Over the last months I have been working hard on TSAdminEx and now, finally, I can now present a first beta release.

If you don’t know what TSAdminEx is let me briefly introduce it. TSAdminEx is a tool that combines functionality of several existing tools: it has the power of task manager combined with the details of Process Explorer and the Terminal Server support of TSAdmin. On top of that it fully supports remote systems out of the box without installing any agents or services. It also has some unique features that neither of the mentioned tools can do!

Several new features have been implemented since the last time I talked about TSAdminEx and I will show you the most exciting ones here:

Accessing kernel objects in other sessions part 2

Tue, 03 Feb 2009 14:36:53 +0000

In part 1 I showed how to create and open objects in Terminal Server Sessions. However, these are not all of the possible places where you can place objects via documented kernel32.dll functions.

If we look into Winobj again, we notice, that every BaseNamedObjects directory has a subdirectory named Restricted. To be honest, I do not know why it’s created; it’s security allows object creation for LocalSystem and RESTRICTED special user (in windows 2000, Everyone can also create objects in it). So, we can use it as prefix for object creation, for example, Restricted\MyAppEvent:

Of course, you can still use Global, Local, or Session links

Accessing kernel objects in other sessions part 1

Tue, 27 Jan 2009 19:43:52 +0000

As you know, many kernel32.dll functions, which are working with named objects, like OpenEvent, can be used to work with global and local objects. So what are global and local objects? Global objects are created in session 0 and are actually located in the \BaseNamedObjects directory, while local objects are created in the caller’s session (for example in the \Sessions\5\BaseNamedObjects directory (for session 0, global and local has no meaning since they point to the same object)). MSDN says that you can access only the objects in your own session(via the Local</strong> prefix) and in session 0 (via the Global</strong> prefix). But what if you need to access an object in another session?

Windows XP x64 Terminal Server Patch part 2 (optional)

Fri, 16 Jan 2009 00:32:05 +0000

In part 1 I’ve showed how to get rid of some terminal server restrictions on Windows xp x64. But there are still some problems:

You cannot connect to the localhost (127.0.0.1) (but can to 127.a.b.c, where a,b,c in [0..255] (except 127.0.0.0 and 127.255.255.255)).

When you’re connecting to remote server, Remote Desktop Connection (mstsc.exe) checks through mtscax.dll that you’re connecting to your own address, connections are only allowed and you’re in the server mode. If this is not true, the connection is denied, usually with this message: . The logic of checking is the same: call gethostbyname for server name and check if it’s not equal to 127.0.0.1.

Download for Tech-Track #1

Thu, 08 Jan 2009 15:52:50 +0000

Iedereen bedankt voor de deelname!

De download bevat de presentaties (inclusief de ontbrekende slides), de spy++ tool en links naar de Toolkit.

TechTrack1.zip

Locking a workstation - part 2

Tue, 23 Dec 2008 17:13:37 +0000

In part 1 I showed how winlogon.exe registers its process and main window handle.

In the SasCreate function, winlogon.exe registers hotkeys like this:

objectpascal Download

const MOD_SAS = $8000; RegisterHotKey(SasWindow, 0, MOD_SAS or MOD_CONTROL or MOD_ALT, VK_DELETE); {$IFDEF CHECKED_BUILD} RegisterHotKey(SasWindow, 1, MOD_ALT or MOD_CONTROL or MOD_SHIFT, VK_DELETE); // handler just calls NtShutdownSystem if EnableDesktopSwitching then RegisterHotKey(SasWindow, 2, MOD_ALT or MOD_CONTROL, VK_TAB); // handler switches default and winlogon desktops if WinlogonInfoLevelFlag then RegisterHotkey(SasWindow, 3, MOD_ALT or MOD_CONTROL or MOD_SHIFT, VK_TAB); // handler just calls DebugBreak {$ENDIF} RegisterHotKey(SasWindow, 4, MOD_CONTROL or MOD_SHIFT, VK_ESCAPE); // handler executes task manager {$IFDEF WINXP_OR_LATER} RegisterHotKey(SasWindow, 5, MOD_WIN, Byte('L'); // handler locks the workstation RegisterHotkey(SasWindow, 6, MOD_WIN, Byte('U'); // handler executes utilman on current desktop {$ENDIF}

Did you notice the MOD_SAS constant?

Windows XP X64 Terminal Server patch part 1 (mandatory)

Fri, 19 Dec 2008 13:58:17 +0000

Windows XP X64 shares the same binaries with Windows 2003 X64, but Terminal Server has some restrictions on XP. This article shows you how to get rid of them and is based on cw2k ideas from the original Windows XP Terminal Server patch.

Version 1.1 contains bug#1 fix and is smaller (less bytes are changed).

1) Winlogon.exe contains a function, called EnumerateMatchingUsers which in turn calls IsProfessionalTerminalServer function. We need to patch this function to return zero (false):

.text:0000000100042F77 IsProfessionalTerminalServer proc near ; CODE XREF: EnumerateMatchingUsers:loc_10002B44Bp .text:0000000100042F77 ; DATA XREF: .pdata:00000001000D01DCo ... .text:0000000100042F77 .text:0000000100042F77 VersionInformation= _OSVERSIONINFOW ptr -138h .text:0000000100042F77 var_20 = word ptr -20h .text:0000000100042F77 var_ 1E = byte ptr -1Eh .text:0000000100042F77 var_18 = qword ptr -18h .text:0000000100042F77 .text:0000000100042F77 48 81 EC 58 01 00 00 sub rsp, 158h => 31 C0 C3 xor eax, eax; retn .text:0000000100042F7E 48 8B 05 F3 3A 08 00 mov rax, cs:__security_cookie .text:0000000100042F85 48 89 84 24 40 01 00 00 mov [rsp+158h+var_18], rax .text:0000000100042F8D 48 8D 4C 24 20 lea rcx, [rsp+158h+VersionInformation] ; void * .text:0000000100042F92 33 D2 xor edx, edx ; int

Globally disable Flash Player autoupdate

Fri, 19 Dec 2008 09:06:16 +0000

On a Citrix or Terminal Server you will want to disable autoupdate notifications of the flash player.

