Re-Apply Windows Theme to existing Users

The windows theme can be managed with GPO , but this setting only takes effect if the user has no profile.

This is because the theme is set using an active setup execution, once execeuted once its tagged and it not run again.

If we want to set a theme for existing users who already have profiles we need to run the code contained in the RUN key.

%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

This will then adhere to the theme settting within group policy.

Appsense Control The Windows 7 Start Menu

Personalize the windows 7 Start Menu with Appsense

The Start Menu allows for Shortcut Icons to be delivered to All Users or  Per User.
It also allows for users to PIN their favourite shortcuts to either the start menu or taskbar or both.

All Users
Shortcuts are stored in C:\ProgramData\Microsoft\Windows\Start Menu

Per User Start Menu
Shortcuts are stored in C:\Users\%username%\AppData\Roaming\Microsoft\Windows\Start Menu

Pinned Items 
Pinned items are stored in the file system and the registry.

%AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

%AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband

Common Practice With Appsense Personalization

Pinned Items

Appsense Personalization has a option to save users Pinned items. This is called "TaskBar and StartMenu" under Windows Personalization. 

This saves the pinned icons to the Personalization database.

All Users

The all users icons are stored at a machine level and as such are not touched by Appsense. This can potentially be an issue for licensed software. In this event ideally software packages should not deploy application icons and the icons can be delivered with an appsense EM policy.  I think that only software that has a user based license control should have its icons delivered with a policy. There is an overhead in managing icons this way and so keeping this to a minimum keeps your system optimised. Obviously Appsense AM can also perform more application control than simply not giving a user an icon as mentioned here. 

Per User

If Per user shortcuts are to be persisted then there are two options.
Redirection of the users Start Menu is the most common. Simply use Policy to redirect the users start menu to a network location. 

An alternative then is to use a logon and logoff trigger to mirror the location to a network share
To Cater for Offline use case the Offline Files option on the redirection can be used. This keeps a copy of the redirected files in C:\windows\csc. 

SDelete to remove Free space in Virtual Desktop

The SDELETE tool from sysinternals at Microsoft removes freespace within a windows image.

This can be very handy in virtual machine environments where we clone machines and are tight on disk-space.

Download SDelete from here
http://technet.microsoft.com/en-gb/sysinternals/bb897443.aspx

Run the command

Sdelete -c -z C:  

It also a good practive to run this on a regaular basis to claim back space from deleted files. 

Apple Magic Mouse on Windows 7 or 8 PC

To get the full functionality of a Apple Magic mouse on your windows PC (like scroll up and down) you need to install the correct driver for the device.

Magic Mouse Driver Down

This ZIP file contains the 32 and 64 bit version of the driver. 

Unzip and run DPInst.exe

I also wanted to use the Apple cable attached keyboard on my PC. This worked apart from the volume and function keys. I resolved this by downloading a free tool called AppleWirelessKeyboard.exe and this corrected the keyboard problems.

My Setup now. Shame about the cables i know i will get them cable tied at some point.

McAfee Remove Uniqueness

When using gold images we commonly need to remove uniqueness in order to allow the image to be cloned multiple times.

The following is the process to remove the uniqueness from McAfee

Stop the following Services
McAfeeEngineService
McAfeeFramework
Mcshield
McTaskManager
mfevtp

Remove the following registry values under
HKLM\Software\Network Associates\ePolicy Orchestrator\Agent

AgentGUID
ComputerName
IPAddress
LoggedOnUser
MacAddress
SubnetAddress
SubnetMask

PHD Virtual Machine Backups

I had a webcast with PHD Virtual last week on their  VM backup and DR solution.

Lets start on price they promise to be considerably cheaper than their direct competitor Veeam.

PHD Virtual Backup
Their backup solution uses a virtual appliance per host to backup all the Virtual machines on that host.
It performs inline de-dup on the data to save on storage. It is licensed per socket for Vmware or Per Guest on XenServer.
It has an additional connector component that allows backups to cloud storage providers like Amazon S3 and Rackspace. This feature i like for SMB market as they can quickly achieve offsite backups without much admin effort.

PHD Virtual Reliable DR
They also offer a DR solution that replicates the storage and Virtual machine information between sites. Rules can then be setup to manage failover in the event of machine loss at a primary site. This solution would again allow SMBs with only a single data centre to have a fully functional DR site in the cloud.
This solution requires more admin effort and resource, but once setup it is an automated solution that would kick in without admin intervention.  This DR site can also be scheduled to be tested on a frequent basis , something that is often quite hard to achieve with native tools.

http://www.phdvirtual.com/

Change the System Locale from command line or appsense

The following method can be used in conjuction with scripts or Appsense Environment Manager to manage a system Regional Locale, Location, Format and language settings.

We basically need to create a XML file with the required settings and then use the Control.exe to read and apply the XML file. 

