Michael 's Public Library

Offline domain join makes it possible for the virtual machines to be joined to the domain when they initially start after the installation of the operating system.
Windows System Image Manager
4 more annotations...
- The computer that you want to join to the domain must also be running Windows 7 or Windows Server 2008 R2
- /downlevel parameter
- The offline domain join process includes the following steps:
- Performing an offline domain join using different physical computers

07 Nov 09

70 Fantastic Windows 7 Tips & Tricks For Better Functionality - Gnoted.com

gnoted.com/ricks-for-better-functionality - Preview

Windows 7

image burning in Windows
We all had trouble with image burning in Windows, because
9 more annotations...
- We all had trouble with image burning in Windows
- We all had trouble with image burning in Windows, because
- Burn Images
- We all had trouble with image burning in Windows
- Dock The Current Windows To The Left Side Of The Screen
- Display Or Hide The Explorer Preview Panel
- Activate The Quick Launch Toolbar
- Create A New Instance Of The First Icon In The Taskba
- Start Windows Explorer From My Computer

Keith Combs' Blahg : Windows 7 Dual Boot Revisited with Bitlocker

blogs.technet.com/...-revisited-with-bitlocker.aspx - Preview

Excellent Windows 7 tip: Drag and drop file associations - SuperSite Blog

community.winsupersite.com/...nd-drop-file-associations.aspx - Preview

yet, but it does appear t

01 Aug 09

Microsoft: European XP and Vista users to get the ballot screen, too | All about Microsoft | ZDNet.com

blogs.zdnet.com/microsoft - Preview

I wonder if these caveats will mean Opera, the company that brought the antitrust case against Microsoft in Europe, would make onto the ballot screen?

Microsoft kills Windows 7 E Editions - SuperSite Blog

community.winsupersite.com/...ills-windows-7-e-editions.aspx - Preview

Those who pre-ordered Windows 7 "E" through a recent discount

heise online - 01.08.09 - Windows 7 mit IE und Auswahlfenster

www.heise.de/...142916 - Preview

nun doch keine spezielle Europa-Version anbieten. Wie der Konzern mitteilte
europäischen Wettbewerbshüter auf den ballout screen und die Bedenken der Computerhersteller und Reseller gewesen.
2 more annotations...
- Vista-Nutzer müssen den neuen Plänen nach ihr Betriebssystem nicht komplett neu aufsetzen.
- Anwender, die bereits Windows 7 E reserviert haben, erhalten wie versprochen am 22. Oktober zum Upgrade-Preis eine Vollversion von Windows 7

22 Jul 09

When will you get Windows 7 RTM? - Windows 7 Team Blog - The Windows Blog

windowsteamblog.com/...ill-you-get-windows-7-rtm.aspx - Preview

when different groups of people – or “audiences”
In fact, you can continue to use it until it expires on June 1st, 2010 (expiration actually starts March 1, 2010, this is when the reboots start).
1 more annotations...
- October 22nd.

04 Jul 09

Ask the Directory Services Team : Getting Over Replmon

blogs.technet.com/...getting-over-replmon.aspx - Preview

Windows administrators are much more comfortable with the command-line

24 Jun 09

Microsoft Security Essentials not quite a must-have | The Download Blog - Download.com

download.cnet.com/8301-2007_4-10271088-12.html - Preview

Security Essentials will probably strike you as an incredibly similar experience
shockingly small memory footprint

16 Jun 09

Mark's Blog : PsExec, User Account Control and Security Boundaries

blogs.technet.com/...638372.aspx - Preview

Given these holes, why do I still recommend using the PsExec feature to run processes with limited rights on Windows XP if you would rather use an administrator instead of standard user account? Because this type of sandbox has not been commonly used, malware authors haven’t bothered with writing the code necessary to escape and so they run into the walls.
Over the Shoulder – OTS - elevation
8 more annotations...
- Admin Approval Mode – AAM - elevation
- Processes elevated from a standard user account run in a different account from those with standard user rights, so the Windows security model defines a wall around the elevated process that prevents the non-elevated processes from writing code into those that are elevated
- However, let’s be clear that no matter how difficult to pull off, the mere possibility of such a breach of a sandbox wall implies that ILs, in and of themselves, do not define security boundaries.
- What’s a security boundary? It’s a wall through which code and data can’t pass without the authorization of a security policy.
- It should be clear then, that neither UAC elevations nor Protected Mode IE define new Windows security boundaries.
- Microsoft has been communicating this but I want to make sure that the point is clearly heard.
- Because elevations and ILs don’t define a security boundary, potential avenues of attack , regardless of ease or scope, are not security bugs.
- So if you aren’t guaranteed that your elevated processes aren’t susceptible to compromise by those running at a lower IL, why did Windows Vista go to the trouble of introducing elevations and ILs? To get us to a world where everyone runs as standard user by default and all software is written with that assumption.