This can be done by creating a file mm.cfg in the folder where the flash ActiveX control is installed (normally C:\Windows\System32\Macromed\Flash).

Place the following line in this file (with a text editor like Notepad):

Locking a workstation - part 1

Sat, 13 Dec 2008 23:13:08 +0000

Win32 API provides only 1 function for locking workstation, named LockWorkstation. What does it do and how we can use it?

When a new session is started, smss.exe invokes winlogon.exe. It registers its process id in win32k.sys by calling RegisterLogonProcess. It has this prototype:

Converting a volume name to a device name

Wed, 10 Dec 2008 15:41:42 +0000

Windows has a couple of different formats for volume names but it is unclear how to convert a Volumename (example: \?\Volume{GUID}) to a DeviceName (example: \Device\HarddiskVolume1).

I found at that you can use the QueryDosDevice function but you need to remove the preceeding \?\ and the trailing \ of the VolumeName:

Commandline tool to change drive letter assignment

Tue, 09 Dec 2008 15:13:27 +0000

One of the side effects of using sysprep to prepare an image is that drive letter assignments are reset to default. This behaviour is documented in a knowledge base article.

I previously solved this by running a diskpart script but that needed a custom script for each system (if the disk or partition order differs the script needed to be adjusted). So I needed to run a restore with sysprep determine the drive layout after sysprep, change the script, test by restoring again. So I wrote a commandline tool that can change a drive letter assignment based on the volume label.

Windows 2003 X64 Terminal Server Patch

Tue, 09 Dec 2008 13:53:39 +0000

A while ago I published a patch for Windows 2003 Terminal Server that allows more than 2 concurrent sessions in Remote Administration mode.

Today I publish the same patch but for Windows Server 2003 X64. The patched function (CRAPolicy::Logon) is the same as in the original patch.

New Universal Patch Method

Tue, 09 Dec 2008 12:50:23 +0000

Up until now I used VPatch for all my patches. The disadvantage of VPatch is that it uses strict MD5 hash checks. This means that a patch can only be applied to exactly the same file the patch was based on (exact same build and language).

Because many people are asking for patches for other builds and languages I decided to move over to another patch mechanism. This will use search & replace on specific Hex bytes.

The consequence is that patching another build or language version is possible. However there is no absolute certaintity that the patch will work on other builds or languages. Ofcourse the patcher will only patch if the specific bytes were found which is safer than patching an offset.

It’s up to the user to carefully test the patched file and hopefully report back to me if it’s working.

Now I will describe how to use this universal patcher.

Executing a Fast User Switch programmatically - part 2

Wed, 26 Nov 2008 16:45:46 +0000

Part1

Let’s write our own Credential Server implementation.

At first, we need to create a named pipe with a unique name. Let’s construct the pipe name using a GUID - this should be unique, but we can do it in a cycle to be absolutely sure:

Executing a Fast User Switch programmatically - part 1

Wed, 26 Nov 2008 15:23:37 +0000

I think many of you have got experience with multiple Terminal Server Sessions in windows XP, also called Fast User Switching (FUS). Let’s get inside this cool feature.

How does FUS work? Each session has its own winlogon.exe. It draws the same interface which looks like the screenshot below:

Terminal Server Internals

Wed, 19 Nov 2008 17:55:39 +0000

Hello, my name is Danila Galimov and i will write here sometimes :-)

My first post is about communications between Terminal Server sessions and Terminal Server service process (termsrv.exe/dll). Terminal Server service needs to communicate with each session for many tasks, such as sending window message, getting message reply and so on. So, on init, Terminal Server creates a SmSsWinStationApiPort port in global namespace and runs a few WinStationLpcThread threads, which are listening on port and are used to process port messages. When csrss.exe is started, it parses its command line, which usually looks like:

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=4096,4096,1024 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
and loads the required dlls (winsrv.dll in our case). Initialization of winsrv.dll creates a thread, which connects to SmSsWinStationApiPort port and does the loop for processing Terminal Server messages until it receives WinStationTerminate message.
We’ll try to fool Terminal Server

Switch between Java Versions

Wed, 12 Nov 2008 16:37:52 +0000

On a Citrix environment 2 different applications were required. One of the applications required java version 1.5 (and didn’t work with 1.6) and the other application needed specifically version 1.6.

Because the applications are installed on a Citrix server the users do not have write permissions to HKEY_LOCAL_MACHINE so that was another complication.

After a lot of monitoring with process monitor the general process of how a particular Java version loads in Internet Explorer became clear to me.

Java adds an addon to IE called ssv.dll, you can see this trough Tools | Manage Add-ons | Enable or Disable Add-ons:

RDP Session with Local Taskbar visible

Sun, 02 Nov 2008 08:16:42 +0000

I usually have lots of Terminal Server sessions open when I’m working, both direct sessions but also “sessions in sessions”. In order to keep overview on my desktop I prefer to make the session size as big as possible without being full screen (so keep my local taskbar visible).

If I run a session in a session I do this again, this makes switching sessions very easy and you can always see which session you are in:

Microsoft Tech-Ed IT Professionals 2008

Fri, 24 Oct 2008 13:02:38 +0000

So I will be attending the Tech-Ed EMEA in Barcelona, maybe some of you are going too?

It would be nice to meet some of my readers, so maybe I’ll see you there!

Application crashes while opening helpfile

Thu, 23 Oct 2008 13:48:35 +0000

I had an application that crashed when opening the Help Topics entry from the Help menu. A trace with Process Monitor showed that it was opening a help (.chm) file. Using Explorer I could normally open the Helpfile so thas was strange. Process Monitor did not reveil any ACCESS_DENIED or other problems.

