To start experiencing a more beautiful web with IE9 and to visit a small set of the top 250 web-sites globally that have created a more beautiful experiences for all of us with IE9, go to http://beautyoftheweb.com/experience.

Internet Explorer 9 has now been downloaded 2.35 million times in the first 24 hours since its Monday night release. That is over 27 downloads every second, or over 240 downloads every 9 seconds. Wow!.

They want to thank everyone around the world for downloading IE9 and the enthusiastic reception. 2.3 million downloads in 24 hours is over double the 1 million downloads we saw of the IE9 Beta and four times that of the IE9 RC over the same time period.

In case you missed it, check out the collection of videos from the SxSW launch event. Ze Frank’s demo of Star.ME is one not to be missed!

You can see all of the demos and the complete launch event by clicking play below. And to download Internet Explorer 9 for yourself, visit http://www.beautyoftheweb.com.

Ze Frank’s demo of Star.ME is one not to be missed!

You can see all of the demos and the complete launch event by clicking play below. And to download Internet Explorer 9 for yourself, visit http://www.beautyoftheweb.com.

First of all, we are excited to announce the availability of App-V 4.6 RC! In August we announced the App-V 4.6 Beta. Since then we have taken in lots of customer feedback and continue to refine the App-V 4.6 release so that we can deliver a great product!  We invite you to check out the RC release by registering and downloading the App-V 4.6 RC release via Microsoft Connect, where you can also submit feedback directly to the team.

We’re not done though, in addition we’d like to share some great news and also announce our integration with Office 2010 Beta:

Microsoft Office 2010 Beta, Ready to be Sequenced With the Microsoft Office 2010 Beta Deployment Kit for App-V

As you know the Office team just completed a major milestone Microsoft Office 2010 Beta, congrats to the team!  Throughout the process of building Office 2010 the App-V and Office teams have been working very closely to make sequencing Office 2010 Beta possible with App-V 4.6 RC!  We have taken the feedback and requests from post-Office 2007 and App-V 4.5 releases, and have been hard at work implementing a solid integration experience for Office when App-V 4.6 releases in H1 2010.

So what’s Different when using Microsoft Office 2010 Beta and App-V 4.6 RC together?

Office 2010 has introduced a new piracy protection initiative, the Software Protection Platform (SPP) service.  This service uses a machine’s hardware characteristics and product key to activate the installation, which is performed during the first Office application launch.

Since the Office 2010 product activation is linked to the hardware on which Office is originally installed, customers who wish to deploy Office 2010 using App-V must physically install the SPP service on the sequencer machine before beginning the sequencing process – and on any client machines that will stream and run Office 2010.

Our engineering teams have collaborated to address the top customer issues that people were running into when virtualizing past versions of Office.   As a result, Office 2010 has a much more integrated user experience.  The Office 2010 integration delivers key productivity enhancements and a seamless user experience by enabling the following::

· Microsoft SharePoint Integration – You can open, edit, and save Microsoft Office documents using Microsoft SharePoint.

· Microsoft Outlook Fast Search – You can use Microsoft Windows Desktop Search to find specific messages in your inbox.

· MAPI Proxy – You can connect to your inbox using Microsoft Outlook Send To functionality.

· Microsoft Office Document Indexing – You can index your documents so that you can use Microsoft Windows Search to locate files.

· Virtual Mail Control Panel icon – You can use the Email icon in Control Panel to perform advance mail configuration.

· URL protocol handler – You can configure links in the browser and specify the appropriate associated Microsoft Office application.

· Send to Microsoft OneNote Printer driver – You can print documents to Microsoft OneNote.

To help customers facilitate this process, we have created the Microsoft Office 2010 Deployment Kit for App-V (Beta). The Deployment Kit contains both the required SPP licensing component and Office 2010 integration features.

And what’s even more exciting, you can get your hands on it now.

How Do I Sequence Microsoft Office 2010 Beta for App-V 4.6 RC?

1. Download Office 2010 Beta here

2. Download the Microsoft Office 2010 Deployment Kit for App-V (Beta)

3. Download App-V 4.6 RC on Microsoft Connect

4. Read the App-V recipe for sequencing Office 2010 Beta on Microsoft Connect.

For detailed information on whether your environment meets the requirements of Office 2010 and App-V 4.6 RC, please refer to the App-V recipe.

