Archive

Archive for the ‘Windows 7’ Category

Remove Vista/W7 hardwareprofiles

March 18th, 2010 No comments

For whatever reason Microsoft removed the accessible way of removing hardware profiles in Vista and Windows 7. To help out a collegue with a corrupt profile I made a tiny Powershell script to perform this action. It’s easily done by hand in the registry, the downside is you won’t see the profile descriptions which is a tad errorprone. Also, feel free to use this but I will take no responsibility whatsoever if you use this and you break your Windows install :-)

# 20091218 – vo.o1 – PZO    – Initial hack to delete hardware profiles in Windows Vista/7
#
#————————————————————————————————————————————–
# Let’s see which profiles exist..
#————————————————————————————————————————————–
$i = 0
Write-Host “”
Write-Host “The following hardware profiles have been found on this computer:” -f white
foreach ($profile in (ls -path “HKLM:\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware Profiles\”) ) {
Write-Host 000$i – (get-itemproperty -path “HKLM:\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware Profiles\000$i”).FriendlyName
$i++
}
#————————————————————————————————————————————–
# Now we can ask which to remove..
#————————————————————————————————————————————–
Write-Host “”
Write-Host “You are strongly advised not to remove profile 0000 – New Hardware Profile” -f red
Write-Host “”
$input = read-host “Which profile is causing you headaches and should be removed?”
Write-Host “deleting.. “HKLM:\SYSTEM\CurrentControlSet\Hardware Profiles\$input”"
Remove-Item -Path “HKLM:\SYSTEM\CurrentControlSet\Hardware Profiles\$input”

Finally: do _not_ remove profile 0000 unless you know what you are doing. YMMV!

[BBG]

Microsoft Deployment Toolkit 2010…

November 12th, 2009 No comments

Finally I have seen a nice Microsoft solution for light touch deployment of servers and workstations. During a half-hour demo session on TechEd MS demonstrated that deploying new desktops and servers doesn’t have to be a tough job if you use the new Deployment Toolkit 2010 and WAIK 2.0. It was impressive to see how easy automated deployment for various operating systems becomes when you use the new Deployment Workbench which wraps like a management shell around the individual WAIK 2.0 components. Big plus for the Deployment Workbench is that all UI management operations are also accessible from Powershell by loading a single powershell snap-in making it easier to automate.

WAIK 2.0 comes with some new tools like DSIM.exe which is a combination of previous WAIK tools like Pkgmgr.exe, Intlcfg.exe, PEimg.exe and has basic functionality to mount and maintain Windows images (either WIM or VHD file format) by adding or removing device drivers, patches, software packages etc..

Other new features in this toolkit:

• BCDboot is a new tool used to quickly set up a system partition, or to repair the boot environment.
• USMT. User State Migration Tool used for doing an in place migration while maintaining all user data and settings.
• Volume Activation Management Tool. Manages volume activation of Windows clients using a Multiple Activation Key (MAK)
• Hardware recognition and driver injection (also during pre-installation stage while booting from WinPE).
• Create image files for media-based deployments from existing deployment shares (WIM and/or ISO image files).

It supports deployment of Windows XP, Vista, Windows 7, Windows Server 2003/2008/2008 R2

Read more about MDT 2010:
http://technet.microsoft.com/en-us/solutionaccelerators/dd407791.aspx

What’s new in MDT 2010 (link to Word doc):
http://go.microsoft.com/fwlink/?LinkId=163309

mdt2010

IPV6 is coming…

November 11th, 2009 1 comment
 Mark Minasi held a nice presentation about the basics of IPV6. Very clarifying.

Of course there was a warning, as all speakers must have done the last couple of years, about the `ending` of IPV4. We are running out of ip addresses, we’ve heard that before.

Here you will find a nice link of where Geoff Huston is predicting the end of time:http://www.potaroo.net/tools/ipv4/index.html 

 

And in fact, we cannot ignore this. It will happen. And I want to be prepared, so that’s why I attended this session. I cannot longer sit back and hoping this would only happen when I’m retired. (and the Dutch government is not helping as well, as they have decided to extend pensioning from 65 to 67 years..)

