Are UAC related problems permission related or security related?

This is effectively the debate going on in my virtual classroom right now. One of the questions in Assessment 3-1 triggered the debate, as two of my students didn't choose UAC as a possible cause of a security related issue and two did.
The one side is arguing based on the material in the book. Several questions are expecting a textbook answer and UAC is explicity referred to in a paragraph above the security related issues and not under the security related heading.

This is the way I see it:
UAC is based on controlling access to ressources based on which privileges a user has at the time of executing a program. with UAC on, that would be the least priviliges required to run an applicaiton. Priviliges mean effectively permissions on files, settings and folders.
When we talk about security we usually differentiate between physical security, securing access to the data and securing the information itself.

• We put our servers into locked rooms to secure the physical aspect
• We put firewalls and passwords in place to secure access to the data
• We put encryption in place to secure the information itself contained in the data.

Where does UAC belong? in the middle section. Securing access to data. By requesting elevated permissions or even an username and password to continue executing a piece of code or accessing a certain file or setting, we have another layer of access security in place to protect our systems.
Thus when anybody asks me if UAC could be a possible cause for security related installation or execution problems I'd go for "yeah, sure it is. look there first!"

Be sure to mention to your students that the paragraph in Module 3-1 headed "Security-Related Problems" should reall be labelled "Other Security-Related Problems" to avoid this discussion :-)

5118 AL Module 3-1 Demonstration

Something I noticed today and want to share with fellow MCTs.
In Module 3-1 there is a flash based demo showing how to use the compatibility settings wizard through control panel.
The steps are really simple and you should demonstrate this directly on the vpc instead.

The reason I say that is twofold.

1. one of my students actually had a problem loading the demonstration and missed out on it, which forced me to give everybody a quick run down anyway.
2. you can easily answer questions using the vpc directly and show alternate paths. For example show the students that right clicking a exe file and changing the compatibility settings there will also allow you to troubleshoot that particular application.

Scenario IE7 Problem

One of my Students had problems getting the toolwire scenarios to run. The whole intro would work but when it came to the lab it simply would not load.
The labs use a vpc activeX control which in his case did not run under the custom security settings he had in IE7. After adding the site to the Trusted Sites Zone AND resetting the trusted sites settings to its defaul level of medium, the lab excercicse loaded correctly.

Just a tip if you come across this particular problem with your students in future

5118AL Teaching Tips

Over the next few Posts I will share with you all my experiences from teaching 5118 using MODL and Livemeeting.
Today I'll start with some general tips on organising the material

1. Add page refrerences to the instructor manual & Slides
   
   The page numbering in the instructor manual does not match the student workbook. That makes it really hard to point things out to students in the book. I found it really useful to create references in my instructor manual and on the slides to the individual pages in the student course book so I could direct them to the correct pages without having both books open all the time. Directing the students is an important task during the session to encourage them to write into the book.
   
   
2. Add Headings to the whiteboard pages
   
   to instruct the students about the task at hand. Using the slide name can be sufficient in most cases. That really helps the student remember what they are supposed to be doing right now.
   
   
3. Create real world demonstrations
   
   Create a copy of one of the vista vpc images and bust it by killing the bcd config or deleting winload. That will show nicely how a startup failure looks like. and allows you to fix it in the demonstration. How to bust it? start the vpc using either a Vista DVD and enter Recovery Environment or make your own WinRE PE iso file. Before busting it, activate System Restore and create a manual restore point. You can use that in one of the demonstrations too! Much bettern than "ahhm, and now you would see XYZ". This image cna now be fixed using the console, the startup-repair or the system restore tool in RE.
   
   
4. Upload flash animations and web pages to web server
   
   Normally I'd upload the flash animations for the course directly to the livemeeting session. But with 5118 the flash files don't work by themselves and only work in a web page. Thus I uploaded them to our webserver and made them available via a Web Page in livemeeting. As each student can control the media individually this way I asked them all to change their colour to green once they had finished viewing the content. That worked like a charm.
   