User Account Control: Inside Windows 7 User Account Control

technet.microsoft.com/...2009.07.uac.aspx - Preview

the security configuration of the system, including antivirus and firewall, is protected.
To both enable more software to run with standard user rights and to help developers write applications that run correctly with standard user rights, Windows Vista introduced User Account Control (UAC).
40 more annotations...
- UAC is a collection of technologies that include file system and registry virtualization, the Protected Administrator (PA) account, UAC elevation prompts, and Windows Integrity levels that support these goals.
- I'll cover the motivations behind UAC's technologies, revisit the relationship between UAC and security, describe the two new modes, and explain how exactly auto-elevation works.
- This change alone enables many enterprises to configure traveling users with standard user accounts, because users can adjust the time zone to reflect their current location.
- Any programs a PA user executes are run with standard-user rights unless the user explicitly elevates the application, which grants the application administrative rights.
- When UAC is enabled, all user accounts—including administrative accounts—run with standard user rights.
- This should remind them to design their application to work with standard user rights.
- Elevation prompts also provide the benefit that they "notify" the user when software wants to make changes to the system, and it gives the user an opportunity to prevent it. For example, if a software package that the user doesn't trust or want to allow to modify the system asks for administrative rights, they can decline the prompt.
- The primary goal of UAC is to enable more users to run with standard user rights.
- owever, one of UAC's technologies looks and smells like a security feature:
- Many people believed that the fact that software has to ask the user to grant it administrative rights means that they can prevent malware from gaining administrative rights
- User Interface Privilege Isolation (UIPI)
- As we've stated since before the launch of Windows Vista, the primary purpose of elevation is not security, though, it's convenience:
- The main reason for the switch to a different desktop for the prompt is that standard user software cannot "spoof" the elevation prompt,
- The alternate desktop is called a "secure desktop,"
- protective barrier around elevated applications. One of its original goals was to prevent software developers from taking shortcuts
- Windows Integrity Mechanism and UIPI
- An application running with standard user rights cannot send synthetic mouse or keyboard inputs into an elevated application to make it do its bidding or inject code into an elevated application to perform administrative operations.
- While it was an early design goal of Windows Vista to use elevations with the secure desktop, Windows Integrity Mechanism, and UIPI to create an impermeable barrier—called a security boundary—between software running with standard user rights and administrative rights, two reasons prevented that goal from being achieved, and it was subsequently dropped:
- First, consider the elevation dialog itself.
- software that isn't signed,
- which makes it possible for malware already running in a users account and that's watching for an elevation of an unsigned Setup.exe application installer, for example, to replace the executable with a malicious Setup.exe without the user being able to tell
- Second, the dialog doesn't tell the user what DLLs the executable will load once it starts.
- Malware could take advantage of that sharing to hijack a shared memory object used by an elevated application, for instance, to compromise the application and then the system.
- As for the Windows Integrity Mechanism, its effectiveness as a barrier is limited by the elevation issues I've mentioned,
- For one
- So, how much malware protection do you get when you run in a Windows Vista PA account with UAC enabled?
- Remember, though, if malware does start running, it can accomplish most of the things that malware wants to do with just standard user rights, including configuring itself to run every time the user logs on, stealing or deleting all the user's data, or even becoming part of a botnet.
- However, elevation prompts don't educate or encourage us to do so, but they do force users to click a second time through a dialog that the vast majority of users don't read. Windows 7, therefore, set out to minimize those prompts from the default Windows experience and enable users that run as administrators to control their prompting experience.
- "Can an application developer inadvertently or trivially depend on administrative rights by leveraging auto-elevate?"
- provide a way to add arbitrary applications to the auto-elevate list since the Windows Vista beta.
- but the risk is too high that developers will avoid fixing their code to work with standard user rights.
- developers might simply change their application setup program, which requires a one-time elevation, to add their application to the list.
- We've instead chosen to invest in educating and working closely with application developers to ensure their programs work correctly as a standard user.
- Several people have observed that it's possible for third-party software running in a PA account with standard user rights to take advantage of auto-elevation to gain administrative rights.
- While true, these steps require deliberate intent, aren't trivial, and therefore are not something we believe legitimate developers would opt for versus fixing their software to run with standard user rights.
- The follow-up observation is that malware could gain administrative rights using the same techniques.
- Again, this is true, but as I pointed out earlier, malware can compromise the system via prompted elevations as well.
- From the perspective of malware, Windows 7's default mode is no more or less secure than the Always Notify mode ("Vista mode"), and malware that assumes administrative rights will still break when run in Windows 7's default mode.
- one overall goal: to make it possible for users to run as standard users.
- and still accomplishes UAC’s goals of enabling more software to run without administrative rights and continuing to shift the software ecosystem to write software that works with standard user rights.