Then run
Control.exe intl.cpl ,,/F:"c:\yyyy.xml"

 

XML file example for setting the English UK

full information
http://msdn.microsoft.com/en-ie/goglobal/bb964650%28en-us%29.aspx

GeoID Table
http://msdn.microsoft.com/en-us/library/dd374073.aspx

VMWare Mirage Windows 7 Migration - Settings that migrate

VMWare Mirage uses the Microsoft USMT to perform simple hands off migrations of users Windows XP machines to Windows 7. 

This migration technique migrates a number of user settings. 

The following are the default settings that are migrated with the tool.

• Accessibility settings
• Address book
• Command-prompt settings
• Desktop wallpaper (not migrated when using offline backup)
• Encrypting File System (EFS) files
• Favorites
• Folder options
• Fonts
• Group membership
• Internet Explorer settings (not migrated when using offline backup)
• Microsoft ODBC settings
• Mouse and keyboard settings
• Network drive mapping
• Network printer mapping (not migrated when using offline backup)
• Offline files (not migrated when using offline backup)
• Phone and modem options (not migrated when using offline backup)
• Remote Access Service (RAS) connection and phone book (.pbk) files
• Regional settings (not migrated when using offline backup)
• Remote Access
• Taskbar settings (not migrated when using offline backup)
• Windows Mail (Microsoft Outlook Express Mail, or .dbx, files are migrated from Windows XP)
• Windows Media Player (not migrated when using offline backup)
• Windows Rights Management

The following article has some good information on the USMT tool

http://technet.microsoft.com/en-us/magazine/jj127984.aspx

Remove Safely Remove Hardware option from Virtual Desktop

My windows 7 Virtual Machines hosted on VMWare ESX 5.0 were showing users a "Safely Remove Hardware" Prompt in their systray.

This showed the NICs and the Harddisk as removal devices.

If the users click to remove the NICs they remove and lose their connection.
The hard disk cannot be removed as its in use.

To remove this un-required icon perform the following action for VMware ESX environments.

Click the VM, Select Edit Settings, Click Option, Click General under the advanced section.

Click Configuration parameters and click “Add Row” enter devices.hotplug and a value of false

Click OK and click OK to save the changes.

Symbolic Links and Junction Points

In order to re-direct folders to another location or drive symbolic links can be used.
Windows 7 by default already does this to manage some legacy directories like AllUsers being moved to ProgramData

Create a symbolic Link
MKLINK /J C:\thisfolder D:\thisfolder

The source folder must not exist and the target folder must exist.

Search for Symbolic Links
dir /aL /s C:\

More information is in this WIKI article http://en.wikipedia.org/wiki/NTFS_junction_point

Customising the Windows Logon Screen

A Nice touch for Windows 7 Deployments is to customise the logon screen with your corporate look and feel. This can be achived with the following process.

LockScreen Background
Add the registry key OEMBackground (REG_DWORD) value 1
to the path
HKLM\software\microsoft\windows\currentversion\authentication\loginui\background

Create a JPEG and name it backgrounddefault.jpg and place it in the folder

C:\Windows\System32\oobe\info\Backgrounds
 
The file should not be larger the 256KB , and will be stretched to fit users screen.

User Icon
The default user icon is a flower. To change this replace the following file with a design of your own choice.

C:\programdata\microsoft\User Account Pictures\user.bmp

Remove Windows Branding 
To go a stage further and remove the Windows 2008 or Windows 7 Logo you can hack the branding DLL that displays this image.

To perform this take ownership and give admins permission to the file

C:\Windows\Branding\Basebrd\basebrd.dll

Then edit this DLL with a tool like Resource Hacker , and remove the bitmaps for the windows logos.

Published desktop Clock not displaying

Some GPO's lockdown to taskbar prevent users from seeing the clock in the bottom right. 
If so the folowing reg key can enable the clock again for users.


Deploy with GPO preferences or whatever your favourite reg poker is.


HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\StuckRects2

You'll see a "Settings" value, which contains something like this: 
28 00 00 00 ff ff ff ff 02 00 00 00 03 00 00 00 6d 00 00 00 20 00 00 00 00 00 00 00 e0 03 00 00 00 05 00 00 00 04 00 00

The nineth pair of digits determines the Taskbar properties. Possible values are: 
Always on top = 0x02 
Auto hide = 0x01
Show small icons in Start menu = 0x04
Hide clock = 0x08

Combine the properties you want and set the byte. For example: 
Always on top + Show small icons + Show clock = 06 
Always on top + Show small icons + Hide clock = 0e

Note that the changes do not take effect immediately, you have to restart Explorer, or logoff and logon again to see the changes. 

Windows 7 Tuning Registry Keys

I found the following bunch of keys on a article i read. I have not had time to test if these work as expected, or if they also work in Server 2008.
The timeout ones for applications look handy as shutdowns on Win7 and Server 2008 do seem to be slower than prior operating systems.