I did notice that ieframe.dll was being accessed several times and some further debugging revealed that a dll in the application directory was loaded (psapi.dll). This is strange because psapi.dll resided in the windows\system32 folder normally. Also the copy in the application directory was an old version (4.0.1371.1).

Patch Windows 2008 Terminal Server to allow more than 2 concurrent sessions

Tue, 21 Oct 2008 13:56:23 +0000

Well it took some time but I patched Terminal Server for Windows 2008 to allow unlimited sessions in Remote Administration mode.

This patch is for 32 bit English version. In order to install it you need to perform the steps below. Before you start please check if using this patch is allowed according to your country’s law and your license agreement.

Prevent rename or removal of the My Documents icon on the desktop

Tue, 02 Sep 2008 09:27:23 +0000

EDIT: Please read the Desktop Icons, hide, show, prevent rename or delete article, it may be a better solution!

One of my customers recently asked if it was possible to preven the user from renaming or deleting the My Documents icon on the desktop.

If you know that deleting the icon from the desktop doesn’t really delete the My Documents folder from disk but just hides the icon then it’s obvious that it must be some kind of registry setting.

So I fired up Process Monitor from Sysinternals and deleted the icon. This showed that after deleting the icon changed registry keys at the following location:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu\

Applications tab in taskmanager is empty #2

Tue, 02 Sep 2008 09:05:25 +0000

As a followup to the previous article:

It might be better to just Exclude taskmanager because settings the Flag value to 0 might disable multi monitor support. To do this Create a new REG_SZ (string) under HKEY_LOCAL_MACHINE\Software\Citrix\CtxHook\AppInit_Dlls\Multiple Monitor Hook and name it Exclude. It's value should be taskmgr.exe (case sensitive!).

Applications tab in taskmanager is empty

Mon, 01 Sep 2008 16:46:21 +0000

Today I noticed something strange: on a Citrix (Presentation Server 4.5) server taskmanager does not show anything in the applications tab.

I tested this on the other Citrix Servers in the farm and they all had the same problem (and non Citrix servers did not). As you might know taskmanager fills the applications tab by enumerating all top level windows. That's why I suspected Citrix because it places several hooks (multi monitor support, speedscreen etc.).

Patch Windows 2003 Terminal Server to allow more than 2 concurrent sessions

Sun, 31 Aug 2008 07:19:48 +0000

As you might know Windows 2003 Server accepts at most 2 concurrent Terminal Server sessions (and 1 console session) in Remote Administration mode (which is the default). Of course if you switch to Application Mode you can have an unlimited number of sessions but this requires licenses and a license server.

When Terminal Server creates a new session it checks if the new session is either a console session or a help assistant session and if not it allocates a license. The function that performs this check is called CRAPolicy::Logon

Remko's download's

Wed, 20 Aug 2008 10:56:04 +0000

ProfMan.zip

Registry editing has been disabled by your administrator (not anymore!)

Tue, 12 Aug 2008 23:09:32 +0000

Most administrator will want to prevent normal users from opening Regedit and a command prompt. Usually this is done by activating the “Prevent access to registry editing tools” and “Prevent access to the command prompt” policy settings. They are located under User Configuration | Administrative Templates | System:

Activating the policies will set the matching keys in the registry:

If we try to open regedit we are denied access:

So how does this work?

Unattended Citrix Installation: Could not Access the datastore using the DSN file

Mon, 23 Jun 2008 22:11:21 +0000

I was working on an unattended installation of Citrix Presentation Server 4.5 or rather Citrix Xenapp. I was creating the dsn file for the installation by a script that uses the echo command and output this to a file.

This is a part of the script:

Resuming Microsoft's (Akami) Download Manager

Sun, 22 Jun 2008 08:51:09 +0000

If you ever download software from Microsoft's Volume Licensing Site you have probably seen that it uses the Akamai download manager. Sometimes your downloads get interrupted but how to restart the downloadmanager? There's no entry in the startmenu and not even an icon on the desktop.

Configuring IBM Raid controller with Altiris

Tue, 17 Jun 2008 21:41:58 +0000

Today I was deploying some IBM x3550 and x3650 servers with Altiris Deployment Server. IBM Delivers a toolkit for Altiris that contains amongst others jobs for configuring raid arrays.

To do this you need to create a raid policy file and deploy this. I created this policy file:

[Policy.RAID-1]
AppliesTo.1 = t:ServeRAID-8k-l,d:4

Array_Mode = CUSTOM
Array.A = 1,2
Array.B = 3,4

Logical_Mode = CUSTOM
Logical.1 = A:FILL:1
Logical.2 = B:FILL:1

As you can see the policy only applies to the type of array controller in my servers (t:ServeRAID-8k-l). This way we prevent applying the policy to other configurarions. I have a 4 disk configuration (d:4) and want to create to RAID 1 arrays (A & B). On each array one Logical drive with the maximum size (FILL parameter).

Multiple Concurrent Terminal Server Sessions On Vista SP1

Sat, 14 Jun 2008 23:35:44 +0000

There are several patched terminal server dll’s floating around in the net to allow multiple concurrent Terminal Server session on Windows Vista with Service Pack 1. But they all have the same limitations:

It’s not possible to start a session to Localhost, this is because the Terminal Server client does a check to see if you are running Personal Terminal Server (Vista/XP) and denies Localhost or 127.0.0.1 if true (127.0.0.2 works though).

Terminal Server Ping Tool

Fri, 13 Jun 2008 13:34:46 +0000

A while ago I included a new undocumented API into my JwaWinsta unit which is called WinStationServerPing. This API “pings” a Terminal or Citrix server and verifies that Terminal Server is up and running. It is not the same as a regular networking ping! This API actually makes a connection to a (remote) Terminal Server and verifies that Terminal Server runs and accepts connections.

I wrote a small cmdline tool that uses this API to ping a Terminal Server which can be used to quickly determine if a Terminal Server is up and running. I named it WTSPing.