   
5. Upload flash games to the web server
   
   uploading all flash media to a web server instead of to the livemeeting session directly also allowed each student to try out the sorting game themselves. and that was definately more fun than writing down the answers in the book or aksing them to start the game from the student cd.
   
   
6. Check the assessment forms before you send them out!
   
   Most of them have Polarbear's Logo on the Feedback worksheet and I assume you might want to exchange that with your company logo. Also fix up the references on the feedback sheet. Two cells (E14 anf G17) are not referring to the answer sheet but have fixed values instead.

5105 Bootable USB Disk

In courses 5119 and 5105 they keep on talking about the different ways of deploying Vista images. Either by DVD or by Network share or by USB.
Taking into respect that your images will be several GB big, even in compressed state, USB sounds like a good alternative when using unswitched networks or slow 10/100 MB ones.

If you're not using PXE and SMS to push out the images you will need a version of Windows PE to help along the way. Now I'm a minimalist and hate having a CD with PE and a USB disk with my image. Why not have it both on the usb and boot from it directly?
Before you embark on that journey keep in mind that not all computers boot from USB! So make sure your environment is going to support your new deployment mechanism! Otherwise many hours will be going down the drain as your great and fancy bootable drive will never get used!

Before you go around all the forums and create a bootable usb disk with HP tools and windows 98 remember that you have the power of Vista at your finger tips. Well, should have! The new version of DiskPart that comes with the AIK detects usb flash disks and usb hard disks as if they were fixed disks. Thus you can clean them, repartition them, set them to active and format them with your desired FileSystem (NTFS). Once prepped all you need to do is copy the contents of your favourite WinPE ISO or WinRE ISO (see post from yesterday) onto the disk and you're up and running.
VistaPC Guy has a great step by step article on putting WinPE on your usb. read it here:
http://www.vistapcguy.net/?p=71

5118 Vista Recovery Environment ISO File

I've been prepping 5118 as well as 5119 and came a cross a great idea. How about creating a real startup failure and recovery process for the students in the lab instead of using the simulation.

Following things you will need to do for this:
1) create a copy of one of the lab machines (Vista-CL1-02 is as good as any)
2) capture your favourite PE, RE or Vista Insall ISO
3) delete a super important system file like the winload.exe
4) make sure to save the changes by merging the disks

Ok, Maybe step 2 is not as easy as it sounds. So here is some help along the way:
Vista PC Guy has a nice article on creating PE images, where he also talks about creating bootable USB versions. http://www.vistapcguy.net/?p=71
But we want a recovery image and not a PE image. More importantly we need the Startup Recovery tools "srt" loaded at startup. This is what you do:

1) Follow PC Guy's teps 1 thru to 8 to create a clean winpe image. Or use the one you extracted out of the 5119 course iso file using WinRar or PowerISO or IsoBuster or whatever ISO app you like.

2) Add the RE tools to the image by using the BuildWinRE tool located in the "C:\Program Files\Windows AIK\Recovery" folder. Remember to use the WinPE Command Prompt instead of the standard one to have all paths properly loaded. It is as simple as defining the source and destination. In my case (having created the pe folder myself using AIK) it looked like this:

C:\Program Files\Windows AIK\Recovery>BuildWinRE /source "C:\winpe_86\ISO\sources\boot.wim" /target "C:\winpe_recovery\ISO\sources\boot.wim"


3) final step is to take this RE image and make a bootable ISO file using oscdimg:

C:\Program Files\Windows AIK\Tools\PETools>oscdimg -lVistaRecovery -b"C:\Program Files\Windows AIK\Tools\PETools\x86\boot\etfsboot.com" -n -h c:\winpe_recovery\iso winrecovery.iso

Important here is to remember to reference the etfsboot.com, otherwise the iso won't start at bootup.