Windows has already implemented the IPV6 stack from 2003 (and XP sp2) onwards and IPV6 from Vista onwards is the preferred protocol by default. Of course you can disable this, but in Win2k8 IPV4 is built on the IPV6 stack, so even when you disable IPV6, you’re always able to ping your local-home-address (::1).

Something I found during my research: Exchange 2003 on Windows 2008 needs IPV6, unless you disable it via a reghack (http://msmvps.com/blogs/ehlo/archive/2008/06/12/1634433.aspx).

You need to understand the principles (doh…) but networking is a piece of cake with IPV6

 

 

IPV4 is all about routing, IPV6 is all about shouting, was a statement of Mark Minasi.

Motivators to use IPV6:

  • China is knocking at the internet-door.
  • All European car-manufacturers have agreed to implement IPV6 in their cars as the standart protocol for car applications. (so beware, breaking will done via commands transported via IPV6..)

I don’t want to get in detail here, plenty of explanation on the web, but the modern OS-es all are capable of doing IPV6, and certainly I will dive deeper into this.  

You should too.

Aladdin eToken and Windows 7

July 14th, 2009 26 comments

Check comments below for a solution to this issue! Thanks to Daniel Verbruggen!

While testing the Aladdin eToken (USB form Factor Smart Card) with PKIClient 5.0 on windows 7, I discovered that the certificates are no longer published into the “Personal Certificate Store”.
Which makes the eToken quite useless for now on Windows 7. I can however logon to the Windows 7 system using the eToken. But for all other purposes like VPN, website authentication etc it cannot be used since Windows 7 does not offer you to pick an certificate to authenticate with.
The Smart Card device forwarding still works, over RDP and also within XP Mode on Windows 7.

I dropped Aladdin an email and asked them for timelines and Windows 7 support, but until now, nothing but silence. I will update this post when I know more. In the meanwhile if you’ve got a workaround… please drop a comment.

etoken windows 7eToken and PKIClient 5.0 on Windows 7

etoken-xpmodeeToken and PKIClient 5.0 on Windows 7 with XP-Mode.

Related issues:

Cisco VPN, Windows 7 and eToken
Website Authentication, Windows 7 and eToken

Windows 7 UAC whitelist: Code-injection Issue

July 14th, 2009 No comments

Interesting insights on the new Windows 7 UAC… (http://www.pretentiousname.com/misc/win7_uac_whitelist2.html)

Win 7 UAC Code-Injection: Summary

On 5th February 2009 I wrote a proof-of-concept program to demonstrate a security flaw in Windows 7′s UAC, under default settings with beta build 7000 (also confirmed on 7022). This simply copied a file to Program Files without the user’s consent. In other words, it performed a file copy to a protected location, bypassing UAC.

“So what? All it does is copy a file?”

On 9th February 2009, to show the implications of being able to copy to System32 and Program Files, I created a second proof-of-concept program which uses the original exploit to open up a hole which in turn allows it to run any command or program with full elevation without itself requiring elevation or the user’s consent.

All of this is done without using the SendKeys or RunDll32 holes which were found earlier in February. It is done using a method which can attack almost any Windows executable and which is inherent to the changes Microsoft have made to UAC in Windows 7.

The proof-of-concept works on unmodified installs of Windows 7 beta build 7000 (and confirmed on 7022), both 32-bit and 64-bit versions, at default settings.

Setting UAC to its highest level, or using a non-admin account, will prevent the proof-of-concept from working by forcing it to display a UAC prompt. However, neither of those are defaults in the current Windows 7 betas.

As well as discussing the proof-of-concept code I argue that:

  • Microsoft should either admit that local process elevation is a problem and make Windows 7 more secure by default or admit that the Windows 7 default UAC settings are security theater (as they offer no protection) and anti-competitive (as they are inflicted on third-party code despite local elevation supposedly being a non-issue).
  • If there is to be a UAC whitelist, or the equivalent of one, then it should be up to the user which Microsoft and third-party software is on it. Users should not be forced to expose themselves to risks from software they do not use. Conversely, if reducing UAC prompts in frequently-used software is needed to stop people disabling UAC entirely then that applies to third-party software as much as to bundled software (especially once a machine is past the “setup” phase).
  • UAC itself was a good API and a good design that was given a bad name because of the way it was used by Microsoft’s application-level code (such as Explorer and Control Panel). Accordingly, the user experience of having UAC enabled could have been vastly improved by changing the application-level code without opening a huge hole in UAC.
  • Microsoft created these problems themselves and, rather than fixing them properly, have taken the easy way out, unnecessarily making UAC less secure in the process. At the same time Microsoft expect third-party vendors to do a better job than they bothered to do using the API which they themselves designed.