So how does it work? Open up a command prompt (Start -> Run -> cmd) and type WTSPing /? to see the help:

Script to logoff all Terminal Server sessions

Mon, 09 Jun 2008 13:48:50 +0000

I needed a script to logoff all running Terminal Server sessions in order to rollout an install package. As you might know there is a commandline tool to logoff a session, it’s called logoff.exe.

These are the commandline options:

LOGOFF [sessionname | sessionid] [/SERVER:servername] [/V]

Encrypting RDP Passwords in VB.NET

Fri, 02 May 2008 08:53:13 +0000

Justin Shepard converted my code to encrypt RPD passwords to VB.NET:

vbnet Download

'======SOF Imports System Imports System.Text Imports System.Runtime.InteropServices Imports System.ComponentModel Imports Microsoft.VisualBasic Public Module RdpEncrypt Public Class DPAPI <dllimport> _ Private Shared Function CryptProtectData( _ ByRef pPlainText As DATA_BLOB, _ ByVal szDescription As String, _ ByRef pEntropy As DATA_BLOB, _ ByVal pReserved As IntPtr, _ ByRef pPrompt As CRYPTPROTECT_PROMPTSTRUCT, _ ByVal dwFlags As Integer, _ ByRef pCipherText As DATA_BLOB _ ) As Boolean End Function <dllimport> _ Private Shared Function CryptUnprotectData( _ ByRef pCipherText As DATA_BLOB, _ ByRef pszDescription As String, _ ByRef pEntropy As DATA_BLOB, _ ByVal pReserved As IntPtr, _ ByRef pPrompt As CRYPTPROTECT_PROMPTSTRUCT, _ ByVal dwFlags As Integer, _ ByRef pPlainText As DATA_BLOB _ ) As Boolean End Function <structlayout> _ Friend Structure DATA_BLOB Public cbData As Integer Public pbData As IntPtr End Structure <structlayout> _ Friend Structure CRYPTPROTECT_PROMPTSTRUCT Public cbSize As Integer Public dwPromptFlags As Integer Public hwndApp As IntPtr Public szPrompt As String End Structure Private Const CRYPTPROTECT_UI_FORBIDDEN As Integer = 1 Private Const CRYPTPROTECT_LOCAL_MACHINE As Integer = 4 Private Shared Sub InitPrompt _ ( _ ByRef ps As CRYPTPROTECT_PROMPTSTRUCT _ ) ps.cbSize = Marshal.SizeOf(GetType(CRYPTPROTECT_PROMPTSTRUCT)) ps.dwPromptFlags = 0 ps.hwndApp = IntPtr.Zero ps.szPrompt = Nothing End Sub Private Shared Sub InitBLOB _ ( _ ByVal data As Byte(), _ ByRef blob As DATA_BLOB _ ) ' Use empty array for null parameter. If data Is Nothing Then data = New Byte(0) {} End If ' Allocate memory for the BLOB data. blob.pbData = Marshal.AllocHGlobal(data.Length) ' Make sure that memory allocation was successful. If blob.pbData.Equals(IntPtr.Zero) Then Throw New Exception( _ "Unable to allocate data buffer for BLOB structure.") End If ' Specify number of bytes in the BLOB. blob.cbData = data.Length Marshal.Copy(data, 0, blob.pbData, data.Length) End Sub Public Enum KeyType UserKey = 1 MachineKey End Enum Private Shared defaultKeyType As KeyType = KeyType.UserKey Public Shared Function Encrypt _ ( _ ByVal keyType As KeyType, _ ByVal plainText As String, _ ByVal entropy As String, _ ByVal description As String _ ) As String If plainText Is Nothing Then plainText = String.Empty End If If entropy Is Nothing Then entropy = String.Empty End If Dim result As Byte() Dim encrypted As String = "" Dim i As Integer result = Encrypt(keyType, _ Encoding.Unicode.GetBytes(plainText), _ Encoding.Unicode.GetBytes(entropy), _ description) For i = 0 To result.Length - 1 encrypted = encrypted & Convert.ToString(result(i), 16).PadLeft(2, "0").ToUpper() Next Return encrypted.ToString() End Function Public Shared Function Encrypt _ ( _ ByVal keyType As KeyType, _ ByVal plainTextBytes As Byte(), _ ByVal entropyBytes As Byte(), _ ByVal description As String _ ) As Byte() If plainTextBytes Is Nothing Then plainTextBytes = New Byte(0) {} End If If entropyBytes Is Nothing Then entropyBytes = New Byte(0) {} End If If description Is Nothing Then description = String.Empty End If Dim plainTextBlob As DATA_BLOB = New DATA_BLOB Dim cipherTextBlob As DATA_BLOB = New DATA_BLOB Dim entropyBlob As DATA_BLOB = New DATA_BLOB Dim prompt As _ CRYPTPROTECT_PROMPTSTRUCT = New CRYPTPROTECT_PROMPTSTRUCT InitPrompt(prompt) Try Try InitBLOB(plainTextBytes, plainTextBlob) Catch ex As Exception Throw New Exception("Cannot initialize plaintext BLOB.", ex) End Try Try InitBLOB(entropyBytes, entropyBlob) Catch ex As Exception Throw New Exception("Cannot initialize entropy BLOB.", ex) End Try Dim flags As Integer = CRYPTPROTECT_UI_FORBIDDEN If keyType = keyType.MachineKey Then flags = flags Or (CRYPTPROTECT_LOCAL_MACHINE) End If Dim success As Boolean = CryptProtectData( _ plainTextBlob, _ description, _ entropyBlob, _ IntPtr.Zero, _ prompt, _ flags, _ cipherTextBlob) If Not success Then Dim errCode As Integer = Marshal.GetLastWin32Error() Throw New Exception("CryptProtectData failed.", _ New Win32Exception(errCode)) End If Dim cipherTextBytes(cipherTextBlob.cbData) As Byte Marshal.Copy(cipherTextBlob.pbData, cipherTextBytes, 0, _ cipherTextBlob.cbData) Return cipherTextBytes Catch ex As Exception Throw New Exception("DPAPI was unable to encrypt data.", ex) Finally If Not (plainTextBlob.pbData.Equals(IntPtr.Zero)) Then Marshal.FreeHGlobal(plainTextBlob.pbData) End If If Not (cipherTextBlob.pbData.Equals(IntPtr.Zero)) Then Marshal.FreeHGlobal(cipherTextBlob.pbData) End If If Not (entropyBlob.pbData.Equals(IntPtr.Zero)) Then Marshal.FreeHGlobal(entropyBlob.pbData) End If End Try End Function End Class Sub Main(ByVal args As String()) Try Dim text As String = args(0) Dim encrypted As String encrypted = DPAPI.Encrypt(DPAPI.KeyType.MachineKey, text, Nothing, "psw") Console.WriteLine("{0}" & Chr(13) & Chr(10), encrypted) Catch ex As Exception While Not (ex Is Nothing) Console.WriteLine(ex.Message) ex = ex.InnerException End While End Try End Sub End Module '======EOF