13 Jun 09

Working to Fulfill our Legal Obligations in Europe for Windows 7 - Microsoft On The Issues

microsoftontheissues.com/...s-in-europe-for-windows-7.aspx - Preview

Given the complexity and competing interests, we don’t believe it would be best for us to adopt such an approach unilaterally.

24 May 09

Security Watch: Why You Should Disable the Administrator Account

207.46.16.252/...2006.01.securitywatch.aspx - Preview

builtin

Using that hash, the attacker could then authenticate to any of the other systems that use the same password. Plus, if the password used on the built-in Administrator account on the domain is the same as the one used on all the domain members, the problem can get truly disastrous.
The built-in Administrator account should never be used during normal operations
8 more annotations...
- Set a Unique Password
- passgen
- By default, blank passwords can only be used locally in Windows XP and Windows Server 2003.
- a blank password is better than a weak password
- Don’t Use It Seriously.
- Don’t Rename It
- No attacker worth his salt
- There are abundant tools

21 May 09

How to Restore Deleted Machine accounts\Active Directory ADRESTORE\Unicode-pwd\searchFlag - Windows Live

edmckinzie.spaces.live.com/...cns!687C72A5909E4230!232.entry - Preview

By changing the value of the searchFlag attribute on the Unicode-pwd

Windows Server: Reanimating Active Directory Tombstone Objects

technet.microsoft.com/...cc137800.aspx - Preview

Installing certain applications
Exchange Server
3 more annotations...
- even if you specify to do so in the searchFlags attribute of the schema object.
- Active Directory will not save forward-linked or backward-linked attributes in the tombstone
- Thus tombstone reanimation doesn't provide a solution for recovering group memberships in Active Director

Michael 's Public Library

The Windows 7 Troubleshooting Platform - Windows Vista could have used this level of advanced troubleshooting - Softpedia

4sysops

Software Q-Dir 3.95 makes your files and folder easy to manage.

Here's what's different about 'the cloud' - Plug Into The Cloud - InformationWeek

Offline Domain Join (Djoin.exe) Step-by-Step Guide

70 Fantastic Windows 7 Tips & Tricks For Better Functionality - Gnoted.com

Keith Combs' Blahg : Windows 7 Dual Boot Revisited with Bitlocker

Excellent Windows 7 tip: Drag and drop file associations - SuperSite Blog

Microsoft: European XP and Vista users to get the ballot screen, too | All about Microsoft | ZDNet.com

Microsoft kills Windows 7 E Editions - SuperSite Blog

heise online - 01.08.09 - Windows 7 mit IE und Auswahlfenster

When will you get Windows 7 RTM? - Windows 7 Team Blog - The Windows Blog

Ask the Directory Services Team : Getting Over Replmon

Microsoft Security Essentials not quite a must-have | The Download Blog - Download.com

Mark's Blog : PsExec, User Account Control and Security Boundaries

User Account Control: Inside Windows 7 User Account Control

Working to Fulfill our Legal Obligations in Europe for Windows 7 - Microsoft On The Issues

Security Watch: Why You Should Disable the Administrator Account

How to Restore Deleted Machine accounts\Active Directory ADRESTORE\Unicode-pwd\searchFlag - Windows Live

Windows Server: Reanimating Active Directory Tombstone Objects

Top Tags

Public Tags (34)

Michael 's Public Lists (0)