Please note: We are providing a recipe to support the sequencing and testing of these pre-release products on Microsoft Connect.  Please provide feedback via Microsoft Connect, by choosing FEEDBACK once logged into the App-V 4.6 Program.

We look forward to hearing about your App-V 4.6 RC and Office 2010 experience!

Virtualization affects how we plan, build, deploy, operate, and service workloads. Customers are creating large libraries of virtual machines containing various configurations. The patch-state of these virtual machines are not always known. Ensuring that offline virtual machines are properly patched and won’t become vulnerable the instant they come online is critical.

I am therefore very pleased to state that the Offline Virtual Machine Servicing Tool v2.1 has now been released!

Congratulations to the Solution Accelerator team for this release!

The Offline Virtual Machine Servicing Tool 2.1 has free, tested guidance and automated tools to help customers keep their virtualized machines updated, without introducing vulnerabilities into their IT infrastructure.

The tool combines the Windows Workflow programming model with the Windows PowerShell interface to automatically bring groups of virtual machines online, service them with the latest security updates, and return them to an offline state.

What’s New?

Release 2.1 is a direct response to customer and Microsoft field requests to support the R2 wave. Offline Virtual Machine Servicing Tool 2.1 now supports the following products:
· Hyper-V-R2
· VMM 2008 R2
· SCCM 2007 SP2
· WSUS 3.0 SP2
· OVMST 2.1 also supports updates to Windows 7 and Windows Server 2008 R2 virtual machines.

Download here; Offline Virtual Machine Servicing Tool  2.1
More info; http://technet.microsoft.com/en-us/library/cc501231.aspx

To easily assess the security state of machines in an environment, Microsoft offers the free Microsoft Baseline Security Analyzer (MBSA) scan tool. MBSA includes a graphical and command line interface that can perform local or remote scans of Microsoft Windows systems.

MBSA 2.1.1 builds on previous versions by adding support for Windows 7 and Windows Server 2008 R2. As with the previous MBSA 2.1 release, MBSA includes 64-bit installation, security update and vulnerability assessment (VA) checks, improved SQL Server 2005 checks, and support for the latest Windows Update Agent (WUA) and Microsoft Update technologies. More information on the capabilities of MBSA 2.1 and 2.1.1 is available on the MBSA Web site.

MBSA 2.1.1 runs on Windows Server 2008 R2, Windows 7, Windows Server 2008, Windows Vista, Windows Server 2003, Windows XP and Windows 2000 systems and will scan for missing security updates, rollups and service packs using Microsoft Update technologies. MBSA will also scan for common security misconfigurations (also called Vulnerability Assessment checks) using a known list of less secure settings and configurations for all versions of Windows, Internet Information Server (IIS) 5.0, 6.0 and 6.1, SQL Server 2000 and 2005, Internet Explorer (IE) 5.01 and later, and Office 2000, 2002 and 2003 only.

To assess missing security updates, MBSA will only scan for missing security updates, update rollups and service packs available from Microsoft Update. MBSA will not scan or report missing non-security updates, tools or drivers.
Choose the appropriate download below for English (EN), German (DE), French (FR) and Japanese (JA) for x86 (32-bit) or x64 (64-bit) platforms.

Download details Microsoft Baseline Security Analyzer 2.1.1 (for IT Professionals)
Source: http://bink.nu/news/microsoft-baseline-security-analyzer-2-1-1.aspx

The upcoming RDP 7 enhancements discussed are as follows:

• Windows 7 Aero support
• Direct 2D & Direct 3D 10.1 application support
• True multi-monitor support
• RDP Core Performance Improvements
• Multimedia enhancements
  • Media Foundation support
  • DirectShow support
• Low Latency audio playback support
• Bi-directional audio support

Anyone who has been doing server-based computing, remoting, terminal services, Citrix or whatever you want to call it for any period of time.  In this portion they show a 1080p high definition (HD) video being remoted from a Windows Server 2008 R2 Terminal Services.

WOW, is all I can say!  I was left speechless.  It was beautiful, not a single skip or hiccup, and it was beautiful.   Microsoft accomplishes this not through virtual GPUs or server-side GPUs but by sending commands (code) from the server to the client.  The commands are then executed on the local client’s graphics cards vs. the servers which Microsoft calls this, “RDP Client Rendering”.