2 Comments

James Jul 5, 2010
Hi friends, anyone know where I can find the code to decrypt in vb.net? Thanks for your help

Working with bitfields in Delphi

Thu, 01 May 2008 23:06:00 +0000

Recently I needed to convert a C header file to Delphi which contained bitfields. Let’s take a look at a sample structure that contains bitfields:

cpp Download

typedef struct _BITFIELDSTRUCTURE { DWORD dwValue1; ULONG BitValue1: 1; ULONG BitValue2: 1; ULONG BitValue3: 1; ULONG BitValue4: 1; } BITFIELDSTRUCTURE, * BITFIELDSTRUCTURE;

It means that there is a DWORD (Cardinal) dwValue1 followed by a bitfield with the size of a ULONG (32 bits). In this bitfield 4 values are defined (BitValue1..4) which are used as boolean’s because the value can offcourse be 0 or 1. Since Delphi doesn’t know a bitfield type the question is how to translate it. Usually it would mean that we simply treat the whole bitfield value as a ULONG and extract the required properties by applying a bitmask (shl/shr). Starting from BDS2006 we can define a record with propertes and use getters and setters. Using this technique we can present boolean values to the user:

Using Windows Server 2008 as a SUPER workstation OS

Sun, 06 Apr 2008 23:35:48 +0000

Vijayshinva Karnure wrote a very cool article about running Server 2008 as a desktop os or rather as a Windows Vista replacement. It seems that besides additional features like Hyper-V, Server 2008 runs approx. 20% faster than Vista.

If only upgrading Vista to Server 2008 would be possible… (has anyone ever tried)?

How to deactivate Internet Explorer Enhanced Security Configuration in Windows Server 2008?

Fri, 04 Apr 2008 15:44:33 +0000

Open Server Manager and in the Security Information tab click Configure IE ESC. An improvement in Server 2008 is that you can disable it for Administators but enable it for Normal Users, this is nice for Terminal Server and Citrix environments.

How to install Powershell in Server 2008?

Fri, 04 Apr 2008 15:40:02 +0000

Even though Powershell is included with Windows Server 2008 it’s not installed by default. You can do this in Server Manager by going to Features and then Click Add Features in the Tasks bar on the right. Select Windows Powershell in the list and there you go!

Microsoft Remote Server Administration Tools released

Wed, 26 Mar 2008 20:59:20 +0000

Microsoft has releaseed the Remote Server Administration Tools (RSAT) for Vista SP1. RSAT enables IT administrators to remotely manage roles and features in Windows Server 2008 from a computer running Windows Vista with SP1. It includes support for remote management of computers running either a Server Core installation or the full installation option of Windows Server 2008. It provides similar functionality to Windows Server 2003 Administration Tools Pack.

New home for Jedi Apilib and Jedi Security Library

Mon, 03 Mar 2008 15:38:34 +0000

A new website (blog) was opened for the Jedi Apilib and Jedi Security Library. I invite you all to take a look!

You can find it here

How rdp passwords are encrypted 2

Sun, 02 Mar 2008 23:28:57 +0000

Several months ago I wrote about encrypting and decrypting RDP passwords. I left one thing open: encrypting the password up to the full 1329 bytes as mstsc does.

Many people were curious about it so I hope the answer is not a disappointment because it’s actually really simple (but I took me a while to figure that out nonetheless). In what I figure is an attempt to hide the password length mstsc always fills up the password with zeroes until it has 512 bytes length.

Vista SP1 changes to Terminal Server API

Sun, 02 Mar 2008 15:31:55 +0000

In a previous article I wrote about changes in utildll in vista that breaked compatibality for Terminal Server. Even though release notes for Service Pack 1 don’t indicate changes or fixes in this area my testing shows that Microsoft has taken over the Windows 2008 implementation of utildll to Vista.

Supporting for in loop in TObjectList descendants

Sun, 02 Mar 2008 15:08:19 +0000

For my Terminal Server unit in the Jedi Security library I use 2 TObjectList descendants to hold a list of Terminal Server Sessions and Processes. Consider the sample below which connects to a server and enumerates all sessions:

objectpascal Download

var ATerminalServer: TJwTerminalServer; i: Integer; begin ATerminalServer := TjwTerminalServer.Create; ATerminalServer.Server := 'TS001'; try if ATerminalServer.EnumerateSessions then begin // Now loop through the list for i := 0 to ATerminalServer.Sessions.Count - 1 do begin Memo1.Lines.Add(ATerminalServer.Sessions[i].Username); end; end; except on E: EJwsclWinCallFailedException do begin // Handle Exception here end; end; // Free Memory ATerminalServer.Free; end;