If you’re already shouting, “But it’s only a beta!” then there’s a section for you, too. :-)

And, for the record, I like Windows and much of what Microsoft do, in general. I even like UAC (the API, not the way it has been used). I wrote this page because I care about the platform not because I get a kick out of attacking something Microsoft have done. I call things as I see them. I attack and criticise some of what Microsoft do and I support and defend Microsoft other things that they do.

From: http://www.pretentiousname.com/misc/win7_uac_whitelist2.html

List of binaries which are allowed “auto-elevation” :

http://www.withinwindows.com/2009/02/05/list-of-windows-7-beta-build-7000-auto-elevated-binaries/

Windows 7 Pricing revealed!

June 25th, 2009 2 comments

The full version of Windows 7 Home Premium is priced at $199, with an upgrade from Vista or XP costing $119. The full version of Windows 7 Professional is $299, with upgrades going for $199. Windows 7 Ultimate is priced at $319, with the upgrade version at $219. In what’s perhaps a nod to the recession and increased competition in the software market, the prices are about 10% less than what Microsoft charged for the corresponding versions of Windows Vista when that product shipped in January of 2007.

More here: http://www.informationweek.com/news/windows/operatingsystems/showArticle.jhtml?articleID=218101310&subSection=All+Stories

Windows 7 / Win 2008 R2 RTM at July 13th!

June 24th, 2009 No comments

From: http://bink.nu/news/windows-7-windows-server-2008-rtm-set-for-july-13th.aspx

4 days earlier then I had in my previous schedule, Microsoft has now set July 13th for RTM “sign-off”

Sign off is the process where all divisions sign that they agree on the final code, which means the actual RTM build will be created a few days earlier, which is targeted on July 10th.

The general availability (GA) is set to October 22nd, this is when you can buy it in stores in a box or on new PC’s (OEM).

We can expect the RTM much earlier on MSDN, Technet and Volume Licensing download sites, probably a few days after July 13th.

Lenovo Windows 7 Drivers

June 12th, 2009 3 comments

Lenovo has made BETA windows 7 drivers available to the general public. I use some of them on Windows 7 RC1 without issues… but remember it’s still beta…

You can find them here.

Categories: Lenovo, Windows 7 Tags: , ,

Windows 7 to launch October 22

June 10th, 2009 1 comment

Microsoft confirmed on Tuesday that it is planning for Windows 7 to hit retail shelves and start showing up on new PCs on October 22.

To reach that milestone, Microsoft plans to wrap up development of the operating system by the middle or end of next month, Senior Vice President Bill Veghte said in an interview.

“The feedback from the release candidate has been good,” Veghte said.

Microsoft made the near-final release candidate version available last month. Shortly after its release, Microsoft finally confirmed that it was aiming Windows 7 for a holiday 2009 release, something that was widely anticipated, but not confirmed by those in Redmond.

In an interview, Phil McKinney, chief technology officer of Hewlett-Packard’s computer unit, said that he feels good about Microsoft’s launch date.

“We’re locked and loaded for the launch,” McKinney said. “The quality of code is just absolutely stellar.”

The software maker also confirmed, without giving details, that it plans to offer some sort of “technology guarantee” giving those who buy Vista machines close to the Windows 7 launch a free or discounted copy of the new operating system. As with past similar programs, details on pricing will be up to individual computer makers, although Microsoft did say the upgrade program will apply to Vista Home Premium and higher-priced editions (meaning not Windows Vista Basic).

The tech guarantee program is not beginning immediately, but Microsoft did raise the possibility it will offer some sort of lower-cost upgrade to those who are already using Windows Vista.

From: http://news.cnet.com/8301-13860_3-10253924-56.html

Categories: Microsoft, Windows 7 Tags: , ,