The following image is a screen shot from the HD movie played over RDP 7.  You will notice the resolution is very high and rich, now imagine it running in full motion with the audio synced.   I never thought I would see the day.

Through RDP Client Rendering the amount of server-side resources are cut drastically.  This eliminates the classic problem where one or two users running a graphics application at any given time renders the Terminal Servers box unusable.  Not anymore.  As the HD movie played, Gaurav showed us that both the server’s CPU and the network bandwidth utilization were running around 1%.   Again, WOW is all I can say!

In the following image you will you will notice the Windows Task Manager’s CPU Usage and Memory Usage are very low considering a HD move is being remoted.  Heck, mouse movements almost add more CPU…

Once they were done wooing us with the amazing eye candy in the demo, Nadim Abdo came back to discuss RDP Graphics Internals, the RDP graphics architecture, and which RDP rendering method was used by which applications.

Applications Supported?

As mentioned earlier, in Windows 7 and RDP 7 Microsoft has added the ability for the server to send commands to the Remote Desktop Client and have those commands executed by the local client’s graphics card vs. being required to have them rendered on the server, thus gaining the benefits we talked about above.  But this is not always the case, and it was pointed out in the presentation where applications that run through and/or somehow embed Windows Media Player will take advantage of client -side rendering, called RDP Client Rendering, but that all others methods will not.  For example, Flash media.  We all know there are tons of Flash videos and banners all over the web today.  Even DABCC.com has Flash.  Microsoft commented that in the future we might see other graphics version move from a host rendering solution to a client rendering model.

The following chart shows the media types and whether they are rendered on the server and/or the client:

RDP 7 Graphics: Bringing it All Together

In the finial demo of the presentation, Gaurav Daga revisits the Direct X 2D and Direct X 3D applications shown earlier in the presentation, but this time he runs them both at the same time, side by side on the screen.

You will also notice the full Aero glass effect is present and running over RDP 7, notice the translucencies?  Gaurav even showed off the eye candy “Flip 3D” support and it all worked flawlessly over a remote desktop session.  Yes, a RDP session…

Virtual Desktop Support

One of the more interesting points Gaurav Daga made, which I found very compelling, was around virtual desktops.   He made the point that today most virtual graphics adapters found on virtual desktops do not support truly rich DirectX and Direct 2D / 3D applications but with Windows 7, Windows Server 2008 R2, and RDP7, it won’t matter due to the fact the features are built into the operating system (Windows 7) and do not require heavy use of the server side graphics driver.  This also means it does not matter what hypervisor Windows 7 runs on.  All you need is a virtual Windows 7 desktop along with the Desktop Client for RDP7 and the user experience will be all that and a bag of chips.

This makes me think.  VMware and a slew of other desktop virtualization venders use RDP as the remoting protocol for their VDI solutions so in theory they will be able to take advantage of these upcoming features.  But the problem is solutions such as VMware View (formally known as Virtual Desktop Manager (VDM)) have a custom client.  This being said, the VDI brokers will be required to update their current clients to support the upcoming RDP 7 enhancements.  Only the upcoming Microsoft Desktop Services connection broker will be able to take advantage of these features by default.

What Clients will be supported?

At launch time and I can only expect for some time afterwards, the following clients will support all the new graphics and multimedia enhancements:

• Windows 7
• Windows Vista (Direct X remoting will not work)

The Bottom Line:

The bottom line is that Microsoft is stepping up the game with Windows 7, Windows Server 2008 R2 Remote Desktop Services, and RDP 7.   The enhancements discussed and shown in the demos will go a long way to enhance the “user experience” in both Presentation Virtualization and Virtual Desktop worlds thus allowing wider adoption due to less pushback from users.  (We all know user pushback matters…and delivering an amazing user experience is the key to overcoming user pushback.)

The only big drawback I saw was the fact that Microsoft is still using host rendering for a slew of common formats.  For example, Flash.   Needless to say Flash tends to be everywhere and typically does not perform well on my TS boxes…   These new features will not directly benefit Flash video and the other formats of videos still using host based rendering.

Although at the end of the day for me it is simple….. when I can get my hands on this I will be retiring my MacBook Pro notebook and will be replacing it with a laptop running Windows 7!   Sorry Apple… Put that in one in an upcoming “PC vs. Mac” commercial because “I’m a PC”!