In the sample I loop through the sessions with a for loop. Even though Delphi supports the for in loop since Delphi 2005 it's not possible to use this in TObjectList descendants, so we cannot use this:

objectpascal Download

// Now loop through the list for Session in ATerminalServer.SessionList do begin Memo1.Lines.Add(Session.Username); end;

To make this possible we need to implement GetEnumerator and an Enumerator class:

objectpascal Download

TJwSessionsEnumerator = class private FIndex: Integer; FSessions: TJwWTSSessionList; public constructor Create(ASessionList: TJwWTSSessionList); function GetCurrent: TJwWTSSession; function MoveNext: Boolean; property Current: TJwWTSSession read GetCurrent; end; constructor TJwSessionsEnumerator.Create(ASessionList: TJwWTSSessionList); begin inherited Create; FIndex := -1; FSessions := ASessionList; end; function TJwSessionsEnumerator.GetCurrent; begin Result := FSessions[FIndex]; end; function TJwSessionsEnumerator.MoveNext: Boolean; begin Result := FIndex < FSessions.Count - 1; if Result then Inc(FIndex); end;

Now we add a function with the name GetEnumerator in the SessionList class:

objectpascal Download

function TJwWTSSessionList.GetEnumerator: TJwSessionsEnumerator; begin Result := TJwSessionsEnumerator.Create(Self); end;

And that's really all!

1 Comments

  Remko shows us how to use the Terminal Server feature of JWSCL by JEDI Windows API Mar 3, 2008
[...] Go and learn more about it here. [...]

TSAdminEx Progress

Sun, 27 Jan 2008 23:04:07 +0000

I just wanted to show some of the progress that I made in development of TSAdminEx. I thought the best way would be to show some screenshots. Which reminds me I installed a nice Javascript to enlarge the thumbnails, click to see it…

Softpedia

Fri, 25 Jan 2008 20:22:25 +0000

Today I received an e-mail from Softpedia telling me that they have listed one of my commandline tools, LaunchRDP. I don’t know how they found or why they think that it should be listed, but it’s nice to see that they respect the author and informed me. If you want to rate it, here’s your chance!

Using WTSWaitSystemEvent

Fri, 25 Jan 2008 18:02:13 +0000

If you develop an application for Terminal Server you might want to react on session events. This means that your application is notified when a user logs on, logs off or becomes idle. This can be done with the WTSWaitSystemEvent function. Implementing it is rather simple and could look something like this:

Why TSAdmin crashes on Windows Vista

Wed, 19 Dec 2007 21:38:39 +0000

Have you ever tried running the Terminal Server Administration tool (aka TSAdmin) on Windows Vista? You would need it to remotely administer windows 2000/2003 Terminal Servers. If you try to run it you will get an Access Violation but why? I found the answer to this question today because I was testing my TSAdmin replacement on different Windows versions. Just like TSAdmin I use an (undocumented) function from Utildll.dll called ElapsedTimeString. It’s a very simple function that returns a formatted elapsed time string (as seen in the Idle time column from TSAdmin).

Undocumented API's from Utildll

Sun, 09 Dec 2007 11:05:04 +0000

Several of Microsoft’s Terminal Server tools use undocumented API’s from Utildll.dll. For instance Terminal Server Admin uses it to get a localised connect state string and to format time strings like idle time, logon time etc.

Functions below seems to be the most usefull ones, I will add those to the JwaWinsta unit:

IDA 4.9 released as freeware

Sun, 09 Dec 2007 10:49:16 +0000

Datarescue has release IDA 4.9 as freeware. IDA Pro is the de-facto standard for the analysis of hostile code, vulnerability research and reverse engineering in general. You can find IDA freeware here: http://www.datarescue.com/idabase/idadownfreeware.htm

1 Comments

Remko Dec 19, 2007
Assarbad has setup a mirror to the freeware version of IDA on the idapalace site. You can find it here: http://old.idapalace.net/news.html

Delphi and Terminal Server Aware

Sat, 24 Nov 2007 23:21:37 +0000

When an application is not Terminal Server aware (also known as a legacy application), Terminal Server makes certain modifications to the legacy application to make it work properly in a multiuser environment. For example, Terminal Server will create a virtual Windows folder, such that each user gets a Windows folder instead of getting the system’s Windows directory. This gives users access to their own INI files. In addition, Terminal Server makes some adjustments to the registry for a legacy application. These modifications slow the loading of the legacy application on Terminal Server and require up to 8 MegaBytes extra memory. This behaviour can be avoided if the TSAware flag is present in the PE header of an executable as can be read here at MSDN.

Even more undocumented Terminal Server API's uncovered

Wed, 21 Nov 2007 18:18:37 +0000

I was contact by Danila Galimov a while ago because he was working with my JwaWinsta unit. Together we were able (and are still working on) uncovering more of the undocumented API’s in winsta.dll.

We found several new classes for WinStationQueryInformationW that return lots of information:

Multiple Terminal Sessions in Windows Vista

Wed, 21 Nov 2007 18:09:47 +0000

There were 2 ways (known to me) of extending Windows XP to offer mulitple concurrent Terminal Sessions. One with the RC1 version of XP SP2 and one that patches Winlogon and Termsrv.dll. The latter offers not only multiple sessions but also multiple sessions under the same account and sessions to the local machine.

More undocumented Terminal Server API's

Fri, 09 Nov 2007 22:42:58 +0000

I added some more undocumented API’s to my Jwawinsta unit, the unit is now becoming a collection of the undocumented API’s in winsta.dll.

These are the functions I added:

WinStationDisconnect

WinStationGetProcessSid

CachedGetUserFromSid (exported by utildll.dll)

I also added some more parts of the undocumented structure returned by WinStationQueryInformationW, it now contains:

Session State

WinStationName

SessionId

ConnectTime

DisconnectTime

LastInputTime

LogonTime

OutgoingFrames

OutgoingBytes

OutgoingCompressedBytes

IncomingCompressedBytes

IncomingFrames

IncomingBytes

Domain

Username

CurrentTime

2 Comments

Chris Dec 3, 2007
I would like know how it is possible to access WindowStation and Desktops from a service.
CreateDesktop and similar only works for the current session of the process.
I know there exists NTQueryObject and similar but they are hard to understand and only query kernel objects.
However creating a desktop from a service into another session is a mystery.