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

"NoLowDiskSpaceChecks"=dword:00000001
"LinkResolveIgnoreLinkInfo"=dword:00000001
"NoResolveSearch"=dword:00000001
"NoResolveTrack"=dword:00000001
"NoInternetOpenWith"=dword:00000001
[HKEY_CURRENT_USER\Control Panel\Desktop]
"AutoEndTasks"="1"
"HungAppTimeout"="1000"
"MenuShowDelay"="0"
"WaitToKillAppTimeout"="2000"
"LowLevelHooksTimeout"="1000"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control]
"WaitToKillServiceTimeout"="1000"



[HKEY_CURRENT_USER\Control Panel\Desktop]
"AutoEndTasks"="1"
"HungAppTimeout"="1000"
"MenuShowDelay"="0"
"WaitToKillAppTimeout"="2000"


NoLowDiskSpaceChecks = Low Disk Notification
deactivated

LinkResolveIgnoreLinkInfo = Determines whether Windows traces shortcuts back
to their sources when it cannot find the target on the user's system.

NoResolveSearch = Prevents the system from conducting a comprehensive search
of the target drive to resolve a shortcut.

NoResolveTrack = Prevents the system from using NTFS tracking features to
resolve a shortcut.

NoInternetOpenWith = Specifies whether to use the Microsoft Web service
for finding an application to open a file with an unhandled file association.

AutoEndTasks = Specifies whether user processes end automatically when
the user either logs off or shuts down Windows .

HungAppTimeout = Specifies how long the system waits for user
processes to end after the user clicks the End Task command button in
Task Manager.

MenuShowDelay = Specifies the interval from the time the cursor is
pointed at a menu until the menu items are displayed.

WaitToKillAppTimeout = Specifies how long the system waits for user
processes to end after the user attempts to log off or to shut down
Windows. When the time specified in this entry expires, the End
Task dialog box appears, stating that the process did not respond.
If the value of AutoEndTasks is 1, the system ends the process
automatically.

LowLevelHooksTimeout = This tweak changes the time to wait to kill
a service, which is not responding

WaitToKillServiceTimeout = Determines how long the system waits
for services to stop after notifying the service that the system is
shutting down.

Windows 7 Control Panel Lockdown with GPO

Im working on a Control Panel Lockdown for Windows 7 via GPO

The following is a useful resource Im using at present. I will post a decent article once ive completed the work.

http://msdn.microsoft.com/en-us/library/ee330741(VS.85).aspx

Windows 7 SSD Tweaks

The following are some tweaks i used on my Windows 7 SSD build. I have only had this running for a few hours so far but will report back if theres any issues or improvements,


Disable indexing
Description: Indexing creates and maintains a database of file attributes. This can lead to multiple small writes when creating/deleting/modifying files. Searching for files will still work.
Instructions: Start Menu -> Right-Click Computer -> Manage -> Services and Applications -> Services - > Right-Click Windows Search -> Startup type: Disabled -> OK

Disable defragmentation
Description: Defragmenting a hard disk's used space is only useful on mechanical disks with multi-millisecond latencies. Free-space defragmentation may be useful to SSDs, but this feature is not available in the default Windows Defragmenter.
Instructions: Start Menu -> Right-Click Computer -> Manage -> Services and Applications -> Services - > Right-Click Disk Defragmenter -> Startup type: Disabled -> OK

Disable Write Caching
Description: There is no cache on the SSD, so there are no benefits to write caching. There are conflicting reports on whether this gains speed or not.
Instructions: Start Menu -> Right-Click Computer -> Manage -> Device Manager -> Disk drives -> Right-Click STEC PATA -> Properties -> Policies Tab -> Uncheck Enable write caching -> OK

Configure Superfetch
Description: Frees up RAM by not preloading program files.
Instructions: On second glance, I would recommend leaving this one alone. However, there are some customizations that you can follow in the post below.

Firefox - Use memory cache instead of disk cache
Description: If you use Firefox, there's a way to write cached files to RAM instead of the hard disk. This is not only faster, but will significantly reduce writes to the SSD while using the browser.
Instructions: Open Firefox -> Type about:config into the address bar -> Enter -> double-click browser.cache.disk.enable to set the value to False -> Right-Click anywhere -> New -> Integer -> Preference Name "disk.cache.memory.capacity" -> value memory size in KB. Enter 32768 for 32MB, 65536 for 64MB, 131072 for 128MB, etc. -> restart Firefox

Free up extra drive space
Disable the Page File
Description: Eliminate writing memory to the SSD, free over 2GB of disk space. Warning - If you run out of memory the program you're using will crash.
Instructions: Start Menu -> Right-Click Computer -> Properties -> Advanced System Settings -> Settings (Performance) -> Advanced Tab -> Change -> Uncheck Automatically manage -> No paging file -> Set -> OK -> Restart your computer
Alternatively, if you want to play it safer, you can set a custom size of 200MB min and max.

Disable System Restore
Description: Don't write backup copies of files when installing new programs or making system changes. Can free up between a few hundred MB to a couple GB. Warning - Although unlikely, if a driver installation corrupts your system, there won't be an automatic way to recover.
Instructions: Start Menu -> Right-Click Computer -> Properties -> Advanced System Settings -> System Protection Tab -> Configure -> Turn off system protection -> Delete -> OK