Paged and nonpaged pools serve as the memory resources that the operating system and device drivers use to store their data structures. The pool manager operates in kernel mode, using regions of the system’s virtual address space (described in the Pushing the Limits post on virtual memory) for the memory it sub-allocates. The kernel’s pool manager operates similarly to the C-runtime and Windows heap managers that execute within user-mode processes.  Because the minimum virtual memory allocation size is a multiple of the system page size (4KB on x86 and x64), these subsidiary memory managers carve up larger allocations into smaller ones so that memory isn’t wasted.

For example, if an application wants a 512-byte buffer to store some data, a heap manager takes one of the regions it has allocated and notes that the first 512-bytes are in use, returning a pointer to that memory and putting the remaining memory on a list it uses to track free heap regions. The heap manager satisfies subsequent allocations using memory from the free region, which begins just past the 512-byte region that is allocated.

Nonpaged Pool

The kernel and device drivers use nonpaged pool to store data that might be accessed when the system can’t handle page faults. The kernel enters such a state when it executes interrupt service routines (ISRs) and deferred procedure calls (DPCs), which are functions related to hardware interrupts. Page faults are also illegal when the kernel or a device driver acquires a spin lock, which, because they are the only type of lock that can be used within ISRs and DPCs, must be used to protect data structures that are accessed from within ISRs or DPCs and either other ISRs or DPCs or code executing on kernel threads. Failure by a driver to honor these rules results in the most common crash code, IRQL_NOT_LESS_OR_EQUAL .

Nonpaged pool is therefore always kept present in physical memory and nonpaged pool virtual memory is assigned physical memory. Common system data structures stored in nonpaged pool include the kernel and objects that represent processes and threads, synchronization objects like mutexes, semaphores and events, references to files, which are represented as file objects, and I/O request packets (IRPs), which represent I/O operations.

Paged Pool

Paged pool, on the other hand, gets its name from the fact that Windows can write the data it stores to the paging file, allowing the physical memory it occupies to be repurposed. Just as for user-mode virtual memory, when a driver or the system references paged pool memory that’s in the paging file, an operation called a page fault occurs, and the memory manager reads the data back into physical memory. The largest consumer of paged pool, at least on Windows Vista and later, is typically the Registry, since references to registry keys and other registry data structures are stored in paged pool. The data structures that represent memory mapped files, called sections internally, are also stored in paged pool.

Device drivers use the ExAllocatePoolWithTag API to allocate nonpaged and paged pool, specifying the type of pool desired as one of the parameters. Another parameter is a 4-byte Tag , which drivers are supposed to use to uniquely identify the memory they allocate, and that can be a useful key for tracking down drivers that leak pool, as I’ll show later.

Viewing Paged and Nonpaged Pool Usage

There are three performance counters that indicate pool usage:

• Pool nonpaged bytes
• Pool paged bytes (virtual size of paged pool – some may be paged out)
• Pool paged resident bytes (physical size of paged pool)

However, there are no performance counters for the maximum size of these pools. They can be viewed with the kernel debugger !vm command, but with Windows Vista and later to use the kernel debugger in local kernel debugging mode you must boot the system in debugging mode, which disables MPEG2 playback.

So instead, use Process Explorer to view both the currently allocated pool sizes, as well as the maximum. To see the maximum, you’ll need to configure Process Explorer to use symbol files for the operating system. First, install the latest Debugging Tools for Windows package. Then run process Explorer and open the Symbol Configuration dialog in the Options menu and point it at the dbghelp.dll in the Debugging Tools for Windows installation directory and set the symbol path to point at Microsoft’s symbol server:

After you’ve configured symbols, open the System Information dialog (click System Information in the View menu or press Ctrl+I) to see the pool information in the Kernel Memory section. Here’s what that looks like on a 2GB Windows XP system:

2GB 32-bit Windows XP

Nonpaged Pool Limits

As I mentioned in a previous post, on 32-bit Windows, the system address space is 2GB by default. That inherently caps the upper bound for nonpaged pool (or any type of system virtual memory) at 2GB, but it has to share that space with other types of resources such as the kernel itself, device drivers, system Page Table Entries (PTEs), and cached file views.