Terminal Server Client annoyances

Fri, 09 Nov 2007 21:39:50 +0000

If you want to get rid of this message:

Remote Desktop cannot verify the identity of the computer you want to connect to. This problem can occur if:

The remote computer is running a version of Windows that is earlier than Windows Vista.

The remote computer is configured to support only the RDP security layer.

Contact your network administrator or the owner of the remote computer for assistance.

Citrix Solutions Conference 2007

Thu, 08 Nov 2007 15:01:24 +0000

Yesterday I attended the Citrix Solutions Conference in Antwerp. Brad Pedersen (Chief Architect and Senior Fellow at Citrix Systems) held an interesting speech about The End User Experience. I liked especially liked the part about the history of Citrix and the early versions of their products like Wincredible and Winframe. Since Brad wrote the original code for Citrix and thus Terminal Server (the stuff that is in winsta.dll now) I hoped he could share some info with me on the undiscovered parts of winsta.dll. Unfortunately Brad could not do this because of a non disclosure agreement with Microsoft. He did tell me that Citrix is pushing Microsoft to make more Terminal Server API’s public. I presume that’s why Vista and Windows 2008 offer some new API’s which I wrote about earlier.

How to launch a process in a Terminal Session #2

Thu, 08 Nov 2007 13:48:18 +0000

A little while ago I wrote an article on launching a process in another Terminal Session (/2007/10/20/how-to-launch-a-process-in-a-terminal-session/).

The article didn’t have a demo app yet so I’ve attached it here.

JEDI Apilib and JEDI Windows Security Code Library

Thu, 08 Nov 2007 12:35:32 +0000

It has been a little silent on the JEDI Apilib project lately, but this will change!

We had some change in the team members: Marcel van Brakel, founder and large contributor of the project has signed off because he no longer actively uses Delphi. Christian Wimmer has joined the team and he is a very promising member.

Christian has been working on a new include model (optional) of the Jedi Apilib which has the advantage that you only need to use one unit (JwaWindows) for the whole library.

Chris has also published the JEDI Windows Security Code Library (Jwscl). This is library that tremendously simplifies using Win32 API calls from Delphi. At this point the library contains:

Windows Version

Token

Impersonation

Login

SID

Access Control List

Security Descriptor

Owner, Group, DACL, SACL

WindowStation

Desktop

LSA

Rights mapping

Secured Objects Files, Registry (+Inheritance), etc.

Credentials (Login Dialog)

Encryption (MS Crypto API)

Well Known SIDs

Privileges

Security Dialogs (The "ACL Editor" you see on the security yab when you rightclick object in Explorer)

Terminal Sessions

Unicode + Ansicode

Vista Elevation

Vista Integrity Level

Although Jwscl is in beta stage it is already very well useable.

Encrypt RDP password in Python

Mon, 05 Nov 2007 23:10:29 +0000

Dirk Schmitz send me his Python version of encrypting the RDP Password:

python Download

import win32crypt import binascii pwdHash = win32crypt.CryptProtectData(u"MYPASSWORD",u'psw',None,None,None,0) print binascii.hexlify(pwdHash)

Read the original article here: /2007/10/18/how-rdp-passwords-are-encrypted/

5 Comments

Arvid Requate Nov 14, 2010
Thank's, this really worked well, after a bit of fiddling (donation will be given asap). For Python 2.7 I had to remove the unicode conversion, otherwise the RDP server would not get the proper password. Interestingly your updated post about 512-byte padding and appending a '0'-character to obtain a 1329 'password 51'-hash did not work for me yet. Did you need the padding as a bugfix or did you suggest it merely as an imrovement to become fully compatible to the MS encoding format? (/2008/03/02/how-rdp-passwords-are-encrypted-2/).

Post Views

Fri, 02 Nov 2007 21:18:28 +0000

I was curious how many times my posts are viewed. So I installed this plugin which was made by Lester ‘GaMerZ’ Chan. If you use Wordpress take a look at his other plugins, there are some good ones there!

Query Active Directory from Excel

Thu, 01 Nov 2007 18:23:55 +0000

I had to lookup some users in Active Directory today which I received by mail. Offcourse I got full users name while I needed either samAccountName or full adsPath. Usually I write a small VBS script to do the lookup and paste this in Excel for further processing. But today I decided that an Excel function to do the lookup would be nice. So I wrote it.

The function is called GetAdsProp and allows you to search on a specific AD field in the whole AD tree and return the value of another field.

Dear Visitor

Thu, 01 Nov 2007 16:19:05 +0000

If this is your first visit, take your time and look around. Here are some things you might be looking for:

SasLibEx: a library that can simulate the Secure Attention Sequence (Ctrl-Alt-Del) but it can even unlock a workstation or session without entering or needing the user's credentials (and many more things).

Who locks my file?

Patch 32 bit Windows to use the full 4 GB (and even more) memory

Patch Terminal Server to allow more Concurrent Sessions: 2003, Windows XP X64, 2003 X64, 2008, Vista

Some of my freeware tools such as LaunchRDP, RDP Password Encryption, Active Directory Excel Addin, RDP Clipboard Fix (well this list can go on and on, see also the Downloads section).

Do you like my work? Did my work help you?

Leave a comment and tell me how it was usefull to you.

If you want you can make a donation with the Paypal Donate Button in the right Sidebar.

Thank you!

Google adds IMAP support to GMail

Thu, 01 Nov 2007 15:53:58 +0000

Google has added imap support to GMail. This means you can use an e-mail client like Outlook (Express) to read your mail but you don’t have to download and store them locally. Read more here. The Storage Limit has been raised to 4 GB (at time of writing 4569 MB)

How to get Client IP Address?