That's all, now you can start up your virtual machine using the recovery console, start the command prompt, and kill c:\windows\system32\winload.exe and then close the machine commiting changes.
The next time your student will start up that machine he/she'll see a wonderful error message and can boot into the recovery console and choose to repair the system following the steps outlined in the coursebook and simulation. No need for ten Vista Installation CDs!

By the way, it is a great iso file to burn to CD and use as Desktop Support Engineer to troubleshoot users computers.

5119 Supporting Vista Lab 4 using VPC

If any of you have been prepping 5119 you might have tried and tried and tried to get lab 4 running just like me. But no matter what you do, the GPO settings are not pushed out to the computer. Even removing the PC fromt he domain and rejoining it had no effect.

This seems to be a problem with Virtual PC. Out of some annoying reason, VPC insists on controlling the clock of your vpcs. Thus, the vista machine is not properly synchronised with the domain controller and refuses to apply the group policy object as it is unsure about the computers compliance to the GPO rules.

I presume using Virtual Server, as advised by the course authors would solve the problem.

How to fix it:
In my case it was as simple as making sure that both domain controller and vista machine were using the same time zone and both ignored daylight savings. Then both machines showed the same time.
For good measure I also included Domain Computers in the GPO Filter rule. To make sure that the rule does not apply only to users, but coputers too.

First reboot did not do it, but after the second reboot the startup took, as expected, forever and once the logon screen appeared I could log on and gradually could see the newly installed apps.


If that does not do the trick, here is a little cheat:
Remember: computer configuration is applied at boot time, while user configuration is applied at log in time.

first, put adrian into the Martketing OU, then when editing the GPO:

instead of using Computer Configuration >> Software Settings >> Software Installation, use
User Confiuguration >> Software Settings >> Software Installation instead.

That will make the icons appear on the start menu as soon as Adrian logs into the target machine. This way the programs are not installed, but get installed on first use.

Ok, the install will complain that it is not configured for a per user install, but it at least demonstrates the point.

Vista & ReadyBoost: speed is king & size does not matter

Hello everyone, now that many of us have Vista machines, some of you might have thought about boosting the performance of those machines. (Now why would anybody want to do that to such a (yawn) fast setup).
One reliable source of boosting the speed of the machine would be to plug in a usb drive into the back of the machine and set it up to assist ReadyBoost.

But beware! All drives are equal! Just some are more equal than others!

The most important thing to remember is that speed matters. And the speed of your drive is no different. If the vendor does not state it to be ReadyBoost compatible or “enhanced for ReadyBoost” then don’t even bother. The read & write speeds won’t be fast enough to get a performance gain and Vista will simply refuse to use it for its snazzy new feature.
That said, just having it say compatible will not necessarily make you feel an enormous performance gain. The “hidden” speed is important. The actual read & write performance of the stick will greatly influence how fast Vista responds on opening up complex apps like Photoshop or running Virtual Machines.
I tested a Transcend 2A stick against a DSE stick and found both to read at the same speed, but the Transcend 2A one wrote 4 times faster. Much better performance when plugged in than the DSE one.

So what to look out for? Make sure the drive claims to be ultra fast. Super performing or even publicly announces read & write speeds. Only few providers do that, because only few providers can actually boast about their performance.

Here are a couple I have found to be good in the past
Transcend 2A series. Skip the V series, they are cheap and slow. The 2A series is fast and responsive.
Apacer HT203 and HA202 are very good bets.

Sadly, the DSE USB stick you can get in Dicksmiths is not the best option, as it merely passes the minimum requirement for having the “enhanced for ReadyBoost” insignia. If you can get your Hands on a fast Apacer or fast Transcend, you’ll be much happier.

The last question you might ask is “do I need a big stick?” And here I’m happy to tell you that size does not matter for a change...:-) With 4GB of Ram and only being able to see 3GB of that I set my ReadyBoost cache to 3.5GB. Looking at the Performance Counters while testing out different scenarios I found a maximum of 2GB being used at any one time.

Final line: a fast performing 2GB USB drive will give you much more umpf than a slower 4GB at the same price.