Prior to Vista, the memory manager on 32-bit Windows calculates how much address space to assign each type at boot time. Its formulas takes into account various factors, the main one being the amount of physical memory on the system.  The amount it assigns to nonpaged pool starts at 128MB on a system with 512MB and goes up to 256MB for a system with a little over 1GB or more. On a system booted with the /3GB option, which expands the user-mode address space to 3GB at the expense of the kernel address space, the maximum nonpaged pool is 128MB. The Process Explorer screenshot shown earlier reports the 256MB maximum on a 2GB Windows XP system booted without the /3GB switch.

The memory manager in 32-bit Windows Vista and later, including Server 2008 and Windows 7 (there is no 32-bit version of Windows Server 2008 R2) doesn’t carve up the system address statically; instead, it dynamically assigns ranges to different types of memory according to changing demands. However, it still sets a maximum for nonpaged pool that’s based on the amount of physical memory, either slightly more than 75% of physical memory or 2GB, whichever is smaller. Here’s the maximum on a 2GB Windows Server 2008 system:

2GB 32-bit Windows Server 2008

64-bit Windows systems have a much larger address space, so the memory manager can carve it up statically without worrying that different types might not have enough space. 64-bit Windows XP and Windows Server 2003 set the maximum nonpaged pool to a little over 400K per MB of RAM or 128GB, whichever is smaller. Here’s a screenshot from a 2GB 64-bit Windows XP system:

2GB 64-bit Windows XP

64-bit Windows Vista, Windows Server 2008, Windows 7 and Windows Server 2008 R2 memory managers match their 32-bit counterparts (where applicable – as mentioned earlier, there is no 32-bit version of Windows Server 2008 R2) by setting the maximum to approximately 75% of RAM, but they cap the maximum at 128GB instead of 2GB. Here’s the screenshot from a 2GB 64-bit Windows Vista system, which has a nonpaged pool limit similar to that of the 32-bit Windows Server 2008 system shown earlier.

2GB 32-bit Windows Server 2008

Finally, here’s the limit on an 8GB 64-bit Windows 7 system:

8GB 64-bit Windows 7

Here’s a table summarizing the nonpaged pool limits across different version of Windows:

Paged Pool Limits

The kernel and device drivers use paged pool to store any data structures that won’t ever be accessed from inside a DPC or ISR or when a spinlock is held. That’s because the contents of paged pool can either be present in physical memory or, if the memory manager’s working set algorithms decide to repurpose the physical memory, be sent to the paging file and demand-faulted back into physical memory when referenced again. Paged pool limits are therefore primarily dictated by the amount of system address space the memory manager assigns to paged pool, as well as the system commit limit.

On 32-bit Windows XP, the limit is calculated based on how much address space is assigned other resources, most notably system PTEs, with an upper limit of 491MB. The 2GB Windows XP System shown earlier has a limit of 360MB, for example:

2GB 32-bit Windows XP

32-bit Windows Server 2003 reserves more space for paged pool, so its upper limit is 650MB.

Since 32-bit Windows Vista and later have dynamic kernel address space, they simply set the limit to 2GB. Paged pool will therefore run out either when the system address space is full or the system commit limit is reached.

64-bit Windows XP and Windows Server 2003 set their maximums to four times the nonpaged pool limit or 128GB, whichever is smaller. Here again is the screenshot from the 64-bit Windows XP system, which shows that the paged pool limit is exactly four times that of nonpaged pool:

2GB 64-bit Windows XP

Finally, 64-bit versions of Windows Vista, Windows Server 2008, Windows 7 and Windows Server 2008 R2 simply set the maximum to 128GB, allowing paged pool’s limit to track the system commit limit. Here’s the screenshot of the 64-bit Windows 7 system again:

8GB 64-bit Windows 7

Here’s a summary of paged pool limits across operating systems:

Testing Pool Limits

Because the kernel pools are used by almost every kernel operation, exhausting them can lead to unpredictable results. If you want to witness first hand how a system behaves when pool runs low, use the Notmyfault tool. It has options that cause it to leak either nonpaged or paged pool in the increment that you specify. You can change the leak size while it’s leaking if you want to change the rate of the leak and Notmyfault frees all the leaked memory when you exit it:

Don’t run this on a system unless you’re prepared for possible data loss, as applications and I/O operations will start failing when pool runs out. You might even get a blue screen if the driver doesn’t handle the out-of-memory condition correctly (which is considered a bug in the driver). The Windows Hardware Quality Laboratory (WHQL) stresses drivers using the Driver Verifier, a tool built into Windows, to make sure that they can tolerate out-of-pool conditions without crashing, but you might have third-party drivers that haven’t gone through such testing or that have bugs that weren’t caught during WHQL testing.