Wed, 31 Oct 2007 11:10:10 +0000

When a client is connected to a Terminal Server Session you can use the Terminal Server API to retrieve the client’s local IP address.

Start by enumerating all sessions with WtsEnumerateSessions and then for each session get the ClientAddress with a call to WTSQuerySessionInformation with the WTSClientAddress parameter. Sound simple, no?

WTSQuerySessionInformation returns a pointer to a WTS_CLIENT_ADDRESS structure. You need to know that the IP address is located at on offset of 2 bytes in the Address member of WTS_CLIENT_ADDRESS.

So here’s a sample:

New Terminal Server API's in Vista SP1

Tue, 30 Oct 2007 22:19:25 +0000

The upcoming Vista SP1 promises 3 new Terminal Server API functions:

WTSConnectSession : Connects a Terminal Services session to an existing session on the local computer.

WTSStartRemoteControlSession: Starts the remote control of another Terminal Services session.

WTSStopRemoteControlSession : Stops a remote control session.

If you look in the Windows 2008 beta you can see that the functions are already implemented (in WtsApi32.dll):

Script to clear SQL Transactions logs

Sun, 28 Oct 2007 13:11:15 +0000

Script to clear SQL Transactions Logs

Did you know that when you backup a SQL database with Backup Exec (with the SQL Agent) the transaction log is not cleared? This means that if you use the full recovery model your transaction log keeps growing and growing. I tested this with Backup Exec v11D and you can only create a seperate scheduled job to backup the transactions logs but not one to just clear it or truncate it after successfull backup.

Therefore I made a VBS script that clears SQL transactions logs, an option would be to schedule this as a post backup job.

This is the script:

RDP Clipboard Fix

Thu, 25 Oct 2007 17:45:57 +0000

Did you ever loose Clipboard functionality (copy/paste) while working with several Terminal Server sessions? I think everyone that works a lot with Terminal Server has experienced this from time to time.

It’s caused by badly behaving applications. Dimitry Vostokov wrote a tool to fix this issue for Citrix (RepairCBDChain.exe), he explains the issue very well on his blog:

Windows has a mechanism to notify applications about clipboard changes. An application interested in such notifications has to register itself in the so called clipboard chain. Windows inserts it on top of that chain and that application is responsible to propagate changes down the chain:

If 3rd-party application forgets to forward notifications down then we have a broken clipboard chain and clipboard changes are not sent via ICA protocol:

Read more at Dimitry’s Blog: http://citrite.org/blogs/dmitryv/2006/12/09/clipboard-issues-explained/

So how can we fix this for Terminal Server then?

TSAdminEx

Tue, 23 Oct 2007 19:48:50 +0000

You will probably know Microsofts Tool to Manage Terminal Server, it’s called Terminal Services Manager (you will probably know it as TSAdmin). It can be used to view information about terminal servers including all sessions, users, and processes for each terminal server.

I’m currently working on a TSAdmin replacement (codename TSAdminEx). Purpose is to show how to use the Terminal Server API’s and as a little bonus we will add some extra functionality to TSAdminEx.

How to launch a process in a Terminal Session

Sat, 20 Oct 2007 22:45:24 +0000

This is an often asked question but the solution is simple:

So how does it work?
First we obtain the user’s primary access token with the WtsQueryUserToken API call. To call this function successfully, the calling application must be running within the context of the LocalSystem account and have the SE_TCB_NAME privilege (LocalSystem has this privilege by default). Since the function returns a primary acces token we can just pass this to CreateProcessAsUser and voila!

A referral was returned from the server

Fri, 19 Oct 2007 15:58:48 +0000

Ever tried to run a VBS scripts that queries Active Directory in another domain or from a workstation that is not a domain member? Than you have probably seen this error before:

This is because the default settings for Chasing referrals is set to ADS_CHASE_REFERRALS_NEVER.

How rdp passwords are encrypted

Thu, 18 Oct 2007 21:23:17 +0000

Ever wondered how mstsc saves passwords? If you open an RDP file with a text editor like Notepad you can see the encrypted password. In this article I will show you how to encrypt and decrypt these passwords. Besides password recovery this enables you to create rpd files programmatically or perhaps update the password in many rdp files with a batch file.

Launch RDP from commandline

Wed, 17 Oct 2007 22:47:53 +0000

A little while ago I wrote a little commandline tool that starts an RDP connection (with mstsc.exe) because mstsc doesn’t allow you to use the login credentials (username, password) as commandline arguments.

Arguments are:

Servername (string)

Port (integer, usually 3389)

Username (string)

Domain (string)

Password (string)

Console (integer, specify 0 for false and 1 for true)

RedirectDrives (integer, specify 0 for false and 1 for true)

RedirectPrinters (integer, specify 0 for false and 1 for true)

Atheros AR5007EG - Bad WLAN performance

Tue, 16 Oct 2007 17:55:54 +0000

A friend bought a new Toshiba Satellite L40 laptop which came with Windows Vista preinstalled. The wireless connection (via the built in Atheros AR5007EG card) was very unstable and sometimes unable to connect to the access point. When connected internet speed was very slow, sometimes unable to open pages at all. First we tried replacing the preinstalled Toshiba drivers with the latest from the Toshiba site and later on the most recent from Atheros (which can be found here). Both drivers didn’t improve the speed.
Solution:

About

Mon, 01 Jan 0001 00:00:00 +0000

I’m an Innovation Engineer at Cloudhouse Labs, where I work on early product ideas, prototypes and technical experiments before they become formal engineering projects. My role sits close to product: exploring what might be useful, building enough to prove or disprove an idea, and helping turn future product direction into something people can actually see, test and discuss.

Archives

Mon, 01 Jan 0001 00:00:00 +0000

Search

Mon, 01 Jan 0001 00:00:00 +0000