I ran Notmyfault on a variety of test systems in virtual machines to see how they behaved and didn’t encounter any system crashes, but did see erratic behavior. After nonpaged pool ran out on a 64-bit Windows XP system, for example, trying to launch a command prompt resulted in this dialog:

On a 32-bit Windows Server 2008 system where I already had a command prompt running, even simple operations like changing the current directory and directory listings started to fail after nonpaged pool was exhausted:

On one test system, I eventually saw this error message indicating that data had potentially been lost. I hope you never see this dialog on a real system!

Running out of paged pool causes similar errors. Here’s the result of trying to launch Notepad from a command prompt on a 32-bit Windows XP system after paged pool had run out. Note how Windows failed to redraw the window’s title bar and the different errors encountered for each attempt:

And here’s the start menu’s Accessories folder failing to populate on a 64-bit Windows Server 2008 system that’s out of paged pool:

Here you can see the system commit level, also displayed on Process Explorer’s System Information dialog, quickly rise as Notmyfault leaks large chunks of paged pool and hits the 2GB maximum on a 2GB 32-bit Windows Server 2008 system:

The reason that Windows doesn’t simply crash when pool is exhausted, even though the system is unusable, is that pool exhaustion can be a temporary condition caused by an extreme workload peak, after which pool is freed and the system returns to normal operation. When a driver (or the kernel) leaks pool, however, the condition is permanent and identifying the cause of the leak becomes important. That’s where the pool tags described at the beginning of the post come into play.

Tracking Pool Leaks

When you suspect a pool leak and the system is still able to launch additional applications, Poolmon, a tool in the Windows Driver Kit , shows you the number of allocations and outstanding bytes of allocation by type of pool and the tag passed into calls of ExAllocatePoolWithTag. Various hotkeys cause Poolmon to sort by different columns; to find the leaking allocation type, use either ‘b’ to sort by bytes or ‘d’ to sort by the difference between the number of allocations and frees. Here’s Poolmon running on a system where Notmyfault has leaked 14 allocations of about 100MB each:

After identifying the guilty tag in the left column, in this case ‘Leak’, the next step is finding the driver that’s using it. Since the tags are stored in the driver image, you can do that by scanning driver images for the tag in question. The Strings utility from Sysinternals dumps printable strings in the files you specify (that are by default a minimum of three characters in length), and since most device driver images are in the %Systemroot%\System32\Drivers directory, you can open a command prompt, change to that directory and execute “strings * | findstr <tag>”. After you’ve found a match, you can dump the driver’s version information with the Sysinternals Sigcheck utility. Here’s what that process looks like when looking for the driver using “Leak”:

If a system has crashed and you suspect that it’s due to pool exhaustion, load the crash dump file into the Windbg debugger, which is included in the Debugging Tools for Windows package, and use the !vm command to confirm it. Here’s the output of !vm on a system where Notmyfault has exhausted nonpaged pool:

Once you’ve confirmed a leak, use the !poolused command to get a view of pool usage by tag that’s similar to Poolmon’s. !poolused by default shows unsorted summary information, so specify 1 as the the option to sort by paged pool usage and 2 to sort by nonpaged pool usage:

Use Strings on the system where the dump came from to search for the driver using the tag that you find causing the problem.

So far in this blog series I’ve covered the most fundamental limits in Windows, including physical memory, virtual memory, paged and nonpaged pool. Next time I’ll talk about the limits for the number of processes and threads that Windows supports, which are limits that derive from these.

Consumers who want to test-drive the beta will be able to download it beginning Jan. 9 at http://www.microsoft.com/windows7 .

Here is the full press release:

Microsoft’s Ballmer Announces Availability of Windows 7 Beta and Windows Live

For TechNet, MSDN and Techbeta customers it is already available here;

Windows 7 Beta 64-bits (Download also this MP3 Fix !)
Windows 7 Beta 32-bits (Download also this MP3 Fix !)

Release notes Windows 7

How can I protect my terminal servers from Spyware, Malware, Trojans, Worms, Viruses and un-authorized software?

1. Start with a secure installation of the Operating System.  Windows Server 2003 installs by default with the users being able to create files and folders in the root of the system drive and Windows 2000 Server installs by default with the Everyone group having Full Control NTFS Permissions to the entire System Drive.  To lock down the System Drive on Windows 2000 Server, start with the following settings:

   1. Root of System Drive – Authenticated Users = "Read and Execute"

   2. Root of System Drive – Administrators = "Full Control"

   3. Root of System Drive – System = "Full Control"

   4. Program Files Directory – Authenticated Users = "Read and Execute"

   5. Program Files Directory – Administrators = "Full Control"

   6. Program Files Directory – System = "Full Control"

2. NEVER allow anyone to logon as an administrator or power user, unless they are a member of the IT Staff / IT Consulting Firm that is responsible for the server, and they are logging on to perform administrative functions, i.e. installing software, performing a backup…

3. Force "Empty Temporary Internet Files when browser closed" via Group Policy.  This will delete most bad files from the Temp IE location of the user’s profile, and leave only the cookie files.

4. Implement Roaming Terminal Server Profiles, Mandatory Terminal Server Profiles or Flex Terminal Server Profiles.

5. Enable DeleteRoamingCache in the registry, or via "Delete Cached Copies of Roaming Profiles " in Group Policy.  Since the Roaming Profile does not propagate the user’s Temp Directory, enabling this policy will usually delete that anything the user downloaded unintentionally.  This policy deletes the user’s local profile at logoff once it’s been successfully unloaded and copied to the roaming location.

6. Install the User Profile Hive Cleanup Service , which helps to ensure user sessions are completely terminated when a user logs off.  Without this service, user profiles are often not unloaded successfully which causes the copy to the roaming profile location and DeleteRoamingCache setting to fail.

7. Install a Terminal Server compatible anti-virus scanner on each terminal server, a VSAPI anti-virus scanner on each SMTP Server, and an anti-virus scanner at the Internet Gateway.

8. Set the Terminal Services Configuration Permission Compatibility to "Full Security" (Windows Server 2003) , or to "Windows 2000 Users" (Windows 2000 Server) . If you use the "Permissions compatible with Terminal Server 4.0 Users" (Windows 2000 Server) or "Relaxed Security" (Windows Server 2003), each user logging on is added to the TSUser Security Group, which has permissions and rights of the Power Users Group.

9. Enable Software Restriction Policies in Group Policy, to define which files can be executed by users.

10. If users need only one application, specify this program to start when they logon.  This can be done for everyone via Group Policy or Terminal Services Configuration , or for specific users via Active Directory or Local User Account.

11. Consider locking down the user environment with a FREE program like BrsSuite , designed by Terminal Server Security Expert "Fabrice Cornet", of FC Consult, Belgium .

12. Restrict access to applications normal users shouldn’t ever use, or that do not follow the policy restrictions in place, i.e. winfile and command.com

How can provide the most secure access to terminal servers from the Public Internet?  The RDP Protocol is secure and uses RSA Security’s RC4 cipher, at either 56 or 128 bits, however the following should be considered when providing access to terminal servers over the Public Internet:

1. Set the RDP-Tcp Encryption Level to "High" (Windows 2000 Server or Windows Server 2003)

2. Define and enforce a strong password policy .

3. If you require password authentication to access a Remote Desktop Web Connection (RDWC, aka TSAC or TSWeb), do so over an SSL Connection.  Since you have to logon to the Terminal Server, there really is no advantage to requiring authentication to access a RDWC.

4. Do NOT use traditional client-to-server VPN to provide secure access to Terminal Servers.  This may sound strange, but traditional client-to-server VPNs require connectivity over non-standard ports client software on the remote computer. These often prevent remote users from being able to connect.  In addition to the connectivity problems traditional VPN can cause, traditional client-to-server VPNs can open the corporate network to viruses, trojans or worms, because they extend the corporate network to the remote client.

5. Do consider providing secure access to terminal servers via SSL VPN or a Terminal Server Secure Gateway , as these can provide access over standard ports like 443 or 80, which makes connectivity easy for remote users.  These devices or software applications also provide access to a specific computer, or set of computers, instead of opening a secure tunnel to the entire corporate network.

• SP2 FAQ
• Windows Vista SP2 Release Notes
• Windows Server 2k8 Release Notes
• Complete List of Updates Included in the SP

SP2 Beta Standalone updates for computers with one or more of the following five languages: English, French, German, Japanese , and Spanish. If your computer has any other language installed this option will not work.

• Windows Update installation of SP2 for Windows Server 2008 x86/x64/ia64 and Windows Vista x86/x64
• Five Language SP2 Standalone:
  

  ISO for Windows Server 2008 x86/x64/ia64 and Windows Vista x86/x64

  x86 for Windows Server 2008 and Windows Vista x86

  x64 for Windows Server 2008 and Windows Vista x64

  IA64 for Windows Server 2008 ia64

There are four gadgets – TV, Music, Pictures + Videos, and Now Playing – that let you browse and control your Media Center PC from any SideShow remote control or device, or even a Windows Mobile phone (if it has the platform installed). The gadgets let you browse the TV guide and details, recorded shows, your photos, music (with cover art), and have playback controls to start/stop/record/etc media.

It was a pleasure to work with the SideShow team on this project. Thanks to everyone in the community for your feedback via Microsoft Connect and community sites. We read every comment and used them to make the gadgets better or just used as feedback for the future.

Download locations:
Install the 32-bit version
Install the 64-bit version

For more details, please see the SideShow blog at http://blogs.msdn.com/sideshow/archive/2008/10/21/media-center-gadgets-for-sideshow-released-available-on-the-windows-live-gallery.aspx

Download

• SkyTimeLaps.com
• Digigami
• Feedback Video $
• Microsoft HD Content Showcase
• AeroXperience Forum
• CES Waterfall Demo (you must convert it to a mpg)
• WinMatrix 2

\\live.sysinternals.com\tools\toolname.exe

For example if you want to run Autoruns (a great program to see what starts up automatically) type \\live.sysinternals.com\tools\autoruns.exe and hit Enter.

Every Sysinternals utility is available for “live” use.

Available Commands

• accesschk.exe
• AccessEnum.exe
• accvio.EXE
• ADExplorer.exe
• ADInsight.exe
• adrestore.exe
• Autologon.exe
• autoruns.exe
• autorunsc.exe
• Bginfo.exe
• Cacheset.exe
• Clockres.exe
• Contig.exe
• ctrl2cap.exe
• Dbgview.exe
• DEFRAG.EXE
• diskext.exe
• Diskmnt.exe
• Diskmon.exe
• DiskView.exe
• du.exe
• efsdump.exe
• Filemon.exe
• handle.exe
• hex2dec.exe
• junction.exe
• ldmdump.exe
• Listdlls.exe
• livekd.exe
• LoadOrd.exe
• logonsessions.exe
• movefile.exe
• newsid.exe
• NotMyfault.exe
• ntfsinfo.exe
• pagedfrg.exe
• pendmoves.exe
• PHYSMEM.EXE
• pipelist.exe
• portmon.exe
• procexp.exe
• ProcFeatures.exe
• Procmon.exe
• psexec.exe
• psfile.exe
• psgetsid.exe
• Psinfo.exe
• pskill.exe
• pslist.exe
• psloggedon.exe
• psloglist.exe
• pspasswd.exe
• psservice.exe
• psshutdown.exe
• pssuspend.exe
• RegDelNull.exe
• Reghide.exe
• regjump.exe
• Regmon.exe
• RootkitRevealer.exe
• sdelete.exe
• ShareEnum.exe
• ShellRunas.exe
• sigcheck.exe
• streams.exe
• strings.exe
• sync.exe
• SysInternalsBluescreen.scr
• tcpvcon.exe
• Tcpview.exe
• Testlimit.exe
• testlimit64.exe
• Volumeid.exe
• whois.exe
• Winobj.exe
• ZoomIt.exe

For a “live” list visit http://live.sysinternals.com/Tools/

Tip: When you are typing in a command hit the Tab key to automatically fill in the rest of the file name. E.g. type autor and then hit Tab to get autoruns.exe

Microsoft replaced the old uitilities with updated version in the Remote Server Administrative Tools  (RSAT) package.

Download the 32-bit version for Vista SP1

Download the 64-bit version for Vista SP1

Once you have downloaded and installed the administrative tools you need to turn the features on.

1. Open Control Panel and go to Programs and Features.
2. Click Turn Windows features on or off located on the side menu.
3. Check Remote Server Administrative Tools and hit OK.

Good Luck!

Download: http://mindre.net/post/Hyper-V-Monitor-Gadget-for-Windows-Sidebar.aspx